[Ross] is the proud owner of a 50 MHz Rigol DS1052E oscilloscope. He’d like to have the 100 MHz version but the $400 difference in price puts it out of his reach. After some extensive poking around on the PCB and pouring over datasheets, he managed to reverse engineer the design and upgrade to a 100 MHz version. This is as easy as desoldering one capacitor to deactivate a high-pass filter present in the lesser model of scope, unlocking the faster potential of its bigger brother.
that is pretty damn snazzy!
then why does it cost $400 for a few resistors?
because its cheaper to create a single pcb and change parts for each model type. manufacturers do it all the time
Edit: it’s “pored over data sheets” not “poured”.
It costs $400 more because of perceived value. It’s not uncommon for “lesser” models to be the same as a higher end model of a product, with parts omitted, a slower clock, or different software.
Why would you manufacturer two completely different boards, when you can make one, change one part, and sell the lesser one at a discount (or the better one at a price increase, depending on which way you want to look at it).
Back in the olden days, IBM doubled the speed of one of their mainframes by clipping a single wire. And that was a multi-thousand dollar upgrade.
Yes, we did something similar all the time on a communications monitor (shortwave to microwave, man-portable) by entering into a configuration screen and entering a passcode. BOOM! That’s a $5000 dollar upgrade. Pay us now.
Now this, THIS is exactly the type of thing that I think typifies Hack-a-Day. Turning cheap things into expensive/better things is what I fell in love with so many years ago!
That’s simply mega! (hz)
Best get an identical one soon before the manufacturers cotton on to the fact we know how to save $400 with a simple soldering iron.
@poiso: It’s called profit margin
All companies do it but for PR reasons it’s kept discreet.
Damn greedy cheating bastards!
People who do this should be put in jail!
this was long suspected in hobby community, FINALLY it proves to be true, I was waiting for this
Yeah, on the HAAS CNC mills, a lot of the upgrades just require an unlock code. And these are $2000 upgrades!
Frustrates me. I wish someone could hack the things!
-taylor
RJSC, they shouldn’t. It’s a perfectly valid technique, you chose what to buy after all.
When it comes to unlock codes, doesn’t it make sense to recover all that software development time by allowing ‘me’ to sell you upgrades – otherwise I’d have to charge everyone extra.
When it comes to the physical, it might be that the other hardware on the board does not support ‘correct’ operation at the higher sample rates. Although it’s more likely that they are selling at the price the market can sustain.
Shouldn’t that be: “deactivate a low-pass filter”? Current synopsis says: “deactivate a high-pass filter”.
Diagnosing the original circuit presents a problem similar to photographing your only camera. I would expect a money saving shortcut such as this to remain implemented only until the public catches on and they see it cut into their sales index.
@Jack of All Trades: Same
wouldn’t you need to remove a LOW-pass filter in order to get a higher frequency response? high-pass doesn’t make sense…
@Dorkhead: oops, i didn’t see your comment before i posted
“Damn greedy cheating bastards!
People who do this should be put in jail!”
Grow up and enter the real world. If I’m designing a scope like this, I need to make $. The way to make money is to charge a lot of money for your hard work.
Well, how about the guy who really wants your hardware, but can’t afford paying the full amount? Well, we will give them a price cut, but it won’t totally pay for all of the R&D we put into the hardware. Plus, if I give you the same item for less, then EVERYONE will want this great scope for less.
I’ll cut you a deal: I’ll give you the scope, but I’m going to limit it to 50MHz. Don’t like it? Don’t buy it.
Tektronix has a line of scopes that all have the same hardware/firmware. If you want to unlock their full potential, you have to pay extra for little security tabs that unlocks the special features. If it wasn’t for this “trick”, I wouldn’t be able to afford any kind of a scope, especially one that can do full USB, SPI, and UART decoding while doing x y and z.
Reminds me of the ol’ budget Radeon cards, where removing 1 cap and relocating another turned it into a top end behemoth.
These hacks are gold, like an easter egg hunt :D
@Odin84gk
Why hack? because we can. Heres an analogy. My V8 car has an exhaust system that reduces power output slightly. What do I do? Chop it out and replace it with a better system, because the design allows for it.
If manufactures allow this to happen by design, then its Stiff s–t to them. Cry all you like about profit loss, if you base a company on just that then you deserve the nastiest of hacks.
Wouldn’t a company that designs scopes realize their primary customer base are engineers (duh) more reason to pump up some on-chip security or a limiting system (not just high and low pass filters that can be blow off smd style).
Only the manufacturers and retailers will cry.
Customers rejoice!
From what I could tell in the forum thread the hack was still being tested, some signal ghosting apparent. Any confirmation?
It’s called market segmentation, virtually everyone does it. I bought more than one Nvidia GeForce card that with a minimal amount of soldering was easily transformed into the higher-end Quadro and much more expensive variant.
This same thing applies to CPUs from Intel and AMD. All the chips in a series are more or less exactly the same. Granted due to incredibly small differences some chips are able to run faster than others but as the manufacturing process is perfected more and more are able to run at the top speeds. This is the reason companies introduced multiplier locks, it makes overclocking a much coarser grain game.
Welcome to the “free market”, enjoy your stay.
The signal ghosting was from testing the channels in parallel without isolation. Normally a 50 ohm terminator is used at the end of each BNC cable when coming off of a single signal source, I didn’t know that when I constructed my home-made cables. When testing with probes, that doesn’t happen as much. I think there’s really no way around that because I’m essentially testing the scopes response using itself.
My concern is that there may still yet be some filter somewhere on the underside of the board, because another person with a 100 MHz model found the same filter on his board. There are two vias travelling to unknown locations, however, which may enable/disable the filter by some command. If there is another filter, it’s curious that the bandwidth response seems to be exactly what it would be in a 100 MHz scope already.
The internal model number may be changed with NI VISA commands and the firmware for the Mixed-signal version (also identical hardware) is out in the wild too. More on that to come, after I graduate probably!
I have one of those scopes sitting on my desk, most tempting.
Guess what? Those expensive Tektronix feature dongles contain nothing more than a 24C02 serial eeprom. The eeprom contains a simple hex string with the name of the feature. For example, this is the string for the DPO4VID HDTV triggering module:
ff ff ff ff 44 50 4f 34 56 49 44 00 ff ff ff ff
Substitute DPO4AUTO, DPO4COMP, or DPO4EMBD for fun and profit. Tested with Tek DPO4000 scopes.
It would be funny if someone who doesn’t know about this unintentionally drops it or something, knocking the cap out of the pcb. When they go to use it again, they realize that it can go up to 100mhz.
Too bad my 30+ y/o Tektronix can’t be “upgraded” this easily.
This is kind of like demo software that can be patched to unlock full functionality. Release teams call ones with the actual code removed ‘true-demos’. Making a ‘true-demo’ or streaming content with SID salted crypto marginally reduces the likelihood your software will be pirated via reversing. Same applies to hardware logic.
We ran in to this way back in the 1980’s; a positive only programmable power supply cost hundreds more with an extra relay (and a DIP switch setting) to make it go positive & negative. We were told it would be against the law to modify it ourselves, so we paid the extra.
This site needs a new category for hacks like this, something like Get Cheap Stuff and Hack It to Awesomeness. Of course, feel free to come up with a better name.
@AlmostThere
“We were told it would be against the law to modify it ourselves, so we paid the extra.”
You seriously bought that?
@Jack Sprat
How about:
From Norm to Awesome ?
The term for this is price discrimination, and it’s perfectly legal. They charge the people who are willing to pay more an extra $400 and still get some profit from the people who aren’t. Realistically, not enough people will hack their scopes to change this dynamic at all. The people who hack for the $400 upgrade weren’t really willing to pay up in the first place, so they don’t actually lose anything.
Personally, measurement tools are the one thing in my shop I won’t hack. It’s more important for me to be able to really trust the output than to save a few bucks. Unreliable measurement tools can cost you a hell of a lot more than $400 in lost time and components.
anon;
>You seriously bought that?
I didn’t, my company did.
Interesting how your paying $400 for the uncrippled version of the same hardware. lol
When you buy “features” you also buy support for those features and some sort of warranty that they work according to the terms agreed during the purchase… so yeah, you can get that feature by fiddling with bits in an eeprom or moving some jumpers around; All that is actually beside the point.
In the scope situation.. yeah you can move jumpers around and make your 50mhz scope into a 100mhz scope. You have no come back if it turns out the ADCs etc in your scope can’t actually handle sampling at that rate.
You get what you pay for.
@Adam
“Welcome to the “free market”, enjoy your stay.”
Here we go – bitch and moan about the free market.
Yes, it is the free market – Rigol is free to manufacture whatever they like, however they like and charge whatever they like for their products, and you’re free to buy it or not. Get over it.
The ADCs are identical in both versions, as are all of the other chips (so far as I can tell). The sampling rate is the same for both versions too, that’s what tipped everyone off that the front-end could probably be hacked.
In an oscilloscope of all things. I can see if you have extra features on a TV, and shorting a couple points unlocks the expensive features, but on a scope? Everyone that uses a scope has some at least minor electronics experience, and would be able to pull this off. It’s just funny.
Cool, time to hit up DX to get this baby: http://www.dealextreme.com/details.dx/sku.30573
@pwsome
“@Adam
“Welcome to the “free market”, enjoy your stay.”
Here we go – bitch and moan about the free market.
Yes, it is the free market – Rigol is free to manufacture whatever they like, however they like and charge whatever they like for their products, and you’re free to buy it or not. Get over it.”
You mean buy it and hack it or not.
I seem to recall Intel Celeron chips having a math feature deactivated and with a pretty simple fix the chip could be upgraded.
Any of you higher qualified people remember that??
Great post/hack, but I would recommend against following the procedure until he’s verified the actual difference between the two versions.
@Kristian
@Dorkhead
BTW, it is a high-pass filter. Read the post, there is a schematic. The high-pass filter is located between the hi/lo outputs of an amplifier, rather than a low-pass filter between the amplifier and the output.
@jproach
The difference isn’t verified, that’s true.. but if you read the post you will see that someone with the 100 MHz version didn’t notice any apparently harmful difference, while I see very noticeable bandwidth gains proportionate to what they should be if the unit is now operating at 100 MHz. They’re graphed, but ignore the second time I tried that as I didn’t use proper cabling. Either way, the filter is in a place where it won’t affect the scopes operation, unless you can explain otherwise. It’s right between the ADC buffer and the amplifier.. the ADC in an oscilloscope has no reason to see a filtered signal that I know of.
I hope someone tries this and plots the output to a 200 MHz scope, as someone at the EEVBlog forums has already done this and plotted the 50 MHz scope output. The two could be compared and it would be the final verification of the hack, IMO.
If it turns out to be a bad hack, it’s easy enough to replace the capacitors.
Perfect timing! I got the 50Mhz Rigol yesterday.
i don’t think the story is over yet–but this is a good start to hacking this guy. i’ve been waiting for someone to start work on this for a while.
this practice is done everywhere, and really it’s completely fair. it’s just that most people find it difficult to grasp that they’re not only paying for the physical product they buy. with all the software pirating these days and low cost products from china, it’s even harder for people to remember that it costs money to design things.
look at intel cpus, for example. Or any cpus. the same family is often the exact same die, with some resistor/fuse set. of course, it’s a bit difference here, because of the variance in maximum speed among dies, and each processor is tested for maximum speed. but the same principle holds–you are not directly paying for the price of hardware.
What a great hack!
It give me again two reasons: 1)blame myself for buying pc based scope long time ago and getting 1/10 of rigol abilities spending almost twice 2)get rigol
any one want to buy bitscope BS310N & logic POD add-on for half price ? :D