Hacking the Rigol DS1052E Oscilloscope With Linux

I was in the market for an oscilloscope, but I didn't want to spend much.  I found out about Rigol and their line of $300-400 scopes, and was getting ready to buy one.  Then I found a post on how to make your DS1052E, which costs about $400 into a DS1102E, which costs about $700 with a simple firmware modification!  I bought the scope right after, and I received it in the mail today.  It's pretty nice by default, but doubling the bandwidth is always a plus.

The DS1052E has a 50Mhz maximum frequency, but it has exactly the same hardware (as far as the reverse-engineering folks can tell) as the DS1102E, which has a 100Mhz maximum.  This guide will show you how to make the switch very easily using Linux.  You can do it in Windows too, but it's a bit more involved, and Linux makes it really really easy.

I've attached the Rigol user guide for both units, in case you don't have one.

WARNING: It's entirely likely that this completely voids your warranty.  Make sure you know what you're doing - you can brick your scope if you screw anything up.

Step 1: Spec Comparison

Here are the specs of the 2 scope models.  Our test to see if we've succeeded is by looking at the Time Base Range minimum setting - the DS1052E has a 5ns/div setting, where the DS1102E has a 2ns/div setting - a much more accurate view for sure!

Step 2: Get Linux Running

The first step is to get Linux going if you don't already have it.  I use Ubuntu 10.10 as my desktop OS, so I was able to skip this step.  If you don't want to continue running Linux, and just want to get this scope flashed, you can download the Ubuntu LiveCD, burn it, and boot from it.  

Step 3: Change the Language If Necessary

My Rigol booted up into Chinese the first time, and it took me a while to figure out where the menu was to change it to English.  Press the Utility button, then press the second to last menu button over and over until you get to English, then push the Menu On/Off button to go back.

Step 4: Find Your Firmware Version

You can find the System Info menu item in the same Utility menu as before, just on the last page.

As you can see in the picture, I've got firmware 02.05.00.00 HardVersion 58. You can get all these details by going into the System Info dialog, pressing CH1 twice, then CH2 twice, then MATH once.  Just be very careful once you do that sequence - apparently you can screw stuff up if you press anything other than RUN/STOP at this point.

Step 5: Prepare the Software

I used this extremely good forum writeup as a guide for the process.  As more firmware versions come out, the post will be updated, and this instructable might not.  Therefore, in this step, you need to click the link above, and find something resembling the following:

DS1052_to_DS1102.zip

This file contains a collection of different firmwares.  At this point, for my original firmware, I needed the following parts:

02.02.SP2_patched_to_02.05.01.02
02.04.SP1_original

The first one has a hex-edited version of firmware 02.02.SP2 that makes a 02.05 Rigol think it's an upgrade when it's really a downgrade.  You need to downgrade to 02.02.SP2 to enable the modifications we're going to make.  Refer to the forum post for more instructions if you have a different firmware than I have.

I simply put the first firmware on a USB key (02.02.SP2_patched_to_02.05.01.02) in the root.  The key was formatted with FAT16.  Then, I safely ejected the key, put it back in the computer, mounted it, and ran the following:

md5sum DS1000EUpdate.RGL

I compared this to the .md5 file that was also in the directory from the zip file.  They matched.

If they don't match, DO NOT CONTINUE.  YOU WILL PROBABLY BRICK YOUR SCOPE.

Step 6: Load the 02.02 Firmware Onto the Scope

1. Put the key in the scope
2. It will prompt you to update.  Do it
3. Once it's complete, it says "Updata successed,please restart", the best message ever.
4. Push the power button on the top
5. Unplug the USB key
6. Push the power button again to turn it on.  You should see the new version in the splash screen.

Step 7: Execute USB Commands

Now that we're running the old firmware, we can do the traditional hack to change this scope.

I found this post really handy for this step.  Hook up the USB cable to the back of the unit.  Any generic USB cable will do - there's nothing special about it.  I used one from my Arduino :).  Once you have the device connected, make sure using dmesg:

[159486.820070] usb 4-2: new full speed USB device using ohci_hcd and address 11
[159487.214647] usbcore: registered new interface driver usbtmc

If you don't see that, try a different Linux (a newer kernel perhaps?) or check your connections a few times.  I'm using Ubuntu 10.10, and it worked perfectly the first time.  Now, we just need to get our commands straight.  The first command sets the model number.  You should probably leave this line as-is:

echo ":INFO:MODEL DS1102E" | sudo tee /dev/usbtmc0

This second line is where you have some wiggle room. Apparently, the firmware cares what your serial number is, so you have to make it a valid DS1102E serial number. The following was taken from the cited blog post above, and he states it was found in an eBay auction. Your original serial number is on the back sticker on the case in case you ever want to change it back.

echo ":INFO:SERIAL DS1EB11305432" | sudo tee /dev/usbtmc0

There.  That's all you need to do with your computer.  At this point, the scope had locked up on me, so I just unplugged it from the USB and rebooted it.  Then, I went into the System Info and checked the model and serial numbers.  See the picture.

Step 8: Flash an Actual DS1102E Firmware

Now that we've gone through all that pain, we have to do one last flash of a working DS1102E firmware to finish the job.  Do it exactly the same as step 4, except this time use the firmware specified in the forum post for your model.  I used 02.04.SP1, which was included with the zip file.  The process is literally exactly the same as step 4, so you can just follow that.

Step 9:

Once the update completes and you've restarted the unit, take a look at the System Info.  You should see DS1102E, the serial number you punched in, and firmware 02.04.SP1.  

Step 10: Test It!

Now, let's see if the scope can measure down to 2ns increments!  

Step 11: Update: Acquired My First Images!

Below you can see my test waveform from the probe compensation terminals.  I've also enabled Delayed Scan mode to get both zoomed and full waveforms on the screen.  It's a cool effect.

Step 12: Update: Testing (Not Mine)

There was some discussion in the comments that I didn't have enough testing in here.  That's mainly because I don't have a function generator (yet), and I had other results to look at.  There's some true scope enthusiasts who've confirmed this mod works by using a function generator and looking at the maximum analog bandwidth and rise times.  Going through the eevblog forum post gets some good results.  This is a sampling:

Here's an analysis using a sine wave of the analog bandwidth.

Rigol DS1102E 100MHz 1GS/S
Start:100kHz End:117MHz
Notes:Used 16X average. Real Time. Equivalent seems to extend bandwidth. I still have to research the difference between the two.

Rigol DS1052E 50MHz 1GS/S (This is the modded scope)
Start:100kHz End:123MHz
Notes:Used 16X average. Real Time. Equivalent seems to extend bandwidth.
Yes really slightly better then the real DS1102E I went back and forth several times.

Here's it against a 200Mhz Tek and an unmodified unit. Notice how much the waveform looks like the Tek image?
Here's someone measuring a 109Mhz signal with a modified unit.  Looks great!