Siglent SSA3000X and SSA3000X-Plus Spectrum Analyzers

[Major1206]

It might be unnecessary, but I modified procedure of the cross-flash by electr_petr Post #1619 & TV84 hex mod from post #2017
It includes everything important.

SSA3021X Plus (FW 3.2.2.5.1R1) to SVA1032X (FW 3.2.2.5.1R1) conversion steps
Procedure for SSA3015X plus to SVA3015X is nearly the same - just lack of bandwidth upgrade
For non-plus there is only online tool license ubnlocking, no cross-flash to SVA, different platform

Prerequisites:
•   Siglent SSA3021X Plus with FW 3.2.2.5.1R1 (if you have FW 3.2.2.5.1R20, simply download R1 and flash it to downgrade)
•   FAT32 formatted USB stick
•   network cable
•   computer with USB and network connection
•   check how to change files with vi editor https://www.howtogeek.com/102468/a-beginners-guide-to-editing-text-files-with-vi/ (read it carefully)
•   SSA3000X+_backup_11411.ADS https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=1217021
•   SSA3000X+_telnet_11411.ADS https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=1217022
•   SVA1000X FW 3.2.2.5.1R1
•   TV84 hex mod for FW 3.2.2.5.1R1 https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4403962/#msg4403962
•   VNA calibration files https://www.eevblog.com/forum/testgear/siglent-sva1015x-1-5ghz-spectrum-vector-network-analyzer-(coming)/msg3707803/#msg3707803
•   

I) Initial backup of SSA3021X Plus

1. Turn on SSA, put USB stick with SSA3000X+_backup_11411.ADS in the front USB port on SSA
2. Navigate to USB directory, select *.ADS via File -> Open/Load and press Enter
3. Wait until device reboots itself, then turn off, eject USB flash and copy backup files to PC. Total backup size is ~483MB (in my case)

II) Telnet access for SSA3021X Plus & manual backup

1) Connect Ethernet cable to SSA3021X and network, configure IP (DHCP option recommended), note IP address.
2) Internal product ID should be 11411. Launch fake update SSA3000X+_telnet_11411.ADS from USB stick to start telnet. SSA hangs with update screen, that's normal.
3) Use Putty (on windows)  to telnet to your SSA
   telnet <SSA IP address> 10101 (for example, Windows terminal Win+R, CMD works)
4) Backup main directories using commands:

Code: [Select]

   cd /
   mount -o remount,rw /usr/bin/siglent/usr/mass_storage/U-disk0
   cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
   cp -R /usr/bin/siglent/usr/config /usr/bin/siglent/usr/mass_storage/U-disk0/SA-config
   cp -R /usr/bin/siglent/usr/usr /usr/bin/siglent/usr/mass_storage/U-disk0/SA-usr
   cp -R /usr/bin/siglent/usr/vnacalikitdata /usr/bin/siglent/usr/mass_storage/U-disk0/SA-vnacalikitdata
   cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata05) Make files writeable
   

Code: [Select]

mount -o remount,rw /usr/bin/siglent6) and add telnet server startup line in file “/usr/bin/siglent/startup_app.sh”:
   

Code: [Select]

vi /usr/bin/siglent/startup_app.shenter the following line exactly close to the end, just before line "/usr/bin/siglent/Aladdin &"
 

Code: [Select]

/sbin/telnetd -l /bin/sh -p 10101 &7)The end of file will look like:

Code: [Select]

portmap &

/sbin/telnetd -1 /bin/sh -p 10101 &
/usr/bin/siglent/Aladdin &

echo "startup_app.sh   end++++++++++"
7) finalise changes and reboot
   

Code: [Select]

sync && reboot
Telnet is active, if you did something wrong there is always backup option for telnet:
1)   Open your SSA webpage
2)   Sent via SCPI “DEBTTT” command
3)   You can use putty to telnet over port 23
4)   Login using username:root paswd:ding1234

III) HEX Mod firmware FW 3.2.2.5.1R1 using @TV84 instruction  & flash
1.   Download exactly SVA1000X FW 3.2.2.5.1R1 and unpack to your computer,
2.   Use notepad++ with hex plugin or other tool to perform hex mod.
3.   Look up post 2017, you have to replace in the very beginning of file
“41 6D 11 4C 62 2F 9D 2D 48 0A DF 44 D7 B2 FE DD”
With
“79 BD EC D2 AB F3 35 A5 E6 F3 58 BF 53 0D 24 8C”
5)   Check md5 of the modified file: 3E137F44965CC6205F704E50203EFB27
6)   Flash the new modified firmware

IV) Enable full options on SVA

1) Launch online python tool: https://www.online-python.com/PX3v0J8nbs
2) Uncomment  #Model = 'SVA1000X' line (remove #)
3) In you SSA navigate to system info and note HOSTID
4) Input HOSTID into python tool
5) Generate license codes and with SSA menu option System -> Load Option install following options: VNA, ALL, 3032
V) Restore calibration files
1) Navigate to https://www.eevblog.com/forum/testgear/siglent-sva1015x-1-5ghz-spectrum-vector-network-analyzer-(coming)/msg3707803/#msg3707803 and download cali.zip
2) Extract contents to your backup USB stick folder:
\SA-firmdata0\cali

3) Connect Ethernet cable to SSA3021X and network, configure IP (DHCP option recommended), note IP address (again)
4) Use Putty (on windows)  to telnet to your SSA
   telnet <SSA IP address> 10101 (for example, Windows terminal Win+R, CMD works)
5) Make files writeable
   

Code: [Select]

mount -o remount,rw /usr/bin/siglent/firmdata06) Copy calibration files from USB stick to SSA
 

Code: [Select]

cp /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0/cali/na_1p /usr/bin/siglent/firmdata0/cali/na_1p
  cp /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0/cali/na_2p /usr/bin/siglent/firmdata0/cali/na_2p7) finalise changes and reboot
   

Code: [Select]

sync && rebootVI) Recalibrate VNA using short/load/open calibration kit

[Crambone]

Does it need to be SSA3021X Plus or can it be a SSA3021X as they include tracking now and cost less?
As a total Computer idiot I wish someone did a video on the entire process.

Drew

[tautech]

Does it need to be SSA3021X Plus or can it be a SSA3021X as they include tracking now and cost less?

Drew

Get the X Plus Drew as the little more cost is rewarded with a touch display and mouse/keyboard capable device and a few more fruits too.
Since the Plus release we haven't bothered with the earlier plain X at all.

[Crambone]

Good to know thanks I do like the mouse option tons.

drew

[roblkc3]

... Thanks Major1206!! It seems to work fine by me!! (though the sytem information still says that it is a SSA --- but, IIRC, somewhere in this thread someone said this is normal...)
I was starting with the latest firmware version (3.2.2.5.1R20), so as a first step I've downgraded to the 3.2.2.5.1R1 version (simply took the firmware from Siglent's website and loaded it).
I had a couple of differences with respect to what you did, I note them down here (maybe they come in handy for someone else)
- the backup firmware did not work the first time I've loaded it, the USB key had no additional files on it. I had to do it twice to make it work
- I have used a fixed IP address (easy to set in the SSA's menus), so that I did not have to bother myself too much looking for the latest IP each time
- to perform the manual backups I had to make the USB key writable

Code: [Select]

mount -o remount,rw /usr/bin/siglent/usr/mass_storage/U-disk0- in my terminal (Linux console) I had the last line of the '/usr/bin/siglent/startup_app.sh' file hidden by the vi bar --- I've simply ignored it, and checked that everything was ok by doing a 'cat' of the file afterwards (for the non-Linux users, simply type:

Code: [Select]

cat /usr/bin/siglent/startup_app.sh)
- I had already used the keygen, so I had everything already set as "permanent". When I've tried inserting the code again, I received an invalid code message --- but I guess that this does not change much since, well, the GUI tells me that everything is already enabled...
- to load the calibration files, I had to enable telnet via the web interface of the SVA (open up your browser, enter the IP of the SVA, then go in the SCPI section and enter 'DEBTTT'). The telnet port becomes 23, so as you say in your post:

Code: [Select]

telnet 10.0.0.50 23
  username: root
  password: ding1234
Thanks again, a very fine way to start my day 

Rob

---- edit ----
Actually, as stated here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4656364/#msg4656364 the model name change is mandatory.
I've thus followed the instructions given here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4596574/#msg4596574 (step 7).
I've also re-run the Python script with SVA1000X as model name (as in step 8 of the post linked above), and enabled first the 3.2 GHz bw (the '3032' option), rebooted and then enabled  'ALL'.

[Major1206]

Yes, fixed unlock step. I've first unlocked licenses in SSA+ model, then cross-flashed. so that is why there is confusion.

[Crambone]

Will this work on the SSA3015X Plus?

Andrew

[Major1206]

Yes, but only to SVA1015

[WPE]

AM  DEMODULATION  QUESTION:  I recently got a used SSA3021X, with version list:  SW1 is at 1.2.9.1, SW2 is 20180320-1, SW3 is 000000D1, HW 07.03.00.  Tag says March 2017.  It's had so little use it still has many hours remaining on the unlicensed options.   
 I can't get AM demod out of the audio jack.   I located a strong local AM station at 1.42 Mhz, tried RBW 20kHz, SPAN .5 MHz with 5s sweep - also tried various RBW/VBW and zero span.  There is absolutely no output at all from the audio jack.  I am able to get FM audio just fine from local FM stations feeding it into computer speakers.  Did I set something up wrong for AM?  I only recall one other poster having such trouble - but can't find that reference now.  It seems generally functional and in-spec, and I was able to sweep a 5.3 MHz filter just fine. 

[xugmu]

Hello, I have two questions regarding the SSA3000

The first is general, I am used to using  tv analyzers and they all bring spectrum analyzers. Normally the noise floor is usually around 20db. Nowadays almost all the signals are digital, for example, a COFDM signal With 8mhz of bandwidth, that type of signal, in a spectrum analyzer like the one that television analyzers bring, would logically begin to be seen from 20db. The  question would be: From what lower level would you start to know that there is such a signal in an SSA3000? We could add the variable of the amplifier but in any case it would be a question of knowing what advantage in terms of weak signals an SSA3000 has over a spectrum analyzer of a normal TV analyzer.

The second question would be to know the dynamic range of these analyzers

Best  Regards

Refer to P10 of the datasheet:
https://int.siglent.com/u_file/download/22_08_23/SSA3000X%20Plus_DataSheet_DS0703P_E04C.pdf

Range is RBW setting and Preamp dependant in that we need the Preamp ON to obtain best sensitivity and RBW at a low value too but the penalty for selecting all sensitivity possible is much increased sweep times.

I do not think that the DANL is the same as the dynamic range, if it were, it would mean that a spectrum analyzer, with the appropriate rbw, could represent a -150dBm signal together with one of, for example, 10dBm. That is, we would be talking about a dynamic range of 160 dBm.

From what I have seen on the internet, I very much doubt that any spectrum analyzer can represent, without problems, a 10 dBm signal together with a -150 dBm signal.

Analyzer                                                       Maximum Dynamic Range @1 GHz   
Signal Hound SA44B 4.4 GHz, 250 kHz IBW     104 dB   
Signal Hound BB60C 6 GHz, 27 MHz IBW        95 dB   
Signal Hound SM200B 20 GHz, 160 MHz         118 dB   
Keysight N9020B-526-B1X (MXA) 26.5 GHz    116 dB

https://signalhound.com/news/how-much-dynamic-range-do-you-really-need/


Best  regards

[RoV]

AM  DEMODULATION  QUESTION:  I recently got a used SSA3021X, with version list:  SW1 is at 1.2.9.1, SW2 is 20180320-1, SW3 is 000000D1, HW 07.03.00.  Tag says March 2017.  It's had so little use it still has many hours remaining on the unlicensed options.   
 I can't get AM demod out of the audio jack.   I located a strong local AM station at 1.42 Mhz, tried RBW 20kHz, SPAN .5 MHz with 5s sweep - also tried various RBW/VBW and zero span.  There is absolutely no output at all from the audio jack.  I am able to get FM audio just fine from local FM stations feeding it into computer speakers.  Did I set something up wrong for AM?  I only recall one other poster having such trouble - but can't find that reference now.  It seems generally functional and in-spec, and I was able to sweep a 5.3 MHz filter just fine.

My SSA3021X+ upgraded to SVA1032X decodes AM correctly. Input 1.5 MHz, -50 dBm, 1 kHz AM at 50%. Two figures: your setting and a more reasonable one. In both cases I get correct audio demod.

[tautech]

From what I have seen on the internet, I very much doubt that any spectrum analyzer can represent, without problems, a 10 dBm signal together with a -150 dBm signal.

From P3 in this thread is an example taken from an early SSA3000X prior to release as an example setting the RBW and REF level to explore the lower levels of sensitivity. Since those early days many later firmware versions improved on what these instruments can do to now we have RBW of 1 Hz whereas once it was 10 Hz as shown in this screenshot.


2 specifications that should be of interest:
Measurement range
DANL to +10 dBm, 100 kHz ~ 1 MHz, Preamp off
DANL to +20 dBm, 1 MHz ~ 7.5 GHz, Preamp off

Reference level -200 dBm to +30 dBm, 1 dB steps

I might suggest you invest even more time on the internet.

[djeZo888]

Everyone is talking about X or X+, but very little info about -R model. Because names are so similar, search mostly spits out only X or X+ related, crossflashing etc..

I read this thread and got info that all -R models have the same HW and that SSA3032X-R to SSA3075X-R with all opts is possible.

To get keys, I did find information and can generate them, so activating options should not be a problem.

But how about increasing BW? 

Is it the same as with SDS and SDG - activate LAN, telnet in and use SCPI commands? Is the command the same as for SDS/SDG? - MCBD?

Thanks

[DL4JY]

How about using the (online) python script? No need to use telnet etc.

Are you sure you read the thread ?

Search for "3075" in this thread.

[djeZo888]

Like I said, I know about the script - and I have generated the keys. The only question I have is where do I enter the bandwidth key? 

[DL4JY]

under system - system info - load option??
!!

[djeZo888]

Okay thanks! 

When I get the device, I will try that out!

[mellowamoya]

Hi I need a little help basicaly i started with a new ssa3021x-plus did the upgrade and cross flash, and changed the nsp config file created the licence file, updated to FW 3.2.2.5R1. can i update FW to SVA1032X ?
The unit is working but I think I made a mistake with the NSP config file in model it is empty, I am unable to get telnet access what ADS file do I need to use to get telnet access so I can correct the NSP file.
I also only have 7 options so I think something is missing. I see 10 in other posts, and the created licence file has 10.
Also how do I load the calibration file ?

dennis

[tv84]

The unit is working but I think I made a mistake with the NSP config file in model it is empty, I am unable to get telnet access what ADS file do I need to use to get telnet access so I can correct the NSP file.

Wowww!!! 

This is uncharted waters. ATM, I don't think you can access it with any of my telnet .ADS files and you will not be able to use any of the Siglent's stock .ADS also.

Unless a recovery package from tautech can do some magic, you'll have to access it via UART to restore that file contents.

[mellowamoya]

Ok thanks I'll have to look for the posts about accessing via the UART.
Once access and changed the file should i be able to flash the FW again?
thanks
Dennis

[tv84]

Once access and changed the file should i be able to flash the FW again?

Yes. The FW files use that file info to verify the Product_ID. If it matches, the FW update proceeds.

[killingtime]

Just out of curiosity, what's the max power that you can run into a SSA3000X+ before non-linearity or artifacts? Anyone tried higher power levels?
The spec sheet says +30dbm (1W) with 20db of internal attenuation & no pre-amp. That doesn't mean linearity will be maintained to that level though, or that you would want to run at that level.

I'll be testing HF amplifier output to 100W, and wondered if 1mW (0dBm, no internal attenuation) via a ext 50dB attenuator would be a reasonable input power.

There's a section in the spec sheet titled 'Distortion and Spurious Responses' that I think should answer my questions, but I'm having a hard time understanding it. Attached.

My understanding:
1db amplitude compression at -5dBm
TOI using two -20dBm tones at +10dBm
2nd Harmonic distortion -65dBc at +45dBm (?) that's above safe operating power.

[tautech]

P11 datasheet
Maximum average power 30 dBm, 3 minutes, fc ≥10 MHz, att > 20 dBm, preamp off
Maximum damage level 33 dBm, fc ≥ 10 MHz, att > 20 dBm, preamp off

A few lines up, SSA3021X+ and higher models: Input attenuation 0 ~ 30 dB, 1 dB steps 0 ~ 50 dB, 1 dB steps

[killingtime]

Yep, seen that. I don't think Siglent are saying that the instrument will be distortion free and linear all the way up to that power level though. That's just the power below which you don't let the magic smoke out the front end.

[tautech]

Yep, seen that. I don't think Siglent are saying that the instrument will be distortion free and linear all the way up to that power level though. That's just the power below which you don't let the magic smoke out the front end.

Right, well actually all the datasheet specifications need be considered for any usage.....including accuracy specs....level and frequency.

Here we need kill time and do proper study.