RIGOL DP711 and DP712 new 1ch PSU

[bitseeker]

So looking at photos, I noticed the safety info beside the plug on the DP711 states a max of 300W/400VA. Does that mean its actually capable of 60V 5A?

Hi atarijedi. Welcome to the forum.

You're looking at the input power limit. Unless a power supply has 100% efficiency (not possible) and designed to output that much power, the output power rating will not be anywhere near the input one.

It's always best to read the product specifications, http://int.rigol.com/File/ModelTechDoc/20160503/DP700_DataSheet_EN.pdf , where you'll find the output limit is 150W and the maximum voltage and current depend on the model you choose.

[bson]

I did have to break the "Warranty void if removed"-sticker to find the bad cap.

Americans can just remove them since they violate federal law.
https://www.extremetech.com/gaming/233120-microsoft-sony-and-other-manufacturers-still-use-illegal-warranty-void-if-removed-stickers

[bitseeker]

Thanks. Interesting article, bson.

[bitbanger]

I know this is a bit of an old thread but just a note from a DP711 owner: look carefully at specs. High res doesn't mean high accuracy! I was happy with the supply so after a few months decided to upgrade without considering this.

Output is within 0.7mV on a 6-1/2 digit DMM. However the DP711 readout is out nearly 12mV. After looking at the specs this is technically "in"("Annual Accuracy: Readback: Voltage 0.05% + 20 mV") but I can't understand why or how you can control to 1mV but your meter is off 12mV (I would assume that in a new power supply like this your display should be showing the ADC value used for feedback control)? This held with and without load.

[bitseeker]

Correct. Accuracy and resolution are two different characteristics.

Here's an example. If someone "calibrated" the power supply to be off by, say, 5 volts, then it would have terrible accuracy, but retain its high resolution.

[bitbanger]

Right right, the problem was I naively assumed that for a $360 150W power supply the meter accuracy would at least match the output resolution. All said still happy.

[bitseeker]

Yep, it can still useful to be able to see small changes in the current draw or fluctuation in voltage without having to hook up a supplemental multimeter.

[djdanielb]

Hi people
Could someone detail the steps using ardui o to enable this features ?

Thank you a lot

[borisbees]

I've done some playing around with my DP712. Slurped the main firmware image off the SPI flash chip inside before and after the trial ran out. Unfortunately the license data is actually stored on an FRAM chip that I missed the first time I took it apart.

For anyone searching, I posted earlier in the year on the wrong thread about dumping the firmware of the DP711/DP712, and have had a few attempts at reverse engineering it to figure out how to generate license keys to unlock options without the intrusive FRAM hack.

I'm currently stuck on figuring out the memory layout in order to relate addresses in the code to actual data. I haven't worked a whole lot with assembly, and never with 8051 / MCS-51 before. In case anyone wants to take a look at this, here's a everything I know so far. DM me if you want a copy of the dump.


Target

The manual for the DP711 states that the following serial command can be used to unlock the device instead of the keypad/UI:

    LIC:SET <keyWithoutDashes>

This seems like the most promising lead to find the licence key algorithm without needing to go through all of the UI related code.

Hardware info

The digital board in the DP711 has a CME-M5 FPGA + 8051 combo chip, an IS42/45S81600F 128Mbit DRAM, and stores its firmware on a Winbond W25Q128FVSG 128mbit SPI flash.

- CME-M5 datasheet: http://www.capital-micro.com/PDF/CME-M5_Family_FPGA_Data_Sheet_EN060418.pdf

- 128Mbit DRAM datasheet: http://www.issi.com/WW/pdf/42-45S81600F-16800F.pdf

- 128Mbit SPI Flash datasheet: https://www.pjrc.com/teensy/W25Q128FV.pdf

The full FPGA/8051 chip model is CME-M5C06N0. It only supports the Keil C51 compiler for the 8051 side of the processor. This variant of the chip has no internal flash, which is why the SPI flash is (conveniently) present.

The 8051 side of the FPGA is documented as a R8051XC2 IP core. This uses a "MCS-51 compatible" instruction set, but has many more peripherals than a generic 8051.

- IP Core: https://ip.cadence.com/uploads/450/cdn-dsd-sys-r8051xc2-ip-pdf

Notes from datasheets

The CMS-M5 has 128K of SRAM accessible by the 8051 MCU. The MCU can use an extended memory mode, accessing the FPGA fabric. I'm unsure if this is used:


    --- 0x07FFFFF
    |
    | FP "Fabric" Expand
    |
    --- 0x020000
    --- 0x01FFFF
    |
    | 128K SRAM
    |
    --- 0x0


The datasheet suggests that FPGA images are about 0x30000 bytes.

Observations

The flash chip is read from address 0x0 at power on after a few flash configuration commands, then at 0x091000 a short while later. The latter address appears to be 8051 assembly. This lines up with what the datasheet suggests.

The FPGA bitstream is likely encrypted, but it does not appear relevant to reversing a license key. The datasheet does not indicate that the MCU code can be encrypted like the bitstream can be.

There are two copies of system settings at 0xCE000 and 0xCE800. About 690 bytes are read from here when entering and exiting the System menu, and when hitting the Timer key. The two strings at the start of this settings data are the calibration date and calibration screen password.

Addresses of interest

Visualization of the flash dump attached. One of the FPGA bitstreams is probably the IP core for the MCU, with the other one being Rigol's own bitstream, assuming they're actually using the FPGA portion of the chip rather than using it purely as a microcontroller.

Bootloader / FPGA core: 0x0
Firmware: 0x091000

The 8051 firmware appears to be split into 4 x 32K sections, identifiable by blocks of NOPs padding at 32K boundaries. This aligns with the 128K of code/data SRAM stated in the datasheet. The sections are:

 - 0x91000 to 0x98FFF
 - 0x99000 to 0xA0FFF
 - 0xA1000 to 0xA8FFF
 - 0xA9000 to 0xB0FFF

From 0xB1000 there's about 1582 bytes that look like instructions (visually similar to the other 4 sections above, but doesn't fit into the above blocks.

After this, the SPI flash appears to be used for persistent storage of settings. This has been verified using a logic analyzer with the DP711 turned on and using the System and Memory functions to change/save settings.


Two copies of system settings at:

 - 0xCE000
 - 0xCE800

Some user settings (Memory button) at: 0x100000

 - These appear to be 33 bytes long
 - Start with 0x01 when set, otherwise 0x0
 - Appears to reference the blocks below (quite spaced out)

Interesting data addresses:

 - Device serial number at 0x0ca000
 - Serial command strings near 0x0cf000
 - Help text near 0x0d2000
 - Licensing related text near 0x0d6000

The LIC:SET serial command might lead quickly to the key. "LIC" appears near other serial command strings at 0x0d025e.

[ElectronMan]

You should read back through this thread. I figured it out and the details are there.

[borisbees]

You should read back through this thread. I figured it out and the details are there.

Yes, the work you've done with the i2c FRAM is great, but:

This is not an ideal solution as it requires opening it up and leeching onto the FRAM chip with a device that talks i2c, but it works

I'm looking for a way to generate a valid licence key from software without opening the PSU, along the lines of http://www.gotroot.ca/rigol/riglol/. I'm well aware I can activate all the features with your FRAM changes, but that only unlocks it for me - generating serials solves it for everyone.

[tv84]

The DP700 keygen is identical to the DL3000 keygen (with a different char_map). See here.

They don't use ECC as riglol/rigup. It's a cascade of CRC16 calculations giving a 28-char license.

The only parameter that is needed for the calculations is the S/N.

I've successfully licensed a DP711 (attached).

Example of licenses for someone curious:

Rigol DP700 S/N: DP7A123456789

                     Official License         
DP7-TRIGER     22W5NBYPM6GUP27A68RY4VWQWH5L 
DP7-TIMER      T9ZKK8GPH7GUTA2BUDDYWJX8PKJ5 
DP7-HIRES      AES6FY3KV6GUV4ENR6QCBK8HH2CK 

[VMZ]

Good afternoon!

Tell me, how exactly did you generate the keys for dp700? Did you do it with riglol? What keys should I use?

[tommot]

Hi, I would also be interested to know and understand how the calculation using this cascaded CRC-16s works.
If I understand this procedure correctly, a CRC-16 is applied to each character of the S/N and converted back to characters via a mapping table?

[tv84]

I will not make the method public. But it's easily visible in the DL3000 FW for those who know how to see.

[VMZ]

Why, then, was it necessary to report this information? Not all programmers are here 

[Nokia6681]

I also plan to buy this DP711, I would be interested in the activation, but I can't program, so I would be very interested in how it works so that everything is activated over Serial

[fqahmad66]

So is it possible to Hack the PS without opening it?

[mrprecision]

Hello,

I have written a software to remote control the power supply and have done some test with my DP711. It should work also on ta DP712. I have activated the DP7-HIRES option. Can some one please test my software with a supply without DP7-HIRES option.



Link for the Download: http://www.schaeck.eu/download/?dir=DP7XX%20Remote

Best Regards,
MrPrecision

[axiv]

They don't use ECC as riglol/rigup. It's a cascade of CRC16 calculations giving a 28-char license.

The only parameter that is needed for the calculations is the S/N.

Please share the algorithm or tell me which way to move