Input for the xbox one controller rapid fire

[RDC]

Those 'rectangle' looking ICs are just bumper pads for the Triggers so they don't hit the PCB, the Mylar silk is for them. They fool everyone at first glance.

U10 and U11 are the Halls, they are what make the voltage 1.5v (1.65v actual) as the Output of them is half of VDD. The ~1.5v measurement is what you'll get if the shell is together, as the Trigger get's pushed in a bit, thus the Magnet will sit a little bit closer to the Hall and do it's thing. If the Magnet is turned around, then the voltage will swing from 1.65v to VDD NOTE: This was done only as a test with the Hall removed from the controller.

The Trigger 'can' be disabled by forcing the line Hi.

[SethMods]

So the question is, has anyone tried forcing Vdd onto the RT line yet with the trigger pulled?

So...the Arbiter 4 is tied directly to the RC filter. (I think that's probably the most popular XB1 RF mod out...as there aren't many.) I do mine the same way and go all the way up to Vdd to force a trigger release. I literally have no idea if it's safe. It wouldn't surprise me if it wasn't.

[Hazer]

Then this should be real easy to rapidfire. I would be surprised if the old codes did not work.

Unless there is a problem with the timing of when the halls are pulsed on/off. If that was the case, you could simply use the same type of code that was used for the PD3 controllers where you just wait for that pulse, then run your logic.

[w02057]

Does it matter whether the PIC is connected directly to the RC filter or to the output pin of the hall sensor?

Forcing the output high to "force the trigger released" will probably work as Hazer and Seth have both said, but could be potentially damaging to the sensor / draw quite a bit of current.

[SethMods]

My (limited) experience was that when I soldered to the sensor side of the filter I couldn't source enough power to completely drive the trigger completely released. (I only saw this early on in my testing though as I quickly moved to the MCU side of the filter.)

That is to say "Your mileage may vary."

[w02057]

Ah yes I've just noticed on your o-scope screenshots that when the trigger is fully pressed the Vout voltage is about 0.25-0.3v so no wonder your PIC couldn't drive the line high when pressed.

That leaves soldering to the MCU side of the RC filter, which risks removing the resistor / capacitor all together if heated for too long whilst soldering.

I think I may have an idea for how you could still connect the PIC to the more accessible Vout pin, but it would require an extra PIC pin and be a little fiddly to pull off, but it would be much safer than potentially desoldering the resistor / capacitor.

[hotburn7]

if this can help you, I bought a chip, I'll forward the link to install the chip.
The chip uses 20 pin, but we only used 15.

i don't know what chip for now, I will give you the reference when I have received.

http://www.consolecustoms.com/dl/xone/xbox_one_maxfire-one_install_high_res.pdf

Good day.

[w02057]

if this can help you, I bought a chip, I'll forward the link to install the chip.
The chip uses 20 pin, but we only used 15.

i don't know what chip for now, I will give you the reference when I have received.

http://www.consolecustoms.com/dl/xone/xbox_one_maxfire-one_install_high_res.pdf

Good day.

Oh I wouldn't bother looking to that guy for inspiration, his method is very "amateur-ish" and he obviously has limited electronics knowledge.
He's connecting to the sensor side of the RC filter and is using two PIC pins to supply enough current to force the trigger into a released state when pressed. A PIC pin is limited to 25mA source and sink, so him using two pins suggests the trigger requires anything up to 50mA.
I'm sure Hazer will agree, forcing the Vout line of the hall sensor from 0.25v-0.3v to Vdd with the sensor having a minimal internal resistance to ground is a bad idea. With his two pin approach you could have anything from 26-50mA flowing through the sensor, it won't like you for that.

But hey it works so he's happy as he's been able to get his product to market quicker. But it would be interesting to see whether there will be a surge of refunds a few months down the line, when the hall sensors in people's controllers start to prematurely wear out.

[navydude]

Would it help to put a resistor in this location? is there a way to avoid the controller crapping out before its time? I am thinking of ordering from this guy as he is the only one selling chips at this time. I have several 12f683 chips from modding 360 controllers but not sure if they will work with this Xbox One controller. I have a programmer also but not really a code writer. If anyone has any input please come forth. Hazer ol master can you shed any new light on these yet?

[rapidfiremoddr]

I've been spending a lot of time tinkering with this. I've figured out that if you pull the trigger sensor node to 3v Vdd then it will simulate a trigger release and stay released. I'm trying to figure out how I can implement it such that I can release it when I want it today. As has been stated, the chip is not enough to pull it high.

Anyone gotten further on this?

[GrammatonKlerik]

In the course of my padhack I've done some analysis and SPICE simulation on what I believe are correct hall effect sensors used on the XB1 controller.  Since these are linear/ratiometric hall sensors, you can more or less treat them as a voltage source.  Looking through some datasheets it appears a common figure for absolute maximum current into/out of the Vout pin is 10mA.   With a trigger pulled, the Vout pin will be ~0.4V and if you put 3.3V on the other end of that RC filter you're going to dump 29mA into the sensor and that is no bueno.  Note this is also why that mod chip linked above uses two pins tied together to source that much current. It may work for a while but each time you do it you're stressing the part to an early grave.

So the good news is there IS an answer on how to get this to work.  The bad news is it will require cutting the trace that leads from the Vout pin to the RC filter and you will need two external components.   The most important component of the two is a unity gain op-amp which will isolate the sensor's output from the current you need to drive to get the line to go high.  The 2nd component is a series resistor going from your PIC output pin that ties to the MCU side of the RC filter to act as a voltage divider so that your 3.3V PIC output ends up at 1.45V to the MCU.

I've simulated all this in LTSpice using a the pulsed voltage for the 'Vhall' source and syncing it to a switch which connects it to the line after the RC filter and everything looks good.  Of course you'll still need to write the code which syncs up with the sensor's power-on interval and then do some checks every so often to see if the user is still pressing the button but that doesn't sound too complicated.

P.S.
Not bad for a first post amirite? 

[navydude]

So if i solder behind the resistor then i would be OK? Look at this picture and tell me if this would be right. The voltatge could then be dropped in half to 1.5v and be safe enough to use without damaging the sensor. Correct?

[rapidfiremoddr]

In the course of my padhack I've done some analysis and SPICE simulation on what I believe are correct hall effect sensors used on the XB1 controller.  Since these are linear/ratiometric hall sensors, you can more or less treat them as a voltage source.  Looking through some datasheets it appears a common figure for absolute maximum current into/out of the Vout pin is 10mA.   With a trigger pulled, the Vout pin will be ~0.4V and if you put 3.3V on the other end of that RC filter you're going to dump 29mA into the sensor and that is no bueno.  Note this is also why that mod chip linked above uses two pins tied together to source that much current. It may work for a while but each time you do it you're stressing the part to an early grave.

So the good news is there IS an answer on how to get this to work.  The bad news is it will require cutting the trace that leads from the Vout pin to the RC filter and you will need two external components.   The most important component of the two is a unity gain op-amp which will isolate the sensor's output from the current you need to drive to get the line to go high.  The 2nd component is a series resistor going from your PIC output pin that ties to the MCU side of the RC filter to act as a voltage divider so that your 3.3V PIC output ends up at 1.45V to the MCU.

I've simulated all this in LTSpice using a the pulsed voltage for the 'Vhall' source and syncing it to a switch which connects it to the line after the RC filter and everything looks good.  Of course you'll still need to write the code which syncs up with the sensor's power-on interval and then do some checks every so often to see if the user is still pressing the button but that doesn't sound too complicated.

P.S.
Not bad for a first post amirite? 

Very helpful. Where is this trace from the Vout pin to the RC filter exactly?

[SethMods]

So if i solder behind the resistor then i would be OK? Look at this picture and tell me if this would be right. The voltatge could then be dropped in half to 1.5v and be safe enough to use without damaging the sensor. Correct?

I don't think anyone knows for sure, but you have a lot of feedback from a lot of electrical experts here (myself very much excluded...as I am more of a programmer) that seem to indicate you are likely to damage the hall unless you cut the trace and add some circuitry to completely isolate the hall from the output of the PIC. (...even if you connect on the far side of the filter to help minimize the current going to Vout of the Hall.)


With that said my two cents is that all of this modding of controllers entails some amount of risk. (Risk that you might get caught, risk that you might damage something in the installation, risk that the mod might damage something over time.) Me personally I'm going to keep playing around with this until something does break. And when that happens I'm going to try to repair it and go at it again. (Again just my two cents. You have to decide for yourself what you want to do.)


rapidfiremoddr, if you look at the picture that navydude posted on the left side you will see two solder points for the RT. The red indicates Vout for the Hall sensor (that 3 legged chip). The beige represents the far side of the filter (made up by those tiny parts, a resistor and a capacitor). The trace goes between those two. It is the only trace connected to Vout.

GrammatonKlerik, it was indeed a very nice first post. You are giving a lot of us too much credit though. It'd be really nice if you submitted some part numbers and a schematic of what you expected would work. Guys like me can't even spell Op-Amp.

[rapidfiremoddr]

I tried using a unity gain op amp, but it was still not enough to keep it pulled up. I'm running out of ideas.

[SethMods]

That's odd. I don't seem to have a problem with a 12f683. I'll see if I can get some screenshots.

Ok, I got some screenshots.
First, a little disclaimer. This is my modified XBox360 code, so it is sync'd on the read to know when to read the triggers, but for output it doesn't care. It outputs all the time. It's already been mentioned how dangerous this is.


This is what Vout looks like normally with the trigger released.



This is me driving it around 20 shots per second.



I'd be interested to hear what chips people are using that they are having a problem.

I guess I should also mention that I am reading these signals at the PIC from the MCU side of the filter where I am connected.

[GrammatonKlerik]

First off, I want to reiterate what SethMods just said because it's the straight up truth.  Proceed at your own risk, these are uncharted waters we are swimming in.

With that said my two cents is that all of this modding of controllers entails some amount of risk. (Risk that you might get caught, risk that you might damage something in the installation, risk that the mod might damage something over time.) Me personally I'm going to keep playing around with this until something does break. And when that happens I'm going to try to repair it and go at it again. (Again just my two cents. You have to decide for yourself what you want to do.)

Everything I'm posting below is just simulation.  I actually have no desire to do a rapidfire mod, I was only interested in a padhack to get my fightstick to work on the XB1.  Pulling the line low to register a press is a much easier feat than driving it high because you only have to drop the line to ~1.25V (400mV drop) for it to register a button press (at least in fighting games like KI.)  Forcing it high on the other hand means you have to go from 0.4V all the way up to 1.45V (~1V swing.)  Even though I have no interest in rapid fire I thought I would see if I could solve this issue.  For one thing I owe this site a great deal of gratitude for the really in-depth PCB scans and o-scope traces from RDC and SethMods; so this is me giving back as much as it is a cool problem to solve.


First, here is a schematic and resulting simulated waveform of when you hook up your PIC pin to the RC filter through a 180ohm resistor.   This is not nearly as good as the op-amp method (which is shown below) but it actually gets you pretty close to the limit of what the sensor can do at 10.5mA (this is assuming 10mA really is the limit, I've seen ones go down as low as 5mA.)  I should also note that the 10mA spec is for absolute max output current and I'm assuming this is also the limit for how much current it can sink; I may be completely off base with this assumption and the sinking current value through the output pin might be way, way lower.  The 180 resistor is there because you don't need to drive the line to 3.3V to release the trigger, you just need to go to 1.45V.  I also just guessed at the value of the filter cap to be 1uF, it might be much smaller.  I choose 1uF because it gave a cutoff frequency 10x greater than the 125Hz VCC line going into the sensor.



Here are the resulting waveform.  Vmcu is what the signal looks like going into the XB1's MCU.  You can see that my simulated input (Vhall) shows what you should see if the user pressed and held the trigger down on the 2nd cycle.  My simulated PIC pin via the switch (Vswitch) then forces every other pulse to 1.45V so that the XB1 registers a trigger release followed by a pull.  I wasn't sure if the XB1 would count multiple hits during a single frame so I went with this method instead.  Since I'm skipping every other frame, the max trigger pull rate is 62 trigger pulls/second; I'm going to guess that is more than adequate.



Now here is the schematic with an op-amp.  I choose an LTC1152 because it can be supplied by a single 3V source, it's high speed and it's designed for exactly this type of application, i.e. a unity gain buffer.  Here is the datasheet for it.  The simulation also shows we need a much lighter series resistance of 400 ohms to get to 1.4V.




And finally here is what the output looks like with the op-amp in place.  All but the current going into the sensor I(Vhall) waveform looks more or less identical before we put the op-amp in; which is exactly what we want. Instead of shoving 10.5mA down the throat of the sensor, we reduce that by 6 orders of magnitude to 10 nanoamps!



P.S.
LTSpice is 100% free.  It used to be a cost product but then Linear Technologies bought it to give away for free to use as a marketing tool.  No surprise that LTSpice has very detailed spice models for everything Linear makes.  There are plenty of online tutorials if SPICE/schematic simulation is new to you; I highly recommend you give it a shot if this stuff interests you in the slightest.

P.P.S
I just realized it's not too clear on how the switch (SW) and the voltage source (Vswitch) inter-operate.  The way to close the switch in LTSpice is by providing a voltage source across its pins that is greater than 0V.  This is why the Vswitch waveform goes from -1 to 1.  This will simulate the PIC pin going from high-impedance (floating) to VCC.

[SethMods]

  Nice!!! 

[Hazer]

Op-amp seems a little much.

Seth, are you saying that you can directly drive a release with a 12F683? It sounds like people are saying that they cannot get rapidfire to work.

As I see it, the series resistor in GrammatonKlerik's first post would be the right way to drive this (the Hall sensor would drive its output, while the PIC would drive the 180 Ohm resistor high, leaving a voltage divider for input into the MCU of the controller. The best way to do this would be use a comparator pin on the PIC to see when the trigger gets pulled, then react to that. Kinda like how the PS3 controller code works.

Oh, it might be time to start using the 18F14K50. Stop screwing around with the 12F683 and move on up to USB. For Christs sake, I left enough USB code on these forums for you guys to do anything you want.

Lastly, if it really does come down to cutting traces, a better method would be to use an analog switch.

[rapidfiremoddr]

Well, I got mine working. I used a BJT. Base connected to the pin of the PIC, collector to Vdd, and emitter to the trigger node. When the pin of the PIC is low, the trigger node is at high impedance, when the pin is high, the trigger will be stuck at ~2.4V, simulating a release. I also measured only about .5mA of current when this is occurring.

[GrammatonKlerik]

So you can get things working without the op-amp and just the 180ohm resistor but you're definitely operating the sensor out of spec when you do that as I've never found a data sheet on a linear sensor that says its abs max output current is any more than 10mA; I've found plenty that say they can only push 3-5mA so 10mA is being really liberal.

So as it turns out I had an issue on my pad hack attempt where the MCU thought one or both of my triggers were being constantly held down. The outcome of that was that pressing 'A' on a home screen tile would visibly register by flashing but no action was taken.  Long story short, something got FUBAR'd to where the Vcc pin and GND pins for the sensor was shorted; TP17 still showed 3.3v so not sure what's up with that. 

In any case this forced me to find a way to release the triggers without the sensors and I found that way and I think it's going to make you rapid modders happy because I believe it means your 360 code should work as is.  All that it requires is the removal of the RC filter.

With the RC filter removed there is no longer a path for the sensor to influence the trigger pins of the MCU, so we need to force this high manually. What I did was take the 5V USB rail and create a voltage divider using a 330ohm resistor and a 1k trim pot I had on-hand. I dialed the trim pot to 808 ohms to make the output voltage exactly 1.45V. I tied this voltage to the bare pads of where the RC filter used to be (the bottom pads) and my trigger issue went away.

Because I had a 1k trim pot at the top of my divider I had a great opportunity to vary the output voltage down to see just exactly what voltage the XB1 code used as it's threshold for a trigger pull. I'm happy to report that this voltage appears to be somewhere between 1.31v and 1.33v - that is the voltage your PIC pin must drive above for a trigger release. I could have stopped there but I wanted to see what would happen if I drove the voltage up all the way to 3.3V.  As we saw from SethMods's o-scope this voltage never goes above 1.45V so I risked damaging the board by doing this but screw it, science. I'm happy to report 3.3V (well 3.29v) worked without issue.  With that in mind I removed the voltage divider and tied TP17 (3.3v) to the trigger pins but for some reason I'm not sure of this loaded down that rail to the point where it was only putting out ~1v so I quickly removed it. I think this is just an issue with my board so you guys may be ok using that rail unless a PIC can regulate 5v down to 3.3v in which case I would do that.

So now all that's left to do is tie the trigger pins to the 3.3v rail through a 1k pull-up resistor and then tie your PIC  pin to that same node and drop it to GND when you want a button press.   This whole setup essentially turns the trigger buttons to act like all the other buttons. Ill post a schematic when I get a chance but hopefully it made some sense.

Edit
One more thing I forgot which is of interest to rapid modders. You still need to know when a trigger pull happens to take appropriate action and all you need to do for that is tie the output of the sensor to your PIC and use that voltage for signaling purposes. I.e.when the voltage of the sensor goes below 1.31v, the trigger is being pressed so start rapid fire. You still need some code to sync up to the 8ms frames so I lied a bit, there is a bit of extra code to add.

[SethMods]

Op-amp seems a little much.

Seth, are you saying that you can directly drive a release with a 12F683? It sounds like people are saying that they cannot get rapidfire to work.

As I see it, the series resistor in GrammatonKlerik's first post would be the right way to drive this (the Hall sensor would drive its output, while the PIC would drive the 180 Ohm resistor high, leaving a voltage divider for input into the MCU of the controller. The best way to do this would be use a comparator pin on the PIC to see when the trigger gets pulled, then react to that. Kinda like how the PS3 controller code works.

Oh, it might be time to start using the 18F14K50. Stop screwing around with the 12F683 and move on up to USB. For Christs sake, I left enough USB code on these forums for you guys to do anything you want.

Lastly, if it really does come down to cutting traces, a better method would be to use an analog switch.

Yeah, I had no problems driving high and low using 1 pin (not two together) of a 12f683.

My (new XB1) code is very similar to my PS3 code which mimics everyone elses approach, except I chose to use ADC instead of a comparator. (In my PS3 I found it was imperative that a comparator was used as the timing was more sensitive-500 uS per input. But here you have almost 1.5ms for the triggers. So floating 20uS in catching that rising edge doesn't seem to matter too much.)

And you are preaching to the choir when it comes to the 18f14k50.

[rapidfiremoddr]

Yeah, I had no problems driving high and low using 1 pin (not two together) of a 12f683.

My (new XB1) code is very similar to my PS3 code which mimics everyone elses approach, except I chose to use ADC instead of a comparator. (In my PS3 I found it was imperative that a comparator was used as the timing was more sensitive-500 uS per input. But here you have almost 1.5ms for the triggers. So floating 20uS in catching that rising edge doesn't seem to matter too much.)

And you are preaching to the choir when it comes to the 18f14k50.

I don't know how you did it, because I was definitely not able to drive it high with one OR two pins of the 12f683.

[SethMods]

GrammatonKleric, if I understand your comment correctly I think what you are describing is "essentially" cutting the trace between the Hall-Effect Sensor and the MCU. Tie one side to a PIC pin for input and the other side to a PIC pin for output. The downside as you mentioned is that you are taking the analog output from the hall and effectively turning it into a digital output before it hits the MCU.

rapidfiremoddr, what points are you tying to on the XB1 controller to power your PIC? Is it possible that you are not providing your PIC with enough power(current)?


Also, I have been mulling over the fragility of the hall sensors the last few days. I'd like to challenge some of the things that are being said. Every person that has made a comment about the halls that has an electronics background seems to agree that if you drive Vout higher than Vdd you will immediately damage the sensor. Yet you can tie 3.3V to the Vout pin and not damage these things. Even though the Vdd is pulsing (held at 0V for a majority of the time). So I'm wondering if there isn't some extra stuff built into the halls for protection that aren't seen in "typical" hall-effect sensors.

Also, I'm trying to say Hall-Effect Sensor as many different ways as possible since I don't know which are appropriate and which aren't. I'm hoping to get it right at least once per post.  ;-)

[GrammatonKlerik]

GrammatonKleric, if I understand your comment correctly I think what you are describing is "essentially" cutting the trace between the Hall-Effect Sensor and the MCU. Tie one side to a PIC pin for input and the other side to a PIC pin for output. The downside as you mentioned is that you are taking the analog output from the hall and effectively turning it into a digital output before it hits the MCU.

Yep, exactly right. As for the downside, is the analog value of the trigger ever applicable in games that people desire to have rapid trigger mods for?  I guess it would make the controller dedicated to these types of games where it's not important.

Also, I have been mulling over the fragility of the hall sensors the last few days. I'd like to challenge some of the things that are being said. Every person that has made a comment about the halls that has an electronics background seems to agree that if you drive Vout higher than Vdd you will immediately damage the sensor. Yet you can tie 3.3V to the Vout pin and not damage these things. Even though the Vdd is pulsing (held at 0V for a majority of the time). So I'm wondering if there isn't some extra stuff built into the halls for protection that aren't seen in "typical" hall-effect sensors.

I can tell you that I've blown 4 out of 4 across two pads and I'm not even trying to drive these things to anything but GND.  The first ones I tried to pull to ground on the pin themselves as that was before I saw these forums and didn't realize exactly what was going on.  The other two I made sure to tie to the MCU side of the RC filter, although I did not have another series resistor so all 1.65v was dropped across the 100ohm filter resistor pulling 16mA.  I'm wondering if there is some sort of latch-up like phenomenon going on.

[SethMods]

I can tell you that I've blown 4 out of 4 across two pads and I'm not even trying to drive these things to anything but GND. 

Mind blown! You fried all four halls on two different controllers?!?! I must be the luckiest guy on the planet.

[navydude]

Well, I got mine working. I used a BJT. Base connected to the pin of the PIC, collector to Vdd, and emitter to the trigger node. When the pin of the PIC is low, the trigger node is at high impedance, when the pin is high, the trigger will be stuck at ~2.4V, simulating a release. I also measured only about .5mA of current when this is occurring.

.5mA sounds nice. That amout shouldnt damage the sensor. I do have one problem...what is a BJT? I am by no means a expert at this so Im still trying to figure out what you guys are talking about. lol. Please forgive me. I'm just an average tinkering guy that likes to do things himself. If Seth or rapidfiremoddr would please post pics of what you guys have done that would be wonderful. Thanks.

[GrammatonKlerik]

Well, I got mine working. I used a BJT. Base connected to the pin of the PIC, collector to Vdd, and emitter to the trigger node. When the pin of the PIC is low, the trigger node is at high impedance, when the pin is high, the trigger will be stuck at ~2.4V, simulating a release. I also measured only about .5mA of current when this is occurring.

0.5mA measured where exactly?  If you didn't cut any traces and/or remove any components from the board and measured the collector current by putting an ammeter inline then what you measured is Average current which is not what you care about, you want instantaneous current which you can get with an o-scope or simulation.   The average current is going to be very low because most of the time the BJT is off, but the instantaneous current is still in the 28mA range.

[GrammatonKlerik]

I do have one problem...what is a BJT? I am by no means a expert at this so Im still trying to figure out what you guys are talking about. lol.

A BJT stands for Bi-polar Junction Transistor which is a fancy way of saying a current amplifier.  Think of a BJT, or a transistor in general, as the small on/off valve on the fireman's hose.  He turns the valve a little bit to the ON position and he gets a ton of water current running out of the hose.  Now replace the water with electrons, the valve with the BJT and the fireman's hand turning the valve with the voltage output of the PIC pin.

Mind blown! You fried all four halls on two different controllers?!?! I must be the luckiest guy on the planet.

Actually now that I think of it, I was trying to move the rechargeable battery pack off the board so I could fit it into my fight stick.  I may have screwed something up in my attempts to do this because it never did work.


[admin]Please click edit to modify . Please do not double post[/admin]

[Modded Matt]

Actually now that I think of it, I was trying to move the rechargeable battery pack off the board so I could fit it into my fight stick.  I may have screwed something up in my attempts to do this because it never did work.

what "rechargeable battery" are you speaking of?