Naked hardware #17: PCTV DVB-S2 Stick (461e)

PCTV DVB-S2 Stick (461e) teardown

PCTV DVB-S2 Stick (461e)

Outwardly, that satellite receiver is just similar than its predecessor, having even same name, but different model number 460e. Also feature set is same - DVB-S/S2 USB receiver with remote controller. Without common interface (CI), it cannot be used for receiving encrypted channels, but free-to-air (FTA) content only.

Only differences between old and new version could be found from the device internals, where DTV chipset is changed to totally different one. Old model uses NXP TDA10071 & Conexant CX24118 demod & tuner combo, whilst that new one is build upon Montage M88DS3103 & Montage M88TS2022. 461e appeared to marked circa one year ago (around September 2013) and replaced old 460e quickly. 461e USB ID is 2013:0258, whilst 460e uses ID 2013:024f.

Initial Linux driver went into Kernel 3.14. Currently that device is one of the rare USB satellite receivers, having both good availability and drivers in mainline kernel.

Unfortunately I don't have a retail package, but only the stick itself. Retail package should include additionally remote controller and USB cable - which are those same coming with almost every PCTV Systems USB receiver. So lets forget all that extra stuff and take a look to device internals! 

Key components:
Empia EM28178
Montage M88DS3103
Montage M88TS2022
Allegro A8293

General hardware design

Device is build on single PCB, having USB connector on other end and antenna connector on the another. There is surprisingly large amount of components, assembled to both PCB sides rather compactly. I wonder how there could be that much extra components needed for connecting few chips together... PCB is also rather big if you compare to most DVB-T USB devices, but DVB-S/S2 receivers tends to be  bigger than DVB-T receivers always. I think it could be still even smallest USB satellite receiver currently.

External 12V power supply is needed, as always for USB satellite receiver, feeding power to LNB. Similar (same?) power supply was used for old 460e too.

PCB upper side

PCTV DVB-S2 Stick (461e)

All important chips are assembled that side of the PCB. Chips counted from antenna connector are M88TS2022 (RF tuner), M88DS3103 (demodulator), EM28178 (USB-bridge). USB-bridge is partly under the IR receiver component. A8293 LNB power supply is small chip near external power supply connector and big component marked WE 330 (power inductor).

Montage M88TS2022

Montage M88TS2022

M88TS2022 is satellite tuner. It receives LNB IF frequency and drops it to the baseband aka Zero-IF. That tuner is successor of the M88TS2020. Both M88TS2022 and M88TS2020 are quite similar. M88TS2020 was used mostly with M88DS3000 demodulator whilst M88TS2022 is usually seen as a pair with M88DS3103 demodulator.

27 MHz clock needed is feed from crystal located another side of the PCB. 

Montage M88DS3103

Montage M88DS3103

DVB-S/S2 satellite TV demodulator. That chip receives radio signal from the tuner (M88TS2022) and decodes it to bit stream, which is then feed over MPEG TS interface to the EM28178 chip. That demodulator needs ~8kB firmware, which is downloaded by the driver. 27 MHz clock is feed from the another side of PCB. There is only one 27MHz crystal on whole device, which means clock is shared between tuner and demod. Clock sharing is nowadays very common as rather costly crystal components could be saved easily.

There is another very similar chip seen on some other PC receivers. That chip is M88DS3002. I suspect it is only earlier revision and differs marginally from the M88DS3103. Even before M88DS3002 there was M88DS3000 DVB-S/S2 demodulator, which is same chipset family, but differs more or  less from M88DS3002/M88DS3103. There is existing Linux driver for old M88DS3000 too. M88DS3000 => M88DS3002 => M88DS3103.

M88DS3103 demodulator in conjunction with M88TS2022 tuner is very common DVB-S/S2 DTV chipset currently. I don't have clear vision how widely it is used for STBs or TVs, but for PC TV market it is in practice the only one chipset used at the moment.

Empia EM28178

Empia EM28178

That chip is DTV USB-bridge, from the rather popular Empia EM28xx family. Its main job is to transfer stream from the demodulator to host computer over USB. It also handles remote controller.

In this picture there is remote controller receiver partly top of the EM28178. It is that quite big three pin component having long legs.

Required 12MHz clock is coming from crystal located another side of the PCB. Also eeprom, needed by bridge, is located another side. EM28178 loads configuration from the eeprom during power-up. That configuration contains USB ID amongst the other things.

Same EM28178 bridge chip was used for PCTV tripleStick (292e) receiver too.

Allegro A8293

Allegro A8293

LNB power supply. LNB needs power in order to work properly. Power is feed over antenna cable and that chip does that job. Voltage is also used to select receiving signal polarity - horizontal or vertical.

Chips is controlled over I2C bus.

That same chip was used for older 460e model too.

PCB bottom side

PCTV DVB-S2 Stick (461e)

Visible parts are, two crystals, eeprom and current limiter chip.

Crystal near antenna is 27MHz and feeds clock for demodulator and tuner. Another crystal, center of PCB, is 12MHz for USB-bridge.

PCB printings:
Redshift
2000000-02 LF
pctv systems

12.000 MHz crystal

Xtal 12.000 MHz

Clock source for Empia EM28178.

27.000 MHz crystal

Xtal 27.000 MHz

Clock source for Montage M88DS3103 & M88TS2022.

Microchip 24LC128

Microchip 24LC128

Eeprom package marking "4LC", Microchip 24LC128, 128Kbit serial eeprom. That chip contains device specific configuration, like USB ID.

Alpha and Omega Semiconductor’s AOZ1360

Alpha and Omega Semiconductor’s AOZ1360

That chip is current limiter. It is located very near external power supply connector and LNB power supply chips, which both are located just opposite side of PCB. I think it is there to protect device for possible LNB power short circuit.

Component is passive and do not need a driver.

Linux driver

Linux driver has been in kernel since 3.14. Device driver consists of 4 chip drivers: em28xx, m88ds3103, m88ts2022 and a8293.

Device needs firmware for M88DS3103 demodulator, which could be downloaded from here.

USB interface

IDLE current drain without a driver: 60 mA

lsusb -vvd 2013:0258 Bus 002 Device 003: ID 2013:0258 PCTV Systems Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x2013 PCTV Systems idProduct 0x0258 bcdDevice 1.00 iManufacturer 3 PCTV Systems iProduct 1 PCTV 461e iSerial 2 753951 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 41 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0000 1x 0 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered)

Pictures

Naked hardware #15: PCTV tripleStick (292e)

PCTV tripleStick (292e) teardown

PCTV tripleStick (292e)

tripleStick is the latest DVB-T/T2/C stick from PCTV Systems, successor of the old good PCTV nanoStick T2 (290e). It has a little bit better features compared to old nanoStick T2 as nanoStick T2 didn't support officially DVB-C at all, only DVB-T and DVB-T2. Case is just similar and it is hard to distinguish visually between nanoStick T2 and tripleStick. Only differences seems to be colored logo on upper-side and model number (290e vs. 292e) on backside.

That device appeared to market beginning of this year, during January 2014 or so. It replaced rather quickly old nanoStick T2. If you now order nanoStick T2 you will likely get tripleStick as a replacement. nanoStick T2 has been very popular stick among the Linux users as it have been basically the only one DVB-T2 capable stick which works out of the box (I made its driver for Kernel 3.0). My initial plan was not write driver for tripleStick, but I changed my mind after large amount of feedback from users who has ordered old well supported nanoStick T2, but got non-working tripleStick instead. So, I decided to give a try for reverse-engineering that Silicon Labs DTV chipset open.

PCTV Systems has assigned USB ID 2013:025f for that device. Windows driver knows also USB ID 2013:025b for 291e. According to Windows driver tripleStick, 292e, seems to be just renamed 291e for the reason or the other. Stick PCB also has model number 291e printed.

PCTV 292e (291e)

Initial Linux support will go the Kernel 3.16 if nothing unexpected happens.


Key components:
Empia EM28178
Silicon Labs Si2168
Silicon Labs Si2157

Hardware internals

That device is build to two PCBs, which are attached together like a sandwitch. It is somehow popular construction only for PCTV Systems and Hauppauge devices. Earlier, Pinnacle also used that kind of sandwich construction, maybe its backgrounds are from there, dunno (PCTV Systems was Pinnacle).

USB bridge / main PCB

Main PCB

That is top side of main PCB. Biggest chip clearly visible is EM28178.

PCB printings:
291e Main
2030000-02 LF
pctv systems

Empia  EM28178

Empia EM28178

EM28178 is USB-bridge, maybe the latest version from Empia EM28xx family. Clock source is crystal (it should be 12 MHz) which is located on same PCB, but bottom side, between the "sandwich".

Regulator?

regulator?

There is another 10 pin chip too, located right side of EM28178. Unfortunately that chip printings are too unclear and I cannot guess what it is. It cannot be LNA as RF parts are located on another PCB. Maybe some regulator? 

Serial eeprom

eeprom I2C bus wires

I2C serial eeprom is located on main PCB, but it is bottom side - between the PCBs. I2C bus wires from EM28178 to eeprom are clearly visible. It is those two long wires going from chip to right on picture and ending right side of "PCTV" text. I2C bus itself goes through PCB directly to eeprom located just other side of PCB. Copper pads are debug pins, attach your sniffer there :) It is not possible sniff demodulator and tuner from that point because only eeprom is connected to this bus. EM28178 has 2 I2C bus. First bus is for eeprom and all the rest are on second bus. However, attaching sniffer to second I2C bus is even more easier as that bus is routed to another PCB via those soldered pin headers.

serial eeprom

Demodulator and tuner / tuner PCB

Tuner PCB

That PCB is practically dedicated for RF parts "tuner". Demodulator, RF tuner and LNA are all here.


PCB printings:
291e Tuner
20300001-02 LF
pctv systems

Silicon Labs Si2157 & Silicon Labs Si2168

Silicon Labs Si2157 & Silicon Labs Si2168

Chip "215730" seen on picture is Silicon Labs Si2157 RF tuner. Metal box, just upper-side of chip, is crystal which offers 24 MHz reference clock. I2C bus is coming through the Si2168 demodulator, chip on the right side. Si2157 is very modern RF tuner which runs firmware and has has a DSP for digital filtering (and more?). Both of those are very uncommon choices for current silicon RF tuners. I can remember only Xceive tuners having firmware before that. DSP is even more uncommon...

Biggest chip, Si2168, is DVB-T/T2/C demodulator from Silicon Labs. It is the most popular DVB-T2 capable demodulator used for PC TV receivers currently. Demodulator supports also T2-Lite profile (DVB-T2 extension) which is aimed mainly for mobile transmissions, mobile TV and radio.

There is no own crystal for Si2168 (or it is hiding another side of PCB), which means clock is feed via Si2157, saving few components. Demodulator offers gated I2C bus for Si2157 RF tuner, as norm is nowadays. TS interface pins are located mostly left side of the chip. Surprisingly it looks like TS is connected using parallel connection...

Metal box right side of  Si2168 is remote controller receiver (IR RX). Weird looking IR component, though. It is connected to EM28178 which decodes IR key codes.

Low-noise amplifier

602

That chip must be LNA as it is clearly middle of the RF signal path, between antenna connector and RF tuner. Specifications unknown, labeled as 602. LNAs are usually controlled over GPIO line. Wired to EM28178 GPIO?

Linux driver

There was existing driver for EM28178 USB-bridge, but no driver for Si2168 nor Si2157. Fortunately both Si2168 and Si2157 provided very high level firmware API for device control. That makes protocol reverse-engineering pretty easy.

Current driver supports only minimal set of features in order to receive DVB-T/T2/C. There is no signal statistics implemented at all. Power management is also broken, it leaves device full active when device is closed, as it should set tuner and demod sleep. Broken PM is actually Windows driver bug - it is hard reverse-engineer it bug free when sniffs from Windows are already broken. All-in-all, it eats ("only") 210mA from USB when idle and Windows does not behave any better.

Driver can be found from that development tree:
http://git.linuxtv.org/cgit.cgi/anttip/media_tree.git/log/?h=pctv_292e


Si2168 needs firmware, which I named as dvb-demod-si2168-01.fw. Firmware size is only 2720 bytes, meaning it cannot be whole firmware, but a kind of the partial patch.
Firmware can be extracted from the bundled driver CD version 6.4.8.984.

file:
/TVC 6.4.8/Driver/PCTV Empia/emOEM.sys

extract:
dd if=emOEM.sys ibs=1 skip=1089416 count=2720 of=dvb-demod-si2168-01.fw

verify checksum:
md5sum dvb-demod-si2168-01.fw
87c317e0b75ad49c2f2cbf35572a8093  dvb-demod-si2168-01.fw

Reverse-engineering scripts I used to parse I2C demod and tuner I2C traffic are available here. There is also few already parsed sniffs to look example and compare things. These are surely very helpful if you are adding new features or support for new chip revisions / versions.

USB interface

IDLE current drain without a driver: 68 mA

lsusb -vvd 2013:025f Bus 001 Device 003: ID 2013:025f PCTV Systems Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x2013 PCTV Systems idProduct 0x025f bcdDevice 1.00 iManufacturer 3 PCTV iProduct 1 PCTV 292e iSerial 2 0011370547 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 41 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0000 1x 0 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered)

Pictures