Motorola DCT 2000 Diagnostics
My Comcast cable service went out while I was gone on a multi-week trip. Its output passes through my VCR on the way to my television. The DCT 2000 set-top box was tuned to a specific channel, and the VCR was programmed to record the same program each week.
I returned to find that I could change channels on the set-top box, but the resulting screen was blank with no audio. However, I did get the channel information banner at the bottom of the screen for a few seconds, indicating that the box was still getting signals from Comcast. As for the VHS tape, it had the first two weeks' programs and then just carefully recorded black screens with no audio. Something had gone wrong while I was gone.
I called customer service, and went through the interactive process to send a reset signal to the box. That didn't help.
Then I called again, and after wading through the tedious voice menus, finally got a "service" representative on the line. That started a long session in which I repeatedly assured her that yes, my television is turned on, and it is tuned to its channel 3, and no, I have not been messing with the cables.
Excuse me, did you not understand my story, that no one has touched the cables or the configuration for the whole multi-week period, and that the tape shows that something happened some time between days 14 and 21?
This, of course, brought further questions as to whether my television is really turned on, and tuned to channel 3, and what have I changed with the cabling to cause this problem?
She eventually gave up on trying to get me to confess to having caused this problem, and said that she would send a service technician out. This call was happening on Thursday evening, and she asked if I would be available between 10 and 12 on Friday morning.
"Late tomorrow morning? That would work."
Oh no, not tomorrow, but Friday of next week, eight days from now!
So, over a week later, the technician showed up at the appointed time. And within the first 10 seconds he saw that it was obviously Comcast's fault.
On the plus side, he showed me how to get into the diagnostic menus of the Motorola DCT 2000 set-top box.
You normally need to hold the Power button down for a second or longer to turn the unit off. Not that I ever do, having read many places that problems are often avoided by leaving it on to get updates from the company.
Anyway, just tap the Power button and then start pushing the Select button repeatedly. You may have to experiment to get the feel for this, but you should be thrown into a white on dark blue screen like the below:
DCT 2000 DIAGNOSTICS >>01 General Status 02 OOB Status 03 In Band Status 04 Audio/Video Status 05 Unit Address 06 Firmware Version 07 Current Channel Status 08 Renewable Security 09 Upstream Modem 10 App Code Modules 11 Memory Config 12 Interactive Info 13 MAC Frequency Table 14 Message Types 15 In Band PAT 16 In Band PMT 17 Task Status 18 IB MCA Status 19 Keyboard/LED
You can move up and down and select the menu items much like selecting channels in the box's normal mode. Below is my interpretation of what the various screens mean — corrections and elaborations are invited! Contact me if you have anything to add or correct here.
Shows Platform ID, Family ID, Model ID, and Tuner, which would
disambiguate models with internal differences but identical
OOB (Out of Band) Status
Shows the signal to noise ratio for the OOB data stream and its carrier frequency.
In Band Status
Shows whether the unit has locked onto the channel carrier, its signal to noise ratio, modulation mode (e.g., QAM-256), and carrier frequency. While it's tedious to jump in and out of diagnostic mode between channel changes, just a little shows that the channels are not in frequency order.
Shows a hardware address, in the form nnn-nnnnn-nnnnn-nnn in base 10. Also shows a network address in the same form — this seems unrelated to the IP address shown in another screen.
Shows the firmware version number and the date and time of the last update. These updates are pushed out by the cable company.
Current Channel Status
Information about the currently selected channel — is it purchasable, is it purchased, is the box connected, what is the channel number and carrier frequency.
Very little information (at least in my situation).
At least for me, the screen itself begins:
STARVUE II DIAGNOSTICS
suggesting that that is the model of the upstream modem. Signal level and frequency, is IPPV (Interactive Pay Per View) enabled.
App Code Modules
I'm guessing that these are programs that can run on the DCT 2000.
I see a list of four:
The values in the "Used" column in the bottom table change every few seconds, but here's an approximate screenshot:
MEMORY STATUS EEPROM Ver.NO. 00.00 PLATFORM APPLICATION NVMEM 236K 20K DRAM 512K 1.5M FLASH 768K 1.25M ROM n/a n/a SYSTEM HEAP PgSz PgCnt Alloc Used Fail 256 627 n/a 306 0 8 1 32 1 0 16 2 32 27 0 32 6 48 6 0 64 76 304 283 0 128 16 32 19 0
This is the main one used by the technicians, as a quick look should show an assigned IP address. If the box has an IP address, then the hardware is all in good shape. If a fix is needed, it can be done by pushing out data from the cable company.
Comcast (at least here in north-central Indiana) used to assign addresses from the 126.96.36.199/8 IP address block. That's a reserved block set aside for RIPE but not in use. Over a year later I repeated the experiment and saw the private 10.0.0.0/8 IP address block in use.
Yes, I tried, I could not scan the set-top box with
or even reach it with
even from the machine on the same cable drop.
The DOCSIS modem sees one data stream,
the set-top box sees another.
I would assume that they occupy
entirely different frequency bands.
This screen also shows both upstream and downstream IDs,
the box state, and something that very vaguely resembles
INTERACTIVE INFO IP : 10.249.41.108 UPM : 0x016657 UPSTREAM ID : 0x0018 DOWNSTREAM ID : 0x046D STATE : RUNNING MAC ABORT CNTR: 0000 GOOD PACKETS : ERROR PACKETS : SOCKET PORT STATE|SOCKET PORT STATE 0 17541 READY 8 UNUSED 1 10250 READY 9 UNUSED 2 50000 READY 10 UNUSED 3 1024 READY | 11 UNUSED 4 UNUSED| 12 UNUSED 5 UNUSED| 13 UNUSED 6 UNUSED| 14 UNUSED 7 UNUSED|
MAC Frequency Table
Beats me. It looks like this:
FREQ POWER 08672000 54 06480000 53
This is intriguing, as it looks vaguely like
The numbers change every couple of seconds, and the
counters roll over — from 255 to 0 in the lower table,
I'm guessing from 65,535 to 0 in the upper one.
Here's an approximate screen shot:
MESSAGE TYPES (hex data) OOB: INB: PID Cnt PID Cnt Lost DRAM 0001 0 0000 1 0 0 1C0A 54966 0037 33586 0 0 0777 22759 0984 0 0 0 150c 26583 0983 0 0 0 0FB0 5006 0000 0 0 0 0000 0 0000 0 0 0 Msg Id Cnt Msg Id Cnt Msg Id Cnt 0 - 108 92 17 61 FD - 5 1 - 242 95 14 32 2 3 87 9A E 0 80 1A 22 A0 15 0 81 B 4 A2 - 210 82 1C 27 B0 - 198 83 C 10 C0 13 58 85 F 50 C1 7 104 86 19 0 C2 18 174 8C - 184 C3 16 233 8D 8 0 C4 A 95 8E 10 35 C5 9 29 8F 12 210 D8 11 64 90 1B 22 E0 - 4 91 D 0 E3 - 3
This looks like a process table.
TID RID PRI STARTS RUNTIME STK%
There are multiple screens, TID counts down from 80 to 1.
The DCT 2000 runs the VxWorks operating system. See, for example, this press release when the replacement for the DCT 2000 was released back in 2003.
This page claims:
The DCT-2000 system consists of 2 complete CPU systems.
The first, and most obvious cpu, is the Motorola MC68331 chip,
along with its various roms, rams and flash.
This CPU controls the onscreen menus, channel guides,
and other eye candy.
It also has a convenient programming port.
The software controlling the menus, consists of a small
"kernel" (though not a kernel in the OS sense, necessarily)
of rom code, written by GI/Motorola, that is very basic,
but smart enough to download extra code over the wire.
It also generally includes cableco specific software,
that may vary by cableco nationwide, or even regionally.
The second CPU is hidden in the chip I labeled "B" on my "inside look" page. It coexists with general digital signal processing, and possibly a crypto core. This CPU decides what you get to watch, what information to send to the 68331 (for channel guide, etc) and other things. It has a small 32k SRAM (labeled "D") which I suspect has the subscription information, box ID, and other critical info.