aioscilloscope / Hardware / Rigol MHO900

Inside the Rigol MHO900, chip by chip

The MHO900 keeps the DHO's RK3399 and Rigol's own front-end and ADC chips, then doubles the ADCs, swaps the Zynq for a much larger FPGA loaded from a file at every boot, and adds a two-channel generator with its own microcontroller. This page checks what has been published about it against what we read on our own MHO934.

CH1The block diagram

Signal flows left to right across the top: input, front end, the two ADCs, the FPGA. Solid lines carry data; dashed lines are control from the RK3399. Parts marked * we read from published teardown photos of an MHO98, the same family, rather than from our own board.

Block diagram of the Rigol MHO900 Four BNC inputs, 1 megohm or 50 ohm, feed four Rigol RT1642 front-end chips with relays and an overload sense line, then two Rigol RT8847IQ 12-bit ADCs, 16 cores in all, at 4 GSa/s on one channel, clocked at 2 GHz by a TI LMK04826 from a 10 MHz reference. The ADCs send 56 LVDS lanes to the FPGA, a Fudan FMK230T on most boards or a Xilinx Kintex-7 XC7K160T, which captures, corrects the interleave, filters, triggers and records into a 64-bit DDR3 memory. It drives two generator channels over JESD204B to a TI DAC38J82, run with a GigaDevice GD32F350K8 microcontroller, and receives 16 logic-analyser lines. It connects to the Rockchip RK3399 over PCIe Gen2 x4 with Xilinx XDMA, and the RK3399 loads its configuration from a file over SPI at every boot. The RK3399 programs the clock chip and front ends over bit-banged buses, talks to the front panel over a 1.5 Mbaud UART, and drives the 7-inch 1024x600 MIPI-DSI panel, HDMI, Ethernet and USB. CH1–CH4BNC1 MΩ / 50 Ω Front end ×4 relays · photo-MOS*Rigol RT1642 AFE1 MΩ and 50 Ω paths50 Ω overload sense20 MHz BW limit ADC ×2Rigol RT8847IQ12-bit · 16 cores4 GSa/s (1 ch)2 / 1 GSa/s(2 / 4 ch) 56 LVDSlanes TI LMK0482610 MHz refVCO 2 GHz 2 GHz Fudan FMK230Tor Xilinx XC7K160T logic: lane capture, IDELAY16-lane interleave fixsinc · FIR filterstrigger enginemin/max compressionrecord / play FSMXDMA PCIe endpointJESD204B to the DAC configured from a fileat every boot(no FPGA flash) DDR3, 64-bit4 × x16 parts*sample memory Generator ×2DDS in the FPGAJESD204B (GTX)TI DAC38J82*THS3491 drivers*GD32F350K8 MCU*on a 115200 UART Logic analyser16 linesPLA2216 probe PCIe Gen2 ×4 · 5 GT/sXilinx XDMA bitstreamover SPI,slave serial,each boot 3-wireGPIO bit-banged SPI+ range GPIO Rockchip RK33992× Cortex-A72 + 4× A53Mali-T860 GPU4 GB RAM32 GB SD card (boot)RK808 PMIC · RX8010 RTC Front panelkeys · knobs · LEDsMCU part unconfirmed UART 1.5 Mbaud 7″ panel 1024×600MIPI-DSI ×4FT5422 touch (I²C) HDMI out (on-chip TX) Ethernet 100 Mb · USB analog FPGA clock host generator / LA * read from published MHO98 photos
Drawn by us from our MHO934's device tree, boot logs, PCIe link, FPGA bitstreams and registers, plus the photo readings marked *.

CH2Every chip we know of

verified on our unit means we read it ourselves on our MHO934. photo means we read the marking from Dave Jones's published MHO98 teardown photos: the part is certain, but another production board could differ. public is a published claim we have not confirmed. unknown means nobody has shown it.

PartJobConnected byHow we know
Rockchip RK3399Runs everything. 2 × Cortex-A72, 4 × Cortex-A53, Mali-T860—verified on our unit
4 GB RAMSoC memory—verified size. photo two CXMT parts, likely LPDDR4
32 GB SD cardThe only storageSD busverified SD protocol, 29.2 GiB
Fudan FMK230TAcquisition FPGA on most boards (hardware codes 2 to 7), Rigol-marked RT6888IFPCIe Gen2 ×4verified our unit loads the image whose header names the FMK230T, ID code 0x02236143. photo marking
Xilinx XC7K160TThe same design, built for hardware code 1PCIeverified in the firmware (ID code 0x0364C093). unknown whether such boards shipped
DDR3, 64-bitSample memoryThe FPGA's own memory controllerverified depth the engine uses. photo four GigaDevice x16 parts
Rigol RT8847IQ ×212-bit ADCs, 8 cores each: 4 / 2 / 1 GSa/s for 1 / 2 / 4 channels56 LVDS lanesverified both brought up by our engine. photo two markings
Rigol RT1642 ×4Front end per channel, with a 50 Ω modeBit-banged SPIverified the same register map as the DHO's
TI LMK04826Clock: 10 MHz in, VCO 2 GHz, ADC and transceiver clocksBit-banged 3-wire busverified chip ID and PLL lock read back. photo marking
TI DAC38J82Dual generator DACJESD204B from the FPGA's transceiversphoto marking. verified the FPGA's link-up flag
GigaDevice GD32F350K8Generator board MCU: relays and output stagesUART, 115200 baud, text commandsverified the link: it answers an identity query. photo marking
TI THS3491 ×2Generator output drivers—photo and public (Norbert Kiszka)
Front panel MCUKeys, knobs, LEDsUART at 1.5 Mbaudverified the same protocol as the DHO. unknown part
7″ panel1024 × 600MIPI-DSI, 4 lanes, 68 MHzverified
FocalTech FT5422Capacitive touch, 10 pointsI²C, 0x38verified chip ID 0x5422
HDMIThe RK3399's own transmitter—verified
Motorcomm YT8512CEthernet PHY, 100 Mb/sRMIIverified driver and link. photo suffix
Epson RX8010SJReal-time clock (the DHO's board leaves it off)I²Cverified
RK808 + SYR827/828Power managementI²Cverified
HUSB238, TI TPS51397USB-C 20 V input, main buck—photo

CH3The FPGA: FMK230T, K160T, or something else?

The MHO900 firmware carries two acquisition bitstreams and picks one from a hardware code wired on the board. We parsed both, packet by packet, as AMD/Xilinx's configuration guide (UG470) describes the format:

Image for code 1Image for codes 2 to 7
Part named in the header7k160tffg676FMK230T
ID code it writes0x0364C093 (Xilinx XC7K160T)0x02236143 (not a Xilinx code)
Configuration frames16,56020,520
Configuration bits53,540,576: exactly Xilinx's figure for the XC7K160T66,339,296: no Xilinx part has this size

What the FPGA does, block by block, is on Inside the Rigol FPGA.

CH4Clocks and the data path

Myths and corrections

Where a published claim and our own reading of the unit disagree, both are here, with thanks to whoever raised it.

“The FPGA is an FM230T”

corrected One teardown post named it FM230T. The bitstream's own header says FMK230T, and distributors sell it as the FMK230T8. dc101's reading of the same file on EEVblog agrees.

“It is a custom acquisition ASIC”

corrected The teardown video called the big chip an acquisition ASIC, with a hint that it was not what it seemed. It is an FPGA: the RK3399 configures it from a bitstream file at every boot and waits for its done signal.

“A 16-core ADC”

corrected Our own earlier text said this. There are two RT8847IQ ADCs with eight cores each: 16 cores, interleaved across two chips.

“32 GB of internal memory”

clarified That is the SD card the scope boots from; there is no separate eMMC. Forum members found the card, and our unit's kernel sees an SD-protocol device of 29.2 GiB.

“The MHO900 is a DHO900 inside”

partly The processor, the front-end chip and the ADC chip are the same, and the software grew from the DHO's. The FPGA, its loading and memory, the clock chip, the number of ADCs, the PCIe width and the whole generator are new.

“Two 2 GSa/s ADCs make 4 GSa/s”

confirmed Two ADCs, a 2 GHz ADC clock, and 4 GSa/s only with one channel.

“The front-end chip does the 50 Ω termination”

consistent The 50 Ω mode is a path in the RT1642's own register set, switched together with the range lines. Whether the resistor itself is on the chip we cannot tell from software.

“1,000,000 waveforms a second”

open Rigol's help gives this for UltraAcquire. We have not measured triggered rates on our MHO yet. On the DHO's FPGA the same kind of record sequence needs about 23.8 µs per frame (see the FPGA page).

Still unknown, and how we will check

Credits and sources

Thank you to Dave Jones (EEVblog #1717 and its photo album, whose markings we read but do not copy), dc101 (the first bitstream reading), PELL and thm_w (the FPGA marking), 0xdeadbeef, Norbert Kiszka, Martin72, 2N3055, SiliconWizard and faveri97.

Have a photo of an MHO900 board, especially one with a Xilinx-marked FPGA? [email protected].