Hacking the HDO1k/HDO4k Rigol 12 bit scope

[2N3055]

If you can write off the tax and get it at a sale, and two at once, might be even around 1000€ for both. You get all the parts to populate all 4 channels. Even the necessary extra buttons, tho marked differently. The front panel might already have the cutouts but have different sticker on front, so maybe only needed to cut that. You get the extra two full frontends including the connectors and extra ADC. 12bit 400MHz and 2GSa/s is pretty nice especially if you get them cheaper.
You're still left with a spare FPGA which is worth around 150$ presuming you have the gear to safely recover it. Plus a spare power supply and various parts like regulator chips. The display could also be sold/kept as spare. Sure this wouldn't be for your average hobbyist adventurist. But at least interesting as an option.

1000 for both? You're need to calibrate your optimism.... Tax write off in USA ?
People who have gear and knowledge to do all that won't be doing it.
I will gladly pay for HDO4000 not to waste my time doing it. And have warranty.

Like I said, I have no doubt some daredevils with enough money and time willing to risk damage and giving up any warranty on 2 brand new scopes (that at his point we don't even know how good this first batch is, or there will be manufacturer corrections to it) will do it for bragging rights.

You will get a thing that has no calibration from factory for ADC you added. Reliability will be directly connected to thermal damage done while doing "surgery". Only reason to do it is bragging rights. I for sure wouldn't trust that scope with any critical measurement. And I do trust both Rigol and Siglent on their equipment doing a good job.

Words "bang for a buck" are good if you actually use the thing to the "full bang".
Most people would be greatly served with 200 MHz 12 bit scope with large touchscreen for very little money . Which HDO1000 is once you license it up and that is all that is needed for many.

Don't get me wrong, I don't mind if anybody does the "Frankenscope"(TM), I'm not against it.
But make sure to know that what you get by doing software unlock of HDO1000 still gives you fully calibrated scope with full warranty that is guaranteed to work.

Doing a "Frankenscope" will NOT get you same type of equivalent of HDO4000, but an experimental device that you don't know how well it works, how long it will work,  no warranty, and you cannot sell it as HDO4000. In fact I wouldn't buy it as a HDO1000. Most I would be prepared to pay for it would be "for parts". So few hundred bucks and it works as it works, if it does at all... Resale value is a thing. I remember years ago I sold my DS1000Z for good fraction of what I paid for it after using it for few years.
That is all.

But by all means have fun... It is much better than giving 4000 USD for "organically cristal aligned copper speaker cables"... And you do get to learn something from it one way or another.

But for 99.99% of people it is expensive high risk sport. They might get cheapest HDO1000 and unlock licenses like with DS100Z (if it proves that easy) and get a 200 MHz 12bit scope for not much money, full warranty and stuff. And that is quite something, believe you me... And if Rigol wakes up and stabilizes the platform it might even be a nice scope...

[bob808]

As far as the active probe circuitry goes it would be interesting to see if the HDO1000 series has that long pcb along the connectors. If it has it then most likely it's the same part as on the HDO4000 series but with the connections covered by the sicker that's over them. On the HDO4000 series teardown photo that sticker can be seen, black, and has cutouts for the PCB pads (first photo). If that PCB is on the HDO1000 series then there's good chances you could rebuild the circuitry.
You'd need the missing connectors/flat cable/second cable + actives/passives.
On the second photo there's three switching regulators for three different rails and two SOIC8 mosfets (circled in red). Can't see the part numbers in the photo but they should all be off the shelf parts. Knowing the voltage rails it could be easy to work out the values for all parts involved. On the backside of this area (third photo) there's two diodes, three 7004 mosfets possibly for enabling each regulator. The rest seem like bypass caps and few inductors.
On the lower part of the oscilloscope's PCB (fourth photo) there's the datalines. On the HDO1000 series the level shifters circled in red are already populated. Cicled in yellow is most likely a TLC274 quad opamp (markings match), and the only (bit harder) thing to figure out is the stuff circled in violet. If someone could work out the BOM it could be easy to retrofit even for less adventurous hobbyists. I don't see any of these parts being challenging to solder. The BOM cost is surely worth it if you need/want the active probe stuff. Presuming it can be software activated.
Also as a bonus you could install the third USB connector if there's a way for the cutout. The protection diodes are already populated and the traces go to the same chip so should theoretically work.

[tv84]

Words "bang for a buck" are good if you actually use the thing to the "full bang".

Wise words, rarely remembered.

[Fungus]

If you can write off the tax and get it at a sale, and two at once, might be even around 1000€ for both.

1000 for both? You're need to calibrate your optimism....

And starting with two, 2-channel models is another can of worms. Are you going to drill the case and add BNCs, too? How much will be missing from the PCB for the other two channels?

The minimum starting point would be a 4-channel and a 2-channel, and you ain't going to get those for 1000 EUR.

But at least interesting as an option.

Fun to imagine, but I don't think many people will try it in practice.

[bob808]

Doing a "Frankenscope" will NOT get you same type of equivalent of HDO4000, but an experimental device that you don't know how well it works, how long it will work,  no warranty, and you cannot sell it as HDO4000. In fact I wouldn't buy it as a HDO1000.

You do make valid point from certain points of view, but this is the hacking thread, we're talking options.

And starting with two, 2-channel models is another can of worms. Are you going to drill the case and add BNCs, too? How much will be missing from the PCB for the other two channels?

The HDO4000 in the teardown has the case cutout for the mixed signal stuff yet no version has it installed. I don't think they made two versions for that case, especially since there's two and four channel versions for HDO1000 series. The only thing to cut (my best guess) are the stickers covering the front panel.

[Fungus]

The HDO4000 in the teardown has the case cutout for the mixed signal stuff yet no version has it installed. I don't think they made two versions for that case, especially since there's two and four channel versions for HDO1000 series. The only thing to cut (my best guess) is that only the stickers covering the front panel need to be cut.

OK, but there's probably only two front-ends populated on the PCB and that fancy front-end heatsink might be half the size.

Feel free to try it though. Let us know how it goes... we're all eyes/ears!

[Fungus]

Woah, Power Analysis?
I don't see this option even available for sale, nor it on my HDO1000, it only shows 4 options.
Does this feature, and the others, actually work?
EDIT: Oops, you have the HDO4000.

Doesn't mean it can't be enabled on the HDO1000 though.

[bob808]

OK, but there's probably only two front-ends populated on the PCB and that fancy front-end heatsink might be half the size.

Surely there's only two frontends populated. But you have (almost) all parts on the second scope. Would be interesting to see a teardown for the HDO1072, including the backside of the PCB and backside of front case.

[bob808]

Are you going to drill the case and add BNCs, too? How much will be missing from the PCB for the other two channels?

The BNC connectors could be recovered from the second oscilloscope. Seem to be a 4pin job. If the case has the cutouts I don't really see this as being something complicated. I've desoldered worse.
I think the relays would be more challenging to desolder but I found them new for cheap so I would just get 4 new ones to not bother.

[oliv3r]

I already requested the GPL source code for both these scopes.

No response at all yet

Also, I just saw Dave's video and got excited and disappointed at the same time (Happy MSO5000 owner and no $ and room for an HDO1000 just to hack it :p)

Interesting stuff from the boot log though; afaik the rockchips have quite decent upstream support (both in U-Boot and in Linux), yet they use (obviously) the vendor stuff, as that ddr training data clearly is from the rockchip SDK, though maybe only the SPL is from rockchip? not familiar with this chip ... I bet they just did minimal modification to the off-the-shell android port from rockchip.

So the good news:

```
SecureMode = 0
SecureInit read PBA: 0x4
SecureInit read PBA: 0x404
SecureInit read PBA: 0x804
SecureInit read PBA: 0xc04
SecureInit read PBA: 0x1004
SecureInit read PBA: 0x1404
SecureInit read PBA: 0x1804
SecureInit read PBA: 0x1c04
SecureInit ret = 0, SecureMode = 0
...
Trust Addr:0x4000, 0x58334c42
No find bl30.bin
...
RunBL31 0x40000 @ 97359 us
\x01NOTICE:  BL31: v1.3(release):845ee93
```
While I'm not familiar _at_all_ with this specific chip/SDK, looks like that secure boot is disabled, e.g. no fuses etc what I worried about. (Chime in the common, rigol loves hackers :p). So that makes a lot of stuff possible! Someone send me a scope (@tv84 probably needs one too >:p) that trust addr is a bit scary though, though I think it's just trying to load an 'arm trust zone firmware' binary here... (though bl30.bin seems to be associated with Amlogic's S905 according to google foo). BL31 seems to be 'optee' opensource trust zone firmware? which actually is booting ... so maybe locked down after all?

```
GPT 0x3335db8 signature is wrong
recovery gpt...
GPT 0x3335db8 signature is wrong
recovery gpt fail!
```
 
Why do vendors never _try_ to fix warnings/errors. This is simple to fix, and should be avoided, a recovery GPT exists for a reason ya'know :p

Anyway, seems to at least load uboot or at least in string, but then dead silcence, no console output, no kernel output but:

All those "\0\0\0\0\0\0\0\0" is probably when the second bootloader (u-boot) started and used a different baudrate. You may want to re-decode that part.

Never would have thought of that. It would really do that?

That's probably very true (where's autobaud ...) 115k is very common for U-Boot ... and yes, I would not be surprised. Vendor of the shelf bits and pieces glued together And they probably never looked/cared at the SPL, if they can get their U-Boot output, if they are even hacking around that at all.

Wondering if we can go from HDO1000 -> HDO4000 (with limitations) though. They probably interleave the ADC to go from 2G to 4G samples, but I'm not analog enough to understand how that would work. I suppose if each samples at 1/2 the clock (or the clock runs twice as fast :p) that could work. The FPGA could be the same, (makes software development and testing much easier) and just never go into a mode that would do anything better then 2G? Curious. But then, rushed developers don't make things easy and modular, just 'it works, ship it' and hack things together to make things work.

I don't think this is how it worked on the MSO5k's, there you only had 2 pairs per adc, 1 + 3 combined. I think this design is different. So very curious if an HDO1000/HDO4000 owner can see if we have the same limits as before (chan 1 + 3 combined) ... @dave :p

Anyway, I just realized I'm just reading page 1, and there's 8 pages already So let me read those 8 pages first and then comment some more :p

[thm_w]

As far as the active probe circuitry goes it would be interesting to see if the HDO1000 series has that long pcb along the connectors. If it has it then most likely it's the same part as on the HDO4000 series but with the connections covered by the sicker that's over them. On the HDO4000 series teardown photo that sticker can be seen, black, and has cutouts for the PCB pads (first photo). If that PCB is on the HDO1000 series then there's good chances you could rebuild the circuitry.

HDO1000 will definitely not have that PCB, as its only used for active probes.

You will get a thing that has no calibration from factory for ADC you added. Reliability will be directly connected to thermal damage done while doing "surgery". Only reason to do it is bragging rights. I for sure wouldn't trust that scope with any critical measurement. And I do trust both Rigol and Siglent on their equipment doing a good job.

It is a good point. In the MSO5000 thread tv84 determined cal data that was not modified by a self-cal (some factory cal presumably).
The DG800 factory cal procedure for high frequency (100MHz) has yet to be discovered as well, so output may be a few dB off.
Some smallish chance ADCs are binned or matched, and just won't work to the spec.

I already requested the GPL source code for both these scopes.

No response at all yet

They never responded to our MSO5000 requests years ago, they dont care.

[Martin72]

I can´t imagine someone will do these "Frankenscope" thing seriously, or...

[bob808]

I had another look at the teardown videos and seems that HDO1000 series does not have the front panel active probe PCB installed. For 4k series you can see the black pcb but on the 1k series it's completely missing.
Third USB connector is also not possible because of the metal shield. Does not have room for it.
So the only hardware mods would be the second ADC and the two other frontends for the 2ch versions (for 4ch conversion) presuming the heatsink allows it.

[Martin72]

When I remember it right, there are no HDO 1000 for sale official actually ?
So it wouldn´t wonder me when the forthcoming HDO1000s wouldn´t have the same pcb layout as the 4000.

[bob808]

They seem to have specifically tried to share as many parts as possible between 1k/4k series. Why would they go out of their way to keep that one guy from trying a 2ch->4ch conversion.

[Martin72]

Correct me but the only 1000 we´ve seen was the one that Dave got.

[bob808]

Yes there might be surprises. We also haven't seen the innards for the 2ch version.
But why would they change it? What would be the justification to spin another PCB?

[Martin72]

That´s a point.
What I expect is at least a pcb with drastical less parts on it or others.
Concerning memory, concerning the fact that the HDO1000 didn´t got 50 ohms, etc...
Accordin to the batronix site, for the HDO4000 there are several upgrades avaible.
Bandwith, Memory (500Mpts), Decoders, Power analyzer.
For the HDO 1000(according to rigolna.com) only Memory (100Mpts) and Bandwith.
No additional decoders, no power analyzer.
The last two are IMHO truly only software addicted, there are no reasons why the HDO1000 shouldn´t handle it.
Memory...HDO1000 got 50 Mpts, up to 100.
I expect at least that the memory on the pcb will be different.

[bob808]

Yeah will be interesting to see a HDO1072/4 teardown. When will they start shipping?

[bob808]

For the HDO 1000(according to rigolna.com) only Memory (100Mpts) and Bandwith.

The 1000 series might have a different frontend filter. I've noticed a single resistor with a different value, out of the marked ones. There's quite a few unmarked. So even if hacking to a 4000 series firmware, it might not get you 800MHz without adjusting the passives.
If the 1000 series keep the same hardware as in Dave's teardown, and firmware patching to 4000 is possible, then 500Mpts might be an option for 1000 series.

[Martin72]

Yeah will be interesting to see a HDO1072/4 teardown. When will they start shipping?

I´ve looked here (germany), there are 5 official rigol distributors named.
And only one of them got the HDO1000 listed with delivery time on request, the others not.
But all offers the HDO4000, mostly on stock with 1-3 days of delivery time.
Very strange....

[ojete]

Yeah will be interesting to see a HDO1072/4 teardown. When will they start shipping?

I´ve looked here (germany), there are 5 official rigol distributors named.
And only one of them got the HDO1000 listed with delivery time on request, the others not.
But all offers the HDO4000, mostly on stock with 1-3 days of delivery time.
Very strange....

It's not strange, read my message
https://www.eevblog.com/forum/testgear/rigol-hdo1000-and-hdo4000-12bit-oscilloscopes-launched-in-china/msg4437196/#msg4437196

Batronix can´t sell the HDO1000 as long as they sell siglent too, the same for the other stores. Only rigolshop.eu is selling the scope for obvious reasons.

[2N3055]

Yeah will be interesting to see a HDO1072/4 teardown. When will they start shipping?

I´ve looked here (germany), there are 5 official rigol distributors named.
And only one of them got the HDO1000 listed with delivery time on request, the others not.
But all offers the HDO4000, mostly on stock with 1-3 days of delivery time.
Very strange....

It's not strange, read my message
https://www.eevblog.com/forum/testgear/rigol-hdo1000-and-hdo4000-12bit-oscilloscopes-launched-in-china/msg4437196/#msg4437196

Batronix can´t sell the HDO1000 as long as they sell siglent too, the same for the other stores. Only rigolshop.eu is selling the scope for obvious reasons.

Yes but why?
There are no HDO1000 to be bought at all anywhere.. Production ramp up problems? Their marketing was much faster than actual production.
And then they decided to give first batch to those that carry only Rigol because they need it more. A bit of loyalty thing.
Later they all will have it.
Think about it, they would want to sell more, not less..

[bob808]

where would they keep the ADC calibration data, if there's any? some eeprom or flash storage?

[Martin72]

Batronix can´t sell the HDO1000 as long as they sell siglent too, the same for the other stores.

It´s therefore strange because all are offical listed rigol distributors in germany and we only know from one (batronix) this siglent thing.