Just received this email. Although I'm fairly critical of Rigol these days, I could use a mediacore signal gen if it's priced right.
Why not go for a second hand Agilent ESG or R&S SME/SMIQ instead? There are many around so prices are pretty low, and they all offer better specs.
I just received the same email. I am very interested but it is a shame there is not a 6 GHz option. That is a maybe a deal killer for me.
I am going to hold my breath until they give more specs.
Why not go for a second hand Agilent ESG or R&S SME/SMIQ instead? There are many around so prices are pretty low, and they all offer better specs.
I was hoping for something half decent, but in a small form factor, :-[
So I'ld say this unit contains a very good hardware and there may actually be a chance for "improvement" of the entry models. What kind of calibration would be necessary afterwards is written on a different page, though... ???
This usually means ;D for everyone and |O for me! :popcorn:
We definitely need a specimen to do some testing.
Attached my notes to extract the firmware binaries from firmware upgrade files.
Attached my notes about the mystery file.
Attached the full list of SCPI commands extracted from the 00.01.06.00.01 firmware image.
It gets obvious that the I/Q add-on board contains more circuitry than just a few ESD ptotection devices and some interconnections, it's got to contain the complete I/Q modulator, and as it seems also considerable circuitry to generate the I/Q baseband signal. So no easy hack, if possible at all...
Does anyone have pictures of the IQ board?
Does anyone have pictures of the IQ board?
Dave's HiRes photos are here (https://www.eevblog.com/2015/11/25/eevblog-823-rigol-dsg815-rf-signal-generator-teardown/).
Dave’s unit didn’t have the IQ board fitted.
Attached my notes to extract the firmware binaries from firmware upgrade files.
Offset CRC32 Type Size Cont Ref1 FTyp Ref2
00000000 - 55469C59 sys0 00000278 dat0 00000002 DSG8A 00000001 [00000004-00000277] CRC OK
00000278 - A8D35F6B bin0 00000210 dat0 00000002 DSG8A 00000001 [0000027C-00000487] CRC OK
00000488 - 196CF684 bin0 00047E9C dat0 00000001 DSG8A 00000003 [0000048C-00048323] CRC OK
00048324 - C87E57E1 rbf0 0005E802 dat0 00000001 DSG8A 00000003 [00048328-000A6B25] CRC OK
000A6B28 - 5BB89F1D bin0 00177C90 dat0 00000001 DSG8A 00000003 [000A6B2C-0021E7B7] CRC OK
0021E7B8 - 1E8000CA bin0 000B99FC dat0 00000001 DSG8A 00000003 [0021E7BC-002D81B3] CRC OK
002D81B4 - 0A378E85 sim0 002B7C95 dat0 00000001 DSG8A 00000003 [002D81B8-0058FE48] CRC OK
0058FE4C - ED06206E bin0 00000046 dat0 00000001 DSG8A 00000003 [0058FE50-0058FE91] CRC OK
0058FE94 - 8A912D43 bin0 00000045 dat0 00000001 DSG8A 00000003 [0058FE98-0058FED8] CRC OK
------------------------- SYSTEM BLOCK --------------------------------------------
00000040 - FW Type: DSG8A
00000050 - Version(?): 00000001
00000054 - # Files: 8
Offset Type Addr(?) Size Flags Filename
00000058 - 00000278 Index 06100000 00000210 00002800 index.bin [000002B8-00000487]
0000009C - 00000488 Setup 06F80000 00047E9C 00100000 DORY_XML.bin [000004C8-00048323]
000000E0 - 00048324 Fpga 06900000 0005E802 00080000 vmu.rbf [00048364-000A6B25]
00000124 - 000A6B28 Res 06D80000 00177C90 00200000 ResData.bin [000A6B68-0021E7B7]
00000168 - 0021E7B8 Fpga 06800000 000B99FC 00100000 dory_wrapper.bin [0021E7F8-002D81B3]
000001AC - 002D81B4 DspPro 06200000 002B7C95 00500000 DoryApplication.sim [002D81F4-0058FE48]
000001F0 - 0058FE4C FirEra 06B00039 00000046 00000050 FirstErase.bin [0058FE8C-0058FE91] RIGOL
00000234 - 0058FE94 ver 06B00022 00000045 00200000 Version.bin [0058FED4-0058FED8] 00.01.06.00.01Offset CRC32 Type Size Cont Ref1 FTyp Ref2
00000000 - 09572EBC sys0 00000278 dat0 00000002 DSG8A 00000001 [00000004-00000277] CRC OK
00000278 - 1B2487B9 bin0 00000210 dat0 00000002 DSG8A 00000001 [0000027C-00000487] CRC OK
00000488 - 140DF4A7 bin0 00049D5E dat0 00000001 DSG8A 00000003 [0000048C-0004A1E5] CRC OK
0004A1E8 - C87E57E1 rbf0 0005E802 dat0 00000001 DSG8A 00000003 [0004A1EC-000A89E9] CRC OK
000A89EC - 42A9907B bin0 00176070 dat0 00000001 DSG8A 00000003 [000A89F0-0021EA5B] CRC OK
0021EA5C - 95EABB13 bin0 000B9DD3 dat0 00000001 DSG8A 00000003 [0021EA60-002D882E] CRC OK
002D8830 - 1002AE08 sim0 002B7A11 dat0 00000001 DSG8A 00000003 [002D8834-00590240] CRC OK
00590244 - ED06206E bin0 00000046 dat0 00000001 DSG8A 00000003 [00590248-00590289] CRC OK
0059028C - 1537D2D7 bin0 00000045 dat0 00000001 DSG8A 00000003 [00590290-005902D0] CRC OK
------------------------- SYSTEM BLOCK --------------------------------------------
00000040 - FW Type: DSG8A
00000050 - Version(?): 00000002
00000054 - # Files: 8
Offset Type Addr(?) Size Flags Filename
00000058 - 00000278 Index 06100000 00000210 00002800 index.bin [000002B8-00000487]
0000009C - 00000488 Setup 06F80000 00049D5E 00100000 DORY_XML.bin [000004C8-0004A1E5]
000000E0 - 0004A1E8 Fpga 06900000 0005E802 00080000 vmu.rbf [0004A228-000A89E9]
00000124 - 000A89EC Res 06D80000 00176070 00200000 ResData.bin [000A8A2C-0021EA5B]
00000168 - 0021EA5C Fpga 06800000 000B9DD3 00100000 dory_wrapper.bin [0021EA9C-002D882E]
000001AC - 002D8830 DspPro 06200000 002B7A11 00500000 DoryApplication.sim [002D8870-00590240]
000001F0 - 00590244 FirEra 06B00039 00000046 00000050 FirstErase.bin [00590284-00590289] RIGOL
00000234 - 0059028C ver 06B00022 00000045 00200000 Version.bin [005902CC-005902D0] 00.01.07.00.06
Attached my notes to extract the firmware binaries from firmware upgrade files.
Example of a .SYS FW parsing (don't have here the version...):Code: [Select]00000000 - Header CRC32: 55469C59 [00000004-00000277] CRC OK
00000018 - File Type: DSG8A
00000050 - Version: 00000001
00000054 - # Sections: 8
Offset StartAdr Type LoadAddr Size Filename
00000058 00000278 Index 06100000 00000210 00002800 index.bin [00000278-00000487]
0000009C 00000488 Setup 06F80000 00047E9C 00100000 DORY_XML.bin [00000488-00048323]
000000E0 00048324 Fpga 06900000 0005E802 00080000 vmu.rbf [00048324-000A6B25]
00000124 000A6B28 Res 06D80000 00177C90 00200000 ResData.bin [000A6B28-0021E7B7]
00000168 0021E7B8 Fpga 06800000 000B99FC 00100000 dory_wrapper.bin [0021E7B8-002D81B3]
000001AC 002D81B4 DspPro 06200000 002B7C95 00500000 DoryApplication.sim [002D81B4-0058FE48]
000001F0 0058FE4C FirEra 06B00039 00000046 00000050 FirstErase.bin [0058FE4C-0058FE91]
00000234 0058FE94 ver 06B00022 00000045 00200000 Version.bin [0058FE94-0058FED8]
Shame that they don't offer the add-on as a separate option so users of the basic version can later on decide to upgrade to I/Q functionality.
But there may be a real chance for a frequency upgrade... Seems like hardware-wise, evereything's already there.
TurboTom,
Thank You so much for your very insightful observations and explanations :clap:
A few questions, from a novices point of view ;-
1. Given Rigol's 'straight-through' approach - are there any inherent performance (i.e. better phase noise, smaller harmonics, etc, etc) advantages over the full-range mixer approach?
2. Did Siglent adopt a similar approach in their SSG3000x range? or the full-range mixer approach?
3. Are there inherent performance benefits of the full-range mixer approach - if so, what are they?
Thanks
Looks like I got a different version of the firmware file. For example the size of DoryApplication.sim is 0x2b7be4 in mine.
I wasn't aware of that thread. The only difference is :SYSTem:PRESet (620, 0x4016cdd8, :SYSTem:PRESet, Programming Guide) which is missing in your list.
Chicken, I've placed renewed parsings in the previous msg.
Check to see if you have a different FW from the ones I have. If yes, I would be interested in getting that one also.
Thanks, this allowed me to correct a rare bug. You could correct your command IDs. It's not the int16 that you assumed (see my list).
PS: And here my notes about loading extracted firmware binaries with Ghidra and radare2
Norepy
From this thread I take you have have bot the Rigol and Siglent offerings on test currently, so what are you conclusions thus far or is the jury still out?
SSG3000X offers touch and mouse control.
I would like a 'touch screen
What I noticed, is that there is no Square Wave output on the 815 - other than on the LF output (BNC) and only up to 20KHz.The LF modulation section in SSG3kX is rated thus:
Not sure if its same on the Siglent at this moment in time?
I can understand that there is no great desire for Square Waves when working with RF (and a digital DAC based signal generator can suffice at a much lower cost) but in my 'one off' case , I was looking for a ULTRA FAST edge in a signal - I guess this is where the 'pulse mode' comes into play. This is my next area of testing , so will report soon.IIRC same for SSG3kX and have it enabled in my unit if there's anything you want to see.
On the 815, this is an option (I think the Siglent has this feature as standard offering - correct me if wrong) so at the moment its on 'trial' mode until time runs out.
With 2.4GHz, 5GHz and even higher RF devices being the norm today - you really need to have the higher frequency capability - especially if you are going to drop >$3000 for a RF Signal Generator.The newer range of SSG5000X RF gens go to 6 GHz but yes these are getting really pricey. :(
This makes me think that even the Rigol's 3.6GHz and Siglent's 3.2GHz offerings are already dated.
But, and a big BUT, there are already RF Signal Generators which cover the higher frequencies and modern digital modulation protocols out on the market but unfortunately they cost lots of $$$.
This is why for the majority of 'us' its the Rigol and Siglent offerings (even if dated) that are really affordable at the moment.
If anyone can make a memdump, we can have a dry run. :popcorn:
If anyone can make a memdump, we can have a dry run. :popcorn:
What's the procedure for a memdump? I may give it a try.
Thanks tv84,
I don't suppose you have any tips on extracting the key for a DSG815 owner? ;D
I tried running rigup search & scan on the file plus on the files extracted by binwalk but no luck |O
Thanks.
:palm: The instructions are above.
Currently running 'break' on the public key but no idea how long it will take.
Turns out it seems to be broken on Linux and OSX but runs OK on Windows (last 4 digits are 23EF), although the resulting key does not produce something my sig gen likes.
Not just broken on Linux & OSX, but Windows too. After waiting a week for a result from rigup-0.4.2-x86_64-win.exe break 6673BBC777EA4D, I gave up and tried running it on another machine. Instant success. 3521E2B968D60F.
How to license DSG815/830 optionsHi TV84
Insert the following parameters in the usual license generator (http://gotroot.ca/rigol/riglol/) :
Forever Options:
AAAB (0x00400) - DSG800-PUM Pulse Modulation & Pulse Generator
AAAC (0x00800) - DSG800-PUG Pulse Train Generator
Public Key:
6673BBC777EA4D (Key taken from the current FW. Those interested will have to calculate the Private Key as homework.) ;)
As always, insert the licenses with SCPI command :SYSTem:LKEY.
Here's how to enter FACTORY and MANAGER/REPAIR modes:
Prepare a USB stick:
1. Format as FAT32
3. Write the following string to disc sector 3 of the USB stick (I used HxD):
35O8O228OLO8LNMN9690217963MN2O9ON46O9P05975K0047
Plug USB stick into the RF generator
Now the following SCPI commands will work:
:PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE
:PRIV:SOFT:MODE 0,REPAIRMODEENTRANCE
:PRIV:SOFT:MODE 0,MANAGERMODEENTRANCE
The first parameter (0) seems to be ignored.
MANAGER and REPAIR seem to be identical, but entering REPAIR doesn't require the USB stick.
The current mode can be verified with:
:PRIV:SOFT:MODE?
To return to USER mode, power cycle the device or use
:PRIV:SOFT:MODE 0,USERMODEENTRANCE
or
:PRIV:SOFT:MODE 0,EXITCURRENTMODE
Additional menus show up when in FACTORY/REPAIR/MANAGER mode:
Syst > Service
Syst > Service > Calibration
Syst > Service > RF DataSyn
Syst > License > Delete
I haven't dared to mess with settings in factory mode yet (like changing the model to DSG830). Don't blame me if you break your RF generator :-BROKE
And a little mystery: When triggering the check of the disk sector, an empty file with the name "LqepdclquJ.txt" is created on the USB stick.
Brand new DSG800.
Having problems with SCPI commands.
Resulting timeout error:
* Error!!!
VISA: (Hex 0xBFFF0015) Timeout expired before operation completed.
Sorry what do You mean by that?Brand new DSG800.
Having problems with SCPI commands.
Resulting timeout error:
* Error!!!
VISA: (Hex 0xBFFF0015) Timeout expired before operation completed.
Is that with the USB key?
Sorry what do You mean by that?
If it has a USB slot on the back?
-> *IDN?
<- (Return Count:50)
Rigol Technologies,DSG815,DSGxxxxxxx,00.01.07
Firmware version I think latest one available: 00.01.07
Change USB pendrive. These equipments are extremely picky regarding USB pendisks.
Big size isn't better... it forces extra timings recognizing/validating things and that may crash against the timings of the internal software.
I made a breakout board to explore the the OCXO option for the DSG-815 (option OCXO-B08).
https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0644/1/-/-/-/-/DSG800%20OCXO%20User%27s%20Guide.pdf (https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0644/1/-/-/-/-/DSG800%20OCXO%20User%27s%20Guide.pdf)
(https://www.eevblog.com/forum/testgear/upcoming-rigol-dsg815830/?action=dlattach;attach=1118088;image)
Pinout:
1: GND
2: Detect input
3: slot
4: slot
5: VCC
6: CLK input
7: VCC
8: VCC
9: GND
10: Detect output
VCC is 6.515 V when the signal generator is plugged into mains. This is higher than I expected as the OCXO-B08 datasheet specifies 5.00 V +/- 0.25 V. It didn't drop much with a 220 ohm resistor (~30 mA). Will have to find a bigger resistor to test at loads specified in datasheet (300-600 mA).
Detect output (pin 10) goes from 0 to 3.3 V when the signal generator is turned on. When I connect this pin to Detect input (pin 2) through a 1 K resistor Syst > Information > System Info reports the option OCXO-B08. Interestingly, there's no error message even though I don't feed an external clock signal yet.
CLK (pin 6) was the only pin left. Not tested yet.
The pitch of the pins on the edge-connector is 1mm, 10 positions with a key slot (which is counted as a position). A matching connector is Samtec 1mm Mini Edge Card Socket Vertical, part number MEC1-105-02-F-D-EM2 or MEC1-105-02-L-D-EM2.
https://www.samtec.com/products/mec1-105-02-f-d-em2 (https://www.samtec.com/products/mec1-105-02-f-d-em2)
https://www.samtec.com/products/mec1-105-02-l-d-em2 (https://www.samtec.com/products/mec1-105-02-l-d-em2)
The dimensions of my breakout PCB are 32 mm x 50 mm, 1.6 mm thickness. It turned out to be about 3 mm too long, so 32 x 47 mm would be the correct size.
The size of the original OCXO is likely 25.4 x 25.4 mm. There are no good images of the OCXO-B08 to be found, but OCXO options for the DSG3000 (OXCO-A08) has similar specifications. Some images for that option show an OCXO from DAPU with part number O22B-G445. Unfortunately, that part number doesn't quite match with the numbering-scheme on DAPU's website:
https://www.dptel.com/Products/ProductLevel4/2899 (https://www.dptel.com/Products/ProductLevel4/2899)
(https://www.eevblog.com/forum/testgear/upcoming-rigol-dsg815830/?action=dlattach;attach=1118092;image)
Any thoughts about VCC being 6.5 V?
Any suggestions for a suitable OCXO for this application?
Do you know by far if a normal USB key inserted will be shown in the System menu automatically?
One last question: what kind of protocol/program did you use by sending commands to the DSG? Netcat? Ultra Sigma? thank You again
Rigol officially claims that the OXCO module has to be inserted at factory by them even after since after plugging the expansion in all RF gen needs to be whole recalibrated again...
I used Python with the vxi11 library for my experimentation. Looking at the code, I have just used the write(":PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE") to set user mode, without expecting/reading a response. Then ask(":PRIV:SOFT:MODE?") to verify if it worked.
Sending Factory mode command (without asking the response a NAG Screen appears on DSG telling:
"Command is protected"
Running the command without the key:
"USB disk not present"
A step forward but now..
|O |O |O |O |O |O |O
OK got it.
the USB was recognized but size was 0.00
Reformatting it to FAT32 again, nag screen disappeared. ^-^
Do you know by far if a normal USB key inserted will be shown in the System menu automatically?
I get the E: drive and a small USB icon with the USB stick plugged in. I use a cheap Chinese uSD card adapter with an ancient uSD card, but it also should work with regular USB sticks.One last question: what kind of protocol/program did you use by sending commands to the DSG? Netcat? Ultra Sigma? thank You again
I used Python with the vxi11 library for my experimentation. Looking at the code, I have just used the write(":PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE") to set user mode, without expecting/reading a response. Then ask(":PRIV:SOFT:MODE?") to verify if it worked.Rigol officially claims that the OXCO module has to be inserted at factory by them even after since after plugging the expansion in all RF gen needs to be whole recalibrated again...
Dooh! :(
Rigol officially claims that the OXCO module has to be inserted at factory by them even after since after plugging the expansion in all RF gen needs to be whole recalibrated again...
Dooh! :(
Its not that the entire unit needs calibration, its just the OCXO will need to be calibrated once its in the unit, otherwise it will be very stably off frequency.
I suspect pins 5/7 are VCC for the oven and clock operation, pin 8 I suspect is voltage error correction from a DAC output to net the OCXO calibration.
Rigol officially claims that the OXCO module has to be inserted at factory by them even after since after plugging the expansion in all RF gen needs to be whole recalibrated again...
Dooh! :(
Its not that the entire unit needs calibration, its just the OCXO will need to be calibrated once its in the unit, otherwise it will be very stably off frequency.
Hmm, I guess the 6.5V observed on the VCC pin will then be adjusted by the DSG to tune the OCXO.
From the datasheet of the OCXO used on the option for the DSG3000:
https://www.dptel.com/Products/ProductLevel4/2899 (https://www.dptel.com/Products/ProductLevel4/2899)
(highlighted 5 is the option based on part-number O22B-G445)
Not sure how to interpret that table. +/- 2.5V from nominal 5V supply voltage?
Caveat: I never tried myself to change the model number.
While the post way back says DSG836, I think the model number should be DSG830. At least that's the model that Rigol sells.