Rigol VS5202D

Rigol VS5000 series

The Rigol VS5202D is a 2 channel analog and 16 channel digital, 200 MHz, USB-based oscilloscope/logic analyzer.

The device is discontinued by Rigol, but you can find the basic specs e.g. here. Maybe some more info by comparing with the DS1000 programming manual.

See Rigol VS5202D/Info for some more details (such as lsusb -vvv output) on the device.

Hardware

CPU

• Analog Devices ADSP-BF531 Blackfin CPU
• Hynix HY57V281620FTP 16MB DRAM
• Spansion S29GL032A 4MB flash

Analog acquisition

• Altera Cyclone EP1C6 6000-gate FPGA
• Altera EPCS 128Kb flash memory
• ISSI IS61LPS25636A 1MB SRAM

Logic acquisition

• Altera Cyclone II EP2C5 4600-gate FPGA
• Altera EPCS 128Kb flash memory
• ISSI IS61LPS25636A 1MB SRAM

Ethernet interface

• Davicom DM9000EP 10/100 ethernet controller
• 25MHz oscillator

USB interface

• PLX NetChip NET2272 USB 2.0 controller
• 130MHz oscillator

Photos

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Protocol

Work in progress.

The Rigol communication protocol only uses the USB control and bulk transfer. Control is for sending setup and request smaller amounts of data. Bulk transfers is returned by the Rigol box with setup and image data.

All control transfers interesting for us has request type set to 0xc0. The request field in the control packets is what tells us which command is actually sent.

All descriptions below should have both request type and request set to proper values, obvious from the headlines what it should be.

Packet types

This information is completely reverse engineered by hand.

Read answer (request = 0x00)

Commands ending with a question mark ('?' ASCII 0x3f) returns answer in two control transfers.

First control transfer is to query the size of the data to be returned. That is done by value set to 0. One byte of data is returned in the data field by this operation which is the size of the string the Rigol box wants to return.

Second control transfer has value set to 1. The buffer, allocated to the size just read, is also sent along the command to be filled with the data. The returned data is an ASCII string.

Write command (request = 0x01)

Commands from the PC program to the Rigol box is sent as text strings. Which commands that are available are listed in the Programming Guide from Rigol.

Each character is sent in a control message with the value set to the ASCII character to be sent. Each ASCII string is terminated with a carriage return (0x0d, '\r'), which terminates the transmission.

Request waveform data (Request = 0x04)

When waveform data is requested to be retrieved a control message is sent. The index field of the setup data is a bitmask on which channels to be requested. It is encoded as bit 0 meaning Channel 1, bit 1 meaning Channel 2, bit 2 meaning Logic Channel 0, bit 3 meaning Logic Channel 1 etc.

The 4 byte data field of the control packet sent back as an ack contains number of bytes to be returned by bulk messages. It is encoded LSB first.

After that a series of bulk transfers occurs, with up to 4096 bytes in each transfer, until number of bytes given before is transferred. The first transfer can be (and usually, but not always, is) empty. The first returned data packet has a 780 byte header.

Data header

Last 8 bytes of header are identical to the ones returned by SETUP DSO? (Request = 0x06). Mostly contains zeroes so maybe can be omitted, however it does seem to contain some meaningful bytes, the meaning of which is as of yet unclear.

Unknown control packet (Request = 0x05)

This control transfer is unknown, but it occurs when stop ha been pressed and streaming of big bulk blocks is terminated. All encoding in the control transfers are as described by request 0x04 above. The index field is always zero. Seems like some kind of 'flush buffers' command.

SETUP DSO? (Request = 0x06)

After this control transfer a bulk transfer occurs with 780 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:DSO? over TCP/IP.

When called in stop sequence returns an empty bulk transfer at first, after which the bulk transfer is reissued and returns the 780 bytes of data.

SETUP LA? (Request = 0x0c)

After this control transfer a bulk transfers occurs with 260 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:LA? over TCP/IP.

SETUP ALT? (Request = 0x0d)

After this control transfer a bulk transfers occurs with 396 bytes of data. What each byte means is still to be determined, but will occur in a separate description. Same data is returned in response to undocumented instruction :SETUP:ALT? over TCP/IP.

Transfer sequences

Turn-on sequence

1. *IDN?
2. :INFO:FPGA?
3. :STOP
4. SETUP DSO?
5. SETUP LA?
6. SETUP ALT?

Turn-off sequence

Nothing special.

Start reading waveform data

2 analogue channels.

1. :CLEARUSB
2. :RUN
3. SETUP DSO?
4. SETUP LA?
5. SETUP ALT?
6. SETUP DSO?
7. SETUP DSO? (waiting for something?)
8. Request waveform data.
9. The data is started get transferred using bulk transfer.

Stop reading waveform data

2 analogue channels.

1. :STOP
2. :CLEARUSB
3. Request waveform data, which returns with size 0.
4. Unknown transfer, which returns with 8192 bytes of data.
5. The 8192 byte of data is bulked up.
6. :INFO:EUQP?
7. SETUP DSO?

Command sequences

1. Command
2. SETUP DSO?
3. SETUP LA?
4. SETUP ALT?

Data blocks

260 bytes block

Address	Description
0	Logic analyzer off/on
1	Logic analyzer available
2	Logic analyzer channel 0 off/on
3	Logic analyzer channel 1 off/on
4	Logic analyzer channel 2 off/on
5	Logic analyzer channel 3 off/on
6	Logic analyzer channel 4 off/on
7	Logic analyzer channel 5 off/on
8	Logic analyzer channel 6 off/on
9	Logic analyzer channel 7 off/on
10	Logic analyzer channel 8 off/on
11	Logic analyzer channel 9 off/on
12	Logic analyzer channel 10 off/on
13	Logic analyzer channel 11 off/on
14	Logic analyzer channel 12 off/on
15	Logic analyzer channel 13 off/on
16	Logic analyzer channel 14 off/on
17	Logic analyzer channel 15 off/on

396 bytes block

No information

780 bytes block

Address	Description
8	Analogue 1; OFF = 0, ON chan1 = 1, ON chan2 = 2 (bitmask?)\\
12	Analogue 1; OFF = 0, ON = 1
32	Coupling chan1; DC = 0, AC = 1, GND = 2
44	Bandwidth Limit chan1; OFF = 0, ON = 1
46	Invert chan1; OFF = 0, ON = 1
90	Analogue 2; OFF = 0, ON = 1
108	Coupling chan2; DC = 0, AC = 1, GND = 2
120	Bandwidth Limit chan2; OFF = 0, ON = 1
122	Invert chan1; OFF = 0, ON = 1
448	Acquire type; Normal = 0, Average = 1, Peak = 2
456	Acquire average; 2 = 1, 4 = 2, 8 = 3, 16 = 4, 32 = 5, 64 = 6, 128 = 7, 256 = 8
520	Trigger mode; Edge = 0, Pulse = 1, Slope = 2, Video = 3, Alternate = ?, Pattern = 5, Duration = 6