2014-04-15

Naked hardware #15: PCTV tripleStick (292e)

PCTV tripleStick (292e) teardown

PCTV tripleStick (292e)

tripleStick is the latest DVB-T/T2/C stick from PCTV Systems, successor of the old good PCTV nanoStick T2 (290e). It has a little bit better features compared to old nanoStick T2 as nanoStick T2 didn't support officially DVB-C at all, only DVB-T and DVB-T2. Case is just similar and it is hard to distinguish visually between nanoStick T2 and tripleStick. Only differences seems to be colored logo on upper-side and model number (290e vs. 292e) on backside.

That device appeared to market beginning of this year, during January 2014 or so. It replaced rather quickly old nanoStick T2. If you now order nanoStick T2 you will likely get tripleStick as a replacement. nanoStick T2 has been very popular stick among the Linux users as it have been basically the only one DVB-T2 capable stick which works out of the box (I made its driver for Kernel 3.0). My initial plan was not write driver for tripleStick, but I changed my mind after large amount of feedback from users who has ordered old well supported nanoStick T2, but got non-working tripleStick instead. So, I decided to give a try for reverse-engineering that Silicon Labs DTV chipset open.

PCTV Systems has assigned USB ID 2013:025f for that device. Windows driver knows also USB ID 2013:025b for 291e. According to Windows driver tripleStick, 292e, seems to be just renamed 291e for the reason or the other. Stick PCB also has model number 291e printed.

PCTV 292e (291e)

Initial Linux support will go the Kernel 3.16 if nothing unexpected happens.


Key components:
Empia EM28178
Silicon Labs Si2168
Silicon Labs Si2157

Hardware internals

That device is build to two PCBs, which are attached together like a sandwitch. It is somehow popular construction only for PCTV Systems and Hauppauge devices. Earlier, Pinnacle also used that kind of sandwich construction, maybe its backgrounds are from there, dunno (PCTV Systems was Pinnacle).

USB bridge / main PCB


Main PCB

That is top side of main PCB. Biggest chip clearly visible is EM28178.

PCB printings:
291e Main
2030000-02 LF
pctv systems

Empia  EM28178

Empia EM28178
EM28178 is USB-bridge, maybe the latest version from Empia EM28xx family. Clock source is crystal (it should be 12 MHz) which is located on same PCB, but bottom side, between the "sandwich".

Regulator?

regulator?
There is another 10 pin chip too, located right side of EM28178. Unfortunately that chip printings are too unclear and I cannot guess what it is. It cannot be LNA as RF parts are located on another PCB. Maybe some regulator? 

Serial eeprom

eeprom I2C bus wires
I2C serial eeprom is located on main PCB, but it is bottom side - between the PCBs. I2C bus wires from EM28178 to eeprom are clearly visible. It is those two long wires going from chip to right on picture and ending right side of "PCTV" text. I2C bus itself goes through PCB directly to eeprom located just other side of PCB. Copper pads are debug pins, attach your sniffer there :) It is not possible sniff demodulator and tuner from that point because only eeprom is connected to this bus. EM28178 has 2 I2C bus. First bus is for eeprom and all the rest are on second bus. However, attaching sniffer to second I2C bus is even more easier as that bus is routed to another PCB via those soldered pin headers.

serial eeprom

Demodulator and tuner / tuner PCB


Tuner PCB
That PCB is practically dedicated for RF parts "tuner". Demodulator, RF tuner and LNA are all here.


PCB printings:
291e Tuner
20300001-02 LF
pctv systems


Silicon Labs Si2157 & Silicon Labs Si2168


Silicon Labs Si2157 & Silicon Labs Si2168
Chip "215730" seen on picture is Silicon Labs Si2157 RF tuner. Metal box, just upper-side of chip, is crystal which offers 24 MHz reference clock. I2C bus is coming through the Si2168 demodulator, chip on the right side. Si2157 is very modern RF tuner which runs firmware and has has a DSP for digital filtering (and more?). Both of those are very uncommon choices for current silicon RF tuners. I can remember only Xceive tuners having firmware before that. DSP is even more uncommon...

Biggest chip, Si2168, is DVB-T/T2/C demodulator from Silicon Labs. It is the most popular DVB-T2 capable demodulator used for PC TV receivers currently. Demodulator supports also T2-Lite profile (DVB-T2 extension) which is aimed mainly for mobile transmissions, mobile TV and radio.

There is no own crystal for Si2168 (or it is hiding another side of PCB), which means clock is feed via Si2157, saving few components. Demodulator offers gated I2C bus for Si2157 RF tuner, as norm is nowadays. TS interface pins are located mostly left side of the chip. Surprisingly it looks like TS is connected using parallel connection...

Metal box right side of  Si2168 is remote controller receiver (IR RX). Weird looking IR component, though. It is connected to EM28178 which decodes IR key codes.

Low-noise amplifier


602
That chip must be LNA as it is clearly middle of the RF signal path, between antenna connector and RF tuner. Specifications unknown, labeled as 602. LNAs are usually controlled over GPIO line. Wired to EM28178 GPIO?


Linux driver

There was existing driver for EM28178 USB-bridge, but no driver for Si2168 nor Si2157. Fortunately both Si2168 and Si2157 provided very high level firmware API for device control. That makes protocol reverse-engineering pretty easy.

Current driver supports only minimal set of features in order to receive DVB-T/T2/C. There is no signal statistics implemented at all. Power management is also broken, it leaves device full active when device is closed, as it should set tuner and demod sleep. Broken PM is actually Windows driver bug - it is hard reverse-engineer it bug free when sniffs from Windows are already broken. All-in-all, it eats ("only") 210mA from USB when idle and Windows does not behave any better.

Driver can be found from that development tree:
http://git.linuxtv.org/cgit.cgi/anttip/media_tree.git/log/?h=pctv_292e


Si2168 needs firmware, which I named as dvb-demod-si2168-01.fw. Firmware size is only 2720 bytes, meaning it cannot be whole firmware, but a kind of the partial patch.
Firmware can be extracted from the bundled driver CD version 6.4.8.984.

file:
/TVC 6.4.8/Driver/PCTV Empia/emOEM.sys

extract:
dd if=emOEM.sys ibs=1 skip=1089416 count=2720 of=dvb-demod-si2168-01.fw

verify checksum:
md5sum dvb-demod-si2168-01.fw
87c317e0b75ad49c2f2cbf35572a8093  dvb-demod-si2168-01.fw

Reverse-engineering scripts I used to parse I2C demod and tuner I2C traffic are available here. There is also few already parsed sniffs to look example and compare things. These are surely very helpful if you are adding new features or support for new chip revisions / versions.

USB interface

IDLE current drain without a driver: 68 mA



Pictures























































27 comments:

  1. Hi Antti, would it be possible to provide me with a binary or code for this driver, so I can use the triple stick with Linux. Like, so many others, I bought a nano stick and ended up with the triple stick!. Thanks Gary

    ReplyDelete
    Replies
    1. Driver is included to kernel 3.16 https://www.kernel.org/
      You could install also media-build http://www.linuxtv.org/wiki/index.php/How_to_Obtain,_Build_and_Install_V4L-DVB_Device_Drivers

      Delete
  2. Thanks, Antti! I will give that a try.

    ReplyDelete
  3. Hello Antti, thanks for working on this. The 292e indeed seems to be one of the few affordable, DVB-C capable sticks currently available.

    I compiled 3.16 rc4 and installed the firmware. dmesg confirms that the stick gets found and firmware loaded.

    However, neither tvheadend nor dvbscan find any services for DVB-C. w_scan warns "This dvb driver is *buggy*: the symbol rate limits are undefined - please report to linuxtv.org" but does produce a channel config with sane results.

    I'm primarily interested in getting this to work with tvheadend. Any hints?

    ReplyDelete
    Replies
    1. I should add that tvheadend only reports "status changed to No signal" after tuning to a frequency for scanning. I know that signal strength reporting is not supported. Does it currently report "no signal" or "full signal strength"? Perhaps it needs to be changed to the latter?

      dvbscan quits immediately after the initial FE_GET_INFO ioctl, without any output or operation.

      Delete
  4. It turned out that recompiling tvheadend from source (3.9.1050~g388b4d7) helped. The one I had problems with were the latest upstream binaries (3.4.28~geb79aee~trusty).

    The key difference is that the more recent tvheadend lets me choose between DVB-C and DVB-T in the device selection view.

    It's working fine now for me. Thanks again.

    ReplyDelete
  5. Hello Antti. Thanks for your work on this. Any idea when HD will be available?

    ReplyDelete
    Replies
    1. HD is working and has been working from the day 1.

      Delete
  6. Oh I see. Thanks for the reply, must be something I'm doing wrong on my end. Not sure what though, I'll try and find out!

    ReplyDelete
  7. Can it be made to work on enigma2?

    ReplyDelete
    Replies
    1. I don't know what enigma2 even is. If it supports any other DVB device via kernel driver then that one should work similarly.

      Delete
  8. Hi, could you please break down how to install drivers for linux, I am a beginner in Linux.
    Thank you

    ReplyDelete
    Replies
    1. http://www.linuxtv.org/wiki/index.php/How_to_Obtain,_Build_and_Install_V4L-DVB_Device_Drivers
      http://palosaari.fi/linux/v4l-dvb/firmware/Si2168/Si2168-B40/d8da7ff67cd56cd8aa4e101aea45e052/

      Delete
  9. Hi Antti,

    I have got the 292e up and running using Linux kernel 3.16 on Ubuntu. The only problem is that I have not been able to
    tune to DVB-T2 channels using w_scan. I don't think it is any
    thing to do with signal strength as i have successfully used a 290e device to tune in to DVB-T2 channels with the same aerial source in the past.

    Do you have any suggestions on what i should monitor or
    if there are any module settings that I need to be aware
    of ?

    Thank you.

    ReplyDelete
    Replies
    1. This comment has been removed by the author.

      Delete
    2. I should have added that I have no problems with DVB-T channels on the 292e - It is just the DVB-T2 channels that are not being found.

      Thanks.

      Delete
    3. Hi,

      The w_scan version is ( 20140727). With this version it finds the the dvb-t2 multiplex during initial scan :-
      546000: (time: 05:28.912) signal ok: QAM_AUTO f = 546000 kHz I999B8C999D999T999G999Y999P0 (0:0:0)
      QAM_AUTO f = 546000 kHz I999B8C999D999T999G999Y999P0 (0:0:0) : updating transport_stream_id: -> (0:0:16516)
      QAM_AUTO f = 546000 kHz I999B8C999D999T999G999Y999P0 (0:0:16516) : updating network_id -> (0:12339:16516)
      ===================== parse_network_change_notify_descriptor ===========
      len = 20
      0x00: 07 00 00 10 01 01 DE 47 13 30 00 01 00 00 13 00 : G 0
      0x10: 20 05 23 3A : #:
      ========================================================================

      but it cannot tune to report the dvb-t2 channels (the dvb_t channels are reported correctly) :-

      ...(snip)
      tune to: QAM_AUTO f = 546000 kHz I999B999C0D0T2G32Y0P0 (9018:12339:16516) (time: 12:08.389)
      ----------no signal----------
      tune to: QAM_AUTO f = 546000 kHz I999B999C999D0T999G999Y0P0 (9018:12339:16516) (time: 12:13.565) (no signal)
      ----------no signal----------
      ...(snip)

      It seems to indicate signal strength issues but I know that not to be the case as the dvb-t2 is received successfully by the TV on the same aerial.
      Anyway, I would be grateful if have any suggestions on what I should check for.

      Thanks.

      Delete
    4. Is that tune attempt done during same w_scan? It first did scan to find out all multiplexes and then finally tunes every multiplex found in order to find channels?
      For me that new w_scan works, it finds all the channels (4 DVB-T muxes & 5 DVB-T2 muxes).

      Delete
  10. For those who had DVB-T2 HD tuning problems see that:
    http://blog.palosaari.fi/2014/09/linux-dvb-t2-tuning-problems.html

    ReplyDelete
  11. Hello Antti!

    As I know, the device works fine with a pure T2-Base signal and a pure T2-Lite signal.
    Do you know, does it work with mixed T2-base/lite mode? I mean, is it possible for this demod to get T2-Lite stream from T2-Base FEFs (as implemented in DVB-T2 v1.3.1)?
    If yes, does the driver have ability to switch between modulation modes on locked RF-channel? Is there an option, what mode to choose for selected channel?

    Guys from Spain, France, Norway, The Netherlands, from Finland too have been trialing mixed T2 mode for two years or more.

    Thanks!

    Alexander

    ReplyDelete
    Replies
    1. I don't know very much about Lite nor M-PLP. All live DVB-T2 muxes here in in Oulu Finland, are normal - no M-PLP nor Lite used. Hardware supports those features what Si2168 supports. M-PLP support was added recently to Linux driver. Lite does not likely work without driver changes.

      Finland switched from DVB-H to DVB-T2 few years ago and before DVB-H there was even DAB :) I suspect there isn't currently any T2 Lite trials ongoing. After the death of Nokia's mobile phone business, there is likely not much interest for mobile trials anymore...

      Delete
  12. Hi!,

    Fantastic work you do!

    I have trouble with the dvb-c in sweden, qam256 and 6857 symbol rate.

    without ruining with a long post i just link my forum thread:

    http://openelec.tv/forum/81-dvb-c-support/73252-dvbc-292e-tvheadend-vdr-addon#119481

    Do you have any tip?, I am running OE 4.0.7 and tvheadend 3.4.27

    Regards

    ReplyDelete
    Replies
    1. So w_scan finds all the channels, but you cannot see those?

      Delete
    2. yes, the channels.conf output files looks complete. but when i replace the default channels.conf (containing some german channels) and starts the vdr-addon the file goes blanc and no channels.

      Delete
  13. would it be possible to somehow edit the annex to enable 6875kbaud for tvheadend?

    ReplyDelete
    Replies
    1. You have to ask from tvheadend developers. Device seems to work as it finds all the channels.

      Delete