EEVblog #675 - How To Reverse Engineer A Rigol DS1054Z

[EEVblog]

Dave shows you how to reverse engineering a PCB to get the schematic. In this case the new Rigol DS1054Z oscilloscope.
How does the discrete transistor analog front end and the software bandwidth limiting work?
How do you decode SMD transistor codes?
How does it compare to the old Rigol DS1052E?
Dave also discusses the low voltage ohms function of a mulitmeter, how it's useful, and how to test your multimeter to see if it will have any issues with in-circuit testing.

Schematic:
http://www.eevblog.com/files/Rigol-DS1054Z-Schematic-FrontEnd.pdf
http://www.eevblog.com/files/Rigol-DS1054Z-Schematic-DiffAmp.pdf
DS1052E Schematic: http://rigol.codenaschen.de/index.php/Schematics

Links:
SMD codes: http://www.sos.sk/pdf/SMD_Catalog.pdf
www.digikey.com.au/Web Export/Supplier Content/MCC_353/PDF/MCC_SMD_Marking_Codes.pdf

Datasheets:
MMBFJ309L JFET http://www.onsemi.com/pub_link/Collateral/MMBFJ309LT1-D.PDF
http://www.analog.com/static/imported-files/data_sheets/AD8510_8512_8513.pdf
BAV199 Diode http://www.nxp.com/documents/data_sheet/BAV199.pdf
BC856 http://www.nxp.com/documents/data_sheet/BC856_BC857_BC858.pdf
Fujitsu FTR-B3 Relay http://www.fujitsu.com/downloads/MICRO/fcai/relays/ftr-b3.pdf
Cosmo solid state relay: http://www.cosmo-ic.com/object/products/KAQY214.pdf
TL072: http://diodes.com/datasheets/TL072.pdf
74HC4053: http://www.nxp.com/documents/data_sheet/74HC_HCT4053.pdf
TLV274 Precision Quad Opamp: http://www.ti.com/lit/ds/symlink/tlv274.pdf
AD5207 Digital POT: http://www.analog.com/static/imported-files/data_sheets/AD5207.pdf

[phenol]

Eventhough J309 is a symmetric device (D and S are interchangeable), it should be drawn (i think) as a source follower in that particular circuit.

[zapta]

Excellent episode.

[gnif]

Had me looking for a rattle on my desk at the end of that video... then I realised that every time you put your arm on the desk, there it was

[RobertoLG]

Excellent episode.

    

[digital]

Dave thank you for an outstanding educational video the time you spent on doing so is well appreciated.Regards to all Waynee

[tom66]

Hang on - on 1X probe I've shoved 200V DC pulse train (@150kHz) into my DS1074Z and I didn't break it on low attenuation band (<200mV/div.) Wouldn't that cause 75R resistor & BAV99 to fail?

[mux]

So basically: desolder 6 transistors, replace one with a short and you've got the 100MHz model. (per channel of course)

[SpiderElectronics]

>So basically: desolder 6 transistors, replace one with a short and you've got the 100MHz model. (per channel of course)
Not necessarily - the software may do other things based on its stored knowledge of which model you have.

[ovi_mv]

Excellent technique, very punctual description of  the method.
Thank you Dave.

[EEVblog]

Dave thank you for an outstanding educational video the time you spent on doing so is well appreciated.Regards to all Waynee

Thanks.
This one did take a while.

[rf-design]

I have doubts that the RE is correct!

1. The two top NPN in the DIFF DRIVER schematic get no positive base current.

2. The DC-path from the input in the mode w/o attentuator only see 222k+265k instead of 1000k

Because that is a working instrument the RE must be wrong.

[SPRX]

Well Executed 

Thanks Dave

[EEVblog]

Because that is a working instrument the RE must be wrong.

Almost certainly. I haven't checked any of it. My goal was to get the basic topology for the bandwidth limiting, and to show the process.

[gnif]

The in circuit testing info is great! I have often lifed parts to check values, I had no idea that if I kept the voltage low enough on the meter I could get pretty good results even still.

[dr.diesel]

The 1054Zed is gonna be very popular, this REing out of the gate is going to really help the community 

[EEVblog]

The in circuit testing info is great! I have often lifed parts to check values, I had no idea that if I kept the voltage low enough on the meter I could get pretty good results even still.

Depends on the rest of the surrounding circuit. But at least you won't turn on PN junctions (diodes, protection diodes in IC's, transistor, IC inputs etc) with a low test voltage.

[Fungus]

Interesting that they appear to have planned the 50MHz version from the start.

(nb. Over in the DS1054Z there are some measurements that show 50MHz filter to be quite sharp, the general opinion was that it was a software filter....but here it is in hardware since day 1)

[German_EE]

Somewhere in deepest China an engineer will be cursing Mr Jones this morning. A bandwidth limit using a few transistors as switches should be easy to bypass.

[Fungus]

Somewhere in deepest China an engineer will be cursing Mr Jones this morning. A bandwidth limit using a few transistors as switches should be easy to bypass.

You know how I can tell you (and that other guy who figured out a hardware mod) haven't read the "DS1054Z" thread....?   

[dentaku]

It's great to see someone explain how they go about doing stuff like this.

I think you said 1052Z instead of 1054Z a few times in the video though.

[Orange]

>So basically: desolder 6 transistors, replace one with a short and you've got the 100MHz model. (per channel of course)
Not necessarily - the software may do other things based on its stored knowledge of which model you have.

Not needed at all, use a keygen, generate a 100MHz key and you are done, no hardware mod necessary.

@ Dave, The scope also has an calibrate modus, this must be connected somewhere along the analog chain per channel.
BTW very much appreciated VIDEO, can become handy if someone blows-up an input channel 

[ElektroQuark]

Those Rigols will be out of stock very soon. 

[Fungus]

Those Rigols will be out of stock very soon.

"Soon"?   

(luckily I ordered mine the day after it was launched...)

[robrenz]

Great tips Dave, much appreciated!

[LoyalServant]

I like it.... I have had to do some of this myself in the past and it really is tedious.
Of course we did not have nice digital cameras back then either.

I bet eventually they will stuff the whole circuit in custom silicon.... then you will need to do some nasty stuff to get at it.

[glatocha]

I am curious, what kind of precision they would use for the resistors in the AMP, Op amps feedback and so on. Would they go for 0.1% or even better?

[tecman]

A quick test - short B-E on switching transistors with a small jumper or solder blob, and measure BW with step input.  This should give you an idea of what the modes do.  When done, just remove the jumper or solder blob used to hold the transistors off.  Forget simulation.

paul

[Fungus]

I am curious, what kind of precision they would use for the resistors in the AMP, Op amps feedback and so on. Would they go for 0.1% or even better?

I'm guessing this is why they have a built-in calibration....to compensate for that sort of stuff.

[nixfu]

So if ALL FOUR of those filter caps are disconnected does that make room for a secret 200mhz model? 


After all, so far we only have 3 different 1000z models(50,70,100) and there are 4 possible combinations of the filters...hmmm.  Although I guess it would be just as possible to have a 25mhz model as the 4th combination of filters.

[BUkitoo]

Excelent Episode Dave!
By the way, Instead of get to paper different printouts, I use photoshop in different layers, and adjust them to match the holes.  .

[EEVblog]

I think you said 1052Z instead of 1054Z a few times in the video though.

Very likely!

[Robyn]

So basically: desolder 6 transistors, replace one with a short and you've got the 100MHz model. (per channel of course)

 I am not sure if that is an good idea. I think using the key is much better. If you use the DS at lower Samplerate I think its much better if it can reduce bandwith, because high frequencies above the Samplerate only make noise.


@Dave, Very much thanks for doing this video, it answered a question i was thinking about the last weeks. Thumbs up!

[Fungus]

I think you said 1052Z instead of 1054Z a few times in the video though.

Very likely!

I know he said it a few times. It's as if he still can't believe it's 4 channels.

[m100]

So if ALL FOUR of those filter caps are disconnected does that make room for a secret 200mhz model? 

Except that 200mhz is nearly DC   

[nixfu]

>Except that 200mhz is nearly DC

Yeah haha, Mega not milli.

200Mhz

[coppice]

>Except that 200mhz is nearly DC

Yeah haha, Mega not milli.

200Mhz

Participants in the pedants revolt need to make a better case than that. How about 200MHz?

Actually, 200MHz is pretty near DC for a gamma radiation expert.

[dentaku]

OK, so the question for a total newbie like me is... is this exactly the same hardware as what's inside the DS1074Z and DS1104Z?
All the features that can be unlocked on the higher end models are available to this model as well?

[Fungus]

OK, so the question for a total newbie like me is...

This topic has been discussed to death in the other threads.

(I wonder what other vital information you missed.  )

is this exactly the same hardware as what's inside the DS1074Z and DS1104Z?
All the features that can be unlocked on the higher end models are available to this model as well?

Yes

[David Hess]

I have doubts that the RE is correct!

I noticed the same two things you did.

1. The two top NPN in the DIFF DRIVER schematic get no positive base current.

If these were on the emitter side of the differential pairs instead of the collector, then they would form a linearized cross coupled quad which I doubt a high bandwidth vertical amplifier would need.  On the other hand, I would have expected a cascode on the output and they are in the right spot for it except for their base bias.

I see no thermal balancing on the collector side of the differential pairs.  Maybe that is what these transistors are actually doing?

The DS1000Z user guide does not say anything about separate position and offset controls and confusingly lists an offset range in the specifications but discusses vertical positioning so my guess is that the connection to the other side of the differential pair is for controlling the common mode level going into the ADC.

2. The DC-path from the input in the mode w/o attentuator only see 222k+265k instead of 1000k

Yep.  Something is missing or wrong here.  The input attenuator was obviously designed for a 1 Mohm input resistance.  I wonder how Rigol calibrated both the input capacitance and compensation with only one trimmer.  Maybe the manufacturing tolerances are good enough not to require it.

[Smokey]

Nice job on the RE.  I've done this with a two layer through hole board and a flatbed scanner and even that took forever and I didn't get it right the first time.

I was thinking of this earlier today....

If we were to put together a community schematic for something like this in a digital format, what program would we want to do it in?  Nothing against DaveCad, but there are some benefits to having a digital CAD copy from a readability and modify-ability standpoint now that the basic foundation is down.

My first thought was LTSpice since besides making a nice schematic you could potentially simulate it.  I know the bigger a schematic gets the harder it is to make the simulation work, but you could always break it up once it's all in there.  One more consideration is that all the parts would need functional SPICE models, which would mean a custom library for LTSpice which isn't really a show stopper.  Even without the simulation LTSpice would be a good clean free and accessible schematic capture.

Maybe treat it like open source software and store it on github or some other collaboration tool with an official maintainer?  That way people could get credit for contributing and finding mistakes and you could track the development.  I bet a fair number of people would benefit from something like that.

[dentaku]

OK, so the question for a total newbie like me is...

This topic has been discussed to death in the other threads.

(I wonder what other vital information you missed.  )

is this exactly the same hardware as what's inside the DS1074Z and DS1104Z?
All the features that can be unlocked on the higher end models are available to this model as well?

Yes

Other treads are full of useless arguing about stuff I don't care about that go on for multiple pages of bickering.
It's not what I'd call first time buyer friendly. Now that I know there's nothing special about the other DS1000Z models I know which one I want to buy.

edit...  just checked the forum thread for the teardown video and I see the question WAS answered in there quite a few pages in. I guess I didn't follow that one closely enough.

[EEVblog]

OK, so the question for a total newbie like me is... is this exactly the same hardware as what's inside the DS1074Z and DS1104Z?
All the features that can be unlocked on the higher end models are available to this model as well?

Yes.

[Fungus]

It's not what I'd call first time buyer friendly.

 

I guess there's a reason engineers don't usually make good shop assistants.

[dentaku]

 

OK, so the question for a total newbie like me is... is this exactly the same hardware as what's inside the DS1074Z and DS1104Z?
All the features that can be unlocked on the higher end models are available to this model as well?

Yes.

 

[dentaku]

It's not what I'd call first time buyer friendly.

 

I guess there's a reason engineers don't usually make good shop assistants.

They also don't make good customers because they get annoyed by the clueless people who work in stores.

[Fungus]

They also don't make good customers because they get annoyed by the clueless people who work in stores.

http://xkcd.com/806/

[steve_w]

Dave,

Love your work,

regards

Steve w

[Rasz]

Would be really nice if someone reverse engineered this (or one with similar performance) frontend properly, and released it as open hardware. I would gladly buy a module with 2 inputs at ~$50.

[David Hess]

Would be really nice if someone reverse engineered this (or one with similar performance) frontend properly, and released it as open hardware. I would gladly buy a module with 2 inputs at ~$50.

What features and performance would you expect from something like this?

Would you want everything up to the ADC or the ADC as well?  In this particular design the integrated ADC handles most of the gain switching so the front end is simplified.

[Dave Turner]

Dave - your tip regarding probing a board with a voltage less than 'say' 0.5V seems fine for silicon based junctions and is much appreciated.

I recall a time that when germanium transistors were prevalent. If I remember correctly the forward voltage was approx 0.2v. I still have a couple of OC71s which surprisingly survived after an unavoidable 99% clear out a couple of years ago. Now I'm so far out of the loop that I don't know whether germanium transistors/junctions are still used or not.

I have a dim recollection of a 1960's project for a "buzz out" detector that ran at a potential difference below that of the germanium forward voltage.

Does anyone recall it and/or would such a device have any value in todays' age?
 

[Rasz]

Would be really nice if someone reverse engineered this (or one with similar performance) frontend properly, and released it as open hardware. I would gladly buy a module with 2 inputs at ~$50.

What features and performance would you expect from something like this?

Would you want everything up to the ADC or the ADC as well?  In this particular design the integrated ADC handles most of the gain switching so the front end is simplified.

hmm you are right, I forgot HMCAD1511 is ~$80 in single quantities. That puts my idea out of its misery

The way I see it, this rigol can be broken down like this
$100 frontend (4 inputs, adc)
$100 computing (data processing, application processor)
$100 case, supply, screen, keyboard, pcb
$100 software


I was thinking of a building block if someone wanted to experiment/play with/build oscilloscope. Every other piece of the puzzle is available off the shelf, except for a good quality, properly designed and battle tested frontend. Some uni or a MOOC could even do a course on building measurement equipment using module like this and fpga dev board. Currently closest thing I can think of is
-analog discovery, 5MHz analog BW $100-300
-embeddedartists labtool, 3-12MHz analog BW ~$200
-Red Pitaya, 50MHz analog BW, but only 120MHz sampling, $470
-maybe Smartscope? same as red pitaya, but not shipping and most likely not open if/when it ships

ps: forgot one
-BeScope, claimed ?50MHz analog BW, 250MHz sampling, $50, but not a proper frontend

[Alex Eisenhut]

Wow, my DS5102C feels kind of pokey now.

[David Hess]

hmm you are right, I forgot HMCAD1511 is ~$80 in single quantities. That puts my idea out of its misery

$100 frontend (4 inputs, adc)

Rigol saved a lot by using 4 inexpensive signal conditioning front ends to drive a single 4 channel ADC which does almost all of the gain switching.

I was thinking of a building block if someone wanted to experiment/play with/build oscilloscope. Every other piece of the puzzle is available off the shelf, except for a good quality, properly designed and battle tested frontend. Some uni or a MOOC could even do a course on building measurement equipment using module like this and fpga dev board. Currently closest thing I can think of is

... examples ...

The ones I have seen struck me as fragile and low performance.

I would want 1 Mohm inputs with overload protection, fast overload recovery which places some limits on the topology, and thermal balancing to prevent long settling times.  The Rigol design discussed here has all or most of that and like Dave says, it is recognizably similar to analog and DSO front ends going back decades so there is a lot of existing documentation about how to do it.

Making a universal design work with different ADCs which may or may not have programmable gain would be difficult.  Calibration of the transient response and input compensation would be a problem.

[krivx]

Dave - your tip regarding probing a board with a voltage less than 'say' 0.5V seems fine for silicon based junctions and is much appreciated.

I recall a time that when germanium transistors were prevalent. If I remember correctly the forward voltage was approx 0.2v. I still have a couple of OC71s which surprisingly survived after an unavoidable 99% clear out a couple of years ago. Now I'm so far out of the loop that I don't know whether germanium transistors/junctions are still used or not.

I have a dim recollection of a 1960's project for a "buzz out" detector that ran at a potential difference below that of the germanium forward voltage.

Does anyone recall it and/or would such a device have any value in todays' age?
 

FYI OC71s are quite sought after by people building clones of 1960s guitar effects pedals. You might make some money selling them.

[ohmineer]

Nice video, it would be nice to see this kind of exercise with other boards you have.
Thanks for your effort.

[Fungus]

The way I see it, this rigol can be broken down like this
$100 frontend (4 inputs, adc)
$100 computing (data processing, application processor)
$100 case, supply, screen, keyboard, pcb
$100 software

Nothing for R&D and the distributors ... ?

[SNGLinks]

Dave - your tip regarding probing a board with a voltage less than 'say' 0.5V seems fine for silicon based junctions and is much appreciated.

I recall a time that when germanium transistors were prevalent. If I remember correctly the forward voltage was approx 0.2v. I still have a couple of OC71s which surprisingly survived after an unavoidable 99% clear out a couple of years ago. Now I'm so far out of the loop that I don't know whether germanium transistors/junctions are still used or not.

I have a dim recollection of a 1960's project for a "buzz out" detector that ran at a potential difference below that of the germanium forward voltage.

Does anyone recall it and/or would such a device have any value in todays' age?
 

FYI OC71s are quite sought after by people building clones of 1960s guitar effects pedals. You might make some money selling them.

Perhaps I should sell mine on eBay - my user name is OC71 ?

[Gunb]

Hi Dave,

great blog again. Thank you for that.


Kind regards
Gunb

[Yansi]

Hi Dave, really thank you for your video about Rigol RE!

I am working on some sort of educational project now - I learn how to use CPLDs/FPGAs, so I decided to try to make a simple oscilloscope. I have got some MAX1422 ADCs laying around (20Msps 12bit) - I'd like to use them. But there is a catch - my experience and knowledge of analog design is poor. (Well... thats relative, but designing a (at least) working AFE is not so easy.) Your video helped me a lot, to get some ideas how to do this. I'd like to avoid any costly specialized ICs.
Yesterday, I was investigating your schematic and also found the two wrong NPNs in the diff amp. Does anybody know, how it might be really connected? 
Did you measure the supply voltage, to these stages? I tried to get some estimates of the bias currents in the stages. Is it standard +-5V? It looks like that might be less there...
Someone in this thread just said, that the diff amp right input might be for setting Vcom for the ADC - I also thought about that. It has to be - I do not see any other way in the circuit, how to control the common voltage for ADC.
Is there a possibility, to make a simple discrete front end also with gain selection? (There would be no need for big bandwidth, just maximaly a few megs, maybe tens with MAX1420..) I'd like to discuss that, maybe I start a thread about it. I'd like to make this as an opensource project for those interested in 

[_Wim_]

Excellent video. Made me join this forum immediatly! (first post here)

[mullecy]

Excellent video. Made me join this forum immediately too!  (first post here, although I've been following on youtube for years)

I was actually simulating the rigol 1052E from A. Helene schamatics to see how it works when this video was published and I have lots of informations and questions on those oscilloscope analog front ends.

My method for reverse engineering:
Basically the same: taking good pictures of both sides, but I don't print on transparent sheets:
I just use GIMP(free photo software) and its multilayers functions.
This way I can dynamically change the transparency and add my own layers with annotations, draw mark pins that I've
already checked (so I don't do things twice)...

http://www.eevblog.com/files/Rigol-DS1054Z-Schematic-FrontEnd.pdf

Here's my analysis: (correct me if i'm wrong)

• The jfet section
  It's not really an amplifier but a follower/buffer that helps dealing with the very high impedance of the source signal (909kOhms).
  The lower part of the jfet seems to be a basic current source to maintain a steady offset between the input and the output of the jfet and the transistor.
  The two 249R from 1052E are gone in 1054Z, but they were useless to my opinion and were just limiting the range of possible outputs (or maybe this was a protection or a way to tweak the bandwidth).
  
• The OA section
  It's just assuring that the output follows the DC offset of the input.
  But what is bothering me is why did they add that ?   
  Dave says that's because the jfet part can't do the DC amplification. Well I don't agree because the jfet part does it (it's not really amplification just a follower with impedance improvement)
  I just don't understand why they added such a complex setting, because using the OA is quite complex because you have to deal with the transition (amplitude and phase) from AO response in very low frequencies and capacitor in front of the jfet for high frequencies. (see http://rigol.codenaschen.de/images/thumb/0/0c/DS1052E_HW58_PCB_Schematics_-_Ch1_analog_front-end.jpg/800px-DS1052E_HW58_PCB_Schematics_-_Ch1_analog_front-end.jpg for a schematic for 1052E)
  
• The differential section
  Nothing really to add to the discussion: there's something wrong with the top transistors. With what Draw only 0 or 1(with a big enough offset in inputs) can be active and this is not what a differential amplifier should do (unless you want some sort of comparator maybe)
  The biggest problem I see is the lack of variable gain amplifier before the ADC. Maybe they just use the internal ADC amplifiers to do that.
  Using formulas from Horowitz book: http://en.wikipedia.org/wiki/The_Art_of_Electronics
  Common Mode Gain: Gm=-Rc/(2.R1+Re)=-82/(2.BigCS+50)=near 0 (the current source impedance is very high)
  Differential Gain: Gdiff=Rc/2(re+Re)=-82/2(52.5)=-0.78 (if we say for example current source gives 10ma then re=2.5Ohms (25/I in ma))
  

[uwezi]

Here's my analysis: (correct me if i'm wrong)

• The differential section
  Nothing really to add to the discussion: there's something wrong with the top transistors. With what Draw only 0 or 1(with a big enough offset in inputs) can be active and this is not what a differential amplifier should do (unless you want some sort of comparator maybe)
  The biggest problem I see is the lack of variable gain amplifier before the ADC. Maybe they just use the internal ADC amplifiers to do that.
  Using formulas from Horowitz book: http://en.wikipedia.org/wiki/The_Art_of_Electronics
  Common Mode Gain: Gm=-Rc/(2.R1+Re)=-82/(2.BigCS+50)=near 0 (the current source impedance is very high)
  Differential Gain: Gdiff=Rc/2(re+Re)=-82/2(52.5)=-0.78 (if we say for example current source gives 10ma then re=2.5Ohms (25/I in ma))
  

After looking at the latest teardown video I also got interested in the discrete differential amplifier section - and yes, something must be wrong in the DaveCad^TM drawing.

Looking at the hires images from the actual teardown of the DS1054Z I noticed that there is an additional pair of MMBT3904s on the other side of the circuit board in the front-end section, which are missing from the RE drawing... but I am still trying to figure out what's going on there...

[t_i_t_o]

So if ALL FOUR of those filter caps are disconnected does that make room for a secret 200mhz model? 


After all, so far we only have 3 different 1000z models(50,70,100) and there are 4 possible combinations of the filters...hmmm.  Although I guess it would be just as possible to have a 25mhz model as the 4th combination of filters.

I was very curious about the upper question too... until now!

Yesterday I received my new lovely DS1054Z. Before unlocking all its features I decided to tear it apart and measure which bandwidth selection capacitor is enabled and when. Generally speaking I could switch among three bandwidths - 20MHz, 50MHz and 100MHz after unlocking, so the stats are:
20MHz - one capacitor enabled
50MHz - the other capacitor enabled
100MHz - no capacitors enabled!

So unfortunately there is no hidden bandwidth...

[Fungus]

So unfortunately there is no hidden bandwidth...

There's no more unlocking but it's usually about 130Mhz if you measure it very carefully.