The Rigol DS1052E

[Simon]

you did it ? converted a DS1052E into a DS1102E ? brilliant !!! (or did I not read between the lines properly ?)

[JimBeam]

you did it ? converted a DS1052E into a DS1102E ? brilliant !!! (or did I not read between the lines properly ?)

At least, the SYSTEM INFO page states so  , and when you look at this I would say YES!:

• the lowpass switching diode (I did not find a SMD part with "FC" mark, but I guess now it's only a switching diode) is reverse biased with around 5V when BW limit is OFF (see diagram, it was forward biased with 100mV before...!)
• the timebase goes down to 2ns/div
• an 80MHz signal shows about the same amplitude as a 50MHz signal, a 150MHz signal is attenuated by only about 5-6dB

I am not sure, if the circuit of the 1052 and 1102 are indeed identical, but for me it is identical enough  

[abbtech]

Nice work! I wonder what Rigol thinks about your clever hack.

[JimBeam]

Nice work! I wonder what Rigol thinks about your clever hack.

I think, they don't really like it - but if some people, who never would have considered buying a DS1102 (like me), now buy a DS1052 - it is still raised profit!

[Simon]

well they are still making a profit, infact I can't really see why they bothered doing what they did, as usual economics has gotten in the way. They are certainly making a profit on the 50 MHz versions or they would not sell them, basically the people that are buying the scopes for what they truly are are being charged through the nose, let me see I got my 50 MHz scope for £ 239, I left negative feedback because I decided that the trace was too noisy, he instantly agreed to a £ 50 refund if I changed the negative feedback. so I actually got it for £ 189 and I will assume that he did not loose out, so maybe the £ 50 was profit ? now the 100 MHz version was being sold for another £ 100, thats another £ 100 profit. But rigol obviously only had to develop one scope !

So when will we have some instructions on how to do this ? cmon this has got to be shared

[JimBeam]

So when will we have some instructions on how to do this ? cmon this has got to be shared

Still didn't get it? It's easy as 123, no instructions needed - just call your device the right name (DS1102E) and serialnumber (DS1EDxxxx)
with the "secret serial commands" via the NI-VISA interface (see entry from bushing a few posts above)...

Sorry, I won't post a patch program here - this seems a bit too hot to me, though even this would be possible ....

[Simon]

ok so just to point out I'm useless at programming and that sort of thing the most I can currently handle is basic on a pic (although I'm hoping to improve). are you saying that you plug the rigol into a pc and rewrite the values via an interfacing program ?

[Mark_O]

At least, the SYSTEM INFO page states so  , and when you look at this I would say YES!:

• the lowpass switching diode (I did not find a SMD part with "FC" mark, but I guess now it's only a switching diode) is reverse biased with around 5V when BW limit is OFF (see diagram, it was forward biased with 100mV before...!)
• the timebase goes down to 2ns/div
• an 80MHz signal shows about the same amplitude as a 50MHz signal, a 150MHz signal is attenuated by only about 5-6dB

I am not sure, if the circuit of the 1052 and 1102 are indeed identical, but for me it is identical enough 

Jim, congrats on putting 2 and 2 together.  Good luck on the deluge of people now wanting you to do a trivial operation for them automatically, and an endless stream of questions.

One very quick test you can always perform, to confirm BW extension unambiguously, is simply check the rise time on a very fast pulse.  You should see that it has dropped from ~7 nS to ~3.5 nS.  (I'd recommend just using 50-ohm BNC cables for this, and not a capacitive probe.)  When I check it on my DS1102CD from an HP pulse-gen with ~500 pS risetimes, I see ~3.8 nS, which is about right, considering source/cable/scope (square root of the sum of the squares).

Tip: After making this transformation with your magic wand, I'd recommend using the fairly slow Utility/Self-Cal procedure to complete the process.  Which of course is what they do at the Factory, after they decide which label to stick on the front.

- Mark

[Mark_O]

Nice work! I wonder what Rigol thinks about your clever hack.

Alan,

you're making the rather big assumption that Rigol knows anything about this hack.  Which, I can assure you, they do not.  Especially 3 hours after it was found.

They may stumble across it some day, but it's not like they have Support people reading the Forums and looking to help their customers.  Rigol has been one of the least customer-friendly companies I've ever encountered.  So unless someone here with the brains of a pinhead e-mails them (or contacts their US support people), to ask what they think about it, or "does this really work?", it probably won't be an issue for some time.

However, depending on how much publicity this gets (and I can see people with SFB broadcasting this far and wide in much more public forums), sales of 1052-models will rise, and 1102-models will eventually fall off.  Then Rigol will respond by removing certain commands without question-marks (I'll let you guess which ones) from their updated firmwares.

- Mark

[Mark_O]

ok so just to point out I'm useless at programming and that sort of thing...

Are you capable of using one of the simple demo/test programs floating around, to just type in simple text commands and see the results?  Things like, e.g. ":INFO:MODEL?".  Having done that, are you then able to type the same command without a ?-mark, and supply your own replacement value?

Viola!

There isn't any "programming" required at all.  If there's not already a pre-compiled little App like this on your CD (I don't have an E or D-series unit to know), I'm sure someone will come up with a pointer to one that's already out there.

- Mark

P.S.  And yes, you have to plug in either a serial or USB cable to a PC (and select a port!) to be able to send these commands to the Rigols.

[Mark_O]

well they are still making a profit, infact I can't really see why they bothered doing what they did, as usual economics has gotten in the way...

These comments, as well as the remainder of your ranting is complete rubbish.  You have no clue what you're talking about.  Sorry, Simon.  Just because you "can't see why", doesn't mean that there isn't a very sound reason why.  If it weren't for the ability to offer a range of products at differing price-points, many products wouldn't exist at all.  Lots of manufacturers do it every day.  And thank goodness for all of us.

When Rigol had their previous C-series out, do you actually think they built 4-DIFFERENT models, with different logic circuits, PCBs, and layouts for the 25 MHz, 40, 60 and 100 MHz units?  Nonsense.  They designed and built a single unit, with some mechanism for setting its capabilities (internal jumpers, whatever).  In this case, they're doing it with software, and left a rather large door open.  Not the smartest thing in the world to do, considering who they're selling to (economy-minded EE's and hobbyists).

Do you think that when Tek or Agilent or LeCroy or whoever make a _range_ of instruments available, they go through and put different quality components on each model, to justify the pricing differentials?  If so, you are sadly mistaken.  In this case, you're *itching about a $200 difference on 2 Rigol models.  In those other cases, we're talking about $thousands.  Of course, there they are a lot more clever about it.  

- Mark

[bushing]

Well, I though, you could read in between the lines, that I already did so - and when I tell you that I just closed the cover of my new DS1102E for the moment and now look for a schematic and/or pictures of the LA part of the 1xxxD, guess what this means.....

Fine, fine, take all the glory and girls ... I should have listened to the voices in my head when I saw those strings looking through the firmware.   Kidding ... actually, Dave himself was the first to suggest this possibility.  I'll give it a try, as soon as I get this thing put back together ... I still wonder where they're storing that info.

Actually, while I still have the thing in pieces, let me document a few things I found, in case they're useful to someone later --

• I dunno what's actually stored on that 24LC04; the device will power on without it attached to the board, but it hangs at the loading screen.
• There's an 8-pin card edge connector on the board, directly adjacent to the EEPROM.  I had hoped that it was a factory programming interface for that EEPROM, but instead it's something quite different:  It's the SPI master bus, and you could connect a SPI flash chip to it and the Blackfin would boot from it (according to the datasheet).  If we number the pins as 1 <notch> 2 3 4 on the top and 5 6 7 <notch> 8 on the bottom, then the pins appear to be SCK <notch> MISO GND MOSI / PF2 Vcc GND <notch> BMODE0.  BMODE1 is shorted to Vcc; pull BMODE0 to ground to enable booting from external SPI flash.  This is probably how they program the units in the factory, and could be used to recover from a bad firmware flash.
• BMODE0 is pulled to Vcc internally through a 10K resistor, which means that normally it boots from another SPI master in the system -- not the 8MB NOR flash as I expected.  Very odd.  Anyone know how this thing boots?  (It still may be the case that the 4MB of firmware is stored in the first half of the NOR flash, but there has to be something shoving a boot stub to this thing over SPI or the datasheet is lying.  I guess the second 4MB of the NOR flash could be used for the internal waveform storage, as well as the serial number and model number.)
• There's also a (presumably) perfectly usable JTAG port for the Blackfin -- pinout seems to be (in order from 1-14) Vref !EMU <empty> GND GND TMS GND TCK GND !TRST GND TDI GND TDO, but I haven't tried it.
• The six-pin header near the Altera chip is the programming header for the Lattice CPLD; I didn't bother trying it, presumably it's fused off.

Lemme know if you find those LA schematics, please.

[rf-loop]

Here is picture about RigolDS1102E and DS1052Et.

Sorry pictures quality is not good becouse fast napshot...

Both Rigol get same signal from HP8161A with double output.
(outputs are not exactly same but well enough for this purpose)

Signal risetime is <1,3ns

As you can see in pictures, 1052 and 1102 have now same risetime (ans simple it means also very much same BW)
Later I will test with 70ps pulse and try look more deep.

With 10kHz 300mVp-p both scope show 300 (exactly 302) mVp-p. And same level with 100MHz. 1102, 240mVp-p ; 1052mod, 242mVp-p (note that I have also find that 1052mod have littlebit more noise and I measure p-p!) Bot measured realtime and 8 average (sinx "fake" of course OFF). If not noise issue these both looks nearly same. (some now unknown small TRIG difference in special situations)

Do not look exactly numbers in Rigol display on these pictures, there are all time variations so randomly these numbers on the display just at shutter open time in camera, in real both of scopes roll same numbers randomly).

You can see that modified 1052 have some more noise what can better see in infinite persist display. (I have not check where from noise is coming... remember that 1052 and 1102 front end is also different!)

First there is infinite persist and Equaltime sampling, display dots. Both scopes are started exactly same time.
Bottom pictures Equtime and average 32, display lines.

Here you can download this picture (download gives better quality and you can also read Rigol display):
http://www.box.net/shared/nnclbrinvs

Also I measure BW with normal sin signal. Looks like same. (very small differencies)

I find some small differency in trig quality but it need also more investigations..

In this time I personally hope that peoples do NOT make big noise about this... specially in many different internet stores "review" articles.  Rigol is not stupid (world #2 in scopes)... and maybe they make some not so nice things... and it means money.

[JimBeam]

Fine, fine, take all the glory and girls ...

You can have one of mine 

I still wonder where they're storing that info.

I still think it is the EEPROM - in a scrambled way.

I dunno what's actually stored on that 24LC04; the device will power on without it attached to the board, but it hangs at the loading screen.[/li][/list]

And that's why I think, the model info is stored in it - the rigol simply doesn't know who he is without it...

There's an 8-pin card edge connector on the board, directly adjacent to the EEPROM.  I had hoped that it was a factory programming interface for that EEPROM, but instead it's something quite different:  It's the SPI master bus, and you could connect a SPI flash chip to it and the Blackfin would boot from it (according to the datasheet).  If we number the pins as 1 <notch> 2 3 4 on the top and 5 6 7 <notch> 8 on the bottom, then the pins appear to be SCK <notch> MISO GND MOSI / PF2 Vcc GND <notch> BMODE0.  BMODE1 is shorted to Vcc; pull BMODE0 to ground to enable booting from external SPI flash.  This is probably how they program the units in the factory, and could be used to recover from a bad firmware flash.

Ahhh, that was one of the remaining secrets I encountered the last days.... Thanks for demystifying!

There's also a (presumably) perfectly usable JTAG port for the Blackfin -- pinout seems to be (in order from 1-14) Vref !EMU <empty> GND GND TMS GND TCK GND !TRST GND TDI GND TDO, but I haven't tried it.

And another think I was about to find out.

The six-pin header near the Altera chip is the programming header for the Lattice CPLD; I didn't bother trying it, presumably it's fused off.

You're perfect - that was the last on my list! 

Lemme know if you find those LA schematics, please.

With the biggest pleasure!

Btw., does anyone have photos from the cable within the 1102 that goes from the 40-pin header to the front? Is it really only a cable? What pinning (Header is 40 pin, connector is 68 pin)? And also are there photos from connector area on the bottom side of the PCB in the LA adapter box?

[Mark_O]

Fine, fine, take all the glory and girls...

LMAO.  If only it were so easy.    Thanks for all the details on the SPI interface.  That's good stuff.

Lemme know if you find those LA schematics, please.

Do you mean these schematics that Trevor came up with, over a year ago? 

- Mark

[JimBeam]

I think RIGOL is already aware of our thread - as it was announced on Hack'A'Day and at rcgroups.com - which is frequented by RIGOL people...

Do you mean these schematics that Trevor came up with, over a year ago? 

I was aware of this thread (see my first sentence above  ), but that's only part of the story - we need to know which signal on the 40-pin header is what.

[Mark_O]

There are official last FW updates...

Surprice: later today there are not anymore these FW update files.

Yep.  Here today, gone... today!  That was certainly quick.  Makes you wonder...

- Mark

[JimBeam]

Yep.  Here today, gone... today!  That was certainly quick.  Makes you wonder...

Wow - that was quick... 

[Mark_O]

I think RIGOL is already aware of our thread - as it was announced on Hack'A'Day and at rcgroups.com - which is frequented by RIGOL people...

Well, you might think so, but not so much.    I.e., Victor, their Head of Service, last stopped by RCGroups a mere 5 months ago.  Saelig is a Rigol dealer, and they stop in every month or two to tell us how great they are.  The new US rep for Rigol has visited once.  So I'm not sure they're getting any info from RCGRoups, though lots of their customers are benefitting.  I agree that HackADay probably got a lot of attention, so perhaps someone from Rigol is monitoring things here now.

Or maybe they've got a mole here watching (not posting) ever since Dave claimed to have caught them "with their pants down", on the overclocking thing. 

I was aware of this thread (see my first sentence above   ), but that's only part of the story - we need to know which signal on the 40-pin header is what.

Ah, my apologies, Jim.  I though you were having trouble locating it.  But I wouldn't think you'd care what was on the 40-pin side of the Logic Head.  Those are just grounds and flying leads to the signal clip-ons.  They're pretty straight-forward, and Alison already documented those here.

Things are more complicated on the 68-pin SCSI side, which carries the differential signals.  I'd think that's what would be of interest to you.

- Mark

[JimBeam]

Things are more complicated on the 68-pin SCSI side, which carries the differential signals.  I'd think that's what would be of interest to you.

You're absolutely right! 

[Mark_O]

You're absolutely right! 

Ah, in that case, I have no quick answer ready for you.  Sorry.  If I come up with something, I'll let you know here.

- Mark

[Simon]

well they are still making a profit, infact I can't really see why they bothered doing what they did, as usual economics has gotten in the way...

These comments, as well as the remainder of your ranting is complete rubbish.  You have no clue what you're talking about.  Sorry, Simon.  Just because you "can't see why", doesn't mean that there isn't a very sound reason why.  If it weren't for the ability to offer a range of products at differing price-points, many products wouldn't exist at all.  Lots of manufacturers do it every day.  And thank goodness for all of us.

When Rigol had their previous C-series out, do you actually think they built 4-DIFFERENT models, with different logic circuits, PCBs, and layouts for the 25 MHz, 40, 60 and 100 MHz units?  Nonsense.  They designed and built a single unit, with some mechanism for setting its capabilities (internal jumpers, whatever).  In this case, they're doing it with software, and left a rather large door open.  Not the smartest thing in the world to do, considering who they're selling to (economy-minded EE's and hobbyists).

Do you think that when Tek or Agilent or LeCroy or whoever make a _range_ of instruments available, they go through and put different quality components on each model, to justify the pricing differentials?  If so, you are sadly mistaken.  In this case, you're *itching about a $200 difference on 2 Rigol models.  In those other cases, we're talking about $thousands.  Of course, there they are a lot more clever about it. 

- Mark

yea they develooped one product and made two out of it simple I said that at the end of my post. I just don't like waste thats all. for a little bit more but not quite as much as the 100 MHz version I would have bought it anyhow, the trick they pulled has only bought them a little time. now countless DS1052e users are going to covert their cheaply bought scopes to DS1102E scopes with very little effort, I'm not versed in the methods used to do this but it sounds like it is simple for many people and rigol have lost possibly money over it but then yea people would not have bought one at all were it not for the 1052 so I suppose it's 6 of one and a half dozen of the other.

Oh and chances are they do already know it has been hacked, I'm sure they have been quivering since the notion was brought up that the 1052 and 1102 are so similar that they must be the same unit with something done to the 1052 to keep it under restraint. They will probably start working on new firmware that will anull the mod like changing the location of the information.

[Mark_O]

Here is picture about RigolDS1102E and DS1052Et.

Sorry pictures quality is not good because fast snapshot...

Plenty good enough!  These are an excellent confirmation.  Thanks!  The two units are now like 2 peas in a pod, as the saying goes. 

Both Rigol get same signal from HP8161A with double output.
(outputs are not exactly same but well enough for this purpose)

You could have swapped the two output leads from the generator, to see if the deviation followed (i.e., signal induced), but I agree that the diff is so small, it's not very important.

Signal risetime is <1,3ns

I'm guessing quite a bit less.  If the source signal were actually contributing that much to the total risetime readout, it would imply that the actual bandwidth of (both) the Rigol's was approaching 200 MHz (~1.8 nS risetimes).

As you can see in pictures, 1052 and 1102 have now same risetime (and simple it means also very much same BW).  Later I will test with 70ps pulse and try look more deep.

You've done a great job here.  I'm not going to comment on every point, but just say "thanks".  I'll be interested in hearing your findings on triggering.

I personally hope that peoples do NOT make big noise about this... specially in many different internet stores "review" articles.  Rigol is not stupid (world #2 in scopes)... and maybe they make some not so nice things... and it means money.

I agree completely.  I can foresee a new firmware update shutting this capability down. 

- Mark

[Mark_O]

yea they develooped one product and made two out of it simple I said that at the end of my post. I just don't like waste thats all.

Well, I'll cut you some slack, but ask, "where's the waste?".  By building a single product, and making it easily adaptable to multiple price points, and multiple customer-bases, that's the height of efficiency.  They can then sell to a much wider range of consumers than would otherwise be possible... at any single fixed price-point.

the trick they pulled has only bought them a little time.

The "trick" is no different than any of their competitors.  They just implemented it more clumsily.

now countless DS1052e users are going to covert their cheaply bought scopes to DS1102E scopes with very little effort

I won't argue with you there.

Oh and chances are they do already know it has been hacked, I'm sure they have been quivering since the notion was brought up that the 1052 and 1102 are so similar that they must be the same unit with something done to the 1052 to keep it under restraint.

You may be right.  It does seem like an odd coincidence for the firmwares to be taken down from their website at just this point in time.

They will probably start working on new firmware that will anull the mod like changing the location of the information.

No doubt about that.  Once they're aware of it, they WILL respond to lock it down.  The only question is, how soon?

- Mark

[bushing]

Do you think that when Tek or Agilent or LeCroy or whoever make a _range_ of instruments available, they go through and put different quality components on each model, to justify the pricing differentials?  If so, you are sadly mistaken.  In this case, you're *itching about a $200 difference on 2 Rigol models.  In those other cases, we're talking about $thousands.  Of course, there they are a lot more clever about it. 

... snip ...
Oh and chances are they do already know it has been hacked, I'm sure they have been quivering since the notion was brought up that the 1052 and 1102 are so similar that they must be the same unit with something done to the 1052 to keep it under restraint. They will probably start working on new firmware that will anull the mod like changing the location of the information.

I look at it a little bit differently.

As far as the economics -- this is a bit like like microprocessors, where (e.g.) Intel will make one batch of chips and sell them at three different speed grades, depending on how they test.  This has a couple of benefits for Intel:

• * Better yield -- by having a way to sell the flakier chips instead of throwing them away, their yield increases and they can get more profit from a wafer of chips than they would if they had to throw away 25% of them
• * Larger market -- they can sell those flakey chips to people who are on a budget; they won't make quite the profit margin, but it's still a sale.  There will always be people who will pay top dollar for the best goods (esp. businesses) -- so they will sell the chips that perform the best to the high end.  They will mark the chips differently so that the people who buy the expensive ones at twice the price won't feel ripped off -- but Intel put the same amount of materials and labor into each chip.

Now, of course, sometimes their product is better than average, but they need to keep their inventory of each chip constant -- so sometimes they will take mid-grade chips and sell them as low-grade.   Some small percentage of the people who buy the low-end chips will overclock them and discover that they got better chips than what they paid for -- but as long as that doesn't really impact overall sales, Intel's not going to care too much (especially when a few of the overclockers will end up burning up their chips and have to buy new ones).

The same thing is true for Rigol -- perhaps even more so, given that they're apparently overclocking a few different parts in these scopes.   I would imagine that when they assemble the units, some of them perform better than others -- some probably get scrapped (or more likely, they put new chips on them), some get put in the 50MHz bin, some in the 100MHz bin.   Maybe most of them work at 100MHz, but they have a way to sell the glitchier ones and still make a bit of money.   If nothing else, you're paying extra for the guarantee that it will operate properly at 100MHz.

So, you reprogram your scope, you take your chances.  Unless Rigol sees their sales drop considerably, I doubt we'll see them do much -- they need to use the current interface for programming the scopes in the factory (or else it wouldn't be there).  They could take the interface out somehow, but that's a fair bit of effort -- and the number of people who actually even try to do this is probably pretty small compared to the number of scopes they sell every day.

(That, and their options are fairly limited.  There's no downgrade protection and no code signing on the firmware... it'd take a lot of effort to lock it down at this point.)