Hacking the Rigol DHO800/900 Scope

[norbert.kiszka]

Going back to the noise. Some people likes to omit posts with my reverse engineering and little later they made huge amount of comments with guessing something which is directly related. So I will repeat myself second and last time (next time go ahead and don't read my effort with rev. eng.).

About 90% (I don't remember exact numbers now) of noise is generated by the AFD. Knowing differences between DHO800/900 and DHO4000 it's almost sure that most noise is coming from switching DC-DC converter.

If somebody needs much less noise, cut traces from DC-DC converter going to all AFD, force this converter to make 1-2 V more and place some low-noise LDO regulator in separate and small PCB connected with wires. How complicated that is?

Also, if You have Lite-ON PSU, good luck with internal ground-PE path. Especially with HV probes.

[shapirus]

Also, if You have Lite-ON PSU, good luck with internal ground-PE path. Especially with HV probes.

What do you mean by this?

[norbert.kiszka]

Also, if You have Lite-ON PSU, good luck with internal ground-PE path. Especially with HV probes.

What do you mean by this?

My another reverse engineering which I did on this forum (for 99.99% in this thread or in teardown thread).

Even best electronics engineering, playing with 200 GHz often completely doesn't know or don't want to know about very basic things related to ELV systems they use. In this case (pseudo) SELV with connected PE in a very poor method - completely unacceptable for any oscilloscope or any other test equipment - even including cheapest ones. It's just one stupid resistor and one capacitor just waiting to be cause of damage of something expensive, like a oscilloscope or measured device or both at the same time.

Anyway, not my scopes, not my problem - too many people called me as being too wise or not so much experienced (so why I play with electronics from being 6-years old?). Good luck with gaining experience with broken scope, broken something else or both - I know from experience, later nobody will apologize that I was right.

[norbert.kiszka]

Going back to the noise. Some people likes to omit posts with my reverse engineering and little later they made huge amount of comments with guessing something which is directly related. So I will repeat myself second and last time (next time go ahead and don't read my effort with rev. eng.).

About 90% (I don't remember exact numbers now) of noise is generated by the AFD. Knowing differences between DHO800/900 and DHO4000 it's almost sure that most noise is coming from switching DC-DC converter.

I forgot to remind what exact reverse engineering - it was related to the module simulating SPI communication with AFD in all four channels. App was made by very lazy people, so it will work no matter what - no errors messages, just execute code. So unloading or better commenting out insmod of this module (as I said previously in this thread if somebody of course didn't want to read my effort) will turn off AFD IC completly and You will see noise from ADC only (and very little bit from its inputs connected practically to traces and LC filters).

If somebody is a genius with a Windows (I cant understand this in last decade, why to use this crap?) and completely zero knowledge about Linux systems, I will explain: modules are modules - like a key in a lock - You can put out key from a lock and put back in. Same with modules - scope will not burn because this test which is temporary. Or like a removing .dll file from a game and put it back in - it works again, right?

[tautech]

Nope. You're supposed to match each probe to its channel. That's why they put little colored rings for the probes in the bags.

Sometimes I cant understand If You trolling again or something else.

Colored rings are because You can use all four probes at the same time and it's easy to make a mistake with swapping channels - that will create bad conclusions.

They ensure the same probe is used on the same channel it has been compensated on.
This is basic probe use and ensures measurement repeatability.

Noise between channels in my scope has much more differences than impedance on inputs. If You wan't to measure very fast signals from something very precise, then DHO800 and DHO900 series at very best can be used as a paper-weight to hold 100x more expensive probes (and other scope) than this scope.

Is a function of the BW rating and its corresponding risetime.

Even my 2 GHz DSO won't get anywhere near the 30ps risetime of a Leo Bodnar 10 MHz pulser.

[iMo]

Instead of theoretize why not put the 50ohm terminator on the BNC input and look at the Avg AC RMS values while in the 500uV/div? It is much faster than write essays which do not move us forward, imho..

Dropping Avg AC RMS in time - looks to me it averages over the entire memory (1Mpts in above example) so it takes some time. After some time it fluctuates around a value.

[sandor626]

Instead of theoretize why not put the 50ohm terminator on the BNC input and look at the Avg AC RMS values while in the 500uV/div?

the test must be done without termination of the 50 ohm!

[sandor626]

Also, if You have Lite-ON PSU, good luck with internal ground-PE path. Especially with HV probes.

the DHO800 /900 system includes a USB-c type power supply. This is a standard (USB-C) which originally does not provide for the chassis to be earthed.
But all power supplies with switching transformers can have the negative connected to ground.
Since it is an oscilloscope it is necessary to bind its inputs to a ground potential.

I don't see the problem. The liteon is already a good power supply.
But if you want, it's possible,
to reduce
EMI, pass the output conductor through a ferrite ring (or cylinder), while for the mains input it is possible to use a complete EMI filter.
I feel good. But I don't need to measure the charge of the neutrino

[shapirus]

Also, if You have Lite-ON PSU, good luck with internal ground-PE path. Especially with HV probes.

What do you mean by this?

My another reverse engineering which I did on this forum (for 99.99% in this thread or in teardown thread).

Even best electronics engineering, playing with 200 GHz often completely doesn't know or don't want to know about very basic things related to ELV systems they use. In this case (pseudo) SELV with connected PE in a very poor method - completely unacceptable for any oscilloscope or any other test equipment - even including cheapest ones. It's just one stupid resistor and one capacitor just waiting to be cause of damage of something expensive, like a oscilloscope or measured device or both at the same time.

Anyway, not my scopes, not my problem - too many people called me as being too wise or not so much experienced (so why I play with electronics from being 6-years old?). Good luck with gaining experience with broken scope, broken something else or both - I know from experience, later nobody will apologize that I was right.

Sorry I can't make anything of it.

All I know is that there's a 1 meg resistance path between the scope ground and PE when using the supplied Liteon PSU. If one isn't satisified with this, then the scope has a dedicated jack and there's a cable included to connect its chassis to PE directly.

I don't see any problem there.

[norbert.kiszka]

The liteon is already a good power supply.

And You can tell me if this PSU is SELV, PELV or FELV? Because this PSU is not SELV, beside of what they printed on a housing. Did You try to measure Riso? If You dissasemble, You will know that can fail with 50 V between PE and output ground. Proper SELV should survive 4 kV pulse. Mine failed test at 500 V. It was surprise for me that it somehow survived test with 250 V.

Look at my photos and schematic from reverse engineering in mentioned post, because I will not repost it here again and again.

I don't know how it's outside EU and even outside Poland, but in Poland, PSU's with such fault are considered as very unsafe and can't be put to sell, even if You want to sell one only.

To make it compliant with regulations and safe, You need to take out that cheap SMD components and put Y1 rated capacitor, like this one: https://eu.mouser.com/datasheet/2/447/KEM_C1104_KJN-3316338.pdf

Also You can add some resistor (1 M or bigger) in parallel, but it must survive at least 2 kV.

[norbert.kiszka]

I don't see any problem there.

Sounds like a bad joke. This doesn't have "one" resistor. I put photos earlier, so go check it out.

Also I should report this PSU to my local regulator, and after they reach only one for test and it will fail (it will fail for 100%) it will be forever officially marked as unsafe and forbidden to sale in EU. If it's not already.

But If You don't want to think to spending time to even think about this problem - this is not my problem.

[sandor626]

Liteon power supply has long been supplying premium models of laptops and portable PCs.
So it would be unsuitable because it doesn't have a single resistor?
Evidently it has other protection: otherwise HP, Lenovo, and others would all be incapable of understanding this enormous flaw?

[iMo]

Mine is "Delta"..

[norbert.kiszka]

supplying premium models?

You think that changes anything? Do You have Riso meter to prove me wrong? I already made a post with photos and reverse engineering of this crap. Wishful thinking and cognitive bias are very bad things for any engineer.

There are many companies that decades ago was making very good or premium devices, but now they are making crap, not any better than chinese companies. Like Sony, Philips, Boeing or mentioned LiteOn and Lenovo.

If You think it's just a resistor and You don't care about safety of electrical shock or damaging scope, because of this problem, it's not my problem, but Yours.

Mine is "Delta"..

I never had problems with Delta PSU-s. Always very reliable. Some of their designes was lillte strage (or maybe original), but still same good.

[sandor626]

I'm sorry but I can't understand you. You keep saying there is an electrocution hazard using this switching power supply.
I softly remember that over twenty years ago the best oscilloscopes (like my HP 54600) had abandoned 50Hz power supplies and switched to switching power supplies. In all swictihng power supplies, galvanic isolation is guaranteed (there is a transformer with primary isolated from the secondary and in addition there is a grounded galvanic shield).
The Liteon also has a ground connection on the input. By doing your reverse engineering, were you able to see how far the ground connection goes? 

How do you think that in the HP 54600 the ground contact reaches the BNC and not also the negative of the power supply?

Rigol did a great job.... instead... tell us about the ultracquire acquisition and its fantastic possibilities. Do your vaunted oscilloscopes (which they will certainly be in many respects) have this fantastic option?

[norbert.kiszka]

I'm sorry but I can't understand you. You keep saying there is an electrocution hazard using this switching power supply.
I softly remember that over twenty years ago the best oscilloscopes (like my HP 54600) had abandoned 50Hz power supplies and switched to switching power supplies. In all swictihng power supplies, galvanic isolation is guaranteed (there is a transformer with primary isolated from the secondary and in addition there is a grounded galvanic shield).
The Liteon also has a ground connection on the input. By doing your reverse engineering, were you able to see how far the ground connection goes? 

How do you think that in the HP 54600 the ground contact reaches the BNC and not also the negative of the power supply?

Rigol did a great job.... instead... tell us about the ultracquire acquisition and its fantastic possibilities. Do your vaunted oscilloscopes (which they will certainly be in many respects) have this fantastic option?

Sorry, but looks like You completely don't know what You are talking about. I was speaking about one particular model of PSU. And I was't talking about whole world or oscilloscopes. Eventually You tried to change topic, because You cannot prove anything.

I know regulations related to devices powered from grid. I have legal license valid everywhere in EU to write paper that describes if some device, electrical installation and electrical grid is safe or not - such paper with my signature and licence number can be used in courts. Also I have test equipment to test such things. That is my special power, What is Yours, beside of knowledge about laptops and behaving as a kid, which cries because somebody told that his toy is bad and unsafe?

PS. It's very easy to lie to Yourself by not seeing my post where I tested it and I did reverse engineering with photos. I think, psychological problems (like cognitive biases) shouldn't have place on engineering forums. It's not what You personally imagine that is, but what is in reality.

[shapirus]

I already made a post with photos and reverse engineering of this crap.

Where was it, can we have a link please?
This is interesting.

[sandor626]

I think, psychological problems (like cognitive biases) shouldn't have place on engineering forums. It's not what You personally imagine that is, but what is in reality.

I simply need a link.
You, on the other hand, need to calm down,

and the MODERATOR's official warning

[norbert.kiszka]

I already made a post with photos and reverse engineering of this crap.

Where was it, can we have a link please?
This is interesting.

2 minutes to find... https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5590693/#msg5590693

Fifth photo tells everything. Also explains why Rigol changed PSU from Lite-On to Delta - they likely know that can cause damage of scope and user at the same time.

Also I did mistake - it didn't fail at 500 V (which is a very very big surprise for that small SMD components), but at 1 kV. Personally I often use at least 5 THT resistors in series to be able to handle at least 2 kV, even if they are one centimeter from VR and connected in parallel.

[sandor626]

on my 230 volt network I have in cascade, two 20,000 volt spark gaps, two 5000 volt spark gaps, and a complete series of Bticino arresters.
On the roof I have a Faraday cage with a metal strip with 4 ground stakes.

 Do your oscilloscopes have these protections?

[sandor626]

I'm talking about safety.... do you think that only recent equipment that complies with safety standards should be placed on the bench? 
I light everything from 1920 to today, so I solve the problem at its root

[cte]

I think I understand the problem Norbert is addressing and will try to summarize it:

The power supply in question is a protection class I device, but the negative pole at the output is not connected to the protective conductor as one would assume (and as would be better for an oscilloscope), but is connected to the protective conductor via an RC network. As a rule, this RC network only serves the purpose of getting the DC output voltage to earth potential. (Otherwise, capacitive coupling would result in approximately half the mains voltage being applied to the DC output and therefore to the BNC sockets).

A capacitor in this RC network failed during an insulation measurement at Norbert with 500V (between the protective conductor and the DC negative pole).

In practice, this results in the following safety risk for the user: If you accidentally apply a voltage to earth, e.g. the mains voltage, to the ground terminal of the probe tip, the entire voltage is applied to the RC network within the power supply. The capacitor is apparently not sufficiently voltage-resistant and will burst. Furthermore, the impedance of the RC network is so high that the upstream fuse does not switch off immediately. This means that energy can continue to flow into the RC network. A fire is very likely.


I am an electrical engineer in Germany and I had tested electrical devices for a while as part of my job. This is why I drew my conclusion from the data that Norbert provided in another thread.


When working with my DHO804, I noticed that the resistance between the ground of the BNC socket and the protective conductor is over 4 ohms. This is why I hard grounded my device via the 4mm socket on the back.

[Fungus]

These 'scopes have an earth connector on the back and a big green+yellow cable in the box.

Feel free to use them if you're probing something dangerous.

[cte]

Not only fire hazard but also electric shock hazard.

I forgot the obvious 

These 'scopes have an earth connector on the back and a big green+yellow cable in the box.

Feel free to use them if you're probing something dangerous.

I was actually using the included power supply in the belief it would ground the scope via the 3-pin Schuko plug. Cause why else would they include a power supply with a Schuko plug, when most USB chargers have 2-pin Euro plugs.

Of course, the instructions shift the responsibility onto the user:

[Simon]

I've tried to clean this up somewhat, but really, just stop it.