RIGOL DP711 and DP712 new 1ch PSU - Page 1
Forum section: electronics / testgear

author: SimonD
author_rank: Regular Contributor
timestamp: May 16, 2016, 11:54:26 am
content: New PSU Series DP7xx ...Looks nice ... but ...RS232 ? without USB at 2016 ?http://int.rigol.com/Product/Model/85/487

author: Rolo
author_rank: Regular Contributor
timestamp: May 16, 2016, 04:35:34 pm
content: Looks good, would like to see this one tested on Dave's bench. Looks like Rigol has come to sense with the display and controls.

author: nidlaX
author_rank: Frequent Contributor
timestamp: May 16, 2016, 05:01:00 pm
content: No remote sense?

author: vinicius.jlantunes
author_rank: Regular Contributor
timestamp: May 16, 2016, 05:34:05 pm
content: Yeah, the RS232 interface is a bit odd. Other than that seems like a nice PSU.Hopefully Dave gets one to teardown / review!

author: burkm
author_rank: Regular Contributor
timestamp: May 16, 2016, 05:43:40 pm
content: Don't seem to find an international dealer for it though...

author: electr_peter
author_rank: Unknown
timestamp: May 16, 2016, 06:23:20 pm
content: Spec sheet herehttp://www.batterfly.com/PDF/RIGOL/DP700_DataSheet_EN_BF.pdf

author: Hydrawerk
author_rank: Super Contributor
timestamp: May 17, 2016, 09:02:12 pm
content: http://int.rigol.com/File/ModelTechDoc/20160503/DP700_DataSheet_EN.pdfWell, my old PC from February 2000 has an USB port. My PC from October 2009 has NO RS-232 port. Most nowadays computers do the same.But it looks like a nice PSU anyway. Maybe I prefer a big LED display.

author: I4E
author_rank: Regular Contributor
timestamp: June 02, 2016, 02:35:25 pm
content: Rigol actually chose to make this unit on purpose with RS 232. I think this has mainly to do with the type of customers or market they feel might use the power supply. You can always purchase a USB-RS232 or LAN-RS232 adapter/converter. This isn't available from Rigol so you'd have to purchase that individually..You can control the DP700 by PC by using a 9 Pin RS2322 Female -Female straight cable to connect the DP 700 to the PC and then control by SCPI programming or PC software like the Ultra Sigma Software.We are authorized distributors for Rigol in the United Kingdom/ Ireland.www.instruments4engineers.comJoy TorresInstruments 4 Engineersinfo@instruments4engineers.comTel +44 (0) 161 871 7450

author: pascal_sweden
author_rank: Super Contributor
timestamp: June 02, 2016, 07:09:46 pm
content: It seems rather expensive for only 1 channel.It would have been nice if the Power measurement would be aligned on the right,together with Voltage and Current measurements.

author: CustomEngineerer
author_rank: Frequent Contributor
timestamp: June 03, 2016, 04:36:24 am
content: Its probably going to have a HIRES option like the DP800 models have that gives an extra digit of resolution, at which point voltage and current would be aligned with power.Edit: Checking Rigol's site for the DP700s does indeed show that HIRES is an option.

author: simone.pignatti
author_rank: Frequent Contributor
timestamp: June 24, 2016, 02:47:17 pm
content: Quote from: nidlaX on May 16, 2016, 05:01:00 pmHello it seems Rigol hasn't added the remote sense since this power supply is intended to be used on a lab or desk, where the distance to the DUT is not far away.Any question, please ask. We have some DP711 to test in case of special request.

author: Nuzzler
author_rank: Contributor
timestamp: August 30, 2016, 07:46:00 pm
content: Is anyone using these PSU's yet? The DP711 looks like a good fit for me. I know that the DP832 is popular, but it's 50% more $$$ and I'm really digging the 30V/5A single channel of the DP711. Any feedback would be appreciated.- Nuzz

author: bitseeker
author_rank: Super Contributor
timestamp: August 30, 2016, 10:30:42 pm
content: @Nuzzler: In the US, this supply isn't that appealing. Unless you really need a new product, you can get more bang for the buck buying used and we've got access to lots of great used gear.

author: carlob
author_rank: Contributor
timestamp: October 16, 2016, 11:44:50 pm
content: Simone, could you please take a short video of powered up DP711? Please?Don't know how, but your YT videos are only one on a whole internet. They are great, but i guess i'm not the only one who would like to see how they actually works... To see some screens from menus, how fast and responsive is UI, etc..I'm in doubt between DP832 and DP711, mostly because i prefer 30V/5A more then 30V/3A.But it is also nice to have 3 chanel for rather small aditional payment. I'm really not smart, and it would really mean a lot to me to see such a short review. Just a shoot with better cell phone, without editing.And you will get great exposure, if you advertise your video, because you will be only one on a whole earth!Thanks a ton!Regards.Quote from: simone.pignatti on June 24, 2016, 02:47:17 pm

author: simone.pignatti
author_rank: Frequent Contributor
timestamp: October 17, 2016, 09:57:00 am
content: Hello! We are working on that video.We will publish it soon. I will post here the link.Thanks

author: Stupid Beard
author_rank: Regular Contributor
timestamp: October 17, 2016, 10:45:17 am
content: Quote from: carlob on October 16, 2016, 11:44:50 pmIf you parallel channels 1 and 2 on the DP832 you can do 30V/6A or in series 60V/3A.

author: carlob
author_rank: Contributor
timestamp: October 17, 2016, 12:01:42 pm
content: Quote from: simone.pignatti on October 17, 2016, 09:57:00 amHey, nice to hear that!Thank you very much, amici miei!

author: carlob
author_rank: Contributor
timestamp: October 17, 2016, 12:04:20 pm
content: Quote from: Stupid Beard on October 17, 2016, 10:45:17 amHey Beard, thanks. I guess if I understand well, you could simply connect both output 1 & 2 on the same circuit, and manually calculate value, or Rigol do that for you?Thanks.

author: Zbig
author_rank: Frequent Contributor
timestamp: October 17, 2016, 12:08:25 pm
content: Quote from: burkm on May 16, 2016, 05:43:40 pmBatronix has them:http://www.batronix.com/shop/rigol/DP700.html. They're in Germany

author: Stupid Beard
author_rank: Regular Contributor
timestamp: October 17, 2016, 01:06:38 pm
content: Quote from: carlob on October 17, 2016, 12:04:20 pmIt shows each channel individually, but you can link them so that they both stay at the same value. On theDP832 thread, the first attachment has information on how to connect it in series and parallel.https://www.eevblog.com/forum/testgear/rigol-dp832-firmware-updates-and-bug-list/?action=dlattach;attach=79494should be a direct link to the PDF.

author: carlob
author_rank: Contributor
timestamp: October 17, 2016, 09:19:23 pm
content: Yes, thanks,http://www.batronix.com/pdf/Rigol/UserGuide/DP800_UserGuide_EN.pdfon 58 Adobe PDF page, or 2-8, as in manual.There is explanation, but as i'm not had oportunity to work with Bench PS, i'm not sure in reality, how all that looks like...

author: Stupid Beard
author_rank: Regular Contributor
timestamp: October 17, 2016, 11:53:09 pm
content: Quote from: carlob on October 17, 2016, 09:19:23 pmPlease excuse the kludgey setup and rubbish cell phone photography.Top two photos are series, bottom two are parallel. The DP832 is setup with channel 1 set to 5V and 0.5A, tracking is turned on so that channel 2's voltage tracks. That is, if I change channel 1 then channel 2 changes too. You don't have to use tracking, it's just convenient if you are going to be using it as a split supply.Since I seem to have also failed at getting the leads fully in shot, series is wired with CH1 +ve to the DMM, CH1 -ve to CH2 +ve and CH2 -ve to DMM. Parallel setup is hopefully obvious.

author: carlob
author_rank: Contributor
timestamp: October 18, 2016, 04:18:49 pm
content: I really don't know why Stupid Beard, even as a joke...You save me of buying DP711... at least for now... Photos are really great. If i see well, that small link, like infinity sign, actually represent connection between two adjacent channels?Actually, procedure you are talking about is this one:https://youtu.be/wIo-MPEXKm4?t=1048Thanks again for your effort! Really appreciated a ton!

author: Stupid Beard
author_rank: Regular Contributor
timestamp: October 18, 2016, 08:20:15 pm
content: Quote from: carlob on October 18, 2016, 04:18:49 pmI wasn't sure if I was understanding you correctly, but I looked at the manual page you linked and could see why someone would be confused so figured I'd post it anyway. Hopefully it helped.Quote from: carlob on October 18, 2016, 04:18:49 pmYes, that's correct. For what it's worth, my only complaints about the DP832 are how loud the fan is and how I am too lazy to replace the fan with a quieter one. I don't know what the DP711 is like, but I use two channels quite often so I'm glad the DP711 didn't exist when I bought my DP832.Quote from: carlob on October 18, 2016, 04:18:49 pmYou're welcome.

author: SteveyG
author_rank: Unknown
timestamp: October 18, 2016, 08:31:46 pm
content: Quote from: SimonD on May 16, 2016, 11:54:26 amLooks like quite a nice device. I do like the classic RS232 interface - I've done several test beds that use the RS232 interface from a simple microcontroller or a bit of VBA in Excel.

author: bitseeker
author_rank: Super Contributor
timestamp: October 18, 2016, 08:58:05 pm
content: Quote from: SteveyG on October 18, 2016, 08:31:46 pmHi Steve. I rarely hear about folks using the RS232 in instruments. Your setup might make for a nice vid.

author: Macbeth
author_rank: Super Contributor
timestamp: October 18, 2016, 09:00:31 pm
content: A classic RS232 interface is better than a USB simply because there is no call for the speed, voltages, protocols, etc. of USB for simple SCPI communication and anyone who doesn't have a 9 pin (or 25 pin, remember them?) D connector on their PC can always purchase a ridiculously cheap USB<->RS232 converter lead anyway (I sniped my last one for less than $1.50 shipped - bloody Shenzhen!)Something I noticed on the RIGOL website - both supplies DP711 and DP712 are rated at 150W but clearly the DP711 with a 3A30V output is only 90W. This would appear to be a typical RIGOL marketing attempt at letting the hackers get the DP711 and upgrade it by software, while leaving the DP712 to the corporates. Am I right?ETA: DOH! DP712 is 50V at 3A. In this case I would imagine it's not just a RIGLOL job

author: SteveyG
author_rank: Unknown
timestamp: October 19, 2016, 07:06:12 am
content: Quote from: bitseeker on October 18, 2016, 08:58:05 pmI'll add it to the list! Currently moving house though hence no videos for a while

author: carlob
author_rank: Contributor
timestamp: October 28, 2016, 09:40:50 pm
content: Quote from: simone.pignatti on October 17, 2016, 09:57:00 amSimone, do you maybe have any news? When you will publish your video about DP711 in action?Thnx!

author: vvmm
author_rank: Contributor
timestamp: December 19, 2016, 12:17:26 pm
content: Is this PSU hackable to enable high-res mode and trigger?

author: Dwaine
author_rank: Frequent Contributor
timestamp: December 20, 2016, 05:06:42 am
content: I can honestly say that I miss the good old serial port.

author: fki82
author_rank: Contributor
timestamp: February 19, 2017, 08:07:23 pm
content: Has anybody tested this device yet?

author: Eric-H
author_rank: Contributor
timestamp: February 20, 2017, 11:13:33 am
content: Quote from: fki82 on February 19, 2017, 08:07:23 pmI've received my DP711 a few weeks ago form Conrad and I'm very happy with it. I especially like the display and the user interface. One minor complaint: the fan is a bit loud.I'm also looking for a way to enable the options

author: ElectronMan
author_rank: Regular Contributor
timestamp: March 12, 2017, 06:56:10 pm
content: I've done some playing around with my DP712. Slurped the main firmware image off the SPI flash chip inside before and after the trial ran out. Unfortunately the license data is actually stored on an FRAM chip that I missed the first time I took it apart.The main processor appears to be a CME-5 (http://www.capital-micro.com/PDF/CME-M5_Family_FPGA_Simplified_Data_Sheet_EN.pdf), an FPGA and 8051-based MCU combo. There is a JTAG port available, but I haven't managed to do anything useful with that yet.The FRAM appears to be a Fijitsu (https://www.fujitsu.com/us/Images/MB85RC16-DS501-00001-8v0-E.pdf). It uses i2c, contains 8 x 2kbit pages.Page 0 (Address 0x50) = Configuration settingsPage 1 (0x51) = Appears to be unusedPage 3 (0x52) = Front panel button lock settings in bytes 0x30-32 (each button is 1 bit) and Serial number at address 0x40-4d with what appears to be a checksum at 0x55-56. Changing the SN causes it to copy the serial # back from SPI flash and rewrite it, probably because of the invalid checksum.Page 4 (0x53) contains the configured options (licenses) starting at 0x00, with what appears to be another checksum at 0x13-0x14.Pages 5-7 (0x54-57) Appear to be unused.I was able to hook up a raspberry pi via i2c and can read-write most of the locations while the unit is powered on, with the exception of 0x52 (SN data). This one you can read/write right after power on before it has booted, so you have to be fast. These areas are read on bootup:1. i2c FRAM address 0x52 Starting at 0x40, reading 23 bytes (appears to be always 0x10 followed by 9 bytes of serial #, 7 0x0 and the 2 byte checksum)2. i2c FRAM address 0x50 Starting at 0x00, reading 24 bytes (config data and checksum)3. i2c FRAM address 0x53 Starting at 0x00, reading 21 bytes (option info and checksum)4. i2c FRAM address 0x52 Starting at 0x30, reading 4 bytes (First 3 bytes front panel button lockouts, unknown 4th byte. These default to all 0x00)It also re-reads #3 above (options) every 66 seconds while running. The main blocker on getting further with this is the checksum. When the license data is all 0's (which it fills when it detects a bad checksum) the checksum is 0xcc 0x71).Hopefully someone more seasoned with reverse engineering can take this further... I haven't given up yet though.

author: ElectronMan
author_rank: Regular Contributor
timestamp: March 15, 2017, 03:35:44 am
content: Got it.... There are 3, 5 byte fields at the beginning of 0x53. One for each feature. The first byte appears to be license type. 01 is trial, 02 is Official, and 03 is expired trial. There are 2 bytes of 00, followed by 2 bytes that seem to represent the # of minutes of trial elapsed. (See image) The # 08 71 works out to 36hrs runtime.i2c Address 53:0x00 = Trigger License type0x01 - 0x02 = 00's, possibly extended trial time field.0x03 - 0x04 = Trial time elapsed in minutes.0x05 = Timer License type0x06 - 0x07 = 00's, see above0x08 - 0x09 = Trial time elapsed for Timer0x0a = High res License type0x0b - 0x12 = All 0's, possibly room for a trial license but one is never enabled.0x13 - 0x14 = 16 bit crc checksum of 0x00 - 0x12.Therefore, we want all 3 license types to be 02, and the checksum needs to be accurate. The data in the attached screen shot checks out. If your trial timer fields are different, those need to be changed to match for the CRC to pass.This is not an ideal solution as it requires opening it up and leeching onto the FRAM chip with a device that talks i2c, but it works

author: Eric-H
author_rank: Contributor
timestamp: March 15, 2017, 08:41:50 am
content: Good work!The remaining question is then: how did you calculate the crc over the license data? It the algorithm that Rigol uses known?

author: ElectronMan
author_rank: Regular Contributor
timestamp: March 15, 2017, 01:14:30 pm
content: Passed a couple of known good instances of the data with checksum to reveng with instructions to discover/dump CRC parameters;Code:reveng.exe -w 16 -s 03000008710300000871020000000000000000a111 030000087103000008710000000000000000006776width=16 poly=0x1021 init=0xebcc refin=false refout=false xorout=0x0000 check=0x6809 residue=0x0000 name=(none)Then pass the parameters back in with instructions to calculate the checksum for the data i want:Code:reveng -w 16 -p 1021 -i ebcc -c 02000008710200000871020000000000000000046fAnd Bob's your uncle

author: Eric-H
author_rank: Contributor
timestamp: March 16, 2017, 07:38:59 am
content: I opened my DP711 but could not find the FRAM chip. Is it located at the bottom side of the board?I did see that a smal cap (47 uF / 50V) had vented its electrolite, so I will have to replace it.

author: Dwaine
author_rank: Frequent Contributor
timestamp: March 16, 2017, 09:16:36 am
content: Quote from: Eric-H on March 16, 2017, 07:38:59 amYou are joking right. These power supplies are new. That's warranty for sureWow.

author: Eric-H
author_rank: Contributor
timestamp: March 16, 2017, 09:57:55 am
content: I did have to break the "Warranty void if removed"-sticker to find the bad cap.

author: ElectronMan
author_rank: Regular Contributor
timestamp: March 16, 2017, 12:38:24 pm
content: It is on the side of the upper-board facing the front. The pins have some test pads there.

author: ElectronMan
author_rank: Regular Contributor
timestamp: March 16, 2017, 01:10:11 pm
content: I suppose I should give the obligatory warning for anyone that might want to do this. It's generally not a good idea to hook into live circuits and talk to memory behind the processor's back. My curiosity got the best of me, so I went for it and it worked out.With that out of the way, a little more detail on what I did. I removed the board with the main CPU on it and found the test pads for the SDA and CLK pins of the i2c FRAM chip. I soldered some wire-wrapping wire ends to the pads and put on a dab of hot glue to eliminate the chances of the ends shorting as the wires moved. I then used some tape for strain relief running the wires out the top of the unit with the case off.SDA and CLK I ran to the i2C-1 pins on a raspberry pi since it was convenient. I ran ground to the top part of the chassis.On the pi with i2c enabled, I used the i2cdump command (with PSU powered on) to get the memory pages:Code:i2cdump -y 1 83 c53 hex (83 decimal) is the one I was interested in. It spits out the entire page.I created a quick shell script so I could write everything at once and dump the result quickly. The CPU only seems to read from the FRAM every 66 seconds while running, but I wanted to reduce the chances for contention.Code:i2cset -y 1 83 0x00 0x02 bi2cset -y 1 83 0x03 0x08 bi2cset -y 1 83 0x04 0x71 bi2cset -y 1 83 0x05 0x02 bi2cset -y 1 83 0x0a 0x02 bi2cset -y 1 83 0x13 0x04 bi2cset -y 1 83 0x14 0x6f bi2cdump -y 1 83 cOnce I verified the memory had what I wanted in it, I power cycled the PSU, and my DP712 was "enhanced."

author: Eric-H
author_rank: Contributor
timestamp: March 16, 2017, 02:05:19 pm
content: Thanks for the detailed description!I did not take the complete unit apart, and was looking at the bottom pcb. Now I know where to look I will give it a try using an arduino.

author: ElectronMan
author_rank: Regular Contributor
timestamp: March 16, 2017, 03:07:44 pm
content: Good Luck! This weekend I might see if I can do anything via serial port commands. I know some devices have allowed writing to memory areas in the past I haven't conducted an exhaustive search of the firmware for undocumented serial commands yet.

author: Eric-H
author_rank: Contributor
timestamp: March 17, 2017, 07:26:13 pm
content: I just enabled all three options on my DP711 by writing to the FRAM via an ArduinoThanks for the info that made this possible.Also replaced the bad cap. It was mounted in the wrong polarity!

author: bitseeker
author_rank: Super Contributor
timestamp: March 17, 2017, 07:46:00 pm
content: Quote from: Eric-H on March 17, 2017, 07:26:13 pmWoops!

author: ElectronMan
author_rank: Regular Contributor
timestamp: March 17, 2017, 10:30:49 pm
content: Cool, I am glad it worked for youNot confidence inspiring that a backwards cap made it through QA though...

author: Eric-H
author_rank: Contributor
timestamp: March 18, 2017, 10:32:39 am
content: Quote from: ElectronMan on March 17, 2017, 10:30:49 pmThe cap had a red marking on it, just like the other caps and connectors have. So, someone did check it. But even with the bad cap the supply worked just fine and I didn't notice anything, until I opened the unit.I must say the unit is constructed quite nicely, and comes apart easily just by removing some screws.

author: atarijedi
author_rank: Newbie
timestamp: October 09, 2017, 08:39:05 am
content: I was just looking into picking up one of these power supplies, and then get another one in a few more months, so I am able to connect them together.So looking at photos, I noticed the safety info beside the plug on the DP711 states a max of 300W/400VA. Does that mean its actually capable of 60V 5A?

author: lundmar
author_rank: Frequent Contributor
timestamp: October 09, 2017, 12:05:24 pm
content: Quote from: SimonD on May 16, 2016, 11:54:26 amI'm more disappointed that they don't feature LXI/Ethernet. I can do without RS232 and USB.

author: bitseeker
author_rank: Super Contributor
timestamp: October 09, 2017, 05:25:03 pm
content: Quote from: atarijedi on October 09, 2017, 08:39:05 amHi atarijedi. Welcome to the forum.You're looking at the input power limit. Unless a power supply has 100% efficiency (not possible) and designed to output that much power, the output power rating will not be anywhere near the input one.It's always best to read the product specifications,http://int.rigol.com/File/ModelTechDoc/20160503/DP700_DataSheet_EN.pdf, where you'll find the output limit is 150W and the maximum voltage and current depend on the model you choose.

author: bson
author_rank: Unknown
timestamp: October 09, 2017, 05:41:40 pm
content: Quote from: Eric-H on March 16, 2017, 09:57:55 amAmericans can just remove them since they violate federal law.https://www.extremetech.com/gaming/233120-microsoft-sony-and-other-manufacturers-still-use-illegal-warranty-void-if-removed-stickers

author: bitseeker
author_rank: Super Contributor
timestamp: October 10, 2017, 12:13:40 am
content: Thanks. Interesting article, bson.

author: bitbanger
author_rank: Regular Contributor
timestamp: March 26, 2018, 02:13:35 am
content: I know this is a bit of an old thread but just a note from a DP711 owner: look carefully at specs. High res doesn't mean high accuracy! I was happy with the supply so after a few months decided to upgrade without considering this.Output is within 0.7mV on a 6-1/2 digit DMM. However the DP711 readout is out nearly 12mV. After looking at the specs this is technically "in"("Annual Accuracy: Readback: Voltage 0.05% + 20 mV") but I can't understand why or how you can control to 1mV but your meter is off 12mV (I would assume that in a new power supply like this your display should be showing the ADC value used for feedback control)? This held with and without load.

author: bitseeker
author_rank: Super Contributor
timestamp: March 26, 2018, 02:21:05 am
content: Correct. Accuracy and resolution are two different characteristics.Here's an example. If someone "calibrated" the power supply to be off by, say, 5 volts, then it would have terrible accuracy, but retain its high resolution.

author: bitbanger
author_rank: Regular Contributor
timestamp: March 26, 2018, 02:24:45 am
content: Right right, the problem was I naively assumed that for a $360 150W power supply the meter accuracy would at least match the output resolution. All said still happy.

author: bitseeker
author_rank: Super Contributor
timestamp: March 26, 2018, 02:27:05 am
content: Yep, it can still useful to be able to see small changes in the current draw or fluctuation in voltage without having to hook up a supplemental multimeter.

author: djdanielb
author_rank: Newbie
timestamp: October 21, 2018, 01:39:33 pm
content: Hi peopleCould someone detail the steps using ardui o to enable this features ?Thank you a lot

author: borisbees
author_rank: Newbie
timestamp: November 12, 2018, 12:55:40 am
content: Quote from: ElectronMan on March 12, 2017, 06:56:10 pmFor anyone searching, Iposted earlier in the yearon the wrong thread about dumping the firmware of the DP711/DP712, and have had a few attempts at reverse engineering it to figure out how to generate license keys to unlock options without the intrusive FRAM hack.I'm currently stuck on figuring out the memory layout in order to relate addresses in the code to actual data. I haven't worked a whole lot with assembly, and never with 8051 / MCS-51 before. In case anyone wants to take a look at this, here's a everything I know so far. DM me if you want a copy of the dump.TargetThe manual for the DP711 states that the following serial command can be used to unlock the device instead of the keypad/UI:LIC:SET <keyWithoutDashes>This seems like the most promising lead to find the licence key algorithm without needing to go through all of the UI related code.Hardware infoThe digital board in the DP711 has a CME-M5 FPGA + 8051 combo chip, an IS42/45S81600F 128Mbit DRAM, and stores its firmware on a Winbond W25Q128FVSG 128mbit SPI flash.- CME-M5 datasheet:http://www.capital-micro.com/PDF/CME-M5_Family_FPGA_Data_Sheet_EN060418.pdf- 128Mbit DRAM datasheet:http://www.issi.com/WW/pdf/42-45S81600F-16800F.pdf- 128Mbit SPI Flash datasheet:https://www.pjrc.com/teensy/W25Q128FV.pdfThe full FPGA/8051 chip model is CME-M5C06N0. It only supports the Keil C51 compiler for the 8051 side of the processor. This variant of the chip has no internal flash, which is why the SPI flash is (conveniently) present.The 8051 side of the FPGA is documented as a R8051XC2 IP core. This uses a "MCS-51 compatible" instruction set, but has many more peripherals than a generic 8051.- IP Core:https://ip.cadence.com/uploads/450/cdn-dsd-sys-r8051xc2-ip-pdfNotes from datasheetsThe CMS-M5 has 128K of SRAM accessible by the 8051 MCU. The MCU can use an extended memory mode, accessing the FPGA fabric. I'm unsure if this is used:--- 0x07FFFFF|| FP "Fabric" Expand|--- 0x020000--- 0x01FFFF|| 128K SRAM|--- 0x0The datasheet suggests that FPGA images are about 0x30000 bytes.ObservationsThe flash chip is read from address 0x0 at power on after a few flash configuration commands, then at 0x091000 a short while later. The latter address appears to be 8051 assembly. This lines up with what the datasheet suggests.The FPGA bitstream is likely encrypted, but it does not appear relevant to reversing a license key. The datasheet does not indicate that the MCU code can be encrypted like the bitstream can be.There are two copies of system settings at 0xCE000 and 0xCE800. About 690 bytes are read from here when entering and exiting the System menu, and when hitting the Timer key. The two strings at the start of this settings data are the calibration date and calibration screen password.Addresses of interestVisualization of the flash dump attached. One of the FPGA bitstreams is probably the IP core for the MCU, with the other one being Rigol's own bitstream, assuming they're actually using the FPGA portion of the chip rather than using it purely as a microcontroller.Bootloader / FPGA core: 0x0Firmware: 0x091000The 8051 firmware appears to be split into 4 x 32K sections, identifiable by blocks of NOPs padding at 32K boundaries. This aligns with the 128K of code/data SRAM stated in the datasheet. The sections are:- 0x91000 to 0x98FFF- 0x99000 to 0xA0FFF- 0xA1000 to 0xA8FFF- 0xA9000 to 0xB0FFFFrom 0xB1000 there's about 1582 bytes that look like instructions (visually similar to the other 4 sections above, but doesn't fit into the above blocks.After this, the SPI flash appears to be used for persistent storage of settings. This has been verified using a logic analyzer with the DP711 turned on and using the System and Memory functions to change/save settings.Two copies of system settings at:- 0xCE000- 0xCE800Some user settings (Memory button) at: 0x100000- These appear to be 33 bytes long- Start with 0x01 when set, otherwise 0x0- Appears to reference the blocks below (quite spaced out)Interesting data addresses:- Device serial number at 0x0ca000- Serial command strings near 0x0cf000- Help text near 0x0d2000- Licensing related text near 0x0d6000The LIC:SET serial command might lead quickly to the key. "LIC" appears near other serial command strings at 0x0d025e.

author: ElectronMan
author_rank: Regular Contributor
timestamp: November 12, 2018, 04:45:04 am
content: You should read back through this thread. I figured it out and the details are there.

author: borisbees
author_rank: Newbie
timestamp: November 12, 2018, 04:58:58 am
content: Quote from: ElectronMan on November 12, 2018, 04:45:04 amYes, the work you've done with the i2c FRAM is great, but:Quote from: ElectronMan on March 15, 2017, 03:35:44 amI'm looking for a way to generate a valid licence key from software without opening the PSU, along the lines ofhttp://www.gotroot.ca/rigol/riglol/.I'm well aware I can activate all the features with your FRAM changes, but that only unlocks it for me - generating serials solves it for everyone.

author: tv84
author_rank: Super Contributor
timestamp: January 18, 2021, 07:21:11 pm
content: The DP700 keygen is identical to the DL3000 keygen (with a different char_map). Seehere.They don't use ECC as riglol/rigup. It's a cascade of CRC16 calculations giving a 28-char license.The only parameter that is needed for the calculations is the S/N.I've successfully licensed a DP711 (attached).Example of licenses for someone curious:Rigol DP700 S/N: DP7A123456789Official LicenseDP7-TRIGER 22W5NBYPM6GUP27A68RY4VWQWH5LDP7-TIMER T9ZKK8GPH7GUTA2BUDDYWJX8PKJ5DP7-HIRES AES6FY3KV6GUV4ENR6QCBK8HH2CK

author: VMZ
author_rank: Newbie
timestamp: March 11, 2021, 01:51:08 pm
content: Good afternoon!Tell me, how exactly did you generate the keys for dp700? Did you do it with riglol? What keys should I use?

author: tommot
author_rank: Newbie
timestamp: March 11, 2021, 07:44:45 pm
content: Hi, I would also be interested to know and understand how the calculation using this cascaded CRC-16s works.If I understand this procedure correctly, a CRC-16 is applied to each character of the S/N and converted back to characters via a mapping table?

author: tv84
author_rank: Super Contributor
timestamp: March 12, 2021, 12:36:33 pm
content: I will not make the method public. But it's easily visible in the DL3000 FW for those who know how to see.

author: VMZ
author_rank: Newbie
timestamp: March 12, 2021, 12:44:08 pm
content: Why, then, was it necessary to report this information? Not all programmers are here

author: Nokia6681
author_rank: Contributor
timestamp: March 29, 2021, 08:13:08 pm
content: I also plan to buy this DP711, I would be interested in the activation, but I can't program, so I would be very interested in how it works so that everything is activated over Serial

author: fqahmad66
author_rank: Regular Contributor
timestamp: April 12, 2021, 07:59:09 am
content: So is it possible to Hack the PS without opening it?

author: mrprecision
author_rank: Regular Contributor
timestamp: November 18, 2021, 09:34:36 pm
content: Hello,I have written a software to remote control the power supply and have done some test with my DP711. It should work also on ta DP712. I have activated the DP7-HIRES option. Can some one please test my software with a supply without DP7-HIRES option.Link for the Download:http://www.schaeck.eu/download/?dir=DP7XX%20RemoteBest Regards,MrPrecision

author: axiv
author_rank: Newbie
timestamp: January 30, 2024, 11:36:18 am
content: Quote from: tv84 on January 18, 2021, 07:21:11 pmPlease share the algorithm or tell me which way to move

author: justincel
author_rank: Newbie
timestamp: May 15, 2024, 11:46:58 pm
content: broth where can I get the license calculator for my dp711 high resolutionthack for your help

author: justincel
author_rank: Newbie
timestamp: May 16, 2024, 12:29:40 am
content: HELP GENERATE LICENCETHANCK

author: justincel
author_rank: Newbie
timestamp: May 16, 2024, 12:52:47 am
content: Quote from: tv84 on January 18, 2021, 07:21:11 pmBROTHER CAN YOU HELP ME WITH MY DP711I DON'T WANT THE METHODBUT IT WOULD BE A GREAT HELP TO ME IF YOU COULD ACTIVATE THE LICENSESVERY NICE THANK YOU VERY MUCHGREETINGS TO THE FAMILY

author: rom67
author_rank: Contributor
timestamp: May 16, 2024, 02:50:52 pm
content: Need help to complete the entire procedure for generating serial numbers for HI-RES unlocking on DP711/712?The question is to generate withount the hardware dissasembling and FRAM modification.

author: justincel
author_rank: Newbie
timestamp: May 18, 2024, 07:35:23 pm
content: Quote from: rom67 on May 16, 2024, 02:50:52 pmyes broth nedd

author: lzcubchgg
author_rank: Contributor
timestamp: January 28, 2025, 03:15:14 am
content: Do you have a backup of the flash content of your DP711? If so, please send me one. Thank you.

author: lzcubchgg
author_rank: Contributor
timestamp: January 29, 2025, 09:13:02 am
content: 712/711 should be interchangeable, the firmware is the same.There are three differences, I have studied them and they should be feasible. After replacement, the calibration content is different and may require firmware replacement.712 r474=01c=ID (r139 r93 r138=9311) R96=47C=30.1K711 r473=01c=ID (r139 r93 r138=3321) R96=30C=20K

author: petergram2
author_rank: Newbie
timestamp: June 20, 2025, 11:19:18 am
content: Hello! Could you provide information on how to extract 3 licenses using just one ID?Do you need to concatenate any additional information to the ID?Please, Can you provide the specific algorithm? if possible.There seem to be some parameters that can be configured to perform the computation.