REVIEW - Owon SDS7102 - A look at the SDS series from Owon

[Spiro]

I am newbie at reversing (8-bit so can I try to quest what are you going to do?

So first you need to find what MCU/CPU pins are used as SPI interface because that
is how you find part of opcode, is that right?
Second, you need to find from datasheet of LMH6518 combination of data that limit
BW to 100MHz (or what ever).
Third, in "somewhere" your are going to search for opcode and data sequnce that
change parameters of LMH6518. That is how you are going to find what to change.

Am I close? Am I close? Am I close? Am I close? Ooooo boy am I at least a bit close?

What is hzlib (i find what zlib is), oob, bsdl? What is JTAG used for (yes I am that newbie ?
Is it possible that they have used some sort of packer and that packer is in zlib?

[tinhead]

I am newbie at reversing (8-bit so can I try to quest what are you going to do?

So first you need to find what MCU/CPU pins are used as SPI interface because that
is how you find part of opcode, is that right?


Second, you need to find from datasheet of LMH6518 combination of data that limit
BW to 100MHz (or what ever).
Third, in "somewhere" your are going to search for opcode and data sequnce that
change parameters of LMH6518. That is how you are going to find what to change.

Am I close? Am I close? Am I close? Am I close? Ooooo boy am I at least a bit close?

What is hzlib (i find what zlib is), oob, bsdl? What is JTAG used for (yes I am that newbie ?
Is it possible that they have used some sort of packer and that packer is in zlib?

1 - find JTAG on PCB
http://en.wikipedia.org/wiki/Joint_Test_Action_Group

2 - dump firmware from whatever memory on PCB.
In case of NAND flash dump OOB blocks
http://wiki.openmoko.org/wiki/NAND_bad_blocks#NAND_page

3 - quick analyze firmware - is the code looking good? (i'm actually opening with hex editor only to see if the content looks good for me) If yes continue, if not sure solder empty NAND, restore backup and check if device is booting up.

4 -  analyze hardware to quick understand what the hardware is suppose to do, read datasheets to find
function which can be used to achieve target (in this case bw hack)

5 - use Boundary Scan
http://en.wikipedia.org/wiki/Boundary_scan

or just a continuity checker (when possible not) to find interessting/data flow pins (like the pins connected to LM6518)

6 - read S3C2416 data sheet and user manual to learn GPIO addressing, this is what you need to know
to be able to find a write sequence to specific GPIO pin or port (e.g. SPI)

7 - deep analyze firmware, look for control sequences. This is actually the part which takes the most time.
There can be always a kind of protection, the first step is to patch something simple like a string to see
what influence it have on the firmware protection - when this works change part of code to do something,
good example is change keypres code to do e.g. init or beep or whatever. Here on Owon this is a bit
more complex, but still these are first steps. When there is protection you have to localize it and remove first.

8 - build a test system - this is optional step, sometimes you can use dev boards from a specific chip to run dumped firmware
without any risk for DUT. In this case you could buy on ebay a cheap S3C2416 board, restore firmware dump to NAND
and analyze changes to firmware - to solder wires directly to PCB might be sometimes dangerous, so test system
will help.

9 - test changes on DUT, when everything works you almost done.

10 - investigate what will happens in case of firmware update - when still possible and all changes you made will
still works you done with hack - when not think about ways to autopatch during firmware update.

So that's all about reversing.

Now these hzlib, this can be crc table or it can be also chinese characters table I will see it during step 7
As for now the firmware is already dumped to separate files, i have also table of content (to be able to reflash changed parts into right sections), disasm (1st run )cleaned up (data, code) - however i don't like the result so i will have to get manualy
through code and re-analyze.

One important question is already answered "is Owon using LHM6518 to reduce bandwidth?" - the answer is YES.
This is a part of menu (some items hidden from user) :

aMenu_bandlimit   DCB "menu_bandLimit",0
aMenu_20m   DCB "menu_20M",0
aMenu_100m   DCB "menu_100M",0
aMenu_200m   DCB "menu_200M",0
aMenu_350m   DCB "menu_350M",0
aMenu_650m   DCB "menu_650M",0
aMenu_750m   DCB "menu_750M",0
aMenu_fullband   DCB "menu_fullband",0

which is exact what LMH6518 can do, so that's the confirmation.

Now the hack could be maybe something like "unhide menu", however there will be for sure a part
which is setting up 100MHz as defualt when "bandlimit" off so this need to be hacked too.
Another option is just to hack all 100MHz code parts to let say 350MHz.

I'm not sure if i can do everything in time, you have to know i loan Owon from someone and in principle
i have to send it back tomorrow (or buy it). However the work i doing now should be at least a good
preparation for future hacks, so someone else can continue in case i will be not ready in time.

[tinhead]

small update : FPGA design is protected by AES / CryptoMemory chip combination,
the firmware itself is usign AES too at least for firmware update, not sure if for other thing too ... i'm keep working on that.

[tinhead]

NEC UD2-4.SNU: no specified capacitance

i got few FTR-B3GA4.5Z (where the cap specs are available) and compared them to NEC UD2-4.SNU.

It seems that there is small difference, the NEC UD2-4.SNU have 0.2pF more for adjacent contacts and between
coil and contacts giving total of ~0.5pF higher as on FTR-B3GA4.5Z.

[tinhead]

Do you think this will make a big difference?

depends, on Owon didn't matter as all relays are in attenuator section and not between opamp/ADC.
On Tekway FTR-B3GA4.5Z instead of NEC UD2-4.SNU gives you immediatelly 2-3MHz more bandwidth.

On Owon there are other thigns which i don't like, input section/BNC ground
is floating - all BNCs (GND) are connected to one big piece of shielding which is solderend
only on one side to PCB, the another end is floating - this is from HF point of view bullshit.

Then no wall/shielding between channels (not in input stage nor between BNCs),
this is for me no go even on a 60MHz DSO. The wire between BNC and PCB is a joke too.

What else, yeah, the VGA out cable right over the trigger comparator and buck converter,
this is a really bad combination, all that garbage (1.25MHz) from buck converter and from VGA
out signal (when enabled) is "flowing" few mm above the comparator. This is a perfect noise
generator for trigger signal And of course trigger signal is coming from inout stage, so
the whole garbage is flowing then back to last opamp and ADC of course.

Can be even worse? Yes, it can, there is no GND layer (for reason) right under the VGA cable,
and gues what on the other PCB side? Right, the ADC clock chip.

How to fix these hardware bugs? Well, piece of shielding soldered to 3 caps and the front end shield
would good enough. It must be flexible and isolated (both sides !!!). That's for the trigger copm/ADC/buck/VGA disaster.

For BNCs is a bit more complex, you have to cut two walls and solder them between channels, solder the floating
GND, solder small GND wires directly from BNC to PCB GND and made a small wall for input stage too.
Unfortunately not everywhere a wall/shielding will be possible, there are holes for screws.
The device which i have, the big piece of shield with BNCs mouted to it, this part is already "moving around" a bit,
so later you will get definitely issues with GND.

These hardware "bugs" are typical for "compact" designs where lack of space will be recognized after all,
maybe Owon will improve that part in next PCB revision, they already improved some "jokes" in PSU part
of the scope. When there is no space to move parts Owon can at least solder a bit better BNCs,
solder the floatinng shielding and add 3 wires for BNC GND. then of course they have to solder small
shileding like on "good.jog" picture to protect trigger/ADC/clock from the buck/VGA garbage.

Total cost - 5USD per unit, so it should be possible for them.

based on the pictures of new PCB all these issues are obsolete!
Owon changed all these bad things, a big thumbs up for that Owon!

[rf-loop]

Then no wall/shielding between channels (not in input stage nor between BNCs),
this is for me no go even on a 60MHz DSO. The wire between BNC and PCB is a joke too.

Sorry but I trust more real measured data than opinion. Example rise time and frequency response is lot of better than old Tektronix analog 100MHz work horses.

But why Owon -3dB point is around 140MHz if you tell that it is only just under 60MHz... and frequency response so that it have no lot of highs and lows. (and becouse this, it give also very nice pulse response - better than Hantek and better trig and less time error between channels (skew)).  Pulse risetime is around 2 - 2.1 ns. Trigger is more stable than example Rigol or around same or littlebit better than Hantek.)  Channel cross talking is also under specs limits.

If solder this BNC plate other side (holes) it is difficult to open for service (and it do not make any meaningfull change in measured data.) I can proof it (soldered and not soldered) - with real tests. It do not help anything.

Mechanical stress over  product designed life time ..  this plate is better to fix better.

Test data is imho more imporrtant than visual opinion about cold unit.
I trust only data.

Hantek have RF shielding but cover is not at all soldered..  its connection with RF is like zero also but if I solder it, no any change. Why?

I think Owon have learn this from old well known brand names. If they can do... why we can not do same?

But yes this design can do better just as all designs.

But first need data what proofs real problem and then data what proofs how much measured problem is better after change. But I have just opposite data - what proofs it work well and littlebit better.

But first we need real data what can show with real lab data that something is wrong. After data can design better, then test with real data. It is slow process. Lab data what proofs some problem is only whjat make sense - not opinions with eyes. Real measured data  show if it works or not.  I need tell that after I look also inside and make my "opinions" I have littlebit same feel as you. But my measured data "thinks" different.
Pulse response and frequency response shape is really good.

What is your RF opinion about this picture and who have design it. Chinese? No GND ... it goes around front panel here and there and long "mixed" RF way to front end.
What about frequency response. 10MHz? Who have design this HF bullshit   ?
(left side white/red wire is NOT GND wire! its meaning is tell probe data (division factor 1:1, 10:1, 100:1 etc) to scope)

Cross talk between these not shielded wires in freq area 0 - 200MHz is minimal. No any meaning becouse there are much more cross talk in other parts. If shield these wires you get nothing in practice. Scope is with 8 bit ADC. This leaking is well under this resolution. It is totally different case if we need care something around -60 ... - 120dB attenuation, example in good RF filters. There really need take care about RF isolating. And of course if go to hundreds of MHz or even GHz area. What is basic oscilloscope channel to channel cross talk. 20 - 40dB... and no need more. But yes making RF shield between these two wires... how much you can reduce total cross talk. What part of cross talk come from these two around 15mm wires. If make this crosstalk attenuation here theoretiocal infinite. It do not still help nearly anything... maybe some small part of one dB in total cross talk. You can try. So - why do it. Maybe becouse it looks better? This is reason why also Tektronix and HP did not care this problem. I have looked, tested, repaired, tons of HP/Tektronix scopes and other real RF stuffs. With my profession I can tell that these two part of short small wires do not crosstalk "anything" meaningful in tthis case. And yes, not wires soldered to GND. If solder GND wire from BNC to PCB. You can not see any advantage with any test instrument as we are talking now this scope case in its frequency area.

How can make this oscilloscope better. It need more sharp BW filtering in analog front end before ADC.  Doing sharp brick wall filter so that  -0.5dB is around 180-200MHz, -3dB corner is around  210MHz and -35 ... - 45dB around <=250MHz
(so -3dB point is better to move littlebit higher freg, from around 140MHz to near 200MHz but only if also do this brick wall.)

Also 250MHz noise from ADC system need reduce. If there is brick wall in analog front end then this can easy do also with DSP or maybe also better design in PCB around ADC. They have break National recommendations. They have not isolated well digital and analog part as recommended. 

Trigger can do littlebit more clean. It is very well in this price class, nearly as leader but maube it can do better with some easy tricks BUT it need PCB totally redesign!

But, if do nothing... it still capture signal with better quality than many others in this price class...

[rf-loop]

Later I have more pictures. Now Hantek fail most of pics to USB. Only this picture was ok.  Hantek display allways ok stored but... then in home, USB have only 1 Hantek pic.

But later... I do it agen. (I do some test what maybe show something difference in signal capture quality.)

In this case both scopes get exactly same signal. Signal level is so adjusted that 1MHz with same level give 8 vertical division with both scopes. I set Owon to 5ns/div becouse 100MHz Hantek have not 2ns/div. Both scopes sample 1Gs/s. Owon was 1k mem and Hantek 4k mem. With 10k, Owon give so same that I can not see difference.
(BTW I find that if Hantek is set for 1M memory  displayed waveforms update rate go extremely slow if compare to Owon with aroundsame settings and signal. This need more study.)

But wait some time...  I can tell that this pic is nothing... not  so bad for factory new unmodified Hantek... also Owon is fully unmodified. (after I get agen these noise and bullshit capture pics... maybe I want sensored some pics or give littlebit handicap to Hantek.)

210MHz in capture and stop. Both scopes get pure sinewave and  level what is 8 vertical div p-p.
And if you think how is sine quality. It come from HP8644B. (test is not made exactly same time becouse I do not have good calibration quality isolating splitter.) Owon -6dB at 260MHz is nearly as in this pic, only level littlebit lower. Hantek capture there nearly garbage. But later... noise and other garbages. (this test was not short and simple and it really takes time.. so I need look what time I can do it agen. I do not like Hantek USB... never can trust if it store or not. How people can do work if tools do not work.

How this "error designed" Owon can beat 10-1 Hantek in all signal quality things, and also if look channels cros talk. Isolated wires or not but it works.  Yes maybe Owon is 60Mhz
This do not need opinions and believes, it need raw hard data from tests.

[tinhead]

cross talk have nothing to do with sampling, and you know that.

To be very honest i designed for years RF systems and things like the crap on Owon is somethign what i saw on
many devices. They did nothing else than copy/paste from bad design from a "known manufacturer".
Cost savings and stupid engineers are everywhere, today most of these so called engineers are googling for
solutions and not knowing what they doing, so you will find in the future more and more such design mistakes.

Don't forget, the same frontend is also used in 350MHz Owon models (and when i look into firmware even for more than 350MHz),
so it is not only "60MHz DSO", it is just a bad design, especially the very weak mechanical construction and bad GND will create many issues with the time.

The 250MHz noise is just another one example of "google engineers", they managed to read datasheet but not application note.
Sure, it not that critical on <200MHz models, but not nice at all. Let's hope they redesign a bit the 350MHz model.

Now Hantek, hehe, except some "calibration issues" on you unit (look what my DSO is doing, sine from R&S SMY and stop - no tricks)
this is something totaly different, just take a look on example picture in Agilent 5989-5732EN (page 9)
taken from LeCroy WaveRunner 104Xi. You will see that even 10x more expensive scope have same interleave distortion issues.
On Owon, as no external interleave has been used the waveform looks of course better, but this is nothgin new.

Btw, you know exactly that especialy Owon will not do anything when we not push them, so no need to hide potential issues from users.
For these already few selled units, a small fix can be done by the user to improve these (not bad at all, even if i don't like here and there few things) devices.

[tinhead]

... and because i love to "fight" with you, here pictures of 250MHz sine shot on my Tekway.
Sure, on default calibrated unit the picture will be in worst case like on your Hantek,
with my optimized factory calibration you will get better results.

Sometimes the issues are not on hardware side, sometimes they created by lazy employees.
The engineer who deigned the original Tekway firmware implemented 16 calibration values:

coarse 1GS/s edge
coarse 1GS/s pulse
coarse 1GS/s slope
coarse 1GS/s O.T.

coarse 800MS/s edge
coarse 800MS/s pulse
coarse 800MS/s slope
coarse 800MS/s O.T.

fine 1GS/s edge
fine 1GS/s pulse
fine 1GS/s slope
fine 1GS/s O.T.

fine 800MS/s edge
fine 800MS/s pulse
fine 800MS/s slope
fine 800MS/s O.T.

now what you will find on Hantek is only 3 of them

coarse 1GS/s edge
coarse 1GS/s pulse
coarse 1GS/s O.T.

has been executed during  production - what a shame.

My scope is using only 6 of them (i don't need coarse values, fine are better but you need good equipment to run them):

fine 1GS/s edge
fine 1GS/s pulse
fine 1GS/s O.T.

fine 800MS/s edge
fine 800MS/s pulse
fine 800MS/s O.T.


which is already a big improvement, i haven't found time to test the missing 2 values (slope 1GSs/ slope 800MSs).

But we should focus in this thread on Owon and not jump to other products.

Maybe some of the Owon issues are also based on lazy employees, who knows (well Owon do).

Our "job" is to blame them a bit to force them to improve their products,
because there is nothing mature on these units

starting from these crazy buttons, firmware logic, missing features, trigger out joke, update rate, noise here and there,
missing shiledings, floating grounds, mechanical construction (BNC), missing fan monitoring (what happens when the
fan stop to work? right, ADC and FPGA will get damaged too).

Nevertheless, i think i will keep my SDS7102 (or buy SDS8102, i have to think about) as the hardware/software
even with these bugs is still worth money. The mechanical issues can be easy fixed, shileding as well,
the 250MHz noise will be bit harder to fix but as already said abiove - for someone who will never ever hack the
hardware to more bw than 200Mhz this didn't matter that much. I will probably cut the power supply
from ADC and install my own inside, there is enough space for that.

I was a bit busy with other things, so no hack news for today, but tomorrow i have nothing in my calendar,
so i will "O(h)won! a bit" the firmware

[rf-loop]

cross talk have nothing to do with sampling, and you know that.

The 250MHz noise is just another one example of "google engineers", they managed to read datasheet but not application note.
Sure, it not that critical on <200MHz models, but not nice at all. Let's hope they redesign a bit the 350MHz model.

Btw, you know exactly that especialy Owon will not do anything when we not push them, so no need to hide potential issues from users.

Yes of course I know this. But I was reading you see these "not isolated" short wires some problem.
Becouse I talk SDS7102 and no other models they are not problem. Then I was thinking why you see this problem and I can not imagine any other that possible thinking about cross talk becouse no shield there. I can tell, there is no cross talk problem and no reactance problem as we talk 100MHz oscilloscope. GND, what is problem? Why it is not problem in HP and Tektronix? Becouse there is no problem.  It is problem only if ageing make loose this connection.  Of course if we go to 200, 300, 400 etc MHz this construction go more bad. I have looked front end with signal eyes... using HP VNA. There is no problem as we think this is 100MHz oscilloscope.

250MHz noise, still quite low level, but this I do not like and there is cheap "engineer" bad job just as you tell... read datasheet but forget then all other things. This ADC area design on the board is not good. It is good if thing this class normal cheap scopes. But it can be better very easy.

Yes we need push Owon to develop it better but this here is not right way.
But how much better it need be than others in same price class. Now its HF characters beat all in this scope class.

If we want they develop it better we need talk with Owon. 
And do not compare apples and oranges... we  need copare unmodified units... just from factory.
This is what peoples buy. But yes we can also destroy all these names. But who win then. Nobody. Then there are only loosers.

--------
ADD:
About cross talk/RF isolation.
I have done (indirect) measurement. This is not exactly how it need do if think scope itself as test instrument and how much it see himself this.
but this difference tell still something.
I connect 0dBM signal to CH1 and listen CH2 with R&S spectrum analyzer only for look level.
Hantek, 100MHz in level 0dBm, CH2 can see around -90dBm
Owon, same, CH2 can see around -53dBm
(remember, this is NOT what scope see as channel isolation)
This is really big difference if this is some other unit than 8bit ADC oscilloscope. In this kind of oscilloscope this do not mean nearly anything. If this is example RF filter, this difference is just as bullshit and exellent. But if Owon do 300MHz scope with exactly same front... this do not work well.  I have never test Owon 200 or 300MHz models. Only what I know is this 100MHz model and becouse this, I can talk only about this. All other talking about other models are only believe and religion if have no real data.

Btw this picture before was taken this "world famous and every lab trusted Tektronix" (this pic was model 2236... there have been 100MHz professional RF designers.. heeh..  and they proud talking they are simple - The best. 


But I need do all other my tests agen, not only becouse this USB issue. Today I find that this single Hantek have some kind of fail! So I can test after this fail is solved or after I can get other unit for test. So, also this 210MHz picture may change later becouse after find this fail I can not repeat this picture as it was before.  Something happend nearly or same time after I update this unit for FW 110909.0  Trigger do not work right, frequency display is totally wrong, also all times this unit start so that display is lowest light... always after start need ghange "contrast" to normal. Also now -3dB point is around 100MHz and lot of some kind of wobble/jitter. Very strange..

[tinhead]

I connect 0dBM signal to CH1 and listen CH2 with R&S spectrum analyzer only for look level.
on Hantek 100MHz in level 0dBm, CH2 can see around -90dBm
on Owon same measurment, CH2 can see around -53dBm

i measured -48dBm on Owon, so not that far from your measurment. So in best case scenario ch2
will have 0.65LSB crosstalk (under 0.5LSB is what it should be) in worst case 1DIV!
Even if these values are not the true channel isolation values i don't like them.

Today I find that this single Hantek have some kind of fail! So I can test after this fail is solved or after I can get other unit for test. So, also this 210MHz picture may change later becouse after find this fail I can not repeat this picture as it was before.  Something happend nearly or same time after I update this unit for FW 110909.0  Trigger do not work right, frequency display is totally wrong, also all times this unit start so that display is lowest light... always after start need ghange "contrast" to normal. Also now -3dB point is around 100MHz and lot of some kind of wobble/jitter. Very strange..

not a surprise, Hanteks QC is sometimes the world worst, i have no idea what these guys doing.

[rf-loop]

I connect 0dBM signal to CH1 and listen CH2 with R&S spectrum analyzer only for look level.
on Hantek 100MHz in level 0dBm, CH2 can see around -90dBm
on Owon same measurment, CH2 can see around -53dBm

i measured -48dBm on Owon, so not that far from your measurment. So in best case scenario ch2
will have 0.65LSB crosstalk (under 0.5LSB is what it should be) in worst case 1DIV!
Even if these values are not the true channel isolation values i don't like them.

Yes it can be better but if think all other inaccuracies and specs it is not real problem. but, if think perfect, it is not at all nice. Specially becouse it can do so easy better without any money... oh yes jiao is also money in China.

[0xdeadbeef]

There was a comment in another thread that a new SDS firmware should have been released end of last week or so.
Is anything known about it? Like: what has been fixed/improved and if it's freely available somewhere?

[rf-loop]

There was a comment in another thread that a new SDS firmware should have been released end of last week or so.
Is anything known about it? Like: what has been fixed/improved and if it's freely available somewhere?

Afaik there is no public downloadable. You ask seller - if you have buy it from responsible Owon reseller.

[rf-loop]

Here are some pictures. Every parallel pair have exactly same signal.
One finding was that slower horizontal speeds using long memory, Hantek waveform update rate go extremely slow (FW bug?) , far far below Owon. But 4k memory Hantek waveform rate is most cases faster becouse Hantek is tiny DPO and Owon is DSO. Last picture show Hantek timing problem. Skew, and with new FW also trig position is wrong. Owon trig position is overall more accurate.
Owon ADC is much more advanced than Hantek. Surprice is why Owon do not it better becouse they have these building blogs in HW. Better design and it is just lot of more better, now it is only slightly better. Also becouse Hantek ADC is nearly like garbage generator they use heavy signal cosmetical cleaning in FW. But from pixel porridge they develop some kind of nice looking cake to show on display. Where is true signal under test... "who knows - who cares" we have "oscilloscope"

I did not take all pictures also with analog scope...  if I take... then all you want analog scopes. But no one do not want this becouse these can not make cheap... (exept some real bullshit)... (oh but not... you can not save pictures to USB/Computer and loose working time with computer play....hehe)

I do not explain all pics... look and they tell all you need, they are self explanating.  (oh yes signal levels are same and first sinewaves so that 1MHz is 8 div. All next sinewaves exactly same level and signal is really clean (HP8644B). Cursors are -3dB related to this level.

Also I know these picture sizes. They are not nice on forum and PC display but I want they are native resolution.
In owon pictures these blue color areas are clean in scope display and stored .bmp but my converson to .gif make this small cosmetic problem.
Pictures 14-16 (triangle wave) this waves originally have in upper ans lower turn point this small backfolded v shape. With good analog scope it can see clearly. Only Owon find it. Hantek loose it totally inside sampling "noise". 

ADD becouse asked:
---------------------------
1. 1MHz sine, level 400mVp-p  for reference, look Hantek noise.
next all sinewave pics are done with same signal level. (in scope end also terminated with HP 50ohm terminator enough good to 300MHz)

2. 100MHz Both scopes well but Hantek loose clearly.
3. 140MHz Both scopes around -3dB, Hantek signal is clearly "wobbling"
4. 180MHz Owon continue perfect work, Hantek level is around -6dB and high wobbling.
5. 200MHz Owon is not yet -6dB and Hantek wobbling is terrible. Looks more bad in live running.
6. 230MHz Owon kontinues perfect and not yet -6dB. Hantek - well it see "something" and still it can do trig. But nearly useless.
7. 270MHz Owon reach -6dB point but signal is still perfect and without wobbling. Hantek have loose trig and show only random garbage.
8. 350MHz Owon continue, no markable wobbling, signal attenuated highly, no any kind of trig problems. Hantek Have really loose all.
(Note: With this signal and adjust, Owon trig to 410MHz, highly attenuated signal and there is wobble just something like picture 6 with Hantek)
9. Not nice noise in Hantek.
10. Captured square wave and then 11 and 12 zoomed in this captured signal in stop mode.
17. Notice Hantek skew. CH1 and 2 have time error. Not much and it can compensate easy with cable lenght. (delay this channel what is first).
But then, there is also problem in trigger. Over one div (around 5 ns) error.
This error is strange. If change time/div setting (scope stopped) it disappear and come agen. FW bug?)
-----------------------------

Then one thing not related to these pictures directly.

Hantek is very superior slow if use long memory.
In fast speeds and short memory, Hantek have much more wfrms/s than Owon. (Owon work in this case as DPO and Owon always as serial processing DSO)
But situation go opposite if use 40k to 1M memory with Hantek. There wfrms update rate is much better in Owon. Even 10M it do more fast than Hantek 1M.
Of course if use very slow speeds and sampling speed is so slow that it come meaningfull then all scopes are slow of course. All understand that 10Megasample memory with 1 Mega sample per second take 10 second to capture but here I do not mean this time.
What happend there inside Hantek, this I do not know. Something in memory handling. What hell they do with captured data in memory before they show it to user. What takes so long time?

[rf-loop]

and more. Yes I use Owon CH2 so yellow...

TST10 is captured normally. With settings you see.
Both scopes 1M memory. 
TST11 and 12 are this same capure, scopes "stop" mode and  "zoomed in" using time/div knob.

[rf-loop]

Note: for .jpg and partially also for .gif. Owon store screen dumps as .bmp. I do not understand why my .bmp to .jpg conversion destroy colors and aslo bmp to gif. And if I convert to .gif it sometimes destroy some lines or other details and render some colors area badly.

So THIS display quality is NOT Owon display quality, it is irfanwiev bullshit converter. Specially it destroy red color if it is in small details as thin lines. Next bad is yellow handling. But .bmp is too big, waste of server capacity. This effect you can see left bottom corner. On Owon display you see these "balls" and there inside channel numbers. These yellow and red are exactly same tone and brightness on the real display text and captured trace... but not at all  in this converted picture. With photographs I have trust irfanwiev becouse it is simple and fast... but with this kind of pictures it is just most bad bullshit what can be. So text and trace display brightness is just same as these balls left bottom.



Read this note about picture quality before open picture.

[0xdeadbeef]

GIF is an obsolete 256 color format and JPG is designed for photographies, so I'd suggest to convert to PNG. Also maybe you should use a decent free program as Photofiltre.
I always use it in the job to convert scope screenshots to PNG for mails or documentation. As it's a simple paint program, you can also draw some rectangles to highlight findings etc.
As an alternative, there is also Paint.NET, but I kinda prefer Photofiltre, as it's small and quick and basic (in a pleasant way).

[tinhead]

attached Owon frontend (without trigger mux, sample/hold and REF DAC).

I wish i could draw rest of the DSO, but to e very honest the blue PCB is making me crazy,
maybe someone with better eyes can do the rest.

[rf-loop]

attached Owon frontend (without trigger mux, sample/hold and REF DAC).

I wish i could draw rest of the DSO, but to e very honest the blue PCB is making me crazy,
maybe someone with better eyes can do the rest.

Very nice work.
Please can you check  R10, C4 and C8 values. Feels littlebit strange.

[tinhead]

attached Owon frontend (without trigger mux, sample/hold and REF DAC).

I wish i could draw rest of the DSO, but to e very honest the blue PCB is making me crazy,
maybe someone with better eyes can do the rest.

Very nice work.
Please can you check  R10, C4 and C8 values. Feels littlebit strange.

C8 is 100pF, only the text above the cap is wrong, should be "C8 + C10 cal value 136pF" not 22.5pF
I have measured both together, from trimmer color code C8 might be 100-120pF

R10 is 01B which is 1k, so no error on schematic

C4 is measured 872pF, so next value is 870pF, no error on schematic

All caps values are real measured off board values, so they should be not that far from the real value.

[tinhead]

btw, i wrote before that the VGA out and buck converter nosie will be feeded back to opamp/ADC,
now from the scheamtic you can see this is not truth. The LMH6518 have separte and buffered aux output,
so the noise have only influence on trigger signal but not on ADC directly.

The indirect way, trough PCB/clock chip is os course still given, but this increase only phase noise of clock a bit,
so not really big issues on under 5k USD device.

Having not the frontend scheamtic should be clear for everybody that there is no bw/alias filter
before LMH6518, so everything is done within that chip.

Hack update - hack over AES implementation hole is working, so i can flash my own firmware but for some reason
it is not working properly (i don't have any menu heh). I ordered now a S3C2416 board and will continue
on that, i just don't wan't to shot the CryptoMemory chip because then i can throw the DSO in scrap.

[rf-loop]

attached Owon frontend (without trigger mux, sample/hold and REF DAC).

I wish i could draw rest of the DSO, but to e very honest the blue PCB is making me crazy,
maybe someone with better eyes can do the rest.

Very nice work.
Please can you check  R10, C4 and C8 values. Feels littlebit strange.

C8 is 100pF, only the text above the cap is wrong, should be "C8 + C10 cal value 136pF" not 22.5pF
I have measured both together, from trimmer color code C8 might be 100-120pF

R10 is 01B which is 1k, so no error on schematic

C4 is measured 872pF, so next value is 870pF, no error on schematic

All caps values are real measured off board values, so they should be not that far from the real value.

Thank you recheck these. These values feels strange (still thinking why they are as they are) and I was afraid some typing error. But now it is as it is.

[rf-loop]

Here same signal to three different scopes.
Owon, Hantek, Tektronix old analog scope (not very good one)
(Tek display have no focusing problem... but camera and eye is different. (also you see light difference, where electron beam use more time then phosphor is more bright... but camera dynamic is always very poor, far below animal eye... so it looks different as with eyes. But this brightness isnclude also information...) This analog have only normal basic phosphor type display. Not this special fast drawing microchannel tube. But this is not now meaningfull.
Tektronix signal was connected to input as Hnatek and Owon. With T and 50ohm terminator.
Tek have also 50ohm input (real, not "fake" 50 ohm.) If use this, signal is more pure square and also risetime then around 1.55 - 1.6ns. (signal itself on the generator output connector is 1.3ns rising)

Oscilloscope is for analyzing "unknown" signal.
What you analyze, you signal under test or your scope?

Both scopes, Hantek and Owon need better front end.

Specially it is useful for Owon becouse Owon ADC quality is enough for better front end.
I do not mean front end need be so different. But it need better "component final adjust" for better frequency and phase characteristics. No need change principle. Principle is acceptable enough. Input protection maybe need be better. I littlebit afraid it is easy to get "smoke out".

(Btw, Hantek pic show also this trigger bug.)

[rf-loop]

As asked, 10kHz square to both scopes and all settings same.

Then littlebit different.
(this sweep can not do with Hnatek becouse persistence can not use, so only with Owon.

Last pic is Owon 435MHz test, not 145MHz as read in picture file name. test. With 5MHz freq mod and with 100kHz modulation freq (not meningful here.) Zoomed 10x. Middle is 436MHz (1MHz wrong if my signal did not change),whole pic area is 75MHz.

Then turn also Hantek to around 435 MHz and zoomed 10x. With same signal as Owon, of course there is nothing (note also f resolution)
Then same without any signal. Btw, what  do Hantek designer... maybe he have never heard name Nyquist.

Middle of 500MHz sweep and 1x zoom there is 250MHz noise in Owon.  If use this sweeped freq response as flatness correction it can think that 250MHz noise is only 40dB below this level input signal - This is not so meaningful if think 100MHz scope but still it is not nice becouse reason is maybe only loose design - lack of reading National application notes.  I also believe that 200MHz model do not have this, it maybe have 500MHz noise becouse different faster ADC. (signal itself was 30mVrms and oscilloscope channel 1 was set 10mV/div ( around 8.5div p-p) in scope mode.  FFT filter set Hanning.