Naked hardware #10: Hauppauge WinTV HVR 930C

About device

That USB device is so called hybrid television receiver as it supports both digital and analog TV. Supported digital television standards are terrestrial (DVB-T) and cable (DVB-C). It also supports FM-radio and has video inputs (S-Video and Composite video). Not to mention quite simple remote controller. All that makes it quite feature rich DTV USB stick!

Hauppauge has assigned USB ID 2040:1605 for that device.

Device is supported partially on Linux starting from the Kernel 3.3. Digital TV and remote controller is supported, whilst all analog stuff is not working.

Unfortunately there is currently new version available, with USB ID 2040:b130, that is not supported on Linux at the moment, as there is no Linux driver for used demodulator. New version has letters "HD" at the end of the name (Hauppauge WinTV HVR 930C HD). Stick itself looks same.

Lets teardown!

Hauppauge WinTV HVR 930C teardown

Hauppauge WinTV HVR 930C

Key components:

Empia EM2884
Micronas AVF 4910
Micronas DRX 3913K
Xceive XC5000

Sandwich PCB design

sandwich PCB

Device is constructed to two PCBs which are attached together like a sandwich. PCBs could not be separated without soldering. That kind of construction is not very common nowadays, but there is some others too, like PCTV nanoSticks. You could get a little bit shorter stick using sandwich design, especially in case of device having that many chips.

Gold colored connector, between the PCBs, near antenna connector is for analog video input. Composite video / S-video adapter cable is plugged to that connector.

There is two chips hidden between the PCBs. Those are USB interface and serial eeprom. Eeprom contains some configuration information as usually, like USB ID, USB strings, endpoint configuration and so. Hauppauge has assigned MAC address for that device too, which is very rare luxury nowadays! Honestly speaking, it is hard to see practical use scenario for MAC address. What I understand, it is aimed for IP transmission over DTV, which is not widely (not at all?) used nowadays. Anyow, it will not hurt anyone. MAC address is stored to that eeprom also.

Used USB interface chip is Empia EM2884. EM2880 series supports both digital and analog interfaces, whilst EM2870 has only digital interface. There is wide range of EM28xx chips, having different combination of features or just newer revisions chips with different chip model number.

EM2884 IR receiver is located opposite side of device. It could be hardly seen in that picture. Just typical IR-looking 3 pin black box.

RF tuner and digital demodulator

Micronas DRX 3913K and Xceive XC5000

RF tuner

Xceive XC5000 silicon RF tuner chip is located centre of the PCB. There is clearly visible copper square around the chip - likely left for possible RF shielding. Shielding is quite often used to reduce RF noise originating from the tuner. XC5000 is rather complex silicon tuner, designed for large scale of both analog and digital television standards. 32.000 MHz crystal, metal box left side of XC5000 in that picture, feeds clock for XC5000 tuner.

If you look carefully enough, you could see two wires between these two chips (XC5000 and DRX 3913K). There seems to be small 6 pin component (marked ARK X2) on that bus near tuner. That bus is either for control (I2C) or RF signal (intermediate frequency). I suspect it is RF signal bus and ARK X2 is switch that select whether to feed signal to analog demodulator or digital demodulator. That could be confirmed using oscilloscope if needed. Sometimes, especially when debugging problems, it could be nice to check signals travelling on that kind of buses, but unfortunately it is usually very challenging to find suitable pads to attach measure probes.

Digital demodulator

DTV demodulator used is Micronas DRX 3913K. It is one of the first multistandard demodulators having both DVB-T and DVB-C. Originally demodulator was made by Micronas but later these was sold to Trident Microsystems.

20.250 MHz crystal seen in picture is demodulator clock source.

DRX-K demodulator product family

DRX-K family contains following demodulators and them properties:
DRX 3913K: DVB-C, DVB-T
DRX 3916K: DVB-T, analog demod
DRX 3918K: DVB-T, analog demod, stereo decoder
DRX 3923K: DVB-C, DVB-T, analog demod, stereo decoder
DRX 3926K: DVB-C, DVB-T, analog demod

Analog demodulator

Micronas AVF 4910

That side of device is not so interesting as only visible chip is AVF 4910 analog demodulator. 20.250 MHz clock is get from the crystal visible on picture. It is just same clock frequency as used by digital demodulator on the other side. That chip is sometimes used in conjunction with DRX 3913K in order to provide both digital and analog television.

If you look this device, as a level how chips as are connected, analog demodulator is located between USB interface and RF tuner - just similarly as a digital side too.

digital RF path:
antenna =>  XC5000 => DRX 3913K => EM2884 => PC
analog RF path:
antenna =>  XC5000 => AVF 4910 => EM2884 => PC
analog video input path:
video input =>  AVF 4910 => EM2884 => PC

There is no Linux driver for that chip currently. Due to that, this device  video inputs and analog television is not working on Linux.

USB interface

IDLE current drain without a driver: 142 mA

lsusb -vvd 2040:1605 Bus 002 Device 010: ID 2040:1605 Hauppauge Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x2040 Hauppauge idProduct 0x1605 bcdDevice 1.00 iManufacturer 0 iProduct 1 WinTV HVR-930C iSerial 2 4034546206 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 305 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 255 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0001 1x 1 bytes bInterval 11 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0000 1x 0 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0000 1x 0 bytes bInterval 4 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0000 1x 0 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 1 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 255 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0001 1x 1 bytes bInterval 11 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0000 1x 0 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x00c4 1x 196 bytes bInterval 4 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 2 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 255 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0001 1x 1 bytes bInterval 11 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0ad0 2x 720 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x00c4 1x 196 bytes bInterval 4 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 3 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 255 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0001 1x 1 bytes bInterval 11 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0c00 2x 1024 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x00c4 1x 196 bytes bInterval 4 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 4 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 255 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0001 1x 1 bytes bInterval 11 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x1300 3x 768 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x00c4 1x 196 bytes bInterval 4 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 5 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 255 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0001 1x 1 bytes bInterval 11 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x1380 3x 896 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x00c4 1x 196 bytes bInterval 4 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 6 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 255 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0001 1x 1 bytes bInterval 11 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x13c0 3x 960 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x00c4 1x 196 bytes bInterval 4 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 7 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 255 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0001 1x 1 bytes bInterval 11 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x1400 3x 1024 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x00c4 1x 196 bytes bInterval 4 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered)

Pictures

Naked hardware #9: TerraTec Cinergy T Stick Dual RC (rev. 2)

TerraTec Cinergy T Stick Dual RC (rev. 2) teardown

That device is ITE Tech IT9135 reference design. It has two independent tuners, so called dual tuner model.
TerraTec has assigned USB ID 0ccd:0099 for that device. Unfortunately same USB ID is used for original revision 1 model too, which is build upon AF9015 chipset. AF9015 belongs to same chipset family, but it is two generation older and differs notably. Hey TerraTec guys, don't do that in future, it causes quite a lot headache!

Device is supported under Linux starting from the Kernel 3.10. Linux AF9035 driver supports IT9135/IT9137 too.

TerraTec Cinergy T Stick Dual RC (rev. 2)

TerraTec Cinergy T Stick Dual RC (rev. 2)

Key components:

ITE Tech IT9137
ITE Tech IT9133

PCB top side

PCB top side

Only chip attached to that side of PCB is IT9137. That chip is so called 3-in-1 as it contains USB-interface, demodulator and RF-tuner. It is all what is needed for DVB-T USB stick.
Black box with 3 pins, partially top of IT9137, is IR-receiver. It is connected to the IT9137, which handles IR decoding. There is also crystal clearly visible. Crystal markings are missing from the reason or the other, but it is most likely 12.000 MHz.

There is two versions of these (IT9130 series) chips available, version 1 and 2. Chips used on that device seems to be version 1. You could see letters AX (v1) or BX (v2) printed top of the chip.

PCB printings: RD168OC VER1.1.

AF9030 and IT9130 family relations

IT9130 family is successor of AF9030 family. Main difference between these families is integrated RF-tuner. IT9130 has integrated RF-tuner whilst external tuner is needed for AF9030. USB-interface and demodulator seems to be quite same between all these chips.

IT9137 is same as IT9135 but contains physical pins for connecting slave demodulator (for dual tuner configuration and/or diversity).

These chips are sold as following chip names and integrated combinations:
* AF9032 = demodulator ?
* AF9033 = demodulator
* AF9035 = USB-interface + demodulator
* IT9133 = demodulator + RF-tuner
* IT9135 = USB-interface + demodulator + RF-tuner
* IT9137 = IT9135 + MPEG TS input for connecting slave IT9133

PCB bottom side

PCB bottom side

Only chip on that side is IT9133. That chip contains demodulator and RF-tuner. It offers second tuner to that device. IT9133 is connected to the IT9137 (other side) as a slave, using I2C bus for control and serial TS for data stream. Also clock is feed through IT9137 saving one crystal.

PCB printings: 94-V0, 1213, LJ-M E300053

Missing eeprom

I cannot see serial eeprom anywhere. Device has still TerraTec USB ID, so there must be eeprom somewhere. I suspect it is integrated to the IT9137. I am pretty sure all IT9135 devices does not have eeprom at all, which makes me wonder if there is versions with and without. Maybe it will be clear after I teardown few more IT9135 devices.

USB interface

IDLE current drain without a driver: 181mA

lsusb -vvd 0ccd:0099 Bus 002 Device 004: ID 0ccd:0099 TerraTec Electronic GmbH Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0ccd TerraTec Electronic GmbH idProduct 0x0099 bcdDevice 2.00 iManufacturer 1 ITE Technologies, Inc. iProduct 2 DVB-T TV Stick iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 71 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 3 Human Interface Device bInterfaceSubClass 0 No Subclass bInterfaceProtocol 1 Keyboard iInterface 0 HID Device Descriptor: bLength 9 bDescriptorType 33 bcdHID 1.01 bCountryCode 0 Not supported bNumDescriptors 1 bDescriptorType 34 Report wDescriptorLength 65 Report Descriptors: ** UNAVAILABLE ** Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 10 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered)

Pictures