Controller Protocol

Byte exchange between the console and controllers on SIO0.

This is an old revision of this page, as edited by RemmyLee at 02:46, 23 October 2026. Edit this revision | Latest revision

Summary

Controllers and Memory Cards communicate with the console through SIO0 by a synchronous serial protocol similar to SPI. There are no start, stop or parity bits. Unlike SPI, one byte is transferred at a time, and the device answers each byte on a separate line, /ACK, when it is ready for the next one.¹ The controller page describes the devices and Sony's library view of them, and the SIO page describes the registers.

Because the transfer is synchronous, the console receives one byte from the device for every byte it sends. When the console has sent all its command bytes and still expects data, it sends dummy bytes to clock the replies in. The dummy bytes are normally 00h.¹

Signals

A transfer begins when the console pulls /CS low for the port. It then clocks out the address byte, the command and the parameters on CMD while the device replies on DAT, and the device pulses /ACK after each byte that it wants to continue:²

      ____                                                              _____
/CS       \____________________________________________________________/
      ______        ____        ____        ____        ____        _________
SCK         ||||||||    ||||||||    ||||||||    ||||||||    ||||||||
      ____                                                              _____
CMD       '=[ Addr ]====[ Cmd  ]====[ Tap  ]====[Param ]====[Param ]==='
DAT   ---------------===[ IDlo ]====[ IDhi ]====[ Data ]====[ Data ]===------
      _______________   _________   _________   _________   _________________
/ACK                 |_|         |_|         |_|         |_|

psx-spx gives the following timing rules:²

A device must not respond when /CS goes low. It waits for the address byte and answers with /ACK and data only when the address is its own.²

Addressing

The first byte after /CS selects the device. All devices keep the data line idle until it has been sent, and the addressed device then pulls /ACK low to signal that it is present:³

The reply to the address byte is not driven by any device and is ignored.¹ The Memory Card page describes the commands after address 81h.

/ACK Interrupt

/ACK is wired to the DSR input of SIO0. Each /ACK pulse after a received byte raises interrupt 7. No interrupt therefore occurs when the device fails to answer or no device is plugged in.¹ Because /ACK means that the device wants more data, it is not sent after the last byte.¹

The interrupt flag in the interrupt controller is edge triggered, but SIO0 status bit 9 is not. psx-spx therefore reports that bit 9 cannot be acknowledged while /ACK is still low: a program waits until SIO0 status bit 7 is 0 and then sets control bit 4. The low pulse lasts about 100 clock cycles.¹

psx-spx also reports that the kernel waits about 100 cycles after sending a byte before it acknowledges the old interrupt and waits for the new one. An emulator therefore cannot raise interrupt 7 immediately after the byte.¹

Read Sequence

The controller read is command 42h ("B"). The console sends the following bytes and receives the replies shown:⁴

A digital pad stops the transfer after the button bytes. A mouse stops after adc1 and an analog pad after adc3. The TAP byte is normally 00h and requests Multi Tap data when it is 01h. The MOT bytes control the vibration motors but have no effect until vibration is enabled by configuration commands.⁴

Controller ID

The ID halfword tells the console how long the rest of the reply is:⁵

Before any read, the BIOS InitPad() buffer holds xx00h.⁵

Standard Controllers

The digital pad returns one halfword of buttons. The analog pad and the analog stick in analog mode add two halfwords for the sticks. A button bit is 0 when pressed and 1 when released:⁶

A controller powers up in digital mode. The Analog button switches analog mode on and off by hand, and the pads with two motors can also be switched by software with the configuration commands.⁷ psx-spx notes that some games, such as Gran Turismo, never switch the pad to analog mode themselves, so the player must press the Analog button.⁷

In the green LED mode of the Dual Analog pad the ID is 5A53h, the L3 and R3 bits are always 1, and some buttons move: bit 9 is L1, bit 10 Square, bit 11 Triangle, bit 12 R1 and bit 15 R2. The mode matches the button layout of the analog stick, and psx-spx names MechWarrior 2, Ace Combat 2, Descent Maximum and Colony Wars as games that use it.⁸

Mouse

The Sony mouse returns a button halfword and one motion halfword:⁹

The Sony mouse holds /ACK low from power-on until it is accessed once. Because /ACK is shared by both controller ports and both Memory Card slots, this blocks every other device. psx-spx therefore recommends that a program access both controller ports, even when it uses only one, and use a timeout when it waits for /ACK to go high.¹⁰

neGcon

The neGcon (ID 5A23h) is twisted instead of steered. Its reply has the following layout:¹¹

The Namco Volume Controller, a paddle with two buttons, returns the same ID with most of the buttons missing.¹¹

Jogcon

The Namco Jogcon (ID 5AE3h in Jogcon mode) returns the digital pad buttons in halfword 1 and a dial in halfwords 2 and 3. Bits 1 to 15 of halfword 2 hold the dial rotation, and bits 0 and 1 of halfword 3 flag a turn to the left and to the right. The dial is read by an optical sensor and has a motor for force feedback, and it accepts configuration command 4Dh as the analog pads do.¹²

Configuration Mode

The pads with two motors (SCPH-1200 and SCPH-110) have a configuration mode. It was introduced to enable the second motor, and it also lets software switch between analog and digital input and read type and status bytes.¹³

A transfer is 5 bytes in normal digital mode and 9 bytes in analog mode. In configuration mode it is always 9 bytes. While the pad is in configuration mode its ID is F3h 5Ah.¹³

The unused commands reply with F3h 5Ah followed by 00h bytes.¹³

43h - Enter or Exit Configuration Mode

Send  01h 43h 00h xx  00h (zero padded)
Reply HiZ id  5Ah buttons (analog inputs)

From normal mode, xx = 01h enters configuration mode and xx = 00h stays in normal mode, and the reply is the button data. From configuration mode, xx = 00h returns to normal mode and xx = 01h stays, and the reply is F3h 5Ah followed by 00h bytes.¹⁴

Entering configuration mode also starts a watchdog timer that resets the pad when it has not been accessed for about 1 second. The timer keeps running after the pad returns to normal mode. The reset stops and locks the motors and returns the pad to digital mode with the LED off, so a program must keep reading the pad even while it loads from the CD-ROM.¹⁴

Pressing the Analog button causes the same reset. After configuration commands have been used, the press also changes the 5Ah byte of the reply to 00h.¹⁴

44h - Set LED State

Send  01h 44h 00h Led Key 00h 00h 00h 00h
Reply HiZ F3h 5Ah 00h 00h Err 00h 00h 00h

Led = 00h selects digital mode with the LED off and Led = 01h analog mode with the red LED; other values are ignored. Key = 03h locks the mode so that the Analog button has no effect, and Key = 00h to 02h unlocks it. Larger Key values act as Key AND 03h.¹⁵

45h - Get LED State

Send  01h 45h 00h 00h 00h 00h 00h 00h 00h
Reply HiZ F3h 5Ah Typ 02h Led 02h 01h 00h

Led is the current LED state (00h off, 01h red) and Typ the controller type (01h for the PlayStation analog pad, 03h for the Dualshock2).¹⁶

46h and 4Ch - Variable Responses

Send  01h 46h 00h ii  00h 00h 00h 00h 00h
Reply HiZ F3h 5Ah 00h 00h cc  dd  ee  ff

Command 46h returns 01h 02h 00h 0Ah for ii = 00h and 01h 01h 01h 14h for ii = 01h. psx-spx identifies it as the PadInfoAct request of Sony's library: ii selects the actuator, and the last byte is its current drain of 10 or 20 units.¹⁷ These values match the drains in Sony's actuator table. Sony gives 10 units for actuator 1 and 20 units for actuator 2 of the SCPH-1200.¹⁸

Command 4Ch with the same layout returns dd = 04h for ii = 00h and dd = 07h for ii = 01h.¹⁹ Command 47h always returns 00h 00h 02h 00h 01h 00h after F3h 5Ah, and its purpose is not known.²⁰

Vibration

The SCPH-1150 has one motor and no configuration commands. Its motor runs while the first MOT byte (xx) is 40h to 7Fh and the second (yy) is odd, so yyxx = 0140h switches it on and 0000h off. The motor is either on or off, and the LED state does not matter.²¹

The SCPH-1200 and SCPH-110 accept the same method for their small motor. To use both motors a program enters configuration mode and maps the motors to the MOT bytes with command 4Dh:²¹

Send  01h 4Dh 00h aa  bb  cc  dd  ee  ff     ;set the new aa..ff values
Reply HiZ F3h 5Ah aa  bb  cc  dd  ee  ff     ;return the old values

Bytes aa to ff give the meaning of the 4th to 9th bytes of the read command. A value of 00h maps the small motor M2 to bit 0 of that byte, 01h maps the large motor M1 to all 8 bits, and FFh maps nothing.²² The usual command is therefore 01h 4Dh 00h 00h 01h FFh FFh FFh FFh, which makes the read command carry M2 in its 4th byte and M1 in its 5th:²²

Send  01h 42h 00h M2  M1  00h 00h 00h 00h

M1 runs the large motor at a speed from 00h (stop) to FFh (fastest), and bit 0 of M2 switches the small motor on and off.²³ In the initial state aa to ff are all FFh and the old one-motor method is used. Once configuration commands have been used the old method is disabled.²²

psx-spx reports that the large motor starts at about 50h to 60h and keeps running down to about 38h. The position of the weight, other movement of the pad, wear and temperature all change the exact threshold.²³

Multi Tap

A read with TAP = 01h does not change the current reply. Instead it requests that the next read return the data of all four slots of the Multi Tap:²⁴

The Multi Tap always sends 4 halfwords per slot and pads shorter replies and empty slots with FFFFh. The request can be sent only when slot A holds a controller, because otherwise the slot A transfer ends after the first byte.²⁴

A request sent during the long reply returns a short garbage reply of HiZ, 80h, 5Ah and the low byte of the slot A ID. A program therefore either toggles TAP between reads, receiving slot A data and the long reply in turn, or sends TAP = 01h every time and ignores every second reply.²⁴

A second method addresses one slot directly by sending 0nh in place of 01h, where n is the slot from 1 to 4. It works like a normal read and also allows replies of more than 4 halfwords per slot.²⁵

The Konami lightgun interrupt line is wired to all four slots through resistors. No logic selects one slot.²⁵

References