RIGOL DP711 and DP712 new 1ch PSU

[bitseeker]

Looks like quite a nice device. I do like the classic RS232 interface - I've done several test beds that use the RS232 interface from a simple microcontroller or a bit of VBA in Excel.

Hi Steve. I rarely hear about folks using the RS232 in instruments. Your setup might make for a nice vid.

[Macbeth]

A classic RS232 interface is better than a USB simply because there is no call for the speed, voltages, protocols, etc. of USB for simple SCPI communication and anyone who doesn't have a 9 pin (or 25 pin, remember them?) D connector on their PC can always purchase a ridiculously cheap USB<->RS232 converter lead anyway (I sniped my last one for less than $1.50 shipped - bloody Shenzhen!)

Something I noticed on the RIGOL website - both supplies DP711 and DP712 are rated at 150W but clearly the DP711 with a 3A 30V output is only 90W. This would appear to be a typical RIGOL marketing attempt at letting the hackers get the DP711 and upgrade it by software, while leaving the DP712 to the corporates. Am I right? 

ETA: DOH! DP712 is 50V at 3A. In this case I would imagine it's not just a RIGLOL job 

[SteveyG]

Looks like quite a nice device. I do like the classic RS232 interface - I've done several test beds that use the RS232 interface from a simple microcontroller or a bit of VBA in Excel.

Hi Steve. I rarely hear about folks using the RS232 in instruments. Your setup might make for a nice vid.

I'll add it to the list! Currently moving house though hence no videos for a while 

[carlob]

Hello! We are working on that video.
We will publish it soon. I will post here the link.
Thanks

Simone, do you maybe have any news? When you will publish your video about DP711 in action?
Thnx!

[vvmm]

Is this PSU hackable to enable high-res mode and trigger?

[Dwaine]

I can honestly say that I miss the good old serial port.   

[fki82]

Has anybody tested this device yet?

[Eric-H]

Has anybody tested this device yet?

I've received my DP711 a few weeks ago form Conrad and I'm very happy with it. I especially like the display and the user interface. One minor complaint: the fan is a bit loud.

I'm also looking for a way to enable the options 

[ElectronMan]

I've done some playing around with my DP712. Slurped the main firmware image off the SPI flash chip inside before and after the trial ran out. Unfortunately the license data is actually stored on an FRAM chip that I missed the first time I took it apart.

The main processor appears to be a CME-5 (http://www.capital-micro.com/PDF/CME-M5_Family_FPGA_Simplified_Data_Sheet_EN.pdf), an FPGA and 8051-based MCU combo. There is a JTAG port available, but I haven't managed to do anything useful with that yet.

The FRAM appears to be a Fijitsu (https://www.fujitsu.com/us/Images/MB85RC16-DS501-00001-8v0-E.pdf). It uses i2c, contains 8 x 2kbit pages.
Page 0 (Address 0x50) = Configuration settings
Page 1 (0x51) = Appears to be unused
Page 3 (0x52) = Front panel button lock settings in bytes 0x30-32 (each button is 1 bit) and Serial number at address 0x40-4d with what appears to be a checksum at 0x55-56. Changing the SN causes it to copy the serial # back from SPI flash and rewrite it, probably because of the invalid checksum.
Page 4 (0x53) contains the configured options (licenses) starting at 0x00, with what appears to be another checksum at 0x13-0x14.
Pages 5-7 (0x54-57) Appear to be unused.

I was able to hook up a raspberry pi via i2c and can read-write most of the locations while the unit is powered on, with the exception of 0x52 (SN data). This one you can read/write right after power on before it has booted, so you have to be fast. These areas are read on bootup:
1. i2c FRAM address 0x52 Starting at 0x40, reading 23 bytes (appears to be always 0x10 followed by 9 bytes of serial #, 7 0x0 and the 2 byte checksum)
2. i2c FRAM address 0x50 Starting at 0x00, reading 24 bytes (config data and checksum)
3. i2c FRAM address 0x53 Starting at 0x00, reading 21 bytes (option info and checksum)
4. i2c FRAM address 0x52 Starting at 0x30, reading 4 bytes (First 3 bytes front panel button lockouts, unknown 4th byte. These default to all 0x00)

It also re-reads #3 above (options) every 66 seconds while running. The main blocker on getting further with this is the checksum. When the license data is all 0's (which it fills when it detects a bad checksum) the checksum is 0xcc 0x71).

Hopefully someone more seasoned with reverse engineering can take this further... I haven't given up yet though.

[ElectronMan]

Got it.... There are 3, 5 byte fields at the beginning of 0x53. One for each feature. The first byte appears to be license type. 01 is trial, 02 is Official, and 03 is expired trial. There are 2 bytes of 00, followed by 2 bytes that seem to represent the # of minutes of trial elapsed. (See image) The # 08 71 works out to 36hrs runtime.

i2c Address 53:
0x00 = Trigger License type
0x01 - 0x02 = 00's, possibly extended trial time field.
0x03 - 0x04 = Trial time elapsed in minutes.
0x05 = Timer License type
0x06 - 0x07 = 00's, see above
0x08 - 0x09 = Trial time elapsed for Timer
0x0a = High res License type
0x0b - 0x12 = All  0's, possibly room for a trial license but one is never enabled.
0x13 - 0x14 = 16 bit crc checksum of 0x00 - 0x12.

Therefore, we want all 3  license types to be 02, and the checksum needs to be accurate. The data in the attached screen shot checks out. If your trial timer fields are different, those need to be changed to match for the CRC to pass.

This is not an ideal solution as it requires opening it up and leeching onto the FRAM chip with a device that talks i2c, but it works

[Eric-H]

Good work!

The remaining question is then: how did you calculate the crc over the license data? It the algorithm that Rigol uses known?

[ElectronMan]

Passed a couple of known good instances of the data with checksum to reveng with instructions to discover/dump CRC parameters;

Code: [Select]

reveng.exe -w 16 -s 03000008710300000871020000000000000000a111 030000087103000008710000000000000000006776
width=16  poly=0x1021  init=0xebcc  refin=false  refout=false  xorout=0x0000  check=0x6809  residue=0x0000  name=(none)
Then pass the parameters back in with instructions to calculate the checksum for the data i want:

Code: [Select]

reveng -w 16 -p 1021 -i ebcc -c 02000008710200000871020000000000000000
046f
And Bob's your uncle

[Eric-H]

I opened my DP711 but could not find the FRAM chip. Is it located at the bottom side of the board?

I did see that a smal cap (47 uF / 50V) had vented its electrolite , so I will have to replace it.

[Dwaine]

I opened my DP711 but could not find the FRAM chip. Is it located at the bottom side of the board?

I did see that a smal cap (47 uF / 50V) had vented its electrolite , so I will have to replace it.

You are joking right.  These power supplies are new.  That's warranty for sure

Wow.   

[Eric-H]

I did have to break the "Warranty void if removed"-sticker to find the bad cap.

[ElectronMan]

It is on the side of the upper-board facing the front. The pins have some test pads there.

[ElectronMan]

I suppose I should give the obligatory warning for anyone that might want to do this. It's generally not a good idea to hook into live circuits and talk to memory behind the processor's back. My curiosity got the best of me, so I went for it and it worked out.

With that out of the way, a little more detail on what I did. I removed the board with the main CPU on it and found the test pads for the SDA and CLK pins of the i2c FRAM chip. I soldered some wire-wrapping wire ends to the pads and put on a dab of hot glue to eliminate the chances of the ends shorting as the wires moved. I then used some tape for strain relief running the wires out the top of the unit with the case off.

SDA and CLK I ran to the i2C-1 pins on a raspberry pi since it was convenient. I ran ground to the top part of the chassis.

On the pi with i2c enabled, I used the i2cdump command (with PSU powered on) to get the memory pages:

Code: [Select]

i2cdump -y 1 83 c
53 hex (83 decimal) is the one I was interested in. It spits out the entire page.

I created a quick shell script so I could write everything at once and dump the result quickly. The CPU only seems to read from the FRAM every 66 seconds while running, but I wanted to reduce the chances for contention.

Code: [Select]

i2cset -y 1 83 0x00 0x02 b
i2cset -y 1 83 0x03 0x08 b
i2cset -y 1 83 0x04 0x71 b
i2cset -y 1 83 0x05 0x02 b
i2cset -y 1 83 0x0a 0x02 b
i2cset -y 1 83 0x13 0x04 b
i2cset -y 1 83 0x14 0x6f b
i2cdump -y 1 83 c
Once I verified the memory had what I wanted in it, I power cycled the PSU, and my DP712 was "enhanced."

[Eric-H]

Thanks for the detailed description!
I did not take the complete unit apart, and was looking at the bottom pcb. Now I know where to look I will give it a try using an arduino.

[ElectronMan]

Good Luck! This weekend I might see if I can do anything via serial port commands. I know some devices have allowed writing to memory areas in the past I haven't conducted an exhaustive search of the firmware for undocumented serial commands yet.

[Eric-H]

I just enabled all three options on my DP711 by writing to the FRAM via an Arduino   
Thanks for the info that made this possible.

Also replaced the bad cap. It was mounted in the wrong polarity!

[bitseeker]

Also replaced the bad cap. It was mounted in the wrong polarity!

Woops!

[ElectronMan]

Cool, I am glad it worked for you 

Not confidence inspiring that a backwards cap made it through QA though...

[Eric-H]

Not confidence inspiring that a backwards cap made it through QA though...

The cap had a red marking on it, just like the other caps and connectors have. So, someone did check it. But even with the bad cap the supply worked just fine and I didn't notice anything, until I opened the unit.

I must say the unit is constructed quite nicely, and comes apart easily just by removing some screws.

[atarijedi]

I was just looking into picking up one of these power supplies, and then get another one in a few more months, so I am able to connect them together.

So looking at photos, I noticed the safety info beside the plug on the DP711 states a max of 300W/400VA. Does that mean its actually capable of 60V 5A?

[lundmar]

New PSU Series DP7xx ...
Looks nice ... but ...
RS232 ? without USB at 2016 ?

http://int.rigol.com/Product/Model/85/487

I'm more disappointed that they don't feature LXI/Ethernet. I can do without RS232 and USB.