RIGOL DP711 and DP712 new 1ch PSU

[SimonD]

New PSU Series DP7xx ...
Looks nice ... but ...
RS232 ? without USB at 2016 ?

http://int.rigol.com/Product/Model/85/487

[Rolo]

Looks good, would like to see this one tested on Dave's bench. Looks like Rigol has come to sense with the display and controls.
 

[nidlaX]

No remote sense? 

[vinicius.jlantunes]

Yeah, the RS232 interface is a bit odd. Other than that seems like a nice PSU.

Hopefully Dave gets one to teardown / review!

[burkm]

Don't seem to find an international dealer for it though...

[electr_peter]

Spec sheet here http://www.batterfly.com/PDF/RIGOL/DP700_DataSheet_EN_BF.pdf

[Hydrawerk]

http://int.rigol.com/File/ModelTechDoc/20160503/DP700_DataSheet_EN.pdf
Well, my old PC from February 2000 has an USB port. My PC from October 2009 has NO RS-232 port. Most nowadays computers do the same.
But it looks like a nice PSU anyway. Maybe I prefer a big LED display.

[I4E]

Rigol actually chose to make this unit  on purpose with RS 232. I think this has mainly to do with the type of customers or market they feel might use the power supply.  You can always purchase a USB-RS232 or LAN-RS232 adapter/converter. This isn't available from Rigol so you'd have to purchase that individually..

You can control the DP700 by PC by using a 9 Pin RS2322 Female -Female straight cable to connect the DP 700 to the PC and then control by SCPI programming  or PC  software like the Ultra Sigma Software.


We are authorized distributors for Rigol in the United Kingdom/ Ireland. www.instruments4engineers.com

Joy Torres
Instruments 4 Engineers
info@instruments4engineers.com
Tel +44 (0) 161 871 7450

[pascal_sweden]

It seems rather expensive for only 1 channel.

It would have been nice if the Power measurement would be aligned on the right,
together with Voltage and Current measurements.

[CustomEngineerer]

Its probably going to have a HIRES option like the DP800 models have that gives an extra digit of resolution, at which point voltage and current would be aligned with power.

Edit: Checking Rigol's site for the DP700s does indeed show that HIRES is an option.

[simone.pignatti]

No remote sense? 

Hello it seems Rigol hasn't added the remote sense since this power supply is intended to be used on a lab or desk, where the distance to the DUT is not far away.
Any question, please ask. We have some DP711 to test in case of special request.

[Nuzzler]

Is anyone using these PSU's yet? The DP711 looks like a good fit for me. I know that the DP832 is popular, but it's 50% more $$$ and I'm really digging the 30V/5A single channel of the DP711. Any feedback would be appreciated.

- Nuzz

[bitseeker]

@Nuzzler: In the US, this supply isn't that appealing. Unless you really need a new product, you can get more bang for the buck buying used and we've got access to lots of great used gear.

[carlob]

Simone, could you please take a short video of powered up DP711? Please?

Don't know how, but your YT videos are only one on a whole internet. They are great, but i guess i'm not the only one who would like to see how they actually works... To see some screens from menus, how fast and responsive is UI, etc..

I'm in doubt between DP832 and DP711, mostly because i prefer 30V/5A more then 30V/3A.
But it is also nice to have 3 chanel for rather small aditional payment. I'm really not smart, and it would really mean a lot to me to see such a short review. Just a shoot with better cell phone, without editing.

And you will get great exposure, if you advertise your video, because you will be only one on a whole earth! 

Thanks a ton!
Regards.

No remote sense? 

Hello it seems Rigol hasn't added the remote sense since this power supply is intended to be used on a lab or desk, where the distance to the DUT is not far away.
Any question, please ask. We have some DP711 to test in case of special request.

[simone.pignatti]

Hello! We are working on that video.
We will publish it soon. I will post here the link.
Thanks

[Stupid Beard]

I'm in doubt between DP832 and DP711, mostly because i prefer 30V/5A more then 30V/3A.

If you parallel channels 1 and 2 on the DP832 you can do 30V/6A or in series 60V/3A.

[carlob]

Hello! We are working on that video.
We will publish it soon. I will post here the link.
Thanks

Hey, nice to hear that!
Thank you very much, amici miei!

[carlob]

I'm in doubt between DP832 and DP711, mostly because i prefer 30V/5A more then 30V/3A.

If you parallel channels 1 and 2 on the DP832 you can do 30V/6A or in series 60V/3A.

Hey Beard, thanks. I guess if I understand well, you could simply connect both output 1 & 2 on the same circuit, and manually calculate value, or Rigol do that for you?

Thanks.

[Zbig]

Don't seem to find an international dealer for it though...

Batronix has them: http://www.batronix.com/shop/rigol/DP700.html . They're in Germany

[Stupid Beard]

I'm in doubt between DP832 and DP711, mostly because i prefer 30V/5A more then 30V/3A.

If you parallel channels 1 and 2 on the DP832 you can do 30V/6A or in series 60V/3A.

Hey Beard, thanks. I guess if I understand well, you could simply connect both output 1 & 2 on the same circuit, and manually calculate value, or Rigol do that for you?

It shows each channel individually, but you can link them so that they both stay at the same value. On the DP832 thread, the first attachment has information on how to connect it in series and parallel. https://www.eevblog.com/forum/testgear/rigol-dp832-firmware-updates-and-bug-list/?action=dlattach;attach=79494 should be a direct link to the PDF.

[carlob]

Yes, thanks, http://www.batronix.com/pdf/Rigol/UserGuide/DP800_UserGuide_EN.pdf on 58 Adobe PDF page, or 2-8, as in manual.

There is explanation, but as i'm not had oportunity to work with Bench PS, i'm not sure in reality, how all that looks like...

[Stupid Beard]

Yes, thanks, http://www.batronix.com/pdf/Rigol/UserGuide/DP800_UserGuide_EN.pdf on 58 Adobe PDF page, or 2-8, as in manual.

There is explanation, but as i'm not had oportunity to work with Bench PS, i'm not sure in reality, how all that looks like...

Please excuse the kludgey setup and rubbish cell phone photography.



Top two photos are series, bottom two are parallel. The DP832 is setup with channel 1 set to 5V and 0.5A, tracking is turned on so that channel 2's voltage tracks. That is, if I change channel 1 then channel 2 changes too. You don't have to use tracking, it's just convenient if you are going to be using it as a split supply.

Since I seem to have also failed at getting the leads fully in shot, series is wired with CH1 +ve to the DMM, CH1 -ve to CH2 +ve and CH2 -ve to DMM. Parallel setup is hopefully obvious.

[carlob]

I really don't know why Stupid Beard, even as a joke...

You save me of buying DP711... at least for now... Photos are really great. If i see well, that small link, like infinity sign, actually represent connection between two adjacent channels?

Actually, procedure you are talking about is this one:

https://youtu.be/wIo-MPEXKm4?t=1048

Thanks again for your effort! Really appreciated a ton!

[Stupid Beard]

I really don't know why Stupid Beard, even as a joke...

I wasn't sure if I was understanding you correctly, but I looked at the manual page you linked and could see why someone would be confused so figured I'd post it anyway. Hopefully it helped.

You save me of buying DP711... at least for now... Photos are really great. If i see well, that small link, like infinity sign, actually represent connection between two adjacent channels?

Actually, procedure you are talking about is this one:

https://youtu.be/wIo-MPEXKm4?t=1048

Yes, that's correct. For what it's worth, my only complaints about the DP832 are how loud the fan is and how I am too lazy to replace the fan with a quieter one. I don't know what the DP711 is like, but I use two channels quite often so I'm glad the DP711 didn't exist when I bought my DP832.

Thanks again for your effort! Really appreciated a ton!

You're welcome.

[SteveyG]

New PSU Series DP7xx ...
Looks nice ... but ...
RS232 ? without USB at 2016 ?

http://int.rigol.com/Product/Model/85/487

Looks like quite a nice device. I do like the classic RS232 interface - I've done several test beds that use the RS232 interface from a simple microcontroller or a bit of VBA in Excel.

[bitseeker]

Looks like quite a nice device. I do like the classic RS232 interface - I've done several test beds that use the RS232 interface from a simple microcontroller or a bit of VBA in Excel.

Hi Steve. I rarely hear about folks using the RS232 in instruments. Your setup might make for a nice vid.

[Macbeth]

A classic RS232 interface is better than a USB simply because there is no call for the speed, voltages, protocols, etc. of USB for simple SCPI communication and anyone who doesn't have a 9 pin (or 25 pin, remember them?) D connector on their PC can always purchase a ridiculously cheap USB<->RS232 converter lead anyway (I sniped my last one for less than $1.50 shipped - bloody Shenzhen!)

Something I noticed on the RIGOL website - both supplies DP711 and DP712 are rated at 150W but clearly the DP711 with a 3A 30V output is only 90W. This would appear to be a typical RIGOL marketing attempt at letting the hackers get the DP711 and upgrade it by software, while leaving the DP712 to the corporates. Am I right? 

ETA: DOH! DP712 is 50V at 3A. In this case I would imagine it's not just a RIGLOL job 

[SteveyG]

Looks like quite a nice device. I do like the classic RS232 interface - I've done several test beds that use the RS232 interface from a simple microcontroller or a bit of VBA in Excel.

Hi Steve. I rarely hear about folks using the RS232 in instruments. Your setup might make for a nice vid.

I'll add it to the list! Currently moving house though hence no videos for a while 

[carlob]

Hello! We are working on that video.
We will publish it soon. I will post here the link.
Thanks

Simone, do you maybe have any news? When you will publish your video about DP711 in action?
Thnx!

[vvmm]

Is this PSU hackable to enable high-res mode and trigger?

[Dwaine]

I can honestly say that I miss the good old serial port.   

[fki82]

Has anybody tested this device yet?

[Eric-H]

Has anybody tested this device yet?

I've received my DP711 a few weeks ago form Conrad and I'm very happy with it. I especially like the display and the user interface. One minor complaint: the fan is a bit loud.

I'm also looking for a way to enable the options 

[ElectronMan]

I've done some playing around with my DP712. Slurped the main firmware image off the SPI flash chip inside before and after the trial ran out. Unfortunately the license data is actually stored on an FRAM chip that I missed the first time I took it apart.

The main processor appears to be a CME-5 (http://www.capital-micro.com/PDF/CME-M5_Family_FPGA_Simplified_Data_Sheet_EN.pdf), an FPGA and 8051-based MCU combo. There is a JTAG port available, but I haven't managed to do anything useful with that yet.

The FRAM appears to be a Fijitsu (https://www.fujitsu.com/us/Images/MB85RC16-DS501-00001-8v0-E.pdf). It uses i2c, contains 8 x 2kbit pages.
Page 0 (Address 0x50) = Configuration settings
Page 1 (0x51) = Appears to be unused
Page 3 (0x52) = Front panel button lock settings in bytes 0x30-32 (each button is 1 bit) and Serial number at address 0x40-4d with what appears to be a checksum at 0x55-56. Changing the SN causes it to copy the serial # back from SPI flash and rewrite it, probably because of the invalid checksum.
Page 4 (0x53) contains the configured options (licenses) starting at 0x00, with what appears to be another checksum at 0x13-0x14.
Pages 5-7 (0x54-57) Appear to be unused.

I was able to hook up a raspberry pi via i2c and can read-write most of the locations while the unit is powered on, with the exception of 0x52 (SN data). This one you can read/write right after power on before it has booted, so you have to be fast. These areas are read on bootup:
1. i2c FRAM address 0x52 Starting at 0x40, reading 23 bytes (appears to be always 0x10 followed by 9 bytes of serial #, 7 0x0 and the 2 byte checksum)
2. i2c FRAM address 0x50 Starting at 0x00, reading 24 bytes (config data and checksum)
3. i2c FRAM address 0x53 Starting at 0x00, reading 21 bytes (option info and checksum)
4. i2c FRAM address 0x52 Starting at 0x30, reading 4 bytes (First 3 bytes front panel button lockouts, unknown 4th byte. These default to all 0x00)

It also re-reads #3 above (options) every 66 seconds while running. The main blocker on getting further with this is the checksum. When the license data is all 0's (which it fills when it detects a bad checksum) the checksum is 0xcc 0x71).

Hopefully someone more seasoned with reverse engineering can take this further... I haven't given up yet though.

[ElectronMan]

Got it.... There are 3, 5 byte fields at the beginning of 0x53. One for each feature. The first byte appears to be license type. 01 is trial, 02 is Official, and 03 is expired trial. There are 2 bytes of 00, followed by 2 bytes that seem to represent the # of minutes of trial elapsed. (See image) The # 08 71 works out to 36hrs runtime.

i2c Address 53:
0x00 = Trigger License type
0x01 - 0x02 = 00's, possibly extended trial time field.
0x03 - 0x04 = Trial time elapsed in minutes.
0x05 = Timer License type
0x06 - 0x07 = 00's, see above
0x08 - 0x09 = Trial time elapsed for Timer
0x0a = High res License type
0x0b - 0x12 = All  0's, possibly room for a trial license but one is never enabled.
0x13 - 0x14 = 16 bit crc checksum of 0x00 - 0x12.

Therefore, we want all 3  license types to be 02, and the checksum needs to be accurate. The data in the attached screen shot checks out. If your trial timer fields are different, those need to be changed to match for the CRC to pass.

This is not an ideal solution as it requires opening it up and leeching onto the FRAM chip with a device that talks i2c, but it works

[Eric-H]

Good work!

The remaining question is then: how did you calculate the crc over the license data? It the algorithm that Rigol uses known?

[ElectronMan]

Passed a couple of known good instances of the data with checksum to reveng with instructions to discover/dump CRC parameters;

Code: [Select]

reveng.exe -w 16 -s 03000008710300000871020000000000000000a111 030000087103000008710000000000000000006776
width=16  poly=0x1021  init=0xebcc  refin=false  refout=false  xorout=0x0000  check=0x6809  residue=0x0000  name=(none)
Then pass the parameters back in with instructions to calculate the checksum for the data i want:

Code: [Select]

reveng -w 16 -p 1021 -i ebcc -c 02000008710200000871020000000000000000
046f
And Bob's your uncle

[Eric-H]

I opened my DP711 but could not find the FRAM chip. Is it located at the bottom side of the board?

I did see that a smal cap (47 uF / 50V) had vented its electrolite , so I will have to replace it.

[Dwaine]

I opened my DP711 but could not find the FRAM chip. Is it located at the bottom side of the board?

I did see that a smal cap (47 uF / 50V) had vented its electrolite , so I will have to replace it.

You are joking right.  These power supplies are new.  That's warranty for sure

Wow.   

[Eric-H]

I did have to break the "Warranty void if removed"-sticker to find the bad cap.

[ElectronMan]

It is on the side of the upper-board facing the front. The pins have some test pads there.

[ElectronMan]

I suppose I should give the obligatory warning for anyone that might want to do this. It's generally not a good idea to hook into live circuits and talk to memory behind the processor's back. My curiosity got the best of me, so I went for it and it worked out.

With that out of the way, a little more detail on what I did. I removed the board with the main CPU on it and found the test pads for the SDA and CLK pins of the i2c FRAM chip. I soldered some wire-wrapping wire ends to the pads and put on a dab of hot glue to eliminate the chances of the ends shorting as the wires moved. I then used some tape for strain relief running the wires out the top of the unit with the case off.

SDA and CLK I ran to the i2C-1 pins on a raspberry pi since it was convenient. I ran ground to the top part of the chassis.

On the pi with i2c enabled, I used the i2cdump command (with PSU powered on) to get the memory pages:

Code: [Select]

i2cdump -y 1 83 c
53 hex (83 decimal) is the one I was interested in. It spits out the entire page.

I created a quick shell script so I could write everything at once and dump the result quickly. The CPU only seems to read from the FRAM every 66 seconds while running, but I wanted to reduce the chances for contention.

Code: [Select]

i2cset -y 1 83 0x00 0x02 b
i2cset -y 1 83 0x03 0x08 b
i2cset -y 1 83 0x04 0x71 b
i2cset -y 1 83 0x05 0x02 b
i2cset -y 1 83 0x0a 0x02 b
i2cset -y 1 83 0x13 0x04 b
i2cset -y 1 83 0x14 0x6f b
i2cdump -y 1 83 c
Once I verified the memory had what I wanted in it, I power cycled the PSU, and my DP712 was "enhanced."

[Eric-H]

Thanks for the detailed description!
I did not take the complete unit apart, and was looking at the bottom pcb. Now I know where to look I will give it a try using an arduino.

[ElectronMan]

Good Luck! This weekend I might see if I can do anything via serial port commands. I know some devices have allowed writing to memory areas in the past I haven't conducted an exhaustive search of the firmware for undocumented serial commands yet.

[Eric-H]

I just enabled all three options on my DP711 by writing to the FRAM via an Arduino   
Thanks for the info that made this possible.

Also replaced the bad cap. It was mounted in the wrong polarity!

[bitseeker]

Also replaced the bad cap. It was mounted in the wrong polarity!

Woops!

[ElectronMan]

Cool, I am glad it worked for you 

Not confidence inspiring that a backwards cap made it through QA though...

[Eric-H]

Not confidence inspiring that a backwards cap made it through QA though...

The cap had a red marking on it, just like the other caps and connectors have. So, someone did check it. But even with the bad cap the supply worked just fine and I didn't notice anything, until I opened the unit.

I must say the unit is constructed quite nicely, and comes apart easily just by removing some screws.

[atarijedi]

I was just looking into picking up one of these power supplies, and then get another one in a few more months, so I am able to connect them together.

So looking at photos, I noticed the safety info beside the plug on the DP711 states a max of 300W/400VA. Does that mean its actually capable of 60V 5A?

[lundmar]

New PSU Series DP7xx ...
Looks nice ... but ...
RS232 ? without USB at 2016 ?

http://int.rigol.com/Product/Model/85/487

I'm more disappointed that they don't feature LXI/Ethernet. I can do without RS232 and USB.

[bitseeker]

So looking at photos, I noticed the safety info beside the plug on the DP711 states a max of 300W/400VA. Does that mean its actually capable of 60V 5A?

Hi atarijedi. Welcome to the forum.

You're looking at the input power limit. Unless a power supply has 100% efficiency (not possible) and designed to output that much power, the output power rating will not be anywhere near the input one.

It's always best to read the product specifications, http://int.rigol.com/File/ModelTechDoc/20160503/DP700_DataSheet_EN.pdf , where you'll find the output limit is 150W and the maximum voltage and current depend on the model you choose.

[bson]

I did have to break the "Warranty void if removed"-sticker to find the bad cap.

Americans can just remove them since they violate federal law.
https://www.extremetech.com/gaming/233120-microsoft-sony-and-other-manufacturers-still-use-illegal-warranty-void-if-removed-stickers

[bitseeker]

Thanks. Interesting article, bson.

[bitbanger]

I know this is a bit of an old thread but just a note from a DP711 owner: look carefully at specs. High res doesn't mean high accuracy! I was happy with the supply so after a few months decided to upgrade without considering this.

Output is within 0.7mV on a 6-1/2 digit DMM. However the DP711 readout is out nearly 12mV. After looking at the specs this is technically "in"("Annual Accuracy: Readback: Voltage 0.05% + 20 mV") but I can't understand why or how you can control to 1mV but your meter is off 12mV (I would assume that in a new power supply like this your display should be showing the ADC value used for feedback control)? This held with and without load.

[bitseeker]

Correct. Accuracy and resolution are two different characteristics.

Here's an example. If someone "calibrated" the power supply to be off by, say, 5 volts, then it would have terrible accuracy, but retain its high resolution.

[bitbanger]

Right right, the problem was I naively assumed that for a $360 150W power supply the meter accuracy would at least match the output resolution. All said still happy.

[bitseeker]

Yep, it can still useful to be able to see small changes in the current draw or fluctuation in voltage without having to hook up a supplemental multimeter.

[djdanielb]

Hi people
Could someone detail the steps using ardui o to enable this features ?

Thank you a lot

[borisbees]

I've done some playing around with my DP712. Slurped the main firmware image off the SPI flash chip inside before and after the trial ran out. Unfortunately the license data is actually stored on an FRAM chip that I missed the first time I took it apart.

For anyone searching, I posted earlier in the year on the wrong thread about dumping the firmware of the DP711/DP712, and have had a few attempts at reverse engineering it to figure out how to generate license keys to unlock options without the intrusive FRAM hack.

I'm currently stuck on figuring out the memory layout in order to relate addresses in the code to actual data. I haven't worked a whole lot with assembly, and never with 8051 / MCS-51 before. In case anyone wants to take a look at this, here's a everything I know so far. DM me if you want a copy of the dump.


Target

The manual for the DP711 states that the following serial command can be used to unlock the device instead of the keypad/UI:

    LIC:SET <keyWithoutDashes>

This seems like the most promising lead to find the licence key algorithm without needing to go through all of the UI related code.

Hardware info

The digital board in the DP711 has a CME-M5 FPGA + 8051 combo chip, an IS42/45S81600F 128Mbit DRAM, and stores its firmware on a Winbond W25Q128FVSG 128mbit SPI flash.

- CME-M5 datasheet: http://www.capital-micro.com/PDF/CME-M5_Family_FPGA_Data_Sheet_EN060418.pdf

- 128Mbit DRAM datasheet: http://www.issi.com/WW/pdf/42-45S81600F-16800F.pdf

- 128Mbit SPI Flash datasheet: https://www.pjrc.com/teensy/W25Q128FV.pdf

The full FPGA/8051 chip model is CME-M5C06N0. It only supports the Keil C51 compiler for the 8051 side of the processor. This variant of the chip has no internal flash, which is why the SPI flash is (conveniently) present.

The 8051 side of the FPGA is documented as a R8051XC2 IP core. This uses a "MCS-51 compatible" instruction set, but has many more peripherals than a generic 8051.

- IP Core: https://ip.cadence.com/uploads/450/cdn-dsd-sys-r8051xc2-ip-pdf

Notes from datasheets

The CMS-M5 has 128K of SRAM accessible by the 8051 MCU. The MCU can use an extended memory mode, accessing the FPGA fabric. I'm unsure if this is used:


    --- 0x07FFFFF
    |
    | FP "Fabric" Expand
    |
    --- 0x020000
    --- 0x01FFFF
    |
    | 128K SRAM
    |
    --- 0x0


The datasheet suggests that FPGA images are about 0x30000 bytes.

Observations

The flash chip is read from address 0x0 at power on after a few flash configuration commands, then at 0x091000 a short while later. The latter address appears to be 8051 assembly. This lines up with what the datasheet suggests.

The FPGA bitstream is likely encrypted, but it does not appear relevant to reversing a license key. The datasheet does not indicate that the MCU code can be encrypted like the bitstream can be.

There are two copies of system settings at 0xCE000 and 0xCE800. About 690 bytes are read from here when entering and exiting the System menu, and when hitting the Timer key. The two strings at the start of this settings data are the calibration date and calibration screen password.

Addresses of interest

Visualization of the flash dump attached. One of the FPGA bitstreams is probably the IP core for the MCU, with the other one being Rigol's own bitstream, assuming they're actually using the FPGA portion of the chip rather than using it purely as a microcontroller.

Bootloader / FPGA core: 0x0
Firmware: 0x091000

The 8051 firmware appears to be split into 4 x 32K sections, identifiable by blocks of NOPs padding at 32K boundaries. This aligns with the 128K of code/data SRAM stated in the datasheet. The sections are:

 - 0x91000 to 0x98FFF
 - 0x99000 to 0xA0FFF
 - 0xA1000 to 0xA8FFF
 - 0xA9000 to 0xB0FFF

From 0xB1000 there's about 1582 bytes that look like instructions (visually similar to the other 4 sections above, but doesn't fit into the above blocks.

After this, the SPI flash appears to be used for persistent storage of settings. This has been verified using a logic analyzer with the DP711 turned on and using the System and Memory functions to change/save settings.


Two copies of system settings at:

 - 0xCE000
 - 0xCE800

Some user settings (Memory button) at: 0x100000

 - These appear to be 33 bytes long
 - Start with 0x01 when set, otherwise 0x0
 - Appears to reference the blocks below (quite spaced out)

Interesting data addresses:

 - Device serial number at 0x0ca000
 - Serial command strings near 0x0cf000
 - Help text near 0x0d2000
 - Licensing related text near 0x0d6000

The LIC:SET serial command might lead quickly to the key. "LIC" appears near other serial command strings at 0x0d025e.

[ElectronMan]

You should read back through this thread. I figured it out and the details are there.

[borisbees]

You should read back through this thread. I figured it out and the details are there.

Yes, the work you've done with the i2c FRAM is great, but:

This is not an ideal solution as it requires opening it up and leeching onto the FRAM chip with a device that talks i2c, but it works

I'm looking for a way to generate a valid licence key from software without opening the PSU, along the lines of http://www.gotroot.ca/rigol/riglol/. I'm well aware I can activate all the features with your FRAM changes, but that only unlocks it for me - generating serials solves it for everyone.

[tv84]

The DP700 keygen is identical to the DL3000 keygen (with a different char_map). See here.

They don't use ECC as riglol/rigup. It's a cascade of CRC16 calculations giving a 28-char license.

The only parameter that is needed for the calculations is the S/N.

I've successfully licensed a DP711 (attached).

Example of licenses for someone curious:

Rigol DP700 S/N: DP7A123456789

                     Official License         
DP7-TRIGER     22W5NBYPM6GUP27A68RY4VWQWH5L 
DP7-TIMER      T9ZKK8GPH7GUTA2BUDDYWJX8PKJ5 
DP7-HIRES      AES6FY3KV6GUV4ENR6QCBK8HH2CK 

[VMZ]

Good afternoon!

Tell me, how exactly did you generate the keys for dp700? Did you do it with riglol? What keys should I use?

[tommot]

Hi, I would also be interested to know and understand how the calculation using this cascaded CRC-16s works.
If I understand this procedure correctly, a CRC-16 is applied to each character of the S/N and converted back to characters via a mapping table?

[tv84]

I will not make the method public. But it's easily visible in the DL3000 FW for those who know how to see.

[VMZ]

Why, then, was it necessary to report this information? Not all programmers are here 

[Nokia6681]

I also plan to buy this DP711, I would be interested in the activation, but I can't program, so I would be very interested in how it works so that everything is activated over Serial

[fqahmad66]

So is it possible to Hack the PS without opening it?

[mrprecision]

Hello,

I have written a software to remote control the power supply and have done some test with my DP711. It should work also on ta DP712. I have activated the DP7-HIRES option. Can some one please test my software with a supply without DP7-HIRES option.



Link for the Download: http://www.schaeck.eu/download/?dir=DP7XX%20Remote

Best Regards,
MrPrecision

[axiv]

They don't use ECC as riglol/rigup. It's a cascade of CRC16 calculations giving a 28-char license.

The only parameter that is needed for the calculations is the S/N.

Please share the algorithm or tell me which way to move