Upcoming Rigol DSG815/830

[dr.diesel]

Just received this email.  Although I'm fairly critical of Rigol these days, I could use a mediacore signal gen if it's priced right.  Looks like more info next week.

The DSG800 Delivers:

9kHz - 3GHz Output Frequency
Max Output +20dBm
Standard ,2ppm Clock (opt 5ppb available)
AM/FM/?M Modulation
Optional Pulse Modulation/Pulse Train Generator

[thewyliestcoyote]

I just received the same email. I am very interested but it is a shame there is not a 6 GHz option. That is a maybe a deal killer for me.

I am going to hold my breath until they give more specs.

[chicken]

More details are up on Rigol UK's web site:
http://www.rigol-uk.co.uk/Rigol-DSG815-RF-Signal-Generator-p/dsg815.htm

Looks like Rigol is going for a US$2000 price point.

Edit: The link to the DSG800 series, including DSG830
http://www.rigol-uk.co.uk/category-s/2031.htm

[dr.diesel]

Mmmm, yup, with datasheet:

http://www.rigol-uk.co.uk/v/pdf/DSG800_Datasheet.pdf

[MisterBiscuit]

Is it me or does this look like it might be an upgraded version of the DSA800's tracking gen in a box?

[Wuerstchenhund]

Just received this email.  Although I'm fairly critical of Rigol these days, I could use a mediacore signal gen if it's priced right. 

Why not go for a second hand Agilent ESG or R&S SME/SMIQ instead? There are many around so prices are pretty low, and they all offer better specs.

[dr.diesel]

Why not go for a second hand Agilent ESG or R&S SME/SMIQ instead? There are many around so prices are pretty low, and they all offer better specs.

I was hoping for something half decent, but in a small form factor, 

[TomThomas]

I just received the same email. I am very interested but it is a shame there is not a 6 GHz option. That is a maybe a deal killer for me.

I am going to hold my breath until they give more specs.

If you need 6GHz there is also a DSG3000 which offers 3 or 6GHz

I saw both gens at the EuMW in Paris last month.

The DSG800 has the same chassis as the DG1000Z.

DSG815 - 1880€ plus VAT
DSG830 - 3380€ plus VAT

official specs are here http://www.meilhaus.de/fileadmin/upload/pdf/Datasheets_english/Rigol/Rigol_DSG800.pdf

[Wuerstchenhund]

Why not go for a second hand Agilent ESG or R&S SME/SMIQ instead? There are many around so prices are pretty low, and they all offer better specs.

I was hoping for something half decent, but in a small form factor, 

If you can live with 3GHz and aren't in a hurry then this could be an option:

http://cdn.rohde-schwarz.com/pws/dl_downloads/dl_common_library/dl_brochures_and_datasheets/pdf_1/SM300_dat_en.pdf

Small size, similar specs as the Rigol, and often go for not much money.

[chicken]

Rigol just announced updates to their DSG800 line:
- New models with 2.1 and 3.6 GHz max frequency
- DSG800A models with IQ modulation
https://www.rigolna.com/news/2019/00003509/
https://www.rigolna.com/products/rf-signal-generators/dsg800/

It would be interesting to see how different they look internally. The DSG815 already had connectors labelled with IQ and IQ CLK, hinting at IQ functionality as a hardware option.
https://www.flickr.com/photos/eevblog/23293853985/in/album-72157661062178650/

[TurboTom]

Since the discussion on Siglent's counterpart to this generator turned into the direction of evaluating in how far an I/Q modulator "hack" could be possible, and the DSG800A series offers much more functionality than Siglent's products (internal baseband generator), I decided to take a closer look at Dave's teardown photos of the DSG815.

It's actually quite amazing how simple the operational principle of this generator is. As always, the difficulty is located in the details. Generally speaking, the DSG800 works in the upper frequency range (probably >300MHz) as a plain PLL VFO with several, switchable frequency dividers and a whole bunch of configurable low pass / band pass filters. The whole unit is full of switching diodes and non-reflective switches (HMC284). The first LO is split into three ranges and is almost a carbon copy of the corresponding section of the DSA815 spectrum analyzer. The reference frequency for the HMC704 PLL is generated by an AD9781 DAC (and not as I initially mistakenly indicated in my scheme, supplied directly from the 10MHz reference oscillator). This way, frequency and phase modulation is possible. The second channel of the DAC is used to generate the LF output signal. The DAC clock is supplied by the highly stable Z-COMM CRO3640B-LF VCO (3.64GHz), controlled by an ADF4106 PLL, divided by eight, hence it's 405MHz 455MHz (already forgot how to properly divide by two... ).

To generate lower frequencies, a minicircuits ADE-12MH mixer is used to mix the 1LO output with 910MHz from the aforementioned synthesizer.

In my scheme, I used orange for the signal path on the visible side and magenta to approximately show what's going on on the hidden side of the PCB. I may have missed a filter or two on the hidden side, but the working principle should be covered failry accurately.

It gets obvious that the I/Q add-on board contains more circuitry than just a few ESD ptotection devices and some interconnections, it's got to contain the complete I/Q modulator, and as it seems also considerable circuitry to generate the I/Q baseband signal. So no easy hack, if possible at all...

But a possibly more interesting conclusion on the circuitry may be that it should be possible to output much higher frequencies than 1.5GHz since it's possible to route the oscillator signal trough the instrument without passing any frequency divider. Moreover, all the semiconductors used should be able to handle up to approx. 4GHz (I didn't believe that initially before I did the reverse engineering). So we may actually be up to a surprise if we compare this 1.5GHz version to one of the higher-frequency specimen of that model range... Another amazing detail: The PA is a NPTB00004A, capable of >5W at 4GHz!

So I'ld say this unit contains a very good hardware and there may actually be a chance for "improvement" of the entry models. What kind of calibration would be necessary afterwards is written on a different page, though... 

[tv84]

So I'ld say this unit contains a very good hardware and there may actually be a chance for "improvement" of the entry models. What kind of calibration would be necessary afterwards is written on a different page, though... 

This usually means  for everyone and  for me!     

We definitely need a specimen to do some testing.

[TurboTom]

This usually means  for everyone and  for me!     

We definitely need a specimen to do some testing.

Yes I know ... Sorry for that 

But I cannot get rid of the impression that you consider it as some kind of sport... 

[chicken]

I dug into the firmware last spring after I bought a DSG815 in a clearance sale. I think 3 GHz (DSG830) is just a software option. There are a lot of inert debug strings in the code that should help with reversing.

A few random snippets from my notes:

Model code name is DORY.

Shortly after boot the firmware checks configuration variables to determine the model. There's also a mystery file (E:\\LqepdclquJ.txt) whose content is checked for certain operations, for example to enter MANAGER and FACTORY modes (IIRC via the :PRIVate:SOFT:MODE SCPI command). I reversed the content of the file by emulating the firmware, but I haven't tried whether the putting it on a USB stick does anything.

The SSP SCPI commands may be for communication with the FPGA controlling the RF hardware.

RTOS is MQX 3.7 with MFS 3.0.0 and lwIP of unknown version.

Compile options for MQX likely were:
MQX_CHECK_MEMORY_ALLOCATION_ERRORS
MQX_EXIT_ENABLED
MQX_MONITOR_STACK
MQX_TD_HAS_STACK_LIMIT
MQX_USE_COMPONENTS
MQX_USE_IDLE_TASK
MQX_USE_INTERRUPTS
MQX_USE_MEM
MQX_USE_UNCACHED_MEM
PSP_HAS_DATA_CACHE
PSP_HAS_SUPPORT_STRUCT
PSP_STACK_ALIGNMENT = 0x1f

Attached my notes to extract the firmware binaries from firmware upgrade files.
Attached my notes about the mystery file.
Attached the full list of SCPI commands extracted from the 00.01.06.00.01 firmware image.

[chicken]

PS: And here my notes about loading extracted firmware binaries with Ghidra and radare2

fw-vectors-0x00000000.bin
ARM vector table, loaded to 0x0

fw-app-0x40000000.bin
ARMv5t 32bit application code, loaded to 0x40000000

Code entry point: 0x4022004c

Loading into Ghidra:
Create new project
Open CodeBrowser
Import file: fw-vectors, architecture ARMv5/T little endian, location 0, name vectors (don't analyze)
Add to program: fw-app, location 0x40000000, name app (ALT-I)
Disassemble at 0 (F11)

Loading into r2:
r2 -a arm -b 32 -m 0x40000000 ./fw-app-0x40000000.bin
e anal.ignbithints=true
o ./fw-vectors-0x00000000.bin 0x0 rwx

PM me if you want a copy of my Ghidra project.

[tv84]

Attached my notes to extract the firmware binaries from firmware upgrade files.
Attached my notes about the mystery file.
Attached the full list of SCPI commands extracted from the 00.01.06.00.01 firmware image.

Chicken, thanks for the files. I've also done a preliminary look and have a FW parser.

I'll try to check your conclusions with my notes of Rigol FW.

SCPI command list has been here for sometime. Did you crosscheck?

[chicken]

I wasn't aware of that thread. The only difference is :SYSTem:PRESet (620, 0x4016cdd8, :SYSTem:PRESet, Programming Guide) which is missing in your list.

[chicken]

It gets obvious that the I/Q add-on board contains more circuitry than just a few ESD ptotection devices and some interconnections, it's got to contain the complete I/Q modulator, and as it seems also considerable circuitry to generate the I/Q baseband signal. So no easy hack, if possible at all...

Does anyone have pictures of the IQ board?

Another, simpler DIY project would be a 10 MHz OCXO. The edge connector looks easy enough to interface with and I didn't see anything that indicates a license key to enable this option. Again, anyone got pictures of the official OXCO?

[TurboTom]

A DIY internal OCXO would surely be a nice project but since the DSG has got an input for an external reference supply, the same or better performance can be achieved by just hooking up an external GPSDO which is inexpensively available or an atomic reference oscillator (also once in a while available at a bargain second hand).

[tv84]

Does anyone have pictures of the IQ board?

Dave's HiRes photos are here.

[chicken]

Does anyone have pictures of the IQ board?

Dave's HiRes photos are here.

Dave’s unit didn’t have the IQ board fitted.

[tv84]

Dave’s unit didn’t have the IQ board fitted.

  My fault.

[tv84]

Attached my notes to extract the firmware binaries from firmware upgrade files.

FW v00.01.06.00.01 parsing:

Code: [Select]

Offset     CRC32     Type  Size      Cont  Ref1      FTyp   Ref2
00000000 - 55469C59  sys0  00000278  dat0  00000002  DSG8A  00000001   [00000004-00000277]  CRC OK
00000278 - A8D35F6B  bin0  00000210  dat0  00000002  DSG8A  00000001   [0000027C-00000487]  CRC OK
00000488 - 196CF684  bin0  00047E9C  dat0  00000001  DSG8A  00000003   [0000048C-00048323]  CRC OK
00048324 - C87E57E1  rbf0  0005E802  dat0  00000001  DSG8A  00000003   [00048328-000A6B25]  CRC OK
000A6B28 - 5BB89F1D  bin0  00177C90  dat0  00000001  DSG8A  00000003   [000A6B2C-0021E7B7]  CRC OK
0021E7B8 - 1E8000CA  bin0  000B99FC  dat0  00000001  DSG8A  00000003   [0021E7BC-002D81B3]  CRC OK
002D81B4 - 0A378E85  sim0  002B7C95  dat0  00000001  DSG8A  00000003   [002D81B8-0058FE48]  CRC OK
0058FE4C - ED06206E  bin0  00000046  dat0  00000001  DSG8A  00000003   [0058FE50-0058FE91]  CRC OK
0058FE94 - 8A912D43  bin0  00000045  dat0  00000001  DSG8A  00000003   [0058FE98-0058FED8]  CRC OK
------------------------- SYSTEM BLOCK --------------------------------------------
00000040 - FW Type: DSG8A
00000050 - Version(?): 00000001
00000054 - # Files: 8
           Offset    Type    Addr(?)   Size      Flags     Filename
00000058 - 00000278  Index   06100000  00000210  00002800  index.bin             [000002B8-00000487]
0000009C - 00000488  Setup   06F80000  00047E9C  00100000  DORY_XML.bin          [000004C8-00048323]
000000E0 - 00048324  Fpga    06900000  0005E802  00080000  vmu.rbf               [00048364-000A6B25]
00000124 - 000A6B28  Res     06D80000  00177C90  00200000  ResData.bin           [000A6B68-0021E7B7]
00000168 - 0021E7B8  Fpga    06800000  000B99FC  00100000  dory_wrapper.bin      [0021E7F8-002D81B3]
000001AC - 002D81B4  DspPro  06200000  002B7C95  00500000  DoryApplication.sim   [002D81F4-0058FE48]
000001F0 - 0058FE4C  FirEra  06B00039  00000046  00000050  FirstErase.bin        [0058FE8C-0058FE91]  RIGOL
00000234 - 0058FE94  ver     06B00022  00000045  00200000  Version.bin           [0058FED4-0058FED8]  00.01.06.00.01

FW v00.01.07.00.06 parsing:

Code: [Select]

Offset     CRC32     Type  Size      Cont  Ref1      FTyp   Ref2
00000000 - 09572EBC  sys0  00000278  dat0  00000002  DSG8A  00000001   [00000004-00000277]  CRC OK
00000278 - 1B2487B9  bin0  00000210  dat0  00000002  DSG8A  00000001   [0000027C-00000487]  CRC OK
00000488 - 140DF4A7  bin0  00049D5E  dat0  00000001  DSG8A  00000003   [0000048C-0004A1E5]  CRC OK
0004A1E8 - C87E57E1  rbf0  0005E802  dat0  00000001  DSG8A  00000003   [0004A1EC-000A89E9]  CRC OK
000A89EC - 42A9907B  bin0  00176070  dat0  00000001  DSG8A  00000003   [000A89F0-0021EA5B]  CRC OK
0021EA5C - 95EABB13  bin0  000B9DD3  dat0  00000001  DSG8A  00000003   [0021EA60-002D882E]  CRC OK
002D8830 - 1002AE08  sim0  002B7A11  dat0  00000001  DSG8A  00000003   [002D8834-00590240]  CRC OK
00590244 - ED06206E  bin0  00000046  dat0  00000001  DSG8A  00000003   [00590248-00590289]  CRC OK
0059028C - 1537D2D7  bin0  00000045  dat0  00000001  DSG8A  00000003   [00590290-005902D0]  CRC OK
------------------------- SYSTEM BLOCK --------------------------------------------
00000040 - FW Type: DSG8A
00000050 - Version(?): 00000002
00000054 - # Files: 8
           Offset    Type    Addr(?)   Size      Flags     Filename
00000058 - 00000278  Index   06100000  00000210  00002800  index.bin             [000002B8-00000487]
0000009C - 00000488  Setup   06F80000  00049D5E  00100000  DORY_XML.bin          [000004C8-0004A1E5]
000000E0 - 0004A1E8  Fpga    06900000  0005E802  00080000  vmu.rbf               [0004A228-000A89E9]
00000124 - 000A89EC  Res     06D80000  00176070  00200000  ResData.bin           [000A8A2C-0021EA5B]
00000168 - 0021EA5C  Fpga    06800000  000B9DD3  00100000  dory_wrapper.bin      [0021EA9C-002D882E]
000001AC - 002D8830  DspPro  06200000  002B7A11  00500000  DoryApplication.sim   [002D8870-00590240]
000001F0 - 00590244  FirEra  06B00039  00000046  00000050  FirstErase.bin        [00590284-00590289]  RIGOL
00000234 - 0059028C  ver     06B00022  00000045  00200000  Version.bin           [005902CC-005902D0]  00.01.07.00.06

EDIT: I added a little more detail to make things clearer.

[chicken]

Attached my notes to extract the firmware binaries from firmware upgrade files.

Example of a .SYS FW parsing (don't have here the version...):

Code: [Select]

00000000 - Header CRC32: 55469C59  [00000004-00000277]  CRC OK
00000018 - File Type: DSG8A
00000050 - Version: 00000001
00000054 - # Sections: 8
Offset    StartAdr  Type      LoadAddr  Size                Filename
00000058  00000278  Index     06100000  00000210  00002800  index.bin             [00000278-00000487]
0000009C  00000488  Setup     06F80000  00047E9C  00100000  DORY_XML.bin          [00000488-00048323]
000000E0  00048324  Fpga      06900000  0005E802  00080000  vmu.rbf               [00048324-000A6B25]
00000124  000A6B28  Res       06D80000  00177C90  00200000  ResData.bin           [000A6B28-0021E7B7]
00000168  0021E7B8  Fpga      06800000  000B99FC  00100000  dory_wrapper.bin      [0021E7B8-002D81B3]
000001AC  002D81B4  DspPro    06200000  002B7C95  00500000  DoryApplication.sim   [002D81B4-0058FE48]
000001F0  0058FE4C  FirEra    06B00039  00000046  00000050  FirstErase.bin        [0058FE4C-0058FE91]
00000234  0058FE94  ver       06B00022  00000045  00200000  Version.bin           [0058FE94-0058FED8]

Looks like I got a different version of the firmware file. For example the size of DoryApplication.sim is 0x2b7be4 in mine.

I downloaded version 00.01.06.00.01 in April 2019, though the link in my notes is now broken.

The current version available at https://www.rigolna.com/firmware/ is 00.01.07.

[chicken]

Re IQ modulator: I think the IQ modulator option only became available recently with the release of the newer generation DSG821/836. The release notes for firmware version 00.01.07 dated 2019-09-05 include "Add DSG800A series, A model supports IQ function"

I wonder if there is a hardware issue in the DSG815/830 that prevented Rigol from offering of the IQ option for those.

[TurboTom]

I'ld rather think that Rigol simply didn't finish the I/Q add-on board at the time they first released the DSG800 series and had to create some cash flow to compensate for the design expenses of the project. The option to install an add-on I/Q board is clearly present on the early models and shown in Dave's DSG815 teardown, and hardware-wise, there's no indication that it wouldn't be operational.

Moreover, there's just a single firmware available for the whole range of instruments. I'ld rather say that after Rigol produced the initial batch of instruments, they quickly realized that the hardware is capable of more than initially anticipated, so they upped the bandwidth to 2.1GHz vs. 3.6GHz (of the 1.5G and 3G models, respectively) and finished the I/Q module and the accompanying firmware extensions. Shame that they don't offer the add-on as a separate option so users of the basic version can later on decide to upgrade to I/Q functionality.

[tv84]

Shame that they don't offer the add-on as a separate option so users of the basic version can later on decide to upgrade to I/Q functionality.

Yes but that is  also a factor behind my theory.

[TurboTom]

We can only know for sure after someone posts a detailed set of photos of a DSG800A teardown.

With the help of Rigol's spec sheet of the DSG800(A) I've been able to complete my flow scheme of the DSA815 of Dave's teardown (sorry for the "ill" choice of colours, some lables have to be magnified to be deciphered -- maybe I'll draw a block diagram to simplify understanding the signal flow). I added signal frequencies as far as possible.

Considering Rigol's preference of Hittite / Analog components, my best bet for the I/Q modulator they used on the add-on board would be the HMC1097. Unfortunately, Hittite's evaluation board for this chip isn't as complete to permit a direct use in the DSG since it requires differential I and Q signals. In order to achieve a good carrier suppression over the whole frequency range, it may also be necessary to adjust the I and Q bias levels depending on the LO frequency. So there probably is an additional look-up table stored soemwhere on Rigol's IQ add-on board. Likely just too much hassle for a DIY solution.

But there may be a real chance for a frequency upgrade... Seems like hardware-wise, evereything's already there.

[tv84]

But there may be a real chance for a frequency upgrade... Seems like hardware-wise, evereything's already there.

Nice work! 

[noreply]

OK noticed some other interesting parameters ....

001A - PLL              PLL         :SERVice:SET:BANDwidth:MODE:PLL
001B - DETect           DET         :SERVice:SET:BANDwidth:MODE:DETect
001C - MODulation       MOD         :SERVice:SET:BANDwidth:MODE:MODulation
001D - ALC              ALC         :SERVice:SET:BANDwidth:MODE:ALC

These are ONLY SET commands - so critical

BUT you can set the PLL BANDWITH - really stupid if Rigol has defined model independent of BW setting - possibly can set the 3.6GHz BW here??

Problem is there is no equivalent READ command - so we can see what the current setting is set at??

[TurboTom]

For those of you who are interested in the DSG800 operational details... 
I don't guarantee for 100% accuracy but the diagram should be fairly correct.

[TurboTom]

So here are a few remarks on the DSG815 (RF) hardware, looking at the block diagram I published yesterday:

It gets immediately obvious that Rigol's design is for the most part a simple "straight-through" approach. Since the main PLL oscillator covers a frequency range of 1:2 (1.82~3.64GHz), followed up by three by-two frequency dividers, the total frequency range is theoretically 1:16 (227.5MHz~3.64GHz) of which the range of 227.5MHz to 3.6GHz is used in the top-of-the-line model.

The lower range of 0~227.5MHz (okay, they start at 9kHz or the like, but for convenience I keep it "0"), the 910MHz signal that's available from the internal reference PLL divided by four, is mixed with the main PLL output divided by four (output range 910~682.5MHz), resulting in the required low frequency band as the difference. It's important to notice that now the control of the main PLL gets mirrored, i.e. all modulation schemes need to be mirrored as well (FM , PM and complex modulations will have to have the side bands reversed).

Another result of the straight-through approach is the necessity of a huge amount of filtering. In contrary to a full-range mixer approach with very high frequencies as input signals, say 5GHz fixed reference and 5~8.6GHz VFO to achieve a mixing product of 0~3.6GHz, where the sum and the mixer input signals are far away from the output signal range and the mixing product is fairly clean (if the mixer inputs were...), in this straight-through approach a lot of harmonics are generated due to the stacked dividers. To get this signal clean, a total of ten switchable low pass filters (plus a few that are doubled up) are required.

Since the filters can be arranged as distributed element configurations (for the upper end) and conventional passive filters, they are not really expensive. Most of the filter switching is accomplished by PIN diodes (HSMP-389B, now obsolete) which also isn't a driver for cost. The biggest advantage of this approach is that the highest frequency throughout the design is 3.64GHz, which may be just low enough to be able to use impedance-controlled FR4 as PCB material and not having to use more expensive and more difficult to process Rogers hybrid materials.

I didn't specifically address Rigol's modulation approaches (the two blocks that I identified as configurable band pass filters could also be amplitude modulators, utilizing HSMP-3832 PIN diodes, so bear with me...), but since the FPGA is controlling both the main PLL's reference clock and all the attenuators, it's well possible that these are the means for frequency, phase and amplitude modulation. The interface for complex modulation add-on circuitry is included in the signal path before the low-frequency band mixer. Still, this modulator will have to cover a very wide frequency range which is a considerable disadvantage of the straight-through approach.

There are two level detectors included in the design, one in front of the attenuator stack and one right at the output. The first one appears to be resposible for the level accuracy since it's heated and temperature stabilized. The second one is probably used as a protection monitor (in case RF is fed back into the output) and as a power monitor for higher output levels when the PA is used.

There is no reason that the entry level models of this instruments cannot be unlocked by software to cover the full frequency range unless on recent production models, part of the filters and switches aren't populated. But since these components really aren't ruining the bill, it would probably be less economical to run different production batches than having all the RF boards produced identically.

The DSG800 series is clearly built to a budget but I'ld still say that no real corners had been cut that would affect performance. The straight-through approach has also been utilized by other manufacturers, i.e. Dave's Marconi SG follows a similar route.

So much for that, if I'ld get my hands on a set of good photos of the "A" version torn down, I'll add some information on the I/Q modulator...

[noreply]

TurboTom,

Thank You so much for your very insightful observations and explanations 

A few questions, from a novices point of view ;-

1. Given Rigol's 'straight-through' approach - are there any inherent performance (i.e. better phase noise, smaller harmonics, etc, etc) advantages over the full-range mixer approach?
2. Did Siglent adopt a similar approach in their SSG3000x range? or the full-range mixer approach?
3. Are there inherent performance benefits of the full-range mixer approach - if so, what are they?

Thanks

[TurboTom]

TurboTom,

Thank You so much for your very insightful observations and explanations 

Thank you very much for your kind words 

A few questions, from a novices point of view ;-

1. Given Rigol's 'straight-through' approach - are there any inherent performance (i.e. better phase noise, smaller harmonics, etc, etc) advantages over the full-range mixer approach?

Actually, there are: Provided the same "care" is taken designing an oscillator for the fundamental frequency or one for a higher frequency suitable for mixing, the phase noise would be better for the straight-through approach. Dividing the fundamental frequency to provide the lower bands would further improve the phase noise. Rigol provided a factor "N" in their frequency band table which actually resembles the reciprocal divisor by which the LO frequency is divided to provide the configured output frequency. If a mixing approach is taken to produce the desired frequency, the resulting phase noise will be the geometrical sum of the phase noise of the two frequencies to be mixed, whereas it scales with the "N" factor in case a straight-through approach is utilized. You've got to be aware that the lowest band of the DSG800 utilizes the VFO to be divided by four and then mixed with the 3.64GHz reference divided by four, which results in a worse phase noise than Band 2 which is generated form the VFO divided by eight (see Rigol's table).

2. Did Siglent adopt a similar approach in their SSG3000x range? or the full-range mixer approach?

Sorry, I cannot answer this question exactly since I don't know of a complete tear-down of one of Siglent's SSG3000's RF modules. But the specs of the SSG3000X make me believe that Siglent had a very thorough look at Rigol's design when they started work on their generator... Yet the second lowest frequency band is the mixing product of the VFO divided by two, so provided the phase noise of the VFO of these two specimen is similar, Siglent's approach will be inferior (for whatever reason, Siglent splits the "mixed" frequency range into two, first 9kHz~1Mhz with "N" = 0.25 and the second 1~250MHz with "N" = 0.5).

3. Are there inherent performance benefits of the full-range mixer approach - if so, what are they?

Thanks

There are a some benefits of the full-range mixer approach: Provided the mixing partners, i.e. local reference and VFO frequencies are sufficiently "clean", the amount of filtering / filter switching required to provide a sufficiently "clean" output signal is reduced considerably. It basically reverts to an LPF suitable to block the sum frequency and the feed-through of the individual mixing partners. Modulation may also be easier since everything can be accomplished at a single frequency (the internal reference). Albeit, this frequency is much higher than in case of the "straight-through" approach, so the semiconductors required may be more expensive.

Edit: Forgot to mention another substantial advantage of the full-range mixer approach: Since range switching isn't required, signal generators following this approach will be capable of seamless frequecy sweeps over large ranges without dropouts or "phase hickups" which unavoidably will result during range-switching of a straight-through SG. Same situation for (ultra) wide-band FM, if your carrier is right on the edge of a band.

I hope this answers your questions so far.

All the best,
Thomas

[noreply]

Thank you once again for great explanation.

Yes - looking through the specifications for both the DGS800A series and the SSG3000X series - Rigol has slightly better phase noise figure quoted - from memory it was  -112 dBc/Hz typical to Siglent's  -110 dBc/Hz

[tv84]

Looks like I got a different version of the firmware file. For example the size of DoryApplication.sim is 0x2b7be4 in mine.

Chicken, I've placed renewed parsings in the previous msg. 

Check to see if you have a different FW from the ones I have. If yes, I would be interested in getting that one also.

I wasn't aware of that thread. The only difference is :SYSTem:PRESet (620, 0x4016cdd8, :SYSTem:PRESet, Programming Guide) which is missing in your list.

Thanks, this allowed me to correct a rare bug. You could correct your command IDs. It's not the int16 that you assumed (see my list).

[chicken]

Chicken, I've placed renewed parsings in the previous msg. 

Check to see if you have a different FW from the ones I have. If yes, I would be interested in getting that one also.

Judging from offset and size of DoryApplication.sim, your 00.01.06.00.01 FW file is the same as mine.

Thanks, this allowed me to correct a rare bug. You could correct your command IDs. It's not the int16 that you assumed (see my list).

Are you referring to the ID column in my list? It's the index of the SCPI command structure in the command tree array, not the int16 field that references the array of function pointers. IIRC there are "inert" entries to build the hierarchy. But I agree, your numbering based on function index makes more sense.

[tv84]

PS: And here my notes about loading extracted firmware binaries with Ghidra and radare2

A practical way that I use to load a IAR file in IDA Pro is using 0x3FFFFF94 as the loading address (attached).

[Sighound36]

Norepy

From this thread I take you have have bot the Rigol and Siglent offerings on test currently, so what are you conclusions thus far or is the jury still out?

[noreply]

Norepy

From this thread I take you have have bot the Rigol and Siglent offerings on test currently, so what are you conclusions thus far or is the jury still out?

Currently only the 815 - no stock on the Siglent when review started - but should be getting the Siglent shortly.

So far, I like the 815 - it 'does what's written on the tin' as the saying goes.

I have been using this for testing RF power amplifiers (as input source) and the signal(s) are extremely clean out of the RF Amplifier(s).

As you know, if you put 'crap' into an Amplifier - it WILL amplify your 'crap' - given that there are absolutely clean signal(s) out of the Amp is a good indication.

I would like a 'touch screen' (spoiled by the SVA and MSO5000) - but the 815 has a functional system - it takes a while to get used to the menu structure - but its possible to make all the setting you need - but sometimes many key presses.

I like the compact size - big bonus - can bring very close to DUT and have 'short' leads.

The 815 'looks' dated , I think it was loosely based on the R&S SM300 from a form factor point of view - a tribute to R&S - as their device was last revised in 2007 - and it still has better specs than Rigol and the Siglent offerings.

What I noticed, is  that there is no Square Wave output on the 815 - other than on the LF output (BNC) and only up to 20KHz.

Not sure if its same on the Siglent at this moment in time?

I can understand that there is no great desire for Square Waves when working with RF (and a digital DAC based signal generator can suffice at a much lower cost) but in my 'one off' case , I was looking for a ULTRA FAST  edge in a signal - I guess this is where the 'pulse mode' comes into play. This is my next area of testing , so will report soon.

On the 815, this is an option (I think the Siglent has this feature as standard offering - correct me if wrong) so at the moment its on 'trial' mode until time runs out.

Modulation works well on the 815, I have been able to successfully modulate FM carrier(s) with various tones and soon full Stereo Encoding with RDS - to check all the pilot frequencies in receiver tests.

I am hoping to do a 'full report' - side by side of the main features from a user's perspective - as soon as I get the Siglent unit and do some similar testing which I made with the 815.

My only negative for the 815 at this moment is that there is no 'hack' to enhance the device - because if it can be enhanced to the 3.6GHz variant - it will kill the Siglent from a price / performance - without a doubt!

Let's face it, most people here don't want to shell out big $$$ on an option which is already 'inside' the device you purchased - just awaiting an activation code?

This is why I think 'hackability' is a big factor when deciding to purchase.

At the moment the score is ;-

DSG815 = 0
SSG3021Z=1

BUT, if and when DSG815=1 - the Siglent will have to drop its price by a mile as the price / performance ratio of the Rigol will kill it for sure.

Like most RF Signal Generator customers TODAY, having a device limited to 1.5GHz is a deal breaker - unless you are ONLY going to be working within this frequency limit.

With 2.4GHz, 5GHz and even higher RF devices being the norm today - you really need to have the higher frequency capability - especially if you are going to drop >$3000 for a RF Signal Generator.

This makes me think that even the Rigol's 3.6GHz  and Siglent's 3.2GHz offerings are already dated.

But, and a big BUT, there are already RF Signal Generators which cover the higher frequencies and modern digital modulation protocols out on the market but  unfortunately they cost lots of $$$.

This is why for the majority of 'us' its the Rigol and Siglent offerings (even if dated) that are really affordable at the moment.

From a price performance point of view , Rigol and Siglent will always be behind the Agilent and R&S offerings - which will be beyond the budget of most people like myself (and possibly others in this forum) - and because Rigol and Siglent choose to be in this market sector we can benefit by having an affordable access to instruments which can be 'enhanced' to make them even more desirable for the price / performance they offer.

[Sighound36]

Indeed, costing is the issue especially with 5Ghz the minimum requirement for IoT development now. IQ mod is going to more important now as are custom wave form generations. Stability and low phase noise to are more preferable for many I suspect. Understand wishing to maximize your potential purchasing power as we all do. Sometime they will be a null spot and your not quite able to use the normal route. Personally I would look for a good Agilent VSA which will set you back around the same cost as a basic 3.2Ghz version. I now have two of them, one is 4Ghz with the OXCO, six hardware upgrades and a few sw options its not small but its decent cost less than the model you are looking at right now. The second unit I did pay more for but its 10Ghz.

Consider a sighound VSG60 amplitude accuracy is incidental, and phase noise looks good for the cost, compared to Rigol or Siglant not sure at what frequency the phase noise is measured?

https://signalhound.com/products/vsg60a-6-ghz-vector-signal-generator/

https://www.testequipmenthq.com/product/keysight-e4422b

https://www.testequipmenthq.com/product/keysight-e4428c

https://www.keysight.com/gb/en/assets/7018-02994/data-sheets/5990-8116.pdf

https://www.testequipmenthq.com/product/aeroflex-ifr-marconi-2026q

https://www.testequipmenthq.com/product/aeroflex-ifr-marconi-2032

https://www.testequipmenthq.com/product/rohde-schwarz-smj100a

[tautech]

I would like a 'touch screen

SSG3000X offers touch and mouse control.

What I noticed, is  that there is no Square Wave output on the 815 - other than on the LF output (BNC) and only up to 20KHz.
Not sure if its same on the Siglent at this moment in time?

The LF modulation section in SSG3kX is rated thus:
Sine wave 0.1 Hz~1 MHz
Square wave, triangle, saw-tooth 0.1 Hz~20 kHz

I can understand that there is no great desire for Square Waves when working with RF (and a digital DAC based signal generator can suffice at a much lower cost) but in my 'one off' case , I was looking for a ULTRA FAST  edge in a signal - I guess this is where the 'pulse mode' comes into play. This is my next area of testing , so will report soon.

On the 815, this is an option (I think the Siglent has this feature as standard offering - correct me if wrong) so at the moment its on 'trial' mode until time runs out.

IIRC same for SSG3kX and have it enabled in my unit if there's anything you want to see.

With 2.4GHz, 5GHz and even higher RF devices being the norm today - you really need to have the higher frequency capability - especially if you are going to drop >$3000 for a RF Signal Generator.

This makes me think that even the Rigol's 3.6GHz  and Siglent's 3.2GHz offerings are already dated.

But, and a big BUT, there are already RF Signal Generators which cover the higher frequencies and modern digital modulation protocols out on the market but  unfortunately they cost lots of $$$.

This is why for the majority of 'us' its the Rigol and Siglent offerings (even if dated) that are really affordable at the moment.

The newer range of SSG5000X RF gens go to 6 GHz but yes these are getting really pricey. 

[noreply]

Rigol DSG815 – FM Modulation Test


Just a few screen shots of some simple FM modulation testing


The modulated signal quality from the DSG815 is nice and clean


I dropped the resolution BW on the SVA to get some ‘clean’ plots


See attached images

(Sorry, when I performed the testing I did not figure out how to do a screen shot on the 815 - so used the next best thing - camara)

[noreply]

Just posted some results & a 'how-to' testing Frequency Accuracy for the Rigol DSG815 with a GPSDO 10MHz reference and any oscilloscope capable of X-Y ploting.

Here is the link

https://www.eevblog.com/forum/testgear/rigol-dsg815-testing-feedback-and-comments/msg3147430/#msg3147430

Hope its of interest to those visiting this thread 

[tv84]

Looking just at the FW side, I think it's possible to convert a DSG815 into a DSG830...

[noreply]

Its interesting to know that there might be mileage in enhancing the DSG815 

Despite it being released back in 2015 - its still a decent bit of Kit - especially when compared to the more recent Siglent offering of their SSG3000X range.

There is another thread - specifically for the review of the SSG3021X - but during the 'testing' - it had been constantly compared to the DSG815 - so for those following this thread - please hop over to here (last post as of today)

https://www.eevblog.com/forum/testgear/siglent-ssg3021x-testing-feedback-and-comments/msg3161586/#msg3161586

and review the findings on the DSG815 - quite a few tests have been made - the latest is a full FM stereo & RDS modulation on 108MHz (via EXT Modulation Input) - to test, tune or align any FM / RDS capable FM radio. 

[tv84]

It has 4 Options (last 2 of them require additional HW).

PUM
PUG
IQ
OCXO

The licenses to enable them are similar to what rigup creates. The FW contains default ECC public and XXTEA keys but allows the use of specific ones.

If anyone can make a memdump, we can have a dry run.   

[chicken]

If anyone can make a memdump, we can have a dry run.   

What's the procedure for a memdump? I may give it a try.

[noreply]

If anyone can make a memdump, we can have a dry run.   

What's the procedure for a memdump? I may give it a try.

From my understanding - easiest way is to use a Jtag cable - to your PC and access the console
Dave's teardown video clearly shows the Jtag connector - its on the CPU board.

I think once the memdump is available then we can investigate 

[chicken]

Here's how to enter FACTORY and MANAGER/REPAIR modes:

Prepare a USB stick:
1. Format as FAT32
3. Write the following string to disc sector 3 of the USB stick (I used HxD):
35O8O228OLO8LNMN9690217963MN2O9ON46O9P05975K0047

Plug USB stick into the RF generator

Now the following SCPI commands will work:
:PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE
:PRIV:SOFT:MODE 0,REPAIRMODEENTRANCE
:PRIV:SOFT:MODE 0,MANAGERMODEENTRANCE

The first parameter (0) seems to be ignored.
MANAGER and REPAIR seem to be identical, but entering REPAIR doesn't require the USB stick.

The current mode can be verified with:
:PRIV:SOFT:MODE?

To return to USER mode, power cycle the device or use
:PRIV:SOFT:MODE 0,USERMODEENTRANCE
or
:PRIV:SOFT:MODE 0,EXITCURRENTMODE

Additional menus show up when in FACTORY/REPAIR/MANAGER mode:
Syst > Service
Syst > Service > Calibration
Syst > Service > RF DataSyn
Syst > License > Delete

I haven't dared to mess with settings in factory mode yet (like changing the model to DSG830). Don't blame me if you break your RF generator 

And a little mystery: When triggering the check of the disk sector, an empty file with the name "LqepdclquJ.txt" is created on the USB stick.

[tv84]

How to license DSG815/830 options

Insert the following parameters in the usual license generator :

Forever Options:
AAAB  (0x00001) - DSG800-PUM Pulse Modulation & Pulse Generator
AAAC  (0x00002) - DSG800-PUG Pulse Train Generator

Public Key:
6673BBC777EA4D  (Key taken from the current FW. Those interested will have to calculate the Private Key as homework.) 

As always, insert the licenses with SCPI command :SYSTem:LKEY.

Edit: Corrected the options' hex designations.

[tv84]

Rigol's Declassification Guide.

[JOHN LEE]

looks good!

[chicken]

I made a breakout board to explore the the OCXO option for the DSG-815 (option OCXO-B08).
https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0644/1/-/-/-/-/DSG800%20OCXO%20User%27s%20Guide.pdf



Pinout:
1: GND
2: Detect input
3: slot
4: slot
5: VCC
6: CLK input
7: VCC
8: VCC
9: GND
10: Detect output

VCC is 6.515 V when the signal generator is plugged into mains. This is higher than I expected as the OCXO-B08 datasheet specifies 5.00 V +/- 0.25 V. It didn't drop much with a 220 ohm resistor (~30 mA). Will have to find a bigger resistor to test at loads specified in datasheet (300-600 mA).

Detect output (pin 10) goes from 0 to 3.3 V when the signal generator is turned on. When I connect this pin to Detect input (pin 2) through a 1 K resistor Syst > Information > System Info reports the option OCXO-B08. Interestingly, there's no error message even though I don't feed an external clock signal yet.

CLK (pin 6) was the only pin left. Not tested yet.

The pitch of the pins on the edge-connector is 1mm, 10 positions with a key slot (which is counted as a position). A matching connector is Samtec 1mm Mini Edge Card Socket Vertical, part number MEC1-105-02-F-D-EM2 or MEC1-105-02-L-D-EM2.
https://www.samtec.com/products/mec1-105-02-f-d-em2
https://www.samtec.com/products/mec1-105-02-l-d-em2

The dimensions of my breakout PCB are 32 mm x 50 mm, 1.6 mm thickness. It turned out to be about 3 mm too long, so 32 x 47 mm would be the correct size.

The size of the original OCXO is likely 25.4 x 25.4 mm. There are no good images of the OCXO-B08 to be found, but OCXO options for the DSG3000 (OXCO-A08)  has similar specifications. Some images for that option show an OCXO from DAPU with part number O22B-G445. Unfortunately, that part number doesn't quite match with the numbering-scheme on DAPU's website:
https://www.dptel.com/Products/ProductLevel4/2899



Any thoughts about VCC being 6.5 V?

Any suggestions for a suitable OCXO for this application?

[tv84]

Using this information one can easily do a random mistake like this:

DSG815 -> DSG836

 

[chicken]

  the joys of shared hardware (and firmware)!

[AlexDavidson]

Thanks to chicken in reply #49 for posting details about how to enter FACTORY mode. A heads up for anyone wishing to try this (e.g. to make semi-random mistakes with the model number) the string you write to the USB drive needs to be written to logical sector 3, not physical sector 3.

[Darius121]

Thanks tv84,
I don't suppose you have any tips on extracting the key for a DSG815 owner? 

I tried running rigup search & scan on the file plus on the files extracted by binwalk but no luck

Thanks.

[tv84]

Thanks tv84,
I don't suppose you have any tips on extracting the key for a DSG815 owner? 

I tried running rigup search & scan on the file plus on the files extracted by binwalk but no luck

Thanks.

  The instructions are above.

[Darius121]

The instructions are above.

I guess I'm blind then 

Currently running 'break' on the public key but no idea how long it will take.

[Darius121]

Currently running 'break' on the public key but no idea how long it will take.

Turns out it seems to be broken on Linux and OSX but runs OK on Windows (last 4 digits are 23EF), although the resulting key does not produce something my sig gen likes.

[AlexDavidson]

Turns out it seems to be broken on Linux and OSX but runs OK on Windows (last 4 digits are 23EF), although the resulting key does not produce something my sig gen likes.

Not just broken on Linux & OSX, but Windows too. After waiting a week for a result from rigup-0.4.2-x86_64-win.exe break 6673BBC777EA4D, I gave up and tried running it on another machine. Instant success. 3521E2B968D60F.

[Darius121]

Not just broken on Linux & OSX, but Windows too. After waiting a week for a result from rigup-0.4.2-x86_64-win.exe break 6673BBC777EA4D, I gave up and tried running it on another machine. Instant success. 3521E2B968D60F.

Hah thanks!
I did find on some systems it will run and finish straight away but give you a different result each time which is obviously broken.

I also note you have to remove the -'s from the key before it will be accepted.

[Houseman]

How to license DSG815/830 options

Insert the following parameters in the usual license generator :

Forever Options:
AAAB  (0x00400) - DSG800-PUM Pulse Modulation & Pulse Generator
AAAC  (0x00800) - DSG800-PUG Pulse Train Generator

Public Key:
6673BBC777EA4D  (Key taken from the current FW. Those interested will have to calculate the Private Key as homework.) 

As always, insert the licenses with SCPI command :SYSTem:LKEY.

Hi TV84
Seems for my Rigol DSG815 with FW 00.01.07 does not work this method.
Generated lics starts with RAJ9JBB are invalid.
Trial installed are LS9FBxxxxx
Any help?
Best regards

[Houseman]

Here's how to enter FACTORY and MANAGER/REPAIR modes:

Prepare a USB stick:
1. Format as FAT32
3. Write the following string to disc sector 3 of the USB stick (I used HxD):
35O8O228OLO8LNMN9690217963MN2O9ON46O9P05975K0047

Plug USB stick into the RF generator

Now the following SCPI commands will work:
:PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE
:PRIV:SOFT:MODE 0,REPAIRMODEENTRANCE
:PRIV:SOFT:MODE 0,MANAGERMODEENTRANCE

The first parameter (0) seems to be ignored.
MANAGER and REPAIR seem to be identical, but entering REPAIR doesn't require the USB stick.

The current mode can be verified with:
:PRIV:SOFT:MODE?

To return to USER mode, power cycle the device or use
:PRIV:SOFT:MODE 0,USERMODEENTRANCE
or
:PRIV:SOFT:MODE 0,EXITCURRENTMODE

Additional menus show up when in FACTORY/REPAIR/MANAGER mode:
Syst > Service
Syst > Service > Calibration
Syst > Service > RF DataSyn
Syst > License > Delete

I haven't dared to mess with settings in factory mode yet (like changing the model to DSG830). Don't blame me if you break your RF generator 

And a little mystery: When triggering the check of the disk sector, an empty file with the name "LqepdclquJ.txt" is created on the USB stick.

Hi.
Brand new DSG800.
Having problems with SCPI commands.
Resulting timeout error:
 * Error!!!
VISA:  (Hex 0xBFFF0015) Timeout expired before operation completed.

Some command accepted without error like IDN? or TIME, DATE ecc.
Other are partially accepted like:
:PRIV:SOFT:MODE 0,REPAIRMODEENTRANCE
Still gives me error timeout but
:PRIV:SOFT:MODE? gives me the change from USER to REPAIR MODE
but other complex one like dump or FACTORYMODEENTRANCE or serial license install mode gives me error.
Have reinstalled VISA driver, tried different OS (Mac, windows) different programs (nc, ultrasigma, Bildschirmkopie), tried append /n /r /r/n /n/r command extended timeout without effort.
Any info that Rigol stopped SCPI advanced access or is it only my fault?
Any help?
Thanks all

[chicken]

Brand new DSG800.
Having problems with SCPI commands.
Resulting timeout error:
 * Error!!!
VISA:  (Hex 0xBFFF0015) Timeout expired before operation completed.

Is that with the USB key?
What's your firmware version?

If I remember correctly, the SCPI implementation is quite picky and I also ran into plenty of timeouts while exploring the undocumented SCPI commands.

[Houseman]

Thank You chicken.

Brand new DSG800.
Having problems with SCPI commands.
Resulting timeout error:
 * Error!!!
VISA:  (Hex 0xBFFF0015) Timeout expired before operation completed.

Is that with the USB key?

Sorry what do You mean by that?
If it has a USB slot on the back?
Mine is just a DSG815 (no model A)
[/quote]
What's your firmware version?
[/quote]
-> *IDN?
<- (Return Count:50)
Rigol Technologies,DSG815,DSGxxxxxxx,00.01.07
Firmware version I think latest one available: 00.01.07
[/quote]
If I remember correctly, the SCPI implementation is quite picky and I also ran into plenty of timeouts while exploring the undocumented SCPI commands.
[/quote]

So what did you do to overcome this timeout? Did you manage get into factory mode?
Best regards and thanks

[chicken]

Sorry what do You mean by that?
If it has a USB slot on the back?

To enable factory mode you need to insert the USB key/drive prepared with the magic data as described in the original post. The firmware does look for this key when changing modes.

I didn't explore much further than enabling factory mode and seeing the extra menus. Most of my reverse engineering was done by analyzing the firmware files.  From my notes, it looks like I also only got timeouts for :SERVICE:READ:FLASH.

Timeouts probably indicate missing or invalid parameters, or that the SCPI client reads the data in the wrong way, or that the feature is not implemented or broken. Attached a spreadsheet with all SCPI commands I've found with some notes.

-> *IDN?
<- (Return Count:50)
Rigol Technologies,DSG815,DSGxxxxxxx,00.01.07
Firmware version I think latest one available: 00.01.07

I still have 01.06, so there may be differences.

[Houseman]

Thanks. Yep, the prepped key has been inserted but with all that timing error I do not know where the fault could be.
Do you know any limitation about USB pen size? I mean I have a 8Gb FAT32 format. Maybe it's too big?
By the way thank You for pointing out and helping me.
One last question: what kind of protocol/program did you use by sending commands to the DSG? Netcat? Ultra Sigma? thank You again

[tv84]

Change USB pendrive. These equipments are extremely picky regarding USB pendisks.

Big size isn't better... it forces extra timings recognizing/validating things and that may crash against the timings of the internal software.

[Houseman]

Change USB pendrive. These equipments are extremely picky regarding USB pendisks.

Big size isn't better... it forces extra timings recognizing/validating things and that may crash against the timings of the internal software.

Thank You TV84...
  "Big size isn't better... it forces extra timings recognizing/validating things and that may crash against the timings of the internal software."
Could be the new excuse .... maybe accepted whenever understood by partner..
Sorry by digressing  You made me laugh, thanks

[Houseman]

I made a breakout board to explore the the OCXO option for the DSG-815 (option OCXO-B08).
https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0644/1/-/-/-/-/DSG800%20OCXO%20User%27s%20Guide.pdf



Pinout:
1: GND
2: Detect input
3: slot
4: slot
5: VCC
6: CLK input
7: VCC
8: VCC
9: GND
10: Detect output

VCC is 6.515 V when the signal generator is plugged into mains. This is higher than I expected as the OCXO-B08 datasheet specifies 5.00 V +/- 0.25 V. It didn't drop much with a 220 ohm resistor (~30 mA). Will have to find a bigger resistor to test at loads specified in datasheet (300-600 mA).

Detect output (pin 10) goes from 0 to 3.3 V when the signal generator is turned on. When I connect this pin to Detect input (pin 2) through a 1 K resistor Syst > Information > System Info reports the option OCXO-B08. Interestingly, there's no error message even though I don't feed an external clock signal yet.

CLK (pin 6) was the only pin left. Not tested yet.

The pitch of the pins on the edge-connector is 1mm, 10 positions with a key slot (which is counted as a position). A matching connector is Samtec 1mm Mini Edge Card Socket Vertical, part number MEC1-105-02-F-D-EM2 or MEC1-105-02-L-D-EM2.
https://www.samtec.com/products/mec1-105-02-f-d-em2
https://www.samtec.com/products/mec1-105-02-l-d-em2

The dimensions of my breakout PCB are 32 mm x 50 mm, 1.6 mm thickness. It turned out to be about 3 mm too long, so 32 x 47 mm would be the correct size.

The size of the original OCXO is likely 25.4 x 25.4 mm. There are no good images of the OCXO-B08 to be found, but OCXO options for the DSG3000 (OXCO-A08)  has similar specifications. Some images for that option show an OCXO from DAPU with part number O22B-G445. Unfortunately, that part number doesn't quite match with the numbering-scheme on DAPU's website:
https://www.dptel.com/Products/ProductLevel4/2899



Any thoughts about VCC being 6.5 V?

Any suggestions for a suitable OCXO for this application?

Rigol officially claims that the OXCO module has to be inserted at factory by them even after  since after plugging the expansion in all RF gen needs to be whole recalibrated again...

[Houseman]

Sorry TV84
I am trying different usb sticks by your suggestion.
In order to break the problem in parts I wanted to test normal inserted USB keys. I hope that if seen by instruments it will also work for MOD.
Do you know by far if a normal USB key inserted will be shown in the System menu automatically? as i.e. using as print screen?
Is it like DS1054Z where inserted disk will be detected automatically by the instrument?
My system only shows D: internal drive.
No other USB disks.
Rebooting with normal USB not shown.
Best regards and thanks


Does

[chicken]

Do you know by far if a normal USB key inserted will be shown in the System menu automatically?

I get the E: drive and a small USB icon with the USB stick plugged in. I use a cheap Chinese uSD card adapter with an ancient uSD card, but it also should work with regular USB sticks.

One last question: what kind of protocol/program did you use by sending commands to the DSG? Netcat? Ultra Sigma? thank You again

I used Python with the vxi11 library for my experimentation. Looking at the code, I have just used the write(":PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE") to set user mode, without expecting/reading a response. Then ask(":PRIV:SOFT:MODE?") to verify if it worked.

Rigol officially claims that the OXCO module has to be inserted at factory by them even after  since after plugging the expansion in all RF gen needs to be whole recalibrated again...

Dooh! 

[Houseman]

I used Python with the vxi11 library for my experimentation. Looking at the code, I have just used the write(":PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE") to set user mode, without expecting/reading a response. Then ask(":PRIV:SOFT:MODE?") to verify if it worked.

What you just said has enlighten me.
You are right. Timeout connection occurs at response. So if I just send the command without asking anything maybe the system accept it even if at response it gives me timeout error.. will give it a try..
Thanks.

by the way no icon appears by inserting usb stick... maybe have a faulty unit.
best regards and thanks

[Houseman]

Finally got an old 256MB usb stick digest by instrument.
Prepared disk with sector 3 etc.etc.
Wanna laugh?
Sending Factory mode command (without asking the response a NAG Screen appears on DSG telling:
"Command is protected"
Running the command without the key:
"USB disk not present"
A step forward but now..
 


OK got it.
the USB was recognized but size was 0.00
Reformatting it to FAT32 again, nag screen disappeared. 

[chicken]

Sending Factory mode command (without asking the response a NAG Screen appears on DSG telling:
"Command is protected"
Running the command without the key:
"USB disk not present"
A step forward but now..
 


OK got it.
the USB was recognized but size was 0.00
Reformatting it to FAT32 again, nag screen disappeared. 

So did you manage entering factory mode?

I wondered whether they changed the passphrase with the new FW version. But I just upgraded my DSG815 to 01.07 and the magic USB key still works.

Attached the Python scripts I use to enter and exit factory mode. You will have to edit the IP address.

[kj7e]

Thanks for the great work all.

Update, my initial sweeps show good leveled output up though 2.35GHz, but seems to loose some calibration from there up to 3.6GHz.  I suspect they dont bother with full calibrations beyond the models specified freq range.

[kj7e]

Do you know by far if a normal USB key inserted will be shown in the System menu automatically?

I get the E: drive and a small USB icon with the USB stick plugged in. I use a cheap Chinese uSD card adapter with an ancient uSD card, but it also should work with regular USB sticks.

One last question: what kind of protocol/program did you use by sending commands to the DSG? Netcat? Ultra Sigma? thank You again

I used Python with the vxi11 library for my experimentation. Looking at the code, I have just used the write(":PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE") to set user mode, without expecting/reading a response. Then ask(":PRIV:SOFT:MODE?") to verify if it worked.

Rigol officially claims that the OXCO module has to be inserted at factory by them even after  since after plugging the expansion in all RF gen needs to be whole recalibrated again...

Dooh! 

Its not that the entire unit needs calibration, its just the OCXO will need to be calibrated once its in the unit, otherwise it will be very stably off frequency.

[chicken]

Rigol officially claims that the OXCO module has to be inserted at factory by them even after  since after plugging the expansion in all RF gen needs to be whole recalibrated again...

Dooh! 

Its not that the entire unit needs calibration, its just the OCXO will need to be calibrated once its in the unit, otherwise it will be very stably off frequency.

Hmm, I guess the 6.5V observed on the VCC pin will then be adjusted by the DSG to tune the OCXO.

From the datasheet of the OCXO used on the option for the DSG3000:
https://www.dptel.com/Products/ProductLevel4/2899

(highlighted 5 is the option based on part-number O22B-G445)

Not sure how to interpret that table. +/- 2.5V from nominal 5V supply voltage?

[kj7e]

I suspect pins 5/7 are VCC for the oven and clock operation,  pin 8 I suspect is voltage error correction from a DAC output to net the OCXO calibration.

[chicken]

I suspect pins 5/7 are VCC for the oven and clock operation,  pin 8 I suspect is voltage error correction from a DAC output to net the OCXO calibration.

Pins 5/7 and 8 on the edge connector are joined by the three vias. Also, based on the datasheet, I don't think the OCXO that Rigol uses has a separate pin for the control voltage.

If I were to build my own option, I'd probably go with a different OCXO that has a dedicated pin for the control voltage, and then use a voltage divider from VCC with a multi-turn trimpot to adjust the control voltage.

[kj7e]

Extended output sweep from the DGS821, 1.000 - 3.200 GHz, the cal is good up through the stock 2.1 GHz range (up to 2.35 GHz), but falls off in the newly liberated extended range.   Note, I calibrated out the cable with another known flat generator.

[kj7e]

Rigol officially claims that the OXCO module has to be inserted at factory by them even after  since after plugging the expansion in all RF gen needs to be whole recalibrated again...

Dooh! 

Its not that the entire unit needs calibration, its just the OCXO will need to be calibrated once its in the unit, otherwise it will be very stably off frequency.

Hmm, I guess the 6.5V observed on the VCC pin will then be adjusted by the DSG to tune the OCXO.

From the datasheet of the OCXO used on the option for the DSG3000:
https://www.dptel.com/Products/ProductLevel4/2899

(highlighted 5 is the option based on part-number O22B-G445)

Not sure how to interpret that table. +/- 2.5V from nominal 5V supply voltage?

I was finally able to view the page from home (work blocked it).  The chart is referring to the ordering part number code for the Voltage Control Characteristics or how much error correction range there is.   The thing that's throwing me, they dont show a VEC pin?  They show in table 2 you can specify 3.3, 5 or 12v VCC and that's pin 5, ground on pin 2, output on pin 1, so either pin 3 or 4 should be VEC. 

[GarbageCan]

I have a DSG815 and my life would be a lot easier if I had just 150MHz more bandwidth. It looks like people have done some impressive work in this thread, and I'm hoping to try and make my signal generator look a bit more like a DSG836.

This is a bit outside my realm, so apologies if this seems obvious. But is the procedure essentially:
1) Follow Reply #49 instructions on how to use a USB to enter factory mode
2) From Reply #50 use the linked license generator with option AAAB and the private key found (in reply #61 or if you break with the public key) along with your own serial number.
3) Insert this generated key using the SCPI command :SYSTem:LKEY

Is that all? I wasn't sure if the riglol option of AAAB/AAAC unlock the 3.6GHz or if that is some separate SCPI command. Just trying to wrap my head around what's necessary before I dive into it. Thanks!

[GarbageCan]

Okay so I used HxD on my flash drive and was able to have success entering factory mode. The AAAB / AAAC options with riglol as said before unlock the PUM and PUG options which don't affect the maximum frequency. I tried editing the model number with :PRIVate:FACTory:MODEL to change it to DSG836 and I do see the HW Info updated. But this did not unlock the 3.6GHz. I'm reading through the scpi.xls function list that Chicken shared but I am no seeing any factory parameters for maximum frequency. Can anyone point me in the right direction of what type of license of SCPI command to use to actually bump up the maximum frequency from 1.5GHz?

[chicken]

Caveat: I never tried myself to change the model number.

While the post way back says DSG836, I think the model number should be DSG830. At least that's the model that Rigol sells.

[chicken]

ok, just checked on the Rigol website and there are other models including DSG836... maybe also depends on the firmware version. When I dug into my firmware, I seem to remember only seeing DSG815 and DSG830.

[GarbageCan]

Caveat: I never tried myself to change the model number.

While the post way back says DSG836, I think the model number should be DSG830. At least that's the model that Rigol sells.

Whoops, got too fixated on other people's 3.6GHz range. Thanks for the help chicken, setting it to DSG830 did the trick. Once it had power cycled it started at 3GHz. I just tested it with a spectrum analyzer and it looks good where I need it. Thank you so much for your help!!