GPRS Communication Protocol

Between GPS Tracker and Server

version V3.2
Update by 2022-06-20

Version Change Record Date

V1.00 Build file 2008-8-21 by George

V1.01 Add parking overtime with time 2008-10-23By George

V1.10 Add DEF alarm bit in alarm info 2008-12-16By George

Change fatigue drive alarm mode, add clear value for illegal ignition 2009-3-16By George
V1.20
alarm , add penetrate transmit data for serial 2-7

V1.28 Add ACC status in 0x82 packet 2009-4-30By JGShi

V1.41 Add remote update result upload A5 command. 2009-7-21By George

V2.00 Format change and add protocol for new functions in 108 2012.5-15By liven

V2.01 Add 8E data description 2012.12-19By Liven

Add command 0x71, 0xA3, 0xD3,0xD4,0xD9,0xDA, 2013.06-15By Wayne

V2.02
0xDB, 0xDC, Appendix1 Position Data.

Add command 0xDD, 0xDE, 0xDF, 0xE0, 0xE1, update Appendix 3 2015.06-10 By Lisa
V2.1
peripheral data.

Update Appendix 3, add sub-command 0x0B used for bar code; add 2015.09-15 By Lisa
V2.2
sub-command 0x10 used for main voltage.

V2.3 Update 0x82 package 2016.01.21 By Lisa

.... ...... ........

V2.54 Add OBDII data to 0xA3 2017-12-15

V2.55 Update OBDII data 2017-12-27

Update A3 blind area data to 8E

Add low speed alarm 2018-03-30

Update RFID status to 0xA3(sub-cmd 0x16)

Content
I Command Format ......................................................................................... 3
III Command Details ....................................................................................... 4
1. Login – 0xB1 ..................................................................................................... 4
2. Login/Server Confirmation – 0x21 ....................................................................... 4
3. Query date and time from server – 0xB3(customized) ........................................... 4
4. Server Confirmation date and time– 0x23 ............................................................ 5
5. One time track on demand – 0x30 ...................................................................... 5
6. One time track on demand reply – 0x81 .............................................................. 5
7. Position Data Upload (by Interval, distance) – 0x80 .............................................. 5
8. Blind Area Data re-Upload – 0x8E ....................................................................... 6
9. Cancel Geo-Fencing – 0x47 ................................................................................ 6
10. Inquiry Geo Fencing – 0x48 .............................................................................. 6
11. Set Geo-Fencing – 0x49.................................................................................... 6
12. Send Dispatch Info – 0x3A................................................................................ 8
13. Alarm Info – 0x82 ............................................................................................ 8
14. Alarm OFF – 0x83 ............................................................................................ 9
15. Cancel Alarm – 0x37 ........................................................................................ 9
16. Set Reply – 0x85............................................................................................ 10
17. Device Reply for Query Parameters– 0x84 ........................................................ 10
18. Camera Related Command – 0x28/0x65/0x26/0xAB .......................................... 10
19. Peripheral data info upload –0xA3 ................................................................... 10
20. Device fuel steal percent set – 0xDD(108/T20) ................................................. 11
21. Device low fuel value set – 0xDE(108/T20) ...................................................... 11
22. Add RFID card No. To device– 0xDF(T20) ........................................................ 12
23. Delete RFID card No. From device– 0xE0(T20) ................................................. 12
24. Clean all RFID card No. From device– 0xE1(T20) .............................................. 12
25. Query RFID card No. From device– 0xE2(T20) ................................................. 13
Appendix 1 Position Data ................................................................................13
Appendix 2 Alarm Data ...................................................................................17
Appendix 3 peripheral data .............................................................................18
26. Bluetooth Alarm Info – 0x86 ........................................................................... 29
Appendix 4 Bluetooth Alarm Data....................................................................30

2
I Command Format
Commands format of GPRS Packets are defined as following:

From Server to Device:

))<Command(1byte)><L(2 bytes)><ID(4bytes)><Parameter(s)><Checksum>\r

From Device to Server:

))<Command(1byte)><L(2 bytes)><ID(4bytes)><data><Checksum>\r

Note:
1. Do not input ‘<’ and ‘>’ in the command content.
2. All Muti-byte data complies with the following sequence: High byte prior to the
low byte (Big Endian).
3. The size of one location data packet is about 50 bytes.
Item Specification
)) 2bytes. It is header for all correct packets. ‘))’ is ASCII code, in
hex code it is 0x29 0x29.
Command 1 byte. It is in hex code, every packet have one and only
command word. For detail, please refer to Part II Command
List
L 2 bytes. It means the length from Length byte (not include
length byte) to packet end, include the end byte. It is in hex
code.
ID 4bytes. It is in hex code. Every device has one and only ID, It is
calculate from the device SN.
For example: Suppose the device SN is: 29800298
Divide into 4 parts: 29 80 02 98
Convert to hex: 1D 50 02 62
Add 0x80 to 2nd,3rd part: 1D D0 82 62
Then you get the device ID: 1DD08262
Parameter/data Minimum 0 byte, maximum 200byte, see appendix 1 for data
description.
Checksum 1 bytes, it is xor checksum, for example:
if the packet is: 29 29 B1 00 07 0A 9F 95 38 0C 82 0D
0x82= 29 xor 29 xor B1 xor 00 xor 07 xor 0A xor 9F xor 95 xor
38 xor 0C
\r 1 bytes, it is end byte of package, in hex it is 0D

3
III Command Details
1. Login – 0xB1
Command: ))<0xB1><L><ID><reserved><Checksum><\r>
After your device installed properly, device will send this packet
to server for login. It will send every 30s, like heart beat.It must
be reply, If server does not give reply (see
Description:
Loginconfirmation), device will keep send this packet
without any other packet; after get reply, other commands start
work.
Example: 29 29 B100 07 0A 9F 95 38 0C 82 0D
In example, the ID is 0A9F9538, change to device SN, it is
Note: 10312156. In <content> part 0x0C, we keep it as future use;
do not have certain meaning now.

2. Login/Server Confirmation – 0x21

))<0x21><L><receive package check sum><receive
Command:
package command><reserved><Checksum><\r>
This command is send from server to device, to confirm some
Description:
information, like login, some important alarm, and so on.
Example: 29 29 2100 05 82 B1 0C1B 0D
The example is the confirmation for packet 29 29 B1 00 07 0A
9F 95 38 0C 82 0D,<receive package check sum> is 0x82,
<receive package command> is 0xB1,<receive package
sub-command(first byte of the content)> part is 0x0C.
Example 2(if device need server to give 0x21 ack):
Note:
29 29 82 00 23 0C 80 80 32 14 10 24 15 10 58 02 23 57 72
11 35 28 35 00 00 00 00 FB 00 00 00 01 00 00 00 00 00 00 25
0D
The reply should be:
29 29 21 00 05 258214 97 0D.

3. Query date and time from server – 0xB3(customized)

Command: ))<0xB3><L><ID><reserved><Checksum><\r>
After first time power on, device will send this packet to server
Description:
for query date and time.
Example: 29 29 B300 07 0A 9F 95 38 0C 80 0D
In example, the ID is 0A9F9538, change to device SN, it is
Note: 10312156. In <content> part 0x0C, we keep it as future use;
do not have certain meaning now.

4
4. Server Confirmation date and time– 0x23
Command: ))<0x23><L><date and time><Checksum><\r>
This command is send from server to device, to confirm the
Description:
date and time.
Example: 29 29 2300 0817 07 08 13 25 30 35 0D
Date range:Year,2000-2099; Month 1-12; Day, 1-31;
Time range: Hour, 00-23; Min, 00-59; Second, 00-59.
Note:
Hour/min/second use compressed BCD code
For example: 17 07 08 13 25 30 means 2017-07-08 13:25:30

5. One time track on demand – 0x30

Command: ))<0x30><L><ID><Checksum><\r>
This command will get current location data when you send,
Description: and device only upload location data once. About the device
reply, See Reply.
Example: 29 29 30 00 060A 9F 95 380E 0D
This command used when you want track manually, you can
Note:
send this command from software platform to device.

6. One time track on demand reply – 0x81

Command: ))<0x81><L><ID><Position data><Checksum><\r>
Reply packet for track on demand command; send current
position, speed, and status data to server. From device to server.
Description:
About <Position data> description , please see Appendix 1
Positon data
29298100280A9F95380812281601310223943011403725000003
Example:
30FF0000007FFC0F00001E000000000034290D
Note: The data between <ID> and <Checksum> is Position data.

7. Position Data Upload (by Interval, distance) – 0x80

Command: ))<0x80><L><ID><data><Checksum><\r>
This packet is send from device to server, send by interval set
to device. In default, our device will send this packet every 30s
Description:
after login. About the <data> description, please see
Appendix 1Positon data.
29 29 8000 280A 81 85 0A 12 03 10 09 57 50 00 52 81 37 00
Example: 61 19 08 00 00 02 32 F8 48 FF BB FF FF 00 00 00 1E 00 00 00
00 00 00 ED 0D
Note: The data between <ID> and <Checksum> is Position data.

5
8. Blind Area Data re-Upload – 0x8E
Command: ))<0x8E><L><ID><data><Checksum><\r>
This packet is for blind area data resend to server, both works
for 0x80 and 0xA3 packages,About the <data> description,
Description:
please see Appendix 1 Positon data and Appendix 3
peripheral data.
Blind data for 0x80:
29 29 8E00 280F 80 81 5A 12 12 18 20 31 16 02 23 18 46 11
40 22 70 00 72 02 62 FB 00 07 7C 7F BF 56 00 00 1E 3C 32 00
00 00 00 85 0D
Example:
Blind data for 0xA3:
29298E002D1580831F1802280722230223557611352270000
00072FB0000007FFF590000000000000000000005200164FA0
D
Note: The data between <ID> and <Checksum> is Position data.

9. Cancel Geo-Fencing – 0x47

Command: ))<0x47><L><ID><Checksum><\r>
This command sends from server to device. It will delete all the
Description:
Geo-Fences set in device.
Example: 29 29 4700 060A 9F 95 3879 0D
Note: Device sendsSet Reply to server after this command.

10. Inquiry Geo Fencing – 0x48

Command: ))<0x48><L><ID><Checksum><\r>
This command sends from server to device. Device will reply
Description:
Geo-Fences set in device.
Example: 29 29 4800 060A 9F 95 3876 0D
Note: Device reply 0x9A packet.

11. Set Geo-Fencing – 0x49

Command: ))<0x49><L><ID><Parameter><Checksum><\r>
This command will set Geo-Fences to device. Device checks if
Description: Geo-Fence alarm triggered. Device give Set Reply to this
command.
29 29 49 00 84 0b 8b 8b 0b05 02 23 55 50 11 35 28 92 02
23 56 05 11 35 30 17 01 80 00 00 00 00 00 00 00 02 23
Example:
55 55 11 35 30 86 02 23 56 03 11 35 32 75 02 80 00 00
00 00 00 00 00 02 23 54 02 11 35 29 10 02 23 54 94 11

6
 35 31 26 03 80 00 00 00 00 00 00 00 02 23 52 56 11 35
32 10 02 23 54 24 11 35 34 80 04 80 00 00 00 00 00 00
00 02 23 52 28 11 35 28 18 02 23 53 34 11 35 30 18 05
80 00 00 00 00 00 00 00 79 0d
In example, it have set 5 Geo-fences, the meaning of the
parameters shows below:
05 //Geo-fences quantities, in this example have 5 Areas.
02 23 55 50//1st Geo-Fence. Latitude for upper left corner
It is 22°33.995′
11 35 28 92//1st Geo-Fence. Longitude for upper left corner
It is 113°58.869′
02 23 56 05//1st Geo-Fence. Latitude for lower right corner
It is 22°32.123′
11 35 30 86//1st Geo-Fence. Longitude for lower right corner
It is 114°1.584′
01//Geo-Fence number, 1st one start with 01
80 //Alarm type, byte 0-1:
0x00 means in region alarm
0x01 means out region alarm
0x02 means alarm when both in/out alarm
0x03 means forbidden alarm
Byte 7:
0x80 means in region alarm, and use extend alarm
0x81 means out region alarm, and use extend alarm
0x82 means in/out region alarm, and use extend alarm
Note: 00 00 00 00//extend alarm byte, reserved.
00 00 00 //extend alarm byte, reserved.

02 23 55 55//2nd Geo-Fence. Latitude for upper left corner

11 35 30 86//2nd Geo-Fence. Longitude for upper left corner
02 23 56 03//2nd Geo-Fence. Latitude for lower right corner
11 35 32 75//2nd Geo-Fence. Longitude for lower right corner
02//Geo-Fence number, 2nd one.
80 //Alarm types. 0x80 means in region alarm and use extend
alarm in region.
00 00 00 00//extend alarm byte, reserved.
00 00 00 //extend alarm byte, reserved.

02 23 54 02 //3rd Geo-Fence. Latitude for upper left corner

11 35 29 10//3rd Geo-Fence. Longitude for upper left corner
02 23 54 94//3rd Geo-Fence. Latitude for lower right corner
11 35 31 26//3rd Geo-Fence. Longitude for lower right corner
03//Geo-Fence number, 3rd one.
80//Alarm type, 0x80 means in region alarm and use extend
alarm in region.
00 00 00 00//extend alarm byte, reserved.
00 00 00 //extend alarm byte, reserved.
7
 02 23 52 56 //4rd Geo-Fence. Latitude for upper left corner
11 35 32 10//4rd Geo-Fence. Longitude for upper left corner
02 23 54 24//4rd Geo-Fence. Latitude for lower right corner
11 35 34 80//4rd Geo-Fence. Longitude for lower right corner
04//Geo-Fence number, 4rd one.
80//Alarm type, 0x80 means in region alarm and use extend
alarm in region.
00 00 00 00//extend alarm byte, reserved.
00 00 00 //extend alarm byte, reserved.

02 23 52 28//5rd Geo-Fence. Latitude for upper left corner

11 35 28 18//5rd Geo-Fence. Longitude for upper left corner
02 23 53 34//5rd Geo-Fence. Latitude for lower right corner
11 35 30 18//5rd Geo-Fence. Longitude for lower right corner
05//Geo-Fence number, 5rd one.
80//Alarm type, 0x80 means in region alarm and use extend
alarm in region.
00 00 00 00//extend alarm byte, reserved.
00 00 00 //extend alarm byte, reserved.
Device will give 0x85 reply after received for confirm.
29 29 85 00 2e 0b 8b 8b 0b 17 03 31 10 52 09 02 23 55 80 11 35 22 70 00 00 00 00 fb 00 00
00 9f ff 57 00 01 01 09 00 00 00 00 49 00 06 10 02 00 8d 52 0d

12. Send Dispatch Info – 0x3A

Command: ))<0x3A><L><ID><info content><Checksum><\r>
This command sends from server to device. It used in send
GPRS dispatch command to device for setting/query
Description:
parameters.
Device will give Set Reply after receive this command.
Example: 29293A000C0AA483112A32363923437D0D
means send”*269#C” to device(10360317), the parameter is
Note:
the ASCII code of “*269#C” in hex.

13. Alarm Info – 0x82

Command: ))<0x82><L><ID><Data><Checksum><\r>
This command sends from device to server. It is alarm data,
Description: this packet need deal with in the first class. This command
words is for important and emergency situation.
29 29 82 00 23 0C 80 80 3214 10 24 15 10 58 02 23 57
Example: 72 11 35 28 35 00 00 00 00 FB 00 00 00 01 00 00 00 00
00 00 25 0D

8
 About the instruction for the <data> the parse shows below：
14 10 24 15 10 58 02 23 57 72 11 35 28 35 00 00 00 00
FB 00 00this 21 byte data check in section Appendix 1 Position
Dataplease;
00 01 00this part is alarm status data, please check the
Note:
instruction in section Appendix 2 Alarm Data; for this example,
it is SOS alarm happen.
00 00 00 00 00 this part is alarm parameters data, please
check the instruction in section Appendix 2 Alarm Data.

Note:
1. Each alarm after first time trigger, will only send 0x82 alarm once, if still under trigger state, will save
the alarm status in 0x80 position package;
2. Need server to give 0x21 confirmation for each alarm.
For example(SOS alarm):
29 29 82 00 23 0C 80 80 32 14 10 24 15 10 58 02 23 57 72 11 35 28 35 00 00 00 00 FB 00 00 00 01 00 00
00 00 00 00 25 0D
The reply should be:
29 29 21 00 05 258214 97 0D.

14. Alarm OFF – 0x83

Command: ))<0x83><L><ID><Data><Checksum><\r>
This command sends from device to server. It is alarm data,
Description: this packet need deal with in the first class. This command
words is for important and emergency situation.
29 29 83 00 23 0A A2 CC 39 12 05 03 05 05 22 02 85 94
Example: 79 03 10 95 50 00 80 02 07 84 00 00 00 02 00 00 00 00
00 00 74 0D
About the instruction for the <data> the parse shows below：
12 05 03 05 05 22 02 85 94 79 03 10 95 50 00 80 02 07
84 00 00 this 21 byte data check in section Appendix 1
Position Data please;
Note: 00 02 00 this part is alarm OFF status data, please check the
instruction in section Appendix 2 Alarm Data; for this example,
it is over speed alarm OFF.
00 00 00 00 00 this part is alarm OFF parameters data,
please check the instruction in section Appendix 2 Alarm Data.

15. Cancel Alarm – 0x37

Command: ))<0x37><L><ID><Checksum><\r>
This command is sends from server to device, it will clear the
alarm status in device, and the alarm status will clear to 0. And
Description:
it only be reset when alarm status happens again.
Device will reply Set Reply after this command.

9
 Example: 29 29 3700 060A 9F 95 3809 0D
This command only clear the alarm status happens before, if
the alarm status is continuously, like overspeed alarm, if you
Note:
speed not low down, and you send cancel command, it will
keep sending this overspeed alarm.
Note:
This command can only send by manual, please do not send 0x37 command once received 0x82 alarm,
in case the alarm is continuous.

16. Set Reply – 0x85

Command: ))<0x85><L><ID><Data><Checksum><\r>
This package sends from device to server, for reply most of the
commands send from server to device. It will put the command
Description: words of packet it reply for in the last byte of <data> part. The
detail description of <Data> part please find in Appendix 1
Position Data.
29 29 8500 081D D0 8C 2212 03 12 17 40 26 02 65 45 71
Example: 03 12 54 17 00 00 00 00 F8 19 C8 39 FF FF 1D 00 00 1E
00 50 00 00 00 3AF9 0D
In this example, the last byte of <Data> part is 0x3A, so it is
Note:
a reply packet for Send Dispatch Info.

17. Device Reply for Query Parameters– 0x84

Command: ))<0x84><L><ID><Data><Checksum><\r>
This command is reply for firmware check, send from device to
Description: server. <Data> part is firmware version of this device, in ASCII
code.
29 29 8400 310A A2 8A 0754 33 36 30 2D 31 30 33 41 57
Example: 28 47 54 4D 29 56 32 2E 30 31 20 40 20 53 65 70 20 32
33 20 32 30 31 31 20 31 32 3A 34 38 3A 31 38CF 0D
In this example, the firmware version of this device is :
Note:
T360-103AW(GTM)V2.01 @ Sept. 23 2011 12:48:18

18. Camera Related Command – 0x28/0x65/0x26/0xAB

Please refer to file<<Amwell Take Photo Protocol V1.0>>.

19. Peripheral data info upload –0xA3

Command: ))<0XA3><L><ID><Parameter><Checksum><\r>
This packet will be send from device to server by set interval
Description:
time to replace the command packet 0x80 when device has
10
 connected peripheral unit like fuel tank sensor, temperature
sensor etc. Anyway, this packet equal 0x80 packet, but added
peripheral sensor data.

29 29 A3 L 0A 9F 95 38Location_info Peripheral_data Xor

Example:
0D
1).
Note: Location_info: Please see Appendix 1 Positon data.
Peripheral_data: see Appendix 3 peripheral data.

20. Device fuel steal percent set – 0xDD(108/T20)

Command: ))<0xDD><L><ID><Parameter><Checksum><\r>
This command is used to set the device odometer value.
Description:

Example: 29 29 DD00 070A 9F 95 38Byte1 Xor 0D

1).
Byte1: The device fuel seal percent value setting, unit 1%,
unsigned short integer.
Example Byte1=0x0F=15%, means when fuel percent is 15%
Note: less than the last point, fuel steal happen(condition details
depend on device firmware.)
2).
Device reply by command 0x85, and set data field V8=0xDD to
indicate ACK.

21. Device low fuel value set – 0xDE(108/T20)

Command: ))<0xDE><L><ID><Parameter><Checksum><\r>
This command is used to set the device odometer value.
Description:

Example: 29 29 DE00 070A 9F 95 38Byte1 Xor 0D

1).
Byte1: The device fuel lower percent value setting, unit 1%,
unsigned short integer.
Example Byte1=0x0A=10%, means that when fuel percent is
Note:
10% or less, device will send fuel percent lower alarm.
2).
Device reply by command 0x85, and set data field V8=0xDE to
indicate ACK.

11
22. Add RFID card No. To device– 0xDF(T20)
Command: ))<0xDE><L><ID><Parameter><Checksum><\r>
This command is used to set the device odometer value.
Description:

Example: 29 29 DF00 000A 9F 95 38Byte1Byte2-Byte XXor 0D

1).
Byte1:The RFID card amount(HEX, range:1-100).
2).
Byte2-Byte X:RFID card No.(ASCII,each RFID No. Is 10 byte,
if less than 10 byte, add “00” at the end)
Example:
2929DF001B0A9F9538023030303135353231343630303
Note:
037313834363334 F50D
02: Two RFID card No. Included;
3030303135353231343630303037313834363334:
Two No. Are: 0001552146 and 0007184634.
3).
Device reply by command 0x85, and set data field V8=0xDF to
indicate ACK.

23. Delete RFID card No. From device– 0xE0(T20)

Command: ))<0xE0><L><ID><Parameter><Checksum><\r>
This command is used to set the device odometer value.
Description:

Example: 29 29 E000 000A 9F 95 38Byte1Byte2-Byte XXor 0D

1).
Byte1:The RFID card amount(HEX, range:1-100).
2).
Byte2-Byte X:RFID card No.(ASCII,each RFID No. Is 10 byte,
if less than 10 byte, add “00” at the end)
Example:
Note: 2929E000110A9F95380130303031343639363438C00D
01: Delete one RFID card No.;
30303031343639363438:
The RFID No. Is 0001469648
3).
Device reply by command 0x85, and set data field V8=0xE0 to
indicate ACK.

24. Clean all RFID card No. From device– 0xE1(T20)

Command: ))<0xE1><L><ID><Parameter><Checksum><\r>
This command is used to set the device odometer value.
Description:

Example: 29 29 E100 060A 9F 95 38Xor 0D

Note: 1).
12
 Example:
2929E100060A9F9538AF0D
3).
Device reply by command 0x85, and set data field V8=0xE1 to
indicate ACK.

25. Query RFID card No. From device– 0xE2(T20)

Command: ))<0xE1><L><ID><Parameter><Checksum><\r>
This command is used to set the device odometer value.
Description:

Example: 29 29 E200 060A 9F 95 38Xor 0D

1).
Example:
Note: 2929E200060A9F9538DC0D
3).
Device reply by command 0x84 with RFID No.

Appendix 1 Position Data

There have 2 kinds of Position data, one is for normal position data, and another
is for alarm data (such as 0x82).
1. ymdhmswwwwjjjjssffstlichen1 lichen2 lichen3st1st2st3st4v1v2v3v4v5v6v7v8
Ex: 12 03 12 17 40 2602 65 45 7103 12 54 1700 0000 00FB19 C8 39FF FF 1D 0000 1E 00 50 00 00 00 00

2. ymdhmswwwwjjjjssffploadsign (For 82 alarm packet)

Ex: 12 05 03 05 05 2202 85 94 7903 10 95 5000 8002 07840000
From the format, we can see that these 2 kinds of data have same part: ymdhms
wwww jjjj ssfffst,and different parts: lichen1 lichen2 lichen3 st1st2st3st4
v1v2v3v4v5v6v7v8and load sign.
Will describe it in 3 parts:
I. instruct for ymdhmswwwwjjjjssff
Field Name Length(Byte) Content Note
Datetime 6 ymdhms Date range:Year,2000-2099; Month 1-12;
12 03 12 17 40 26 Day, 1-31;
Time range: Hour, 00-23; Min, 00-59;
Second, 00-59.
Hour/min/second use compressed BCD
code
For example: 12 03 12 17 40 26 means
2012-3-12 17:40:26
Latitude 4 wwww Latitude range: 00 ° 00.000 ′ ~89 °
02 65 45 71 59.999′.
Use compressed BCD code, But the
highest bit is sign bit. “Positive”Means
“North Latitude”, “negative” means “south
latitude”; The Unit for ′ is 0.001′
13
 For example: South latitude 30°37.901′
express as: 83H, 03H, 79H, 01H
02 65 45 71 means: north latitude 26°
54.571′.
Longitude 4 jjjj Longitude range: 000°00.000′~179°
03 12 54 17 59.999′;
Use compressed BCD code, the highest bit
is sign bit. “Positive”Means “east
longitude”, “negative” means “West
longitude”;
The Unit for ′ is 0.001′
For example: west longitude 130 °
45.608′express as: 93H, 04H, 56H, 08H
03 12 54 17 means: 31°25.417′.
Speed 2 ss Speed express method:
00 80 Range: 0-9999km/h
Use compressed BCD code.
00 80=(00H,80H)=80km/h
For example: 120km/h
express as: 01H, 20H
Direction 2 ff Direction range: 000-359°
02 07 Use compressed BCD code, true North is
0°, clockwise counting.
The unit is degree.
For example: 154°express as: 01H, 54H
02 07means 207°.

II.Instruct for stlichen1 lichen2 lichen3st1st2st3st4v1v2v3v4v5v6v7v8

Field Length(Byt Conten Note

Name e) t
GPS/ant 1 st D7 0 Not located 1Located
enna FB D6 1 1 GPS antenna normal
/power 1 0 GPS antenna short circuit
status 0 1 GPS antenna open circuit
D5
0 0 GPS module error
D4 11 main power normal
10 main power off
D3 01 main power abnormal(too high/low)
00 main power off(AT09)
D2 0: mileage unit KM
1: mileage unit 0.1km
D1 D1D0:
D0 00:mileage unit m;
01:mileage unit m;
10: mileage unit Km;

14
 11:mileage unit Km
In the example FB =1111 1011, means located/gps normal/power
normal/mileage is Km.

Mileage 3 lichen1 HEX format 0x00-0XFFFFFF (16777215) meters.

lichen2 19 C8 39 means 1689657m
lichen3
19 C8 39

Status 4 st1st2s bit St1 St2 St3 St4

t3st4 D7 1 ACC off 1 normal 1 Fatigue driving 1 OUT1 enabled;
FF FF 1D 0 ACC on 0 SOS 0 normal 0 OUT1 disable
00
D6 1 DEF(1)no alarm 1 normal 1 need reply 0x21 1 OUT2 enabled;
0 alarm happen 0 over speed 0 do not need reply 0 OUT2 disable

D5 1 DEF (2) no alarm 1 normal 1 Temperature 1 Lock wire cut

0 alarm happen 0 stop overtime abnormal 0 normal
0 normal
D4 1 DEF (3) no alarm 1 normal 1 LBS location
0 alarm happen 0 out area alarm 0 GPS location
D3 1 DEF (4)/Lora 1 normal 1 enable
connect normal no 0 in area alarm protection mode
alarm 0 disable
0 alarm happen
D2 1 Fuel pump not cut 1 DEF (5) no alarm D4-D0: GSM 1 unlock
0 Fuel pump 0 alarm happen signal strength. 0 lock on
cut(immobilize). CSQ(GSM) value:
D1 1 Detach/light 1 no alarm 0~31 1 on charging
sensor normal 0 IDLE alarm 0 normal
0 alarm/light happen
sensor on
D0 1 not in sleep 1 no alarm 1 casing/sim
0 in sleep mode 0 low-speed tamper
alarm happen 0 normal
FF FF 1D 00 means acc off / no DEF alarm / no immobilize/ not sign
in/ no defence/ no alarms/ gprs registerd/no need reply 0x21
command/ UDP mode/ csq=29/no accessories.

Customized for Gurtam:

bit St1 St2 St3 St4
D7 1 ACC off 1 SOS 1 Fatigue driving 1 OUT1 enabled;
0 ACC on 0 normal 0 normal 0 OUT1 disable

15
 D6 1 DEF(1) alarm 1 over speed 1 need reply 0x21 1 OUT2 enabled;
0 normal 0 normal 0 do not need reply 0 OUT2 disable

D5 1 DEF (2) alarm 1 stop overtime 1 Temperature 1 Lock wire cut

0 normal 0 normal abnormal 0 normal
0 normal
D4 1 DEF (3) alarm 1 exit Geo-fence 1 LBS location
0 normal 0 normal 0 GPS location
D3 1 DEF (4)/Lora 1 Enter Geo-fence 1 enable protection
disconnect alarm 0 normal mode
0 normal D4-D0: GSM 0 disable
D2 1 immobilize 1 DEF (5) alarm signal strength. 1 unlock
0 recover Fuel pump 0 normal CSQ(GSM) value: 0 lock on
D1 1 Detach/light 1 IDLE alarm 0~31 1 on charging
sensor alarm happen 0 normal
0 normal 0 normal
D0 1 in sleep Reserved 1 casing/sim tamper
0 exit from sleep 0 normal
V1V2 2 v1v2

V3Satelli 1 v3 Range: 0-12

te
Number
V4 1 v4

V5 1 v5

V6 1 v6

V7 1 v7

V8 1 v8
00

III. Instruct for ploadsign

Field Name Length(By Cont Note
te) ent

16
 GPS status 1 80 D7 0 Not located 1 Located
D6
D5
D4
D3 Reserved
D2
D1
D0
In the example 80 =10000000, means located.
AT10 battery 1 45 Hex data;
percent Battery power percent, range: 0% - 100%
For example：
0x45=69%
AT10D unlock 1 1
medium D7 Reserved
D6
D5
D4
D3 Unlock by auto unlock
D2 Unlock by SMS
D1 Unlock by GPRS
D0 Unlock by RFID

Appendix 2 Alarm Data

In alarm info packet, there have 8 bytes of data to describe the alarm status and
alarm parameters. For example: 29 29 82 00 23 0A A2 CC 3912 05 03 05 05 22
02 85 94 79 03 10 95 50 00 80 02 07 84 00 00 00 02 00 00 00 00 00 00
75 0D. The part 00 02 0000 00 00 00 00is what we will describe in this part.

About the 8 bytes of data, first 3 bytes for alarm status and 5 bytes for alarm
parameters.

I. Instruct for alarm status 00 02 00

1st byte 2nd byte 3rd byte
D7 In area alarm Door open alarm (DEF(3) Idle alarm
alarm)
D6 Out area alarm Tow away alarm/move Fatigue alarm
alarm(ACC OFF)
D5 Enter Sleep G-Sensor alarm (see 4th byte Parking status
in alarm parameters )
D4 Low power alarm DEF (4) alarm Tamper box Alarm/sim
/Lora disconnect card slot tamper
(customized)/Detach
alarm(light sensor)

17
D3 DEF(5) alarm Power cut alarm Harsh turning
D2 DEF(2) alarm Stop over time alarm Temperature abnormal
D1 DEF(1) alarm Over speed alarm GSM Jamming alarm

D0 Illegal ignition alarm SOS alarm Fuel Sensor Disconnect

alarm

1 means alarm happen; 0 means no alarm. So 00H 02H 00H = 00000000B

00000010B 00000000B means over speed alarm; 00H 00H 04H = 00000000B
00000000B 00000100B means Temperature Abnormal.

II. Instruct for alarm parameters00 00 00 00 00

1st byte 2nd byte 3rd byte 4th byte 5th byte
D7 Geo-Fence Charging alarm Route Crash alarm High impact
Number of (1 alarm) number of (customized)
D6 GEO Fence 1=Temp high alarm, Offset route Turnover Unlock with wrong
alarm 0=Temp low alarm alarm PWD alarm
D5 Reserved Harsh Low speed alarm
Acceleration (1 alarmed)
D4 Protection alarm Harsh Disconnect the load
deceleration sensor(AT09+ only for
KSA version)
D3 Lock wire cut alarm Shake/vibrate Reserved
alarm
D2 Camera disconnect Temp sensor Refilling alert（LL）
alarm(AT22) disconnect alarm
(AT22)
D1 Charge full Alarm Fuel stolen Reserved
(1 alarm) alarm
D0 ACC status (0 on ;1 off); Low fuel alarm Unauthorized card
Or swipe
AT10 Lock status(0 alarm(AT10D&E)
locked on; 1 unlock)

Sign up status 1 sign Use compress BCD code, 1=sign in; 0=sign
out

Appendix 3 peripheral data

Peripheral data structure:
Field Name Length(Byte) Description

All KLV data length 2 The data length of all KLV list, including length byte.

KLV data list N KLV list, see Peripheral data KLV list as follow.

18
 Peripheral data KLV list:
K(key) L(length) V(value)

0x01 N Reserve.
0x02 N Reserve.
RFID action info:
0x03 11 Byte1(0:sign off, 1:sign on) + Byte2~Byte11(ascii string, filling 0x00 to the
remaining bytes when less than 10 bytes).
0x04 N Reserve.
0x05 N Reserve.
0x06 N Reserve.
0x07 N Reserve.
0x08 N Reserve.
0x09 3
0x0A N Reserve.
Bar code value(T20 device)
Example:
0x0B N
0B0C323031353034313031303133
The bar code ID is:201504101013
0x0C N Reserve.
Temperature value. Bit15: signed mark; Bit0-14:temperature value. The unit
0x0D 2 is 0.1℃.
For example: 0x000A = 1℃, 0x800A=-1℃.
0x0E 1 Fuel level percent: 0-100%.
0x0F N Reserve.
Main power voltage value, HEX data.
0x10 2 For example: 10 02 00 EF
voltage value=(0xEF)/10=239/10=23.9
0x11 N Reserve.
RFID/MIFARE Card:
Format:
Sign status(1BYTE)+CARD NO.(n BYTE,ASCII)
Explain:
0x16 N+1
0x00 sign in start+CARD NO.(n BYTE,ASCII)
0x01 sign in status+CARD NO.(n BYTE,ASCII)
0X02 sign out+CARD NO.(n BYTE,ASCII)
0x03 unauthorized RFID+CARD NO.(n BYTE,ASCII)
Fuel level percent(2 byte, accuracy is 0.01%)(Customized for JT fuel
sensor)
0x17 2 percent(2 byte)
For example: 170219DD
0x19DD means 66.21%
ACC ON time counting, unit: minute
0x18 4 For example：
00 00 FF FF= 65535min

19
 Fuel value: upload unit 0.1%（0.0% - 99.9%）
2/4 For example：
0x03E7=(999/10)*100%=99.9%

0x19
Duel fuel sensor:
19 04 03 A9 0219
No.1 fuel value=0x(03 A9)=93.7%
No.1 fuel value=0x(02 19)=53.7%
1+6 Ibutton(HEX):
Format:
Sign status(1BYTE)+CARD NO.(6 BYTE,hex)
0x1A Explain:
0x00 sign in start+CARD NO.(6 BYTE,hex)
0x01 sign in status+CARD NO.(6 BYTE,hex)
0X02 sign out+CARD NO.(6 BYTE,hex)
Battery power percent, range: 0% - 100%
0X20 1 For example：
0x45=69%
TPMS data：
Tyre ID(1byte)+Pressure value(1byte)+Temp(1byte)+status(1byte)

1+4*n
0x21

Data sample:
2929A300441580831F0000000004390000000000000000000000D73B000000
FFFF15000000000000000000001C211801124B0002124C0003124D80
04114C0005000000060000008D0D
3*N Multiple temp data：
0x22 Temp ID（1byte）+temp value（2byte）

N+1+1+N Bluetooth data：

0x23 AT18 BT ID （ N*byte ） +BT ON/OFF (1byte)+ BT connection

state(1byte)+connected BT ID(N*byte)

1 AD voltage, unit: 0.1V, range: 0-12V

0x24 For example:24 01 78
voltage value=(0x78)/10=120/10=12.0V

20
 4 One Ultrasonic fuel sensor, unit is 0.1mm
For example: 25 04 01 25 01 26
Smooth Height=0x(0125)=29.3mm
Real time height=0x(0126)=29.4mm

8 Dual Ultrasonic fuel sensor, unit is 0.1mm

0x25 For example: 25 08 01 25 01 26 01 20 01 21
A4A:
Smooth Height=0x(0125)=29.3mm
Real time height=0x(0126)=29.4mm
A4B:
Smooth Height=0x(0125)=28.8mm
Real time height=0x(0126)=28.94mm
4 LS803 fatigue sensor data：M5 M6 M7 M8

0x26

Note:
We just transmit the fatigue sensor data, but not handle the content.
2 Battery voltage
unit: 0.01V
2 Engine Speed, Unit: RPM

1 OBD Speed, Unit: KM/H

1 Throttle Position=(Upload value*100/255) Unit: 0.01%

1 Engine Load=(Upload value*100/255) Unit: 0.1%

1 Engine Coolant Temp, unit : 1 ℃

Real Value=upload value-40,
2 Instantaneous fuel consumption
Real value=(upload value)/100, unit :1L/100km
0x27 2 AVG fuel consumption
(HEX) Real value=(upload value)/100 , unit: 1L/100km
2 Trip distance, unit: 0.01km

4 Total Mileage, unit: 0.01km

2 Trip Fuel consumption , unit: 0.01L

2 Accumulative Fuel consumption, unit: 0.01L

2 Remaining fuel, unit: 0.01L(current not support, will improve in future)

1 No. of DTC code

1 Accelerate alarm Times

1 Decelerate alarm times

21
 2 Trip time, unit: s

2 Trip Idle time, unit: s

0x28 N DTC code

(OBD)
17-25 ASCII, Vehicle VIN code.
0x29 For example:
(OBD) 29113147314A43353434345237323532333637
VIN code=1G1JC5444R7252367
2
Hex code, unit is 0.1%
0x2A(hum For example: 2A 02 03B7
idity)
Humidity=0x(03B7)/10=95.1%

9 LBS data

0x2B

0x2C 8 8 bit unlock PWD（I-LOCK）

116 Energy meter data

0x2D
Details refer to PMC200 energy meter.
2 ADC value, upload with voltage. Range：0-33V
Hex code, unit is 0.1V

ADC value, upload with voltage

0x2E
Hex code, unit is 0.01V

For example: 2E 02 003B

Percent=0x(003B)/100=0.59V
2 Load sensor
ADC2 value, upload with voltage. Range：0-10V
Hex code, unit is 0.01V
0x2F

For example: 2F 02 003B

Percent=0x(003B)/100=0.59V
1 Re-fuel value percentage,unit:%
0x30
For example:54=84%

22
0x31
31 Group number & G-Sensor x-y-z value
Group number,X1,y1,z1,x2,y2,z2,.......

For example:
0x3F
29 29 A3 00 54 16 B4 87 59 19 04 13 14 20 16 02 24 24 56 11 41 58 81 00
00 00 00 7F 00 00 00 7F FF 16 00 00 00 00 00 00 07 00 00 00 2C 3F 1F 01
0D B4 C0 00 B4 C6 10 B6 C2 00 B5 B6 08 B1 C9 01 B2 C2 02 B9 DC 02 B4 BC
07 AF BE 00 B6 C6 FF 0D
2 Fuel temp for DUT-E fuel sensor(customized)
Temperature value. Bit15: signed mark; Bit0-14:temperature value. The unit
0x40
is 0.1℃.
For example: 0x000A = 1℃, 0x800A=-1℃.
10 SIM ICCID:

For example:
0x41
29 29 A3 00 3A 2A AA DC 26 19 12 12 13 26 57 02 24 24 28 11 41 58 91 00
00 01 78 7B 00 00 00 FF FF 18 00 00 00 00 00 00 02 00 00 00 12 2F 02 00
03 41 0A 89 86 04 07 11 19 80 36 41 71 C6 0D
1+N
Salve amount 1byte max 10 salve
Salve ID1 4bytes 16000001, no convert
Lock status+lock rope 1byte D0=1 unlock,D0=0 locked on;
status D1=1 rope in,D1=0 rope not in
Battery voltage 2bytes Unit: 0.01V
battery percent 1byte
Temp 2bytes 0.1degree
Unlock by RFID or 1byte D0=1 RFID authorized;
GPRS+RFID D0=0 RFID unauthorized;
authorized or not D1=1 unlock by GPRS
RFID card No. 10bytes
Salve ID2
0x42 ...

Example:
42160116000001010FB85F00CE0130303133353233383537
42 ->salve lock data sub-command
22 ->11 bytes, salve lock data length
01 ->salve lock amount, 1 salve
16000001 ->salve lock ID,no convert
02 ->salve Lock on | lock rope In
0FB8 ->salve lock battery voltage, 4.024V
5F ->salve lock battery percent, 95%
00CE ->salve lock temp, 20.6 degree
01 ->salve unlock by authorized RFID
30303133353233383537 ->RFID number:0013523857

23
 BT Temp& Connected BT sensor total amount(1byte) + (BT ID(3 byte) + temp(2
humidity byte)+humidity (2 byte)+ battery percent(1 byte) )*N
sensor
1+8*N ID/MAC Temp value Humidity Battery
address value percent
3 byte 2 byte 2 byte 1 byte
0x43

Temp value: hex format, 2 bytes, unit: 0.01℃

Humidity value:
hex format, 2 bytes, unit: 0.01%

SEN003 PP(1byte)+Group1(24bytes)+Group2(14bytes)+Group3(24bytes)+Grou
sensor p4(8bytes)

1+70bytes PP: Protocol used by the vehicle ( hexadecimal text format ):

15 ( 0x31:0x35 ) : J1708/J1587
19 ( 0x31:0x39 ) : J1939
0x44

Group1(24bytes):

24
Liters >RTT,19,000007D0,00000FA0,0006D600,00002EE0,000001F4,000032C8<
Shipping Totalizers Protocol: 19
Total Fuel Idle: 1000 Liters
Total Hours Idle: 200 Hours
Total Distance: 56000 Km
Total Hours: 600 Hours
Total Hours PTO: 25 Hours
Total Consumption: 6500

Group2(14bytes):

25
Example:
>RTE,19,007D,0069,0C51,0AD1,006C,005F,0BB1<
Temperature Shipping Protocol: 19
Temp. Refrigerant: 85 °C
Temp. Fuel: 65 °C
Temp. Motor Oil: 90 °C
Temp. Turbo Oil: 78 °C
Temp. Intercooler Motor: 68 °C
Tmep. PTO Oil: 55 °C
Temp. Transmission Oil: 85 °C

Group3(24bytes):

26
27
Example；
>RTI,19,0032,00BC,0000,00A2,044C,2800,4600,00F0,00F0,00AC,0000,00EE<
Sending Information Protocol: 19
Porc. Engine load: 50%
Engine Oil Level: 75%
Engine Oil Pressure: 2 KPa
Coolant Level: 65%
Fuel Rate: 55ltsh
Fuel Economy: 20 kmlt
Avg. Fuel Economy: 35 kmlt
Alternator Volts: 12 volt
Battery Volts: 12 volt
Transmission Oil Level: 69%
Transmission Oil Pressure: 4 KPa
Combustible Level: 95%
Group4(8bytes):

28
 Unlock by SMS Phone No.(AT10D)(without country code 13bit, if number not have
phone No. 13 bit fill 0 at the head)
Example:
1+13 45 0d 31 32 33 34 35 36 37 38 39 31 32 33 34
0x45 The phone No. is:1234567891234

45 0d 30 30 33 34 35 36 37 38 39 31 32 33 34
The phone No. is:34567891234

KLV structure frame:

K(1byte): the key id of the data part.
L(1byte): the length of the data part of V.
V(nbyte): the value of the data part.
For example, Temperature sensor KLV: 0x0D0x020x00 0x0A, means 1℃.

Extend Alarm for BT sensor:

26. Bluetooth Alarm Info – 0x86

Command: ))<0x86><L><ID><Data><Checksum><\r>
This command sends from device to server. It is alarm data,
Description: this packet need deal with in the first class. This command
words is for important and emergency situation.
29 29 86 00 230C 80 80 32 14 10 24 15 10 58 02 23 57
Example: 72 11 35 28 35 00 00 00 00 FB 00 0000 01 00 00 00 00
00 00 25 0D

29
 About the instruction for the <data> the parse shows below：
14 10 24 15 10 58 02 23 57 72 11 35 28 35 00 00 00 00
FB 00 00 this 21 byte data, PLS check in section Appendix 1
Note: Position Data;
00 01 00 00 this part is Bluetooth ID which triggered alarm;
00 00 00 00 this part is alarm parameters data, please check
the instruction in section Appendix 4 Alarm Data.

Alarm Info – 0x86（Bluetooth alarm）

Name Length Content Remark
Package head 2 29 29 Fixed
Command 1 86
Length 2 00 23+0E
Device ID 4 1D D0 8C 22 Refer to device ID: 29801234
Date & time 6 Refer to Position 2
Lat & long 8
Speed 2
Direction 2
Locate/antenna/ 1
power status
Reserved 1
Reserved 1
Reserved 1
Bluetooth ID 3 1c 13 d9 The Bluetooth which triggered
alarm
Bluetooth alarm 4 00 00 00 00 Refer to Appendix 4 Bluetooth
Alarm Data
Checksum 1
Package end 1

Appendix 4 Bluetooth Alarm Data

Byte 1 Byte 2 Byte 3 Byte 4

D7 1=BT disconnect alarm Reserved Reserved Reserved

0=BT connect normal

30
 1=BT low battery alarm Reserved Reserved Reserved
D6 0=BT low battery normal
D5 Reserved Reserved Reserved Reserved
D4 Reserved Reserved Reserved Reserved
D3 Reserved Reserved Reserved Reserved
D2 Reserved Reserved Reserved Reserved

D1 Reserved Reserved Reserved Reserved

D0 ACC status Reserved Reserved Reserved
(0=ACC ON ;1=ACC OFF);

31