Hacking the Rigol MHO900 Scope

[gsobol]

Also, I noticed that 3 options - EMB, COMP and AUTO are not officially offered, but can be found in firmware, 

IMHO, these are always included by default.
From what I can tell, "AUTO" is CAN (non FD) and LIN, "EMB" is SPI and I2C and "COMP" is UART.

Very possible, it may be that the functionality is always active in the background and does not require explicit license, although licenses do show up on the list of options once activated.  No clue...

[MajorTom2]

If you made it this far, you are brave or ..., yeah let's go with brave.   

Thanks, worked like a charm!

BTW: you only need BND, RLU05, BWU05T08 (or BWU03T08) to have all options

[egonotto]

Hello,

for a limited time, you can now get the feature of the MHO98 at a lower price with the special offer of the PLA2216 for half the normal price from Batronix until 2 December 2025.

Best regards,
egonotto

[Hydron]

Telonic is showing the MHO954 at 15% off still (says ending 2nd Dec but still is at that price), they also have the half price probes thing but that discount didn't show in the basket as they were out of stock the whole promo period. Maybe worth ringing them up though if you're in the UK and want one. Now that there's a known way to generate the keys I kinda wish I'd gone for the MHO954 rather than the MHO98 (mostly to avoid the bling BS, even with half price LA probes the price would haven ended up within 10% so not a huge savings).

[pakakezu]

Not script kiddy easy, but knocking it out in half an hour easy, worked first try.  Many thanks!

[sjm]

Im not sure, but I think I said it already somewhere. According to the documentation, AFG has a sample rate 1 G Sa/s. So theoretically it should be able to give sine wave 500 MHz.

Low pass filters, even in theory, will not cut out everything. Unless we start speak about extremely high frequency like 100 THz or more.

Upper limit is only a limit - If You don't need to use it, then don't use it.

One person reported on his scope that anything above 100 MHz is unstable and with square wave above 25 MHz it's the same.

Well... I just tried 100MHz, 110MHz and 150MHz sine wave on my new hacked MHO954 and... haha, yeah anything above 100MHz is really weird looking and unusable.
I used a straight bnc-bnc coax cable from G1 output to ch1 input, and configured ch1 with 50 ohm impedance.
Below are a few screenshots I saved.

If you have something specific to also try out, let me know. Thanks.

[0xdeadbeef]

haha, yeah anything above 100MHz is really weird looking and unusable.

Not really a total surprise though.

[norbert.kiszka]

Well... I just tried 100MHz, 110MHz and 150MHz sine wave on my new hacked MHO954 and... haha, yeah anything above 100MHz is really weird looking and unusable.
I used a straight bnc-bnc coax cable from G1 output to ch1 input, and configured ch1 with 50 ohm impedance.
Below are a few screenshots I saved.

If you have something specific to also try out, let me know. Thanks.

I took a look into Dave photos with the AFG board. There is a lot of LC filters and THS3491 at the output which have 900 MHz GBW. I guess those LC filters are resonating when output frequency is above 100 MHz.

BTW. Probably I told it already, my DHO924S works fine with 80 MHz sine wave (sample rate 250 M instead of original 156.25 M), while stock firmware gives max 25 MHz. Somewhere on the forum there is schematic diagram from reverse engineering of it.

[gf]

Well... I just tried 100MHz, 110MHz and 150MHz sine wave on my new hacked MHO954 and... haha, yeah anything above 100MHz is really weird looking and unusable.
I used a straight bnc-bnc coax cable from G1 output to ch1 input, and configured ch1 with 50 ohm impedance.
Below are a few screenshots I saved.

If you have something specific to also try out, let me know. Thanks.

Looking at your screenshots, I wonder if the AFG really runs at 1GSa/s.

Could you take a screenshot of the spectrum of the generated signal over a 0–2 GHz span? Either using FFT (at full bandwidth of the scope and using a large number of FFT points), or even better, use a spectrum analyzer if you have one.

Ideally, generating a 110 MHz sine wave at 1GSa/s is expected to produce frequencies of 110, 890, 1110, and 1890 MHz within the 0-2 GHz span. The frequencies at 890, 1110, and 1890 MHz should be significantly attenuated (like in the attached plot). The region between 110 and 890 MHz should be empty. If you see peaks with significant power in this region, something is wrong.

[ EDIT: The expected peak locations are fc and N * fs ± fc, where fc is the frequency of your sine wave, fs is the sample rate and N is an integer >= 1. ]

[LesWright]

Just asking as I don't see in on the thread, has anyone done a real bandwidth measurement on an upgraded MHO900 scope?
Are there any differences between base models, for example can an MHO934, MHO954, MHO980 all hit 1GHz? Where is the roll-off (I'm guessing around 1.1GHz)

Cheers!

[norbert.kiszka]

With my calculations, MHO98 and hacked MHO900 should have 1050 MHz and there is possibility to make ~1470 MHz by changing few bits in AFE flags.

[bobrov1989]

norbert.kiszka thanks for the hack for the scope! Just installed it on my MHO934. Just one thing, please add a mention in the instructions that a LAN (wired) connection is required for the install script  . It is my first Android-based scope, so I connected in via WAN (Rigol is so lovely to include the dongle with the scope) and started the installation... Only after the first reboot did I understand my mistake, quickly made a wired connection, and updated the DHCP settings to match the IP address - great that you added so many retry attempts to the script.

[Fungus]

Just asking as I don't see in on the thread, has anyone done a real bandwidth measurement on an upgraded MHO900 scope?

Yes.

can an MHO934, MHO954, MHO980 all hit 1GHz?

Yes.

[rdarlington]

norbert.kiszka thanks for the hack for the scope! Just installed it on my MHO934. Just one thing, please add a mention in the instructions that a LAN (wired) connection is required for the install script  . It is my first Android-based scope, so I connected in via WAN (Rigol is so lovely to include the dongle with the scope) and started the installation... Only after the first reboot did I understand my mistake, quickly made a wired connection, and updated the DHCP settings to match the IP address - great that you added so many retry attempts to the script.

Yeah, wired LAN is a must.    I just installed this last week on my MHO98.   I never heard back from Rigol about license keys.  After about two weeks from delivery I decided to call.  No way to get through to anybody, so I gave up and spent the extra few bucks for the upgrade/unlock forever.     Absurd level of support from the company that made it.  Can't get em to respond to my ticket, no emails to spam (or my inbox for that matter).  Just ignored.   This is probably my first and last Rigol product.   

[washley]

Yeah, wired LAN is a must.    I just installed this last week on my MHO98.   I never heard back from Rigol about license keys.  After about two weeks from delivery I decided to call.  No way to get through to anybody, so I gave up and spent the extra few bucks for the upgrade/unlock forever.     Absurd level of support from the company that made it.  Can't get em to respond to my ticket, no emails to spam (or my inbox for that matter).  Just ignored.   This is probably my first and last Rigol product.

I received my MHO98 on Dec 3 and requested the license key right away via the google form. The response came yesterday, Dec 8 with subject "MHO98 Bundle CDKEY".

[Hydron]

The form on the rigol europe website worked immediately for me. Maybe worth a try even if your unit is a NA one?

Be very interested in AFE BW boost (and the intermediate filters, I wish they gave more options than 20 and 250) - obviously >1GHz is only really applicable for a single channel but nice to have the option!

[norbert.kiszka]

The form on the rigol europe website worked immediately for me. Maybe worth a try even if your unit is a NA one?

Be very interested in AFE BW boost (and the intermediate filters, I wish they gave more options than 20 and 250) - obviously >1GHz is only really applicable for a single channel but nice to have the option!

Im going to make it (as a free update of my mod). But I have to release updates also for DHO800/900 and DHO1000/4000. I have only two hands and only one brain, so I can't make two things at exact same time (in most cases...).

[ikcalB]

Thank you @norbert.kiszka!

Your work on the MHO900 (and Rigol in general) is MUCH appreciated! If you can, please keep up your work 
(On my MHO954: The larger display area alone is worth the price for your mod.)

Question: Self-Cal
It seems, that in mod 0.1.2 the self cal has options too choose from, which do not exist in the stock self-cal.
- At least 4 options are not checked after installing - does that mean, that is what the stock self-cal does?
- when checking ALL options, self-cal fails after <1min (4%). Is that expected? Do some self-cal items require external connections, i.e. some (BNC) cables?

Wishlist:
1. Customize Shortcuts (top right): Ability to remove certain buttons
1b. if 1) not possible, would you mind [adding an option] to remove all shortcuts, that are directly accessible via hardware buttons?
(i.e. run/stop, Measure, navigate, ...)
2. Pressing the Default button: load `DEFAULT.stp` instead of the rigol hard coded default settings?
(Allows to customize own defaults)
2b. if 2) is not feasible: Can we change hard coded default, so all channels are configured for 10x?

Thanks again & best regards from Austria,
Florian

[norbert.kiszka]

Question: Self-Cal
It seems, that in mod 0.1.2 the self cal has options too choose from, which do not exist in the stock self-cal.
- At least 4 options are not checked after installing - does that mean, that is what the stock self-cal does?
- when checking ALL options, self-cal fails after <1min (4%). Is that expected? Do some self-cal items require external connections, i.e. some (BNC) cables?

Those options are available but hidden in the stock firmware (app to be precise). If those are hidden and You press start, it will run with default settings. Usually there is no need to change anything in those checkboxes. So just leave them alone as it is and press start.

Wishlist:
1. Customize Shortcuts (top right): Ability to remove certain buttons
1b. if 1) not possible, would you mind [adding an option] to remove all shortcuts, that are directly accessible via hardware buttons?
(i.e. run/stop, Measure, navigate, ...)

Making in-app customization for it is extremely difficult because of the lack of source code. App was coded both in Java and C++ (for 100% they used source code from DHO800/900 and a lot of hardware design also from DHO800/900). This first one can be "deassembled" into Smali and second one into real Assembly. For me personally this second one is a lot easier.

Modifying those shortcuts permanently is a lot easier. Already I have plans to modify whole top bar as I did with DHO800/900 and to add more bandwidth options. Speaking about last one, Im going to fix 800 M option to be real 800 M, add 1 G and "OFF" will be around 1.4-1.5 GHz (because whole bandwidth is limited by multiple things, including AFE binary flags). All of it will be as a free update as usual, but first I need to finish my current work with DHO800/900, which is already getting too long. And likely I need to take a look into my DHO1000/4000 mod (some issues was reported). So most likely it will be not quicker than one week.

As I said already on this forum, from time to time Im working with the new app working on different system (Debian instead of Android) and with API, which will give open source GUI. In such case any UI modification will be easy and possible for everybody, including adding in-app user customization.

2. Pressing the Default button: load `DEFAULT.stp` instead of the rigol hard coded default settings?
(Allows to customize own defaults)

Actually this is quite good idea. Instead of making hardcoded individual changes, everybody will be able to make their own defaults.

2b. if 2) is not feasible: Can we change hard coded default, so all channels are configured for 10x?

This should be easier. Already one person asked for such thing on DHO800/900. From the other hand, making different versions and update all of them...

[ikcalB]

Thanks for taking your time to reply!
I'm in love with debian for over a decade myself, and am an embedded dev - although not as experienced as you.
So if you want a second pair of eyes (or better, hands  ), DM me.

One more question: The settings from Utility->Setup do not seem to be saved anywhere (also not in "store setup").
They are lost on reboot (or poweroff) as well as after loading the "Default".

EDIT:
---
Also Horizontal settings, i.e. "Expand" (values Left, Right, Center, Trigger, ...) does not seem to be saved in setup.
--- EDIT2:
Horizontal setting seems to be saved, idk what happened before.
STILL: Utility->Setup | Expand:Center and Vernier/Zoom:Zoom are not saved.
---

Is this a RIGOL bug & could you fix that? I find that quite annoying.

BR, Florian

[norbert.kiszka]

They are lost on reboot (or poweroff) as well as after loading the "Default".

Do You have load settings (or how it was called - right now I don't remember exact name in MHO900) default or load last? It was one of the first switches.

If it's set to "default", all settings are set to default at app startup.

[ikcalB]

I have load last.

It's only some settings (i.e. the ones I mentioned before - but I keep finding more) that are not saved.

Is it useful to file a bug with rigol on this?
Br

[norbert.kiszka]

I will check this later. For ~90% it's a Rigol bug, since I didn't made any change in saving settings. Beside of the optimizations in a way like compiler should do it when -O flags are used (which is never the case in Rigol firmware...).

Is it useful to file a bug with rigol on this?

You can wait years for bugfix in Rigol.

[ikcalB]

Thanks for your effort.
Regarding Rigol, I feared as much.

If you don't find anything regarding saving (don't worry about the timeline - mid january is fine with me) I'd still try to contact rigol about that subject.

Br & pleasant holidays,
Florian

[0xdeadbeef]

I will check this later. For ~90% it's a Rigol bug, since I didn't made any change in saving settings. Beside of the optimizations in a way like compiler should do it when -O flags are used (which is never the case in Rigol firmware...).

Is it useful to file a bug with rigol on this?

You can wait years for bugfix in Rigol.

Again, might be just my experience, but I tend to disagree. I reported a bug in early October (LA threshold set and LA threshold used off by a factor of two), received  some additional questions about this and finally a test firmware on last Friday. I just tested this today and the issue is fixed now. It will certainly not always be like this, but in my specific case, I have nothing to complain about.
There are obviously people working for Rigol who are capable and willing to fix existing issues. Well, at least regarding blatant bugs which are easy to reproduce...