The Rigol DS1052E

[DavidDLC]

I haven't read the hole topic, but I just found this out !!!


http://hackaday.com/2010/03/10/50mhz-to-100mhz-scope-conversion/#comments

[DavidDLC]

Whaaattttt never mind, the took it from here.

Sorry.

[loydb]

Another newbie stumbling here from Hack-a-day. I'm in the market for my first scope, this is fascinating reading.

[JimBeam]

Hello everybody.

I am new to the forum - but I think I have to correct a few things here... 

The circuit between pins 8 and 9 and the ADC amp indeed limits the bandwidth to about 20MHz - when you activate the "BW limit" from the channel menu!

When you take a close look on the part in the middle (D1), you see a small grey bar on the right hand side - as this is neither a cap nor a coil, but a diode, supposedly a varactor diode! And the parts at the upper and lower end of the "filter" are no caps either, they are simple resistors (R1 and R2). R1 goes to ground, R2 is HF-shunted to ground via C3. The control signal comes from somewhere via R3 and biases the diode.

The series circuit of C1, C2 and D1 is a small condenser in the range of well below 1pF to some pF - depending on the control voltage and thus the capacitance of D1.

When you remove C1 you do not only remove this serial capacitance that limits the bandwidth in any case (at any value of the control voltage) - but you also disable the BW Limit function from the menu altogether!

Btw., when you look at the real circuit, it now is obvious, that after removing C1 a removal of C2 doesn't change anything more...

Andreas

[Simon]

so are you saying that if the variac diode is shorted all filtered limits are removed so the scope will be open to all frequencies ?

[rct]

Another newbie stumbling here from Hack-a-day. I'm in the market for my first scope, this is fascinating reading.

I'm in the same boat, doing research on my first scope purchase.  I just posted a summary of some of the things I've learned at the RCgroups.com forum.  The Rigol thread on that forum has been running for three years.  Some of the discussion is about other models of the rigol (c,ca,...) but there is a lot of useful info there if you can wade through the 56+ pages.

• My summary post: http://www.rcgroups.com/forums/showpost.php?p=14568161&postcount=844
• Full Rigol thread staring at page 1, http://www.rcgroups.com/forums/showthread.php?t=663958

It would be ideal if there was a wiki or something similar for summarizing the Rigol DS1052E info to help other newcomers.

Thanks,
--Rob

[rossmoffett]

Hello everybody.

I am new to the forum - but I think I have to correct a few things here... 

Respectfully, your circuit is missing some information.  There are two vias - possibly both controls (maybe one for the selectable BW limit and one for 50 MHz limit?).  R1 in your circuit is not going to ground, it meets a via and connects to a capacitor which goes to ground.  I did notice, and note, that the hack only requires the removal of one capacitor though.  I'm not familiar with this type of circuit, so if you could elaborate some more that would be awesome!

I think given this new information, it might be possible that this could be modified with a software hack, rather than a hardware hack.  Soon I'll be able to mess with that a bit more and see what happens.

[Simon]

thats true, if you can get it to make the viarac go to it's maximum value all the time it would be "open" to all frequencies.

[rossmoffett]

I just verified that this does in fact disable the bandwidth limit option in the Ch2 (modified) menu.

So the next step is to take it apart again and check those vias to see what kind of signals they're giving.  One of them should respond only to the bandwidth limit select, the other is likely the 50 MHz limit, and perhaps there's a way to bypass the other without cutting the trace.

Otherwise, fiddling with the software may be the only choice.

[JimBeam]

Respectfully, your circuit is missing some information.  There are two vias - possibly both controls (maybe one for the selectable BW limit and one for 50 MHz limit?).  R1 in your circuit is not going to ground, it meets a via and connects to a capacitor which goes to ground.

Ooops, you are right! I did not measure this via - just estimating from the circuit that it was ground...

So we obviously have two control signals (circuit below), which could mean that this second signal indeed is causing the bandwidth "problem" - but before I take any further assumptions, I'm going to take some live measurements on my scope this evening. ;-)

so are you saying that if the variac diode is shorted all filtered limits are removed so the scope will be open to all frequencies ?

Not exactly for all frequencies, but at least to the limit the amplifier poses - and not if shorted, but if the diode would be removed. (The caps and resistors still present lowpass filters on both pin8 and 9, but this should be neglectible).

Andreas

[Simon]

Not exactly for all frequencies, but at least to the limit the amplifier poses - and not if shorted, but if the diode would be removed. (The caps and resistors still present lowpass filters on both pin8 and 9, but this should be neglectible).

Andreas

Well thats what i meant, obviously at some point due to the scope sampling rate and it circuit limitations there will be a maximum limit but a more natural one, it seems that the scope has been deliberately restricted

[jgibson]

Even with the mod, this scope wouldn't be able to handle (due to BW) USB 2.0 (480mhz) eye diagram correct?

As I read that 1.5ghz of BW is need to get accurate USB 2.0 measurements.

[Simon]

probablt not, the scope has a "bigge brother" capable of 100 MHz so it is the general concensus that the two are the same one but the 50 MHz version has had a limitation put on it

[jgibson]

probablt not, the scope has a "bigge brother" capable of 100 MHz so it is the general concensus that the two are the same one but the 50 MHz version has had a limitation put on it

Thanks for the info, still a good deal for 100mhz.. just was hoping it met my needs.

[Simon]

well we won't know until it is done, the scope samples 1GS/s (1 billion samples per second) in single channel mode so you have this to consider as well, with a 480 MHz signal that will be just over 2 samples per waveform, you will need at least 10 samples per cycle to acurately display the signal so thats 100 MHz although you may get way with a little more. There is also the actual limitations of the input circuitry

[jgibson]

well we won't know until it is done, the scope samples 1GS/s (1 billion samples per second) in single channel mode so you have this to consider as well, with a 480 MHz signal that will be just over 2 samples per waveform, you will need at least 10 samples per cycle to acurately display the signal so thats 100 MHz although you may get way with a little more. There is also the actual limitations of the input circuitry

Thanks for the info, reading http://www.analogzone.com/iot_1115.pdf suggests 1.5ghz as a minimum. Also this note about bandwidth make me think this scope has no chance to measure USB 2.0.
http://www.analogzone.com/iot_1115.pdf

Sample rate must also be considered. Many oscilloscopes on the market today incorporate a form of interleaving, where by the maximum specified sample rate of the oscilloscope is achievable when only using one or two channels of a four-channel oscilloscope. Insufficient sample rate will lower the measurement bandwidth of your oscilloscope and result in signal aliasing. One key to good measurement is to ensure that you have sufficient sample rate on a per-channel basis for all the channels you want to simultaneously use on the oscilloscope. For oscilloscopes with 2-Ghz bandwidth, and greater, the sample rate of the oscilloscope should be at least two times the bandwidth of the oscilloscope. Therefore, for a 2ghz oscilloscope, the per-channel sample rate should be a minimum of 4 G/samples sec.

[Simon]

Thanks for the info, reading http://www.analogzone.com/iot_1115.pdf suggests 1.5ghz as a minimum. Also this note about bandwidth make me think this scope has no chance to measure USB 2.0.
http://www.analogzone.com/iot_1115.pdf

Well that's what I said

[bushing]

I just verified that this does in fact disable the bandwidth limit option in the Ch2 (modified) menu.

So the next step is to take it apart again and check those vias to see what kind of signals they're giving.  One of them should respond only to the bandwidth limit select, the other is likely the 50 MHz limit, and perhaps there's a way to bypass the other without cutting the trace.

Otherwise, fiddling with the software may be the only choice.

To each his own -- I'd see fiddling with the software as the first choice, not the last one.  Much cleaner.   Sadly, IDA Pro can't handle Blackfin DSP code, leaving me to deal with objdump.

In the hopes of seeing something useful, I yanked off the 24LC04 I2C EEPROM attached to the Blackfin DSP, in the hopes of finding something obvious -- I was disappointed with what I found:

Code: [Select]

0000000: 0104 ffff 1700 0000 00ff ffff 8025 0000  .............%..
0000010: 0009 0001 0001 0100 a086 0100 1900 0000  ................
0000020: 0000 803f 0000 0001 a086 0100 e7ff 0000  ...?............
0000030: 0000 803f 0000 0000 0000 0100 0000 0700  ...?............
0000040: 0000 0000 0000 0000 cdcc cc3d 1400 b5ff  ...........=....
0000050: 0300 9600 0000 0000 0100 0000 0000 0000  ................
0000060: 0000 ffff 4042 0f00 0000 0000 0000 0000  ....@B..........
0000070: 0000 0000 a086 0100 0000 0000 0000 0000  ................
0000080: 0000 0000 0000 0800 0020 0000 0000 0000  ......... ......
0000090: 0800 0010 0500 0000 bd37 0635 5c8f c23e  .........7.5\..>
00000a0: 0000 0000 0000 0000 0002 1900 e7ff 0000  ................
00000b0: bd37 8635 0000 0000 bd37 8635 0000 0000  .7.5.....7.5....
00000c0: 0000 0000 0000 0000 0100 0000 0000 0100  ................
00000d0: cdcc 4c3e cdcc 4c3e 0100 0000 0100 0000  ..L>..L>........
00000e0: 0100 0000 0000 0003 0101 07ff 4042 0f00  ............@B..
00000f0: 0000 0000 4042 0f00 0000 0000 0000 0000  ....@B..........
0000100: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000110: 0000 0000 0000 0000 0000 ffff bd37 8635  .............7.5
0000120: 00ff ffff bd37 8635 0000 0000 0000 0000  .....7.5........
0000130: 0100 01ff 0000 0000 0101 0101 0101 0101  ................
0000140: 0101 0001 0000 0000 0100 ffff 3aa3 14a9  ............:...
0000150: 00ff 0000 0001 0203 0405 0607 0001 0203  ................
0000160: 0405 0607 0000 0000 0000 0000 0007 0700  ................
0000170: 0007 0708 0202 0202 0202 0202 0202 0202  ................
0000180: 0202 0202 0000 0202 0202 0202 0202 0202  ................
0000190: 0202 0202 0202 0000 8ded b5a0 f7c6 b03e  ...............>
00001a0: 0100 00ff 0000 0000 ffff ffff 0000 0000  ................
00001b0: ffff ffff 0000 0000 ffff ffff 0000 0000  ................
00001c0: ffff ffff 0000 0000 ffff ffff 0000 0000  ................
00001d0: ffff ffff 0000 0000 ffff ffff 0000 0000  ................
00001e0: ffff ffff 0000 0000 ffff ffff 0000 0000  ................
00001f0: ffff ffff 0000 0000 ffff ffff 0000 0000  ................

I'm not seeing anything that looks remotely like a model number or serial number.  This was from a DS1052E -- anyone else care to do the same so we can compare?

The firmware images don't appear to be signed, so they could be modified easily -- they are 4194325-byte files, which seems to me like a 21-byte header plus a 4MB firmware image.   The header is:

0000000: 4453 3130 3030 4520 2020 3032 2e30 322e 3032 2e30 30  DS1000E   02.02.02.00

There's no room for a hash, so you could do whatever you want to the file.   Unfortunately, this means that there's no sort of bootloader which could recover corrupted firmware, so your options would be to desolder the NOR flash holding the firmware and reprogram it using a chip programmer, or try to get the 13-pin JTAG-looking connector working.

[rossmoffett]

Here you go:
Secret serial commands
Programming guide

Sorry for the other forum registration, but I can't attach them here due to file size limits and the programming guide is essential.  It communicates via National Instruments VISA commands, you'll have to write your own software to do it.  Python has an easy library for interfacing with VISA devices once you successfully install the drivers from your CD.  I just don't have the time because of school for the next month and a half or so, so I hope you guys figure out the rest!  There's firmware for the MSO version there too, which I'm sure is very interesting.  Deep in the thread somewhere were some pictures and circuit sketches of the logic analyser head.

Thanks hackaday for all of the attention to this great hack!

[rf-loop]

Hello!

I have many times see that peoples share here some files for Rigol.
Why this all.  Most good place to get all info is official original Rigol!
Also this proof that peoples use updated last officially released info.

http://www.rigol.com/en/index.aspx

This is place to get info.
Go to service&support, member resources.

There are official last FW updates, there are all officially released and updated manuals and all other files. (last week I find there all updated info, also FW updates (00.02.02.SP2) and all manuals up to dated. (there is also user area and members area, both are open for all) (also chinese language sides = better info).

----------------------------
Surprice: later today there are not anymore these FW update files.

[JimBeam]

... This was from a DS1052E -- anyone else care to do the same so we can compare?

Here is mine (DS1052E too):

Code: [Select]

000000  01 04 FF FF 0C 00 00 00 00 FF FF FF 80 25 00 00  .............%..
000010  00 09 00 01 00 01 01 FF 40 42 0F 00 00 00 FF FF  ........@B......
000020  00 00 80 3F 00 00 00 00 D0 07 00 00 00 00 FF FF  ...?............
000030  00 00 80 3F 00 00 00 00 00 00 01 00 00 00 07 00  ...?............
000040  00 00 00 00 00 FF FF FF CD CC CC 3D 14 00 B5 FF  ...........=....
000050  03 00 96 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
000060  00 00 FF FF 00 C2 EB 0B 00 00 00 00 00 00 00 00  ................
000070  00 00 00 00 A0 86 01 00 00 00 00 00 00 00 00 00  ................
000080  00 00 00 00 00 00 08 00 00 40 00 00 00 00 00 00  .........@......
000090  08 00 00 10 05 00 FF FF BD 37 06 35 5C 8F C2 3E  .........7.5\..>
0000A0  00 00 00 00 77 BE 1F 3E 00 02 19 00 E7 FF FF FF  ....w..>........
0000B0  BD 37 86 35 00 00 00 FF BD 37 86 35 00 00 FF FF  .7.5.....7.5....
0000C0  00 00 00 00 00 00 00 FF 01 00 00 00 00 00 01 FF  ................
0000D0  CD CC 4C 3E CD CC 4C 3E 01 00 00 00 01 00 FF FF  ..L>..L>........
0000E0  01 00 00 00 00 00 00 03 01 01 07 FF 40 42 0F 00  ............@B..
0000F0  00 00 00 00 40 42 0F 00 00 00 00 00 00 00 00 00  ....@B..........
000100  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF  ................
000110  00 00 00 00 00 00 00 00 00 00 FF FF BD 37 86 35  .............7.5
000120  00 FF FF FF BD 37 86 35 00 00 00 00 00 00 00 FF  .....7.5........
000130  01 00 01 FF 00 00 00 00 01 01 01 01 01 01 01 01  ................
000140  01 01 00 01 00 00 00 FF 01 00 FF FF FA 5C 78 6B  .............\xk
000150  00 FF 00 00 00 01 02 03 04 05 06 07 00 01 02 03  ................
000160  04 05 06 07 00 00 FF FF 00 00 00 00 00 07 07 00  ................
000170  00 07 07 08 02 02 02 02 02 02 02 02 02 02 02 02  ................
000180  02 02 02 02 00 00 02 02 02 02 02 02 02 02 02 02  ................
000190  02 02 02 02 02 02 FF FF 8D ED B5 A0 F7 C6 B0 3E  ...............>
0001A0  01 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
0001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
0001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
0001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
0001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
0001F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00  ................

Andreas

[bushing]

Here you go:
Secret serial commands
Programming guide

Sorry for the other forum registration, but I can't attach them here due to file size limits and the programming guide is essential.  It communicates via National Instruments VISA commands, you'll have to write your own software to do it.  Python has an easy library for interfacing with VISA devices once you successfully install the drivers from your CD.  I just don't have the time because of school for the next month and a half or so, so I hope you guys figure out the rest!  There's firmware for the MSO version there too, which I'm sure is very interesting.  Deep in the thread somewhere were some pictures and circuit sketches of the logic analyser head.

Thanks hackaday for all of the attention to this great hack!

Actually, I bought this before hackaday posted it ... dammit ...

This looks rather interesting:

:INFO:MODEL DS1xxxx
Sets(!!) the model returned by "*IDN?" and shown in the "System Info" dialog.

Can someone try sending :INFO:MODEL DS1102E on a DS1052E and see if it lifts the frequency cutoff?  I don't have any RS232 cables handy, and haven't had much luck getting the TDM stuff to compile for OS X. :/

[JimBeam]

Can someone try sending :INFO:MODEL DS1102E on a DS1052E and see if it lifts the frequency cutoff?  I don't have any RS232 cables handy, and haven't had much luck getting the TDM stuff to compile for OS X. :/

Yes, I tried it - it does not work... Also, when you powercycle the unit, it becomes a DS1052E again. The firmware also checks the serialnumber, which starts with DS1ED for the 1052 and with DS1EB for the 1102 series. Hmm, a wonder what might happen, if you change model and the serialnumber.......... 

[Simon]

well go on then and let us know the result 

[JimBeam]

well go on then and let us know the result  

Well, I though, you could read in between the lines, that I already did so - and when I tell you that I just closed the cover of my new DS1102E for the moment and now look for a schematic and/or pictures of the LA part of the 1xxxD, guess what this means.....