Rigol VS5000 series

From sigrok
Jump to: navigation, search
Rigol VS5000 series

The Rigol VS5000 series are 2 channel, 25-200Mhz USB/Ethernet oscilloscopes. Some models also include a 16 channel logic analyzer.

The device is discontinued by Rigol, but you can find the basic specs e.g. here.


Model Analog Bandwith Logic Analyzer Time Base Range
VS5022 25 MHz 20ns/div – 50s/div
VS5042 40 MHz 10ns/div – 50s/div
VS5062 60 MHz 5ns/div – 50s/div
VS5102 100 MHz 2ns/div – 50s/div
VS5202 200 MHz



Analog acquisition

Logic acquisition

Ethernet interface

USB interface

TCP Protocol

The device listens on TCP port 19, and implements an SCPI based protocol compatible with that of the Rigol DS1000 series. Responses received from the device are prefixed with a 32-bit, little-endian length field. The transport is implemented in hardware/common/scpi_tcp.c, and the protocol by the rigol-ds driver.

USB Protocol

Work in progress.

The Rigol communication protocol only uses the USB control and bulk transfer. Control is for sending setup and request smaller amounts of data. Bulk transfers is returned by the Rigol box with setup and image data.

All control transfers interesting for us has request type set to 0xc0. The request field in the control packets is what tells us which command is actually sent.

All descriptions below should have both request type and request set to proper values, obvious from the headlines what it should be.

Packet types

This information is completely reverse engineered by hand.

Read answer (request = 0x00)

Commands ending with a question mark ('?' ASCII 0x3f) returns answer in two control transfers.

First control transfer is to query the size of the data to be returned. That is done by value set to 0. One byte of data is returned in the data field by this operation which is the size of the string the Rigol box wants to return.

Second control transfer has value set to 1. The buffer, allocated to the size just read, is also sent along the command to be filled with the data. The returned data is an ASCII string.

Write command (request = 0x01)

Commands from the PC program to the Rigol box is sent as text strings. Which commands that are available are listed in the Programming Guide from Rigol.

Each character is sent in a control message with the value set to the ASCII character to be sent. Each ASCII string is terminated with a carriage return (0x0d, '\r'), which terminates the transmission.

Request waveform data (Request = 0x04)

When waveform data is requested to be retrieved a control message is sent. The index field of the setup data is a bitmask on which channels to be requested. It is encoded as bit 0 meaning Channel 1, bit 1 meaning Channel 2, bit 2 meaning Logic Channel 0, bit 3 meaning Logic Channel 1 etc.

The 4 byte data field of the control packet sent back as an ack contains number of bytes to be returned by bulk messages. It is encoded LSB first.

After that a series of bulk transfers occurs, with up to 4096 bytes in each transfer, until number of bytes given before is transferred. The first transfer can be (and usually, but not always, is) empty. The first returned data packet has a 780 byte header.

Data header

Last 8 bytes of header are identical to the ones returned by SETUP DSO? (Request = 0x06). Mostly contains zeroes so maybe can be omitted, however it does seem to contain some meaningful bytes, the meaning of which is as of yet unclear.

Address Description
0x200 0x01 when trigger is "Single", 0x03 when Normal.
0x201-? 0x03 when trigger "Normal", number of bytes correlates to number of bulk transfers to return
0x304-0x30B Identical to last 8 bytes of "SETUP DSO?" packet

Unknown control transfer (Request = 0x05)

This control transfer is unknown, but it occurs when stop has been pressed and streaming of big bulk blocks is terminated. All encoding in the control transfers are as described by request 0x04 above. The index field is always zero.

Returns 0x1000 or 0x080000 (the currently selected memory depth). After this request is called, bulk transfers occur the same way they would after request 0x04, except the data header is not present.

SETUP DSO? (Request = 0x06)

After this control transfer a bulk transfer occurs with 780 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:DSO? over TCP/IP.

When called in stop sequence returns an empty bulk transfer at first, after which the bulk transfer is reissued and returns the 780 bytes of data.

SETUP LA? (Request = 0x0c)

After this control transfer a bulk transfers occurs with 260 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:LA? over TCP/IP.

SETUP ALT? (Request = 0x0d)

After this control transfer a bulk transfers occurs with 396 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:ALT? over TCP/IP.

Transfer sequences

Turn-on sequence

  1. *IDN?
  2.  :INFO:FPGA?
  3.  :STOP
  5. SETUP LA?

Turn-off sequence

Nothing special.

Start reading waveform data

2 analogue channels.

  2.  :RUN
  4. SETUP LA?
  7. SETUP DSO? (waiting for something?)
  8. Request waveform data.
  9. The data is started get transferred using bulk transfer.

Stop reading waveform data

2 analogue channels.

  1.  :STOP
  3. Request waveform data, which returns with size 0.
  4. Unknown transfer, which returns with waveform data without data header.
  5. The 8192 byte of data is bulked up.
  6.  :INFO:EUQP?

Command sequences

  1. Command
  3. SETUP LA?

Data blocks

260 bytes block

Address Description
0 Logic analyzer off/on
1 Logic analyzer available
2 Logic analyzer channel 0 off/on
3 Logic analyzer channel 1 off/on
4 Logic analyzer channel 2 off/on
5 Logic analyzer channel 3 off/on
6 Logic analyzer channel 4 off/on
7 Logic analyzer channel 5 off/on
8 Logic analyzer channel 6 off/on
9 Logic analyzer channel 7 off/on
10 Logic analyzer channel 8 off/on
11 Logic analyzer channel 9 off/on
12 Logic analyzer channel 10 off/on
13 Logic analyzer channel 11 off/on
14 Logic analyzer channel 12 off/on
15 Logic analyzer channel 13 off/on
16 Logic analyzer channel 14 off/on
17 Logic analyzer channel 15 off/on

396 bytes block

No information

780 bytes block

Address Description
8 Analogue 1; OFF = 0, ON chan1 = 1, ON chan2 = 2 (bitmask?)\\
12 Analogue 1; OFF = 0, ON = 1
32 Coupling chan1; DC = 0, AC = 1, GND = 2
44 Bandwidth Limit chan1; OFF = 0, ON = 1
46 Invert chan1; OFF = 0, ON = 1
90 Analogue 2; OFF = 0, ON = 1
108 Coupling chan2; DC = 0, AC = 1, GND = 2
120 Bandwidth Limit chan2; OFF = 0, ON = 1
122 Invert chan1; OFF = 0, ON = 1
448 Acquire type; Normal = 0, Average = 1, Peak = 2
456 Acquire average; 2 = 1, 4 = 2, 8 = 3, 16 = 4, 32 = 5, 64 = 6, 128 = 7, 256 = 8
520 Trigger mode; Edge = 0, Pulse = 1, Slope = 2, Video = 3, Alternate = ?, Pattern = 5, Duration = 6

The image information bulk transfer