50MHz To 100Mhz Scope Conversion

[Ross] is the proud owner of a 50 MHz Rigol DS1052E oscilloscope. He’d like to have the 100 MHz version but the $400 difference in price puts it out of his reach. After some extensive poking around on the PCB and pouring over datasheets, he managed to reverse engineer the design and upgrade to a 100 MHz version. This is as easy as desoldering one capacitor to deactivate a high-pass filter present in the lesser model of scope, unlocking the faster potential of its bigger brother.

96 thoughts on “50MHz To 100Mhz Scope Conversion

  1. It costs $400 more because of perceived value. It’s not uncommon for “lesser” models to be the same as a higher end model of a product, with parts omitted, a slower clock, or different software.

    Why would you manufacturer two completely different boards, when you can make one, change one part, and sell the lesser one at a discount (or the better one at a price increase, depending on which way you want to look at it).

    Back in the olden days, IBM doubled the speed of one of their mainframes by clipping a single wire. And that was a multi-thousand dollar upgrade.

  2. Yes, we did something similar all the time on a communications monitor (shortwave to microwave, man-portable) by entering into a configuration screen and entering a passcode. BOOM! That’s a $5000 dollar upgrade. Pay us now.

  3. Yeah, on the HAAS CNC mills, a lot of the upgrades just require an unlock code. And these are $2000 upgrades!

    Frustrates me. I wish someone could hack the things!

  4. When it comes to unlock codes, doesn’t it make sense to recover all that software development time by allowing ‘me’ to sell you upgrades – otherwise I’d have to charge everyone extra.

    When it comes to the physical, it might be that the other hardware on the board does not support ‘correct’ operation at the higher sample rates. Although it’s more likely that they are selling at the price the market can sustain.

  5. Diagnosing the original circuit presents a problem similar to photographing your only camera. I would expect a money saving shortcut such as this to remain implemented only until the public catches on and they see it cut into their sales index.

    @Jack of All Trades: Same

  6. “Damn greedy cheating bastards!
    People who do this should be put in jail!”

    Grow up and enter the real world. If I’m designing a scope like this, I need to make $. The way to make money is to charge a lot of money for your hard work.

    Well, how about the guy who really wants your hardware, but can’t afford paying the full amount? Well, we will give them a price cut, but it won’t totally pay for all of the R&D we put into the hardware. Plus, if I give you the same item for less, then EVERYONE will want this great scope for less.

    I’ll cut you a deal: I’ll give you the scope, but I’m going to limit it to 50MHz. Don’t like it? Don’t buy it.

    Tektronix has a line of scopes that all have the same hardware/firmware. If you want to unlock their full potential, you have to pay extra for little security tabs that unlocks the special features. If it wasn’t for this “trick”, I wouldn’t be able to afford any kind of a scope, especially one that can do full USB, SPI, and UART decoding while doing x y and z.

  7. Reminds me of the ol’ budget Radeon cards, where removing 1 cap and relocating another turned it into a top end behemoth.
    These hacks are gold, like an easter egg hunt :D

  8. @Odin84gk
    Why hack? because we can. Heres an analogy. My V8 car has an exhaust system that reduces power output slightly. What do I do? Chop it out and replace it with a better system, because the design allows for it.

    If manufactures allow this to happen by design, then its Stiff s–t to them. Cry all you like about profit loss, if you base a company on just that then you deserve the nastiest of hacks.

    Wouldn’t a company that designs scopes realize their primary customer base are engineers (duh) more reason to pump up some on-chip security or a limiting system (not just high and low pass filters that can be blow off smd style).

    Only the manufacturers and retailers will cry.
    Customers rejoice!

  9. It’s called market segmentation, virtually everyone does it. I bought more than one Nvidia GeForce card that with a minimal amount of soldering was easily transformed into the higher-end Quadro and much more expensive variant.

    This same thing applies to CPUs from Intel and AMD. All the chips in a series are more or less exactly the same. Granted due to incredibly small differences some chips are able to run faster than others but as the manufacturing process is perfected more and more are able to run at the top speeds. This is the reason companies introduced multiplier locks, it makes overclocking a much coarser grain game.

    Welcome to the “free market”, enjoy your stay.

  10. The signal ghosting was from testing the channels in parallel without isolation. Normally a 50 ohm terminator is used at the end of each BNC cable when coming off of a single signal source, I didn’t know that when I constructed my home-made cables. When testing with probes, that doesn’t happen as much. I think there’s really no way around that because I’m essentially testing the scopes response using itself.

    My concern is that there may still yet be some filter somewhere on the underside of the board, because another person with a 100 MHz model found the same filter on his board. There are two vias travelling to unknown locations, however, which may enable/disable the filter by some command. If there is another filter, it’s curious that the bandwidth response seems to be exactly what it would be in a 100 MHz scope already.

    The internal model number may be changed with NI VISA commands and the firmware for the Mixed-signal version (also identical hardware) is out in the wild too. More on that to come, after I graduate probably!

  11. Guess what? Those expensive Tektronix feature dongles contain nothing more than a 24C02 serial eeprom. The eeprom contains a simple hex string with the name of the feature. For example, this is the string for the DPO4VID HDTV triggering module:

    ff ff ff ff 44 50 4f 34 56 49 44 00 ff ff ff ff

    Substitute DPO4AUTO, DPO4COMP, or DPO4EMBD for fun and profit. Tested with Tek DPO4000 scopes.

  12. It would be funny if someone who doesn’t know about this unintentionally drops it or something, knocking the cap out of the pcb. When they go to use it again, they realize that it can go up to 100mhz.

  13. This is kind of like demo software that can be patched to unlock full functionality. Release teams call ones with the actual code removed ‘true-demos’. Making a ‘true-demo’ or streaming content with SID salted crypto marginally reduces the likelihood your software will be pirated via reversing. Same applies to hardware logic.

  14. We ran in to this way back in the 1980’s; a positive only programmable power supply cost hundreds more with an extra relay (and a DIP switch setting) to make it go positive & negative. We were told it would be against the law to modify it ourselves, so we paid the extra.

  15. The term for this is price discrimination, and it’s perfectly legal. They charge the people who are willing to pay more an extra $400 and still get some profit from the people who aren’t. Realistically, not enough people will hack their scopes to change this dynamic at all. The people who hack for the $400 upgrade weren’t really willing to pay up in the first place, so they don’t actually lose anything.

    Personally, measurement tools are the one thing in my shop I won’t hack. It’s more important for me to be able to really trust the output than to save a few bucks. Unreliable measurement tools can cost you a hell of a lot more than $400 in lost time and components.

  16. When you buy “features” you also buy support for those features and some sort of warranty that they work according to the terms agreed during the purchase… so yeah, you can get that feature by fiddling with bits in an eeprom or moving some jumpers around; All that is actually beside the point.

    In the scope situation.. yeah you can move jumpers around and make your 50mhz scope into a 100mhz scope. You have no come back if it turns out the ADCs etc in your scope can’t actually handle sampling at that rate.

    You get what you pay for.

  17. @Adam
    “Welcome to the “free market”, enjoy your stay.”

    Here we go – bitch and moan about the free market.

    Yes, it is the free market – Rigol is free to manufacture whatever they like, however they like and charge whatever they like for their products, and you’re free to buy it or not. Get over it.

  18. The ADCs are identical in both versions, as are all of the other chips (so far as I can tell). The sampling rate is the same for both versions too, that’s what tipped everyone off that the front-end could probably be hacked.

  19. In an oscilloscope of all things. I can see if you have extra features on a TV, and shorting a couple points unlocks the expensive features, but on a scope? Everyone that uses a scope has some at least minor electronics experience, and would be able to pull this off. It’s just funny.

  20. @pwsome
    “Welcome to the “free market”, enjoy your stay.”

    Here we go – bitch and moan about the free market.

    Yes, it is the free market – Rigol is free to manufacture whatever they like, however they like and charge whatever they like for their products, and you’re free to buy it or not. Get over it.”

    You mean buy it and hack it or not.

  21. I seem to recall Intel Celeron chips having a math feature deactivated and with a pretty simple fix the chip could be upgraded.
    Any of you higher qualified people remember that??

  22. @Kristian
    BTW, it is a high-pass filter. Read the post, there is a schematic. The high-pass filter is located between the hi/lo outputs of an amplifier, rather than a low-pass filter between the amplifier and the output.

  23. @jproach
    The difference isn’t verified, that’s true.. but if you read the post you will see that someone with the 100 MHz version didn’t notice any apparently harmful difference, while I see very noticeable bandwidth gains proportionate to what they should be if the unit is now operating at 100 MHz. They’re graphed, but ignore the second time I tried that as I didn’t use proper cabling. Either way, the filter is in a place where it won’t affect the scopes operation, unless you can explain otherwise. It’s right between the ADC buffer and the amplifier.. the ADC in an oscilloscope has no reason to see a filtered signal that I know of.

    I hope someone tries this and plots the output to a 200 MHz scope, as someone at the EEVBlog forums has already done this and plotted the 50 MHz scope output. The two could be compared and it would be the final verification of the hack, IMO.

    If it turns out to be a bad hack, it’s easy enough to replace the capacitors.

  24. i don’t think the story is over yet–but this is a good start to hacking this guy. i’ve been waiting for someone to start work on this for a while.

    this practice is done everywhere, and really it’s completely fair. it’s just that most people find it difficult to grasp that they’re not only paying for the physical product they buy. with all the software pirating these days and low cost products from china, it’s even harder for people to remember that it costs money to design things.

    look at intel cpus, for example. Or any cpus. the same family is often the exact same die, with some resistor/fuse set. of course, it’s a bit difference here, because of the variance in maximum speed among dies, and each processor is tested for maximum speed. but the same principle holds–you are not directly paying for the price of hardware.

  25. It give me again two reasons: 1)blame myself for buying pc based scope long time ago and getting 1/10 of rigol abilities spending almost twice 2)get rigol

    any one want to buy bitscope BS310N & logic POD add-on for half price ? :D

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.