New Rigol RSA5000 Real Time Spectrum Analyser

[EEVblog]

https://www.rigolna.com/real-time/?utm_term=Cover%20image

[Johncanfield]

Please forgive this probably stupid question,  but aren't all SA's "real time", (I have a Siglent SA.)

[1anX]

9kHz to 6.5gig make this analyser perfect for my uses!
Tear it down Dave, and give us your verdict, the sooner the better, as have been considering Siglent's offering!

[TheSteve]

Please forgive this probably stupid question,  but aren't all SA's "real time", (I have a Siglent SA.)

No, most sweep the frequency range you've got selected. As a result if a signal is not present when the spectrum analyzer tunes to that specific frequency during the sweep you won't see it. This is pretty common with frequency hopping transmissions etc. A realtime spectrum analyzer will sample a given bandwidth(often around 40 MHz) so you can see that entire range at once and constantly so you won't miss short transmissions etc.

[Devov]

I was expecting them to launch a new DSA, the 800 series are getting pretty old and were out-competed by the new Siglents.  I was hoping for a redesign with a snappier UI refresh rate, bigger screen, but still a budget device in the ~$3k range.  These RSA5000 are $9k+ with a tracking generator.

[Andrey_irk]

I hope they'll send one to Shahriar and he'll have enough time to do a proper review.

In this price range it will be hard for them to compete with companies like KS or R&S. I mean, even if this SA is a bit cheaper than the competitors, customers will think twice before buying it as the Rigol is unlikely to offer the same service and support.

[TurboTom]

Sorry for the pessimistic attitude but I don't know where Rigol hired their product designers recently. Their electronic load was front-panel design-wise a nightmare and this SA is no better. I see three times "Spectrum analyzer" written / embossed on the panel -- yes, I know it's a spectrum analyzer... I didn't count the fonts used and the round about ten different shapes of buttons definitely don't make it better. Since this instrument is clearly aimed at the (semi-) professional users, whom do they intend to attract with a design like that? Actually, in order to convince me to buy a device like this, it's got to have superb technical features and be more than a bargain to make me overlook the abominating appearance 

I considered Rigol a serious contender in the inexpensive measurement instrument market but with this recent move, they are making a joke of themselves. I only hope they got the internals right this time, other than with the DL3000.

Cheers,
Tom

[simone.pignatti]

Please forgive this probably stupid question,  but aren't all SA's "real time", (I have a Siglent SA.)

Hello, RSA5000 has two modalities:
GPSA : general purpose spectrum analyzer, sweep mode like Rigol DSA800 and Siglent SSA3000X
RTSA : real time spectrum analyzer where you have 25MHz standard or 40MHz optional real time bandwidth analysis. this will allow you to have 25 or 40MHz span real time BW from the center frequency you want to analyze.

here is the link to download the Rigol app note "Realtime Spectrum Analyzer Vs Spectrum Analyzer"
https://www.batterfly.com/PDF/RIGOL/Appnote-Real-Time-Rigol.pdf

I'm here to help if I can answer more tech questions, cheers!

[MattSR]

If the vertical axis is amplitude, horizontal is freq, so what do the colours mean?

[simone.pignatti]

from the user manual:
"The Density view is displayed combined with the persistence view. X-axis represents frequency, Y-axis represents amplitude, Z-axis represents number of hits, and T-axis represents time. This view displays four dimensional data on a two dimensional display, using color to represent Z-axis and brightness to represent T-axis."
please look for the word "color" into the user manual and the application note, you will find a detailed description.

here is the link to the user manual:
https://www.batterfly.com/PDF/RIGOL/RSA5000_UserGuide_EN.pdf

[borjam]

If the vertical axis is amplitude, horizontal is freq, so what do the colours mean?

If the vertical axis is amplitude, horizontal is freq, so what do the colours mean?

The amount of time that each amplitude value has been recorded for each frequency. It's a heat map.

That red line shows that most of the time the band was somewhat idle and transmissions were intermitent. This is an example from a very modest spectrum analyzer in which you can see what a constant carrier looks like.

The left signal is an analog audio/video transmitter working on 2.4 GHz and the reason why it was a nightmare to set up a WiFi network on the first channels The center signal is a WiFi network, you can see thanks to its color that transmissions are not so frequent.

[nctnico]

In this price range it will be hard for them to compete with companies like KS or R&S. I mean, even if this SA is a bit cheaper than the competitors, customers will think twice before buying it as the Rigol is unlikely to offer the same service and support.

I agree. In this price range buyers will require a device which works and bugs fixed immediately. If you look at Rigol's more expensive equipment then you'll notice that getting a similar device from an A-brand doesn't cost that much extra. So why take the risk? And then there is also the second hand market.

[simone.pignatti]

We have just got the unit today and next week I will start making tests.
Actually the list of companies waiting to see a demo is pretty long and we will learn more while visiting them.
Back to the bugs, I remember when TEK RSA was introduced was a nightmare for installing the SW and for many other issue, not sure they have solved all of them.
However ... I'm excited about the new product so I can learn more about applications.

I'm pretty sure Rigol is not giving up the entry level market and will bring more exciting models in the future.

[Mechatrommer]

So why take the risk? And then there is also the second hand market.

i briefly checked 2nd hand market in ebay yesterday. the cost is similar to this NIB rigol... anyway, $10K is not in my affordable list right now, neither 1st nor 2nd hand market...

[simone.pignatti]

few real images just got it

[taydin]

I hope they'll send one to Shahriar and he'll have enough time to do a proper review.

In this price range it will be hard for them to compete with companies like KS or R&S. I mean, even if this SA is a bit cheaper than the competitors, customers will think twice before buying it as the Rigol is unlikely to offer the same service and support.

Did you ever look at how much a real time SA from KS, R&S, or Tektronix costs? I am looking at the prices for a few months now, and you can't get ANY RTSA from these companies under 35,000 dollars!

Examples:

Tektronix RSA5xxx: 25 MHz RTBW and 13.5 GHz BW, absolutely NO options at all costs $54,000
Keysight  N9020B: 25 MHz RTBW and 13.5 GHz BW, absolutely NO options at all costs $47,000

I am very enthusiastic about this Rigol offering and I applaud them for offering a 25 MHz RTBW SA for a price around $10,000. It will do 90% of what the big boys do, but without those insanely low noise figures etc. And if you need those, then you probably already have millions of dollars at your disposal to get the best that's available.

[taydin]

In fact, the "around $10,000" figure includes tracking generator, pre-amp option. With the big boys, the pre-amp option costs thousands of dollars extra, and they don't have a tracking generator by default.

[Sparky]

From Rigol's website the options Realtime Bandwidth, Advance Measurements and PreAmplifier are all software license options.  What about the "High Stability Clock" option (OCXO-C08) mentioned in the datasheet?  I don't see any different pricing for this option so I wonder how it's specified at purchase and what it cost.

Looking foward to Dave and Shahriar doing in-depth review, teardown and discussion! 

[simone.pignatti]

Part number OCXO-C08 euro 695.-net

[taydin]

Another very good option for a RTSA that won't cost you an arm, leg, or kidneys is the Signal Hound SM200A. 20 GHz analysis bandwidth, 160 MHz (!) RTBW, and overall better noise figure compared to the Rigol. Price is similar to Rigol's offering, but as far as I can see, it doesn't have built in TG.

But for me the disadvantage with the SM200A is that it isn't represented in Turkey, so it will get more expensive with all the import procedures, duties etc. I'm looking into getting either the RSA5000 or the SM200A soon.

[chriswebb]

Another very good option for a RTSA that won't cost you an arm, leg, or kidneys is the Signal Hound SM200A. 20 GHz analysis bandwidth, 160 MHz (!) RTBW, and overall better noise figure compared to the Rigol. Price is similar to Rigol's offering, but as far as I can see, it doesn't have built in TG.

But for me the disadvantage with the SM200A is that it isn't represented in Turkey, so it will get more expensive with all the import procedures, duties etc. I'm looking into getting either the RSA5000 or the SM200A soon.

Have you looked into Aaronia? Seems comparable, but don't know the brand very well.

[taydin]

Have you looked into Aaronia? Seems comparable, but don't know the brand very well.

I did look at their offerings, too. But as you said, not much information available on the internet. But in some their marketing material, they seem to be portraying it as a tool for WIFI infrastructure installation and troubleshooting. Kinda like the WiSpy USB dongle, but of course much more capable, much more advanced than WiSpy. I wish I could get a demo of it here in Turkey. It's also in a similar price range with the Rigol and SM200A.

[taydin]

And another application where it is marketed for is drone detection. But I want to find out how it will work as an electronics lab instrument.

[Mechatrommer]

Another very good option for a RTSA that won't cost you an arm, leg, or kidneys is the Signal Hound SM200A. 20 GHz analysis bandwidth, 160 MHz (!) RTBW, and overall better noise figure compared to the Rigol. Price is similar to Rigol's offering, but as far as I can see, it doesn't have built in TG.

you can get classical sweep SA wt TG for about $2K 2nd hand. imho we'll need RTSA for intermittent signal such as frequency hopping. other than that, sweep SA will do. the main difference signalhound compared to this is it doesnt have a monitor and buttons.

[taydin]

you can get classical sweep SA wt TG for about $2K 2nd hand. imho we'll need RTSA for intermittent signal such as frequency hopping. other than that, sweep SA will do.

You also need an RTSA if you need to demodulate a data stream, like 802.11n OFDM etc. The RTSA will not have a blind time within it's RTBW, which will make this possible.

the main difference signalhound compared to this is it doesnt have a monitor and buttons.

I think putting it that way is very unfair to the SM200A. You are getting 20 GHz bandwith with SM200A, and a whopping 160 MHz RTBW !

To put it into context, for the keysight N9020B, you have to pay $20,000 in order to bring the standard 25 MHz RTBW up to 160 MHz :

And you need to shell out $22,000 to bring the standard 3.2 GHz bandwidth up to 26.5 GHz

So in keysight terms, you are getting a $44,000 upgrade with the SM200A.

[Sparky]

Another very good option for a RTSA that won't cost you an arm, leg, or kidneys is the Signal Hound SM200A. 20 GHz analysis bandwidth, 160 MHz (!) RTBW, and overall better noise figure compared to the Rigol. Price is similar to Rigol's offering, but as far as I can see, it doesn't have built in TG.

SignalHound SM200A is off-topic here but looks interesting, especially as competitor to RSA5000.  @taydin: You seem to know a little about it so wondering if you wouldn't mind to create a thread for it at your convenience.  Will be great to read more about it's capabilities.

[Sparky]

I'm wondering how the Rigol RSA5000 will do for demodulating typical sub-1GHz schemes like ASK, FSK, and GFSK?  Is it able to show the waveform of demodulated symbols?

[nctnico]

I'm wondering how the Rigol RSA5000 will do for demodulating typical sub-1GHz schemes like ASK, FSK, and GFSK?  Is it able to show the waveform of demodulated symbols?

Wouldn't a radio receiver + oscilloscope be more suitable for that?

[simone.pignatti]

I'm wondering how the Rigol RSA5000 will do for demodulating typical sub-1GHz schemes like ASK, FSK, and GFSK?  Is it able to show the waveform of demodulated symbols?

Yes it will when the VSA part will be implemented, probably second part of this year. It will go up to 256 QAM.

[2N3055]

If you want to compare to Signal Hound, SH BB60C is more direct comparison than SM200A. 9kHz - 6GHz , 27MHz real-time bandwidth...
RSA5000 might have better front end and better specs though ...

[Sparky]

I'm wondering how the Rigol RSA5000 will do for demodulating typical sub-1GHz schemes like ASK, FSK, and GFSK?  Is it able to show the waveform of demodulated symbols?

Wouldn't a radio receiver + oscilloscope be more suitable for that?

I'm not sure.  How would it work?  Typical sub-1GHz ISM band carrier frequencies are around ~433MHz, ~868MH, ~915MHz --- so will need to have a scope with high bandwidth (especially for 915MHz carrier).  I don't have a scope with 1GHz of bandwidth...  I found this Keysight App Note which explains decoding ASK modulation.

Or are you suggesting the radio receiver would demodulate and remove the carrier frequency so the oscilloscope measures only the demodulated signal? 

[nctnico]

I'm wondering how the Rigol RSA5000 will do for demodulating typical sub-1GHz schemes like ASK, FSK, and GFSK?  Is it able to show the waveform of demodulated symbols?

Wouldn't a radio receiver + oscilloscope be more suitable for that?

I'm not sure.  How would it work?  Typical sub-1GHz ISM band carrier frequencies are around ~433MHz, ~868MH, ~915MHz --- so will need to have a scope with high bandwidth (especially for 915MHz carrier).  I don't have a scope with 1GHz of bandwidth...  I found this Keysight App Note which explains decoding ASK modulation.

Or are you suggesting the radio receiver would demodulate and remove the carrier frequency so the oscilloscope measures only the demodulated signal?

Yes. Use a radio receiver to demodulate the signal and look at that using an oscilloscope.

[Safar]

I'm wondering how the Rigol RSA5000 will do for demodulating typical sub-1GHz schemes like ASK, FSK, and GFSK?  Is it able to show the waveform of demodulated symbols?

Wouldn't a radio receiver + oscilloscope be more suitable for that?

I'm not sure.  How would it work?  Typical sub-1GHz ISM band carrier frequencies are around ~433MHz, ~868MH, ~915MHz --- so will need to have a scope with high bandwidth (especially for 915MHz carrier).  I don't have a scope with 1GHz of bandwidth...  I found this Keysight App Note which explains decoding ASK modulation.

Or are you suggesting the radio receiver would demodulate and remove the carrier frequency so the oscilloscope measures only the demodulated signal?

Yes. Use a radio receiver to demodulate the signal and look at that using an oscilloscope.

Radio receiver with demodulator don't show all frequency domain magic. Spurious, harmonics, band allocation, freq response etc.

[Safar]

And when compare prices of RTSA I think is correct to look on dynamic range also. You can take "cheap" 12bit HiSpeed ADC and get NotBad-SDR-like SA, but specially designed ASIC with at least 16bit will be better I hope.

[G0HZU]

I guess a 'used' alternative in a similar price range would be the old Tek RSA3408A RTSA. This offers 8.5GHz and 36MHz RTBW. The user interface on the Tek is a bit clunky and laggy but with a few decent options fitted (eg option 002 is a must have) the old RSA3408A would be a reasonable competitor in terms of (used) price/performance.

https://www.tek.com/datasheet/rsa3408a-real-time-spectrum-analyzers-datasheet

One big disadvantage of the Tek will be the service and support costs from Tektronix. I think Tek will demand something like $12,000 as an initial service charge if you ever wanted them to repair an RSA3408A that isn't in a current $$$ support contract. So best to do all your own repairs if you buy one of these!

[usagi]

if you don't need RT, there's good deals to be had.

used spectrum analyzer buyer's guide

 

[Scratch.HTF]

I don't know why the preamp hardware requires a software key, or that the bandwidth (expensive analog hardware) of oscilloscopes can be "upgraded" with a software key - these "hardware enabling" keys are basically expensive gimmicks.

[Sparky]

Hmm...still no reviews out in the wild on this RSA5000?  Is it in limited supply from distributors and just not getting into the hands of people to test?

[tautech]

Saw one on Emona's stand at the Auckland EMEX show earlier this week.
Like the image that Dave posted in the OP, it's BIG !
And in charcoal gray ?   



Anyways, had a nice chat with member John South too.

[ogden]

Yes. Use a radio receiver to demodulate the signal and look at that using an oscilloscope.

If you are poor hobbyist, then perhaps this is the way to get around the problem of not having signal analyzer function of SA to ( try ) debug your transmitter. Otherwise it is not that simple. Try to use your radio receiver + scope to do something like this:

[Sparky]

I'm wondering how the Rigol RSA5000 will do for demodulating typical sub-1GHz schemes like ASK, FSK, and GFSK?  Is it able to show the waveform of demodulated symbols?

Yes it will when the VSA part will be implemented, probably second part of this year. It will go up to 256 QAM.

Any update on this?  Is it going to be a free upgrade by system firmware, or optional software license?

[simone.pignatti]

we have Rigol EU sales meeting next week, hope to get several news to share with you all.

[Sparky]

Yes. Use a radio receiver to demodulate the signal and look at that using an oscilloscope.

If you are poor hobbyist, then perhaps this is the way to get around the problem of not having signal analyzer function of SA to ( try ) debug your transmitter. Otherwise it is not that simple. Try to use your radio receiver + scope to do something like this:

Thanks, that is awesome!  Is this Rigol going to be able to do that!?

[ogden]

Thanks, that is awesome!  Is this Rigol going to be able to do that!?

Most likely not. Datasheet/leaflet does not mention demodulation capability.

There's more about real time spectrum and signal analysis and demodulation as well:

[Sparky]

we have Rigol EU sales meeting next week, hope to get several news to share with you all.

Hi Simone!

Any update?  Really looking forward to some real-world application and critical reviews of this equipment...but still not much out there.  Can you share anything of the demodulation capabilities?

Thanks!

[IRB]

Has anyone else tried a Rigol 5065-TG?

I had a demo unit, I did a SAVE "Screen Image", Rigol emailed me back that this is not a bug...   

The bmp files have a pop up on one, and on the other one a keyboard over the data, I converted them to jpg to post here
 
Now I found how to put up a Poll   
https://www.eevblog.com/forum/beginners/rigol-5065-tg-save-image-function/new/#new

[taydin]

I had a demo unit, I did a SAVE "Screen Image", Rigol emailed me back that this is not a bug...   

If there is no separate function to save just the waveform, then this is indeed a problem. But if Rigol provided a way to save the waveform, then my take on this is "saving a screen image" means saving EXACTLY what's on the screen ... So this would be a feature, not a bug

If Rigol would provide a "save screen image" that picks stuff from the screen and omits other stuff, they would never be able to get it right. There would be as many opinions about what should be included and what should be omitted as the number of screws in the unit  For example, consider the case where a college bought these and wants to write a course manual for the students. In this case, you would want those dialogs on the screen. You would also want the pop ups that show the errors when something was done wrong.

[IRB]

There is a Save Measure function, that will save the 801 points of data in to a .cvs file.
I was doing a long data collection in Max Hold, 10 minutes of data collection to compare, two antennas.

I could have saved the data, taken the data a graphed it, to end up with the same image, as I thought I would get with the "SAVE Screen Image"
 
So yes, saving the measurement data, would have be a wise decision.

Poll at:  https://www.eevblog.com/forum/beginners/rigol-5065-tg-save-image-function/new/#new

[Mad ID]

Has anyone else tried a Rigol 5065-TG?

Hi, we had a demo unit for test.
I was surprised to find that internal spurious emission is much worse than on DSA875-TG. e.q. peaks every 10MHz from 0-100MHz, every 100MHz above 1GHz etc.

Don't know if this is normal for all spectrum analyzers but we'll stick with the old model as real time is not crucial for us. It's not about the peaks, but there are too much of them. Don't wont to ask myself where is this coming from for every EMC measurement.

[Sparky]

Just noticed a new YouTube video "Introduction of the VSA Measurement Application for the RSA5000 Series".



User's Guide and Programming Guide are available from Rigol website: https://www.rigolna.com/complex-signal-analysis-and-vsa-with-rsa5/

The demodulation capability looks a lot better than I had expected...but I'm not experienced to be a good judge of its worth for real-world RF test/debug.

Any opinions about it from the video, and how it compares to other RSA systems?

[Sparky]

Update: The VSA option for RSA5000 series cost USA $1999

It seems like not much interest in the RSA5000 at all...perhaps not selling well...

[usagi]

hobbyists will look to used market or other products instead.

[tv84]

Maybe some teasing could change things a little since these RSA seem to be very nice tools.

[Sparky]

Maybe some teasing could change things a little since these RSA seem to be very nice tools.

Oh boy! Can we get the scoop on what is going on in this picture?! 

Despite these units being released sometime ago there's still literally no "real world" reviews on the RSA... 

[Sighound36]

Maybe some teasing could change things a little since these RSA seem to be very nice tools.

Despite these units being released sometime ago there's still literally no "real world" reviews on the RSA...

I concur with you Sparky virtually impossible to find any non manufacturer marketing video's why hasn't Dave had one apart yet!

Would love to see these spectrum analyzers being given the Dave treatment, still looking for a SA myself!

[tv84]

Oh boy! Can we get the scoop on what is going on in this picture?! 

That was the appetizer. These images are the main course.

As all can see, it seems the RSA3000 3GHz is upgradable up to RSA5000 6.5GHz.   

I don't have the knowledge for a review but these equipments definitely deserve a walk-through by any of the experts around here.

Edit: added several images including the VSA application.

[tinhead]

nice, however model number and option is half of the story, it would be great to see if/how the TG performs after mod

[tv84]

nice, however model number and option is half of the story, it would be great to see if/how the TG performs after mod

You're right but, FWIW, it's a "feature" not a mod so I think it should perform as the original...

[Sparky]

Oh boy! Can we get the scoop on what is going on in this picture?! 

That was the appetizer. These images are the main course.

WOW, now we're talking!!       If this doesn't bring some excitement to this product and further discussion here, nothing will!

I'm hoping Dave or Shahriar can do the honors and evaluate this RSA --- it seems there's a lot to like about it...but who knows the truth??

[Sighound36]

If you have managed to open up the 3000 that would great, it would make the device a lot more attractive, any 3000 or 5000 owners out there comments would be welcome 

[Sparky]

Oh boy! Can we get the scoop on what is going on in this picture?! 

That was the appetizer. These images are the main course.

As all can see, it seems the RSA3000 3GHz is upgradable up to RSA5000 6.5GHz.   

I don't have the knowledge for a review but these equipments definitely deserve a walk-through by any of the experts around here.

Edit: added several images including the VSA application.

@tv84:  Thanks for updating your post with pictures of VSA application!! This is an aspect that really interests me about this product.

Can you comment on VSA usage and how it has been in basic tests?

How does RSA3030 (~$5800) (with your mods) compare with SignalHound BB60C 6.0GHz (~$3000 USD)?

I hope Dave will tear this down and do a review...

[Sighound36]

Sparky

The original unit is 3030TG model (£4500) after some clever reorganization of the coding (TV84 has a wonderful way with code) the unit is now fully open with all options working 100% as they should with the full 6.5Ghz BW, and the VSA is performing spot on, which according to Rigol is only possible on a fully fledged 5000 series. You also benefit from improved SSB phase noise of -108dbc and DANL 165dbm.

Having lived with this unit for three months I feel it really delivers plus the benefits of a RTSA are now invaluable.

The EMI option has many levels which do take so time to get your head around, but no substitute for just using the unit daily. VSA is also very useful and again had many layers with demodulation variant analysis, do not profess to understand them all but I am getting there!

The unit is particularly useful for 5Ghz wifi signal analysis and in depth circuit board RFI discovery and remedy and really zooming in with the Real time mode and identifying those potential RFI black-spots that need addressing.
I did try several other SA's from Keysight, R&S and Pico, all of which had the strengths and weakness (budget was £8K) for me personally the RSA3030 just works really well and has not given me any cause for concern performs really well, the unit is kept at straight eye level and is used daily.

[tv84]

Can you comment on VSA usage and how it has been in basic tests?

Sparky,

After Sighound36's answer, anything I may add is irrelevant. I'm just a wizard's apprentice.

[Sparky]

@Sighound36, @tv84: Thanks for both your comments!  It seems you guys, and me as an observer, and the very few people quite excited by this RSA3030TG, and especially its capacity to be like the big brother.

Excellent to read your progress, Sighound, of getting to know the RSA, how you become comfortable using it daily and not experience any troubles.  In fact, it seems like no troubles at all!  Which is fantastic news!  I am a bit hesitant because we often find bugs with Rigol equipment firmware...but in this case the firmware seems mature/robust already.  Definitely a good start and features should get better with new releases.   

I still hope for Dave's evaluation/teardown...or other independent vlog to compare and put it though its paces...

[Sighound36]

Hi Sparky

I know that people have concerns over Rigol FW and to an extent I would agree with some other models, genuinely have not had any gripes or obvious bugs with the RSA (different for the MSO5000 I might add, but its still a good piece imho).

Yesterday I engaged the unit twice once one with a Rb audio studio clock repair and the other for a wifi issue at 2.415Ghz, identifying in stock SA mode and really go deep with real time mode to identify the spurious signals for a suspect router

Not a Rigol fanboy either, I have pieces from Siglent, Keysight, Marconi, HP and Agilent all of which have a useful place in my lab.
Others may feel different 

Last week I purchased a the Siglent VNA unit and with the new FW it makes a solid basic VNA that performs some positive features that I require, towards the end of the year I will obtain a greater BW VNA but for the outlay its a nice piece and the basic SA is fine.

The RSA 3030 is one of the pieces that has slipped under the radar possibly due to its price, out of the DIY bracket but not taken seriously enough by the SME's or educational facilities. However Tv84 must take the credit for his exceptional tenacity with coding and understanding the structures of how various manufacturers go about their coding operations, so his modesty of being the sorcerers apprentice is a little misleading   

Having various manufacturers equipment side by side I find the RSA easy to use compared to say the Keysight (which I find clunky) however overall the balance is nice and takes a few days to competently fly.

These units are worth checking out if you are in the market for a quality SA with a lot of capabilities but as always do compare with others of the same abilities and live with them for a good couple of weeks before deciding to part with your funds.

[tautech]

Last week I purchased a the Siglent VNA unit and with the new FW it makes a solid basic VNA that performs some positive features that I require, towards the end of the year I will obtain a greater BW VNA but for the outlay its a nice piece and the basic SA is fine.

FYI, there's a 3.2 GHz SVA coming later this year.

[tv84]

Rigol RSA3000E

https://www.rigol.com/products/spectrum-analyzers/RSA3000E.html

What's the difference to the RSA3000 ?

[Sparky]

Rigol RSA3000E
What's the difference to the RSA3000 ?

Hmm, maybe it's Education segment model?  Might be cheaper?  I wonder about the internal hardware

[2N3055]

No it stands for economy. They start at 1,5 GHz, have only 10 MHz RT bandwidth, and interesting prices.
But, analog numbers look the same, and it might be only software lock... If that is so, with tv84 unlock, it might be a new hit...

[tv84]

No it stands for economy. They start at 1,5 GHz, have only 10 MHz RT bandwidth, and interesting prices.
But, analog numbers look the same, and it might be only software lock... If that is so, with tv84 unlock, it might be a new hit...

Well, if that is the case, maybe it's a model that I've "seen" in the last few weeks and I was unable to go beyond 3 GHz...  Just a hunch...

[2N3055]

No it stands for economy. They start at 1,5 GHz, have only 10 MHz RT bandwidth, and interesting prices.
But, analog numbers look the same, and it might be only software lock... If that is so, with tv84 unlock, it might be a new hit...

Well, if that is the case, maybe it's a model that I've "seen" in the last few weeks and I was unable to go beyond 3 GHz...  Just a hunch...

For 1500€ (+VAT) fully unlocked RT SA and up to 3 GHz still a good deal

[Sparky]

No it stands for economy. They start at 1,5 GHz, have only 10 MHz RT bandwidth, and interesting prices.
But, analog numbers look the same, and it might be only software lock... If that is so, with tv84 unlock, it might be a new hit...

Well, if that is the case, maybe it's a model that I've "seen" in the last few weeks and I was unable to go beyond 3 GHz...  Just a hunch...

Interesting... will hope for additional details sometime

[Sparky]

No it stands for economy. They start at 1,5 GHz, have only 10 MHz RT bandwidth, and interesting prices.
But, analog numbers look the same, and it might be only software lock... If that is so, with tv84 unlock, it might be a new hit...

The specs/datasheets/prices for the RSA3000E series are now published on the (english) Rigol NA website!
https://www.rigolna.com/products/spectrum-analyzers/rsa3000/

I have not done side-by-side comparison of the datasheets yet...

@tv84 do you have any comments on RSA3015E-TG tweaking up to RSA5xyz-TG? 

[tv84]

@tv84 do you have any comments on RSA3015E-TG tweaking up to RSA5xyz-TG? 

I haven't seen one so I don't have any comments. Or the PCB is the same as in some 3030 or i couldn't have seen one because they haven't been out yet...

Certainly that, at least, a BW upgrade can be done. Don't know about a model change.

[Sparky]

@tv84 do you have any comments on RSA3015E-TG tweaking up to RSA5xyz-TG? 

I haven't seen one so I don't have any comments. Or the PCB is the same as in some 3030 or i couldn't have seen one because they haven't been out yet...

Certainly that, at least, a BW upgrade can be done. Don't know about a model change.

I will keep watching this space!  Hopefully one day we see tear down and comparison of internals for all these models

[NoisyBoy]

@tv84 do you have any comments on RSA3015E-TG tweaking up to RSA5xyz-TG? 

I haven't seen one so I don't have any comments. Or the PCB is the same as in some 3030 or i couldn't have seen one because they haven't been out yet...

Certainly that, at least, a BW upgrade can be done. Don't know about a model change.

tv84,

If the bandwidth upgrade and unlocking features can be done, The added realtime aspect would make it a very compelling offering against the Siglent new SSA3000X Plus models.  Because the Rigol spec is better, or equally as good, in most areas, with a $200 price difference.

[Sparky]

Is the 1Hz RBW possible on all the RSA3000 models, unlike what is listed on Rigol's website: https://www.rigolna.com/products/spectrum-analyzers/rsa3000/

I suspect the 10Hz mentioned there is the default, with an option able to enable 1Hz resolution, but I don't see a "RBW option" in any of tv84's photos posted.     Could someone clarify?

[simone.pignatti]

Hello, on RSA3000E is standard, on RSA3000 it needs the option RSA3000-BW1

[Sparky]

Hello, on RSA3000E is standard, on RSA3000 it needs the option RSA3000-BW1

Thanks for pointing that out, Simone!  Can you tell us further about the `E` models?  Did anyone take it apart yet?   

[simone.pignatti]

About RSA3000E, we feel the price is more centered, in fact since the E models are out more and more customers are approaching us for such model. So far the main application is EMI pre compliance. If you like to see anything special just let me know.

[tv84]

So to clarify things, the model 3000E runs a slightly different app than its older brothers 3000/5000.

As such, any "model change" will only be possible between models 3015E and 3030E (same for TG versions).

For 1500€ (+VAT) fully unlocked RT SA and up to 3 GHz still a good deal

That seems perfectly possible.

[srce]

I'm thinking about getting a 5065-TG. Is anyone else seeing these spurs?

Hi, we had a demo unit for test.
I was surprised to find that internal spurious emission is much worse than on DSA875-TG. e.q. peaks every 10MHz from 0-100MHz, every 100MHz above 1GHz etc.

Or any other problems? Thanks.

[Sighound36]

Never had any of the issues at all regarding those quoted, we have a R&S 13Ghz SA and its looks pretty clean on the Rigol RSA 3030 as it does on the R&S driven by a HP/ Aglient 4433b SG.

I use the RSA every day I find it easy to fly, and intuitive and accurate, our unit has the OXCO fitted as well, though what i do find extremely useful is the multi domain analysis when coupled with the MSO7000 (hopefully before Xmas a 8000)

To have this kind of facility would cost a lot of $£$£$ that  from other companies it works just fine and it produces reliable accurate results I depend  Debug heaven.

The RSA upgraded really does deliver high quality performance and features plus the hdmi output is a nice bonus as well plus the CISPER emi features are very useful to.

It fashionable to knock Rigol and Siglent, they are but small players however they are some great products these companies produce which not only VFM but performance as well.

We have other test equipment from the big three as well, and a Tek 6 series scope on order for the research lab, but the daily Rigol fliers we have really do cut the mustard. Would also suggest a look at Picoscope some quality products in there at almost realistic prices

I'm sure Martin72 will poo poo the thoughts and say 12 bits are much better than 8, while I agree, it purely depends on what you are using these products for.

We are a SME so small staff company but multi talented personal across a broad spectrum of electronic disciplines not just one or two people just pass testing or finial power analysis. 

Non of the equipment is net connected, they are used in conjunction with lab servers, no pass/fail continuous testing etc

The equipment is used daily and is used a great percentage of their capabilities not just one or two aspects.

[srce]

I use the RSA every day I find it easy to fly, and intuitive and accurate, our unit has the OXCO fitted as well, though what i do find extremely useful is the multi domain analysis when coupled with the MSO7000 (hopefully before Xmas a 8000)

Yes, this is one of the things I'm interested in it for, although I'll be planning to use it with a Keysight scope. I presume the IF out is just an analog signal that can be hooked up to any BNC scope probe connector?

[Sighound36]

I use the RSA every day I find it easy to fly, and intuitive and accurate, our unit has the OXCO fitted as well, though what i do find extremely useful is the multi domain analysis when coupled with the MSO7000 (hopefully before Xmas a 8000)

Yes, this is one of the things I'm interested in it for, although I'll be planning to use it with a Keysight scope. I presume the IF out is just an analog signal that can be hooked up to any BNC scope probe connector?

Hello srce

Yes that is way I hook up along with a dedicated trigger out/in from each device 50 ohm bnc.

For extra accuracy you can use a Rb or GPSO ref clock.

It does make quite a decent debug package for RF and IoT, I am lucky enough to have the 'mystical' RSA fully opened up, full bandwidth and all options.

Have used the RSA with a new 5 and 6 series Tek scopes even the ref was somewhat surprised lol

[Sparky]

For extra accuracy you can use a Rb or GPSO ref clock.

Hi Sighound36! thank you very much for sharing your knowledge and experience of the Rigol RSA -- I think you are the only one giving first-hand user experience!!! 

It is awesome to hear possibility of using GPSDO for 10MHz clock input for higher accuracy...especially I recently bought Symmetricon GPSDO and plan for 10MHz distribution to my test equipment. 

I am curious to know more about your comments:

I use the RSA every day I find it easy to fly, and intuitive and accurate, our unit has the OXCO fitted as well, though what i do find extremely useful is the multi domain analysis when coupled with the MSO7000 (hopefully before Xmas a 8000)

For extra accuracy you can use a Rb or GPSO ref clock.

I wonder if there is significant improvement to get RSA with OCXO option if one plans to use a GPSDO 10MHz reference for their equipment.  Clearly OSXO is excellent to have without GPSDO, but with the latter time source i suspect it will override the OSXO clock?

Do you think OCXO option is worth paying for?

Thanks for your comments!
Sparky

[Sighound36]

Hello Sparky

I am sure they are one or two other RSA users on here as well, so their contribution would also come in handy to 

We are lucky to have a couple of reference clocks in the lab, one Rb one GPSO.

The OXCO upgrade on the Rigol RSA does make an appreciable difference especially as well the unit 'off site' at customers as well.

Taking a master clock along is not a viable proposition! Yes you do notice a positive difference with the clock upgrade, you may not have to take your RSA out on 'missions' so you may find for the cost outlay just constructing a decent ultra low noise power supply for the GPSO will work absolutely great for you.

The way I have viewed this is simple most of the labs (professional) we deal or have dealt with, all use some form of master/slave reference clocking system, and pretty much all their scopes/SA/VNA's have the OXCO upgrade as well.

I feel personally it makes a difference others may not, however one issue when considering this method quality cabling or the correct length.

Nice to see a fellow RSA owner stepping out of limelight!

I do feel that having the upgrade internal clock  is worthwhile, however for the outlay you can built a really top notch GPSO and have enough left for a good time away on a Rugby weekend outing!

[Sighound36]

Would point like to point out that Tv84 has been exceptional help on this project so large thanks must go to man for his tenacious attitude to unearthing the ways and means to 'help' other folks enjoy the full benefits of many a piece of test equipment respect 

[2N3055]

Would point like to point out that Tv84 has been exceptional help on this project so large thanks must go to man for his tenacious attitude to unearthing the ways and means to 'help' other folks enjoy the full benefits of many a piece of test equipment respect 

Yep, he's awesome!

[tv84]

Here are some pics that illustrate my previous msg.

[Ditiris]

I will also state definitively that tv84 is the man.

As for the RSA3015E, I'll sing its praises all day long. My daily driver at work is an old Agilent E44xx series, and I vastly prefer the RSA. It performs better (going to be even better for low-level signals now with the PA), the UI is more responsive, and the way the menu options operate is more intuitive.

I didn't get the OCXO option because I haven't needed it. For most of my use cases the internal oscillator is good enough (I've watched digital clock drift on the real-time spectrum analyzer). In almost everything I build I create a 10MHz output, and the RSA locks to that without issue. I can see how you might want a ppb clock if you don't have that option.

The only negative I can think of for the RSA is that I haven't had great luck with the remote control software (UltraSpectrum). I basically just wanted to use it to make screenshots easier to grab, but the application doesn't display properly. Of course, the USB works just fine and captures images to bmp, jpg, or png... unlike the old Agilent E44xx I use at work that has a floppy disk...

I would say for $2k, if you need a spectrum analyzer, don't hesitate.

[Sparky]

Here are some pics that illustrate my previous msg.

Thanks for visual confirmation!  Amazing tv84!

This is gonna be really great news for tons of ppl out there!   This seems incredible possibility of RSA instrument at very relatively cheap price.   

I compared some specs difference between RSA3000E and RSA3000 -- it seems the majority of difference, after options are added, is the real-time analysis bandwidth and parameters related to that.  It's also $2k vs $5.8k which is a huge step. 

I'm thinking this `E` model could suit my needs best.  I'm only doing BLE stuff, so not needing above 3GHz.  I think the lower phase noise, DANL, and higher bandwidths that are possible with non-E version is "nice to have", but beyond my needs...hard to justify the +$4k for that.

Thank you very much for the continued updates!!!   

[Sparky]

I decided to read up on the OCXO option, which seems user-upgrade option.  A few findings from the user guide to share if anyone is interested:

- During the start-up process, the spectrum analyzer recognizes the OCXO module automatically and synchronizes with the OCXO module. Note that at this point, no external sync signal is allowed to be connected to the spectrum analyzer.

If you're working in an environment where you have GPSDO and distribution for all equipment, then you're more likely to be using that so OCXO is no use.

- After the OCXO module is installed on the spectrum analyzer, the OCXO module will still be working if you only turn off the Power key on the front panel without cutting off the AC power supply on the rear panel. Therefore, please cut off the AC power if you do not use the spectrum analyzer for a long period of time.

I can understand that warm-up time of OCXO and stability is best if left on, so this makes sense.  Probably want to be using the RSA daily though.

Since I'm not taking the RSA elsewhere and therefore don't need portability of build-in high accuracy clock, I would not get the OCXO option.  And...it's available as separate module if needed at a later time.

[tv84]

And...it's available as separate module if needed at a later time.

Thanks, Sparky.

Here is a photo of the OCXO module.

[r0d3z1]

I am going to buy a RSA3015E for EMI conducted emission precompliance, can someone confirm the quality of the instrument for this activity ?

[Sighound36]

I have no hesitation in recommending the RSA for this task, the EMI package is very good, takes a bit of getting used to, however we use this function regularly, and especially with the 40Mhz RT bandwidth examination of any spurious artifacts are easily observed. Lots of options with the EMI app that will make life easier for this task.

[Sparky]

Here is a photo of the OCXO module.

Awesome tv84!  Any chance you can show picture of the top-side of the module, with OCXO?  Would be great to see what oven it uses

[srce]

Does anyone know if these contain ARM CPUs or x86? Datasheet doesn't mention it, just that it runs Linux. Can you ssh in? I'm just wondering if it's possible to develop and run your own apps on it.

[tv84]

Does anyone know if these contain ARM CPUs or x86? Datasheet doesn't mention it, just that it runs Linux. Can you ssh in? I'm just wondering if it's possible to develop and run your own apps on it.

Each contain 2 Zynq-7000. SSH is not enabled by default. Surely you can run your apps on it.

[Sparky]

Has anyone tried external HDMI monitor?

The main display has resolution 1024x600 (Datasheet), and the HDMI resolution is configurable up to 1280x720 @ 60Hz (Users guide).
 - I wonder if using HDMI impacts any system performance?
 - Does the increased resolution and use of external monitor (say 1080p capable 22") help with usage?

[Sighound36]

Hello Sparky

I use both the MSO8000 and RSA5000 through an external monitor in the lab to great effect it does help, the monitor is at eye height, just use a hdmi splitter to swap inputs.

Really surprised that more of the bigger companies do not include this in the lower and mid point ranges.

[tv84]

Doing a quick comparison between a  RSA5032-TG mainboard v1.04 and a RSA3015E-TG mainboard v1.03, these seem to be the only differences.

Maybe someone can do a proper teardown...

[srce]

U305/U306 - 140MHz filter - https://www.vectron.com/products/saw/pdf_saw/TFS140AU.pdf

[Click_whirr]

Finding out what U307 might take some probing of the board. I've an 'E' version unfortunately, but I'm certainly keen to do some guinea-pig modifications to mine.

Can you probe out which pins are the supply and GND tv84? Some good old fashioned trawling datasheets might do it.
There at least seems to be an output on pin18, and an input on 24.

[tv84]

I attach the calibration data from 2 different RSA models: 3015E-TG and a 3030-TG  (you can easily see that the 3015E comes calibrated up to 3GHz)

The data inside the equipments are in a different format (SQLite DB) but this way is easier to visualize it.

Sheets and related SCPI set commands:

ATT       :PRIVate:CALibration:FRESponse:ATT<n>
PA        :PRIVate:CALibration:FRESponse:PA<n>
AMP       :PRIVate:CALibration:FRESponse:AMPLitude - TG calibration
INS0      :PRIVate:CALibration:FRESponse:INS<n> - related with the Realtime BW
INTSPUR0  :PRIVate:CALibration:FRESponse:ISPUr
DAC       :PRIVate:CALibration:DAC:RECord:....
TEMP0     :PRIVate:TEMPerature<n>


If anyone has some knowledge about calibration parameters and could elaborate on these tables/fields, it would be great.


For those that have a RSA3045 or a RSA5065, I would also be very much interested in seeing the cal data.

[mysol]

Hello!

Can anyone tell me is there any hack of BW for RSA3015E? TV84 shows 3 GHz BW for 3015 model. How do you achieve that?
Thanks!

[Gandalf_Sr]

So I'm considering an RSA3000 series Rigol SA but the Rigol web site leaves me confused about the difference between the 3000 and 3000E versions, this page has the table below but what's the difference between an RSA3030E and an RSA3030 and have you guys noticed that there's now an RSA3045?

[egonotto]

Hello,

RBW and Real-time Analysis Bandwidth.

RBW 1 Hz to 10 MHz is a option for RSA3000 and
Real-time Analysis Bandwidth 25 MHz is a option for RSA3000 and
Real-time Analysis Bandwidth 40 MHz is a option for RSA3000.

Best regards
egonotto

[Gandalf_Sr]

Hello,

RBW and Real-time Analysis Bandwidth.

RBW 1 Hz to 10 MHz is a option for RSA3000 and
Real-time Analysis Bandwidth 25 MHz is a option for RSA3000 and
Real-time Analysis Bandwidth 40 MHz is a option for RSA3000.

Best regards
egonotto

Thanks,

But aren't those just bandwidth filters?

That begs the question, is the RSA3000 hardware different from the RS3000E?

[Sighound36]

From the conversations I have been having with Tv84 and few other users there does seem to be some fundamental differences between the newer 3030 and the 5065's.

Its seems I have the only 3030 that has been opened up, recently I rebuilt the frankly very average power supply in side the RSA (and the MSO8000 they are the same  )

I took some images of the inside Tv84 has then he was comparing them with a genuine 5065.

Happy to help where I can

[jemangedeslolos]

Im not a RF guy but I sometimes needed a spectrum analyser.
I bought an SVA1015X last year but I got fucked by Siglent so I sent it back.
If I have a project again where I can afford a spectrum analyzer, I think it will be the Rigol RSA3015E-TG so i will follow this post carefully 

[mysol]

It looks like the SSH is locked. Can't acces via port 22...
Software/Hardware versions in attachment
Any advice? Thank you!

[tv84]

Here are 2 scripts to make FULL BACKUPs of RSA3000(E) and 5000 (I think...  long time I looked at this...).

[Sighound36]

My time of late has been taken up with some time consuming projects which should have been completed a while ago, buts that's life 

Rigol RSA update time, a while back I stripped out the power supply on the MSO 8000 and introduced some quality components into the design, now that had a nice positive effect on the scope, more of that in an upcoming post.

That got me in the mood to, "don't use use it, liberate the casings' I believe is a well known phrase in these parts 

So I proceeded to do the same to the RSA Tv84 enhanced unit, well struth Bruce if they aren't the same cheap arsed power supply  .

If you own any of the the following models they all have the same SMPS RSA3000/5000 and the MSO/DSO 7000/8000.

Tv84 has been slaving away with his necromancer like abilities with coding to try and get to the bottom of the 3.2Ghz floor limit even after his opening up spell has been cast.

I believe he now has the information he requires to demystify the current impasse that has plagued users on this forum from being able to use the full bandwidth on an opened up RSA 3000 upwards (not E models).

So without further ado please find below a series of base line noise floor screen images from a genuine fully used RSA5065 running the latest firmware, no options activated on this unit so just the basic 25Mhz real time BW

The second set of identical freqency readings are from the code fettled wondrous world of the Mage of deep SCPI extraction plus a little open frame surgery from this humble Metcal twirler.

Both Real time analysers had been running for a solid two hours and the temp in the lab yesterday was  a very pleasant 24C.

First is a straight sweep at full BW of 6.5Ghz, then 100Khz, 10Khz and lastly 3Khz (and that took a wee while ) All the sweeps has the 'Accy' function selected, this is a posh button on the RSA that means I believe translates to  'averaging'

Then the same frequency sweeps conducted with the Pre Amp activated.

You will be able to see for yourselves the power supply improvements have paid off nicely a good -2 to -3dbm drop in noise floor generally, after 4Ghz in some places up to -7dBm resulting in a much more fluid and straighter trace line.

So around three hours of time, £48 worth of quality components has proved rather beneficial.

Have some more updates this time on a DG822 but that is for the other thread on Rigol function generators.

I believe next week an ester egg will be popping up for the RSA3000/5000 models (not sure about the E version yet) suffice to say it will be most pleasing.

The next post will have the pre amplifier enabled images

[Sighound36]

Second part this time with the pre amp switched on.

Seems my USB transfer stick has lost some information in transit bugger, the 100Khz and 3Khz PA on  stock unit images are missing

Will address that tomorrow apologies chaps!

[tv84]

Great PSU change! 

[Sighound36]

Thank you Tv84 

I have attached a few images of the before and after.

[Sighound36]

Last two images of the finished board and the er um Krapzon caps that came out.

[Gandalf_Sr]

Hmmm, the PSU improvements are clearly huge but the fact that there's 25 cent capacitors in such an expensive SA questions the VFM of the whole equation; the cheapest RSA303-TG is $5,800 and, hacked or not, there's no VNA mode (or is there?).

[jemangedeslolos]

I have to do the same on my MSO7k!
Thank you Sighound36, can't wait for your upcoming posts 

[tautech]

Rigol RSA update time, a while back I stripped out the power supply on the MSO 8000 and introduced some quality components into the design, now that had a nice positive effect on the scope, more of that in an upcoming post.

but not really. 

Search the forum/internet for Project Yaigol. 

[tv84]

there's no VNA mode (or is there?).

 

[Sighound36]

Sorry Tautech what I was eluding to was a similar upgrade in the MSO 8000 noise floor and general smooth running of the unit.

I will also start a section on the Siglent equipment I have improved in a similar vien particularly the DMM's and the VNA's the respond rather well to power supply improvements particularly regulation improvement which translates to greatly  improved  stability of the unit.

 Gandalf sr it's not just Rigol ( to be fair Dave did point this out when he did a tear down of the MSO 7000) have seen inside the baby R&S vna and the psu is tiny with enough room in the case to park rampant rhino in there  I am looking to further improve the RSA again with some  line emc filtration  revisions as well as the switching frequency damping and secondary stage work



Mind you the psu in the DG822 is quite dire they must have paid $12 at the most that did make some quite decent gains I will put those FG tests up this week as well be careful  what you wish for it may really happen 

[tautech]

Sorry Tautech what I was eluding to was a similar upgrade in the MSO 8000 noise floor and general smooth running of the unit.

I will also start a section on the Siglent equipment I have improved in a similar vien particularly the DMM's and the VNA's the respond rather well to power supply improvements particularly regulation improvement which translates to greatly  improved  stability of the unit.

Hmmm, before and after detailed measurements of PSU performance is mandatory. 
I have a couple of units I can open for checks but not any new gears of course.

IMO it would be necessary to compare initial measurements against service manual spec before undertaking any 'improvements'.
Certainly it's worthy of a dedicated thread with the topic focussed on the quality or not of instrument PSU's but the topic is deep due to the proliferation of 'on PCB' convertors where each can have an impact on performance like is outlined in the Project Yaigol thread. < is an interesting read and almost mandatory if we are to dive down this rabbit hole.

[Sparky]

You will be able to see for yourselves the power supply improvements have paid off nicely a good -2 to -3dbm drop in noise floor generally, after 4Ghz in some places up to -7dBm resulting in a much more fluid and straighter trace line.

I couldn't determine from the filenames of the images which ones are the "before" and then "after" the power supply mod (capacitor replacement).   (Or perhaps you are comparing the RSA5065 data to "tv84" RSA3000 upgrade version?

Just a suggestion: I think the impact of the capacitor replacement would be more easily distinguished if the before/after data were plot on the same axes (and the data come from the same instrument).  I haven't checked but I'm assuming it's possible to save the trace data instead of just "screenshot".

[2N3055]

I see nice improvement from 3GHz up (preamp on 10kHz BW), but I also see new spur at around 120MHz.
On a pics without preamp, you can see that spur at 120 MHz on stock (3kHz BW) is there  , but on "post" 120MHz spur is 10 dBm higher.
Also new spurs at 1550 MHz and 2775MHz, 5-6 dBm..
Similar as "with preamp", from 3GHz up, noise floor is better..

It can be that now PSU buses became resonant on some (other than before) frequencies (lower ESR, higher Q), or probably RSA has some spur rejection in software that would need recalibration.......Or both...

[tv84]

Or perhaps you are comparing the RSA5065 data to "tv84" RSA3000 upgrade version?

This one.

He didn't do any before photos so, now, he can only compare with another RSA. What you ask is the best way but now it'll be impossible.

At least, he's comparing a 3030 "upped" with a 5065 "stock". Without the PSU improvement it still is a very nice upgrade given the fact that, precisely in the additional range (3-6.5GHz), is where it is better than a supposedly calibrated one.

[tv84]

I see nice improvement from 3GHz up (preamp on 10kHz BW), but I also see new spur at around 120MHz.
On a pics without preamp, you can see that spur at 120 MHz on stock (3kHz BW) is there  , but on "post" 120MHz spur is 10 dBm higher.
Also new spurs at 1550 MHz and 2775MHz, 5-6 dBm..
Similar as "with preamp", from 3GHz up, noise floor is better..

It can be that now PSU buses became resonant on some (other than before) frequencies (lower ESR, higher Q), or probably RSA has some spur rejection in software that would need recalibration.......Or both...

I agree but i find it hard to believe that Rigol would do any software filtering of something caused by a PSU (made with crap components which may create any random effects of that type).

[Sighound36]

2N3055

I would agree the 120Mhz I know is the obvious one, I suspect this has something to do with a glitch that another forum user had identified with his RSA and we have spoken about, I will be delving deeper into this in the coming weeks.

Your observations are very fair with regard to resonances and as I mentioned before  in a previous post plans are afoot to look at the line filtration insertion losses plus as well as  revisions in the switching frequency damping and secondary stage work.

However it a nice start. I would like mention my unit has the option OXCO clock fitted, for the comparison I removed the clock but in the interests of fairness I placed in the stock unit and performed the same sweeps the results were identical on the the stock 5065 screen, but that is as far as it went.

What i could do is set up up the Agilent VSG and measure the output on both units at some point as well.

While I was inside the unit I did notice the circuit layout around the main clock at the bottom center right of the circuit board, I will take some measurements in a few strategic places as well.

All good fun though

[2N3055]

I see nice improvement from 3GHz up (preamp on 10kHz BW), but I also see new spur at around 120MHz.
On a pics without preamp, you can see that spur at 120 MHz on stock (3kHz BW) is there  , but on "post" 120MHz spur is 10 dBm higher.
Also new spurs at 1550 MHz and 2775MHz, 5-6 dBm..
Similar as "with preamp", from 3GHz up, noise floor is better..

It can be that now PSU buses became resonant on some (other than before) frequencies (lower ESR, higher Q), or probably RSA has some spur rejection in software that would need recalibration.......Or both...

I agree but i find it hard to believe that Rigol would do any software filtering of something caused by a PSU (made with crap components which may create any random effects of that type).

It wouldn't be PSU specific, but many instruments will try to "sanitize" spurs (any spurs) and they do it by taking baseline and than "do something" about it... My Signal Hound has "Suppress spurs" mode.

[2N3055]

2N3055

I would agree the 120Mhz I know is the obvious one, I suspect this has something to do with a glitch that another forum user had identified with his RSA and we have spoken about, I will be delving deeper into this in the coming weeks.

Your observations are very fair with regard to resonances and as I mentioned before  in a previous post plans are afoot to look at the line filtration insertion losses plus as well as  revisions in the switching frequency damping and secondary stage work.

However it a nice start. I would like mention my unit has the option OXCO clock fitted, for the comparison I removed the clock but in the interests of fairness I placed in the stock unit and performed the same sweeps the results were identical on the the stock 5065 screen, but that is as far as it went.

What i could do is set up up the Agilent VSG and measure the output on both units at some point as well.

While I was inside the unit I did notice the circuit layout around the main clock at the bottom center right of the circuit board, I will take some measurements in a few strategic places as well.

All good fun though

I mentioned resonances because I have some experience with switchers designed to have resonant filters... 
And also power planes resonating with decoupling capacitors... Lots of  fun...Not.
I wasn't complaining, just commenting.  I have no doubt that you will be able to do some serious work here and looking forward to it!!
Best regards,

[Sighound36]

I did find time today to drill down a bit more into the noise floor differences, have been working on a new psu so LISN time 

So I have broken down the results into what I feel are more meaningful segments.

First I set up the sweep from 0-150Mhz on each unit, both had been running for a few hours both on the same power conditioner outlets.

Then one from 0-3.2Ghz, then 3.2-6.5Ghz then 5.5-6.5Ghz at various RBW's

Cables are T-flex 405 18Ghz with quality crimped stainless matching bandwidth connectors.

Also an image of the set up so you can see both RSA working in the same environment.

Next post all of the screen images

[Sighound36]

Below are the images I took earlier.

The psu improvements are also evident at the  lower end of the spectrum as well 

[tv84]

It seems there is a new FW version for RSA3000E:

Link

[mysol]

Hm, the files inside tell it is old firmware....

[tv84]

Hm, the files inside tell it is old firmware....

Which version?

[mysol]

Which version?

The version of the file in the archive that you sent? Honestly, I didn't check after seeing the modify date.

[tv84]

The version of the file in the archive that you sent? Honestly, I didn't check after seeing the modify date.

What I wanted to know is the version showed in system info.

[mysol]

What I wanted to know is the version showed in system info.

Same as here https://www.eevblog.com/forum/testgear/new-rigol-real-time-spectrum-analyser/msg3066898/#msg3066898

[tv84]

New firmware v00.03.00.00.29:

[Model Supported] RSA5065,RSA5065-TG,RSA5065N
                                RSA5032,RSA5032-TG,RSA5032N
                                RSA3015N,RSA3030,RSA3030-TG,RSA3030N
                                RSA3045,RSA3045-TG,RSA3045N

[Latest Revision Date] 2020-07-16


[Updated Contents]
00.03.00

    - Add Vector Network Analyzer Application(VNA),
                   Only for N Mode.

Link.

[mysol]

I've tried to look some more information about this update. They've made only new app for VNA but for all versions of RSA3/5. What?)

[tv84]

RSA5000 Declassification & Performance Verification Guides.

RSA3000(-E) Performance Verification Guides.

[rogersstuart]

Is the RSA3015N in the same hardware series as the RSA3030 and "unlockable" to 6 GHz? I was reading and I see that tv84 did his magic on an RSA3015E and enabled 3 GHz. Looking at the list I can see that none of the E models have VNA capabilities or reach higher than 3 GHz but the N models do.

[tv84]

Until now I only saw a 3030 able to go to 5065. For all others, the 3 GHz is usually the limit (to which they are pre-calibrated). After that the noise floor is just not there (calibration and/or PCB components   ).

In this regard it seems the new realtime Siglent is more expandable.   

[mysol]

Until now I only saw a 3030 able to go to 5065. For all others, the 3 GHz is usually the limit (to which they are pre-calibrated). After that the noise floor is just not there (calibration and/or PCB components   ).

In this regard it seems the new realtime Siglent is more expandable.   

Can we get 3 GHz for 3015/3015E series and how?
Or at least unlock options...

[Pitrsek]

Anyone having experience with  RSA3015N?

[Dennis Frie]

Anyone having experience with  RSA3015N?

I just received a RSA3015N. I've not had much time to play with it yet, but so far I'm happy with it. I've normally been using a mix of SDR, a Rigol DSA analyzer and a R&S VNA- hopefully the RSA will be able to replace most of them for everyday use. It would have been nice with some kind of VSA option as the 3000E and RSA5000 series offers.
If you can live with the 1.5 GHz frequency-range and missing VSA option, it seems like a pretty good bang for the buck. I will keep my 6 GHz SDR for anything high-frequency and anything VSA-related though.

As a sidenote, calibration data shows that the unit is only calibrated to 1.5 Ghz.

[tv84]

Another interesting random mistake:

RSA3015N running as RSA5032N

[Sparky]

Another interesting random mistake:

RSA3015N running as RSA5032N

This is a very appealing mistake, because I think VSA option is not an option on RSA3000.  If one does not need to go beyond 3.2GHz, this is very pleasing!

  tv84!

[Dennis Frie]

Another interesting random mistake:

RSA3015N running as RSA5032N

This is a very appealing mistake, because I think VSA option is not an option on RSA3000.  If one does not need to go beyond 3.2GHz, this is very pleasing!

  tv84!

Very neat mistake indeed...
It's interesting, that Rigol offers a VSA option (although only FSK/ASK, but much cheaper) for the E-series, but not for the RSA3000 series. Unfortunately, the E-series doesn't offer the 40 MHz bandwidth or VNA-option..
The RSA3015N mistake seems like the perfect combi.

[eleguy]

Another interesting random mistake:

RSA3015N running as RSA5032N

Could you elaborate how this mistake happened?

[qip]

Hi Sighound36, can you please perhaps provide a BOM for the PSU modification? Or same values, just lower ESR? BOM would be nice nevertheless, so I can order the parts. tia! qip

[qip]

Hi tv84, thanks for your great work already, I am also looking at the firmware, but currently stuck at the cramfs images. I see that this might me a non standard cramfs format, quite similar but the inodes are 1 block (4 bytes) longer than the spec. Having already mapped a few of the additional bytes, but not there yet. How are you unpacking the rom images?

[qip]

Well I got it, and looks like the RSA3030-TG got the -E treatment, or maybe I am missing something with my method.

After doing some convincing for 6.5GHz, there is a sharp cutoff at exactly 3.2GHz, guess there is some HW path not populated like in post #101 https://www.eevblog.com/forum/testgear/new-rigol-real-time-spectrum-analyser/msg2833482/#msg2833482. Don't think they have redesigned the board in such a short time and haven't had a look inside yet.

Caldata freq ranges are the same as in the already mentioned excel sheets for RSA3030-TG.

If someone would be willing to compare HW revisions or upgrade methods, let's work on it.

[tv84]

If someone would be willing to compare HW revisions or upgrade methods, let's work on it.

AFAIK, you're in the right track. What you see should be the result of unpopulated areas. At least, I've been unable to overcome that via software.

So far I've only seen a unit that allowed the full 6.5Ghz upgrade. Sadly, never saw its internals...

[qip]

AFAIK, you're in the right track. What you see should be the result of unpopulated areas. At least, I've been unable to overcome that via software.

Yea I just realized the HW Version: 00.01.02 vs. your 00.01.01. So they might have not placed the components in the newer versions, guess end of the line without knowing U307.

[chrismholt]

I just ordered an rsa3015n. Im excited to try upgrading it. I was wondering where to start learning. Is the method similar to an oscilloscope outlined in another thread?  Where should I start reading?

[EE-digger]

I've just stopped short of ordering either a 3015N or 3030N after watching the Rigol videos.  It's probably unfair to compare it to a high end brand A unit.

One thing I found interesting is that their DTF (distance to fault) seems to only have around 50mm resolution.  The brand A unit can get down to 1- 2mm or better.  Since both are set to 3GHz, this limitation would seem to be in their transform math or sampling resolution in hardware.

On cabling that's 10s or 100s of feet, this may not be much of an issue but on more compact assemblies it is.

Has anyone performed an SOLT cal with a good quality cal kit?  What do you see for return loss when re-examining the load?  What do the open and short look like?

[tv84]

Comparing the inside of these equipments:

It's not possible to convert Rigol RSA30xxE to RSA30xxN.

BTW, RSA3000E is even different from RSA3000, so 100% upgrade is not possible. There are some missing parts.

[mysol]

What about 50% upgrade?) At least unlock features or maybe getting 3 GHz from 1.5

[tv84]

What about 50% upgrade?) At least unlock features or maybe getting 3 GHz from 1.5

That has already been demonstrated in this thread.

[mysol]

But how to do this?)

[mysol]

There seems to be a new firmware for RSA3000E from 06/21/2021 ver 00.01.00.00.14, but without patch notes
https://int.rigol.com/En/Index/listView/catid/28/tp/6/wd/rsa3000e

[grothendieck]

So have you figured it out?

[hcglitte]

Hi,

Going through this thread it seems that an upgrade is possible, but no mention of how to do this.
There is one attachement which is named full backup, but the contents says update.
However, how is this file used?

I don't understand why someone has the desire to demonstrate that it is possible, but do not want to share how they do it.

[mysol]

Hi!
Dear sirs tv84 and qip said that it is still quite difficult and there is no single recipe and requires good knowledge in ebedded linux

[hcglitte]

Hi mysol,

Ok, thanks for clarifying :-)

[mysol]

No problem)

[scottapotamas]

Just got a 3015N and have started trying to familiarise myself with the fw. I've hit the same cramfs roadblock that qip mentioned and haven't found a way through it quite yet...


Rigol released a new 00.03.04 fw update early March 2022, notes below:

Code: [Select]

[Model Supported] RSA5065，RSA5065-TG，RSA5065N
                            RSA5032，RSA5032-TG，RSA5032N
                            RSA3015N，RSA3030，RSA3030-TG，RSA3030N
                            RSA3045，RSA3045-TG，RSA3045N
[Latest Revision Date] 2022-03-02


[Updated Contents]
00.03.04

- Solve the corrected value of the meter in EMI mode related problems.

For general reference, my 3015N unit shipped with these versions (+free BW40+EMI options):

Code: [Select]

HW Version
    Main Board:     00.01.03
    Keyboard:       00.01.00
    TG Board:       00.01.00

FW Version
    CPU:            00.01.00
    SPU:            00.01.06
    WPU:            00.01.02

SW Version
    BOOT:           00.01.00
    OS:             00.01.00
    Firmware:       00.03.03


I haven't committed to a particular SOTL kit yet, but noticed that there are no preloaded values for their 1.5G kit (CK106E). Thoughts?

[tv84]

I've hit the same cramfs roadblock that qip mentioned and haven't found a way through it quite yet...

What you say about the cramfs, although not fully "officially supported", is a mere evolution of the cramfs format that allows bigger files. The original format has a limitation in the size of files inside the filesystem and in the size of the cramfs filesystem file itself.

AFAIR there are a few websites that talk about the differences. And it's used in many cramfs systems that have bigger filesystems.

[scottapotamas]

Yeah I got it shortly after you posted. Is there some unspoken reason for why we're not talking about the details?

I don't want to overstep, but I've previously appreciated the transparency in other Rigol threads.


I've run out of time to play with licence related 'features' this evening, but for anyone wondering, SSH and FTP are enabled out of the box.

Code: [Select]

[root@RSA5000:]#uname -a
Linux RSA5000 3.12.0-xilinx #1 SMP PREEMPT Tue Dec 25 17:30:27 CST 2018 armv7l GNU/Linux

[root@RSA5000:]#ls
bin      dev      home     linuxrc  opt      rigol    run      sys      usr
boot     etc      lib      mnt      proc     root     sbin     tmp      var

The "root" user hash is DES (Unix), which took about 3 minutes to break on GPU via hashcat.
There is also a "RSA5000" user, but the hash is SHA512 (UNIX), didn't brute-force under 6 character length, and doesn't matter anyway...

[eeX86]

Good work guys.

Yes, so figuring out the specifics of that modified CRAMFS can be annoying. Could someone share the modifications?

So the more lazy approach in this case was to modify the firmware upgrade sh script.
Just put in some commands e.g. copying some interesting files to the USB stick. passwd, process list,  ssh config for example. With the root and ssh working, there is
the way open to explore more. I basically think the device specifics are in the internal fram.

dmesg:
at24 1-0050: 2048 byte mb85rc16 EEPROM, writable, 128 bytes/write
xi2cps e0005000.ps7-i2c: 400 kHz mmio e0005000 irq 80   

It should be possible to read the 2048 byte with : cat /sys/devices/amba.0/e0005000.ps7-i2c/i2c-1/1-0050/fram
or : cat /sys/devices/amba.0/e0004000.ps7-i2c/i2c-0/0-0050

-rw-------    1 root     root          2048 Feb 15 20:24 fram

However the kernel does probe the at24 driver for this, it crashes all the time when I do it. ??

[scottapotamas]

I don't believe any of the following is particularly sensitive, but might be of use to someone. This is a small dump of publicly available info, and steps detailed in forums and blog posts around the MSO5k and so on...


As mentioned here: https://rigol.force.com/support/s/article/rsa3000-rsa3000e-and-rsa5000-alternative-factory-reset-and-firmware-upgrade

To reset to factory settings without using the System menu:

1) Power cycle the instrument,
2) During the boot sequence, quickly and repeatedly press the Back button directly below the keypad on the instrument.

To upgrade the firmware to factory settings without using the System menu:

1) Power cycle the instrument
2) Insert a flash drive into the front of the instrument with the latest firmware version loaded onto the root directory of the drive.
3) During the boot sequence, quickly and repeatedly press the Preset button in the upper right hand corner of the instrument.


Finding the hash as mentioned earlier in the thread can be done by peeking at a firmware file or dump from a unit as described earlier in the thread, then finding the normal linux rootfs/etc/passwd file.

1. Download the Rigol RSA firmware
2. Unzip rsa3000_FW_v2.zip
3. Tear the bundle apart

Code: [Select]

unzip rsa3000_FW_v2.zip
cd RSA5000\(ARM\)update_00.03.04.00.03/
tar -xvf rsa5000_updatefile.bin
gunzip *.gz

Code: [Select]

$ls
app.img  fw4linux.sh  fw4uboot.sh  jac_spu.bin  logo.bmp  rootfs.img  rsa5000_updatefile.bin  system.img  zynq.bit

Unlike the MSO5000 stuff, the images are CramFS, not UBI. This is where other users generally get stuck with app.img and rootfs.img.

4. not-so-secret cramfs extraction trick - seems like we're leaving this bit as a 'hurdle'...
5. Use hashcat to break the DES hash

Code: [Select]

hashcat -m 1500 -a 3 roothash.txt -o output.txt6. SSH should be available for further poking...


There's no reason to flash a firmware update to get access to anything, assuming you have SSH access.

This assumes that a given software update hasn't changed the FPGA bitstream, any of the supporting files in `/mnt/app`, or any specific steps as part of `fw4linux.sh` and friends.

Use of this method is intended to test patched applications without reflashing hardware.

As /mnt/app is read-only without a flash, it's a bit trick to modify the rsa5000 app, but their app-config script provides a reasonably easy option OOTB.

During the startup process it looks for a development style /mnt/user/user-config script. If it exists, it invokes it instead of the app.

I've been successfully loading modified versions of the main app from the writable section of flash by scp'ing the modified rsa5000 binary into the /mnt/user along with a modified version of their user-config script. Specifically, I check for a specific file I touched on the USB, and use this as a way to 'fallback' to my OEM app by removing the USB.

Code: [Select]

[ ... normal user-config template ... ]

echo "Running the custom user-config script"

# Find the path of the connected USB disk
# Looks for a file called rsa_run_userapp to run the modified rsa5000 application
USB_DISK=/mnt/user/media/$(ls /mnt/user/media)

cd /mnt/user/
/mnt/app/bin/plctrl spu reset
sleep 3

if [ -f /mnt/user/rsa5000 ]; then
echo "User-specified rsa5 app exists..."

if [ -f ${USB_DISK}/rsa_run_userapp ]; then
echo "User usb-flag found. Running user's rsa5000 app"
/mnt/user/rsa5000 &
return 0
fi
fi

echo "Running builtin app"
cd /mnt/app/
/mnt/app/rsa5000 &
return 1
This is useful for me because I've been working with Ghidra a bit.




Some information about i2c devices:

FRAM

There's Fujitsu MB85RC16 FRAM at  `/sys/class/i2c-adapter/i2c-0/0-0050/fram`

Code: [Select]

DRIVER=at24
OF_NAME=fram
OF_FULLNAME=/amba@0/ps7-i2c@e0004000/fram@50
OF_COMPATIBLE_0=mb85rc16
OF_COMPATIBLE_N=1
MODALIAS=i2c:mb85rc16
And also at `/sys/class/i2c-adapter/i2c-1/1-0050/` apparently?

I also struggled to access this from a shell.

RTC

There's a Renesas ISL1208 RTC at `/sys/class/i2c-adapter/i2c-0/0-006f/rtc`

Code: [Select]

[root@RSA5000:user]#cat /sys/class/i2c-adapter/i2c-0/0-006f/rtc/rtc0/time
19:34:22

Code: [Select]

[root@RSA5000:proc]#cat /proc/driver/rtc
rtc_time : 19:45:20
rtc_date : 2022-04-11
alrm_time : 00:00:00
alrm_date : 2022-04-12
alarm_IRQ : no
alrm_pending : no
update IRQ enabled : no
periodic IRQ enabled : no
periodic IRQ frequency : 1
max user IRQ frequency : 64
24hr : yes
status_reg : BAT (0x02)
batt_status : okay
digital_trim : 0 ppm
analog_trim : 12.50 pF
user_data : 0x0000
Touchscreen controller

SSD2543 touchscreen controller at `/sys/class/i2c-adapter/i2c-1/1-0048`

[龚平]

I do not know software system, but I have a RSA3030E, need to crack the option, can you help me

[龚平]

RSA3030E HOW TO CRACK? Can you help me

[ON6RF]

Hi!

So I've been "lurking" for quite some time around the forum, and followed the MSO mods saga, amongst other things. The level of skill shown here is quite impressive!

I finally bit the bullet and bought a second-hand RSA3030-TG. I was "foolishly" thinking about how easy it would be to run the serial number through "RigLol" to enable all feature... Boy was I wrong!

Thanks to all the tips posted by scottapotama, tv84 and qip, I was able to re-enable SSH and FTP, as mine didn't have them enabled on the get go. I'll throw some extra notes here to complete what was already said:

I don't believe any of the following is particularly sensitive, but might be of use to someone. This is a small dump of publicly available info, and steps detailed in forums and blog posts around the MSO5k and so on...



Finding the hash as mentioned earlier in the thread can be done by peeking at a firmware file or dump from a unit as described earlier in the thread, then finding the normal linux rootfs/etc/passwd file.

1. Download the Rigol RSA firmware
2. Unzip rsa3000_FW_v2.zip
3. Tear the bundle apart

Code: [Select]

unzip rsa3000_FW_v2.zip
cd RSA5000\(ARM\)update_00.03.04.00.03/
tar -xvf rsa5000_updatefile.bin
gunzip *.gz...
4. not-so-secret cramfs extraction trick - seems like we're leaving this bit as a 'hurdle'...
5. Use hashcat to break the DES hash

Code: [Select]

hashcat -m 1500 -a 3 roothash.txt -o output.txt6. SSH should be available for further poking...

The latest firmware available (v00.03.something), however, is packed with something different than Cramfs (according to binwalk), probably some kind of encryption. Luckily, I was able to find ver 00.02.00 with Wayback machine. The rest of the extraction was smooth sailing, quick cramfsck mod to support larger file size, as @tv84 said. Hashcat found the password within 2 minutes 

Re-enabling SSH was a matter of packing a fw4linux.sh (that re-enables sshd and vsftpd by running the command) with gzip, then tar it into rsa3000_updatefile.bin (I learned that thanks to TV84's backup script).

Now, off to understand how to make it permanent as the rootfs is read-only, then tackle enabling those features! I'm learning quite a lot in the process.
Do you have any pointer on where to look for those? I'm thinking playing with Ghidra and tearing the rsa5000 bin apart, but I don't know much about disassembling executables...

[tv84]

The latest firmware available (v00.03.something), however, is packed with something different than Cramfs (according to binwalk), probably some kind of encryption.

Not true. They are just plain "larger FS" CRAMFS images. binwalk needs some patches for a long time.

To make FS mods permanent, you have to flash a new rootfs.img (with the mods included). Not such an easy task.

Nonetheless, AFAIK, SSH daemon is enabled by default.

[ON6RF]

Got it. As for the FS mods, I won't touch anything for now and use the /mnt/user/ dir to mess around.

That's weird, on mine (and on the 00.02.00 FW unpack), /etc/init.d/rcS has sshd and vsftpd commented out (and port 22 is closed unless I start sshd with the update trick):

Code: [Select]

echo "nameserver 8.8.8.8" >> /run/resolv.conf
/usr/sbin/mac-set
/usr/sbin/network $net_config
#/usr/sbin/vsftpd /etc/vsftpd.conf &
#/usr/sbin/sshd &

As for features (or changing the RTSA version), do I need to poke around the binary itself, or am I missing something simpler perhaps?

[tv84]

As for features (or changing the RTSA version), do I need to poke around the binary itself, or am I missing something simpler perhaps?

Poke, but not the best target to start learning.

[RedCali]

The RSA3000E supports ASK/FSK - but the RSA3000N don't - and vice versa the VNA on the N-Model but not the E-Version 
And in an older Manual i read as well something about AM/FM support for measurement / demod....

Has anybody tried to use / enable the E-Features on an N-Model and nows if the AM/FM stuff is supported? :-)

[r0d3z1]

Does anyone knows if the RSA3015E has a webinterface that allows browser control? thanks

[VK6HP]

No, the 3000E series analysers don't have the web interface in the current firmware.  I played with the web interface on a loan "N" analyser while my 3015E-TG was being repaired and, frankly, I was underwhelmed; I no longer covet the capability on my (now returned) unit.

[r0d3z1]

is there any windows tool to visualize the screen remotely ?

[Userli]

Does anybody know the format of the license option text, which is then signed?

[Userli]

I finally joined the club.
While playing with the device I found that in addition to the buttons described earlier, pushing Mode frequently at startup allows to update the boot manager. The AutoTune button acts like Preset at startup but uses Refresh mode, where all parts in the upgrade file are rewritten and not only the ones different from the current ones.
Not that one would really need it but just for completeness.

Are there any news on the 3.2GHz limit? Did anybody try to add the missing parts or find a software solution?

[Userli]

Does anybody know how to get a demodulated signal to the earplugs? In the manual it's mentioned as the purpose of the ear plug jack but no mention of how to achieve this.

[tautech]

Does anybody know how to get a demodulated signal to the earplugs? In the manual it's mentioned as the purpose of the ear plug jack but no mention of how to achieve this.

Set Span settings to zero. 

[Userli]

Set Span settings to zero. 

Thanks, this works. The demodulation type can be chosen under input/output and the earphones need to be switched on there, too.

[Frex]

Hello all,

I have a question for RSA3000/5000 owners, about the web control interface.
When I connect the RSA to my network I try to take control of it,
 I show it right in the web browser (Firefox on win 10) but if i try to acces
to RSA menues with mouse, nothing work !
I have a message on the bottom on screen capture "RESPONSE:NULL"
for each mouse click on screeen (see screen captures below).
Does anyone have same issue with it's device ?
For now, the web browser is usless...

Another question, I was able to copy a screenshoot to a USB key by using
"save" key on the right path with the RSA, but I wasn't able to save in the same
way the S parameters in my USB key. Data are always saved inside the RSA itself.
Any  idea about that ?

Best regards.

Frex

[Frex]

No RSA3000N/5000N owner here ? 

Frex

[Userli]

Did you enable web control on the device?

[Frex]

Hi,

Yes of course.
If not, you don't see the device as on my screenshots
and a message appear on bottom "DISCONNECTED".

I use DHCP mode, and the web browser show well
all change of screen, but no command are possible.
I tried with different browsers without success too.

Frex

[Userli]

Do you see the answer of the analyzer or any errors in the browser debugging tools?

[Frex]

Hi,

No, how I can do that ?
You  have also a RSA ? You web control work ?
Thank you for the help !

Frex

[Userli]

The browser sends constantly html gets to the device. In firefox and edge you hit F12 to see the debugging tools. On the network tab you should see the gets being send.
Btw. you need to have javascript enabled for that page.

[Frex]

Hi,

I have enable the debugging tool of firefox and i see each new
screen image from RSA, but when I click on screen in web browser
there is no specific line that appear in list.
screen shoot copy below.

Frex

[Frex]

Hello all,

Does anybody has successfully used the web control of RIGOL RSA3000 / RSA5000 ?
I don't know for now if there is something wrong on my network or if the RSA is buggy (it has latest firmware 03.06).
Anyway, I have others devices that work fine via web control without issue on same  network (Siglent SDS2104X-Plus).

No others users feedback to confirm/infirm this ?
Regards.

FRex

[Frex]

So, without any answer from others RSA owners, I finally try to ask to the seller (Batronix).
We will see.. Anyway, I really suspect a bug...
For those who doubt about the fact that there is a web control on RSA, the Rigol link
https://rigol.my.site.com/support/s/article/RSA3000-5000-series-web-control

Frex

[IRB]

So, without any answer from others RSA owners, I finally try to ask to the seller (Batronix).
We will see.. Anyway, I really suspect a bug...
For those who doubt about the fact that there is a web control on RSA, the Rigol link
https://rigol.my.site.com/support/s/article/RSA3000-5000-series-web-control

Frex

Hi Frex,

I just tried the web page control. It has horrible lag.
I used Chome, here is a print screen.

I use a VB6 program I wrote. I use the USB for control and doing automated testing.

I added the IP function to my code, for getting the screen image on another post:
https://www.eevblog.com/forum/testgear/spectrum-analyzer-rigol-dsa815/msg4918783/#msg4918783

The files are there Rev. C and D are USB only. I have received no feed back if it works on the RSA815, it woks on my RSA5065-TG

I tried Save-> Quicksave Path -> Set Path   
I pointed it at a USB drive, and Clicked the Print screen in the browser, I checked the drive there was no save file.
I clicked Save -> Save Image -> Save     That made a new screen file in the local screen folder.

I clicked the soft Key in the main menu Quick Save, the system hung for a bit. It worked The file showed up in the USB drive.
 

[Frex]

Hello IRB,

Thank you for your feedback.

As I understand, you don't use an Ethernet link but the USB. Right ?

On my side, on the web control page in browser I'm able to use "print screen" button
of the web interface.
Anyway, I'm not able to take control of analyzer by clicking on screen in web browser.
There is always a message on bottom of screen "RESPONSE:NULL".

Are you able to control the RSA with your mouse in the web browser ?
Regards.

Frex

[IRB]

Hello IRB,

Thank you for your feedback.

As I understand, you don't use an Ethernet link but the USB. Right ?

On my side, on the web control page in browser I'm able to use "print screen" button
of the web interface.
Anyway, I'm not able to take control of analyzer by clicking on screen in web browser.
There is always a message on bottom of screen "RESPONSE:NULL".

Are you able to control the RSA with your mouse in the web browser ?
Regards.

Frex

Normal I only use the USB. To try to help I connected the Ethernet, too.

I set up the TCP with a fixed IP to do the testing I noted in the message above, sorry if I wasn't clear.
Yes, I used the web browser called Chrome, and the mouse not the keyboard.

My unit did not go in to RMT until I communicated over the USB.

I was able to send the save screen to the USB drive, I thought that was what you were asking for help with...
 
When using the web browser, my program can not get the screen image, the port is in use by the browser. And vice versa, one has to release the port for the other to run.  I was successful at using my program to get the screen image, I ran my program and connected to the Rigol then I opened the browser, and both are working together.

OK, in the browser I clicked the gears at the to edge of the screen, there you can lock the Keypad and the Touch Screen.
HOWEVER, when I locked the touch screen the browser mouse functions had no affect on the analyzer.   
Also with the keypad locked and the touch screen locked, I had to use the keypad to unlock the keypad first then to unlock the touch screen.

I hope this helps.

I did notice the the "CONNECTED" switches to "NULL" after I click on an option then after it completes the command it returns to "CONNECTED" 

[IRB]

Frex,

Just a thought .. if you connect the USB, it will put the unit in RMT mode. Then close the program and use the Web Browser.

[dmz56]

I want to thank all that have posted here the various ways to hack the RSA.  I want to add my way of enabling all the options on an RSA5000/3000 that I ran into in ghidra:
NOTE: this only works on RSA5000 or RSA3000 series with firmware 3.06.  No other firmware or hardware (such as RSA3000E) is supported.

• Ensure you're on firmware 3.06.  You can get it from RigolNA site under the RSA model page. (The support page still lists 3.05) On this firmware FTP is enabled, but SSH is disabled.  The root password is "jackalde"
• ftp to the RSA, download "/mnt/data/license.lic" and store it in a safe place
• upload the user-config script to /mnt/user/user-config that starts sshd and will start the patched app:

Code: [Select]

#!/bin/sh

echo "Running the custom user-config script"

# Start SSH
/usr/sbin/sshd &

# Find the path of the connected USB disk
# Looks for a file called rsa_run_userapp to run the modified rsa5000 application
USB_DISK=/mnt/user/media/$(ls /mnt/user/media)

cd /mnt/user/
/mnt/app/bin/plctrl spu reset
sleep 3

if [ -f /mnt/user/rsa5000 ]; then
    echo "User-specified rsa5 app exists..."

    if [ -f ${USB_DISK}/rsa_run_stock ]; then
        echo "Stock usb-flag found. Running Running builtin app"
        cd /mnt/app/
        /mnt/app/rsa5000 &
        return 0
    fi
    echo "Stock usb-flag not found. Running user's rsa5000 app"
    /mnt/user/rsa5000 &
    return 0
fi

echo "Running built-in app"
cd /mnt/app/
/mnt/app/rsa5000 &
return 0


• Make sure to set the execute bits 0755 once the file is uploaded
• Restart the RSA and SSH to the box
• Type the following commands to create a patched app in the user directory

Code: [Select]

cp -f /mnt/app/rsa5000 /mnt/user
cd /mnt/user
echo -n -e '\xEA' > 3.06.patch
dd if=3.06.patch of=rsa5000 obs=1 seek=3647727 conv=notrunc
rm 3.06.patch
sync


• Reboot the RSA and make sure everything still works when running the patched app
• SSH to the RSA and rename your original license file:

Code: [Select]

cd /mnt/data/
mv license.lic license.bak
sync


• Upload the following license.lic file to /mnt/data/license.lic
  

Code: [Select]

VERSION=1.0;OPTION=VNA;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VERSION=1.0;OPTION=PA;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VERSION=1.0;OPTION=AMK;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VERSION=1.0;OPTION=B40;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VERSION=1.0;OPTION=EMI;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VERSION=1.0;OPTION=EMC;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VERSION=1.0;OPTION=BW1;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VERSION=1.0;OPTION=B25;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VERSION=1.0;OPTION=VSA;LICENSE=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000


• Reboot the RSA and check your options

NOTE: if you mess things (for example by doing a factory reset which will erase your user directory data including the patched app and user-config script) and the app doesn't start (you see the boot progress bar being stuck towards the end for more than 2 min) do not panic.  During boot, the RSA has a hard coded ip address of 192.168.1.10 and FTP still works.  So if you did a factory reset, ftp to that address and restore your license file from the backup you made.

[Bicurico]

Great work! 

[eeX86]

Thanks dmz56 for this great guide.

Does this patch also the model type or the maximum frequency capabilities? (going from 1.5 to 4.5GHz)

I was wondering how to view and change the internal FRAM that contains the model.
The kernel driver was always hanging when accessing the device file from the ssh. 

Did you ever tried this out ?

Thanks 

[dmz56]

Thanks dmz56 for this great guide.

Does this patch also the model type or the maximum frequency capabilities? (going from 1.5 to 4.5GHz)

I was wondering how to view and change the internal FRAM that contains the model.
The kernel driver was always hanging when accessing the device file from the ssh. 

Did you ever tried this out ?

Thanks

Unfortunately that's beyond my capabilities.  I did notice that there is functionality in the app to update the model number as well as the serial number into FRAM, so most likely there is an SCPI secret command perhaps even with a secret USB stick trick that would do that, but I wasn't able to figure it out.

[dmz56]

One other quick note - if you access FRAM and pipe the output to a USB stick it will NOT hang the kernel, but will give you an empty file.  Dzięki.

[dmz56]

So there is a MODel? for querying and a MODel for updating SCPI commands.  No idea on the full SCPI path of those commands or what magic is required to invoke them.