aioscilloscope / Hardware / Rigol DHO800 / DHO900

Inside the Rigol DHO800 / DHO900, chip by chip

A Rockchip RK3399 runs the scope; a Xilinx Zynq XC7Z015 FPGA catches the samples from one of Rigol's own 12-bit ADCs and hands them over PCIe. This page collects what the community has found inside these scopes and checks each claim against what we read on our own DHO924S while running our own software on it.

CH1The block diagram

Signal flows left to right across the top: input, front end, ADC, FPGA. The FPGA keeps the record in its own memory and streams it to the RK3399, which draws it. Solid lines carry data; dashed lines are slow control from the RK3399. Parts marked * are community findings we have not yet read on our own board.

Drawn by us from our unit's device tree, boot logs, PCIe configuration and FPGA registers, plus the community findings marked *.

CH2Every chip we know of

verified on our unit means we read it ourselves on our DHO924S: a boot log line, the live device tree, a register, the FPGA bitstream's ID code. public is a published claim we have not confirmed yet. unknown means nobody has shown it.

Part	Job	Connected by	How we know
Rockchip RK3399	Runs everything: OS, UI, drivers. 2 × Cortex-A72, 4 × Cortex-A53, Mali-T860 GPU	—	verified on our unit CPU IDs and GPU node
4 GB RAM	SoC memory	—	verified size. unknown type (LPDDR3 or 4)
32 GB SD card	The only storage: OS, calibration, files	SD bus, 4-bit, 50 MHz	verified SD protocol, 29.5 GiB. First found by EEVblog (a glued Lexar microSD)
Xilinx Zynq XC7Z015	Acquisition FPGA: capture, trigger, filters, record memory	PCIe Gen2 ×2 to the RK3399	verified from the bitstream's ID code (0x0373B093)
QSPI flash	The Zynq's own boot images: golden, update, calibration	Zynq QSPI	verified slot layout. public Winbond 128 Mbit (EEVblog boot log)
DDR3, PL side	Sample memory, 167.8 M points	The FPGA's own memory controller	verified controller and depth. public parts disputed: GigaDevice or Samsung K4B4G1646E
Rigol RT8847IQ ×1	12-bit ADC, 8 interleaved cores, 1.25 GSa/s on one channel	28 LVDS lanes to the FPGA	verified part, cores and lanes through the driver
Rigol RT1642 ×4	Front end per channel: gain, VGA, attenuator, filters, offset	Bit-banged SPI, 100 kHz	verified our driver reproduces the stock register state
TI LMX2582	The ADC's sample clock	Bit-banged 3-wire bus from the RK3399	verified part and programming. 1.25 GHz verified by the FPGA's 800 ps time tags
Generator (S models)	DDS in the FPGA at 156.25 MHz, one output	FPGA to DAC; relays on GPIO	verified DDS clock and wave tables. public AD9744 DAC
Logic analyser	16 lines straight into the FPGA, thresholds set by the FPGA	PLA2216 probe	verified registers. public comparators live in the probe
Front panel MCU	Keys, 7 knobs, LEDs	UART at 1.5 Mbaud, 5-byte frames, CRC-7	verified protocol. public GD32F350K8 + SM16306SJ LED drivers
7″ panel	1024 × 600, Jadard JD9365 controller	MIPI-DSI, 4 lanes, 68 MHz pixel clock	verified panel ID read-back
FocalTech FT5422	Capacitive touch, 10 points	I²C, address 0x38	verified chip ID 0x5422
HDMI	The RK3399's own HDMI transmitter	—	verified 1080p into a capture card
Motorcomm YT8512	Ethernet PHY, 100 Mb/s	RMII	verified PHY ID
RK808 + SYR827/828	Power management, CPU and GPU rails	I²C	verified
MB85RC64	8 KiB FRAM: saved setup	I²C, 0x50	verified device. Its layout: see corrections
HUSB238	USB-C power delivery sink, 15 V	—	public (EEVblog teardown thread)

CH3Clocks and the data path, with numbers

One ADC, shared. A single RT8847IQ with eight cores samples at 1.25 GSa/s for one channel, 625 MSa/s for two and 312.5 MSa/s for four.
ADC to FPGA: 28 LVDS lanes, each one trained at power-up with a programmable delay and bit-slip against a test pattern. 1.25 GSa/s × 12 bit is 15 Gb/s.
Sample clock: the LMX2582, programmed by the RK3399 before the FPGA starts. The FPGA's time tags count 800 ps ticks, which is one sample at 1.25 GSa/s.
FPGA to RK3399: PCIe Gen2 with two lanes (5 GT/s each, about 1 GB/s after encoding). The device tree allows four lanes, but the FPGA's end only offers two, and that is what the link trains to.
Re-arm: inside a run of records, the FPGA needs about 23.8 µs per frame beyond the record itself, measured from its own trigger time tags. That caps a record sequence near 41,000 frames a second.
Read-out: the FPGA plays a record out of its memory at about 130 to 145 MSa/s, and it records or plays, never both at once.
What NovaOS gets from it today: about 31,000 waveforms a second at 20 ns/div and 10,000 at 2 µs/div, every one counted into the density display.

The FPGA side, block by block and with how we measured it, is on Inside the Rigol FPGA.

CH4Myths and corrections

Where a published claim and our own reading of the unit disagree, both are here. Nobody is wrong for asking; most of these come from a careful post with less evidence than we happened to have.

“The RT1642IQ is the ADC”

corrected One teardown-thread post called the RT1642IQ the ADC. On our unit the RT1642 is the per-channel front end: four of them, one per channel, each set up over its own chip select. The ADC is the RT8847IQ, which sits behind the FPGA. The original teardown post had it right.

“The FPGA link is PCIe x4”

corrected The published device tree says four lanes, and the RK3399 can do four. The Zynq's PCIe endpoint advertises only two, and the link trains at Gen2 ×2 (5 GT/s per lane). We read this from the PCIe configuration space on our unit.

“8 GB of internal memory”

clarified The datasheet lists 8 GB of internal non-volatile memory. There is no separate memory chip: everything, including the OS, lives on one 32 GB SD-protocol card (29.5 GiB on ours), as Dave Jones found when he pulled a glued-in Lexar microSD. The 8 GB is most likely the share offered to the user.

“The board has a voltage monitor, temperature sensors and an RTC chip”

corrected The stock device tree, which has been published, declares an ADC128D818 monitor, five TMP421 sensors and an RX8010 real-time clock. On our DHO924S none of them answers on any of 13 logged boots, so they are not fitted. That also explains the reports of the clock starting in 2013: the only clock left is the power-management chip's.

“1,000,000 waveforms a second”

open A forum post says the DHO reaches a million waveforms a second in UltraAcquire, and Rigol's MHO900 help gives the same figure for that scope. On the DHO's FPGA, driven with the same record settings, we measure at least 23.8 µs between frames from the FPGA's own time tags: about 41,000 frames a second at most. We could not measure the stock software directly, because it has no rate readout. Reading its frame headers would settle it, and we will report what we find.

“The FRAM holds the calibration at 0x800”

open A forum post puts calibration data at 0x800 in the FRAM. What we have read says the stock app keeps its last setup there. It may differ between firmware versions; a read-only dump on our unit will settle it.

“DHO800 and DHO900 are the same hardware”

mostly confirmed Both run the same FPGA image from the same firmware package, on the same main design. The community has shown that DHO900 boards add the logic-analyser connector, extra memory and the generator parts, and two-channel models leave a front end unfitted.

Still unknown, and how we will check

The RK3399's RAM type: from the memory loader's banner on the serial console at power-on.
The LMX2582's reference clock: by decoding its 46 register words against TI's datasheet.
Markings: the Zynq's speed grade, the ADC, the generator DAC, the panel MCU, the sample memory parts and their speed. These need photos of our own open unit.
Whether the Zynq's ARM side has its own RAM: its boot loader sets up a memory controller; a board photo will say if a chip is fitted.

Credits and sources

This page stands on the community's work. Thank you to everyone in the EEVblog threads, especially Azusa (the first teardown photos and part list), Nikki Smith (the generator), Norbert Kiszka (the PLL tool and years of digging), Dave Jones (the teardown video, boot logs and the SD card), Mechatrommer, TurboTom, Martin72, souldevelop, Spectra and MatthiasElectronic (an open generator board).

EEVblog forum: Rigol's new DHO800 oscilloscope unbox & teardown
EEVblog forum: Hacking the Rigol DHO800/900 scope
EEVblog #1563, the DHO800 teardown video, and Dave Jones's board photos
Norbert Kiszka's projects: github.com/norbertkiszka
MatthiasElectronic's open generator board: AWG_DHO8-900
Rigol's DHO800/DHO900 data sheet; AMD/Xilinx DS190 and UG470; TI's LMX2582 data sheet

Found a mistake, or have a photo of a marking we list as unknown? [email protected]. We will credit you and correct the page.