Motorola DCT 2000 digital set-top box for cable television. Oooh, the messages light is lit! That means I could look at some on-screen spam urging me to watch the latest wrestling pay-per-view show.

Motorola DCT 2000 Diagnostics

Comcast Diagnostics

My Comcast cable service went out while I was gone on a multi-week trip. Its output passes through my VCR on the way to my television. The DCT 2000 set-top box was tuned to a specific channel, and the VCR was programmed to record the same program each week.

I returned to find that I could change channels on the set-top box, but the resulting screen was blank with no audio. However, I did get the channel information banner at the bottom of the screen for a few seconds, indicating that the box was still getting signals from Comcast. As for the VHS tape, it had the first two weeks' programs and then just carefully recorded black screens with no audio. Something had gone wrong while I was gone.

I called customer service, and went through the interactive process to send a reset signal to the box. That didn't help.

Then I called again, and after wading through the tedious voice menus, finally got a "service" representative on the line. That started a long session in which I repeatedly assured her that yes, my television is turned on, and it is tuned to its channel 3, and no, I have not been messing with the cables.

Excuse me, did you not understand my story, that no one has touched the cables or the configuration for the whole multi-week period, and that the tape shows that something happened some time between days 14 and 21?

This, of course, brought further questions as to whether my television is really turned on, and tuned to channel 3, and what have I changed with the cabling to cause this problem?

She eventually gave up on trying to get me to confess to having caused this problem, and said that she would send a service technician out. This call was happening on Thursday evening, and she asked if I would be available between 10 and 12 on Friday morning.

"Late tomorrow morning? That would work."

Oh no, not tomorrow, but Friday of next week, eight days from now!

So, over a week later, the technician showed up at the appointed time. And within the first 10 seconds he saw that it was obviously Comcast's fault.

On the plus side, he showed me how to get into the diagnostic menus of the Motorola DCT 2000 set-top box.

You normally need to hold the Power button down for a second or longer to turn the unit off. Not that I ever do, having read many places that problems are often avoided by leaving it on to get updates from the company.

Anyway, just tap the Power button and then start pushing the Select button repeatedly. You may have to experiment to get the feel for this, but you should be thrown into a white on dark blue screen like the below: 

DCT 2000 DIAGNOSTICS
>>01 General Status
  02 OOB Status
  03 In Band Status
  04 Audio/Video Status
  05 Unit Address
  06 Firmware Version
  07 Current Channel Status
  08 Renewable Security
  09 Upstream Modem
  10 App Code Modules
  11 Memory Config
  12 Interactive Info
  13 MAC Frequency Table
  14 Message Types
  15 In Band PAT
  16 In Band PMT
  17 Task Status
  18 IB MCA Status
  19 Keyboard/LED

You can move up and down and select the menu items much like selecting channels in the box's normal mode. Below is my interpretation of what the various screens mean — corrections and elaborations are invited! Contact me if you have anything to add or correct here.

General Status

Shows Platform ID, Family ID, Model ID, and Tuner, which would disambiguate models with internal differences but identical cases. I see 0x0011, 0x00b, 0x00f2, and V860DL, respectively.

OOB (Out of Band) Status

Shows the signal to noise ratio for the OOB data stream and its carrier frequency.

In Band Status

Shows whether the unit has locked onto the channel carrier, its signal to noise ratio, modulation mode (e.g., QAM-256), and carrier frequency. While it's tedious to jump in and out of diagnostic mode between channel changes, just a little shows that the channels are not in frequency order.

Unit Address

Shows a hardware address, in the form nnn-nnnnn-nnnnn-nnn in base 10. Also shows a network address in the same form — this seems unrelated to the IP address shown in another screen.

Firmware Version

Shows the firmware version number and the date and time of the last update. These updates are pushed out by the cable company.

Current Channel Status

Information about the currently selected channel — is it purchasable, is it purchased, is the box connected, what is the channel number and carrier frequency.

Renewable Security

Very little information (at least in my situation).

Upstream Modem

At least for me, the screen itself begins:
STARVUE II DIAGNOSTICS
suggesting that that is the model of the upstream modem. Signal level and frequency, is IPPV (Interactive Pay Per View) enabled.

App Code Modules

I'm guessing that these are programs that can run on the DCT 2000. I see a list of four: 00082000, Tv_Guide, osc2000s, and MACGclnt.

Memory Config

The values in the "Used" column in the bottom table change every few seconds, but here's an approximate screenshot: 

MEMORY STATUS

EEPROM Ver.NO.     00.00
       PLATFORM  APPLICATION
NVMEM     236K      20K
DRAM      512K      1.5M
FLASH     768K      1.25M
ROM       n/a       n/a

SYSTEM HEAP
PgSz PgCnt  Alloc    Used   Fail
256    627    n/a     306      0
  8      1     32       1      0
 16      2     32      27      0
 32      6     48       6      0
 64     76    304     283      0
128     16     32      19      0

Interactive Info

This is the main one used by the technicians, as a quick look should show an assigned IP address. If the box has an IP address, then the hardware is all in good shape. If a fix is needed, it can be done by pushing out data from the cable company.

Comcast (at least here in north-central Indiana) used to assign addresses from the 176.0.0.0/8 IP address block. That's a reserved block set aside for RIPE but not in use. Over a year later I repeated the experiment and saw the private 10.0.0.0/8 IP address block in use.

Yes, I tried, I could not scan the set-top box with Nmap or even reach it with ping or traceroute, even from the machine on the same cable drop. The DOCSIS modem sees one data stream, the set-top box sees another. I would assume that they occupy entirely different frequency bands.

This screen also shows both upstream and downstream IDs, the box state, and something that very vaguely resembles simplified netstat -a output. 

INTERACTIVE INFO

IP            :   10.249.41.108
UPM           :   0x016657
UPSTREAM ID   :   0x0018
DOWNSTREAM ID :   0x046D
STATE         :   RUNNING
MAC ABORT CNTR:   0000

GOOD PACKETS  :
ERROR PACKETS :

SOCKET PORT STATE|SOCKET PORT STATE
  0   17541 READY   8        UNUSED
  1   10250 READY   9        UNUSED
  2   50000 READY  10        UNUSED
  3   1024 READY | 11        UNUSED
  4        UNUSED| 12        UNUSED
  5        UNUSED| 13        UNUSED
  6        UNUSED| 14        UNUSED
  7        UNUSED|

MAC Frequency Table

Beats me. It looks like this: 

FREQ      POWER
08672000  54
06480000  53

Message Types

This is intriguing, as it looks vaguely like netstat -s output. The numbers change every couple of seconds, and the counters roll over — from 255 to 0 in the lower table, I'm guessing from 65,535 to 0 in the upper one. Here's an approximate screen shot: 

MESSAGE TYPES (hex data)

OOB:    INB:
 PID    Cnt  PID    Cnt Lost DRAM
 0001     0  0000     1    0    0
 1C0A 54966  0037 33586    0    0
 0777 22759  0984     0    0    0
 150c 26583  0983     0    0    0
 0FB0  5006  0000     0    0    0
 0000     0  0000     0    0    0

 Msg Id Cnt Msg Id Cnt Msg Id Cnt
  0   - 108 92  17  61 FD   -   5
  1   - 242 95  14  32
  2   3  87 9A   E   0
 80  1A  22 A0  15   0
 81   B   4 A2   - 210
 82  1C  27 B0   - 198
 83   C  10 C0  13  58
 85   F  50 C1   7 104
 86  19   0 C2  18 174
 8C   - 184 C3  16 233
 8D   8   0 C4   A  95
 8E  10  35 C5   9  29
 8F  12 210 D8  11  64
 90  1B  22 E0   -   4
 91   D   0 E3   -   3

Task Status

This looks like a process table. Columns are:
TID RID PRI STARTS RUNTIME STK%
There are multiple screens, TID counts down from 80 to 1.

The DCT 2000 runs the VxWorks operating system. See, for example, this press release when the replacement for the DCT 2000 was released back in 2003.

This page claims:

The DCT-2000 system consists of 2 complete CPU systems. The first, and most obvious cpu, is the Motorola MC68331 chip, along with its various roms, rams and flash. This CPU controls the onscreen menus, channel guides, and other eye candy. It also has a convenient programming port. The software controlling the menus, consists of a small "kernel" (though not a kernel in the OS sense, necessarily) of rom code, written by GI/Motorola, that is very basic, but smart enough to download extra code over the wire. It also generally includes cableco specific software, that may vary by cableco nationwide, or even regionally.

The second CPU is hidden in the chip I labeled "B" on my "inside look" page. It coexists with general digital signal processing, and possibly a crypto core. This CPU decides what you get to watch, what information to send to the 68331 (for channel guide, etc) and other things. It has a small 32k SRAM (labeled "D") which I suspect has the subscription information, box ID, and other critical info.