Hacking the Rigol MSO5000 series oscilloscopes

[Martin72]

I removed it from channel 4 (no caps and inductors replaced with 0 Ohm resistors )

Guess why they have implemented these filters...
Little hint, not to artificially limit it.

[Neekeetos]

Well, I rebuilt connection to scope and took different oscillator, now rise rime is ~530ps. Probe construction is from https://jahonen.kapsi.fi/Electronics/DIY%201k%20probe/ with feed through termination. Some cable reflections thus seen from 17pF @ oscilloscope input, but bearable.

Well you are way faster than me, nice work. But I don't know if completely removing it is ideal, as you could get aliasing from the front end amp noise? The MSO7000 also has a filter in this location, though Dave's photos don't show it clearly so I can't tell what component values might be.

From my measurements the CLC was something like 1pF -> 47nH -> 1pF? But I did not remove the components to verify yet. This might be around the 300MHz range.

According to my measurements, you are right, 1pF+47nH. Regarding noise, there is some <1db noise rise in an area of 500-1000MHz, but this not visible on a trace, rms noise measures same values  on modified and not modified channels.

Little hint, not to artificially limit it.

I know several reasons why this lowpass could be there , as well as why it could be remover or used by rigol for other purposes, here little hint for you:
- Aliasing.  With 8Gsps adc it has to be 4G+ signals to create aliased signals. This frontend will struggle to pass such signals nor own distortions to output. Moreover, for oscilloscope as a time domain device aliasing is actually a good thing, every equivalent sampling oscilloscope uses analog BW which is greater than sampling.
- Noise . There is some concern that frontend in this scope is noisy, so reducing BW before sampling will reduce jitter etc. However as far as i can judge by fft , most noise above 500M is not coming from frontend, it is adc noise so it could not be removed with such a lowpass placed before adc ( and removing filter will not bring much additional noise )
- Matching. Matching network is placed near frontend ic, before transmission line, otherwise it makes no sense.

[thm_w]

This scope is not an equivalent time sampling scope, so I don't see the value of allowing signals above the sample rate into the ADC.
Though as you have explained, the sample rate being 8Gsps (10 in hardware), would mean the filter could drop to 10-20nH.

Its interesting that they also have the output filter directly on the frontend tweaked to boost some ranges as well. Here is the full schematic of this section:


Why they are boosting the ~300M range I'm not sure (10p/4.6R). And the effect of 770p/560R would seem to be near nothing.

KJC = BAW56 diode array on the MSO7000, some overload protection. Maybe not present on the 5000.

[Neekeetos]

Why they are boosting the ~300M range I'm not sure (10p/4.6R). And the effect of 770p/560R would seem to be near nothing.

Are you sure that 750p is a capacitance? I thought it is a small inductance, white caps are rare.
ADC input impedance should be ~110 Ohm.

[thm_w]

Why they are boosting the ~300M range I'm not sure (10p/4.6R). And the effect of 770p/560R would seem to be near nothing.

Are you sure that 750p is a capacitance? I thought it is a small inductance, white caps are rare.
ADC input impedance should be ~110 Ohm.

Thanks, I updated the schematic above with 110 ohm.

The white cap is the lower value one on the inside, 10pF, those are commonly used on the input section in the same way (RC series).
The darker colored cap is 770pF. Usually the darker the brown dielectric, the higher the capacitance.

Simulation with 47nH, 15nH, 5nH:

[kelemvor]

Thanks lujji and stmcore (I didn't tried the patch yet).

Also, the IP address (I set it to manual) cannot remember the changes, and get lost every time I reboot the scope.

Thank you! Regards!

Log into your network router and create a DHCP reservation for the scope by mac address.  Then you don't have to configure the scope manually and you always get the same ip.

[thm_w]

There is some slight oddity with bandwidth vs. range. I was expecting bandwidth to drop as voltage in gets higher, but, its not that straightforward. These are the stock hardware results:

Code: [Select]

Range Bandwidth (MHz)
1V 605
500mV 610
200mV 620
100mV 630
50mV 580
20mV 590
10mV 590
So if you are testing standardize on what range you are going to use. 100mV gave the greatest bandwidth for me.

I played with 12nH, 15nH, 0R swap in place of 47nH. The 15nH does give a boost in frequency range but not nearly what you would expect. From -3dB of 630MHz to maybe 670MHz or so. As demonstrated above, you do see the ADC noise extend out further:


Notes:
- There was no difference in bandwidth with 12nH over 15nH, so the limitation does not lie there.
- Using 0R resistors across the inductors gave me no significant improvement over stock (odd).
- Removing the 1pF at the front of the CLC made things either slightly worse or did nothing.
- Adding a MSO7000 style RCL filter at the front end did improve bandwidth up to ~700MHz but at the cost of ~3dB of peaking at 400MHz. Too much IMO.

The 400MHz peak might be due to poor choice of components (4.7nH, 17pF, 22R), or due to another filter further down the chain.
The signal generator used was rated 6GHz, 15dBm +/-1.5dBm.

I don't have a FET probe to look at the signal along the way, that might be useful. Also could be some external passives on the AFE used to set something.

[Neekeetos]

- There was no difference in bandwidth with 12nH over 15nH, so the limitation does not lie there.
- Using 0R resistors across the inductors gave me no significant improvement over stock (odd).
- Removing the 1pF at the front of the CLC made things either slightly worse or did nothing.
- Adding a MSO7000 style RCL filter at the front end did improve bandwidth up to ~700MHz but at the cost of ~3dB of peaking at 400MHz. Too much IMO.

With 0R resistors caps sould be removed, if you left them this probably explains the result.
Also for lower values of L, should the caps be replaced with new values so impedance of CLC filter is not changed?

[drhex]

I built an appEntry for MSO7000 v00.01.04.00.00 in case anybody needs it.

[thm_w]

With 0R resistors caps sould be removed, if you left them this probably explains the result.
Also for lower values of L, should the caps be replaced with new values so impedance of CLC filter is not changed?

Yeah that could explain it as I left them in, giving a 2pF load.
I don't have any values less than 1pF, but, I guess I can try some 0402 0.5pF in the future. Didn't even know they were a thing.

I built an appEntry for MSO7000 v00.01.04.00.00 in case anybody needs it.

Have you tested your MSO7000 max bandwidth at all?

[Neekeetos]

Yeah that could explain it as I left them in, giving a 2pF load.
I don't have any values less than 1pF, but, I guess I can try some 0402 0.5pF in the future. Didn't even know they were a thing.

I tried to calculate lc filter and with 110 ohm adc load filter with 1pf & 47nH makes no sense, corner frequency should be too high. We need to guess a new value for adc input impedance.
You right that completely removing this filter is bad idea, it interacts with match components on frontend side. Also there are spurs as i can see on my zero ohm replacement filter ).

PS take a look at fft options on screenshots, it could get up to 2.5GHz , which is better for our purposes. CH1 with stock lc filter. CH4 with LC removed and L replaced with zero ohm.

[Neekeetos]

Well, I've adjusted a spice model according to 750MHz peaking for 15nH and calculated values so peak should appear at ~1G. This gave 0.5pF+1pF & 10nH  for filter.  After some soldering i got no peaking at 1G , this probably means that at 1G there is no noise from frontend, and likely BW limit lies in its configuration bits. Rise time for modded channel is ~600ps , bit more than for zero resistors replacing filter.

Having scope open, I also covered TCXO with some foam, so it will not drift on any slight air flows around the scope. Now it is possible to look at OCXO at trigger shifts 0.1s and more. Appears as a useful modification.

[Mountaincat]

Thanks to very one involved, another 5074 hacked!

[tv84]

this probably means that at 1G there is no noise from frontend, and likely BW limit lies in its configuration bits.

I'm not sure if you are doing all this stuff with a 7000 device. But if you are, and you want to try a vendor.bin for DS7104 or MSO7104, pm me.

[Neekeetos]

I'm not sure if you are doing all this stuff with a 7000 device.

No, I only have an mso5k.

[tv84]

In that case, we can't do much more "officially" as the FW doesn't have the "5104" model.

[Neekeetos]

In that case, we can't do much more "officially" as the FW doesn't have the "5104" model.

Not sure what do you mean by officially. My scope has same features as anybody elses , ie unlocked to 350mhz model.
There is no 1GHz model of course, but mso5k shares frontend ic with 7k scopes, that is why we have expectations to have at least same bw as on 7k.
Bw limit could be different because of schematics as well as different frontend registers configurations , in latter case changing models within mso5k will not help and some more serious patching will be needed to copy configuration code from 7k line software.

[zhongzuocheng520]

Is there a way to restore the oscilloscope that has been stuck in the RIGOL display window due to an operational error? I have backed up the data, and there is a way to tell me. Thank you very much.

[tv84]

There is no 1GHz model of course, but mso5k shares frontend ic with 7k scopes, that is why we have expectations to have at least same bw as on 7k.

That is all HW-wise. What I meant is that, if you have a SW limitation, you'll only be able to use it up to the highest model Rigol considered for it in the SW - MSO5104, unless you would do a MAJOR SW patch. Or, forcing the MSO7000 SW to run in the 5000...

[rpro]

Is there a way to restore the oscilloscope that has been stuck in the RIGOL display window due to an operational error? I have backed up the data, and there is a way to tell me. Thank you very much.

Try "restoring defaults". Immediately after power on, wait for the power-on lights to go out (for the Single key to stop glowing orange) and press the "Single" key once. Choose the "Restore Defaults" option. Hope it helps.

[zhongzuocheng520]

Thank you very much. I have time to give it a try, but I'm not sure if it will succeed

[drhex]

Think it was good to about 600MHz - been a while, can recheck if you need the information.

[zhongzuocheng520]

Is there a way to restore the oscilloscope that has been stuck in the RIGOL display window due to an operational error? I have backed up the data, and there is a way to tell me. Thank you very much.

Try "restoring defaults". Immediately after power on, wait for the power-on lights to go out (for the Single key to stop glowing orange) and press the "Single" key once. Choose the "Restore Defaults" option. Hope it helps.

You can enter the operation and prompt for recovery failure after the operation.What additional files do I need to add and what folders do I need，Can you tell me? Thank you.

[rpro]

Is there a way to restore the oscilloscope that has been stuck in the RIGOL display window due to an operational error? I have backed up the data, and there is a way to tell me. Thank you very much.

Try "restoring defaults". Immediately after power on, wait for the power-on lights to go out (for the Single key to stop glowing orange) and press the "Single" key once. Choose the "Restore Defaults" option. Hope it helps.

You can enter the operation and prompt for recovery failure after the operation.What additional files do I need to add and what folders do I need，Can you tell me? Thank you.

I have done this in the past without needing to add additional files. Just choosing the "Restore Defaults" option and rebooting cleared a similar problem (stuck on RIGOL boot screen) for me. 

[comeau]

Okay so I'm pretty new to the MSO5000 club, but I think it was a pretty good purchase. I do embedded firmware for off-highway vehicles professionally. I really would like to expand the CAN decode/trigger to the search function. An alternative goal would be to store things in the same file format (.arb/.ref/.bin etc) that it reads or have a converter on the scope. Has anybody made any serious effort for tweaking the firmware? I noticed that there was a repo on gitlab that had the appEntry file. https://gitlab.com/riglol/rigolee/firmware/-/tree/MSO5000/firmware/rootfs/rigol?ref_type=heads
I popped it open in Ghidra, but before I go down the rabbit hole of teaching myself Ghidra/RE, does anybody know of an active project to reverse the source code for this?