then why does it cost $400 for a few resistors?

Edit: it’s “pored over data sheets” not “poured”.

Yes, we did something similar all the time on a communications monitor (shortwave to microwave, man-portable) by entering into a configuration screen and entering a passcode. BOOM! That’s a $5000 dollar upgrade. Pay us now.

That’s simply mega! (hz)

Best get an identical one soon before the manufacturers cotton on to the fact we know how to save $400 with a simple soldering iron.

Damn greedy cheating bastards!
People who do this should be put in jail!

Yeah, on the HAAS CNC mills, a lot of the upgrades just require an unlock code. And these are $2000 upgrades!

Frustrates me. I wish someone could hack the things!
-taylor

When it comes to unlock codes, doesn’t it make sense to recover all that software development time by allowing ‘me’ to sell you upgrades – otherwise I’d have to charge everyone extra.

When it comes to the physical, it might be that the other hardware on the board does not support ‘correct’ operation at the higher sample rates. Although it’s more likely that they are selling at the price the market can sustain.

Diagnosing the original circuit presents a problem similar to photographing your only camera. I would expect a money saving shortcut such as this to remain implemented only until the public catches on and they see it cut into their sales index.

@Jack of All Trades: Same

@Dorkhead: oops, i didn’t see your comment before i posted

Reminds me of the ol’ budget Radeon cards, where removing 1 cap and relocating another turned it into a top end behemoth.
These hacks are gold, like an easter egg hunt :D

From what I could tell in the forum thread the hack was still being tested, some signal ghosting apparent. Any confirmation?

The signal ghosting was from testing the channels in parallel without isolation. Normally a 50 ohm terminator is used at the end of each BNC cable when coming off of a single signal source, I didn’t know that when I constructed my home-made cables. When testing with probes, that doesn’t happen as much. I think there’s really no way around that because I’m essentially testing the scopes response using itself.

My concern is that there may still yet be some filter somewhere on the underside of the board, because another person with a 100 MHz model found the same filter on his board. There are two vias travelling to unknown locations, however, which may enable/disable the filter by some command. If there is another filter, it’s curious that the bandwidth response seems to be exactly what it would be in a 100 MHz scope already.

The internal model number may be changed with NI VISA commands and the firmware for the Mixed-signal version (also identical hardware) is out in the wild too. More on that to come, after I graduate probably!

Guess what? Those expensive Tektronix feature dongles contain nothing more than a 24C02 serial eeprom. The eeprom contains a simple hex string with the name of the feature. For example, this is the string for the DPO4VID HDTV triggering module:

ff ff ff ff 44 50 4f 34 56 49 44 00 ff ff ff ff

Substitute DPO4AUTO, DPO4COMP, or DPO4EMBD for fun and profit. Tested with Tek DPO4000 scopes.

Too bad my 30+ y/o Tektronix can’t be “upgraded” this easily.

We ran in to this way back in the 1980′s; a positive only programmable power supply cost hundreds more with an extra relay (and a DIP switch setting) to make it go positive & negative. We were told it would be against the law to modify it ourselves, so we paid the extra.

@AlmostThere

“We were told it would be against the law to modify it ourselves, so we paid the extra.”

You seriously bought that?

The term for this is price discrimination, and it’s perfectly legal. They charge the people who are willing to pay more an extra $400 and still get some profit from the people who aren’t. Realistically, not enough people will hack their scopes to change this dynamic at all. The people who hack for the $400 upgrade weren’t really willing to pay up in the first place, so they don’t actually lose anything.

Personally, measurement tools are the one thing in my shop I won’t hack. It’s more important for me to be able to really trust the output than to save a few bucks. Unreliable measurement tools can cost you a hell of a lot more than $400 in lost time and components.

Interesting how your paying $400 for the uncrippled version of the same hardware. lol

@Adam
“Welcome to the “free market”, enjoy your stay.”

Here we go – bitch and moan about the free market.

Yes, it is the free market – Rigol is free to manufacture whatever they like, however they like and charge whatever they like for their products, and you’re free to buy it or not. Get over it.

In an oscilloscope of all things. I can see if you have extra features on a TV, and shorting a couple points unlocks the expensive features, but on a scope? Everyone that uses a scope has some at least minor electronics experience, and would be able to pull this off. It’s just funny.

@pwsome
“@Adam
“Welcome to the “free market”, enjoy your stay.”

Here we go – bitch and moan about the free market.

Yes, it is the free market – Rigol is free to manufacture whatever they like, however they like and charge whatever they like for their products, and you’re free to buy it or not. Get over it.”

You mean buy it and hack it or not.

Great post/hack, but I would recommend against following the procedure until he’s verified the actual difference between the two versions.

@jproach
The difference isn’t verified, that’s true.. but if you read the post you will see that someone with the 100 MHz version didn’t notice any apparently harmful difference, while I see very noticeable bandwidth gains proportionate to what they should be if the unit is now operating at 100 MHz. They’re graphed, but ignore the second time I tried that as I didn’t use proper cabling. Either way, the filter is in a place where it won’t affect the scopes operation, unless you can explain otherwise. It’s right between the ADC buffer and the amplifier.. the ADC in an oscilloscope has no reason to see a filtered signal that I know of.

I hope someone tries this and plots the output to a 200 MHz scope, as someone at the EEVBlog forums has already done this and plotted the 50 MHz scope output. The two could be compared and it would be the final verification of the hack, IMO.

If it turns out to be a bad hack, it’s easy enough to replace the capacitors.

i don’t think the story is over yet–but this is a good start to hacking this guy. i’ve been waiting for someone to start work on this for a while.

this practice is done everywhere, and really it’s completely fair. it’s just that most people find it difficult to grasp that they’re not only paying for the physical product they buy. with all the software pirating these days and low cost products from china, it’s even harder for people to remember that it costs money to design things.

look at intel cpus, for example. Or any cpus. the same family is often the exact same die, with some resistor/fuse set. of course, it’s a bit difference here, because of the variance in maximum speed among dies, and each processor is tested for maximum speed. but the same principle holds–you are not directly paying for the price of hardware.

It give me again two reasons: 1)blame myself for buying pc based scope long time ago and getting 1/10 of rigol abilities spending almost twice 2)get rigol

any one want to buy bitscope BS310N & logic POD add-on for half price ? :D

@therian
I considered that, but there are Rigol knock-offs also, with the same face and everything. Careful.

Mobile Phone RF testers…
They have lots of options…

To upgrade you get a quote, after giving the S/N – the dealer passes the info to the Manufacture, and they list the Hardware changes needed (if any)…

If Hardware is require – the unit is sent back and returned upgraded…

If no Hardware is require – you run a upgrade utility and enter a unlock code – which is locked to the serial number of the tester…

Depending on what is requires the upgrade can cost up to £30,000… (This on test equipment costing from £20,000!)

If the company can turn a profit on both models, and both are technically the same (minus 40c worth of components) Then that additional $400 is sweet cream on the cake for the companies bottom line.

Providing you dont circumvent a copyright mechanism in the device, its open slather (sic).

“This site needs a new category for hacks like this, something like Get Cheap Stuff and Hack It to Awesomeness. Of course, feel free to come up with a better name.”

This site already has a name for hacks like this, I would suggest names for the other sorts of “hacks”. I think this is why they now have how-tos and reviews etc.

@ross

There should be an anti-aliasing filter between the signal source and ADC. An impedance matching filter may be needed to, but could also be lumped into the anti-aliasing filter.

The whole support and compatibility argument to this is irrelevant. It’s the same circuit with trivial differences in one block. This is just an example of enhanced profit margin.

If there was noteworthy affect on other components I could see the whole company-Bob type argument. Even then though the manufacturing cost is still well below selling price per unit.

You think a $150 MATX board for a PC costs $60 to manufacture per unit?

@SparcMX

I was not degrading the quality of this hack. I was trying to tell RJSC that price segregation was a legit tactic to maximize profit yet help the people with less money.

@therian
I haven’t modified both channels. I’ve left the other alone for testing.

The phase difference is restricted to two regions, if you look at my graph that I made immediately after the hack you’ll see spikes at 20 MHz and 65 MHz. That’s where the Butterworth filter edges are apparent about the cutoff frequency. When I move away from those areas in frequency the phase locks back into place.

@Don
I have no more information on the DPO modules. I haven’t handled them myself. However, I don’t believe there’s anything beside the serial eeprom. With pictures of the PCB, it should be trivial to build a “dock” to reprogram the dongles–or make your own from scratch.

Dell also used a “key” with a serial eeprom to enable expensive RAID features on certain disk array chassis. These keys were widely counterfeited for commercial purposes and are probably still available via eBay. Details here:

http://www.g-cipher.net/~resin/dp/

The question here is whether this is, actually, a case of the manufacturer artificially handicapping the hardware or whether the 50mhz model of the unit serves as a way for the manufacturer to sell units that failed their QA test at, the more stressful, 100mhz but worked just fine at 50mhz. Companies like Intel, AMD, nVidia, and ATI do this all the time, especially at the beginning of a new product line where semiconductor yields aren’t as good as they can be (though they also, often, continue to handicap perfectly good chips later on in order to produce profitable market tiering). It’s possible that the “ghosting” that some of these mod-ers are seeing is the result of units that failed to pass muster as 100mhz units when they came off the manufacturing line (whether it’s due to a slightly sub-par solder joint/IC somewhere in the circuitry or something else).

I was sifting through this thread to see if anyone had made the obvious and yet most important observation here. And no one had — until the last post. I couldn’t agree more with colecoman.

RF devices are very finicky. My company outsources our PCB manufacture and assembly, but tests and repairs each module in-house to make sure it meets spec. After R&D, testing is BY FAR the most expensive part of producing our products.

For the company that makes this scope, guaranteeing proper functionality at all frequencies up to 100MHz is undoubtedly more expensive than guaranteeing only half of that. That’s why you have to pay more for the 100MHz version.

This hack is really neat, but any results you get for signals over 50MHz will have to be presented with an asterisk: “Figures may not be accurate to the o-scope datasheet tolerances.” In fact, once you’ve touched a soldering iron to the scope’s PCB, you could argue that the asterisk would apply for all results.

This is what I was afraid to be since it reminded diode switching filter

”
Hello everybody.

I am new to the forum – but I think I have to correct a few things here…

The circuit between pins 8 and 9 and the ADC amp indeed limits the bandwidth to about 20MHz – when you activate the “BW limit” from the channel menu!

When you take a close look on the part in the middle (D1), you see a small grey bar on the right hand side – as this is neither a cap nor a coil, but a diode, supposedly a varactor diode! And the parts at the upper and lower end of the “filter” are no caps either, they are simple resistors (R1 and R2). R1 goes to ground, R2 is HF-shunted to ground via C3. The control signal comes from somewhere via R3 and biases the diode.

The series circuit of C1, C2 and D1 is a small condenser in the range of well below 1pF to some pF – depending on the control voltage and thus the capacitance of D1.

When you remove C1 you do not only remove this serial capacitance that limits the bandwidth in any case (at any value of the control voltage) – but you also disable the BW Limit function from the menu altogether!

Btw., when you look at the real circuit, it now is obvious, that after removing C1 a removal of C2 doesn’t change anything more…

Andreas
“

@ross: I’m sure the calibration is probably fine. The problem is you’ve only checked your readings using a _very_ limited sample set. What happens at different temperature and different waveforms. Are there now waveforms that might introduce ringing in the filters or something else that’s hard to track down?

In my case the scope I’m using is an MSO 4054. It’s just too expensive to experiment with and risk a loss of accuracy or warranty even if it got me another 500MHz.

@Don
The warranty is worthless to me, because I purchased it from a Chinese reseller (Dealextreme) I don’t expect I could get any support. Rigol is upfront about not supporting Chinese imported products, because of the price difference. Even beyond that, the warranty only covers the very limited scope of manufacturing defects, which are such a statistical anomaly that I wasn’t worried about that either. If something electronic works out of the box, under most circumstances it’s going to continue to work indefinitely.

Beside that, the C model scopes previous to this had bad logic analyser issues that were never fixed under warranty, so I don’t expect much in that department even if something were to go wrong.

It’s all in good fun anyway, apparently there is more to this than it seemed to me after all, considering the latest forum post. All I have to do to repair the hack if I choose is solder the caps back on.

Anyhow, I understand completely why some people wouldn’t mess with their scopes, I just don’t see any harm in doing a few well-tested mods myself, for my purposes. Even if the BW limit is disabled, I won’t care if it gives me increased bandwidth overall, others might not either. IIRC, the digital filter was working fine on the modded channel, but I’ll have to do some more tests now.

I work for a scope company. The fundamental design is the same for the same family of scopes (and indeed, often several families). However, there are a few component changes, typically filters, amplifiers. The BOM cost between the entry level scope might be $400, but sell for $1,000; whereas the high-end version BOM will be $440 and sell for $3,000. You should really try and barter with the manufacture knowing this… and in most cases, they’ll give you a “free” bandwidth upgrade.

I’m not surprised that the original poster has managed to change a 50MHz scope to 100MHz, it is really that easy. However, the calibration at the factory will only have been done to the B/W limit of the badged spec, so the measurements will not be as accurate above 50MHz.

Lastly, Rigol manufacture for Agilent. What you have for $500 with a Rigol badge is the same $1,000 Agilent DS01000 model.

@Don:

I just tried it, and I can confirm what reboots said. I have a TDS3052 with TDS3VID module. I don’t do any video-related work, and some of the features are standard anyway in recent firmware versions, so I tried to replace it with something more useful. The pin-out is here:
http://herzogmuehlweg.de/TDS3UAM/TDS3UAM.html

The author of that page makes a module with four EEPROM’s to have an all-in-one module, I just reprogrammed the module I had. A2 is permanently tied to ground. I tied A0 and A1 to ground, and connected it to a Bus Pirate in I2C mode. Was able to read the EEPROM (it’s 256 bytes, starts with +++ TDS3VID, a clear-text description ‘Advanced Video Application Module’ and some binary stuff). I just modified the TDS3VID to TDS3AAM with single byte writes (I also changed the description to read ‘Advanced Anala Application Module’, but that doesn’t show up anywhere). The scope detects it and enables all TDS3AAM functions, so it seems to work fine. Features like integration, differentiation and statistics are a lot more useful for me than analog video triggers.

The pin-out might be different for other series, but should be easy to figure out, it’s just I2C + power + a few address lines that are permanently attached to either VCC or GND, depending on the slot.

The Hardware hack is not needed, simple software hack is all that is needed now.

Here is the detail for you.

Connect a straight through serial cable to scope and computer.

Open up a terminal program on the PC, set to 9600 baud 8 data bits, no parity,1 stop bit, no flow control, set it to echo back what you type and send only Linefeeds.

to test coms send :IO:TEST testing
it should come back with “testing”

great, now to hack your scope

:INFO:MODEL DS1102E

Now change the serial (X is your own serial Numbers)

:INFO:SERIAL DS1EBXXXXXXXXX

Switch off the scope then back on and auto calibrate from the utils menu.

Job Done, you now have a 100Mhz DS1102E

For those of you with a 1052D to convert to 1102D the previous instructions don’t work. You need to do the following.
Connect Rs232 at same 9600 as in previous message.
Send -
:INFO:MODEL DS1102D(followed by 3xLine feeds)
:INFO:SERIAL DS1EA1xxxxxx(followed by 3xLine feeds)

Switch off and on (If you miss the line feeds things start going crazy)

I actually did a little more than this but I can’t be bothered working out if a it makes a difference (I started with an :INFO:MODEL? 2xline feeds, and at the end pressed RUN/STOP and AUTO).

Has anybody tried the hack with DS1022C?

YAY software hack works for me!
Got it in 6 days, I ordered from dealextreme for 400ish.

Pls, precisely which capacitor have to be desolder?

@reboots, @alm, @willem,

Have you guys considered using a 24C08 instead of a 24C02.In this way you can have one dongle for all four features (or two if you use a 24C04). Seems like this is theoretically possible?

Also, can someone post the hex dump of one of the DPO2xxxx modules so we can see what else is in there? Thanks.