[Ross] is the proud owner of a 50 MHz Rigol DS1052E oscilloscope. He’d like to have the 100 MHz version but the $400 difference in price puts it out of his reach. After some extensive poking around on the PCB and pouring over datasheets, he managed to reverse engineer the design and upgrade to a 100 MHz version. This is as easy as desoldering one capacitor to deactivate a high-pass filter present in the lesser model of scope, unlocking the faster potential of its bigger brother.
By the way there is rumors that Rigol DS1052E only 250-300$ on Chinese ebay-like site but you have to do all manually by contacting seller who agree to send it to us. Anyone have experience with taobao.com ?
@therian
I considered that, but there are Rigol knock-offs also, with the same face and everything. Careful.
@ross
If it’s an almost-indistinguishable knockoff then it’s probably made in the same exact factory as the “official” version. It’s probably just as good, too.
Mobile Phone RF testers…
They have lots of options…
To upgrade you get a quote, after giving the S/N – the dealer passes the info to the Manufacture, and they list the Hardware changes needed (if any)…
If Hardware is require – the unit is sent back and returned upgraded…
If no Hardware is require – you run a upgrade utility and enter a unlock code – which is locked to the serial number of the tester…
Depending on what is requires the upgrade can cost up to £30,000… (This on test equipment costing from £20,000!)
Just another proof that our economic system that worked acceptably with solid goods in the past is totally incompatible with the cost reduction brought by the digital age.
As for that scope… damnit! I was going to buy it a few months ago then David at eevblog gave his enthusiastic review and the price went up everywhere, and now this hack makes it even more appealing. Let’s hope in a few months it won’t end up costing like a Tek.
If the company can turn a profit on both models, and both are technically the same (minus 40c worth of components) Then that additional $400 is sweet cream on the cake for the companies bottom line.
Providing you dont circumvent a copyright mechanism in the device, its open slather (sic).
333 m
“This site needs a new category for hacks like this, something like Get Cheap Stuff and Hack It to Awesomeness. Of course, feel free to come up with a better name.”
This site already has a name for hacks like this, I would suggest names for the other sorts of “hacks”. I think this is why they now have how-tos and reviews etc.
@Buzz Bannister
>I seem to recall Intel Celeron
>chips having a math feature deactivated
Every vendor has done this since integration got the level that there was enough stuff on a single chip that even if some parts don’t work it has value. I.e. Motorola used to sell cheap “EC” 68030 parts that “didn’t have an MMU” but a good percentage of those chips have an MMU and it works. If bought a batch of those chips and used them in a product that required a working MMU you wouldn’t have a leg to stand on if it turned out the batch of parts you got all had duff MMU’s though.
The opposite also happens.. there a plenty of products with devices running overclocked or otherwise overrated.
@ross
There should be an anti-aliasing filter between the signal source and ADC. An impedance matching filter may be needed to, but could also be lumped into the anti-aliasing filter.
Excellent timing indeed. My Rigol DS1052 (from DX) is on its way to me as I type! Very tempting hack. I’ll wait until it’s been verified, and if all goes well I’ll try it myself.
The whole support and compatibility argument to this is irrelevant. It’s the same circuit with trivial differences in one block. This is just an example of enhanced profit margin.
If there was noteworthy affect on other components I could see the whole company-Bob type argument. Even then though the manufacturing cost is still well below selling price per unit.
You think a $150 MATX board for a PC costs $60 to manufacture per unit?
@ross
When both channels modified do they show in phase ?
@SparcMX
I was not degrading the quality of this hack. I was trying to tell RJSC that price segregation was a legit tactic to maximize profit yet help the people with less money.
As several people have pointed out- I’m not willing to risk the calibration of my scope. It’s the one instrument I need to be able to rely on.
@ross: I realize the scope has the same ADC’s and other components- but it could be that they teted the board and it didn’t meet specs so they derated it. As cantido pointed out- this happens all the time.
@reboots: Any more information on hacking those DPO4k modules? Now I’m curious what’s in them and how they’re pinned out.
@therian
I haven’t modified both channels. I’ve left the other alone for testing.
The phase difference is restricted to two regions, if you look at my graph that I made immediately after the hack you’ll see spikes at 20 MHz and 65 MHz. That’s where the Butterworth filter edges are apparent about the cutoff frequency. When I move away from those areas in frequency the phase locks back into place.
@Don
The calibration is fine, I have tested the two channels against one another. If you look at the first test data I took with unmodified vs. modified according to frequency, you’ll see they stay pretty much the same until approaching 50 MHz and about the two points I mention above. After that, it’s a little up in the air until another scope is used to verify, but it clearly hasn’t made it worse. It’s only eight bits of resolution anyhow, any discrepancies you see in the data can easily be explained by that alone.
The test data I took was verified against test data someone else took of a 50 MHz Rigol scope vs. a 200 MHz Tektronix. If you look at his curves linked in my posts, you can see he has roughly the same measurements I do, which is why I took them in the first place, to verify against his data. My data isn’t as clean, I only took every 2 MHz or so, but it still seems legit to me.
@Don
I have no more information on the DPO modules. I haven’t handled them myself. However, I don’t believe there’s anything beside the serial eeprom. With pictures of the PCB, it should be trivial to build a “dock” to reprogram the dongles–or make your own from scratch.
Dell also used a “key” with a serial eeprom to enable expensive RAID features on certain disk array chassis. These keys were widely counterfeited for commercial purposes and are probably still available via eBay. Details here:
http://www.g-cipher.net/~resin/dp/
Nice – now it goes “up to eleven”! http://en.wikipedia.org/wiki/Up_to_eleven :) :)
The question here is whether this is, actually, a case of the manufacturer artificially handicapping the hardware or whether the 50mhz model of the unit serves as a way for the manufacturer to sell units that failed their QA test at, the more stressful, 100mhz but worked just fine at 50mhz. Companies like Intel, AMD, nVidia, and ATI do this all the time, especially at the beginning of a new product line where semiconductor yields aren’t as good as they can be (though they also, often, continue to handicap perfectly good chips later on in order to produce profitable market tiering). It’s possible that the “ghosting” that some of these mod-ers are seeing is the result of units that failed to pass muster as 100mhz units when they came off the manufacturing line (whether it’s due to a slightly sub-par solder joint/IC somewhere in the circuitry or something else).
Using the same PCB for various models is pretty common because there’s almost no price difference between a complicated board and a simple one. High quality, low error components can get stupid expensive, though. I’m not even talking ICs – 0.1% and lower caps and resistors can be a hundred times more expensive than the lower tolerance version. Maybe they cheaped out on components?
Not that it’s a bad hack, but like was said above, I want to trust the calibration of my tools.
I was sifting through this thread to see if anyone had made the obvious and yet most important observation here. And no one had — until the last post. I couldn’t agree more with colecoman.
RF devices are very finicky. My company outsources our PCB manufacture and assembly, but tests and repairs each module in-house to make sure it meets spec. After R&D, testing is BY FAR the most expensive part of producing our products.
For the company that makes this scope, guaranteeing proper functionality at all frequencies up to 100MHz is undoubtedly more expensive than guaranteeing only half of that. That’s why you have to pay more for the 100MHz version.
This hack is really neat, but any results you get for signals over 50MHz will have to be presented with an asterisk: “Figures may not be accurate to the o-scope datasheet tolerances.” In fact, once you’ve touched a soldering iron to the scope’s PCB, you could argue that the asterisk would apply for all results.
hmm… wonder how many other ‘scopes can be hacked in this way.
The Tek ones are bulletproof FWIW, if you are able to buy one at auction get it.
the main headache here would be if results were unreliable (running outside specs could cause unwanted glitches same as overclocking)
still, if it saves $400 in a hobbyist application its worth it.
This is what I was afraid to be since it reminded diode switching filter
”
Hello everybody.
I am new to the forum – but I think I have to correct a few things here…
The circuit between pins 8 and 9 and the ADC amp indeed limits the bandwidth to about 20MHz – when you activate the “BW limit” from the channel menu!
When you take a close look on the part in the middle (D1), you see a small grey bar on the right hand side – as this is neither a cap nor a coil, but a diode, supposedly a varactor diode! And the parts at the upper and lower end of the “filter” are no caps either, they are simple resistors (R1 and R2). R1 goes to ground, R2 is HF-shunted to ground via C3. The control signal comes from somewhere via R3 and biases the diode.
The series circuit of C1, C2 and D1 is a small condenser in the range of well below 1pF to some pF – depending on the control voltage and thus the capacitance of D1.
When you remove C1 you do not only remove this serial capacitance that limits the bandwidth in any case (at any value of the control voltage) – but you also disable the BW Limit function from the menu altogether!
Btw., when you look at the real circuit, it now is obvious, that after removing C1 a removal of C2 doesn’t change anything more…
Andreas
“
Hmmmmm…
(begins to eye his TDS2002B)…..
hmmmmmm i wonder…..
@ross: I’m sure the calibration is probably fine. The problem is you’ve only checked your readings using a _very_ limited sample set. What happens at different temperature and different waveforms. Are there now waveforms that might introduce ringing in the filters or something else that’s hard to track down?
In my case the scope I’m using is an MSO 4054. It’s just too expensive to experiment with and risk a loss of accuracy or warranty even if it got me another 500MHz.
@reboots: Thanks- I have a couple of modules in my scope and now I’m curious. I don’t actually need any other modules but it would be amusing to experiment.
@Don
The warranty is worthless to me, because I purchased it from a Chinese reseller (Dealextreme) I don’t expect I could get any support. Rigol is upfront about not supporting Chinese imported products, because of the price difference. Even beyond that, the warranty only covers the very limited scope of manufacturing defects, which are such a statistical anomaly that I wasn’t worried about that either. If something electronic works out of the box, under most circumstances it’s going to continue to work indefinitely.
Beside that, the C model scopes previous to this had bad logic analyser issues that were never fixed under warranty, so I don’t expect much in that department even if something were to go wrong.
It’s all in good fun anyway, apparently there is more to this than it seemed to me after all, considering the latest forum post. All I have to do to repair the hack if I choose is solder the caps back on.
Anyhow, I understand completely why some people wouldn’t mess with their scopes, I just don’t see any harm in doing a few well-tested mods myself, for my purposes. Even if the BW limit is disabled, I won’t care if it gives me increased bandwidth overall, others might not either. IIRC, the digital filter was working fine on the modded channel, but I’ll have to do some more tests now.
@ross:
Oh I totally understand- if you can increase your bandwidth and performance- why not?
In my case I do a lot of higher frequency work and the margin for error gets a lot smaller when you’re working with a 500MHz signal. Add to that a crazy price tag and Tektronix’s awesome warranty and it’s definitely not something I would risk with my scope.
I work for a scope company. The fundamental design is the same for the same family of scopes (and indeed, often several families). However, there are a few component changes, typically filters, amplifiers. The BOM cost between the entry level scope might be $400, but sell for $1,000; whereas the high-end version BOM will be $440 and sell for $3,000. You should really try and barter with the manufacture knowing this… and in most cases, they’ll give you a “free” bandwidth upgrade.
I’m not surprised that the original poster has managed to change a 50MHz scope to 100MHz, it is really that easy. However, the calibration at the factory will only have been done to the B/W limit of the badged spec, so the measurements will not be as accurate above 50MHz.
Lastly, Rigol manufacture for Agilent. What you have for $500 with a Rigol badge is the same $1,000 Agilent DS01000 model.
DAM YOU HaD! for 2 days I was unable to study sleep or think knowing this information, I just had to get it, and now all my weed and booz savings for summer are gone.
@Don:
I just tried it, and I can confirm what reboots said. I have a TDS3052 with TDS3VID module. I don’t do any video-related work, and some of the features are standard anyway in recent firmware versions, so I tried to replace it with something more useful. The pin-out is here:
http://herzogmuehlweg.de/TDS3UAM/TDS3UAM.html
The author of that page makes a module with four EEPROM’s to have an all-in-one module, I just reprogrammed the module I had. A2 is permanently tied to ground. I tied A0 and A1 to ground, and connected it to a Bus Pirate in I2C mode. Was able to read the EEPROM (it’s 256 bytes, starts with +++ TDS3VID, a clear-text description ‘Advanced Video Application Module’ and some binary stuff). I just modified the TDS3VID to TDS3AAM with single byte writes (I also changed the description to read ‘Advanced Anala Application Module’, but that doesn’t show up anywhere). The scope detects it and enables all TDS3AAM functions, so it seems to work fine. Features like integration, differentiation and statistics are a lot more useful for me than analog video triggers.
The pin-out might be different for other series, but should be easy to figure out, it’s just I2C + power + a few address lines that are permanently attached to either VCC or GND, depending on the slot.
Check the thread, it’s been updated and you can do this with a software hack opposed to having to open the thing up.
The Hardware hack is not needed, simple software hack is all that is needed now.
Here is the detail for you.
Connect a straight through serial cable to scope and computer.
Open up a terminal program on the PC, set to 9600 baud 8 data bits, no parity,1 stop bit, no flow control, set it to echo back what you type and send only Linefeeds.
to test coms send :IO:TEST testing
it should come back with “testing”
great, now to hack your scope
:INFO:MODEL DS1102E
Now change the serial (X is your own serial Numbers)
:INFO:SERIAL DS1EBXXXXXXXXX
Switch off the scope then back on and auto calibrate from the utils menu.
Job Done, you now have a 100Mhz DS1102E
Forgot to add that you can check that the update worked by going to utils menu and checking the system info. Also you can leave the scope on the system info screen as you do the update, and you can see your progress as you do the update. ie you can see the model number and the serial change.
you can also check it but seeing that the time base now goes down to 2ns not 5ns as in the 50Mhz scope
For those of you with a 1052D to convert to 1102D the previous instructions don’t work. You need to do the following.
Connect Rs232 at same 9600 as in previous message.
Send –
:INFO:MODEL DS1102D(followed by 3xLine feeds)
:INFO:SERIAL DS1EA1xxxxxx(followed by 3xLine feeds)
Switch off and on (If you miss the line feeds things start going crazy)
I actually did a little more than this but I can’t be bothered working out if a it makes a difference (I started with an :INFO:MODEL? 2xline feeds, and at the end pressed RUN/STOP and AUTO).
btw, you shouldn’t be doing this to your scope as it’ll probably break.
Has anybody tried the hack with DS1022C?
Don’t do the hack. It broke my scope, all adcs dead.
YAY software hack works for me!
Got it in 6 days, I ordered from dealextreme for 400ish.
please help! i’ve an overdone/stupid upgrade 1052e to 1102d resulting in vertical system error. pls goto
http://www.rcgroups.com/forums/showthread.php?t=1222045
for more details. plssssssss, fellows EEs gurus here, plssss help!
Pls, precisely which capacitor have to be desolder?
@reboots and @alm
I own a tektronix dpo2014.
So a made also a module stick but it doesn’t work.
@roboots: are you sure the DPO4VID HDTV triggering module string is:
ff ff ff ff 44 50 4f 34 56 49 44 00 ff ff ff ff ?
My modules are named DPO2COMP, DPO2EMBD, etc.
The problem is dat your string is exactly 16 bytes and mine 17 bytes.
I programmed the following string beginning at eeprom adress 0: ff ff ff ff 44 50 4f 32 45 4d 42 44 00 ff ff ff ff
It is 17 bytes and contains the module name DPO2EMBD.
I’m wondering if the Null byte after the module name is needed and from where your string is programmed in the chip?
Centered inside the first memory page?
@reboots, @alm, @willem,
Have you guys considered using a 24C08 instead of a 24C02.In this way you can have one dongle for all four features (or two if you use a 24C04). Seems like this is theoretically possible?
Also, can someone post the hex dump of one of the DPO2xxxx modules so we can see what else is in there? Thanks.
Hello, I own a DS1022CD, did anybody know a hack for this DSO?
regards
Marc
I have been looking it but I don´t know which capacitor exactly have to be desoldered in order to get to higher version. Could you please show me which one is it?