Naked hardware #15: PCTV tripleStick (292e)

PCTV tripleStick (292e) teardown

PCTV tripleStick (292e)

tripleStick is the latest DVB-T/T2/C stick from PCTV Systems, successor of the old good PCTV nanoStick T2 (290e). It has a little bit better features compared to old nanoStick T2 as nanoStick T2 didn't support officially DVB-C at all, only DVB-T and DVB-T2. Case is just similar and it is hard to distinguish visually between nanoStick T2 and tripleStick. Only differences seems to be colored logo on upper-side and model number (290e vs. 292e) on backside.

That device appeared to market beginning of this year, during January 2014 or so. It replaced rather quickly old nanoStick T2. If you now order nanoStick T2 you will likely get tripleStick as a replacement. nanoStick T2 has been very popular stick among the Linux users as it have been basically the only one DVB-T2 capable stick which works out of the box (I made its driver for Kernel 3.0). My initial plan was not write driver for tripleStick, but I changed my mind after large amount of feedback from users who has ordered old well supported nanoStick T2, but got non-working tripleStick instead. So, I decided to give a try for reverse-engineering that Silicon Labs DTV chipset open.

PCTV Systems has assigned USB ID 2013:025f for that device. Windows driver knows also USB ID 2013:025b for 291e. According to Windows driver tripleStick, 292e, seems to be just renamed 291e for the reason or the other. Stick PCB also has model number 291e printed.

PCTV 292e (291e)

Initial Linux support will go the Kernel 3.16 if nothing unexpected happens.

Key components:
Empia EM28178
Silicon Labs Si2168
Silicon Labs Si2157

Hardware internals

That device is build to two PCBs, which are attached together like a sandwitch. It is somehow popular construction only for PCTV Systems and Hauppauge devices. Earlier, Pinnacle also used that kind of sandwich construction, maybe its backgrounds are from there, dunno (PCTV Systems was Pinnacle).

USB bridge / main PCB

Main PCB

That is top side of main PCB. Biggest chip clearly visible is EM28178.

PCB printings:
291e Main
2030000-02 LF
pctv systems

Empia  EM28178

Empia EM28178
EM28178 is USB-bridge, maybe the latest version from Empia EM28xx family. Clock source is crystal (it should be 12 MHz) which is located on same PCB, but bottom side, between the "sandwich".


There is another 10 pin chip too, located right side of EM28178. Unfortunately that chip printings are too unclear and I cannot guess what it is. It cannot be LNA as RF parts are located on another PCB. Maybe some regulator? 

Serial eeprom

eeprom I2C bus wires
I2C serial eeprom is located on main PCB, but it is bottom side - between the PCBs. I2C bus wires from EM28178 to eeprom are clearly visible. It is those two long wires going from chip to right on picture and ending right side of "PCTV" text. I2C bus itself goes through PCB directly to eeprom located just other side of PCB. Copper pads are debug pins, attach your sniffer there :) It is not possible sniff demodulator and tuner from that point because only eeprom is connected to this bus. EM28178 has 2 I2C bus. First bus is for eeprom and all the rest are on second bus. However, attaching sniffer to second I2C bus is even more easier as that bus is routed to another PCB via those soldered pin headers.

serial eeprom

Demodulator and tuner / tuner PCB

Tuner PCB
That PCB is practically dedicated for RF parts "tuner". Demodulator, RF tuner and LNA are all here.

PCB printings:
291e Tuner
20300001-02 LF
pctv systems

Silicon Labs Si2157 & Silicon Labs Si2168

Silicon Labs Si2157 & Silicon Labs Si2168
Chip "215730" seen on picture is Silicon Labs Si2157 RF tuner. Metal box, just upper-side of chip, is crystal which offers 24 MHz reference clock. I2C bus is coming through the Si2168 demodulator, chip on the right side. Si2157 is very modern RF tuner which runs firmware and has has a DSP for digital filtering (and more?). Both of those are very uncommon choices for current silicon RF tuners. I can remember only Xceive tuners having firmware before that. DSP is even more uncommon...

Biggest chip, Si2168, is DVB-T/T2/C demodulator from Silicon Labs. It is the most popular DVB-T2 capable demodulator used for PC TV receivers currently. Demodulator supports also T2-Lite profile (DVB-T2 extension) which is aimed mainly for mobile transmissions, mobile TV and radio.

There is no own crystal for Si2168 (or it is hiding another side of PCB), which means clock is feed via Si2157, saving few components. Demodulator offers gated I2C bus for Si2157 RF tuner, as norm is nowadays. TS interface pins are located mostly left side of the chip. Surprisingly it looks like TS is connected using parallel connection...

Metal box right side of  Si2168 is remote controller receiver (IR RX). Weird looking IR component, though. It is connected to EM28178 which decodes IR key codes.

Low-noise amplifier

That chip must be LNA as it is clearly middle of the RF signal path, between antenna connector and RF tuner. Specifications unknown, labeled as 602. LNAs are usually controlled over GPIO line. Wired to EM28178 GPIO?

Linux driver

There was existing driver for EM28178 USB-bridge, but no driver for Si2168 nor Si2157. Fortunately both Si2168 and Si2157 provided very high level firmware API for device control. That makes protocol reverse-engineering pretty easy.

Current driver supports only minimal set of features in order to receive DVB-T/T2/C. There is no signal statistics implemented at all. Power management is also broken, it leaves device full active when device is closed, as it should set tuner and demod sleep. Broken PM is actually Windows driver bug - it is hard reverse-engineer it bug free when sniffs from Windows are already broken. All-in-all, it eats ("only") 210mA from USB when idle and Windows does not behave any better.

Driver can be found from that development tree:

Si2168 needs firmware, which I named as dvb-demod-si2168-01.fw. Firmware size is only 2720 bytes, meaning it cannot be whole firmware, but a kind of the partial patch.
Firmware can be extracted from the bundled driver CD version

/TVC 6.4.8/Driver/PCTV Empia/emOEM.sys

dd if=emOEM.sys ibs=1 skip=1089416 count=2720 of=dvb-demod-si2168-01.fw

verify checksum:
md5sum dvb-demod-si2168-01.fw
87c317e0b75ad49c2f2cbf35572a8093  dvb-demod-si2168-01.fw

Reverse-engineering scripts I used to parse I2C demod and tuner I2C traffic are available here. There is also few already parsed sniffs to look example and compare things. These are surely very helpful if you are adding new features or support for new chip revisions / versions.

USB interface

IDLE current drain without a driver: 68 mA