Naked hardware #15: PCTV tripleStick (292e)

PCTV tripleStick (292e) teardown

PCTV tripleStick (292e)

tripleStick is the latest DVB-T/T2/C stick from PCTV Systems, successor of the old good PCTV nanoStick T2 (290e). It has a little bit better features compared to old nanoStick T2 as nanoStick T2 didn't support officially DVB-C at all, only DVB-T and DVB-T2. Case is just similar and it is hard to distinguish visually between nanoStick T2 and tripleStick. Only differences seems to be colored logo on upper-side and model number (290e vs. 292e) on backside.

That device appeared to market beginning of this year, during January 2014 or so. It replaced rather quickly old nanoStick T2. If you now order nanoStick T2 you will likely get tripleStick as a replacement. nanoStick T2 has been very popular stick among the Linux users as it have been basically the only one DVB-T2 capable stick which works out of the box (I made its driver for Kernel 3.0). My initial plan was not write driver for tripleStick, but I changed my mind after large amount of feedback from users who has ordered old well supported nanoStick T2, but got non-working tripleStick instead. So, I decided to give a try for reverse-engineering that Silicon Labs DTV chipset open.

PCTV Systems has assigned USB ID 2013:025f for that device. Windows driver knows also USB ID 2013:025b for 291e. According to Windows driver tripleStick, 292e, seems to be just renamed 291e for the reason or the other. Stick PCB also has model number 291e printed.

PCTV 292e (291e)

Initial Linux support will go the Kernel 3.16 if nothing unexpected happens.

Key components:
Empia EM28178
Silicon Labs Si2168
Silicon Labs Si2157

Hardware internals

That device is build to two PCBs, which are attached together like a sandwitch. It is somehow popular construction only for PCTV Systems and Hauppauge devices. Earlier, Pinnacle also used that kind of sandwich construction, maybe its backgrounds are from there, dunno (PCTV Systems was Pinnacle).

USB bridge / main PCB

Main PCB

That is top side of main PCB. Biggest chip clearly visible is EM28178.

PCB printings:
291e Main
2030000-02 LF
pctv systems

Empia  EM28178

Empia EM28178
EM28178 is USB-bridge, maybe the latest version from Empia EM28xx family. Clock source is crystal (it should be 12 MHz) which is located on same PCB, but bottom side, between the "sandwich".


There is another 10 pin chip too, located right side of EM28178. Unfortunately that chip printings are too unclear and I cannot guess what it is. It cannot be LNA as RF parts are located on another PCB. Maybe some regulator? 

Serial eeprom

eeprom I2C bus wires
I2C serial eeprom is located on main PCB, but it is bottom side - between the PCBs. I2C bus wires from EM28178 to eeprom are clearly visible. It is those two long wires going from chip to right on picture and ending right side of "PCTV" text. I2C bus itself goes through PCB directly to eeprom located just other side of PCB. Copper pads are debug pins, attach your sniffer there :) It is not possible sniff demodulator and tuner from that point because only eeprom is connected to this bus. EM28178 has 2 I2C bus. First bus is for eeprom and all the rest are on second bus. However, attaching sniffer to second I2C bus is even more easier as that bus is routed to another PCB via those soldered pin headers.

serial eeprom

Demodulator and tuner / tuner PCB

Tuner PCB
That PCB is practically dedicated for RF parts "tuner". Demodulator, RF tuner and LNA are all here.

PCB printings:
291e Tuner
20300001-02 LF
pctv systems

Silicon Labs Si2157 & Silicon Labs Si2168

Silicon Labs Si2157 & Silicon Labs Si2168
Chip "215730" seen on picture is Silicon Labs Si2157 RF tuner. Metal box, just upper-side of chip, is crystal which offers 24 MHz reference clock. I2C bus is coming through the Si2168 demodulator, chip on the right side. Si2157 is very modern RF tuner which runs firmware and has has a DSP for digital filtering (and more?). Both of those are very uncommon choices for current silicon RF tuners. I can remember only Xceive tuners having firmware before that. DSP is even more uncommon...

Biggest chip, Si2168, is DVB-T/T2/C demodulator from Silicon Labs. It is the most popular DVB-T2 capable demodulator used for PC TV receivers currently. Demodulator supports also T2-Lite profile (DVB-T2 extension) which is aimed mainly for mobile transmissions, mobile TV and radio.

There is no own crystal for Si2168 (or it is hiding another side of PCB), which means clock is feed via Si2157, saving few components. Demodulator offers gated I2C bus for Si2157 RF tuner, as norm is nowadays. TS interface pins are located mostly left side of the chip. Surprisingly it looks like TS is connected using parallel connection...

Metal box right side of  Si2168 is remote controller receiver (IR RX). Weird looking IR component, though. It is connected to EM28178 which decodes IR key codes.

Low-noise amplifier

That chip must be LNA as it is clearly middle of the RF signal path, between antenna connector and RF tuner. Specifications unknown, labeled as 602. LNAs are usually controlled over GPIO line. Wired to EM28178 GPIO?

Linux driver

There was existing driver for EM28178 USB-bridge, but no driver for Si2168 nor Si2157. Fortunately both Si2168 and Si2157 provided very high level firmware API for device control. That makes protocol reverse-engineering pretty easy.

Current driver supports only minimal set of features in order to receive DVB-T/T2/C. There is no signal statistics implemented at all. Power management is also broken, it leaves device full active when device is closed, as it should set tuner and demod sleep. Broken PM is actually Windows driver bug - it is hard reverse-engineer it bug free when sniffs from Windows are already broken. All-in-all, it eats ("only") 210mA from USB when idle and Windows does not behave any better.

Driver can be found from that development tree:

Si2168 needs firmware, which I named as dvb-demod-si2168-01.fw. Firmware size is only 2720 bytes, meaning it cannot be whole firmware, but a kind of the partial patch.
Firmware can be extracted from the bundled driver CD version

/TVC 6.4.8/Driver/PCTV Empia/emOEM.sys

dd if=emOEM.sys ibs=1 skip=1089416 count=2720 of=dvb-demod-si2168-01.fw

verify checksum:
md5sum dvb-demod-si2168-01.fw
87c317e0b75ad49c2f2cbf35572a8093  dvb-demod-si2168-01.fw

Reverse-engineering scripts I used to parse I2C demod and tuner I2C traffic are available here. There is also few already parsed sniffs to look example and compare things. These are surely very helpful if you are adding new features or support for new chip revisions / versions.

USB interface

IDLE current drain without a driver: 68 mA



  1. Hi Antti, would it be possible to provide me with a binary or code for this driver, so I can use the triple stick with Linux. Like, so many others, I bought a nano stick and ended up with the triple stick!. Thanks Gary

    1. Driver is included to kernel 3.16 https://www.kernel.org/
      You could install also media-build http://www.linuxtv.org/wiki/index.php/How_to_Obtain,_Build_and_Install_V4L-DVB_Device_Drivers

  2. Thanks, Antti! I will give that a try.

  3. Hello Antti, thanks for working on this. The 292e indeed seems to be one of the few affordable, DVB-C capable sticks currently available.

    I compiled 3.16 rc4 and installed the firmware. dmesg confirms that the stick gets found and firmware loaded.

    However, neither tvheadend nor dvbscan find any services for DVB-C. w_scan warns "This dvb driver is *buggy*: the symbol rate limits are undefined - please report to linuxtv.org" but does produce a channel config with sane results.

    I'm primarily interested in getting this to work with tvheadend. Any hints?

    1. I should add that tvheadend only reports "status changed to No signal" after tuning to a frequency for scanning. I know that signal strength reporting is not supported. Does it currently report "no signal" or "full signal strength"? Perhaps it needs to be changed to the latter?

      dvbscan quits immediately after the initial FE_GET_INFO ioctl, without any output or operation.

  4. It turned out that recompiling tvheadend from source (3.9.1050~g388b4d7) helped. The one I had problems with were the latest upstream binaries (3.4.28~geb79aee~trusty).

    The key difference is that the more recent tvheadend lets me choose between DVB-C and DVB-T in the device selection view.

    It's working fine now for me. Thanks again.

  5. Hello Antti. Thanks for your work on this. Any idea when HD will be available?

    1. HD is working and has been working from the day 1.

  6. Oh I see. Thanks for the reply, must be something I'm doing wrong on my end. Not sure what though, I'll try and find out!

  7. Can it be made to work on enigma2?

    1. I don't know what enigma2 even is. If it supports any other DVB device via kernel driver then that one should work similarly.

  8. Hi, could you please break down how to install drivers for linux, I am a beginner in Linux.
    Thank you

    1. http://www.linuxtv.org/wiki/index.php/How_to_Obtain,_Build_and_Install_V4L-DVB_Device_Drivers

  9. Hi Antti,

    I have got the 292e up and running using Linux kernel 3.16 on Ubuntu. The only problem is that I have not been able to
    tune to DVB-T2 channels using w_scan. I don't think it is any
    thing to do with signal strength as i have successfully used a 290e device to tune in to DVB-T2 channels with the same aerial source in the past.

    Do you have any suggestions on what i should monitor or
    if there are any module settings that I need to be aware
    of ?

    Thank you.

    1. This comment has been removed by the author.

    2. I should have added that I have no problems with DVB-T channels on the 292e - It is just the DVB-T2 channels that are not being found.


    3. Hi,

      The w_scan version is ( 20140727). With this version it finds the the dvb-t2 multiplex during initial scan :-
      546000: (time: 05:28.912) signal ok: QAM_AUTO f = 546000 kHz I999B8C999D999T999G999Y999P0 (0:0:0)
      QAM_AUTO f = 546000 kHz I999B8C999D999T999G999Y999P0 (0:0:0) : updating transport_stream_id: -> (0:0:16516)
      QAM_AUTO f = 546000 kHz I999B8C999D999T999G999Y999P0 (0:0:16516) : updating network_id -> (0:12339:16516)
      ===================== parse_network_change_notify_descriptor ===========
      len = 20
      0x00: 07 00 00 10 01 01 DE 47 13 30 00 01 00 00 13 00 : G 0
      0x10: 20 05 23 3A : #:

      but it cannot tune to report the dvb-t2 channels (the dvb_t channels are reported correctly) :-

      tune to: QAM_AUTO f = 546000 kHz I999B999C0D0T2G32Y0P0 (9018:12339:16516) (time: 12:08.389)
      ----------no signal----------
      tune to: QAM_AUTO f = 546000 kHz I999B999C999D0T999G999Y0P0 (9018:12339:16516) (time: 12:13.565) (no signal)
      ----------no signal----------

      It seems to indicate signal strength issues but I know that not to be the case as the dvb-t2 is received successfully by the TV on the same aerial.
      Anyway, I would be grateful if have any suggestions on what I should check for.


    4. Is that tune attempt done during same w_scan? It first did scan to find out all multiplexes and then finally tunes every multiplex found in order to find channels?
      For me that new w_scan works, it finds all the channels (4 DVB-T muxes & 5 DVB-T2 muxes).

  10. For those who had DVB-T2 HD tuning problems see that:

    1. Hi Antti
      I got the 292e up and running on 3.18.5. As with others DVB-T tunes fine but DVB-T2 doesnt find any channels. Im using w_scan 20140727. Im in the UK and my transmitter is shown as sending DVB-T2.
      Ive built drivers from V4LDVB. I also tried to include your patch 27382 but couldnt get it to compile (Error "can't select all drivers at ./build line 490")
      Is this patch what I need to get DVB-T2 working? if so whats the easiest way of getting the patched drivers.
      Thank you in advance for any help.

    2. on closer inspection w-scan does find the mutliplex with the HD channels and say the signal ok. But when it later tries to tune the channels it says "no signal" .
      Ive also now tried with vlc in windows and can get the HD channels to work.

    3. To clarify:
      Will the patch 27382, resolve issues where thehd multiplex is found but then wont tune channels?
      If so where / when will the patch be in V4LDVB ?

    4. Patch 27382 (Si2168: increase timeout to fix firmware loading) could fix the issue. I found that from time to time my PCTV 292e fails to tune DVB-T2 channels and that patch fixes it, and due to that I requested that patch to stable kernels too.
      Could you test with VLC?
      Open capture device
      Capture mode = TV - digital
      Delivery system = DVB-T2
      Bandwidth = 8 MHz
      Transponder/multiplex frequency =

    5. I can get it to work on VLC when using a window laptop. But I get errors when trying to use the ubuntu machine: "dtv access error: cannot access DVR: Permission denied" (Ive tried using root and attempted to check the groups are correct but have fail so far).

      Any idea which kernal the patch is likely to make it into ?

  11. Hello Antti!

    As I know, the device works fine with a pure T2-Base signal and a pure T2-Lite signal.
    Do you know, does it work with mixed T2-base/lite mode? I mean, is it possible for this demod to get T2-Lite stream from T2-Base FEFs (as implemented in DVB-T2 v1.3.1)?
    If yes, does the driver have ability to switch between modulation modes on locked RF-channel? Is there an option, what mode to choose for selected channel?

    Guys from Spain, France, Norway, The Netherlands, from Finland too have been trialing mixed T2 mode for two years or more.



    1. I don't know very much about Lite nor M-PLP. All live DVB-T2 muxes here in in Oulu Finland, are normal - no M-PLP nor Lite used. Hardware supports those features what Si2168 supports. M-PLP support was added recently to Linux driver. Lite does not likely work without driver changes.

      Finland switched from DVB-H to DVB-T2 few years ago and before DVB-H there was even DAB :) I suspect there isn't currently any T2 Lite trials ongoing. After the death of Nokia's mobile phone business, there is likely not much interest for mobile trials anymore...

  12. Hi!,

    Fantastic work you do!

    I have trouble with the dvb-c in sweden, qam256 and 6857 symbol rate.

    without ruining with a long post i just link my forum thread:


    Do you have any tip?, I am running OE 4.0.7 and tvheadend 3.4.27


    1. So w_scan finds all the channels, but you cannot see those?

    2. yes, the channels.conf output files looks complete. but when i replace the default channels.conf (containing some german channels) and starts the vdr-addon the file goes blanc and no channels.

  13. would it be possible to somehow edit the annex to enable 6875kbaud for tvheadend?

    1. You have to ask from tvheadend developers. Device seems to work as it finds all the channels.

  14. Hello Antti!

    First of all, thank you for your work!

    As you are taken by drivers for to my tuners (si2168, si2157)I thought you mean to most.
    I have three pieces Geniatech T230 (http://www.linuxtv.org/wiki/index.php/Geniatech_T230) tuner.
    My system: Ubuntu 14.10 minimal 3.19rc6 with fresh media_build, with VLC or Tvheadend+Kodi.
    Kernel correctly recognizes my device (but in log dont write firmware version!?).
    I Use one tuner at a time, but the problem is same. When I start or switch channel a good chance (75-80%) tuning is wrong and I get continuity counter error in log and picture artifact or green screen or does not. When tuning is good perfect all the next switch. After power on first tuning is always good.
    When two client (kodi, vlc) in same multiplex broadcast in, one channel is good, then the other is also good or both are wrong.

    What can I do about it?

    Thank you in advance for your help!

    1. Is that happening for DVB-T2 channels only? There is bug which causes DVB-T2 tune failure sometimes. Fix is there, but it is not yet in mainline https://patchwork.linuxtv.org/patch/27382/

    2. Sorry, i missed: DVB-C, QAM256, 6875Ks/s, two multiplex (176 and 184 MHz)

    3. What it prints to log when device is plugged and single tuning attempt was done?

    4. plug in:
      [138339.727857] usb 6-4: USB disconnect, device number 3
      [138339.785510] dvb-usb: Mygica T230 DVB-T/T2/C successfully deinitialized and disconnected.
      [138343.598372] usb 6-4: new high-speed USB device number 4 using ehci-pci
      [138343.731288] usb 6-4: New USB device found, idVendor=0572, idProduct=c688
      [138343.731304] usb 6-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
      [138343.731313] usb 6-4: Product: USB Stick
      [138343.731320] usb 6-4: Manufacturer: Max
      [138343.731327] usb 6-4: SerialNumber: 080116
      [138343.732780] dvb-usb: found a 'Mygica T230 DVB-T/T2/C' in warm state.
      [138343.966711] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
      [138343.966896] DVB: registering new adapter (Mygica T230 DVB-T/T2/C)
      [138343.979184] i2c i2c-10: Added multiplexed i2c bus 11
      [138343.979197] si2168 10-0064: Silicon Labs Si2168 successfully attached
      [138343.984213] si2157 11-0060: Silicon Labs Si2147/2148/2157/2158 successfully attached
      [138343.984249] usb 6-4: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)...
      [138343.984870] input: IR-receiver inside an USB DVB receiver as /devices/pci0000:00/0000:00:13.2/usb6/6-4/input/input13
      [138343.985130] dvb-usb: schedule remote query interval to 100 msecs.
      [138343.985958] dvb-usb: Mygica T230 DVB-T/T2/C successfully initialized and connected.

      after tvheadend start:
      [138403.203708] si2168 10-0064: found a 'Silicon Labs Si2168' in cold state
      [138403.208415] si2168 10-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
      [138403.777133] si2168 10-0064: found a 'Silicon Labs Si2168' in warm state
      [138403.786730] si2157 11-0060: found a 'Silicon Labs Si2146/2147/2148/2157/2158' in cold state
      [138403.791089] si2157 11-0060: downloading firmware from file 'dvb-tuner-si2158-a20-01.fw'
      after start a channel:
      [138404.854838] usb 6-4: DVB: adapter 0 frontend 0 frequency 0 out of range (110000000..862000000)

      one more comment: In tvheadend FEC is 3/5 this can not be chose, only auto mode work.

    5. I fresh media_build:

      [ 909.535726] si2168 2-0064: found a 'Silicon Labs Si2168-B40'
      [ 909.535875] si2168 2-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
      [ 910.097852] si2168 2-0064: firmware version: 4.0.4
      [ 910.109104] si2157 3-0060: found a 'Silicon Labs Si2148-A20'
      [ 910.109288] si2157 3-0060: downloading firmware from file 'dvb-tuner-si2158-a20-01.fw'
      [ 911.177370] si2157 3-0060: firmware version: 2.1.6

    6. With new firmware:
      [ 1129.547316] si2168 2-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
      [ 1130.332719] si2168 2-0064: firmware version: 4.0.11
      [ 1130.344101] si2157 3-0060: found a 'Silicon Labs Si2148-A20'
      [ 1130.344238] si2157 3-0060: downloading firmware from file 'dvb-tuner-si2158-a20-01.fw'
      [ 1131.411497] si2157 3-0060: firmware version: 2.1.6

    7. It still does not work well even that latest media_build (it is driver having all the fixes) is used?
      Support for that device was added someone else, IIRC CrazyCat or Olli. Olli has added support for most of the Si2168 devices as well major contributions to driver changes needed. So maybe you should ping those persons for help. I don't have that device. Only Si2168 devices I have are PCTV 290e and new Hauppauge HVR-5525.

  15. Which kernel versions did https://patchwork.linuxtv.org/patch/27382/ make it into? Is it on the 3.19.y branch yet? Thanks.

  16. The labeling on the regulator IC is clearer on my device. It is an Anpec APW7139, datasheet available from http://www.anpec.com.tw/ashx_prod_file.ashx?prod_id=12&file_path=20100907143900767.pdf&original_name=APW7139.pdf

    Do you have any plans to implement signal strength reporting or any clues on what mechanism might exist to implement it, is the patch at https://patchwork.linuxtv.org/patch/25821/ all that is needed or is there more work needed after that?

  17. Hi Antti Palosaari
    Don't know if you can help but I think I have found a bug with DVBLink Server Software when using the 290e and 292e Sticks. If a TV stream is initiated on the host from WMP, WMC, VLC picture is great with no disconnects. If stream is initiated from the web client I get Pixilation (Disconnects) also if stream is initiated from 'Any Remote Client’.
    Today I have discovered they have inbuilt Amplifiers so I am guessing when Stream is initiated from Host using WMC, WMP or VLC Amplifier's are automatically switched on. What code is used to initiate the Amps? It seems if initiated by a remote client Amps are not activated! I found out about the amps when installing DistanTV, it gives options to turn amps on, off, or Auto.

    Thanks in advance

    1. Yes there is really amplifier on both of those sticks. There is own DVBv5 API call for that amplifier. So application support is needed in order to use it. For example dvbv5-zap --lna=1 enables amp.

    2. Thank you so much :-)

      I will pass the information on.

      Here is a video of the problem: https://youtu.be/8eKz1TWaJQs

    3. Hi Again Antti Palosaari

      So would I be correct is saying: when a ‘Remote’ stream is initiated to the TV Server the Server should send: dvbv5-zap --lna=1 to the relevant stick to ensure Amplifier is initialised?

      Thanks again

    4. Sorry, so many questions are coming into my head now.

      How would I obtain the TV sticks State, to find out if the Amp is on or off. Or could I invoke the amp to the on state?

      Would either of the above be possible from command prompt on a Win 7 Machine?

      Thanks Again