Based on existing documentation and reverse engineering
This document covers the ASCII command protocol for controlling the function generator. For uploading custom waveforms, see the “Arbitrary Waveform Upload Protocol” section.
The control command line has a fixed communication baud rate of 9600bps. Commands are issued by the PC, analyzed and executed by the machine, and the results are returned to the PC.
Commands: Use only lowercase letters (a to z) and digits (0 to 9).
Terminator: Each command line must end with a line break (Hex: 0x0a).
Max Length: The total command length is a maximum of 15 characters (including the 0x0a terminator).
Error Handling: The device provides no error feedback. Invalid commands or commands with invalid parameters are silently ignored.
cf or cd).Parsing Behavior: The command parser appears to stop reading a parameter as soon as it encounters an invalid character.
bf1a + 0x0a will be interpreted as bf1 + 0x0a, setting the frequency to 0.01Hz, because the a is not a valid number and is ignored.a command (Read Model)Action: Reads the machine model.
PC Sends: a + 0x0a
Machine Returns: The model name (e.g., FY3206S, FY3212S, FY3220S, or FY3224S).
w command: Set WaveformMain Channel: bwx + 0x0a
Deputy Channel: dwx + 0x0a
x: Waveform identifier. Note: The available waveforms and their IDs are different for the Main and Deputy channels.
bwx) Waveform IDs0: Sine
1: Square
2: Pulse
3: Triangle
4: Sawtooth
5: Reverse Sawtooth
6: DC
7: Preset 1 / Lorentz pulse
8: Preset 2 / Multi tone
9: Preset 3 / Periodic Random
10: Preset 4 / ECG
11: Preset 5 / Trapazoidal Pulse
12: Preset 6 / Sinc Pulse
13: Preset 7 / Narrow Pulse
14: Preset 8 / Gaussian white noise
15: Preset 9 / AM
16: Preset 10 / FM
17: Arbitrary 1
18: Arbitrary 2
19: Arbitrary 3
20: Arbitrary 4
dwx) Waveform IDs0: Sine
1: Square
2: Triangle
3: Sawtooth
4 : Reverse Sawtooth
5 : DC
6: Preset 1 / Lorentz pulse
7: Preset 2 / Multi tone
8: Preset 3 / Periodic Random
9: Preset 4 / ECG
10: Preset 5 / Trapazoidal Pulse
11: Preset 6 / Sinc Pulse
12: Preset 7 / Narrow Pulse
13: Preset 8 / Gaussian white noise
14: Preset 9 / AM
15: Preset 10 / FM
16: Arbitrary 1
17: Arbitrary 2
18: Arbitrary 3
19: Arbitrary 4
f command: Set FrequencyMain Channel: bf<freq> + 0x0a
Deputy Channel: df<freq> + 0x0a
<freq>: Frequency value in cHz (0.01Hz).
Note on Format: While reading frequency (cf) returns a fixed 10-digit string, setting frequency (bf, df) accepts a variable-length number.
Examples:
bf10000: Set Main frequency to 10,000 * 0.01Hz = 100Hz.
df0000000050: Set Deputy frequency to 50 * 0.01Hz = 0.5Hz.
bf20000: Set Main frequency to 20,000 * 0.01Hz = 200Hz.
a command: Set AmplitudeMain Channel: baxx.xx + 0x0a
Deputy Channel: daxx.xx + 0x0a
xx.xx: Amplitude value in Volts.
Examples:
ba12.30: Set Main channel amplitude to 12.3V
da08.00: Set Deputy channel amplitude to 8.0V
o command: Set DC OffsetMain Channel: boxxx.xx + 0x0a
Deputy Channel: doxxx.xx + 0x0a
x.xx: Offset value in Volts (can be negative).
Examples:
bo-12.3: Set Main channel offset to -12.3V
do02.1: Set Deputy channel offset to 2.1V
d command: Set Duty CycleMain Channel: bdxxx + 0x0a
Deputy Channel: ddxxx + 0x0a
xxx: Three-digit duty cycle (0.1% resolution).
Examples:
bd668: Set Main duty cycle to 66.8%
dd500: Set Deputy duty cycle to 50.0%
dp command: Set Deputy Wave Phase (Deputy Only)Action: Sets the deputy wave’s phase relative to the main wave.
Format: dpxxx + 0x0a
xxx: Phase offset value in integer degrees.
Example:
dp039: Set phase lag to 39 degrees.bu command: Set Pulse Width (Main Only)Note: This command was specified in the original protocol document, but traces show the OEM PC software does not provide an interface to set this parameter.
Format: buxxxx + YY + 0x0a
xxxx: 4-digit pulse width value.
YY: 2-character unit (ns, us, ms).
Limits: 10nS - 1S
Example:
bu0202us: Set pulse width to 202usbr command: Control Sweep Operationbm1: Logarithmic scan mode. (Confirmed by documentation)bb command: Set Sweep Beginning FrequencyAction: Sets the sweep’s beginning frequency.
Format: bbxxxxxxxxx + 0x0a
xxxxxxxxx: 9-digit frequency value in cHz (0.01Hz).
Examples:
bb100000000: Set sweep start frequency to 1MHz.
bb000123456: Set sweep start frequency to 1.23456kHz.
bb000000001: Set sweep start frequency to 0.01Hz.
be command: Set Sweep End FrequencyAction: Sets the sweep’s end frequency.
Format: bexxxxxxxxx + 0x0a
xxxxxxxxx: 9-digit frequency value in cHz (0.01Hz).
Examples:
be100000000: Set sweep end frequency to 1MHz.
be000123456: Set sweep end frequency to 1.23456kHz.
be000000001: Set sweep end frequency to 0.01Hz.
bt command: Set Sweep TimeFormat: btxx + 0x0a
xx: Two-digit sweep time in seconds (1-99).
Example:
bt51: Set sweep time to 51 seconds.
bt05: Set sweep time to 5 seconds.
This procedure replaces the incorrect method observed in the OEM software traces.
Set Start Frequency: Set the sweep’s start point using the bb command.
bb00010000 (Sets start frequency to 100Hz)Set Stop Frequency: Set the sweep’s stop point using the be command.
be00020000 (Sets stop frequency to 200Hz)Set Sweep Time: Set the duration of the sweep using the bt command.
bt05 (Sets sweep time to 5 seconds)Set Sweep Mode: Select either Linear or Logarithmic mode.
bm0 (Selects Linear mode)
…or bm1 (Selects Logarithmic mode)
Start Sweep: Begin the sweep operation.
br1Stop Sweep: To stop the sweep at any time, send:
br0tn command: Set Trigger CyclesFormat: tnxxxxxxx + 0x0a
xxxxxxx: Number of trigger cycles.
Example:
tn0001000: Set 1000 cycles.tt command: Set Trigger Sourcett0: Trigger Manually.
tt1: Trigger External.
tt2: Trigger Channel 2.
bc command: Clear CounterAction: Clears the internal counter.
PC Sends: bc + 0x0a
ce command: Read Counter FrequencyAction: Reads the current external measurement frequency.
PC Sends: ce + 0x0a
Machine Returns: cexxxxxxxxxx (10-digit frequency in cHz)
Example: ce0000000000
cc command: Read Counter CountAction: Reads the current external count.
PC Sends: cc + 0x0a
Machine Returns: ccxxxxxxxxxx (10-digit count)
Example: cc0000000000
cw command (Unknown)Action: Unknown. This command was observed in traces of the OEM software.
PC Sends: cw + 0x0a
Machine Returns: (Nothing)
bs command: Save SettingsAction: Saves current settings to a register.
Format: bsn + 0x0a or bsnn + 0x0a
n or nn: Register number (0-99). Traces show both single-digit (e.g., bs1) and double-digit (e.g., bs00) formats are accepted.
Example:
bs00: Save settings to register 00.
bs1: Save settings to register 1.
bl command: Load SettingsAction: Loads settings from a register.
Format: bln + 0x0a or blnn + 0x0a
n or nn: Register number (0-99). Traces show both single-digit (e.g., bl2) and double-digit (e.g., bl00) formats are accepted.
Example:
bl00: Load settings from register 00.
bl2: Load settings from register 2.
c command (Read Settings)cf command: Read Main Channel FrequencyPC Sends: cf + 0x0a
Machine Returns: cfxxxxxxxxxx (10-digit frequency in cHz)
Example: cf0000000050 (returns 0.5Hz)
cd command: Read Main Channel Duty CyclePC Sends: cd + 0x0a
Machine Returns: cdxxx (3-digit duty cycle, 0.1% resolution)
Example: cd500 (returns 50.0%)
ct command: Read Sweep TimePC Sends: ct + 0x0a
Machine Returns: ctxx (2-digit sweep time in seconds)
Example: ct10 (returns 10 seconds)
This is a separate, binary protocol used for uploading custom waveform data.
Initialize Upload:
PC Sends: DDS_WAVE\0xa5
Machine Responds: 'X' (Hex 0x58)
Erase Memory Slot:
PC Sends: DDS_WAVE\0xfn (where n is the memory slot, e.g., \0xf1 for memory 1)
Machine Responds: 'SE'
Upload Data:
PC Sends: DDS_WAVE\0x0n (where n is the memory slot, e.g., \0x03 for memory 3)
Machine Responds: 'W'
After ‘W’ is received:
PC sends 4096 bytes of data, which represents 2048 16-bit samples.
Each 16-bit sample is sent Low Byte first, then High Byte. (e.g., for the 16-bit value 0x07FF, send the byte 0xFF first, then the byte 0x07).
CRITICAL (Flow Control): The device will respond with a single ‘X’ character (Hex 0x58) for each byte of waveform data it successfully receives (for a total of 4096 ‘X’s).
The PC must not send data faster than the device can process it. While traces show the OEM software sending data in large bursts (e.g., 50-100 bytes) and receiving a burst of ‘X’s in response, the safest implementation is to send a small number of bytes (or even one at a time) and wait to receive the corresponding ‘X’ responses before sending more.