Hacking the Rigol DHO800/900 Scope

[norbert.kiszka]

Anyway, 50 ohm switch is in app, but is hidden. Its shown when You put vendor.bin generated for DHO4000. Its a matter of decompile, change and compile it back. After that add transistor, resistor, diode, relay and resistor... I was just going just to add 4 parallel 0.25W 200 ohm resitors into channel 4 after adding buch of capacitors into empty missing pads and couple other places...

you typed about heating pcb and resistor risk. Now you want to do more heavy metal to make your scope spaggetti mess whats wrong with $1 external inline 50 ohm teminator? spend a little bit more if u want quality.

Everything has upsides and downsides. "$1 external inline 50 ohm" is not a best option for higher frequencies and fast rising times and that creates additional staff around which creates troubles and its more time consuming. Whats wrong with having three 1 MΩ channels and one 50 Ω ? For me personally this is a best option.

[ebastler]

Anyway, 50 ohm switch is in app, but is hidden. Its shown when You put vendor.bin generated for DHO4000. Its a matter of decompile, change and compile it back. After that add transistor, resistor, diode, relay and resistor... I was just going just to add 4 parallel 0.25W 200 ohm resitors into channel 4 after adding buch of capacitors into empty missing pads and couple other places...

Fearless but clueless...

Once you hack your frontend like that, the good thing is that you don't need to pay attention whether you switch in the 50 Ohm termination or not. Signal quality will be a mess either way. 

[Mechatrommer]

Everything has upsides and downsides. "$1 external inline 50 ohm" is not a best option for higher frequencies and fast rising times and that creates additional staff around which creates troubles and its more time consuming. Whats wrong with having three 1 MΩ channels and one 50 Ω ? For me personally this is a best option.

of course you have every right to do whatever setup to your toys. i'm just giving advice, i find it confusing if only solder 50 ohm relay to CH4, i may understand you want to reserve CH4 for special purpose, but if i have to go this route i will solder all channels. but then i only use $1 inline terminator even with leo bodnar pulse. no need to mess with front end just to get built in 50 ohm. to get increased BW 400-500MHz maybe sensible, but 800MHz BW maybe not because nyquist is 1.6-2GSps, way more even using single CH, unless if you can hack/boost the sample rate.

my first attempt if i really need RF > 250MHz, i will profile dso BW respond curve and compensate using manual calculator or my PC SW. for example if you know 400MHz is -2dB down, then you can calculate manually to add visible signal on screen with 2dB, more advance is using inverse FFT to compensate all spectrums and replot the signal on PC SW. i have suspicion that more advance GHz dsos do this kind of SW trick to get flat respond... ymmv.

[Randy222]

AFG is commanded by FPGA and vendor.bin hack to 900 alone will activate it even on HW12, so far no differences that i can spot. bode plot was working fine in HW12. btw checking start_rigol_app.sh i spotted there is another afg_gpio.ko module is loaded if anyone interested, so far i am not interested in wasting time on it since every AFG functionalities that i expect to work, work as expected either on HW12 or 8. the point we looked for HW8 is because we want the 16CH digital channels can be used as trigger source correctly. this has some applications, but if you dont need it, thats fine for you.

The afg KLM uses 5 pins in gpio3, gpio 122,123,124,125,126, using odd name "afg_in1" , odd in that uses the word "in" but the pin is an out pin, and on my 804 are set 10101

you gave me some idea, because i have 3 unknown pins on AFG interface, 1 is output i think and the other 2 pins probably input. if there is way knowing what RK3399 pins refered as 122-126... maybe i need to look into afg_gpio.ko more closely. thanks.

1) using just shell cli I have full control over any pin that is configured as gpio, as long as there's no KLM using these pins. Caveat is, not sure what good direct control over a pin is, software still needs to read the pin states.
2) RK pins are mapped into 1 of 4 functions, not all pins have 4 defined functions, see the RK datasheet
3) in gpio, the RK has 5x(4x8) mapping, 5 groups of 32 pins, each group divided into 4 banks A B C D, each bank has pin labels 0-7
4) logically the groups are gpio0 gpio1 gpio2 gpio3 gpio4
5) there's no just counting pins, they are "gpio" numbered, and they start at "0" and end on "159",  "gpio0_A0"  is not to be referred to as "pin #1", its "gpio pin #0, the very 1st pin in gpio". The very last pin in gpio, the 160th pin under gpio, is "gpio pin #159".

122-126 are in gpio3
122 gpio3_D2
123 gpio3_D3
124 gpio3_D4
125 gpio3_D5
126 gpio3_D6

Use this RK datasheet XY matrix to find physical pin location of the "gpio" names.

https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf
Verify this datasheet matches the actual RK chip used in your DHO. My gpio mappings are correct, but if wrong datasheet they could be physically mapped in a different matrix (there are several versions/flavors of RK3399).

You also mention that some of those pins may be 'in' and 'out' pins, but IIRC I noted them as all 'out' pins on my 804, and I have no idea if perhaps they are configured in some way being related to HW #.

[AndyBig]

If anyone is interested, I have attached two files. These are boot logs read from the UART connectors of the processor and FPGA.

[AceyTech]

Verify this datasheet matches the actual RK chip used in your DHO. My gpio mappings are correct, but if wrong datasheet they could be physically mapped in a different matrix (there are several versions/flavors of RK3399).

Question:  How many "versions/flavors" of the RK3399 chip have you discovered?
 
And do you have any info that Rigol used different versions in the DHO's?
Links please?

[AceyTech]

If anyone is interested, I have attached two files. These are boot logs read from the UART connectors of the processor and FPGA.

Thanks for posting these.  Have you diff'd these to the original logs Dave posted that he took during the teardown video?  Has much changed?  I'll check in "the morning" when I get up.

[AndyBig]

If anyone is interested, I have attached two files. These are boot logs read from the UART connectors of the processor and FPGA.

Thanks for posting these.  Have you diff'd these to the original logs Dave posted that he took during the teardown video?  Has much changed?  I'll check in "the morning" when I get up.

No, I didn't compare. I didn't even look closely at what I recorded from my oscilloscope

[norbert.kiszka]

Three photos of underside of CPU in original & unmodified DHO924S. If somebody wants more photos of something particular - better tell me now.

 

Could you take a photo of the side of the input tract?(Its analog part)

Input stages? I already did. First things first. Now Im removing LC filter from channel 4 and adding missing capacitors around dc-dc converters - some of them wasnt populated (one instead of two parallel).

Ścieżka wejścia analogowego

More like: stopień wejścia analogowego. Word ścieżka means path.

BW 400-500MHz maybe sensible, but 800MHz BW maybe not because nyquist is 1.6-2GSps, way more even using single CH, unless if you can hack/boost the sample rate.

my first attempt if i really need RF > 250MHz, i will profile dso BW respond curve and compensate using manual calculator or my PC SW. for example if you know 400MHz is -2dB down, then you can calculate manually to add visible signal on screen with 2dB, more advance is using inverse FFT to compensate all spectrums and replot the signal on PC SW. i have suspicion that more advance GHz dsos do this kind of SW trick to get flat respond... ymmv.

Even with this sample rate it will still work. 800 MHz bandwidth makes possible to test signals up to ~80 MHz. 80 MHz square wave with 250 MHz bandwidth will be more like sinus and You lose precious data. Only one problem will be with spikes directly between two samples.

Speaking of bandwidth, I did one simple and stupid mistake...



 

Next time I should think more before doing simple job like that. Those two filters makes higher impedance at higher frequencies. so they added this capacitor. When I leaved it (with removed LC filters after it), impedance went down and signal was distorted. Same problem will be with mentioned 400 MHz "hack", when You leave it or remove it.

First LC filter is around 280-300 MHz (they made higher bandwidth than specified because of elements tolerance and eventual complaints because somebody didnt calculate total system bandwidth when using passive probes). Second one is probably around 800 MHz to filter out high frequency noise. Speaking of noise, after correcting my mistake (removing this capacitor) noise went from 74 uV RMS (originally) up to ~145 uV. After some time it went up to 300-350 uV making it less usable. I have suspicious about used thermopads was splashed and it added capacitance like it was with mentioned capacitor (same noise level - probably caused by capacitive load of opamp). Later I will check this.

I used 1mm thick thermopads. After that it was little pressure into thermopad on FPGA and on CPU (rk3399) heatsink was touching about half of it - measured temp. was increased by ~10° beside most expensive thermopads (6 W/m⋅K) from a local shop. Those on input stages was splashed like a cake...

So I measured height difference between those spacers (is that correct english name of it?) with a caliper. At input stages those are longer by 1 mm. So I think input stages should have 0.5 mm and everything else should have 1.5 mm. Workaround is to use 1 mm and 2 mm, but with less size due to splashing it around and possibly creating capacitance...

That is probably the worst aluminium heatsink I ever seen. Thermal conductivity is comparable to a cheap plastic. I think there is a way to hack this problem. Cut it to leave part around input stages and ADC, and cut other and better one to put it into everything else - maybe after that, fan wont be needed or one small at very low speed. Of course this heatsink is also a shield, so maybe it should be cut up to ADC and maybe little bit more.

Power dissipation for RK3399 is 6.05 W. I dont know how much is for FPGA (provided spreadshit doesnt work with LibreOffice correctly) but I assume we need similar size of heatsink due to higher total thermal resistance.

I need to divide next photos into another post because of total size limits and better readability. If somebody wants more photos, I already have much more.

[norbert.kiszka]

I added some capacitors. In some cases, this scope was pretty sensitive to a ripples from PSU (probably common mode) - I didnt figured out when it is and when not. Photo from unplaced caps:



On left-bottom side this is a parallel to this one on the left and it creates LC filter just after USB-C socket. So I added three caps (two SMD ceramic 330 nF and one film 1uF THT - yellow one). Above that, there are couple LC filters and I just added one 330 nF to a missing spot.



On other side I added one more 1 uF to mentioned LC filter after USB-C:



I know that looks very ugly and unprofessional, but who cares when it does the job?

Measured noise with disconnected inputs (ch. 1-3) was lower just by 2%... I didnt measure sensitivity to common mode yet. Long time ago I was going to make linear power supply because of common mode noise from a switching PSU - but I didnt done it yet...

After around 1-2 hr I will post resistors values around CPU in photo.

[ebastler]

What a lucky coincidence that these are 4-channel scopes. Now you can hack the input stages to all possible combinations of regular and high bandwidth, 1 MOhm and 50 Ohm termination. 

Better add a sticker to the front panel to remember which channel does what... 

[norbert.kiszka]

What a lucky coincidence that these are 4-channel scopes. Now you can hack the input stages to all possible combinations of regular and high bandwidth, 1 MOhm and 50 Ohm termination. 

Better add a sticker to the front panel to remember which channel does what...

One channel with higher bandwidth and 50Ω termination is good enough for me - it will be for special purposes when 250 MHz is not enough. 1-3 channels are unmodified - I just cleaned flux residues because of unnecessary higher capacitance (difference on same signal on those channels is very subtle after this - almost no change).

[Veteran68]

This is what scares me about buying used test equipment. I sincerely hope if Norbert ever sells his scope that fully discloses all of these... adjustments he's made.

[Mechatrommer]

Even with this sample rate it will still work. 800 MHz bandwidth makes possible to test signals up to ~80 MHz. 80 MHz square wave with 250 MHz bandwidth will be more like sinus and You lose precious data.

if you want to diagnose signal integrity (rise/down time detailed shape) at 80MHz square wave, DHO800/900 is not the tool, period. unless you can modify it to like 10GSps or more. you need at least say 10 points on each rise/fall time. you havent proved that it can even do 2-4GSps, or maybe you did? you just dont want to tell us? either way, you keep posting inconclusively..

Only one problem will be with spikes directly between two samples.

we all know this consequence when you try to make a machine violates nyquist limit... i wonder if you really know the reason behind the theorem? because if you do, i think you wont do what you tried to do with the front end..

Speaking of bandwidth, I did one simple and stupid mistake...

i hope destroying/overloading the centaurus adc input is not one of it. with your lack of evidence and inconclusive post, i hope nobody will follow your step blindly... ymmv.

[norbert.kiszka]

This is what scares me about buying used test equipment. I sincerely hope if Norbert ever sells his scope that fully discloses all of these... adjustments he's made.

We are indeed in a hacking thread so what did You expect? Of course selling anything is a matter of being honest. Are you suggesting something?

Why You didnt tell same thing when half of people in here was playing around with resistor around CPU?

Even with this sample rate it will still work. 800 MHz bandwidth makes possible to test signals up to ~80 MHz. 80 MHz square wave with 250 MHz bandwidth will be more like sinus and You lose precious data.

if you want to diagnose signal integrity (rise/down time detailed shape) at 80MHz square wave, DHO800/900 is not the tool, period. unless you can modify it to like 10GSps or more. you need at least say 10 points on each rise/fall time. you havent proved that it can even do 2-4GSps, or maybe you did? you just dont want to tell us? either way, you keep posting inconclusively..

Only one problem will be with spikes directly between two samples.

we all know this consequence when you try to make a machine violates nyquist limit... i wonder if you really know the reason behind the theorem? because if you do, i think you wont do what you tried to do with the front end..

I don't want to be rude, but probably You dont know too much about analog filters. With same sample rate, changing bandwith via filter changes shape which in some cases can be very significant and change Your decisions. Spikes between samples will be also visible (I still have filtering but on much higher frequency), but it ADC will it see earlier and in less samples. I never told anything about measuring 800 MHz signals. With 80 MHz I still have ~15 samples per period but its less distorted.

Changing coils instead of removing it, makes necessary to add another capacitor to maintain same transmission line termination.

Speaking of bandwidth, I did one simple and stupid mistake...

i hope destroying/overloading the centaurus adc input is not one of it. with your lack of evidence and inconclusive post, i hope nobody will follow your step blindly... ymmv.

ADC wasnt overloaded. More like opamp from input stage IC, but this is not enough to destroy output transistors in it.

[AndyBig]

norbert.kiszka Did I understand correctly that no practical benefit was achieved as a result of all these horrors?

[ebastler]

This is what scares me about buying used test equipment. I sincerely hope if Norbert ever sells his scope that fully discloses all of these... adjustments he's made.

Sounds like one of those ebay specials in the making: "Powers on. I can't test it any further since I don't know what to look for." 

[ebastler]

ADC wasnt overloaded. More like opamp from input stage IC, but this is not enough to destroy output transistors in it.

Be careful anyway. The ADC is obviously a custom Rigol part. But if I remember correctly, even the pre-amplifier -- while a TI part -- has a part number which people have not been able to find on the TI site or through distributors, hence may be a custom variant for Rigol.

[norbert.kiszka]

norbert.kiszka Did I understand correctly that no practical benefit was achieved as a result of all these horrors?

Its opposite. I can use CH4 at a single channel mode to have higher bandwidth when needed. 250 MHz is calculated for 3-4 channels (312.5 M samples per second) and for people (beginners) complaining about small time offset between channels (because samples are not in the same time). Also this is made to force consumers to buy more expensive (and bigger...) scope. This puppy almost fits into my pocket, making it more useful.

Added capacitors (see photos) makes it work more stable and less vulnerable to ripples from a external PSU - I already had issues with it as I told before. As we all see, whole thing was designed to save every penny at production line. Thats why we have aluminium made from plastic (paraphrase of friend words) and almost everything else made very poorly.

If somebody wants to leave all hardware as it is, then its his/her choice.

Speaking of hacking and things like that. Long time ago I had PC running 233 (or 266?) MHz Celeron overclocked to 600 MHz without single fan inside PC - not even in PSU. But now nominal clocks are much closer to hardware limits - so ~30% is the max what we can overclock those days.

ADC wasnt overloaded. More like opamp from input stage IC, but this is not enough to destroy output transistors in it.

Be careful anyway. The ADC is obviously a custom Rigol part. But if I remember correctly, even the pre-amplifier -- while a TI part -- has a part number which people have not been able to find on the TI site or through distributors, hence may be a custom variant for Rigol.

I didnt notice that is from TI (some logo somwhere?). IMHO TI makes much better jelly bean parts than other manufacturers.

[norbert.kiszka]

I almost forget about photos of input stages from opposite side. Also photo around FPGA.

[Mechatrommer]

norbert.kiszka Did I understand correctly that no practical benefit was achieved as a result of all these horrors?

as i said tuning to 400-500MHz is probably sensible. but the way he is shorting the filter inductor is like opening up infinite BW at ADC input to me, at least we have a sound filter simulation presented that cutoff nyquist sampling limit, ie at 500-625MHz, slightest presence of anything more than 625MHz will create false (aliased) signal on screen, worse is that dho800/900 enforce sinc interpolation only (no linear vector or dots) on the display. this has been discussed to death and as an arguing point to competing brand fanboysm why dho900 is a bad dso, now this guy want to go even further, amazing!

I don't want to be rude, but probably You dont know too much about analog filters. With same sample rate, changing bandwith via filter changes shape which in some cases can be very significant and change Your decisions. Spikes between samples will be also visible (I still have filtering but on much higher frequency), but it ADC will it see earlier and in less samples. I never told anything about measuring 800 MHz signals. With 80 MHz I still have ~15 samples per period but its less distorted.

thats ok, the day of feeling insulted is gone, we are here to learn new things even if we have to go through lenghty arguments. in fact it is true i have no clue at all at the front end since i never investigate that region, what those LC filter values on components etc because imho no point for me atm. or maybe because i'm not there yet due to no urgent need. yes you can see descent, nice and smooth 80MHz square with 500-800MHz BW scope. i thought you want to see details including rise time region, thats where telling many things about circuit condition. with 10-20X sampling, you can see decent square, but thats all, probably most real step condition are lost anyway. and please note, once sampler is exposed to anything half or more frequency content, you can be happy with any false signals on your screen without knowing it is false, just a precaution that i hope future beginner readers will not fall trap into. this is not me telling, this is mr harry nyquist is telling us. ymmv.

[ebastler]

I didnt notice that is from TI (some logo somwhere?). IMHO TI makes much better jelly bean parts than other manufacturers.

Hmm... I might be confusing this with some other scope. I'll try to find the reference.

[norbert.kiszka]

norbert.kiszka Did I understand correctly that no practical benefit was achieved as a result of all these horrors?

as i said tuning to 400-500MHz is probably sensible. but the way he is shorting the filter inductor is like opening up infinite BW at ADC input to me, at least we have a sound filter simulation presented that cutoff nyquist sampling limit, ie at 500-625MHz, slightest presence of anything more than 625MHz will create false signal on screen, worse is that dho800/900 enforce sinc interpolation (no linear vector or dots) on the display. this has been discussed to death and as an arguing point to competing brand fanboysm why dho900 is a bad dso, now this guy want to go even further, amazing!

Everybody should keep in mind limits of test equipment hardware and software. I already had that discussion about sampling with my teacher long time ago (thats why he told me he doesnt like digital scopes - however that was exactly two decades ago). In this case most important is to maintain line termination - in "400 MHz hack" nobody mentioned it. Maybe Im stupid and proper termination is not a problem? BTW. This cap before filters has 7 pF (measured).

slightest presence of anything more than 625MHz will create false signal on screen

Are you trying to suggest LC filters are kind of magic and not making false signals? Phase shift in pulses are nothing to worry about? Lowering amplitude of high frequency is also never not a problem? Anything between samples will be still on screen - more or less. Im aware of it. Only one problem for me here is the noise (as I mentioned earlier) - I will check eventual contamination (making higher capacitance somewhere in the analog path) - if its not the case, then I will bring back second stage filter, which I suspect is around 800 MHz.

[sjfaustino]

Has anyone tried these Puccy 3 Pack Screen Protector TPU Film Guard (Not Tempered Glass) for the touchscreen?
If so, what are the pros and cons of them? Does it cut down on the screen reflection?

[norbert.kiszka]

Has anyone tried these Puccy 3 Pack Screen Protector TPU Film Guard (Not Tempered Glass) for the touchscreen?
If so, what are the pros and cons of them? Does it cut down on the screen reflection?

I remember somebody mentioned some screen protector in this thread or in a teardown/bugs thread.