FUJI Digitial Camera Serial Interface information

I spent a couple of days trying to figure out how the serial interface worked and I thought I'd publish the result of that effort here. I did not start from scratch, but collected what I could from two other homepages (see references) and then added some of my own. I developed this with the MX-700, but it should also work with an MX-500. Apparently the DX-7 also has a subset of these commands.

General description

As with most means of communication, the communication is carried out at a number of levels, each level providing the transport for the next higher level. For theses cameras I have identified the levels as such (my names):

Serial port

The serial port should be set to

Higher speeds may be used, however the camera defaults to 9600 each time it is switched on or the control switch is set onto PC mode. Thus normally you would establish contact at 9600 and then increas the speed - exactly how this is done is described further on.

I don't know whether XON/XOFF should be used, however I seemed to notice no difference in operation with or without it.

Low level Transmission Protocol

The FUJI MX serial interface uses a standard ISO protocol (but I don't know its name) for the low level data link protocol. This works as follows:

Sequence of events

  1. Communication is started by sending an ENQ by any one side of the link (Enquiry = 0x05)
  2. An ACK (Acknowledge 0x06) should be received to confirm the link is in operation
    1. Send DLE-STX (Start of text = 0x10 0x02) to indicate the beginning of a message
    2. The first packet of data pertaining to this message is transmitted upto a maximum of 512 bytes (see paragraph below about 0x10 characters contained in the data).
    3. If the message length exceeds 512 bytes, intervening packets are sent as follows
      1. Send a DLE-ETB (end transmission block = 0x10 0x17) to indicate the end of the packet currently being sent - however this indicates that more packets relating to this message will be sent
      2. Send a Block Check Character (this is described below)
      3. An ACK (Acknowledge 0x06) should be received from the camera, meaning that the data was received correctly at the other end
      4. Send DLE-STX (Start of text = 0x10 0x02) to indicate the start of another block of data (continuation of the message)
      5. Transmit the next block of data upto a maximum of 512 bytes (remember to take care of 0x10s)
      6. If still more data needs to be transmitted, repeat process from sending of the DLE-ETB until all the data has been sent.
    4. A DLE-ETX (end of text = 0x10 0x03) is sent
    5. A Block Check Character is sent (this is a sort of checksum)
    6. An ACK (Acknowledge 0x06) should be received, meaning that the data was received correctly at the other end
    7. Any further messages to be sent repeat procedure from sending of the DLE-STX
  3. When all communication is ready (for example before quitting the program) an EOT (end of text = 0x04) is sent

Character 0x10 contained in data

The character 0x10 is known as DLE (data link escape). Its function is to indicate that the following character is a control character rather than data. A problem would thus arise if we want to send a data byte with the value of 0x10 since this would be interpreted as a DLE and the following character would be interpreted as a control character.

In order to avoid this problem, any character 0x10 which needs to be transmitted by data is preceeded by another 0x10 character. Thus if for example we want to send in the data:

07 08 09 10 11 12 13 we would change this into:

07 08 09 10 10 11 12 13 Note the extra 0x10 shown in bold.

It is important that when considering lengths of transmitted packets you do not count the extra 0x10s inserted. for example the above packet should be counted as 7 bytes of actual data, not 8. Thus for example the maximum packet length of 512 bytes does not include the extra 0x10 characters in the count. The same also applies for checksums, where only the 'real' 0x10 is counted.

The BCC - Block Check Character

The block check character is a form of checksum. It is calculated simply as the XOR of all the transmitted data.

In calculating the BCC, the following must be ignored (skipped)

Thus to summarize, the BCC takes into account the actual data and the ETX or ETB character that marks the end of the packet.

The value of BCC is initialised to zero after each STX. Thus each BCC covers the data in one single packet.

Specific command protocol for the camera

The camera sends and receives packets encapsulated in the protocol described above. This part describes the contents of those packets sent.

Thus at this stage we shall not concern ourselves with checksums STX and such things as these have been described above in the low level protocol. However some examples will be given showing the actual bytes going over the serial link, and identifying the protocol level.

General format

First of all the host (i.e. the computer) always originates the commands, and the camera gives responses. That is: the computer gives the orders and the camera obeys and replies.

Each message has the following format:

The camera should reply to each command by sending a response message as soon as the command has executed. (Note however that the low level protocol should check that an ACK is received immediately. If an ACK is not received within a second or two, the low level protocol should signal trouble).

When a command (or response) must contain more that 512 bytes of data, since the low level protocol can only handle packets of 512 bytes, the data to be transmitted must be split into several 512 byte chunks. Note that the four byte header containing the command (or response) and the data length indicator must be repeated at the beginning of each packet related to that message. Thus for example when uploading a picture, the first two bytes of each packet sent must contain the command type, while the next two bytes must contain the data length of that particular packet not the size of the full data to be transmitted.

The same occurs when receiving data from the camera - that is, the camera puts the four byte response at the beginning of each packet it sends, the length indicator indicating the packet length and not the full message length.

Not all commands take the same time to execute. In particular the shoot and charge flash commands. Thus allowance must be made for them when waiting for a response.

Data formats

The following types of data are used in the messages transferred: Note that the only times when multiple packets per message are required is for the transfer of images and previews. All other messages contain much less than 512 bytes and can thus be transmitted in a single packet. You may be better off writing separate functions for the handling of image data and short commands.

Specific command details

The following table lists all the available commands for the MX-700. The command and response columns show the bytes to be transmitted and received. This does not include the control characters substitution of DLEs and other things that are done by the low level protocol.

You will notice that the information is incomplete for some commands. I am trying to find out more about them - if you know the missing info please let me know so I don't waste time re-inventing the wheel.

Some of the command meanings have links to a more detailed explanation.
Command Parameter Meaning Response Data
00 00 02 00 xx xx (int) Frame no <\td> Download thumbnail 00 01 00 02 xx xx xx-xx Packet of thumbnail data -variable length 1-512
00 02 02 00 xx xx (int) Frame no <\td> Download Picture 00 03 nn nn xx-xx Packet of picture data -variable length 1-512
01 07 01 00 xx (byte) Speed <\td> Change serial port speed 00 08 01 00 xx (byte)Result, 0=ok
00 09 00 00 none <\td> What is software version 00 05 nn 00 xx-xx Software version in ascii - variable length
00 0A 02 00 xx xx (int) Frame no <\td> What is picture name of frame# 00 04 nn 00 xx-xx Filename of the frame in ascii
00 0B 00 00 none <\td> How many pictures in camera 00 06 02 00 xx xx (int)No of pictures in camera
00 0C 00 00 none <\td> No operation ? 00 0d 01 00 xx (byte) Unknown
00 0E nn nn xx-xx picture data packet- variable length 1-512<\td> Upload Picture None ? -
00 0F nn 00 xx-xx String - variable<\td> Set name for upload 00 10 01 00 xx (byte) response
00 11 00 00 ?? <\td> Unknown 00 12 01 00 xx (byte) Unknown
00 13 01 00 xx ?? <\td> Unknown 00 14 01 00 xx (byte) Unknown
00 15 00 00 none <\td> What is name of last picture shot 00 16 nn 00 xx-xx Name in ascii - variable length
00 17 02 00 xx xx (int) Frame no <\td> What is filesize of image # 00 18 04 00 xx xx xx xx (long) size of image in bytes
00 19 02 00 xx xx (int) Frame no <\td> Delete image # 00 1a 01 00 xx (byte) Result 0=ok
00 1B 00 00 none <\td> What is card status and space available 00 1c 05 00 xx xx xx xx yy (long)xx=space in bytes, (byte) yy=card status
00 20 00 00 none <\td> Unknown 00 21 02 00 xx xx ?
00 22 02 00 xx xx ?? <\td> Unknown 00 23 01 00 xx (byte)Unknown
00 27 00 00 none <\td> Shoot a picture 00 28 04 00 xx xx yy yy (int) xx= frame number where image is stored, (int)yy - unknown meaning
00 29 00 00 none <\td> What is camera type 00 25 nn 00 xx-xx Ascii string variable length
00 2A 02 00 xx xx (int) dir no <\td> (?)What is name of directory no # 00 24 nn 00 xx-xx name in ascii
00 2B ?? ?? ?--? ?? <\td> Unknown 00 26 02 00 xx xx Unknown
00 30 00 00 none <\td> What mode is flash set 00 31 01 00 xx (byte) xx=flash mode
00 32 01 00 xx (byte) Flash mode<\td> Set flash mode 00 33 01 00 xx (byte) result 0=ok
00 34 02 00 xx xx (int) intensity(?)<\td> Charge flash 00 ??????? ?
00 4C 00 00 none <\td> What commands are supported 00 4d nn 00 xx-xx list of supported commands (one byte for each command)
00 51 01 00 xx (byte) command? <\td> (?) Get command information 00 52 02 00 xx xx 2 bytes or int - unknown meaning
00 62 00 00 none <\td> Download preview 00 63 nn nn xx-xx Packet of preview image data
00 64 00 00 none <\td> Shoot Preview 00 65 02 00 xx xx Unknown
00 80 00 00 none <\td> What is camera ID 00 81 nn 00 xx-xx Ascii string
00 82 nn 00 xx-xx sString - variable<\td> Set camera ID 00 83 01 00 xx (?) result 0=ok
00 84 00 00 none <\td> What is date 00 85 0e 00 xx-xx Date in ascii YYYY MM DD HH MM SS
00 86 0E 00 xx-xx (14 bytes) date in ascii YYYY MM DD HH MM SS<\td> Set date (and time) 00 87 01 00 xx (?) (byte) result 0=ok
00 C0 02 00 xx xx Unknown<\td> (?) Send image information 00 c1 01 00 xx Unknown


Here I give some examples of the actual bytes that are transferred between the computer and the camera. This will help to illustrate some of the concepts which may not be too clear in the above text.

Example 1 setting the flash mode to auto

Example 2 Downloading a picture


Many thanks to Thierry Bousch and Mamoru Ohno from whose pages I found invaluable help in preparing this document.

Page last updated on 6th June 1999

Back to front page,