Hacking the HDO1k/HDO4k Rigol 12 bit scope

[bob808]

it's a compiled version of a dts file. tv84 posted the dts here:
https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg4501150/#msg4501150

looking through it here's a few things coming up if searching for "fan":

Code: [Select]

00003290        syr827@40
000032A0           compatible = silergy,syr827
000032BC           reg = 00000040
000032CC           vin-supply = 0x00000032
000032DC           regulator-compatible = fan53555-reg
000032F8           pinctrl-names = default
0000330C           pinctrl-0 = 0x00000033
0000331C           vsel-gpios =
00003334           regulator-name = vdd_cpu_b
0000334C           regulator-min-microvolt = 0x000ADF34
0000335C           regulator-max-microvolt = 0x0016E360
0000336C           regulator-ramp-delay = 0x000003E8
0000337C           fcs,suspend-voltage-selector = 0x00000001
0000338C           regulator-always-on =
00003398           regulator-boot-on =
000033A4           regulator-initial-state = 0x00000003
000033B4           phandle = 0x00000012
000033C4           regulator-state-mem
000033DC              regulator-off-in-suspend =
000033F0        syr828@41
00003400           compatible = silergy,syr828
0000341C           reg = 00000041
0000342C           vin-supply = 0x00000032
0000343C           regulator-compatible = fan53555-reg
00003458           pinctrl-names = default
0000346C           pinctrl-0 = 0x00000035
0000347C           vsel-gpios =
00003494           regulator-name = vdd_gpu
000034A8           regulator-min-microvolt = 0x000ADF34
000034B8           regulator-max-microvolt = 0x0016E360
000034C8           regulator-ramp-delay = 0x000003E8
000034D8           fcs,suspend-voltage-selector = 0x00000001
000034E8           regulator-always-on =
000034F4           regulator-boot-on =
00003500           regulator-initial-state = 0x00000003
00003510           phandle = 0x00000098
00003520           regulator-state-mem
00003538              regulator-off-in-suspend =
and

Code: [Select]

00012428     pwm_fan
00012434        status = okay
00012448        compatible = pwm-fan
0001245C        pwms =
Should be available in software. They should be controlled by syr827 which is a synchronous step down regulator with i2c.

edit: don't know how PWM plays into it.

[bob808]

Also I don't know if you can get a shell into the scope without opening it up. Does it work on USB?
edit: the MOSFETs on the back suggest PWM, I don't see any syr827 chips on the PCB with that footprint.
if it's software controlled they might already have a curve defined, or badly defined one. so this might be fixable into a future firmware update, I don't think it's worth the hassle of doing it yourself.

[markone]

it's a compiled version of a dts file. tv84 posted the dts here:
https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg4501150/#msg4501150

looking through it here's a few things coming up if searching for "fan":

Code: [Select]

00003290        syr827@40
000032A0           compatible = silergy,syr827
000032BC           reg = 00000040
000032CC           vin-supply = 0x00000032
000032DC           regulator-compatible = fan53555-reg
000032F8           pinctrl-names = default
0000330C           pinctrl-0 = 0x00000033
0000331C           vsel-gpios =
00003334           regulator-name = vdd_cpu_b
0000334C           regulator-min-microvolt = 0x000ADF34
0000335C           regulator-max-microvolt = 0x0016E360
0000336C           regulator-ramp-delay = 0x000003E8
0000337C           fcs,suspend-voltage-selector = 0x00000001
0000338C           regulator-always-on =
00003398           regulator-boot-on =
000033A4           regulator-initial-state = 0x00000003
000033B4           phandle = 0x00000012
000033C4           regulator-state-mem
000033DC              regulator-off-in-suspend =
000033F0        syr828@41
00003400           compatible = silergy,syr828
0000341C           reg = 00000041
0000342C           vin-supply = 0x00000032
0000343C           regulator-compatible = fan53555-reg
00003458           pinctrl-names = default
0000346C           pinctrl-0 = 0x00000035
0000347C           vsel-gpios =
00003494           regulator-name = vdd_gpu
000034A8           regulator-min-microvolt = 0x000ADF34
000034B8           regulator-max-microvolt = 0x0016E360
000034C8           regulator-ramp-delay = 0x000003E8
000034D8           fcs,suspend-voltage-selector = 0x00000001
000034E8           regulator-always-on =
000034F4           regulator-boot-on =
00003500           regulator-initial-state = 0x00000003
00003510           phandle = 0x00000098
00003520           regulator-state-mem
00003538              regulator-off-in-suspend =
and

Code: [Select]

00012428     pwm_fan
00012434        status = okay
00012448        compatible = pwm-fan
0001245C        pwms =
Should be available in software. They should be controlled by syr827 which is a synchronous step down regulator with i2c.

edit: don't know how PWM plays into it.

I would say a great start, thank you very much 

PWM fan should be 4 pins device, where 2 are supply lines, one is the tachometer signal and finally the PWM, that sets the speed in function of his duty cycle, but it's not our case

We do have a 2 wires FAN that requires a step down converter like the syr827, but I found out a datasheet on the web that reports 6V maximum voltage... could you spot the device on the PCB photos ?

I guess they are using another device with compatible command set and/or it does exist a 12V version.

[markone]

Also I don't know if you can get a shell into the scope without opening it up. Does it work on USB?
edit: the MOSFETs on the back suggest PWM, I don't see any syr827 chips on the PCB with that footprint.
if it's software controlled they might already have a curve defined, or badly defined one. so this might be fixable into a future firmware update, I don't think it's worth the hassle of doing it yourself.

OK, i saw this post right now, there is a photo of the back on this 3ad ?

If you can spot an inductor nearby we have a buck for the FAN.

[bob808]

I posted it here: https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg4576165/#msg4576165

I think it's just PWM and fans are on 12V from the SMPS. Connector from power supply is close to the ones for the fans.

[markone]

I posted it here: https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg4576165/#msg4576165

I think it's just PWM and fans are on 12V from the SMPS. Connector from power supply is close to the ones for the fans.

I'm pretty sure that those 2 SOIC8 devices are part of the switching regulator section in yellow square (see attached photo) that is too complex to be related to FANs.

I have instead a doubt about the SOIC8 in red square, but i do not see any inductor, anyway the most important thing is that you have found signs of FAN management in scope filesystem.

[bob808]

Nah the inductor on the left is for 3.3V, you can see a small chip on the left. It's for RAM or something.
Look at the HDO4k photo, it has 12V on the silkscreen for those electrolytics, and 3.3V under that inductor.
My bet is that fans are on 12V and MOSFETs are PWM-ed on the GND connection.

[markone]

Nah the inductor on the left is for 3.3V, you can see a small chip on the left. It's for RAM or something.
Look at the HDO4k photo, it has 12V on the silkscreen for those electrolytics, and 3.3V under that inductor.
My bet is that fans are on 12V and MOSFETs are PWM-ed on the GND connection.

As you can clearly see from PCB traces, Fans Pin 1 is tied directly to GND, so is the 12V line to be switched, but i do not understand which device is in charge for that.

Anyhow, its not important right now, the right path is a software patch.

[bob808]

Indeed GND is connected so they must be controlling the 12V line.

[markone]

Indeed GND is connected so they must be controlling the 12V line.

How do you make access to system command console ?

[bob808]

One way that users reported as working is opening the scope and connecting on the serial port on the PCB. Might work through USB with adb but I'm not sure, maybe someone with the scope can confirm it.

One thing I noticed on the PCB is that there's no protection diodes across the fan connectors. Do some fans have it included?

[skander36]

You can open a shell through ADB in Windows :

PS C:\ADB_Tool> .\adb.exe connect 192.168.xxx.xxx:55555
* daemon not running; starting now at tcp:5037
* daemon started successfully
connected to 192.168.xxx.xxx:55555
PS C:\ADB_Tool> .\adb -s 192.168.xxx.xxx:55555 shell
rk3399_rigol:/ $ ls /sys/class/thermal
cooling_device0 cooling_device1 cooling_device2 cooling_device3 thermal_zone0 thermal_zone1
rk3399_rigol:/ $

[markone]

You can open a shell through ADB in Windows :

PS C:\ADB_Tool> .\adb.exe connect 192.168.xxx.xxx:55555
* daemon not running; starting now at tcp:5037
* daemon started successfully
connected to 192.168.xxx.xxx:55555
PS C:\ADB_Tool> .\adb -s 192.168.xxx.xxx:55555 shell
rk3399_rigol:/ $ ls /sys/class/thermal
cooling_device0 cooling_device1 cooling_device2 cooling_device3 thermal_zone0 thermal_zone1
rk3399_rigol:/ $

Ok, so as I did for the "upgrade".

[skander36]

yes, as for the upgrade, now with shell to access console
But if you, sometime will open the case, you can just try to unplug one fan and check the temp in Self Check -> Board Test to see if a lower airflow is sustainable.
(There are ways to peel off the warranty seal without damage)

[markone]

-snip
(There are ways to peel off the warranty seal without damage)

Do you mean with hot air ?

I remember some tutorials on the tube, anyway I will do it only if the result is guaranteed, at least now that the instrument is almost new.

Anyhow, not locating on PCB a dedicated buck converter nearby FAN connectors i'm starting to think that they are driving FANs with a straight PWM driving, that could be the cause of weird sound at low speed.

[bob808]

You could also make a cable with a series resistor. Check the current rating for the fans, at 12V. You could drop the voltage this way.
For the weird sound it might as well be the PWM frequency. Try with an audio spectrum app on the phone, it might stand out at 1kHz or smth.

[skander36]

Yes I am also thinking that PWM is used to drive the fans.
In that case I don't know if a resistor will be efficent.

[bob808]

It should work fine if PWM is at 100% at all times (apart from startup). They might have skipped defining the curve and just 100% it at all times. But this might change in later firmware updates. It clearly was rushed to market.

[markone]

You could also make a cable with a series resistor. Check the current rating for the fans, at 12V. You could drop the voltage this way.
For the weird sound it might as well be the PWM frequency. Try with an audio spectrum app on the phone, it might stand out at 1kHz or smth.

There is not limit for solutions opening the case 

Series resistor was the solution for my DS1000Z scope, probably for this one i would go for a couple of high efficiency 60x60x25 fans, like Noctua NF-A6x25 FLX (or something cheaper like NMB) plus a series resistor for the sweet spot.

But it could be that we find the configuration file containing the regulation parameters so no money and no case opening required 

[markone]

Yes I am also thinking that PWM is used to drive the fans.
In that case I don't know if a resistor will be efficent.

It would be because it will apply a voltage drop.

[skander36]

... It clearly was rushed to market...

We can see this. They have things to polish.
Color grading is not so grading. Only red and yellow.
Sometime capture stop when you run through the timebase. (RUN/STOP button became red).
The are bugs to be reported but they need to be well documented.


   

[markone]

... It clearly was rushed to market...

We can see this. They have things to polish.
Color grading is not so grading. Only red and yellow.
Sometime capture stop when you run through the timebase. (RUN/STOP button became red).
The are bugs to be reported but they need to be well documented.

I saw worse launch FW release, but i would say it's time to release an update, for sure removing serial decoder crash, quieter FAN profile and so on.

So, if RIGOL is reading this, please ACTION !   

[2N3055]

... It clearly was rushed to market...

We can see this. They have things to polish.
Color grading is not so grading. Only red and yellow.
Sometime capture stop when you run through the timebase. (RUN/STOP button became red).
The are bugs to be reported but they need to be well documented.

I saw worse launch FW release, but i would say it's time to release an update, for sure removing serial decoder crash, quieter FAN profile and so on.

So, if RIGOL is reading this, please ACTION !

LOL.. Good luck with that.
Rigol HQ is shaking in fear...

We did speak about this and warned about this.
Rigol is capable of making very decent products hardware wise, but are "famous" for doing exactly this... MSO5000 users waited long time for some basic things to be fixed and not all of them were in the end...

I warned about risks of being early adopters many times.
I used to own DS1074Z from Rigol. It was a nice little scope. At the time it was worth every penny and best in class. But they had early problems, and I actually bought it when it was 2 years on market and fixed to decent level.
With obvious production ramp up problems, you could end up with basically buying release candidate product.

Even R&S was dragging its feet with FW for more than 6 months in beginning when RTB2000 was released. Even them struggled a bit because it was completely new platform. But they picked up the pace after that and started doing the right thing.

At this particular point you paid for a promise that one day your scope will be as good as you think it will be. Now you wait. And Rigol will eventually do it, but they have reputation to take it slow. Which is OK, because price was very attractive.
If you wanted it differently, you should have bought some other scope that has been on market for some time and is working as it is, or should have waited for Rigol to finish the product eventually.
If you want to stick with it, then well document all the bugs you find and report them to Rigol technical support through proper procedure. That is how bugs get fixed. There are some manufacturers that pay attention here but that is informal.  Talk to Rigol EU directly... That is the way.
And good luck, I hope Rigol does the better job this time.

[bob808]

There is not limit for solutions opening the case 

if you get a shell through ethernet then the PWM line might get overridden constantly to update 100%. dunno how they implemented the control. so you'd have to mess it up for the software so you can control it. random thought would be to change the fan control index/name/identifier so that their software can't access it anymore. this way you should be able to control it, but the software might complain if there's no fan control. theoretically you wouldn't need to open the oscilloscope for this.

[bob808]

Here's some examples for RK3399 and fan control:
https://bbs.t-firefly.com/forum.php?mod=viewthread&tid=2519
https://gist.github.com/nuumio/06858ccd8df515569f386a7a00a1cb0d
Might help for inspiration.
If Rigol programed a binary 1 write on the GPIO at startup and nothing else after then it might just be as simple as a script like in the examples.

edit: maybe check /sys/class/ for PWM or GPIO.