aioscilloscope / Hardware / Rigol DHO800 / DHO900

Inside the Rigol DHO800 / DHO900, chip by chip

A Rockchip RK3399 runs the scope; a Xilinx Zynq XC7Z015 FPGA catches the samples from one of Rigol's own 12-bit ADCs and hands them over PCIe. This page collects what the community has found inside these scopes and checks each claim against what we read on our own DHO924S while running our own software on it.

CH1The block diagram

Signal flows left to right across the top: input, front end, ADC, FPGA. The FPGA keeps the record in its own memory and streams it to the RK3399, which draws it. Solid lines carry data; dashed lines are slow control from the RK3399. Parts marked * are community findings we have not yet read on our own board.

Block diagram of the Rigol DHO800/DHO900 Four BNC inputs feed four Rigol RT1642 front-end chips, then one Rigol RT8847IQ 12-bit ADC with eight cores at 1.25 GSa/s, clocked by a TI LMX2582. The ADC sends 28 LVDS lanes to a Xilinx Zynq XC7Z015. The FPGA's logic captures, filters, triggers and records into its own DDR3 memory, and boots from its own QSPI flash. It drives the generator's DAC and receives the 16 logic-analyser lines. It connects to the Rockchip RK3399 over PCIe Gen2 x2 at 5 GT/s using Xilinx XDMA, plus a 10 MHz SPI control link to its ARM side. The RK3399 programs the LMX2582 and the front ends over bit-banged buses, talks to the front-panel MCU over a 1.5 Mbaud UART, and drives the 7-inch 1024x600 MIPI-DSI panel, HDMI, Ethernet and USB. CH1–CH4BNC1 MΩ Front end ×4 relays · attenuatorRigol RT1642 AFEgain · VGA · offset20 MHz BW limitLC filter* ADCRigol RT8847IQ12-bit · 8 cores1.25 GSa/s (1 ch)625 / 312.5 MSa/s(2 / 4 ch) 28 LVDSlanes TI LMX2582sample clock 1.25 GHz Xilinx ZynqXC7Z015 logic (PL): lane capture, IDELAYinterleave trimssinc · FIR filterstrigger enginemin/max compressionrecord / play FSMXDMA PCIe endpoint ARM side (PS):boot loader +flash serverno Linux DDR3 (PL)sample memory167.8 M points QSPI flashgolden · update· calibration Generator (S)DDS 156.25 MHzAD9744 DAC*relays → GI out Logic analyser16 linesPLA2216 probe PCIe Gen2 ×2 · 5 GT/sXilinx XDMA SPI 10 MHz(boot cmds) 3-wireGPIO bit-banged SPI100 kHz + GPIO Rockchip RK33992× Cortex-A72 + 4× A53Mali-T860 GPU4 GB RAM32 GB SD card (boot)RK808 PMIC Front panelkeys · 7 knobs · LEDsGD32F350K8 MCU* UART 1.5 Mbaud 7″ panel 1024×600MIPI-DSI ×4 · JD9365FT5422 touch (I²C) HDMI out (on-chip TX) Ethernet 100 Mb · USB analog FPGA clock host generator / LA * community finding, not yet read on our unit
Drawn by us from our unit's device tree, boot logs, PCIe configuration and FPGA registers, plus the community findings marked *.

CH2Every chip we know of

verified on our unit means we read it ourselves on our DHO924S: a boot log line, the live device tree, a register, the FPGA bitstream's ID code. public is a published claim we have not confirmed yet. unknown means nobody has shown it.

PartJobConnected byHow we know
Rockchip RK3399Runs everything: OS, UI, drivers. 2 × Cortex-A72, 4 × Cortex-A53, Mali-T860 GPU—verified on our unit CPU IDs and GPU node
4 GB RAMSoC memory—verified size. unknown type (LPDDR3 or 4)
32 GB SD cardThe only storage: OS, calibration, filesSD bus, 4-bit, 50 MHzverified SD protocol, 29.5 GiB. First found by EEVblog (a glued Lexar microSD)
Xilinx Zynq XC7Z015Acquisition FPGA: capture, trigger, filters, record memoryPCIe Gen2 ×2 to the RK3399verified from the bitstream's ID code (0x0373B093)
QSPI flashThe Zynq's own boot images: golden, update, calibrationZynq QSPIverified slot layout. public Winbond 128 Mbit (EEVblog boot log)
DDR3, PL sideSample memory, 167.8 M pointsThe FPGA's own memory controllerverified controller and depth. public parts disputed: GigaDevice or Samsung K4B4G1646E
Rigol RT8847IQ ×112-bit ADC, 8 interleaved cores, 1.25 GSa/s on one channel28 LVDS lanes to the FPGAverified part, cores and lanes through the driver
Rigol RT1642 ×4Front end per channel: gain, VGA, attenuator, filters, offsetBit-banged SPI, 100 kHzverified our driver reproduces the stock register state
TI LMX2582The ADC's sample clockBit-banged 3-wire bus from the RK3399verified part and programming. 1.25 GHz verified by the FPGA's 800 ps time tags
Generator (S models)DDS in the FPGA at 156.25 MHz, one outputFPGA to DAC; relays on GPIOverified DDS clock and wave tables. public AD9744 DAC
Logic analyser16 lines straight into the FPGA, thresholds set by the FPGAPLA2216 probeverified registers. public comparators live in the probe
Front panel MCUKeys, 7 knobs, LEDsUART at 1.5 Mbaud, 5-byte frames, CRC-7verified protocol. public GD32F350K8 + SM16306SJ LED drivers
7″ panel1024 × 600, Jadard JD9365 controllerMIPI-DSI, 4 lanes, 68 MHz pixel clockverified panel ID read-back
FocalTech FT5422Capacitive touch, 10 pointsI²C, address 0x38verified chip ID 0x5422
HDMIThe RK3399's own HDMI transmitter—verified 1080p into a capture card
Motorcomm YT8512Ethernet PHY, 100 Mb/sRMIIverified PHY ID
RK808 + SYR827/828Power management, CPU and GPU railsI²Cverified
MB85RC648 KiB FRAM: saved setupI²C, 0x50verified device. Its layout: see corrections
HUSB238USB-C power delivery sink, 15 V—public (EEVblog teardown thread)

CH3Clocks and the data path, with numbers

The FPGA side, block by block and with how we measured it, is on Inside the Rigol FPGA.

CH4Myths and corrections

Where a published claim and our own reading of the unit disagree, both are here. Nobody is wrong for asking; most of these come from a careful post with less evidence than we happened to have.

“The RT1642IQ is the ADC”

corrected One teardown-thread post called the RT1642IQ the ADC. On our unit the RT1642 is the per-channel front end: four of them, one per channel, each set up over its own chip select. The ADC is the RT8847IQ, which sits behind the FPGA. The original teardown post had it right.

“The FPGA link is PCIe x4”

corrected The published device tree says four lanes, and the RK3399 can do four. The Zynq's PCIe endpoint advertises only two, and the link trains at Gen2 ×2 (5 GT/s per lane). We read this from the PCIe configuration space on our unit.

“8 GB of internal memory”

clarified The datasheet lists 8 GB of internal non-volatile memory. There is no separate memory chip: everything, including the OS, lives on one 32 GB SD-protocol card (29.5 GiB on ours), as Dave Jones found when he pulled a glued-in Lexar microSD. The 8 GB is most likely the share offered to the user.

“The board has a voltage monitor, temperature sensors and an RTC chip”

corrected The stock device tree, which has been published, declares an ADC128D818 monitor, five TMP421 sensors and an RX8010 real-time clock. On our DHO924S none of them answers on any of 13 logged boots, so they are not fitted. That also explains the reports of the clock starting in 2013: the only clock left is the power-management chip's.

“1,000,000 waveforms a second”

open A forum post says the DHO reaches a million waveforms a second in UltraAcquire, and Rigol's MHO900 help gives the same figure for that scope. Inside a record sequence the DHO's FPGA records a frame every 1.44 µs at 1 kpts, about 694,000 frames a second, from its own time tags, so the hardware is in that range; what a scope then displays depends on how fast its software reads and draws them. (A ~20 µs per-frame cost we measured earlier turned out to be a setting of our own start-up.) We could not measure the stock software directly, because it has no rate readout. Reading its frame headers would settle it, and we will report what we find.

“The FRAM holds the calibration at 0x800”

open A forum post puts calibration data at 0x800 in the FRAM. What we have read says the stock app keeps its last setup there. It may differ between firmware versions; a read-only dump on our unit will settle it.

“DHO800 and DHO900 are the same hardware”

mostly confirmed Both run the same FPGA image from the same firmware package, on the same main design. The community has shown that DHO900 boards add the logic-analyser connector, extra memory and the generator parts, and two-channel models leave a front end unfitted.

Still unknown, and how we will check

Credits and sources

This page stands on the community's work. Thank you to everyone in the EEVblog threads, especially Azusa (the first teardown photos and part list), Nikki Smith (the generator), Norbert Kiszka (the PLL tool and years of digging), Dave Jones (the teardown video, boot logs and the SD card), Mechatrommer, TurboTom, Martin72, souldevelop, Spectra and MatthiasElectronic (an open generator board).

Found a mistake, or have a photo of a marking we list as unknown? brady@aioscilloscope.com. We will credit you and correct the page.