Hacking the Rigol DHO800/900 Scope

[ebastler]

The only downside is the digital channel thing in the UI.

A piece of black masking tape should take care of that. 

Edit: Maybe Rigol will provide a reduced-bandwidth setting for the DHO900 series in a future firmware update, either user-selectable or kicking in automatically in 3- or 4-channel mode? Must be a concern for the "real" DHO914 too, and even more the 924.

[Fungus]

I'm still wondering if I should leave it in or not.

The extra bandwidth is unimportant, I can get 50Mts on a DHO800, I don't really care about the decoders...

It's all down to whether I want to trade 2ns/div for the ugly graphic.

I'm going to sleep on it.

[Martin72]

I am satisfied with the bandwidth and memory hack, the only thing that is a bit annoying is the missing 2ns/div.
And as for the "missing" decoders, honestly, does anyone really need them?

[Mechatrommer]

The only downside is the digital channel thing in the UI.

A piece of black masking tape should take care of that. 

now, i dont have to... why mask a little bit nice bell and whistle? https://www.eevblog.com/forum/testgear/low-cost-logic-analyzer-probe-for-rigol-mso5000-easyeda-project/msg5200419/#msg5200419

[t_i_t_o]

Yesterday just received my new DHO804 toy, that I bought with the money from my old DS1054Z I sold in ebay
Yesterday I just unlocked 100MHz and the mem depth. Today I fooled it to be DHO924 using the vendor file from the first post.

Of course with the 924 vendor file I get the annoying DC offset, so @Fungus how did you fix that or it is just not seen with 914 one?

Here are the results sampling the same 100MHz SDRAM clock, but using 500 MHz Tek probe, using correspondingly 70, 100 and 250 MHz BW: it seems the pics are too big for the forum, tomorrow I will downscale them and upload them here.

[Fungus]

Of course with the 924 vendor file I get the annoying DC offset, so @Fungus how did you fix that or it is just not seen with 914 one?

The 914 calibrates OK.

Here are the results sampling the same 100MHz SDRAM clock, but using 500 MHz Tek probe, using correspondingly 70, 100 and 250 MHz BW: it seems the pics are too big for the forum, tomorrow I will downscale them and upload them here.

Haw are you making the pics? Use the 'scope's screenshot function, or (even better) the web interface screenshot.

[t_i_t_o]

Here are the pics.

I am old school, so I used my phone to take them

P.S.: I did the measurement the right way - used the provided probe's spring for the ground connection!

P.S2: The setup is the same as with the old DS1054Z https://www.eevblog.com/forum/testgear/new-rigol-ds1054z-oscilloscope/msg2586828/#msg2586828

[Fungus]

Looks about right.
The limits of the 150Mhz Rigol probe are very clear (see image). The 300Mhz harmonic is definitely attenuated by it.

I've measured the bandwidth at every configuration, I get:
70Mhz DHO800: 125MHz measured bandwidth
100Mhz DHO800: 200MHz measured

125MHz DHO900: 225MHz measured
250Mhz DHO900: 280Mhz measured

This was done using a pulse fed into the 'scope via. 50 Ohm terminated coax and measuring the rise time.

Martin72 has confirmed the math (ie. 0.45/rise time) by measuring attenuation of signals from his signal generator.

(my cheapo siggen doesn't go that high...  )

Why is Rigol so conservative with the labeling? No idea. 

[Fungus]

now, i dont have to... why mask a little bit nice bell and whistle? https://www.eevblog.com/forum/testgear/low-cost-logic-analyzer-probe-for-rigol-mso5000-easyeda-project/msg5200419/#msg5200419

Does the signal generator work? THAT is a hack.

It should probably have its own thread.

[Mechatrommer]

Does the signal generator work?

looking at D0, some floating signal going on, but proper probe need to be built to avoid damage to fpga pins inside. from reading, fpga can accepts rspecl differential signal safely.
edit: oh you mean the afg module? work in progress, still waiting for parts to arrive.

[Martin72]

Why is Rigol so conservative with the labeling? No idea. 

Good question.
Inspired by the last posts here, I measured a probe from my rigol.
First only the rise time, soon on the R&S generator.
I used the (unfortunately no longer available) bodnarpulser, fitted the probe with a spring and fixed it to the output as well as possible (it's not perfect).
The rise time of the hacked rigol is not influenced by the probe, so it is already over 200Mhz.
Then I connected the same setup to a 500Mhz scope and measured about 1.1ns.
I will verify this with the generator soon.

[t_i_t_o]

Of course with the 924 vendor file I get the annoying DC offset, so @Fungus how did you fix that or it is just not seen with 914 one?

The 914 calibrates OK.

I can confirm that partly
Tonight I decided to try to f*ck the devil once more:
1. I decided to generate vendor file for 914
2. Verified there is no DC offset
3. Decided to use BW option upgrade to 250MHz hoping no offset will be introduced
4. Generated the BW15T25 option and applied it and... offset is there!

Bottom-line: It's not the 924 vendor file that introduces the offset, it is the very 250MHz BW enablement that does it.
So here are two possible reasons - either software i.e. Rigol made sure its not that easy to have the 250MHz BW, either hardware - there might be somewhere small component difference between the 800 and the 900 series in the front-end...

[Mechatrommer]

Bottom-line: It's not the 924 vendor file that introduces the offset, it is the very 250MHz BW enablement that does it.
So here are two possible reasons - either software i.e. Rigol made sure its not that easy to have the 250MHz BW, either hardware - there might be somewhere small component difference between the 800 and the 900 series in the front-end...

if you copy the whole hubertyoung's 924S fw on dho800, now its 250MHz, but there is no offset, how you explain that?

[Fungus]

Bottom-line: It's not the 924 vendor file that introduces the offset, it is the very 250MHz BW enablement that does it.

It makes no sense though. Calibration isn't done with a signal that's changing.

there might be somewhere small component difference between the 800 and the 900 series in the front-end...

I don't believe that. I think the firmware does something different when it detects a 924.

[t_i_t_o]

Bottom-line: It's not the 924 vendor file that introduces the offset, it is the very 250MHz BW enablement that does it.

It makes no sense though. Calibration isn't done with a signal that's changing.

Try it, it costs 5 mins... You already have the 914 configuration, just generate yourself a DHO900 BW upgrade option.

[t_i_t_o]

Bottom-line: It's not the 924 vendor file that introduces the offset, it is the very 250MHz BW enablement that does it.
So here are two possible reasons - either software i.e. Rigol made sure its not that easy to have the 250MHz BW, either hardware - there might be somewhere small component difference between the 800 and the 900 series in the front-end...

if you copy the whole hubertyoung's 924S fw on dho800, now its 250MHz, but there is no offset, how you explain that?

Damn, I thought I'm done with the hacking...
I haven't open my scope yet so I can not directly dd the hubertyoung's image. I'll try to manually compare firmware content to see what is the difference. I really would like the 250 megs bandwidth without offset.

[ebastler]

I really would like the 250 megs bandwidth without offset.

But it's not such a big difference in real bandwidth -- not sure whether it is worthwhile. As measured by Fungus,

125MHz DHO900: 225MHz measured
250Mhz DHO900: 280Mhz measured

[t_i_t_o]

Not sure about that, looking at real 100MHz signal using the right probe:

[Fungus]

I really would like the 250 megs bandwidth without offset.

But it's not such a big difference in real bandwidth -- not sure whether it is worthwhile. As measured by Fungus,

125MHz DHO900: 225MHz measured
250Mhz DHO900: 280Mhz measured

Yep, and one of those two settings breaks the "2.5x" rule for sample rate with 2 channels enabled.

625MSa/s @ 225MHz gives 2.8x oversample
625MSa/s @ 280MHz gives 2.3x oversample

[Fungus]

Not sure about that, looking at real 100MHz signal using the right probe:

You're looking at the difference the 300Mhz harmonic makes with a 225Mhz vs. 280Mhz oscilloscope.

That's the sort of setup a marketing department would use. 

PS: A  few 5mV of offset makes zero difference for digital signals.

[t_i_t_o]

Just FYI, while playing with the upgrade options, I pasted the whole list at once in the web interface of the scope and hit send (strings are intentionally truncated):
:SYSTem:OPTion:INSTall DHO800-BW2T4@7438837537
:SYSTem:OPTion:INSTall DHO800-BW2T8@33526edc3b
:SYSTem:OPTion:INSTall DHO800-BW4T8@6aef25ef93
:SYSTem:OPTion:INSTall DHO800-BW7T10@c648cb912
:SYSTem:OPTion:INSTall DHO800-BW7T15@b9bdc5e27
:SYSTem:OPTion:INSTall DHO800-BW7T20@8bf2c3452
:SYSTem:OPTion:INSTall DHO800-BW10T20@44618ef3
:SYSTem:OPTion:INSTall DHO800-BW15T25@192653e3
:SYSTem:OPTion:INSTall DHO800-AERO@832fc9c2e74
:SYSTem:OPTion:INSTall DHO800-ARINC@e771496048
:SYSTem:OPTion:INSTall DHO800-AUDIO@fa89095f52
:SYSTem:OPTion:INSTall DHO800-AUTO@102a385d266
:SYSTem:OPTion:INSTall DHO800-AWG@efad83ca473e
:SYSTem:OPTion:INSTall DHO800-BND@8720d45f439e
:SYSTem:OPTion:INSTall DHO800-BODE@d07e116934c
:SYSTem:OPTion:INSTall DHO800-COMP@b56e6789a69
:SYSTem:OPTion:INSTall DHO800-COUNT@17ef539118
:SYSTem:OPTion:INSTall DHO800-DG@3950b6c79250f
:SYSTem:OPTion:INSTall DHO800-EMBD@8d316fca563
:SYSTem:OPTion:INSTall DHO800-EYE@cae00e28e8e5
:SYSTem:OPTion:INSTall DHO800-FLEX@b7f26d0c18d
:SYSTem:OPTion:INSTall DHO800-JITTER@1fbd0f7df
:SYSTem:OPTion:INSTall DHO800-MSO@e630514de32b
:SYSTem:OPTion:INSTall DHO800-PWR@4d4d7bf2b911
:SYSTem:OPTion:INSTall DHO800-RLU@ef44597ef58e
:SYSTem:OPTion:INSTall DHO800-RTSA@3aa195bbf20
:SYSTem:OPTion:INSTall DHO800-UPA@bb00db9e8da8
:SYSTem:OPTion:INSTall DHO800-CM_USB@f577d673e
:SYSTem:OPTion:INSTall DHO800-CM_ENET@32dc101b
:SYSTem:OPTion:INSTall DHO800-CM_MIPI@0ae25bf2
:SYSTem:OPTion:INSTall DHO800-CM_HDMI@52fede3a

And out of these 31 options only three were accepted (.lic files were created in the /rigol/data folder) for DHO800, those are expectedly RLU, BW7T10 and... the BND (bundle) one. Not sure what the bundle option should enable, but at least it does not enable additional protocol decoders.

Expectedly for DHO900, additionally the BODE option was accepted.

[t_i_t_o]

After several self calibrations I saw that all the cal files get modified except "-rwxrwxrwx  1 system system    156 2013-01-18 08:58 cal_lsb.hex".
Can some DHO92X owner share his whole /rigol, /rigol/data folder or at least cal_lsb.hex file (one can delete its Key.data file - I am not interested in it)?

[Mechatrommer]

After several self calibrations I saw that all the cal files get modified except "-rwxrwxrwx  1 system system    156 2013-01-18 08:58 cal_lsb.hex".
Can some DHO92X owner share his whole /rigol, /rigol/data folder or at least cal_lsb.hex file (one can delete its Key.data file - I am not interested in it)?

you can download and play with hubertyoung's fw in first page. here is the data i extracted sometime ago.. the rigol folder is about 95MB, so not easy to upload.

[t_i_t_o]

After several self calibrations I saw that all the cal files get modified except "-rwxrwxrwx  1 system system    156 2013-01-18 08:58 cal_lsb.hex".
Can some DHO92X owner share his whole /rigol, /rigol/data folder or at least cal_lsb.hex file (one can delete its Key.data file - I am not interested in it)?

you can download and play with hubertyoung's fw in first page. here is the data i extracted sometime ago.. the rigol folder is about 95MB, so not easy to upload.

Isn't his image an HDO804 one? - "@hubertyoung has provided a DHO804 FW1.14 image with the DHO924 vendor file preloaded".

[Mechatrommer]

Isn't his image an HDO804 one? - "@hubertyoung has provided a DHO804 FW1.14 image with the DHO924 vendor file preloaded".

@hubertyoung has provided a DHO804 FW1.14 image with the DHO924 vendor file preloaded. It can be extracted using 7zip then flash using HDD Raw Copy Tool (compressed image).
https://mega.nz/file/UjBC3KRY#Kqv1BCHNQdPcUGMfR8IqbuUwHUsUhU4GpO1keTAXqf8

@Luc7777 provided some guidelines on how has has achieved this.

Hi,

• This is what I've done:
  1. Run the Win32 Disk Imager
  2. Backup the SD
  3. Flash the SD with the image from the link
  4. Run the claibartation (offset gone) - device identifies as DHO804
  5. Connect the scope to ethernet
  6  Run adb:
      6.1 adb devices
      6.2 adb connect 192.xxx.x.xxx:55555
      6.3 "adb pull /rigol/data/vendor.bin"
      6.4 backup the generated vendor bin file from the adb folder to a new location
      6.5 copy in the adb folder the DHO924 image
      6.6 "adb push vendor.bin /rigol/data"

the "precursor" to the hack is here, feel free to follow as to why fw 1.14, instead of fw 1.0.0 (i need to recap)
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg4977448/#msg4977448