Rigol VS5000 series

Rigol VS5000 series

The Rigol VS5000 series are 2 channel, 20-200Mhz USB/Ethernet oscilloscopes. Some models also include a 16 channel logic analyzer.

The device is discontinued by Rigol, but you can find the basic specs e.g. here.

Models

Model	Analog Bandwith	Logic Analyzer	Time Base Range
VS5022	25 MHz		20ns/div – 50s/div
VS5022D		●
VS5042	40 MHz		10ns/div – 50s/div
VS5042D		●
VS5062	60 MHz		5ns/div – 50s/div
VS5062D		●
VS5102	100 MHz		2ns/div – 50s/div
VS5102D		●
VS5202	200 MHz
VS5202D		●

Hardware

CPU

• Analog Devices ADSP-BF531 Blackfin CPU
• Hynix HY57V281620FTP 16MB DRAM
• Spansion S29GL032A 4MB flash

Analog acquisition

• Altera Cyclone EP1C6 6000-gate FPGA
• Altera EPCS 128Kb flash memory
• ISSI IS61LPS25636A 1MB SRAM

Logic acquisition

• Altera Cyclone II EP2C5 4600-gate FPGA
• Altera EPCS 128Kb flash memory
• ISSI IS61LPS25636A 1MB SRAM

Ethernet interface

• Davicom DM9000EP 10/100 ethernet controller
• 25MHz oscillator

USB interface

• PLX NetChip NET2272 USB 2.0 controller
• 130MHz oscillator

TCP Protocol

The device listens on TCP port 19, and implements an SCPI based protocol compatible with that of the Rigol DS1000 series. Responses received from the device are prefixed with a 32-bit, little-endian length field. The transport is implemented in hardware/common/scpi_tcp.c, and the protocol by the rigol-ds driver.

USB Protocol

Work in progress.

The Rigol communication protocol only uses the USB control and bulk transfer. Control is for sending setup and request smaller amounts of data. Bulk transfers is returned by the Rigol box with setup and image data.

All control transfers interesting for us has request type set to 0xc0. The request field in the control packets is what tells us which command is actually sent.

All descriptions below should have both request type and request set to proper values, obvious from the headlines what it should be.

Packet types

This information is completely reverse engineered by hand.

Read answer (request = 0x00)

Commands ending with a question mark ('?' ASCII 0x3f) returns answer in two control transfers.

First control transfer is to query the size of the data to be returned. That is done by value set to 0. One byte of data is returned in the data field by this operation which is the size of the string the Rigol box wants to return.

Second control transfer has value set to 1. The buffer, allocated to the size just read, is also sent along the command to be filled with the data. The returned data is an ASCII string.

Write command (request = 0x01)

Commands from the PC program to the Rigol box is sent as text strings. Which commands that are available are listed in the Programming Guide from Rigol.

Each character is sent in a control message with the value set to the ASCII character to be sent. Each ASCII string is terminated with a carriage return (0x0d, '\r'), which terminates the transmission.

Request waveform data (Request = 0x04)

When waveform data is requested to be retrieved a control message is sent. The index field of the setup data is a bitmask on which channels to be requested. It is encoded as bit 0 meaning Channel 1, bit 1 meaning Channel 2, bit 2 meaning Logic Channel 0, bit 3 meaning Logic Channel 1 etc.

The 4 byte data field of the control packet sent back as an ack contains number of bytes to be returned by bulk messages. It is encoded LSB first.

After that a series of bulk transfers occurs, with up to 4096 bytes in each transfer, until number of bytes given before is transferred. The first transfer can be (and usually, but not always, is) empty. The first returned data packet has a 780 byte header.

Data header

Last 8 bytes of header are identical to the ones returned by SETUP DSO? (Request = 0x06). Mostly contains zeroes so maybe can be omitted, however it does seem to contain some meaningful bytes, the meaning of which is as of yet unclear.

Address	Description
0x200	0x01 when trigger is "Single", 0x03 when Normal.
0x201-?	0x03 when trigger "Normal", number of bytes correlates to number of bulk transfers to return
0x304-0x30B	Identical to last 8 bytes of "SETUP DSO?" packet

Unknown control transfer (Request = 0x05)

This control transfer is unknown, but it occurs when stop has been pressed and streaming of big bulk blocks is terminated. All encoding in the control transfers are as described by request 0x04 above. The index field is always zero.

Returns 0x1000 or 0x080000 (the currently selected memory depth). After this request is called, bulk transfers occur the same way they would after request 0x04, except the data header is not present.

SETUP DSO? (Request = 0x06)

After this control transfer a bulk transfer occurs with 780 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:DSO? over TCP/IP.

When called in stop sequence returns an empty bulk transfer at first, after which the bulk transfer is reissued and returns the 780 bytes of data.

SETUP LA? (Request = 0x0c)

After this control transfer a bulk transfers occurs with 260 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:LA? over TCP/IP.

SETUP ALT? (Request = 0x0d)

After this control transfer a bulk transfers occurs with 396 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:ALT? over TCP/IP.

Transfer sequences

Turn-on sequence

1. *IDN?
2. :INFO:FPGA?
3. :STOP
4. SETUP DSO?
5. SETUP LA?
6. SETUP ALT?

Turn-off sequence

Nothing special.

Start reading waveform data

2 analogue channels.

1. :CLEARUSB
2. :RUN
3. SETUP DSO?
4. SETUP LA?
5. SETUP ALT?
6. SETUP DSO?
7. SETUP DSO? (waiting for something?)
8. Request waveform data.
9. The data is started get transferred using bulk transfer.

Stop reading waveform data

2 analogue channels.

1. :STOP
2. :CLEARUSB
3. Request waveform data, which returns with size 0.
4. Unknown transfer, which returns with waveform data without data header.
5. The 8192 byte of data is bulked up.
6. :INFO:EUQP?
7. SETUP DSO?

Command sequences

1. Command
2. SETUP DSO?
3. SETUP LA?
4. SETUP ALT?

Data blocks

260 bytes block

Address	Description
0	Logic analyzer off/on
1	Logic analyzer available
2	Logic analyzer channel 0 off/on
3	Logic analyzer channel 1 off/on
4	Logic analyzer channel 2 off/on
5	Logic analyzer channel 3 off/on
6	Logic analyzer channel 4 off/on
7	Logic analyzer channel 5 off/on
8	Logic analyzer channel 6 off/on
9	Logic analyzer channel 7 off/on
10	Logic analyzer channel 8 off/on
11	Logic analyzer channel 9 off/on
12	Logic analyzer channel 10 off/on
13	Logic analyzer channel 11 off/on
14	Logic analyzer channel 12 off/on
15	Logic analyzer channel 13 off/on
16	Logic analyzer channel 14 off/on
17	Logic analyzer channel 15 off/on

396 bytes block

No information

780 bytes block

Address	Description
8	Analogue 1; OFF = 0, ON chan1 = 1, ON chan2 = 2 (bitmask?)\\
12	Analogue 1; OFF = 0, ON = 1
32	Coupling chan1; DC = 0, AC = 1, GND = 2
44	Bandwidth Limit chan1; OFF = 0, ON = 1
46	Invert chan1; OFF = 0, ON = 1
90	Analogue 2; OFF = 0, ON = 1
108	Coupling chan2; DC = 0, AC = 1, GND = 2
120	Bandwidth Limit chan2; OFF = 0, ON = 1
122	Invert chan1; OFF = 0, ON = 1
448	Acquire type; Normal = 0, Average = 1, Peak = 2
456	Acquire average; 2 = 1, 4 = 2, 8 = 3, 16 = 4, 32 = 5, 64 = 6, 128 = 7, 256 = 8
520	Trigger mode; Edge = 0, Pulse = 1, Slope = 2, Video = 3, Alternate = ?, Pattern = 5, Duration = 6