CelloTrack Nano Programming Manual

Cellocator Cello
Programming Manual -
CelloTrack Nano
Proprietary and Confidential
Version 5.4.3.0
Revised and Updated: April 18, 2018
POINTER TELOCATION LTD. 14 HAMELACHA ST. ROSH HA'AYIN 4809133, ISRAEL ● TEL: 972-3-5723111 ● FAX: 972-3-5723100 ● WWW.POINTER.COM
Copyright © 2018 by Pointer Telocation, Ltd.

Cellocator Cello
Programming Manual
Legal Notices
IMPORTANT
1. All legal terms and safety and operating instructions should be read thoroughly before
the product accompanying this document is installed and operated.
2. This document should be retained for future reference.
3. Attachments, accessories or peripheral devices not supplied or recommended in
writing by Pointer Telocation Ltd. May be hazardous and/or may cause damage to the
product and should not, in any circumstances, be used or combined with the product.
General
The product accompanying this document is not designated for and should not be used in
life support appliances, devices, machines or other systems of any sort where any
malfunction of the product can reasonably be expected to result in injury or death.
Customers of Pointer Telocation Ltd. Using, integrating, and/or selling the product for use
in such applications do so at their own risk and agree to fully indemnify Pointer Telocation
Ltd. For any resulting loss or damages.
Warranty Exceptions and Disclaimers

Pointer Telocation Ltd. Shall bear no responsibility and shall have no obligation under the
foregoing limited warranty for any damages resulting from normal wear and tear, the cost
of obtaining substitute products, or any defect that is (i) discovered by purchaser during
the warranty period but purchaser does not notify Pointer Telocation Ltd. Until after the
end of the warranty period, (ii) caused by any accident, force majeure, misuse, abuse,
handling or testing, improper installation or unauthorized repair or modification of the
product, (iii) caused by use of any software not supplied by Pointer Telocation Ltd., or by
use of the product other than in accordance with its documentation, or (iv) the result of
electrostatic discharge, electrical surge, fire, flood or similar causes. Unless otherwise
provided in a written agreement between the purchaser and Pointer Telocation Ltd., the
purchaser shall be solely responsible for the proper configuration, testing and verification
of the product prior to deployment in the field.
POINTER TELOCATION LTD.’S SOLE RESPONSIBILITY AND PURCHASER’S SOLE REMEDY
UNDER THIS LIMITED WARRANTY SHALL BE TO REPAIR OR REPLACE THE PRODUCT
HARDWARE, SOFTWARE OR SOFTWARE MEDIA (OR IF REPAIR OR REPLACEMENT IS NOT
POSSIBLE, OBTAIN A REFUND OF THE PURCHASE PRICE) AS PROVIDED ABOVE.
POINTER TELOCATION LTD. EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES OF ANY
KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, SATISFACTORY
PERFORMANCE AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL
POINTER TELOCATION LTD. BE LIABLE FOR ANY INDIRECT, SPECIAL, EXEMPLARY,
INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOSS
OR INTERRUPTION OF USE, DATA, REVENUES OR PROFITS) RESULTING FROM A BREACH
OF THIS WARRANTY OR BASED ON ANY OTHER LEGAL THEORY, EVEN IF POINTER
TELOCATION LTD. HAS BEEN ADVISED OF THE POSSIBILITY OR LIKELIHOOD OF SUCH
DAMAGES.
Cellocator Cello Programming Manual Page 2 of 219

Cellocator Cello
Programming Manual
Intellectual Property
Copyright in and to this document is owned solely by Pointer Telocation Ltd. Nothing in
this document shall be construed as granting you any license to any intellectual property
rights subsisting in or related to the subject matter of this document including, without
limitation, patents, patent applications, trademarks, copyrights or other intellectual
property rights, all of which remain the sole property of Pointer Telocation Ltd. Subject to
applicable copyright law, no part of this document may be reproduced, stored in or
introduced into a retrieval system, or transmitted in any form or by any means
(electronic, mechanical, photocopying, recording or otherwise), or for any purpose,
without the express written permission of Pointer Telocation Ltd.
© Copyright 2018. All rights reserved.

Cellocator Cello
Programming Manual
Table of Contents
Cellocator Cello Programming Manual - CelloTrack Nano ................................................... 1

1 Introduction ........................................................................................................... 11
1.1 About this Document ..................................................................................................11
1.2 Applicability Table ......................................................................................................11
1.3 References ................................................................................................................11
1.4 Document Conventions ...............................................................................................12
2 Accessing the Configuration Memory via Wireless Channel (OTA) .......................... 13
3 Accessing the Configuration Memory via Direct Wire Interface .............................. 14
4 Event Types generated by Cellocator devices ......................................................... 14
4.1 Logged (Plain) Event ...................................................................................................14
4.2 HRLS Event ...............................................................................................................14
4.3 Distress Event ............................................................................................................14
4.4 Security Event ...........................................................................................................15
4.5 Active Logged (Plain) Event .........................................................................................15
5 Address and Bitmask Field Allocation Tables .......................................................... 17
5.1 Address Allocation Table ..............................................................................................17
5.2 Bitmask Field Allocations .............................................................................................26
5.2.1 Application Configuration .............................................................................................27
5.2.2 Communication Events Mask ........................................................................................29
5.2.3 Communication Settings in Home/Roam GSM Network Mode ...........................................29
5.2.4 WAKE UP Message Configuration ..................................................................................29
5.2.5 GPS Management Bitmap ............................................................................................30
5.2.6 Maintenance Server Configuration Bitmap .....................................................................30
5.2.7 UART Configuration ....................................................................................................30
5.2.8 Alternative Inputs Usage Bitmap ..................................................................................31
5.2.9 Time Based Mask Bitmap.............................................................................................31
5.2.10 Over (and Idle) Speed Session Control Bitmap ...............................................................31
5.2.11 Go/Halt Session Control Bitmap ...................................................................................31
5.2.12 GPS Alerts Mask Bitmap ..............................................................................................31
5.2.13 Time Report Period Value (Home, Roam, High Speed) .....................................................32
5.2.14 Time/Distance Alert Multipliers for High Speed Mode .......................................................32
5.2.15 Discrete Inputs Masks .................................................................................................33
5.2.16 Mask of Analog Inputs Alerts ........................................................................................33
5.2.17 Disable Continuous Output Activation after SW Reset Bitmask .........................................34
5.2.18 Geo-Fence Alert Mask .................................................................................................34

Cellocator Cello
Programming Manual
5.2.19 Offline Tracking - Auto Upload Configuration ..................................................................34

5.2.20 Security Settings Bitmask 1 .........................................................................................34
5.2.21 Security Settings Bitmask 2 .........................................................................................35
5.2.22 Security Logic Configuration ........................................................................................35
5.2.23 Active Correlation Lines ...............................................................................................35
5.2.24 Vector Change Detection Bitmask .................................................................................35
5.2.25 Accelerometer Configuration ........................................................................................36
6 Communication and Configuration ......................................................................... 37
6.1 Communication Events ................................................................................................37
6.1.1 Enable Voice Call Events..............................................................................................37
6.2 Communication Settings..............................................................................................37
6.2.1 GPRS Settings ............................................................................................................37
6.2.2 SMS Settings .............................................................................................................49
6.2.3 Comm. Permissions in Home/Roam Network ..................................................................50
6.2.4 COM port settings.......................................................................................................51
6.2.5 Distress Session Configuration .....................................................................................53
6.2.6 Wake Up Messages .....................................................................................................54
6.2.7 Offline Tracking ..........................................................................................................55
6.2.8 Cell ID Based Location (Neighborhood list of the serving GSM cell) ...................................59
6.2.9 Internal Accelerometer Configuration ............................................................................63
6.2.10 Roaming List, GSM Operator Management .....................................................................64
6.2.11 GSM Jamming Detection & Reaction (Not Supported by 3G units) .....................................69
6.2.12 Other Configuration Parameters related to Communication Settings ..................................77
6.3 GPS Calibration ..........................................................................................................80
6.3.1 Base Unit (Measurement Factor of GPS Odometer) .........................................................80
6.3.2 GPS Odometer Current Value .......................................................................................80
6.3.3 Report Max. Speed instead of Real Time Speed ..............................................................81
6.3.4 Enable GPS Navigation Start-Stop updates ....................................................................81
6.3.5 GPS Navigation Start/Stop filter ...................................................................................81
6.3.6 Enable Tight GPS PMODE Filter.....................................................................................81
6.3.7 GPS DOP Threshold ....................................................................................................82
6.3.8 GPS accepted accuracy threshold .................................................................................82
6.3.9 Synchronize Unit’s Time with GPS Time only when GPS is Navigating ................................83
6.3.10 Velocity Threshold for HIGH SPEED Mode ......................................................................83
6.3.11 GPS Maintenance Updates ...........................................................................................83
6.3.12 GPS Odometer Management ........................................................................................84
6.3.13 GPS Reset Settings .....................................................................................................86
6.4 Inputs & Outputs ........................................................................................................87
6.4.1 Discrete Inputs Triggering Time Filters ..........................................................................87
6.4.2 Analog Measurement Averaging Time ...........................................................................87
6.4.3 Inputs in OTA Message ................................................................................................88
6.4.4 Enable Monitoring Logical Status of Ignition in OTA Packets .............................................88

Cellocator Cello
Programming Manual
6.4.5 Enable Warning Output Activation during Gradual Immobilization .....................................88

6.4.6 Outputs Pulse Width Period ..........................................................................................88
6.4.7 Analog (& Frequency) Inputs in OTA Message ................................................................90
6.4.8 Outputs Inversion Mask...............................................................................................91
6.4.9 Usage Counter Configuration .......................................................................................92
6.4.10 Modem & SIM ............................................................................................................94
6.4.11 Modem Reset Settings ................................................................................................96
6.4.12 GSM Band & GPRS Auth Type ......................................................................................97
6.4.13 SIM PIN ....................................................................................................................98
6.5 Power Management .................................................................................................. 100
6.5.1 Power Management Mode .......................................................................................... 100
6.5.2 Hibernation Mode Delay ............................................................................................ 101
6.5.3 Enable Pre-Hibernation Update ................................................................................... 101
6.5.4 Enable Data Forwarding from Serial Port by SMS (in Hibernation) ................................... 101
6.5.5 GPS Peeking ............................................................................................................ 102
6.5.6 GSM Peeking ........................................................................................................... 102
6.6 Voice Call Settings .................................................................................................... 104
6.6.1 Voice Call Destination Number ................................................................................... 104
6.7 Informative Parameters ............................................................................................ 104
6.7.1 Last Distance Event .................................................................................................. 104
6.7.2 Field for Customer Use .............................................................................................. 105
7 Distance and Speed Events ................................................................................... 106
7.1 Distance Events ....................................................................................................... 106
7.1.1 Enable Distance Updates ........................................................................................... 106
7.1.2 Trip for a Distance Event ........................................................................................... 106
7.1.3 Distance Event Multiplier for HIGH SPEED Mode ........................................................... 106
7.2 Over and Idle Speed ................................................................................................. 107
7.2.1 Velocity Threshold for Over Speed Start Event ............................................................. 107
7.2.2 Velocity Threshold for Over Speed End Event ............................................................... 107
7.2.3 Filter of Over Speed Duration ..................................................................................... 107
7.2.4 Do not use Time Filter to Close Over Speed Session...................................................... 108
7.2.5 Alternative Over Speed Threshold for Input Dependent Mode ......................................... 108
7.2.6 Velocity Threshold for Idle Speed Start Event .............................................................. 109
7.2.7 Velocity Threshold for Idle End Event .......................................................................... 109
7.2.8 Filter of Idle Speed Duration ...................................................................................... 109
7.2.9 Multiplier for Idle Speed Start Detection Time Filter ...................................................... 109
7.2.10 Do not use Time Filter to Close Idle Speed Session ....................................................... 110
7.2.11 Start Idle Speed Timer with Ignition On ...................................................................... 110
7.2.12 Create Idle/Over Speed End Update for an Open Session per Ignition Off ........................ 110
7.2.13 Events and Distress Control ....................................................................................... 110
7.3 Sudden Course Changed and Sudden Speed Change Sensors ........................................ 111

Cellocator Cello
Programming Manual
7.3.1 Speed Thresholds V0, V1 and V2 ................................................................................ 111

7.3.2 Delta Speed and Delta Course for Speed Range X ......................................................... 112
7.3.3 Events, Distress and HRLS Updates Control ................................................................. 113
8 Time and Trip Events ............................................................................................ 115
8.1 Start and Stop Alerts ................................................................................................ 115
8.1.1 Start Alert Generation Time Filter ............................................................................... 115
8.1.2 Stop Alert Generation Time Filter ............................................................................... 115
8.2 Time-based Alert ...................................................................................................... 115
8.2.1 Time Alerts Resolution Definer ................................................................................... 116
8.2.2 Time Alerts Period Value ........................................................................................... 116
8.2.3 Force one second resolution Roaming Mode ................................................................. 116
8.2.4 Time Alert Period Multiplier for High Speed Mode .......................................................... 117
8.2.5 Time Report Period Multiplier for NOIP Mode ................................................................ 117
8.2.6 Table of Time-based Alert Period Calculation ................................................................ 118
8.3 Curve Smoothing ..................................................................................................... 118
8.3.1 Enable Vector Change Detection Events /Distress ......................................................... 119
8.3.2 Enable Compressed Vector Change Report................................................................... 120
8.3.3 Compressed Vector Change Report Timeout ................................................................ 121
8.3.4 Vector Change Detection Angle .................................................................................. 121
8.4 Communication Idle Alerts ......................................................................................... 121
8.4.1 Time between Communication Idle Alerts .................................................................... 121
8.4.2 Event and Distress Controls for Communication Idle Alert .............................................. 122
8.4.3 Do not Wake Up from Hibernation upon Comm. Idle Distress ......................................... 122
9 Inputs Events ....................................................................................................... 125
9.1 4 – Ignition ............................................................................................................. 125
9.1.1 Reporting Journey Start ............................................................................................ 125
9.1.2 Reporting Journey Stop ............................................................................................. 125
9.1.3 Inverting Journey Start/Stop ..................................................................................... 126
9.1.4 Reporting Signal Falling on Ignition ............................................................................ 126
9.1.5 Reporting Signal Rising on Ignition ............................................................................. 126
9.1.6 Inverting Ignition Input ............................................................................................. 126
9.2 16 – Panic ............................................................................................................... 127
9.2.1 Function Assigned to Panic Input ................................................................................ 127
9.2.2 Inverting Panic Input ................................................................................................ 127
9.2.3 Threshold for Panic Input .......................................................................................... 128
9.2.4 Averaging Factor for Panic Input ................................................................................ 128
9.2.5 Reporting Signal Falling on Panic ................................................................................ 128
9.2.6 Reporting Signal Rising On Panic ................................................................................ 129
10 Power Events ....................................................................................................... 130
10.1 Power Threshold Settings .......................................................................................... 130

Cellocator Cello
Programming Manual
10.1.1 Main Power Low Threshold – High/Low levels ............................................................... 130

10.2 Power Events/Distress Control ................................................................................... 130
10.2.1 Enabled Main Power Disconnected in Ignition Off Mode alert .......................................... 130
10.2.2 Enabled Main Power Low in Ignition Off Mode Alert ....................................................... 131
10.2.3 Enabled Backup Battery Disconnected in Ignition Off Mode Alert .................................... 131
10.2.4 Enabled Backup Battery Low in Ignition Off Mode Alert.................................................. 131
10.2.5 Enabled Main Power Disconnected in Ignition On Mode Alert .......................................... 131
10.2.6 Enabled Main Power Low in Ignition On Mode Alert ....................................................... 132
10.2.7 Enabled Backup Battery Disconnected in Ignition On Mode Alert ..................................... 132
10.2.8 Enabled Backup Battery Low in Ignition On Mode Alert .................................................. 132
10.2.9 Period between the Alerts, Triggered by Detection of Power Disconnection ...................... 132
11 Geo-Fences ........................................................................................................... 134
11.1 Geo-Fence ............................................................................................................... 134
11.1.1 Format of Geographical Perimeter .............................................................................. 135
11.1.2 Four Configuration Bytes of the Fence ......................................................................... 135
11.1.3 TOE - Type of Entry .................................................................................................. 136
11.1.4 Waypoint ................................................................................................................. 136
11.1.5 Geo Hot Spot ........................................................................................................... 136
11.1.6 No Modem Zone ....................................................................................................... 137
11.2 Fences Configuration ................................................................................................ 137
11.2.1 Geo-Fence Logic ....................................................................................................... 137
11.2.2 Geo-Fence Violation Filter .......................................................................................... 138
11.2.3 Ignore Geo-Fence Violation on Boot (after Reset) ......................................................... 138
11.2.4 Control of Geo-Fence Alters (Events and Distress) ........................................................ 139
11.2.5 Geo-Fence Heading Angle .......................................................................................... 140
11.2.6 Geo-Fence Priority .................................................................................................... 141
12 CelloTrack ............................................................................................................ 143
12.1 CelloTrack Configuration 1 ......................................................................................... 143
12.2 CelloTrack Configuration 2 ......................................................................................... 145
12.2.1 Disable Cell ID Packets on Peeking ............................................................................. 145
12.2.2 Enable FixTime Algorithm (Non CelloTrack T Variants only) ............................................ 145
12.2.3 Enable Extended Charging Temperature Range ............................................................ 146
12.2.4 GPIO Control 0/1 (CelloTrack only) ............................................................................. 146
12.2.5 Cradle Mount Power Save (CelloTrack only) ................................................................. 147
12.3 GPS Peeking On Time during Live Tracking .................................................................. 147
12.4 Activation/Deactivation Procedure Options ................................................................... 148
12.4.1 Activation/Deactivation Procedure .............................................................................. 148
12.4.2 GPS-based Start Event Enable (Non CelloTrack T Variants only) ..................................... 149
12.5 GPS-based Movement Timeout (Non CelloTrack T Variants only) .................................... 150
12.6 Max Extra GPS On Time for Distress Mode ................................................................... 150
12.6.1 Distress Mode during COM-Location Glancing State ...................................................... 150

Cellocator Cello
Programming Manual
12.7 Glancing at Specific Time (ST Glancing) ...................................................................... 151

12.8 Radio-Off (CelloTrack and CelloTrack Power)................................................................ 154
12.9 Advanced Glancing (peeking): CelloTrack and CelloTrack Power ..................................... 155
12.10 Cradle tamper events definitions .............................................................................. 157
13 CelloTrack Power.................................................................................................. 158
13.1 CelloTrack Power and Nano Configuration Settings ....................................................... 158
13.2 Slow charging in extreme temperatures ...................................................................... 159
14 CelloTrack Nano ................................................................................................... 161
14.1 Overview ................................................................................................................. 161
14.2 User Interface – Buttons, LEDs and Buzzer .................................................................. 162
14.2.1 Buttons ................................................................................................................... 162
14.2.2 LEDs ....................................................................................................................... 164
14.2.3 Buzzer .................................................................................................................... 167
14.2.4 Indications after Power Up (Built-In Self-Test) ............................................................. 168
14.3 System Modes ......................................................................................................... 169
14.3.1 Improved Tracking Mode ........................................................................................... 169
14.3.2 Improved Tracking with POD Mode (Infrastructure) ...................................................... 170
14.4 The Layers Concept .................................................................................................. 171
14.5 USB ........................................................................................................................ 172
14.5.1 Usage ..................................................................................................................... 172
14.5.2 Charging Speed........................................................................................................ 172
14.5.3 Charging Modes ....................................................................................................... 172
14.5.4 Power-bank keep alive pulsing ................................................................................... 173
14.6 Sensors ................................................................................................................... 174
14.6.1 Use of IIR Filters ...................................................................................................... 175
14.6.2 Accelerometer .......................................................................................................... 175
14.6.3 Ambient Light Sensor (ALS) ....................................................................................... 176
14.6.4 Pressure Sensor (Altimeter) ....................................................................................... 176
14.6.5 Accurate Temperature Sensor .................................................................................... 176
14.7 BLE functionality ...................................................................................................... 176
14.8 Communication Protocols .......................................................................................... 176
14.9 Parameters Descriptions and Notes ............................................................................. 177
14.9.1 Nano Take Location Interval ...................................................................................... 177
14.9.2 System Tracking Mode .............................................................................................. 177
14.9.3 GPS warm start ........................................................................................................ 178
14.9.4 Legacy Events Type-11 Configuration ......................................................................... 178
14.9.5 Tilt Tamper .............................................................................................................. 179
14.9.6 Accelerometer Based Impact / Free-fall Detection ........................................................ 181
14.9.7 Orientation Change ................................................................................................... 183
14.9.8 Man-down alarm and voice call .................................................................................. 184

Cellocator Cello
Programming Manual
14.9.9 Package Open/Close Events ....................................................................................... 186

14.9.10 Analog Source Selection ....................................................................................... 188
14.9.11 Temperature and Humidity Measurements .............................................................. 189
14.9.12 Indications Time Window ...................................................................................... 196
14.9.13 Buzzer Configuration............................................................................................ 197
14.9.14 LEDs Configuration .............................................................................................. 198
14.9.15 Check-in_out configuration ................................................................................... 199
14.9.16 Work-ID Messaging ............................................................................................. 199
14.9.17 Exception Handling .............................................................................................. 200
14.9.18 BLE Block ........................................................................................................... 201
14.9.19 Dry contact input mode ........................................................................................ 204
14.9.20 Add module 44 .................................................................................................... 204
14.9.21 Prevent power button from shutting down (Nano) ................................................... 204
14.9.22 Pressure sudden change ....................................................................................... 205
14.9.23 Voice listen-in ..................................................................................................... 205
14.9.24 Airplane mode..................................................................................................... 206
14.9.25 Improved power consumption for high transmission rates ........................................ 207
14.10 Installations .......................................................................................................... 208
15 MultiSense and MultiSense-TH ............................................................................. 209
15.1 Introduction............................................................................................................. 209
15.2 Operation ................................................................................................................ 210
15.2.1 Marking ................................................................................................................... 210
15.2.2 Battery ................................................................................................................... 210
15.2.3 Button and Blue LED ................................................................................................. 210
15.2.4 Pairing Process ......................................................................................................... 210
15.2.5 Unpairing Process ..................................................................................................... 211
15.3 Sensors ................................................................................................................... 212
15.3.1 Accelerometer .......................................................................................................... 212
15.3.2 Ambient Light Sensor (ALS) ....................................................................................... 212
15.3.3 Accurate Temperature Sensor .................................................................................... 212
15.3.4 Humidity Sensor....................................................................................................... 212
15.3.5 Magnetic Sensor ....................................................................................................... 212
15.4 Parameter Descriptions and Notes .............................................................................. 213
15.4.1 MultiSense Units Provisioning ..................................................................................... 213
15.4.2 MultiSense Open/Close Door/Window Feature .............................................................. 213
15.4.3 BLE Pairing Time Window .......................................................................................... 214
15.4.4 Specific MultiSense parameters .................................................................................. 214

Cellocator Cello
Programming Manual
1 Introduction
1.1 About this Document

This document defines the contents of the Cellocator Unit’s Configuration Memory (CM).
The CM is a non-volatile memory, which is used to store different parameters that affect
the behavior of the unit, as well as communication parameters, which are necessary for
the Cellocator unit’s correct operation.
The CM can be read and written both from the wireless channel as well as from the direct
wire interface. Refer to the Wire and Wireless Protocols in order to learn how to read and
write to the CM. Note that if the stored communication parameters are not correct, the
wireless channel might not work, so the only way to program the CM might be via the
direct wire interface.
1.2 Applicability Table

Device Comments
CelloTrack All information related to CelloTrack in this document

Family refers to CelloTrack-T units based on the Cello platform.
CelloTrack-T family includes the standard CelloTrack and
CelloTrack Power. The CelloTrack Power has built-in
charger and charging control logic. CelloTrack-T
members are distributed with 2G or 3G modems
according to the specific hardware part number.
Unsupported features include the following: Towing
detection, Driver Authentication, Audio call, CFE, Pulse
Counter, APS mode in 2G variant, and GSM Jamming in
3G variant.
Most of the functionality is also inherited to CelloTrack-
Nano units.
1.3 References
All the reference documents listed in the following table can be downloaded from the
support section of the Pointer Website (www.pointer.com).
# Reference Description

Cellocator Cello
Programming Manual
1.4 Document Conventions

Unless otherwise specified:
 All multiple bytes values are stored and treated Intel-style (meaning, “little endian”,
least significant bytes first).
 All the parameters are loaded from CM upon reset. In other words, changing the
programming parameters will take effect only after unit reset.
This document defines the common programmable features, supported by all the
modifications of Cellocator units, as well as the specific programmable options, supported
by specific modifications only. The non-common options are highlighted.

Cellocator Cello
Programming Manual
2 Accessing the Configuration Memory via Wireless

Channel (OTA)
When done over the air (OTA), CM access is performed in blocks. The 4096 bytes are
partitioned to aligned, non-overlapping blocks of 16 bytes. This means the whole CM
space contains 256 different blocks, assigned with block codes of 0 (zero) to 255
(decimal).
The first block (which represents CM locations 0 to 15 decimal) is assigned with block
code 0 (zero). The following blocks are assigned with successive numbers (block 1 for
locations 16 to 31 and so on).
Refer to the Cellocator Wireless Communication Protocol document for more information
about accessing the CM via the wireless channel.

Cellocator Cello
Programming Manual
3 Accessing the Configuration Memory via Direct

Wire Interface
The CM cells are accessed via the direct wire interface in a linear manner. This means
that cells are identified by their actual addresses – there are no blocks or pages.
Refer to the Cellocator Serial Communication Protocol for more information about
accessing the CM via the direct wire interface.
4 Event Types generated by Cellocator devices

Every event (like trigger on input, violation of speed any other), generated by the
Cellocator unit can be threaded in 4 ways, as per the descriptions below. Every enabled
event causes the unit to generate a location message type 0 (see description in Cellocator
Wireless Communication Protocol) with the appropriate transmission reason. The various
event types are described in the following sections.
4.1 Logged (Plain) Event

If the condition for the specific event is met, the unit will create an event and store it into
its non-volatile memory. The event will be uploaded to the Control Center only during the
GPRS session and will be deleted from the memory of the unit only after reception of an
Acknowledge. Note: Plain events will never be delivered by SMS.
4.2 HRLS Event

This is a private case of Plain Event. If the condition for the specific event is met, the unit
will create a pre-defined number of plain events (one a second) and store them into its
non-volatile memory. Upon the end of storing the unit will upload them to the Control
Center, similarly to any other plain events.
4.3 Distress Event

If the condition for the specific event is met, the unit will create a series of messages
(session) with the same transmission reason. The messages will be uploaded to the
Control Center immediately with the first available communication transport (during IP
session – over IP, otherwise by SMS). The messages are not stored in the memory and if
there is no cellular coverage at the moment of sending the message will be lost. Distress
events do not require ACK from the control center.
The number and time between messages in a Distress transmission session is defined in a
Time between Transmissions section of that document.
Distress sessions caused by the same trigger, which occurred while the first session is not
over, restarts the session from the beginning.
Distress sessions caused by a different trigger, which occurred while the first session is
not over, causes a new distress session (up to 5 distress sessions can be maintained
concurrently).
A 6th distress session, while the previous 5 are still active, will be lost.

Cellocator Cello
Programming Manual
It is also possible to initiate an endless (or specified duration) distress session by

command from the CCC. Upon starting, this session cancels all active distress sessions.
The session will be stopped by any other distress session or by a command from the OTA.
Distress sessions may be prolonged by up to 20 seconds after the transmission of the last
distress message.
4.4 Security Event

As per the Distress Event, but in this instance the condition for event generation is only
checked when the alarm of the unit is armed (only applicable for security modification of
the Cellocator unit). If the condition for the specific event is met, the unit will create a
series of messages with the same transmission reason.
The number and time between messages in a Security transmission session is defined in a
Security Section of that document.
IMPORTANT: Any event can be created in multiple ways simultaneously.
4.5 Active Logged (Plain) Event

The “Active Logged Event” is a new configurable feature designed to enhance the
functionality of legacy logged events. The feature affects all events configured as logged
(or plain). Enabling the “Active Logged Event” feature changes the behavior of the system
in the following way:
 During Hibernation
When a new event is generated, the unit will turn its modem and GPS on, wait for a
GPS fix and then queue the event into the event queue. The event will be transmitted
to the server, acknowledged by the server and removed from the queue. “Active
Logged Event” turns the unit on from hibernation for up to 2 minutes. If a GPS fix is
not detected within 1.5 minutes from the beginning of the session, the event will be
queued into the events queue and sent towards the server while giving an extra 30
seconds for the server to acknowledge the event. If a Cellular link is not available the
unit will be turned off and the message will wait in the queue for later delivery.
Event
1.5 Minutes 30 Sec
Wait for GPS Fix
Queue Event
Transmit Event
Ack. From Server
 During Live Tracking

When a new event is generated, and the GPS is off (in CelloTrack units), the unit will

Cellocator Cello
Programming Manual
turn the GPS on, wait for a fix and then insert the event into the event queue.
The “Active Logged Event” feature is important for units, such as CelloTrack, which are
battery operated and mostly hibernating while periodically communicating with the
server. Prior to this feature, users had to configure both “Event” and “Distress” bits to
achieve this functionality.

Cellocator Cello
Programming Manual
5 Address and Bitmask Field Allocation Tables

This section describes the addresses and bit mask field allocations. Where relevant, there
are references to corresponding sections, where you can find further information.
 Address allocation table, see below
 Bitmask Field allocation tables, page 26
5.1 Address Allocation Table

Address Purpose
0 Application Configuration byte 1
2 CelloTrack: Configuration
3-4 Hibernation mode communication settings
5 Unused
8 - 31 Operational Sever - PPP Username
32-34 Trip for a Distance event in Roaming mode
35 Time/Distance alert multipliers for High Speed in Roaming GSM
36 - 65 Operational Sever - APN
66 - 69 Default Target IP Address (for GPRS)
70 - 71 Time between Idle Transmissions
72 - 73 Time between Distress Transmissions
74 Operational Server - Modem type code
75 Number of Distress transmissions
76 - 79 GPS odometer's current value
80 - 83 Base unit (measurement factor of GPS odometer)
84 Max Time between GPS readings for SxT calculation

Cellocator Cello
Programming Manual
Address Purpose
85 - 88 GPS odometer - Last Distance Event (in base units)
89 - 91 Trip for a Distance event (in base units)
92 Time/Distance alert multipliers for High Speed in Home GSM
93 Over Speed velocity threshold for GPS Over Speed Start event
94 Over Speed velocity threshold for GPS Over Speed End event
95 Over Speed time event filter
96 Idle Speed Velocity threshold for GPS Idle End event
97 Idle Speed Velocity threshold for GPS Idle Speed Start event
98 Idle Speed event time filter
99 GPS Events Mask Bitmap
100 - 101 Inputs Logic Invert Mask
102 GPS Distress Triggers Bitmapped mask
104 Journey Start Event time filter
105 Journey Stop Event time filter
106 Time Report Period Value
107 - 108 Listening UDP Port (while connected to both operational server or
maintenance server)
109 - 110 Operational server TCP/UDP Target Port
115 Main Power Low threshold - high level
116 Main Power Low threshold - low level
121 Mask of Analog Inputs Events
122 Mask of Analog Inputs Distress
124 - 125 Inputs Events mask – on Falling
126 - 127 Inputs Events mask – on Rising
128 - 129 Inputs Distress mode mask - on Falling

Cellocator Cello
Programming Manual
Address Purpose
130 - 131 Inputs Distress mode mask - on Rising
132 - 133 Towing detection – Speed threshold
134 - 135 Towing detection – Geo-Fence perimeter
136 Common Discrete Inputs change Time filter
137 Towing detection filter
138 Maximum Backup Battery extra charge time
139 Message Transit Acknowledge timeout
140 Outputs pulse width period
141 - 164 Operational Sever - PPP Password
165 - 166 Modem Reset Period
167 - 176 BCALL (Brake down) Destination number
177 - 186 SMS Center Address
187 - 196 SMS Default Destination Address
197 - 200 SIM PIN code
201 - 202 Communication settings in Home GSM Network Mode
203 - 204 Communication settings in Roam GSM Network Mode
205 Advanced GSM Jamming Detection – Ignition Off - 1st activated output
(Infrastructure)
206 Advanced GSM Jamming Detection – Ignition Off - Template of 1st

activated output (1st byte) (Infrastructure)
207 Advanced GSM Jamming Detection – Ignition Off - Template of 1st

activated output (2nd byte) (Infrastructure)
208 Advanced GSM Jamming Detection – Ignition Off – 2nd activated output
209 Advanced GSM Jamming Detection – Ignition Off - Template of 2nd

activated output (1st byte) (Infrastructure)
210 Advanced GSM Jamming Detection – Ignition Off - Template of 2nd

activated output (2nd byte)

Cellocator Cello
Programming Manual
Address Purpose
211 Advanced GSM Jamming Detection – Ignition Off - Delay for output
activation for the 1st output (Infrastructure)
212 Advanced GSM Jamming Detection – Ignition Off - Delay for output
activation for the 2nd output (Infrastructure)
213 Advanced GSM Jamming Detection – Jamming Detection Time Filter:

Jamming detection time in resolution of 3 Seconds. Ranges between 3
Seconds to 765 Seconds. Default 10 Seconds (Infrastructure)
214 Advanced GSM Jamming detection – Ignition On and Ignition Off

Jamming End Time Filter (15 Sec resolution)
(Infrastructure)
215 Logged Events Amount for Upload Offline Events
216-217 Unused
218-219 Logged Events Upload Periodic Timer
220 Timeout before switching off the modem
221 Number of Logged Events Upload Retries
222 Time Between Logged Events Upload Retries
223-224 Local Timer to Upload Logged Events
225-226 Movement Timer Before Local Timer Activation
227-229 Unused
2301 Modem On Delay Timer
231-234 Unused
250-254 Unused
255 Offline Tracking - Auto Upload configuration
256-258 Unused
259-260 Offline Tracking - Time to Auto Upload after Trip Stop
263 GPS Peeking – Max. On Time
1
Available only for CR300B (New Platform) from FW version 43m and later, and for CR300B
(Legacy) from FW version 43h and later.

Cellocator Cello
Programming Manual
Address Purpose
264 - 265 GPS Peeking – Off Time
266 Power Management mode
267 GSM Peeking – Maximum Modem On Time
268 - 269 GSM Peeking – Off Time
270 GSM Peeking – Maximum Network Registration Time
271 - 272 Hibernation Mode Delay
283 Number of retries to forward data over UDP
284 Anti-Flooding timer
285 Garmin Configuration

CelloTrack Configuration 1
288-299 Unused
350-411 Unused
402-411 Unused
412 Security - Max. Amount of failure samples
413 Security – Pre-arming Time
414 Security - Time to Passive Arming
415 Security - Time to Pre-Arming
416 Security - Silent delay time
417 Security - Maximum time in Garage mode
418-420 Reserved, ex. Security - Security inputs invert bitmap
421 Security - Trigger an Alarm upon Towing Detection during Alarm Armed
422 - 425 Security - Security inputs mask bitmap
426 Security - Number of Security transmissions
427 Security - Time between Security transmissions
428 Security - Logic configuration

Cellocator Cello
Programming Manual
Address Purpose
454 Max Extra GPS On Time for Distress Mode
455 Velocity threshold for HIGH SPEED mode
465 Additional inputs functionality control bitmask
466 Analog Measurement Averaging Time
467 Accelerometer Configuration
468 Voltage Level Threshold IgnitionOn Detection
469 Internal variable: AHR counter
471-472 UART configuration
473 Speed Range Threshold V0
476 Harsh Braking Threshold for Speed range 0
480 Course Delta Threshold for Speed range 0
485 Time Based Alert Period Multiplier for NOIP mode
492 Idle Speed Alerts Control Bitmask
493 Time Based Events Mask Bitmap
494 Time Based Distress Mask Bitmap
495 HRLS Trigger Mask Time Based Events (not supported, Infrastructure
only)

Cellocator Cello
Programming Manual
Address Purpose
496 GPS Events Mask (second byte, the first is on 99)
497 Active GPS Distress Triggers Bitmapped mask (second byte, the first is
on 102)
498 HRLS Trigger Mask of GPS Events (second byte, the first is on 103)
499 Time event period in Roaming
500 GPS Navigation Start/Stop Filter
501 Disable Continuous Output Activation after SW Reset Bitmask
504 Maximum number of AHR retries
509 Vehicle’s Driver speed delta relative to GPS speed
511 Acceleration Threshold for Speed range 0
515 Registration Lack Timeout (for Modem’s AHR)
540 -603 Extended Events Control Bits array: 256 entries of 2 Bits representing
the extended configurable option for each of the fleet events.
800-999 White list phone numbers for dial-in
1004 Geo-Fence Alert Mask for events
1005 Geo-Fence Alert Mask for distress
1006 GeoFence filter threshold
1008 Roaming Operator’s Management - Timer of Auto-Search
1009 Roaming Operator’s Management - Number of PLMNs programmed
1010-1012 Roaming Operator’s Management - PLMN 1
…. ….

Cellocator Cello
Programming Manual
Address Purpose
1314 - 1317 Reserved for Customer’s Use

designed to store customer’s proprietary data (like specific EEPROM
content identifier)
1318 Configuration 1 (legacy 285)
1319 GPS based movement timeOut
1322-1325 Geofence Outputs activation 0-3
1326-1329 New SIM PIN
1330 First Usage Counter input
1331 Second Usage Counter input
1332 Usage Counter Reporting interval
1337-1338 Advanced Glancing (peeking): Glancing time for movement and not
charging state.
1339-1340 Advanced Glancing (peeking): Glancing time for No movement and

charging state.
1341-1342 Advanced Glancing (peeking): Glancing time for movement and

charging state.
1344 Wake Up message configuration
1346 Period between the alerts, triggered by detection of power

disconnection
1352 Periodical Modem Reset Randomization threshold
1353 Anti-flooding randomization threshold
1387-1388 Go / Halt Speed Detection threshold
1389 Go / Halt Time threshold filter
1390 Go / Halt – Session Control Bitmask
1391 Modem type code for Maintenance Server

Cellocator Cello
Programming Manual
Address Purpose
1392-1395 Maintenance Server IP address
1396-1397 Maintenance Server Target Port
1398 Maintenance Server configuration bitmask
1399 Maintenance Server connection period
1400 Maintenance Server Session Time Update
1403-1432 Maintenance Server APN
1433 Vector Change Detection Bitmask
1434 Compressed Vector Change Report Timeout
1435 Vector Change Detection angle
1444 Cellular Network Selection
1446 Power configuration settings
1447 Activation/Deactivation Procedure options
1614-1615 Glancing at Specific Time
1616 GPS peeking On time during Live Tracking
1619 Time event resolution multiplier for “external power” mode
1620 Select Measurement source reported in Byte 26 of OTA Msg type 0
1625 GPS DOP Threshold
1626-1649 Maintenance Server APN Username
1650-1673 Maintenance Server APN Password
1711 Reserved for manufacturer usage (Timer of retry of SIM operation

upon failure)
1847-1913 Nano Phase-2 parameters

Cellocator Cello
Programming Manual
Address Purpose
1914 Lock to Certain IMSI
1921-2020 Geo Fence heading angle (Infrastructure)
2021-2022 BT-extender configuration
2044 Tilt Tamper Messaging
2045 Tilt Tamper Angle Change Threshold
2046 Tilt Tamper Time Filter
2050 Orientation Change Messaging
2051 Orientation Change Angle Change Threshold
2052 Orientation Change Time Filter
2039-2091 CelloTrack Nano and BT Extender area
2092-2347 MultiSense parameters
2348-2367 CelloTrack Nano area and BT Extender area
2394 -2425 Default target DNS Address (for Maintenance Server)
2464-2495 Operational Server DNS Address
2496-2516 Geo-Fence 1 Configuration
…. ….
4080-4095 Geo-Fence 100 Configuration
5.2 Bitmask Field Allocations

This field describes the allocation of configuration bits in the bitmap configuration bytes.
The description of each bit is provided in other sections in this document.

Cellocator Cello
Programming Manual
5.2.1 Application Configuration

Address: 0, Application Configuration byte 1
Presentation Enable Enable Active

Ignition filter
of inputs in conditional infinite Logged
Enable warning source for
wireless activation driver (Plain)
Enable Long output starting
Cellocator of notification Events
Transparent Transmission activation Driver
protocol immobilizer when Enable
Mode Ack. Timeout during Gradual Authentication
Driver is
immobilization time
not
calculations
identified
Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Wake up Enable Enable Enable Generate an Ignore Geo- Shorten

from Command Immobilizer modem’s event per Violations on cellular
hibernation Authentication activation power AHR Boot registration
upon while there is control by timeout
periodical no Door
Usage Authenticatio input
counter n code
update timer
expiration
Bits 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Address: 3, Hibernation mode communication settings
Reserved Reserved Renew GPRS

upon drop in
(in semi-
hibernation)
Bits 7 Bits 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Address: 4, Hibernation mode communication settings
Enable Pre- Enable Pre- Reserved Enable

Hibernation Hibernation Intermediat
distress event e state of
Anti-
flooding in
semi-
hibernation

Cellocator Cello
Programming Manual
Overlapping GPS Reset GPS Reset Disable Active

Geo-Fence on ignition on ignition Transmissions
logic: off off
Global/ When not in When in
Discrete navigation Navigation
Synchronize Enable
unit’s time Usage
with GPS Counters
time only
when GPS is
navigating
Bit 7 Bit 6 Bit 5 Bit 4 Bit3 Bit 2 Bit 1 Bit 0
Enable
Max
Speed
Report
Enable Consider Disable GSM Enable

Offline Unknown Jamming Event Auto
tracking Operators (Legacy + SIM PIN
As Ignition On) locking
Forbidden
Enable
Monitoring
logical
status of
Ignition in
OTA
packets
Periodic
Transmission
(in battery
saving

Cellocator Cello
Programming Manual
mode) -
Type-0
0-Disable
1-Enable
5.2.2 Communication Events Mask

Address: 604
Unused Unused Unused Unused Unused Unused Enable Voice SMS Delivery
Call Events Confirmation
event enable
5.2.3 Communication Settings in Home/Roam GSM Network Mode

Address: Home GSM: 201; Roam GSM: 203; Hibernation: 3
Enable SMS Enforce SMS Generate Generate GPRS Enable Generate Generate
Destination Cell ID Cell ID Cell ID Cell ID
packet (RT) packet packet (RT) packet
with any (logged) with any (logged)
distress with any distress with any
while there event while unconditiona event
is no valid there is no lly unconditiona
GPS valid GPS lly
Address: Home GSM: 202; Roam GSM: 204; Hibernation: 4
Unused Disable Disable Enable Enable IP Enable Auto Answer

forward from active incoming up event Intermediate Voice call (if
serial port to transmissions Voice Call state of Anti- incoming
SMS via SMS flooding voice
enabled)
5.2.4 WAKE UP Message Configuration

Address: 1344
2
Available only for CR300B (New Platform) from FW version 43m and later, and for CR300B
(Legacy) from FW version 43l and later.

Cellocator Cello
Programming Manual
Enable GPRS Enable SMS Number of repetitions,

Wake up Wake up
Value of zero set number of retries to 64
message message
5.2.5 GPS Management Bitmap

Address: 509
Enable Tight GPS Not used CR200/CR300 Reset last known Enable Pythagoras Enable Speed x Time
PMODE Filter GPS location on Ignition Calculation Calculation (SxT)
management off
Enable
0-Normal
1-Managed
Bit 7 Bits Bit 3 Bit 2 Bit 1 Bit 0

6,5,4
5.2.6 Maintenance Server Configuration Bitmap

Address: 1398
Reserved Enable Modem Enable auto Reconnect to Enable Enable Enable

FW Upgrade connection to the connection to firmware programming
from the maintenance maintenance the upgrade from updates from
Maintenance server server after maintenance the the
Server firmware server on each maintenance maintenance
upgrade power up. server server
Bit 6-7 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
5.2.7 UART Configuration

Address: 471
Reserved Baud rate
Address: 472
Reserved Flow Control Stop Bits Parity

Cellocator Cello
Programming Manual
5.2.8 Alternative Inputs Usage Bitmap

Address: 465
Bits 5-7 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
5.2.9 Time Based Mask Bitmap

Address: 493 for events
494 for distress
Only in 494 Unused Enable Time Enable event for

events Communication Idle
Do not wake up from

hibernation upon comm.idle
distress
5.2.10 Over (and Idle) Speed Session Control Bitmap

Address: 492
Create Idle/Over Start Idle speed Don’t use time Don’t use time Multiplier for filter of Idle Speed Start
Speed End event timer with ignition filter to close Idle filter to close Session
for open session On speed session Over speed
per ignition Off session
5.2.11 Go/Halt Session Control Bitmap

Address: 1390
Spare Spare Don’t use time Multiplier for Go/Halt Time Threshold filter
threshold filter for
For "Halt" detection
"Go" detection
Bit 7 Bits 5,6 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
5.2.12 GPS Alerts Mask Bitmap

Address: 99 For events

Cellocator Cello
Programming Manual
102 For distress
Enable event Enable event Enable Enable Enable Idle Enable Over Enable Enable GPS
upon upon speed Sudden Sudden Speed Speed Distance Navigation
location detection Course Speed Events Events Events Start/Stop
change when Change Change Events
detection Ignition Off Sensor sensor
when
Ignition Off
Address: 496 For events

497 For Distress
Not used Enable Go/Halt Enable Event per Enable GPS

Events GPS Auto Factory Disconnection
reset
0 – Disable
1 - Enable
5.2.13 Time Report Period Value (Home, Roam, High Speed)

Address: For Home GSM: 106
For Roam GSM: 499
Resolution Basic Period Value (BPV)

Definer
5.2.14 Time/Distance Alert Multipliers for High Speed Mode

Address: For Home GSM: 92
For Roam GSM: 35
Time Event Multiplier for HIGH SPEED mode Distance Event Multiplier for HIGH SPEED mode

Cellocator Cello
Programming Manual
5.2.15 Discrete Inputs Masks

Address: For Inversion 100-101
Inputs Events on Falling 124-125
Inputs Events on Rising 126-127
Inputs Distress on Falling 128-129
Inputs Distress on Rising 130-131
HRLS Trigger Mask of Inputs Falling 486-487
HRLS Trigger Mask of Inputs Rising 488-489
Security inputs mask bitmap 422-425
Lower byte
Driving
Status GP1
Panic (dry contact

(Ignition or input in power
accelerometer harness)
based)
Important notes:
 The GP1 (dry contact input in power harness of the Nano), is active only while the
power harness is actively supplying power to the unit.
 The distress and the events are applicable when the input mode is set to either
“Normal” or "Dry contact input mode selection" (per address 2046 bits 4-5).
 The invert bit doesn’t affect the raw value shown on IO bytes in type-0 (byte 21 bit 2)
or in its encapsulated form as Type-11 module 41.
5.2.16 Mask of Analog Inputs Alerts

Address: 121 for events, 122 for distress, 490 for HRLS
Ignition Switch On Ignition Switch Off
Backup battery Main Main Power Backup battery Main Power

disconnected Power Disconnected disconnected Disconnected
Low
Charging Level Charging Battery
voltage voltage low level
power Event power Event

Cellocator Cello
Programming Manual
5.2.17 Disable Continuous Output Activation after SW Reset Bitmask

Address: 501
Reserved Reserved Blinkers LED St. Reserved Siren Gradual

Immobilizer Stop
5.2.18 Geo-Fence Alert Mask

Address: 1004 - For events
1005 - For distress
Unused Speed No Modem Geo Hot Way Point Keep Out Keep In
Limiting Zone Entry Spot violation Fence Fence
Geo-Fence Traversal violation violation
Event
5.2.19 Offline Tracking - Auto Upload Configuration

Address: 255
Unused Memory Ignition Off

Full Event
5.2.20 Security Settings Bitmask 1

Address: 421
Unused Trigger an Alarm Upon

Towing Detection During
Alarm Armed

Cellocator Cello
Programming Manual
5.2.21 Security Settings Bitmask 2

Address: 424
`Unused Trigger an Alarm Upon

Main Power Disconnection
Detection
5.2.22 Security Logic Configuration

Address: 428
Unused Auto-gradual Unused Auto Arming Disable Auto Does Not Unused
stop Enable Independent Arming Trigger
from door Silent
delay upon
Unlock
detection
5.2.23 Active Correlation Lines

Address: 287
Unused Shock (pin 15) Unlock (pin 11) Lock (pin 5)
5.2.24 Vector Change Detection Bitmask

Address: 1433
Reserved Prevent Enable Enable Enable

Curve Compress Vector Vector
Smoothing Vector change change
Message change Detection Detection
generation Detection Distress Events
during "Halt"
mode

Cellocator Cello
Programming Manual
5.2.25 Accelerometer Configuration

Address: 467
Enable Towed Start & Stop Detection Movement Enable GPS Use
mode Detection Sensitivity Detection wake up upon "movement
0 - Disable Using Voltage 0 - Very type: movement for detection" by
Level and insensitive (movement / towing accelerometer
1 - Enable Accelerometer engine status) detection for Start/Stop
1 - Normal
0 – Disable (don't care if 0 – Start/Stop
2 - Very bit 0 is set) alerts by
1 – Enable sensitive 0 – movement
status of
1 – engine 0 – Don't use
3 - spare Ignition switch
status 1 – Use. (legacy),
1 – Start/Stop
alerts by
movement
detection using
accelerometer.
If this bit is
enabled, all
the logic
normally
dependent on
status of
Ignition Switch
will be re-
linked to the
status of
Movement
detection.
Bit 7 Bit 6 Bit 5 Bits 3-4 Bit 2 Bit 1 Bit 0

Cellocator Cello
Programming Manual
6 Communication and Configuration
6.1 Communication Events
6.1.1 Enable Voice Call Events
Address: 604, bit 1

Description: This parameter enables to send logged events upon start/stop of
incoming/outgoing voice calls.
Whenever a voice session is started and ended, the unit will create a type-0 event with
TR=18:
 Upon start of incoming voice call, the unit will transmit a "Start Incoming Voice
Call" event (Type 0, TR 18, STR 1).
 Upon stop of incoming voice call, the unit will transmit a "Stop Incoming Voice
Call" event (Type 0, TR 18, STR 0).
Data Range: 1 - Enable, 0 - Disable
Default value: 0 - Disable
6.2 Communication Settings
6.2.1 GPRS Settings
6.2.1.1 Acknowledge OTA
6.2.1.1.1 Message Transit Acknowledge Timeout
Address: 139
This parameter defines the maximum time the unit will wait for server to acknowledge a
plain event (plain events are one of the four available event generation patterns proposed
by Cellocator unit; refer to the Event Types section in this document). If no ACK is
received by this time, the event will be retransmitted.
Event Delivery Algorithm
Once generated, a plain event is stored in the unit’s Log memory.
This Log memory can store up to 8946 plain events.
When the Log memory is full, newer events will push out the
older ones (FIFO). Events will be uploaded to the Control
Center only when GPRS is available and will be deleted from
the unit’s Log memory only when acknowledgment is received Log memory queue Pending event
Up to 8946 events waiting for Ack

Cellocator Cello
Programming Manual
from Central Control. NOTE: Plain events will never be delivered by SMS!
The unit supports one pending event waiting for server acknowledgment. When server
acknowledgment is received, the pending event is deleted from the Log memory head,
and the next event is moved to the pending event data structure in order to be sent to
the server.
NOTE: Legacy units used to have 16 concurrent pending events.
If the Acknowledge is not received during the time defined in Message Transit
Acknowledge Timeout, the event is resent.
Data format: 8-bit unsigned. Resolution is 20msec or 160mseconds, according to the
value of Acknowledge Timeout Extension Multiplier bit, see below.
Note that there is a separate control of ACK to forward data message from server to 3rd
party device connected to the serial port of the unit (application configuration byte 5).
Value span: 00h to FFh (=5.1sec or ~40 seconds)
Default value: 200 (4sec)
6.2.1.1.2 Acknowledge Timeout Extension Multiplier
Address: 0 bit 6
If this bit is enabled (1) the resolution of Message Transit Acknowledge Timeout
parameter will be 160mseconds/bit, otherwise 20msec/bit
Default value: 1 (160mseconds/bit)
6.2.1.2 Anti-flooding
The Anti-Flooding mechanism is designed to minimize the unit’s message Retransmissions
in situations where GPRS connection is available but the server is unreachable.
The Anti-flooding will randomize the idle communication time between message
retransmission sessions to avoid server overloading in situations where the server
becomes available after period of server unavailability and to avoid network overloading.

Cellocator Cello
Programming Manual
Configuration
Received Messages Anti-Flooding

Ack. Mechanism
Modem Reset
5 sessions 5 sessions
Pending 5 sessions
Message
Logged Events Events
Send Random
Queue Buffer
Process Communication
(up to 16) Idling
6 message
retransmissios
The block diagram above describes the Anti-Flooding mechanism. The Anti-Flooding
mechanism’s most important input is the received server acknowledgment; in case there
are no acknowledge messages returned from the server, the Anti-Flooding mechanism
will implement the following retry patterns:
Send each pending message 6 times while waiting for ack. between each transmission.
Repeat the above sessions 5 times.
Stop transmissions for a random time based on “Anti-Flooding timer” and “Anti-Flooding
randomization threshold” configurable parameters (see Anti-Flooding timer, Anti-Flooding
randomization threshold). This random period is defined in the diagram as “Random Communication
Idling”.
Reset the modem.
Go to step 1.
The Anti-Flooding has another sub operational mode called “Intermediate state of Anti-
Flooding” which when enabled blocks message transmission till only after IPUP is
acknowledged by the server. This operational mode will start logged events transmission
only after the server is guaranteed to be responsive. Enabling this mode will implement
the above Anti Flooding behavior only for IPUP messages while not saving IPUP events
into the log memory. Refer to Intermediate state of Anti-Flooding Activation Control. The
Intermediate Anti Flooding mode can be selected to work in Home network, Roam
network and in hibernation.
6.2.1.2.1 Anti-Flooding Timer
Address: 284
Description: This parameter defines a "communication idling" timeout, used by the unit
to decrease a communication costs during the server (CCC) failure.

Cellocator Cello
Programming Manual
Data format: 1 byte with a resolution of 1 minute

Value span: 0-255minutes, a value of zero means no delay between the sets
Default value: 0
6.2.1.2.2 Anti-Flooding Randomization Threshold
Address: 1353
Description: In case of server failure all the units are entering Anti-Flooding
simultaneously and, as a result, reconnecting to CC simultaneously after the Anti-Flooding
delay expires. This causes a heavy load of communication on the CC server and might
cause a new crash. In order to prevent this issue it is possible to randomize the Anti-
Flooding timer.
The timer is restarted every time with a different value, limited by a programmable
threshold.
(A – Ta)≤ Anti-flooding interval≤(A+ Ta)
A - Anti-flooding timer parameter
Ta - Anti-flooding threshold, programmed in EEPROM
Wrong programming protection:
if A≤Ta the unit will NOT use the low limit of randomization.
Data format: Resolution of programmable threshold is 30 seconds, 1 byte

Value span: 0-127 minutes, a value of zero means no randomization
Default value: 0
6.2.1.2.3 Enable IP Up Alert (Event)
Address: 202, bit 2 for home network

204, bit 2 for roam network
Description: The "IP up" alert is generated with every dial-up to GPRS in order to
update the Central Control with the resent IP address of the unit. In cases when SIM card
is associated with static IP, it is possible to cancel IP up events.
Note that “IP Up event” CANNOT be disabled if Intermediate state of Anti-flooding is
enabled.
Default value: 1 – both enabled
6.2.1.2.4 Intermediate state of Anti-Flooding Activation Control
Address: 202, bit 1 for home network

204, bit 1 for roam network
4, bit 1 for hibernation, if enabled for active GSM network

Cellocator Cello
Programming Manual
Description: If Intermediate state is enabled, the unit will not store IP Up events into log
memory. When dialing to GPRS, only IP Up messages will be sent to the server. The unit
will not try to download accumulated event before reception ACK to the IP Up message
(see Anti-flooding description above).
Default value: all three enabled (1). In CelloTrack family to save energy all three are
disabled.
6.2.1.2.5 Enable Active Logged (Plain) Events
Address: 0, Bit 0
Description: “Active Logged Events” is a new configurable feature designed to enhance
the functionality of legacy logged events. The feature affects all events configured as
logged (or plain). For more details refer to Active Logged (plain) Event.
Default value: Disable
6.2.1.3 Operational Server Support

The operational communication server is used for uploading positions and other events
from the end unit. Normally this will be a communication gateway of the Central Control
application.
6.2.1.3.1 Operational Server APN
Address: 36-65
Name in Programmer: APN
Description: This parameter contains an APN used upon dialing to an operational
communication server.
Data format: 30 bytes string, first byte is length
Value span: First byte 0 to 0x1D, second to 30th - ASCII characters
Default value: ASCII "internet"
6.2.1.3.2 Operational Server APN Username
Address: 8-31
Name in Programmer: GPRS PPP Username
Description: This parameter contains a PPP username used upon dialing to an APN
defined for operational server.
Value span: First byte 0 to 0x17, second to 24th - ASCII characters
Default value: ASCII "test"

Cellocator Cello
Programming Manual
6.2.1.3.3 Operational Server APN Password
Address: 141-164
Name in Programmer: GPRS PPP Password
Description: This parameter contains a PPP password, used upon dialing to an APN
defined for operational server.
Value span: First byte 0 to 0x17, second to 24th ASCII characters
Default value: zeroes
6.2.1.3.4 Operational Server IP Address
Address: 66 to 69
Name in Programmer: Default Target IP Address (for GPRS)
Description: Stores an IP address of the operational server. All the messages (both
active and passive, irrespectively to the source of the incoming command) during normal
operation will be sent to this IP address.
If this parameter contains zeros, the unit will use an operational DNS instead.
Data format: 4 bytes IP address, Intel order (low significant bytes first)
Default value: 0.0.0.0 (change to the IP address of central command)
6.2.1.3.5 Operational Server DNS Address
Address: 2464-2495
Name in Programmer: Default target DNS Address (operational server)
Description: The Domain Name System (DNS) is a hierarchical naming system for
computers, services, or any resource connected to the Internet or a private network. It
translates domain names meaningful to humans into the numerical (binary) identifiers
associated with networking equipment for the purpose of locating and addressing these
devices worldwide.
In our case the DNS support is required in order to prevent a necessity to assign a static
IP to each of the servers (operational and maintenance).
A domain name usually consists of two or more parts (technically labels), which are
conventionally written separated by dots, such as example.com.
 Cello supports down to 2 levels subdomains (e.g. XXX.XXX.XXX.XXX), maximum

length is 32 chars.
 Labels are restricted to a small subset of the ASCII character set known as LDH,
the Letters A–Z in upper and lower case, Digits 0–9, Hyphen, and the dot to separate
LDH-labels; see RFC 3696 section 2 for details.

Cellocator Cello
Programming Manual
The DNS will be used for dial up only if the IP address field of the corresponding server
(in programming memory) is set to zero (e.g., 0.0.0.0).
If the IP address field of the corresponding server is not set to zero – the unit shall use
this IP address for dial up.
Data format: 32 bytes string, first byte is length.
6.2.1.3.6 Listening UDP Port (while connected to both Operational Server or

Maintenance Server)
Address: 107-108
Name in Programmer: GPRS Self Port
Description: This parameter stores the listening UDP port. This should be the
"destination port" of incoming UDP messages, it will also be sent as a "source port" of an
outgoing transmissions.
Value resolution & span: 0- 65535’
Default value: 231
6.2.1.3.7 Operational Server Target Port
Address: 109 -110

Description: This parameter stores the "destination port" of outgoing UDP or TCP
(depends on Modem Type code) messages while connected to the operational server. This
will be the also listening UDP or TCP port of target host.
Value resolution & span: 0- 65535’
Default value: 231
6.2.1.3.8 Modem Type Code for Operational Server
Address: 74
Description: This parameter defines dial up type, which is differs according to the
communication platform and modem connected.
Valid values: According to the table below:
Value Network
0 UDP/IP over GPRS
1-3 Not supported
4 TCP/IP over GPRS
Default value: 4 - TCP/IP over GPRS

Cellocator Cello
Programming Manual
6.2.1.4 Maintenance Server Support

The Cellocator unit supports a periodic connection to the maintenance server, which is
used as a Service & Support Server.
It is possible to set an additional APN, IP address, ports and dial up type for the
Maintenance Server; this server will be used for a periodical service communication
sessions.
It is also possible to force the unit to connect to the specific server manually, using the
OTA command (SMS or GPRS). If the command to connect to maintenance server is
received during the communication peak of full hibernation – the unit will connect to
maintenance server upon the end of the peeking.
The unit periodically connects (completely drop an existing connection and redial using
the dedicated APN) to this server in order to check for the latest firmware and/or
programming update. It is possible to enable auto connection to the maintenance server
upon power up and upon firmware upgrade.
The connection to the maintenance server:
 In TCP mode - TCP socket establishment and a Maintenance Platform Manifest* packet
paste into this socket.
 In UDP mode - it will be just a Maintenance Platform Manifest* UDP packet delivery to
the Maintenance server and use listening port according to the configuration of the
maintenance server.
An acknowledge (OTA message type 4) should be received in with a defined timeout;
otherwise the platform manifest will be resent.
In case the unit cannot establish a connection to the maintenance server while the GPRS
is available, it will use a dial up retry algorithm defined in Anti-Flooding section of this
document.
If all the retries fail, the unit will stop trying and connect back to an operational server
(instead of entering Anti-Flooding, as it would do while connected to an operational
server).
If the timeout of periodical connection to the maintenance server expires while the unit is
hibernating, it will not wake up; instead it will dial the maintenance server immediately
after the next COM glancing.
It is possible to disable firmware upgrades or programming from the maintenance server.
The unit automatically disconnects from the maintenance server and connects back to its
operational communication server after 3 minutes after the last communication
transaction.
The unit does NOT send logged or distress events to the maintenance server. It keeps
logging events as usual during the maintenance session (except during firmware
upgrades) but does not upload them. The unit will reply to commands sent from a
maintenance server.
Distress alerts and real time based alerts that occurred during the maintenance session
will be lost.

Cellocator Cello
Programming Manual
The unit will ignore the incoming voice calls and the incoming SMS notification during the
maintenance session (the SMS will be processed after the maintenance session end).
Outgoing voice call initiation attempts (both plain and emergency) are ignored during the
maintenance session.
After any reset occurred during the maintenance session (except the final reset of
firmware upgrade procedure, see bitmap below) the unit will connect back to the primary
server.
6.2.1.4.1 Enable Programming Updates from the Maintenance Server
Address: 1398, Bit 0

Description: If this bit is enabled the unit will accept updates of programming
parameters from maintenance server.
6.2.1.4.2 Enable Firmware Upgrade from the Maintenance Server

Description: If this bit is enabled the unit will perform firmware upgrade if the process
will be initiated from maintenance server.
Default value: 0 – Disable
6.2.1.4.3 Enable Connection to the Maintenance Server on each Power-Up.

Description: If this bit is enabled the unit will automatically connect to the maintenance
server upon each power up.
6.2.1.4.4 Reconnect to the Maintenance Server after Firmware Upgrade

Description: If this bit is enabled the unit will automatically reconnect to the
maintenance server after firmware upgrade (irrespectively from what server, main or
backup, the upgrade was performed).
If this bit is disabled the unit will connect back to an operational server immediately upon
the end of the upgrade, without even validation of the upgrade process success.
Reconnection to the maintenance server after firmware upgrade is normally required in
order to validate successful firmware upgrade and to set up new added configuration
parameters.

Cellocator Cello
Programming Manual
6.2.1.4.5 Enable Auto Connection to Maintenance Server

Description: If this bit is disabled the unit will never try connecting to the maintenance
server automatically (even if enabled in previous bits), but it will still be possible to force
the unit to connect to the maintenance server by a command from OTA.
6.2.1.4.6 Maintenance Server Connection Period
Address: 1399
Description: This parameter defines a time between automatic maintenance sessions.
Maintenance server connection period will automatically randomize, in order to prevent a
load on the maintenance server, caused by simultaneous connection of multiple units.
The randomization is affected by a unit's ID in the following way:
Real period = Programmed Period + {last 2 digits of decimal representing of unit's ID}
[min]
Data format: 1 byte with a resolution of 90 minutes (1.5 hours).
In case of zero, the real period will be only {last 2 digits of decimal representing of unit's
ID} [min]
Value span: 0-15.9 days
Default value: 16 dec (1 day)
6.2.1.4.7 Maintenance Server APN
Address: 1403-1432
Description: This parameter define a dedicated APN, used by the unit during GPRS dial
up only during a connection to the maintenance server.
Value span: 1st byte – 0 to 0x1D, 2nd to 30th - ASCII characters
Default value (Hex): 08 69 6E 74 65 72 65 61 6C 00 …
6.2.1.4.8 Maintenance Server APN Username
Address: 1626-1649
Description: This parameter contains a PPP username used upon dialing to an APN
defined for the maintenance server.
Value span: First byte 0 to 0x17, second to 24th - ASCII characters
Default value (Hex): 04 74 65 73 74 00 00 00 00 00 00 00 …. 00

Cellocator Cello
Programming Manual
6.2.1.4.9 Maintenance Server APN Password
Address: 1650-1673
Description: This parameter contains a PPP password, used upon dialing to an APN
defined for the maintenance server.
Value span: First byte 0 to 0x17, second to 24th ASCII characters
Default value (Hex): 00 00 00 00 00 00 00 00 00 00 00 00
6.2.1.4.10 IP Address (for GPRS) for Maintenance Server
Address: 1392 to 1395

Description: Stores the target IP address used by the unit during a maintenance
session.
Data format: 4 bytes IP address, Intel order (low significant bytes first)
Default value: 62.90.141.201 (current main maintenance server)
6.2.1.4.11 Default Target DNS Address (Maintenance Server)
Address: 2394-2425
Description: As per the DNS for the operational server, described earlier in this
document.
The DNS will be used for dial up only if the Maintenance Server IP Address field is set to
zero (e.g., 0.0.0.0). If the IP address field is not set to zero, the unit will use this IP
address for dial up.
6.2.1.4.12 GPRS Target Port for Maintenance Server
Address: 1396-1397
Description: Those EEPROM cells store the "destination port" of outgoing UDP or TCP
messages (during the maintenance session). This will also be the listening UDP or TCP
port of target host.
Value resolution & span: 0 - 65535
Default value: 7435
6.2.1.4.13 Listening UDP Port for Maintenance Server
Address: 107 -108

Name in Programmer: Listening UDP Port

Cellocator Cello
Programming Manual
Description: As per for the operational server.
6.2.1.4.14 Modem Type Code for Maintenance Server
Address: 1391
Description: This parameter defines the connection type of the maintenance server.
Valid values: According to the table below:
Value Network
0 UDP/IP over GPRS
1-3 Not supported
4 TCP/IP over GPRS
Default value: 0
6.2.1.4.15 Maintenance Server Session Time Update
Address: 1400
Description: The maintenance server will use default 3 Min session timeout when first
connecting to the C+ server. After the first message arrives from the maintenance server
to the unit, the FW will cancel the 3 Min time out, or what is left of it, and replace it with
a new session timeout value defined by this parameter.
Valid values: Min time 30 Sec: 3
Resolution: 10 Sec
Default value: 90 Seconds

Cellocator Cello
Programming Manual
6.2.2 SMS Settings
6.2.2.1 SMS Destination Address
Addresses: 187-196
Description: Stores the default target address used by the unit. Under normal
circumstances, this will be the SMS number of the SMS server of central control.
Note that this parameter defines only the default target address, which will be used only
for active transmissions (i.e. transmissions that are automatically generated by the unit).
Passive transmissions (i.e. replies for commands and queries) will be sent to the address
that generated the command/query.
Data format (GSM-SMS): First byte should contain the total amount of digits that make
up the actual address (not including address type byte). Second byte is the address type
byte, which should be 91h for international address (recommended type to use, to allow
roaming) or 81h for local address. The rest of the bytes contain the actual address,
encoded in BCD. The order of the transmission is bytes with lower address first, lower
nibbles (nibble = 4 bit) first. If only the lower nibble of a byte is used (this is legal only in
the last byte – in case this is the last digit of the address), the higher nibble should have
all of its bits set (the nibble should contain 15 dec). The rest of the bytes that are not
used should contain FFh.
Default value: NULL.
6.2.2.2 SMS Center Address
Addresses: 177 – 186

Name in Programmer: SMSC Address
Description: This parameter stores the address of the cellular operator’s SMS center.
This parameter is applicable only for units that make use of SMS.
Data format (GSM-SMS): First byte should contain the total amount of bytes that
actually contain the address (including address type byte). Second byte is the address
type byte, which should be 91h for international address (recommended type to use, to
allow roaming) or 81h for local address. The rest of the bytes contain the actual address,
encoded in BCD. The order of the transmission is bytes with lower address first, lower
nibbles (nibble = 4 bit) first. If only the lower nibble of a byte is used (this is legal only in
the last byte – in case this is the last digit of the address), the higher nibble should have
all of its bits set (the nibble should contain dec 15). The rest of the bytes that are not
used should contain FFh.
This number has to be either left blank or set to the correct value; otherwise the unit will
not be able to send any SMS message.
Example: If the parameter contains 07h 91h 79h 52h 14h 32h 54h F6h FFh, the address
that will be used is the international address +972-54-123456, from left to right.
Default value: NULL (blank).

Cellocator Cello
Programming Manual
6.2.3 Comm. Permissions in Home/Roam Network
6.2.3.1 Enable GPRS
Address: In home network 201 bit 2, in Roam network 203 bit 2, in hibernation 3, bit 2
(see the following parameter).
Description: If this parameter is enabled the unit will utilize GPRS whenever possible as
a default communication channel.
Default value: Enabled (1) In Home network, Disabled (0) in Roaming
6.2.3.2 Renew GPRS upon Drop (in Hibernation, GPS Peeking)
Address: 3, bit 2
Description: If GPRS is enabled, the unit will try maintaining GPRS session active all the
time, even if there is no data to transfer (for example on parking, during one of the
hibernation modes).
Due to resource reasons the GPRS network is searching for an idling connections and
actively shutting them down. Once the connection is down - the unit will try redialing the
network and generate an additional useless traffic and charge.
If this bit is disabled, the unit will not renew the GPRS session during hibernation upon
drop. The session will be restored only in case the unit is leaving hibernation due to an
Ignition On or Distress Session.
This bit can also be disabled when it is required to prevent GPRS dial up during GSM
peeks (in full hibernation only).
Default: 1 (renew session)
6.2.3.3 Enable SMS
Address: In home network 201 bit 7, in Roam network 203 bit 7

Description: If this parameter is enabled the unit will respond to a valid incoming SMS
commands and generate an active distress and real-time messages (if enabled in the next
parameter) when GPRS is not available.
Default value: Enabled in both Home and Roaming (1)
6.2.3.4 Enable Active Transmissions via SMS
Address: In home network 202 bit 4, in Roam network 204 bit 4

Description: If this parameter is disabled, the unit will not generate any active SMS
traffic (distress or real-time, except the "Wake Up" SMS messages, see description
below), even if SMS communication is enabled in previous parameter.
Default value: Disable (1)

Cellocator Cello
Programming Manual
6.2.4 COM port settings

Note that not all the available options are currently supported.
6.2.4.1 Baud rate
Address: 471, bits 0-3

Description: Defines the baud rate of unit's COM, as per the table below:
Value (dec) Baud rate (bps) Currently

supported
0 110
1 300
2 600
3 1200
4 2400
5 4800
6 9600 √
7 14400
8 19200 √
9 38400
10 56000
11 57600
12 115200 √ (default)
13 128000
14 256000
15 460800 √
Default: 12
6.2.4.2 Parity

Description: Defines the parity of unit's COM as per the table below:

Cellocator Cello
Programming Manual
Value (dec) Parity Currently supported
0 No Parity √ (default)
1 Odd Parity
2 Even Parity
3 Mark Parity
4 Space Parity
5-7 Unused
Default: 0
6.2.4.3 Stop Bits

Description: Defines the stop bits of unit's COM, as per the table below:
Value (dec) Stop Bits Currently supported
0 One Stop Bit √ (default)
1 1.5 Stop Bits
2 Two stop bits
3 Unused
Default values: 0
6.2.4.4 Flow Control

Description: Defines the flow control of unit's COM, as per the table below:
Value (dec) Flow Control Currently supported
0 No Flow Control √ (default)
1 Software flow
control
2 Hardware flow
control
3 Unused
Default values: 0

Cellocator Cello
Programming Manual
6.2.5 Distress Session Configuration

A Distress Session is one of four possible ways to deliver data to a Central Control (refer
to the Event Types generated by Cellocator devices section).
If the condition for the specific event is met, the unit will create a series of messages with
the same transmission reason. The messages will be uploaded to the Control Center
immediately with the first available communication transport (during IP session – over IP,
otherwise by SMS). The messages are not stored in the memory and if there is no cellular
coverage at the moment of sending – the message will be lost. Distress events do not
require any kind of acknowledge.
The number and time between messages in Distress Session is defined in parameters
below, but can be temporary overwritten by Distress Session initiation OTA command.
Distress session caused by the same trigger, occurred while the first session is not over
yet restarts the session from the beginning.
Distress session caused by different trigger, occurred while the first session is not over
yet causes new distress session (up to 5 distress sessions might be maintained
concurrently). The 6th distress session, while previous 5 are still active, will be lost.
It is also possible to initiate an endless (or specified duration) distress session by
command from CCC. Upon start, this session cancels all active distress sessions. The
session will be stopped by any other distress session or by a command from OTA.
6.2.5.1 Time between Distress Transmissions
Address: 72-73
Description: This parameter defines the amount of time between two consecutive
Distress Transmissions in distress session initiated by trigger of distress event.
The amount and the period of distress events generated during session initiated by OTA
command is defined by the command itself.
Data Format: 16-bit unsigned integer, 0.01 seconds resolution
Legal values span: 01h to FFFFh – 65535 (~11minutes)
Default value: 1000 (10 seconds)
6.2.5.2 Number of Distress Transmissions
Address: 75
Description: This parameter defines the amount of transmissions that will be generated
in a single distress session triggered by internal logic, if no more sensors are triggered.
The maximum time of single distress session is [this parameter]*[time between
transmissions]. Take into account up to another second per transmission (this is the time
that it takes the unit to prepare and arrange a transmission).
NOTE: A Distress session initiated by OTA command will contain the number of messages
specified in a command.

Cellocator Cello
Programming Manual
Legal values span: 01h (one transmission) through 00FFh (255 transmissions). 0 is
illegal.
Default value: 1
6.2.6 Wake Up Messages

In most of the cases the unit is sent to the installation site programmed with operational
PL file, but without a SIM card. The SIM card is being inserted on installation site.
In order to create an automatic association of the unit with the SIM number in CCC
application, the unit initiates a real-time message using SMS or GPRS, according to the
bitmap below.
In case Wake Up message has not been sent due to server side issue triggering Anti
flooding condition, The Wake Up message counter will be reset and the Number Of
Repetition counting will start again from 0.
6.2.6.1 Enable SMS Wake Up
Address: 1344, bit 6

Description: An SMS message/s (number is set in repetitions field of the same byte) will
be sent to the Default Destination SMS address upon power up, after successful
registration into Home or Roam GSM network, respectively to SMS rules (like pre-
programmed GSM operator’s selection, active transmissions block etc).
The “SMS Wake up” event does not require any type of ACK. The message shall be
retransmitted in case error.
NOTE: The “wake up” message will be transmitted even if active transmissions are
disabled. In addition, the time between Wake up SMS repeated messages will be 40
seconds (except for the CelloTrack Nano, in which the time between emergency
transmissions will be shorter but still dependent on network responses).
NOTE: In CelloTrack and CelloTrack-T, Wake up SMS will be sent every time the unit is
moved between Inactive to Active states.
Default value: 0 - disabled
6.2.6.2 Enable GPRS Wake Up

Description: The message will be sent to the Default Destination IP address upon power
up, after successful registration into Home or Roam GSM network, and dial up to GPRS,
respectively to GPRS rules (like pre-programmed GSM operator’s selection etc). The
message requires ACK (standard type 4 message). If ACK is not received, it will be resent
limited number of times, as configured in "Number of Repetitions" parameter (address
1344, bits 0-5).

Cellocator Cello
Programming Manual
6.2.6.3 Number of Repetitions

Description: This parameter defines the amount of SMS/GPRS Wake Up messages. In
case of failure during sending Wake Up event via GPRS (ACK is not received), the unit will
try to resend the message with a period configured in "Time between Distress
Transmissions" parameter (address 72). Every time a new GPRS session is established,
the repetition counter is reset to 0 and the count is restarted.
Default: 5
6.2.7 Offline Tracking

This mode is designed to enable offline data logging. During this mode the modem of the
unit remains off, although the GPS, processor and all the peripherals are managed by
unit's logic as usual. The unit is generating and storing logged events in its non-volatile
memory and once a day establish a connection to upload all of them during a single
communication session.
The modem is also temporarily switches on upon trigger of distress session (in this
session only the distress event itself is sent).
The communication session for accumulated data upload will be initiated in the following
cases:
 At the end of trip (upon expiration of the dedicated timeout after the Stop alert)
 Upon filling of 90% of memory capacity
 Upon expiration of Logged Events Upload Periodic Timer
 Upon reaching a certain amount of logged events
 Upon activation of Input
 Upon movement in a certain time
 Due to FOTA process

In case of failure of upload process when the unit tries to upload the logged events (i.e. if
not all the events were uploaded for any reason), the will perform a configurable number
of retries, with a configurable time between the retries.
If during a retry session one of the 5 upload modes is triggered again, the retry
mechanism will be "restarted" (e.g. if the number of upload retries was configured to 5,
and in the current retry session 3 retries were done, and an upload mode is triggered
again, the unit will perform the upload sequence again, i.e. first upload try + 5 retries).
If a retry session was "expired" (i.e. the unit performed all the retries as configured, and
still failed to upload all of the logged events), the unit will return to silent offline tracking,
until the next upload mode is triggered.

Cellocator Cello
Programming Manual
6.2.7.1 Enable Offline Tracking

If this bit is enabled (1) the unit switches the modem on and initiate the GPRS session
only when data download is required (see below). The rest of the time the modem
remains off.
Upon the end of data upload process the session and the modem is shut down.
The modem will also be switched on during distress sessions and real time alerts (Wake
up etc).
In case of wake up due to distress session (or real time alert) the modem will be switched
off after transmission of the last message (any valid Cellocator message will extend this
timeout by an additional 10 seconds).
Switching the modem on followed by GPRS dial up is initiated by the unit upon:
 At the end of trip (upon expiration of the dedicated timeout after the Stop alert)
 Upon filling of 90% of memory capacity
 Upon expiration of Logged Events Upload Periodic Timer
 Upon reaching a certain amount of logged events
 Upon activation of input
 Upon movement in a certain time
 Due to FOTA process

After modem's wake up it will try to register into a GSM network. If the registration is not
accomplished during timeout, defined in "Maximum Network Registration Time" (address
270), the modem will be switched off until next wake up.
Any modem reset, occurred during the upload session, will be followed by modem wake
up and registration attempt as per "Maximum Network Registration Time" (address 270).
If the GSM registration is successful, the unit will get more time to dial up GPRS and
deliver the first message from the log (the total time from modem wake up is "Maximum
Network Registration Time" + 90 seconds, independently from the exact moment of GSM
registration). If during this timeout the unit failed to establish GPRS session and deliver
the first message - the modem shall be switched off until next wake up.
The unit will not switch off the modem while data transfer is in process;
The modem will be switched off:
 While log is not empty: 90 seconds after last message reception (in case of session
drop or server failure).
 While log is empty: 10 seconds after last valid message reception (including ACK)
 For CR300, CelloTrack T and Cellotrack Nano, this timeout is configurable via "Timeout
before switching off the modem" parameter.

Cellocator Cello
Programming Manual
Once the dial up attempts stop for one of the reasons described above, no more GPRS
dialup attempts (or modem wakes up followed by GPRS dial up attempts) will be made
until Stop Journey is detected. After such an event, dial up attempts will start again as
described above.
Maintenance Session, if enabled, will start immediately after ANY data session occurred
after periodical maintenance timeout expiration. In such a case the modem will be
switched off after the end of the maintenance session. There is no dedicated modem
wake up for maintenance session.
Serial data Forward mechanism (MDT, Garmin, transparent data ...) will behave in next
manner during offline mode:
 During modem wake up due to Emergency session, then the data forwarded from
COM port will be forwarded to the server.
 During modem wake up due to Ignition OFF or memory overfilling, then the data will
be lost.
Default: 0
6.2.7.2 Timeout before switching off the modem
Address: 220
This timer is restarted every time a data packet is received (to allow the server time to
send necessary commands to the unit, if needed), when the log is not empty (i.e. not all
logged events were uploaded to the server). Note that the FW limits this parameter to be
minimum 30 seconds, so any programmed value under 30 seconds would be treated as
30 seconds.
After completion of uploading all of the logged events (i.e. the log is empty), the unit is
switching off the modem after 10 seconds (hardcoded).
Resolution: 2 seconds/bit
Default value: 90 seconds
6.2.7.3 Auto Upload after Ignition Off Event
Address: 255, bit 0

Description: If this bit is enabled (1), the unit will wake up the modem and establish
GPRS session upon expiration of a timeout (Time to Auto-Upload) after a Stop alert.
Default Value: 0 - Disable
6.2.7.4 Auto Upload upon Memory Overflow
Address: 255, bit 1

Description: If this bit is enabled (1), the unit will wake up the modem and establish
GPRS session upon detection of memory overflow (90% full).

Cellocator Cello
Programming Manual

6.2.7.5 Time to Auto Upload after Trip Stop
Address: 259 – 260

Description: This parameter defines time interval between Trip Stop and GPRS dial up
for data upload. Disabling the automatic upload at trip stop is done by "Auto Upload after
Ignition Off Event" parameter (address 255, bit 0).
Value resolution & span: Resolution is 4 Seconds. Span from: 4 seconds (0x0001), to
18:12 Hours (0xFFFF).
Default value: 5400, (0x1518h), 1.5 Hours
6.2.7.6 Logged Events Auto Upload Timer
Address: 218 – 219

Description: This parameter defines the period for periodical auto-upload of events
accumulated during Offline mode. 0 – cancels periodical auto upload.
Value resolution & span: Resolution is 1 minutes. Span from: 1 minute to 65535
minutes. 0 disables the periodic upload.
Default value: 0
6.2.7.7 Logged Events Amount for Upload Offline Events
Address: 215
Description: This parameter defines the amount of logged events for upload of events
accumulated during Offline mode. 0 – cancels the amount dependent upload.
Value resolution & span: Resolution is 1 event. Span from: 1 to 255 events.
Default value: 0
6.2.7.8 Number of Logged Events Upload Retries
Address: 221
Description: This parameter defines the number of logged events upload retries (in case
of no GSM connection when attempting to upload logged events). 0 – cancels the retry
mechanism.
Value resolution & span: Resolution is 1 retry. Span from: 1 to 255 retries.
Default value: 0

Cellocator Cello
Programming Manual
6.2.7.9 Time Between Logged Events Upload Retries
Address: 222
Description: This parameter defines the time between logged events upload retries (in
case of no GSM connection when attempting to upload logged events).
Value resolution & span: Resolution is 10 seconds. Span from: 10 to 250 seconds.
Default value: 0
6.2.7.10 Local Timer to Upload Logged Events
Address: 223-224
Description: This parameter, together with "Movement Timer Before Local Timer
Activation" (address 225-226) define a time range for a local upload mode for logged
events. The "Local Timer to Upload Logged Events" starts after previous upload session
ends. After it expires, the "Movement Timer Before Local Timer Activation" starts. If
during this time the unit moves, the logged events are uploaded, and the "Local Timer to
Upload Logged Events" starts again.
Value resolution & span: Resolution is 1 minute. Span from: 0 to 65535 minutes.
Default value: 30 minutes
6.2.7.11 Movement Timer Before Local Timer Activation
Address: 225-226
Description: This parameter, together with "Local Timer to Upload Logged Events"
(address 223-224) define a time range for a local upload mode for logged events. The
"Local Timer to Upload Logged Events" starts after previous upload session ends. After it
expires, the "Movement Timer Before Local Timer Activation" starts. If during this time
the unit moves, the logged events are uploaded, and the "Local Timer to Upload Logged
Events" starts again.
Value resolution & span: Resolution is 1 minute. Span from: 0 to 65535 minutes.
6.2.8 Cell ID Based Location (Neighborhood list of the serving GSM cell)
The Cell ID triangulation is an alternative location method. In cases when the GPS is not
available information regarding in-range cellular towers (Cells) with known location, along
with signal power or SNR (Signal to Noise Ratio) indication, might be used for location
approximation of the transmitting device.

Cellocator Cello
Programming Manual
-105dbm
-105dbm
-90dbm
-90dbm
-75dbm
-75dbm
~0.75km
~1.5km
~1km
-75dbm
-90dbm
-105dbm

Cellocator Cello
Programming Manual
The location of the transmitting vehicle in respect with the “in-range” cells and the RF
signal propagation attributes which can be significantly affected by reflectors, black spots,
interference, etc. all of this may influence the relative “reliability” of the SNR indication as
an estimator for the distance of the vehicle from the receiving Cell.
How does it work with Cellocator unit?
When the unit loses a GPS signal for longer than 2 minutes, it will poll modem for Cell ID
information. The modem will update with the following parameters of up to 7 cells (the
serving cells and up to 6 neighbor cells):
 Base station identification code
 Cell ID
 Location Area Code
 Received signal strength in dBm
The message, containing this information and CellID retrieval timestamp, will accompany
any log or distress message (as per configuration) generated by Cellocator unit during
GPS coverage loss.
Positioning software performs a triangulation calculation on the information and the data
is converted into a geographical location: strongest reception signal theoretically defines
closest cells.
Conditions to consider GPS coverage loss and restore
The GPS coverage loss in is considered when:
 The GPS is communicating (connected)
 The location appears as invalid for longer than 2 minutes in Standby mode or timeout,
programmed in "GPS Max On time" parameter in hibernation mode.

Cellocator Cello
Programming Manual
The recovery from Cell ID state is to GPS coverage state, in standby (i.e. not Hibernation)
mode, happens when the GPS location is considered valid continuously for more than 1
minute or as in PL parameter 500/1 "GPS Navigation Start_Stop filter" in hibernation
mode.
Behavior during No GPS Mode
Once the "NO GPS" mode is started, the unit is polling Cell ID neighborhood information
from modem periodically, every 1 minute.
The data session (to operational server only) is suspended during polling, the connection
does not drop. Messages generated during Cell ID polling are delivered after data mode is
restored.
The Cell ID neighborhood data is stored in a unit and delivered as an additional message
to a central control after any event or distress message. The additional message contains
the next sequential message numerator for easy correlation.
In 3G networks, information of the neighbor cells is not available. Thus, the modem is
polled for current serving cell extended data, which may include sector data, which in turn
may improve determining the unit location.
6.2.8.1 Enable Generation of Logged Cell ID Escorting Packet
Address: 201, bit 3 in Home Network

203, bit 3 in Roam Network
Description: If this flag is enabled, the unit will generate logged message type 9, (sub
data type 9) following any logged message type 0 while the GPS location is considered as
invalid.
The logged messages type 9/9 will be stored in the same buffer as corresponding
messages type 0 and use the same sequence of numerator for easy correlation.
The message type 9.9 will not be generated if the unit is not logged into GSM.
Default: 0 - Disabled
6.2.8.2 Enable Generation of Real Time Cell ID Escorting Packet

Description: If this flag is enabled, the unit will generate real time message type 9, (sub
data type 9) following any distress message type 0 while the GPS reading is considered as
invalid.
The real time messages type 9/9 will be delivered using the same rules as the
corresponding distress messages type 0 and use the same sequence of numerator for
easy correlation.

Cellocator Cello
Programming Manual
Default: 0 – Disabled
6.2.8.3 Enforce SMS Destination

Description: Usually units have a predefined SMS destination ("SMS Destination
Address" parameter) to which it sends it's initiated SMSs. As for SMS replies to
transmissions from other addresses, the legacy logic dictates that they would be sent only
to the originating address.
This parameter enable enforcing to send the ACK always (regardless of the origin of the
command) to the same SMS destination number.
Default: 0 - Disabled
6.2.9 Internal Accelerometer Configuration
6.2.9.1 Accelerometer Sensitivity
Address 467, bits 3-4

Description: It is possible to calibrate the sensitivity of the internal accelerometer (3
levels) and to adapt it to any vehicle. The default value of 1 is adapted to detect
movement start/end in standard private vehicle. In case of truck it is recommended to
decrease the sensitivity level, in case of very silent vehicle – to increase it.
Values span: 0 - Very insensitive, 1 – Normal, 2 - Very sensitive, 3 - Spare
Default value: 1 – Normal
Note: The Accelerometer Sensitivity feature is applicable also in CelloTrack T units from
FW version 61c.
6.2.9.2 Voltage Level Threshold for Ignition On Detection
Address 468
Description: This parameter allows to configure the main battery voltage for assisting
accelerometer or Ignition input with Start/Stop detection, or for waking up the unit from
hibernation upon connecting electrical vehicle to charging source. It only affects if bits 5
and/or 7 of address 467 and/or bit 0 of address 3 are set.
The Start Event shall be registered if movement by accelerometer is detected or Ignition
input state is On, and the voltage of the main battery is higher than this parameter
during the entire Start Event registration timeout.
The Stop Event shall be registered if NO movement by accelerometer is detected or
Ignition input state is Off, and the voltage of the main battery is lower than this threshold
during the entire Stop Event registration timeout.

Cellocator Cello
Programming Manual
Data format: 8-bit unsigned, 0.1176470588235V/bit

Default value: 12.81V
6.2.10 Roaming List, GSM Operator Management

The non-volatile configuration is storing a list of 100 Public Land Mobile Networks (GSM
operators) with their priorities.
The end unit continuously* monitors a GSM operators (PLMNs) available on the air and
dynamically selects the best cost effective operator according to the pre-programmed
priority assigned to each one.
*The GSM operator selection mechanism is activated in 2 cases:
Periodically, according to pre-programmed timer
Upon new GSM registration, caused by reset or leaving the area covered by previously
selected network.
After one of the conditions listed above becomes true the state machine takes control
over the process and selects the best operator based on the list in the configuration
memory.
6.2.10.1 Timer of Auto Search
Address: 1008
Description: This parameter defines a timer, used by the system to repeat search of
available GSM networks in the air. The timer restarts each time when the unit is “taking
decision” to register in a specific PLMN, irrespectively to the result of registration attempt.
Data format: The parameter is an 8-bit integer, resolution of 10 minutes.
Value span: 1 to 255 (10 minutes to 2550 minutes, zero is automatically translated into
30 minutes)
Default value: 6
6.2.10.2 Consider Unknown Operators as Forbidden

Description: If this flag is set, any PLMN not listed in the programming will be
considered as forbidden.
Otherwise, if this bit is 0, any PLMN not listed in the programming will be considered as
enabled with lowest priority.
Default value: zero (not forbidden)

Cellocator Cello
Programming Manual
6.2.10.3 Number of PLMNs Programmed
Address: 1009
Description: This parameter defines a number of active records in PLMN table.
Zero value cancel Roaming List Management feature.
Value span: 0 to 100
Default value: zero
6.2.10.4 Public Land Mobile Networks (PLMN)
Addresses:
Address Value
1010-1012 PLMN 1
1013-1015 PLMN 2
…. ….
1307-1309 PLMN 100
Description & Data Format:

Each PLMN number is composed of two fields:
MMC-Mobile Country Code
MNC-Mobile Network Code
It will be stored in the configuration memory together with its priority as a single
parameter in the following way:
Priority PLMN (MCC-MNC)
Bit 23 Bit 20 Bit 19 Bit 1 Bit 0
The highest number in Priority field (15) is representing the most preferred network.
The value of 1 is the lowest priority, 2 - higher priority and so on.
The value of zero – is representing Forbidden PLMN.
NOTE: The network available in the air, but not listed in the pre-programmed PLMN list
will be treated as per configuration in “Consider Unknown Operators As Forbidden” above.
During searching of available networks (processing AT+COPS command) the modem is
busy and not available for any type of communication. This process might take up to 3
minutes, but in majority of the cases will be accomplished in less than 20 seconds.
In case no available network found during search, or all the available networks are
“forbidden” – the unit will hold and proceed with searching after expiration of Timer of
Auto Search.

Cellocator Cello
Programming Manual
Default value: zeroes

Cellocator Cello
Programming Manual
6.2.10.5 Operator Selection Flow Chart

Cellocator Cello
Programming Manual
Normal operation
Timer of available operator re- GSM Modem Wake up

search expired (after hibernation /reset
/AHR)
Yes Is Home
Connect to home network
network available?
Search for available networks

until at least one network is found
Is one (or
more) No
operators
forbidden /
Connect to the most No suspended?
Yes Is one (or
preferred operator more) operator
in the preferred
list? Yes
Yes Are there

not- No
Connect to the first unforbidden /
unsuspended operator in the list forbidden
/
suspende
Wait till successful

registration
Is 1348 bit5
=1 ("consider
unknown
operators as
forbidden") Yes
Is it 3rd failure Is the
No to connect to
No active
the same operator =
operator? required
operator?
No
Yes
Yes
Mark the same operator as Let the modem select the
suspended (until "Proceed to operator
normal operation")
Restart timer of available

operator re-search
Proceed with normal

operation

Cellocator Cello
Programming Manual
6.2.11 GSM Jamming Detection & Reaction (Not Supported by 3G units)

The GSM Jamming detection supports two modes of operation:
 Legacy Jamming Detection mode: Jamming is detected without any relation to the
Ignition state of the vehicle. In this operational mode, jamming detection can activate
up to two outputs for jamming driver feedback. The Jamming feedback is released by
OTA command or Ignition Sequence.
Jamming Outputs Release by OTA Send OTA Event
Command No
Jamming Output Release by Ignition Jamming Jamming Outputs
Activation Configuratin
2426-2433
Jamming Out1
Jamming
Modem Output
Detection Send OTA Event
Activation Out2
 Advanced Jamming Detection mode: The jamming detection is depended on the

vehicle’s ignition state. Different outputs activations are allocated for Ignition On and
Ignition Off states. Each Ignition state can drive up to two driver feedback outputs.
Jamming Driver feedback outputs are released when jamming condition ends. The
user can terminate the jamming state by the legacy sources (OTA commands and
Ignition sequence). In the advanced mode, the user can configure the jamming
detection time filter and the Jamming End condition time filter. Jamming events will
be sent when jamming is detected or when jamming ends. The Jamming events will
also reflect the vehicle’s ignition state. The Ignition on jamming output activation
configuration is the same configuration array used by the legacy jamming outputs
activation.

Cellocator Cello
Programming Manual
Ignition On
Send OTA Event Parameters
No (Legacy Params)
Jamming 2426-2433
Ignition On Out1
Jamming
Send OTA Event Output
Out2
(Ignition On) Activation
Jamming
Modem Send OTA Event
Detection (Ignition OFF)
Ignition Off
Jamming Out1
Output
activation Out2
PL
Jamming Ignition Off
Criteria Parameters
(213) (New Parameters)
205-212
The following responses to jamming detection are available and switchable by unit's
programming:
 The unit allows activating a vehicle horn and / or blinkers in pre-programmed

frequency and cadence.
 Each of the outputs (horn and blinkers) is equipped by independent activation time
filter.
 The unit allows activating nested immobilization (after vehicle's stop) and / or
immediate immobilization.
 Unconditionally the unit stores dedicated event for jamming detection into its non-
volatile memory.
 The unit enables releasing activated outputs by valid Dallas or by certain activity of
Ignition input.
6.2.11.1 GSM Jamming Detection
6.2.3.1.1 Telit
The cellular modem detects jamming and, if not during an active GPRS session, initiates
periodical reports to a microcontroller while jammed (every 3 seconds).
The jamming status is considered as GSM JAMMED upon reception of 3 consecutive
jamming detection notifications from the modem in 10 seconds. The unit stores a GSM
JAMMED event (TR206, TR Specific data 0) upon jamming status changing to Jammed.

Cellocator Cello
Programming Manual
The jamming status is considered as GSM NOT JAMMED upon reception of a dedicated
unsolicited message from the modem - "Operative". The unit stores a GSM JAMMED event
(TR206, TR Specific data 1) upon jamming status change to Not Jammed.
Since during an active GPRS session unsolicited Jamming detection indications are not
received, the microcontroller is temporary suspending GPRS session upon traffic jam
(missing ACKs for at least 30 seconds and 3 lost ACKs minimum).
NOTE: In this case (GSM Jamming during GPRS Session) the Acknowledge Timeout
directly affects time to Jamming Detection.
The unit will not suspend the GPRS session more than once; next session suspend can
only happen in a subsequent GPRS session.
6.2.3.1.2 Cinterion
The Cinterion modem, unlike Telit, is not limited by active GPRS sessions – the jamming
indications are issued in any state. The modem is not initiating any periodical report; it is
reporting GSM jamming state change upon jamming start and end. The unit is
immediately entering or leaving "Jamming" mode upon reception of the appropriate
notification from the modem.
6.2.11.2 Advanced GSM Jamming Detection Mode
Address: 525, bit 6

Description: The Advanced Jamming detection mode differentiates between Ignition-On
and Ignition-Off jamming detection criteria. Each mode (Ignition On or Ignition Off) has
its dedicated outputs activation configuration parameters. The Advanced Jamming also
enables the configuration of the jamming detection threshold and the “Jamming End”
filter delay. OTA events reflecting the beginning and End of jamming sessions will be sent
whenever jamming is detected or jamming stops. 0-Legacy Jamming support (not
depended on Ignition state), 1-Advanced Jamming support, Ignition state depended.
Default value: zero (Disabled)
6.2.11.3 Disable GSM Jamming Event or Disable GSM Jamming Event during
Ignition On

Description: This configuration parameter disables jamming OTA events. The
functionality of this configuration bit depends on the state of the Jamming detection mode
(See: Advanced GSM Jamming Detection Mode): If the advanced mode is configured, This
configuration bit will only disable jamming events started during Ignition On, If the
Advanced mode is not configured, this pin will disable all jamming events.
Note that Jamming detection started during Ignition On and ended while in Ignition Off
will be reported even if “Disable GSM Jamming Event during Ignition off” is enabled.
In addition, output activation as a reaction to jamming is independent from registration of
GSM JAMMED event.

Cellocator Cello
Programming Manual
Default value: zero (Jamming is NOT disabled)
6.2.11.4 GSM Jamming-End Time Filter
Address: 214
Description: The GSM Jamming-End Time Filter is only applicable if advanced jamming
mode is enabled (See: Advanced GSM Jamming Detection Mode). The Jamming-End Time
Filter defines the time required for declaring “End of Jamming” event. End of jamming will
send a jamming end event and deactivate the associated outputs if configured by
“Release by Jamming End” flag. Setting the Jamming End Time Filter to 0 will result in
immediate outputs deactivation. The filter is common for both Ignition-on and Ignition-off
jamming states. The timer resolution is 15 seconds.
Default value: 10 Minutes
Resolution: 15 second
6.2.11.5 GSM Jamming Detection Time Filter
Address: 213
Description: The GSM Jamming-End Time Filter is only applicable if advanced jamming
mode is enabled (See: Advanced GSM Jamming Detection Mode). The Jamming detection
Time Filter defines the basic criteria for declaring jamming condition. The time filter
defines the minimal number of consecutive 3 seconds samples needed before jamming
condition is detected. Each bit represents time delay of 3 seconds. The minimal value is 1
(0 will be translated to 1 by the Firmware). Typically this parameter will be set to 10,
representing 30 Seconds time filter.
Default value: 30 Seconds (10)
6.2.11.6 Output Activation as a reaction to GSM Jamming Detection
Upon GSM jamming detection and expiration of activation timeouts, the unit can
concurrently activate two outputs. Once activated by Jamming Detection logic, the output
can only be deactivated by:
 A command (OTA or serial)
 Authorized Dallas
 Ignition activity pattern

Once deactivated by user or by command the output will be activated again only upon the
next jamming detection. In other words: after the end of the active jamming session and
beginning of the next one.
NOTE: Reset does not deactivate an output activated upon jamming detection.
6.2.3.7.1 Output, Auto-Activated upon Jamming Detection

Cellocator Cello
Programming Manual
Address: 2426 for first output and 2429 for second output, bits 0-2
Description: This pair of parameters defines a numbers of outputs that will be activated
upon jamming detection.
Output name Output number
Feature Disabled 0
Siren 1
Gradual Stop 2
St. Immobilizer 3
LED 4
Blinkers 5
Reserved 6
Reserved 7
Value span: 1 to 5
Default value: zero
6.2.3.7.2 Delay for Output Activation
Address: 2432 for first output and 2433 for second output
Address: 211 for first output and 212 for second output
Description: This pair of parameters contain a time filters for output activation upon
GSM Jamming.
The event of Jamming detection will still be generated w/o any timeout.
If this parameter contains any number, different from zero, the output will not be
activated immediately upon Jamming detection, but after a pre-programmed timer. An
activation of the output will only occur if upon expiration of this timer a jamming session
is still active.
The timer for output activation will start upon detection of GSM Jamming and reset upon
detection of GSM Jamming end.
Resolution: 15 seconds / bit, maximum 63.75 minutes
Default value: zero (immediate activation upon Jamming detection)
6.2.3.7.3 Output Activation Pattern (Upon Jamming Detection)

Cellocator Cello
Programming Manual
Address: 205 for first output and 208 for second output, bits 3-5 (Advanced Mode during
Ignition-Off)
Description: This pair of parameters defines a activation pattern of outputs upon
jamming detection.
Setting Action
0 Pulse Activation (The output shall be activated for the time, defined in
"Pulse Outputs Width Period", addr. 140 dec
1 Change state to “active” upon jamming detection, change to inactive

upon release (by command, Dallas or Ignition Activity)
2 Activate Gradually (only compatible with Gradual Stop output)
3 Activate Nested (executed upon jamming detection only after vehicle

stops, e.g. Ignition off or 10 valid GPS packets showing speed lower than
1 km/h)
4 Template Activation (according to the settings described below)
5-7 Reserved
6.2.11.7 Template of Output Activation upon Jamming Detection
Example of template:
Two activations in a session, 1 second per activation, 2 sessions, 3 seconds between
sessions:
6.2.3.7.1 GSM Jamming - Output Activation Template - Activation Length

Cellocator Cello
Programming Manual
Address: 206 for first output and 209 for second output, bits 0-3 (Advanced Mode,
During Ignition-Off)
Description: This pair of parameters defines a length of activation of the selected output
upon GSM Jamming detection.
0 for the time, defined in "Pulse Outputs Width Period", addr. 140 dec
Value resolution: 0.5 second
Default value: zero
6.2.3.7.2 GSM Jamming - Output Activation Template - Number of Activations in a

Session
Description: This pair of parameters defines a number of activations of the selected
output upon GSM Jamming detection.
0 – cancels outputs activation upon jamming detection
Default value: zero
6.2.3.7.3 GSM Jamming - Output Activation Template - Number of Activation Sessions
Description: This pair of parameters defines a number of sessions of output activations
upon GSM Jamming detection.
0 – for cyclic activation all the time of jamming
Default value: zero
6.2.3.7.4 GSM Jamming - Output Activation Template - Time between the Activation
Sessions
Description: This pair of parameters defines a time between activation sessions of
output activations upon GSM Jamming detection.
Zero value: If zero is programmed the unit will only perform one session of activation
irrespectively to the programmed number of sessions.

Cellocator Cello
Programming Manual
Value resolution: 0.5 second

Default value: zero
6.2.11.8 GSM Jamming Outputs Release

GSM jamming outputs can be released by Dallas key authentication or by Ignition
sequence. When advanced jamming mode is enabled (See: Advanced GSM Jamming
Detection Mode), It is possible also to release the outputs when GSM jamming condition
ends.
6.2.17.8.1 Enable Output Release by GSM Jamming End condition while in Ignition-On
Address: 522, bit 5

Description: GSM Jamming-end detection will deactivate the outputs if this parameter is
enabled. The “Jamming-End” state is declared after no jamming detection is detected for
the time defined in “GSM Jamming End Filter”:
0 - Jamming-End doesn’t affect the activation outputs.
1 - Jamming-End will deactivate the GSM Jamming activation outputs.
This bit is applicable for jamming end condition detected while the unit was in Ignition-
On.
Values span: 0- Disable, 1 - Enable
Default value: Enable
6.2.17.8.2 Enable Output Release by GSM Jamming End condition while in Ignition-Off
Address: 522, bit 4

Description: GSM Jamming-end detection will deactivate the outputs if this parameter is
enabled. The “Jamming-End” state is declared after no jamming detection is detected for
the time defined in “GSM Jamming End Filter”:
0 - Jamming-End doesn’t affect the activation outputs.
1 - Jamming-End will deactivate the GSM Jamming activation outputs.
This bit is applicable for jamming end condition detected while the unit was in Ignition-
Off.
Values span: 0- Disable, 1 - Enable
Default value: Enable
6.2.17.8.3 Enable Output Release by Authorized Dallas
Address: 522, bit 7

Description: This bit enables deactivation of an output, activated by Jamming Detection
Logic, by an authorized Dallas key

Cellocator Cello
Programming Manual
Values span: 0 - Disable, 1 - Enable

Default value: zero
6.2.17.8.4 Enable Output Release by Ignition Activity
Address: 522, bit 6

Description: This bit enables deactivation of an output, activated by Jamming Detection
Logic, by the below specified sequence on Ignition line:
1. From ignition off state Switch Ignition on for a period between 0.5 to 2 seconds
(Ignore input change time filter)
Switch it back off for a period between 0.5 to 2 seconds (Ignore input change time filter)
Repeat 1 and 2 four times.
Upon detection of deactivation activity on Ignition the unit will:
 Activate feedback "beep" (using feedback output/s)
 Release an output
Values span: 0 - Disable, 1 - Enable
Default value: zero
6.2.12 Other Configuration Parameters related to Communication Settings
6.2.12.1 Disable Active Transmissions
Address: 6 bit 1
Description: If set to ‘1 the unit will not actively initiate any kind of connection - SMS,
GPRS or voice. It will reply to incoming SMS commands, if the relevant flags for the
current roaming/homing state are enabled.
Default: 0 – Enable Active Transmissions
6.2.12.2 Enable Command Authentication
Address: 1 bit 6
Description: If this feature is enabled authentication of every incoming message to the
unit (like command or acknowledge) will be verified. Each incoming message should
include a unique code, generated as a function of two variables:
 Unit’s ID
 8 bytes Auth Table, stored in non-volatile memory of the unit and concurrently in the
Communication Center application.

Cellocator Cello
Programming Manual
If the code will not be verified as authentic – the unit will not perform / acknowledge the
command and will erase it.
The unit supports dedicated Auth Table read/write commands over its wire protocol. See
description of the commands in a corresponding documentation.
The OTA Auth. table modification will be only be accepted by the unit if the Command
Authentication feature is DISABLED.
Default: 0 – Disabled
6.2.12.3 HRLS (High Resolution Logging Session) - Number of Events
Address: 491
Any system trigger (Input trigger, GPS reading based trigger etc.) can be configured to
trigger a High Resolution Logging Session (HRLS - HRLS is one of 4 available event
generation types; refer to the Event Types generated by Cellocator devices section).
During this session the unit is logging an event every valid GPS fix (every second). If the
GPS fix is invalid during HRLS - the event will not be logged.
The duration of HRLS is limited by:
 Pre-programmed number of logged events as programmed in this parameter.
 A timeout, closing the HRLS even if not all the events programmed in “Amount of
Events during HRLS” are logged (in case of poor GPS coverage).
HRLS Timeout [sec] = [Amount of Events during HRLS] x 2
There is no data upload during the High Resolution Logging Session – the events are
delivered after the end of HRLS.
Description: This parameter defines number of events, generated during High Resolution
Logging Session. Event is logged every second (if the GPS fix is valid), therefore the
parameter defines minimal duration of HRLS in seconds.
Events with invalid GPS fix will not be logged, and as a result the session could proceed
longer. Maximal duration of HRLS in seconds is twice bigger than the minimal one.
Value span: 0-255
Default value: 5
6.2.12.4 Number of Retries to Forward Data over UDP GPRS
Address: 283
Description: This parameter defines number of retries to forward data from the COM
port (for example from MDT) to the Central Control over UDP/IP. Such a message
requires acknowledge (msg type 4) from the Central Control. If the acknowledge will not
be received during the timeout defined by "Message Transit Acknowledge Timeout", the
unit will resend it number of times, defined in this parameter.
If all the reties forwarding data through UDP will fail, the same message will be sent by
SMS (if enabled in bytes 202, 204, bit 5).

Cellocator Cello
Programming Manual
Default value: 5

Cellocator Cello
Programming Manual
6.3 GPS Calibration
6.3.1 Base Unit (Measurement Factor of GPS Odometer)

Address: 80 to 83
Description: The value defines unit used for distance and odometer measurements. The
selected value (for example 100m, 1km or 1 mile) will be used by the unit as a lowest
distance unit to be reported and as a distance resolution.
The parameter is a 32-bit unsigned integer. Value is represented in centimeters. (100000
for 1 Km).
Valid values: Any non-zero value
Default Value: 100000
6.3.2 GPS Odometer Current Value

Address: 76 to 79
Description: This parameter stores the current “reading” of the vehicle odometer, in
“base units” (see previous parameter). Normally this value is programmed upon
installation (synchronization with vehicle odometer) and then maintained by the unit
itself.
NOTES:
 This parameter does not require reset to be implemented.
 Upon 'Ignition OFF' ('Stop Event time filter' elapsed), the unit will update the PL ('GPS
odometer’s current value') with the odometer value reported OTA (same as the value
serially found in 'Master Unit Status Request'), regardless of the 'GPS odometer’s
current value' in PL.
 Having the 'GPS odometer’s current value' serially programmed requires Power
recycle in order to take effect.
 OTA update of 'GPS odometer’s current value' will take effect immediately.
 Upon new FW boot due to any type of FW upgrade (serial, OTA, 'Cellocator+' etc.),
the unit will take the odometer value stored in PL, which is true for the last 'Stop
Report'.
This note is more relevant for those users, upgrading while vehicle is traveling (after
FW upgrade, odometer skip back to the last 'Stop Report' value can be observed).
Data format: The parameter is a 32-bit integer
Value span: 00000000h to FFFFFFFFh
Default value: 00000000h

Cellocator Cello
Programming Manual
6.3.3 Report Max. Speed instead of Real Time Speed

Address: 1347 bit 0
Description: If this bit is enabled (0) the unit will report in each logged event (message
type 0 and 9) the maximum speed recorded from the previous logged event. This is
useful for comparison with police ticket report.
Even if this bit is enabled, any real time and distress events will still contain a snapshot of
the speed at the moment of message generation.
There is a bit in every OTA messages, clarifying the type of the reported speed (real-time
or maximum).
Default: Disable (1)
6.3.4 Enable GPS Navigation Start-Stop updates

Address: 99, bit 0 for plain event
102, bit 0 for distress
Description: If this bit is set (1) the unit will generate an event/distress upon every GPS
reading validity status change.
Default: Both Disable (0)
6.3.5 GPS Navigation Start/Stop filter

Address: 500
Description: This parameter defines number of invalid GPS packets, required for
declaring a "GPS Navigation End"; it is also defines number of valid GPS packets required
to declare "GPS Navigation Start".
Note that the GPS validity is automatically declared as "invalid" upon wake up or after
reset.
Data format: The parameter is an 8-bits integer
Value span: 0-255 (value of zero cancels the filter)
Default value: 0x0A (10 seconds)
6.3.6 Enable Tight GPS PMODE Filter

Address: 509, bit 7
Description: If this flag is enabled, the unit will consider GPS data as valid only when
PMODE1=3 (in GPS Data, refer to the Cellocator Wireless protocol) or 4 and PMODE2=2.
Otherwise any of the following values of PMODE1:2,3,4,5 or 6 will be accepted as a valid
fix.

Cellocator Cello
Programming Manual
Values:
0 Requires 2≤PMODE1≤6 values to deem position as "Correct".
1 Requires PMODE1 equal to 3-4 values and PMODE2=2 to deem position as

"Correct".
First acquisition:
In order to speed up the GPS acquisition:
1. Upon initial boot (power up, excluding AHR) the GPS validity test will start according
to "Normal GPS PMODE Filter", irrespective of the setting in this parameter AND w/o
DOP validation.
This simplified validation routine will work until the first acquisition compatible with
"Tide GPS PMODE Filter" setting AND with DOP setting.
2. Upon achieving acquisition compatible with "Tide GPS PMODE Filter" the unit will start
behaving according to the setting in this parameter AND with DOP setting as usual.
Data format: The parameter is a flags bitmap, “1” - Enable, “0” – Disable
Value span: any 8-bit value, four upper bits are currently a don’t-care bits
Default value: 1
6.3.7 GPS DOP Threshold

Address: 1625
Description: Dilution of Precision (DOP) is a measure of how the geometry of the
satellites affects the current solution’s accuracy. This message provides a method to
restrict use of GPS solutions when the DOP is too high.
This is actually an additional GPS solution validation tool: the GPS packets with an HDOP
higher than the value in this parameter are marked as invalid.
Data format: unsigned 8 bits integer
Default value: 9
6.3.8 GPS accepted accuracy threshold

Address: 1853
Description: Additional filter that can be activated on location fixes. Accuracy below that
TH will not considered to be valid fixes.
Data format: unsigned 8 bits integer
Valid Range: 2-510 meters. 0=Disable (pass everything)
Resolution: 2 meters.
Default value: 100 meters

Cellocator Cello
Programming Manual
6.3.9 Synchronize Unit’s Time with GPS Time only when GPS is
Navigating
Address: 7, bit 3
Description: This flag defines the condition for time synchronization with GPS time:
0 - Anyway, even when GPS is not navigating
1 - Only when the GPS is navigating
Default value: 1
6.3.10 Velocity Threshold for HIGH SPEED Mode

Address: 455
Description: The unit can be configured to decrease frequency of Time and Distance
events on high speeds automatically. The speed threshold considered as "high speed" is
programmed into this parameter.
This parameter is used by Time based alert Period Multiplier for HIGH SPEED mode
(Address 92 and 35, bits 4 to 7) and by Distance Event Period Multiplier for HIGH SPEED
mode (Address 92 and 35, bits 0 to 3) parameters to define from what speed the number of
the events should be decreased.
Note, that the in order to switch the operational mode of the unit from "Low Speed
Mode" to "High Speed Mode" the system speed must raise 3km/h above the programmed
speed. Same way, in order to switch the operational mode of the unit from "High Speed
Mode" to "Low Speed Mode" the system speed must fall 3km/h below the programmed
speed.
Data format: 8-bit unsigned, unit’s [cm/sec]
Default value: 60 k/h
6.3.11 GPS Maintenance Updates
6.3.11.1 Enable GPS Navigation Start-Stop Updates

Description: If this bit is set (1) the unit will generate an event/distress upon every GPS
reading validity status change. (Refer to wireless protocol for GPS signal validity
definition)
The validity status changes after 10 consecutive GPS frames with the same validity
status, different from the current one.
Default: Both Disable (0)

Cellocator Cello
Programming Manual
6.3.11.2 Enable Update per GPS Auto Factory Reset Updates

Description: If enabled, the unit will create an event or/and distress per GPS Factory
reset. Obviously the GPS Factory reset has to be enabled. See below description of GPS
Factory reset.
Default value: Both 0 (Disable)
6.3.11.3 Enable GPS Disconnection Updates

Description: If enabled, the unit will generate an event or/and distress of GPS
Disconnection upon detection of 10 sequential missing packets from GPS.
The first received packet from GPS will cause the unit to generate GPS connection alert.
Default value: Both 0 (Disable)
6.3.12 GPS Odometer Management
6.3.12.1 Enable Speed x Time Calculation (SxT)
Address: 509, bit 0

Description: As a default, the unit queries the GPS every second. If that flag is enabled,
the unit multiplies the speed at a specific location by 1 second, the result being the
distance traveled during this second.
Speed (m/s) x 1 sec = elapsed distance (m)
Whenever the unit does not receive new GPS data for time, defined in Max Time between
GPS readings for SxT calculation it will not use the regular calculating algorithm. Instead,
it will ignore the time during which no reception was available and will restart calculating
the elapsed distance immediately when satellite reception reappears.
If both Pythagoras and SxT calculation are enabled, the unit will use SxT when there is a
valid GPS fix and Pythagoras when there is no GPS coverage.
Default: 1 - Enable
6.3.12.2 Enable Pythagoras Calculation
Address: 509, bit 1

Cellocator Cello
Programming Manual
Description: If this flag is enabled the unit will calculate the distance between 2
consistent GPS queries according to the Pythagoras theorem:
Distance = √(∆𝐴𝑙𝑡𝑖𝑡𝑢𝑑𝑒)2 + (∆𝐿𝑜𝑛𝑔𝑡𝑖𝑡𝑢𝑑𝑒)2 + (∆𝐿𝑎𝑡𝑖𝑡𝑢𝑑𝑒)2
If both Pythagoras and SxT calculation are enabled, the unit will use SxT when there is a
valid GPS fix and Pythagoras when there is no GPS coverage (from last GPS fix to the
next GPS fix).
Default: 1 - Enable
6.3.12.3 Reset Last Known Location on Ignition Off
Address: 509, bit 2

Description: Relevant for Pythagoras and combined Pythagoras + SxT calculation. If
that flag is set (logical ‘1’) the unit will dismiss the last detected location per detection of
Ignition off. For future calculation will be used the first GPS fix obtained after Ignition On.
In other words the unit will ignore the distance, passed by the vehicle during Ignition Off
mode. The feature is useful in case when the vehicle is being towed from one place to
another.
Note that in this case the vehicle will also ignore the distance, passed from Ignition On to
first GPS fix obtained.
Default: 0 - Disable
6.3.12.4 Max Time between GPS Readings for SxT Calculation
Address: 84
Description: This parameter stores the maximal time between two valid readings from
GPS (in seconds) to be qualified for SxT odometer accumulation.
When you make a configuration take into a consideration the following rule:
where:
max speed in km/h – maximum speed that the vehicle get during the normal usage.
Recommended 160km/h.
max time apart is a value programmed in this parameter.
base unit is “Base unit (measurement factor of GPS odometer)”, address 80-83.
Data format: The parameter is a 8-bit integer.
Value span: 1 to 255
Default value: 7

Cellocator Cello
Programming Manual
6.3.13 GPS Reset Settings
6.3.13.1 Enable GPS Auto Factory Reset
Address: 497, bit 7

Description: If this bit is set, the unit will trigger a Factory Reset of the GPS in the
following cases:
 The GPS communicates, but service fields MODE1 and MODE2 are equal to 0 and 16
respectively for 10 minutes.
 The GPS is communicating, but the data is considered as “not navigating” and the
service fields MODE1 and MODE2 are not equal to 0 and 16 respectively for 15
minutes. In this case the unit is resetting GPS using On/Off line. If the condition is
true for another 15 minutes – the unit will send factory reset command to GPS
(effectively the factory reset is sent once in 30 minutes).
Default value: 0
6.3.13.2 GPS Reset Upon Ignition Off
Address: 6, bit 2 when GPS is navigating

6, bit 3 when GPS is NOT navigating
Description: As with any ARM based module, the GPS has to be reset from time to time.
If one of hibernation modes is used, the GPS is reset upon entrance to hibernation.
But if the hibernation in not used the safest way to reset the GPS periodically is upon
Ignition change to Off state. There is an advantage of doing such a maintenance reset
when the GPS is navigating, because such a worm reset enables the shortest recovery
time. It is also possible to do it only when the GPS is not navigating anyway, but in this
case (for example on underground parking) the recovery might be longer.
Default values: bit 2 – 0 (disabled), bit 3 – 1 (enabled GPS reset upon ignition off when
the GPS is not navigating)
6.3.13.3 GPS AHR (Auto Hardware Reset) – except in CelloTrack Nano

When the unit identifies 3 consecutive GPS communication errors, the unit will attempt to
Auto Hardware Reset (AHR) its GPS up to programmable number of retries (according to
Maximum Number of AHR parameter used also for Modem AHR, 5 by default).
The unit will create a dedicated event per each GPS AHR – TR 200, STR 2 (if enabled by
Enable AHR Reporting parameter).

Cellocator Cello
Programming Manual
6.4 Inputs & Outputs
6.4.1 Discrete Inputs Triggering Time Filters

These two bytes defines the input’s Additional Time Filters. The Additional Time Filter will
extend the input’s filtering capabilities separately for logical Rising and logical Falling.
The total filter is constructed from Common Discrete Inputs Time Filter (same for all
inputs and all states) and dedicated filter for each state change (Rising/Falling) of each
input.
It is possible to define asymmetric triggering delays for logical Rising and logical Falling
for each one of system's discrete inputs.
The Additional Time Filter supports multiple resolutions from seconds to hours.
Logical Status Input's Input Input's Input

of discrete status Rising status Falling
input changes OTA changes event
to High event to Low
Common Additional Common Additional

Discrete Inputs Begin Discrete Inputs End Time
Time Filter Time Time Filter Filter
Filter
6.4.1.1 Common Discrete Inputs Time Filter
Address: 136
Description: This parameter is aimed to protect unit’s discrete input from noise influence
and defines time, from input’s level change to change detection.
Data format: 8-bit unsigned, Resolution 10 msec.
Value span: 0x00 to 0xFF
Default value: d10
6.4.2 Analog Measurement Averaging Time
Address: 466
Name in Programmer: Power Sources Measurement Time filter

Cellocator Cello
Programming Manual
Description: This parameter is aimed to protect analog measurement from noise

influence and defines averaging time. The reported value will be therefore an average
voltage for the period defined in this parameter. (The sampling rate is every 10msec).
Data format: 8-bit unsigned, resolution 0.1 second
Value span: 0-25.5 seconds
Default value: 1 second
6.4.3 Inputs in OTA Message
Address: 0, bit 3
Presentation of inputs in wireless Cellocator protocol
0 Legacy mode, inputs are presented in their raw (unprocessed) form.
1 Inputs are presented in their processed, logical form (inverted and

filtered).
Default value: 0
6.4.4 Enable Monitoring Logical Status of Ignition in OTA Packets

Description: If this bit is enabled (1) the ignition bit in all any outbound messages (OTA
and serial) will reflect logical status of Ignition (i.e. after the Ignition Filter)
Default value: 0 - Disable Logical
6.4.5 Enable Warning Output Activation during Gradual Immobilization
Address: 0, bit 5
Description: If enabled, a "blinkers" output (pin 18) will be activated when Gradual Stop
output is gradually or immediately activated (to notify surrounding driver that the vehicle
is going to blame and stop shortly).
Default value: 0 - Disable warning output activation
6.4.6 Outputs Pulse Width Period
Address: 140
Description: This parameter defines the activation duration time for pulse outputs (for
example some system feedbacks like Driver Authorization and others).

Cellocator Cello
Programming Manual
Data format: 8-bit unsigned, resolution is 100 mSec

Default value: 0.5 second

Cellocator Cello
Programming Manual
6.4.7 Analog (& Frequency) Inputs in OTA Message
Note that frequency counters are supported from FW30a.
6.4.7.1 Bytes 26-29 of OTA Message 0

Address: 1620 1621 1622 1623
Byte of OTA 26 27 28 29
Message 0
Description: The OTA protocol provides 4 bytes dedicated for monitoring of analog
inputs in few different message types. Those bytes can contain measurement from the
different fields as per the configuration below.
Obviously if the selected source of Data is an Analog input, the corresponding input shall
be programmed as an analog input in Input's Configuration.
Pin Number/Field Name Number to be Remarks

programmed
USB input voltage 0 Default for byte 27 of OTA

Message 0
Battery voltage (V bat) 1 Default for byte 26 of OTA

Message 0
NTC 2 Default for byte 28 of OTA

Message 0
Audio in 3 Not active (Infrastructure)
Reserved 4
Reserved 5
Reserved 6
Reserved 7
Nano source 8 As selected by parameters in

addresses 2064 and 2065.
Default for byte 29 of OTA
Message 0

Cellocator Cello
Programming Manual
6.4.8 Outputs Inversion Mask
6.4.8.1 Invert Blinkers Output
Address: 503, bit 3

Description: This parameter enables inversion of corresponding output's logic (pin 18).
Inverted output will be normally activated and will be turned off per OTA or serial output
activation command.
0 - Normal polarity (not activated - disconnected; activated – grounded)
1 - Inverted polarity (not activated - grounded; activated – disconnected)
Default value: 0 – Normal polarity
6.4.8.2 Invert Gradual Stop (PWM) Output
Address: 502, bit 2

activation command.
6.4.8.3 Invert Standard Immobilizer Output
Address: 503, bit 5

activation command.
6.4.8.4 Invert LED Output
Address: 503, bit 0

activation command.

Cellocator Cello
Programming Manual
6.4.9 Usage Counter Configuration
6.4.9.1 General Description

This feature is designed for continuous counting of the “Working time” of a device,
monitored by one or two unit’s inputs. Example of possible usage is – monitoring of an
engine's working hours.
The inputs who's "High State" time is counted are selectable by programming.
It is possible to assign each of two timers to a specific input, including the option to
assign both timers into the same input. Every input, including ignition, supports "High
State" or "usage" time calculation.
The value of the measured time from each input is located in the unit’s RAM (protected,
not erased on software reset). The unit makes mathematical rounding on partial minutes:
(1:29 will be counted as 1 minute and 1:30 and above as 2 minutes).
Once a day the values of both Usage Counters are backed up to the especial address in
non-volatile memory. The timer keeps time counting (from the value stored in RAM) each
time when the logical level of the appropriate input changes from low to high.
The time counting stops each time the logical level of the input changes from high to low.
Dedicated Read/Write commands over RS232 and OTA are provided for Usage Counters,
including a periodical Usage Counters update OTA packet.
6.4.9.2 Enable Usage Counters
Address: 7, bit 2
Description: In order to start Usage Counters time counting this bit shall be enabled (set
to 1).
Status of this parameter can be changed without reset.
6.4.9.3 Wake up from Hibernation upon Periodical Usage Counter Update Timer
Expiration
Address: 1, bit 7
Description: This bit enables waking up the unit from full hibernation for periodic Usage
Counter update.

Cellocator Cello
Programming Manual
6.4.9.4 1st Usage Counter Input
Address: 1330
Description: The byte contains number of the input, utilized by the first Usage Counter.
The unit will use this parameter to backup the value of the 1st Usage Counter from RAM
once a day.
Input’s numbers definition:
Input's name Input's number
Door 0
Shock/Unlock2 1
Ignition 5
Panic 6
Unlock 7
Lock 10
In order to set the use of only one Usage Counter input, select inexistent input for the
second counter (for example 4).
Default: 0
6.4.9.5 2nd Usage Counter Input
Address: 1331
Description: The byte contains number of the input, utilized by a second Usage Counter.
The unit will use this parameter to backup the value of the 2 nd Usage Counter from RAM
once a day. In order to set use only one Usage Counter input – select inexistent input
number in this parameter (for example 4).
Default: 0
6.4.9.6 Reporting Interval of Usage Counters
Address: 1332
Description: This parameter defines Usage Counters reporting period. Setting this value
by standard programming access is not recommended, as it will require reset to be
implemented. Refer to OTA and serial protocol document for a dedicated update
command description.
Data format and resolution: 1 byte, 1 minute resolution (from 1 minute to 255
minutes). Zero value cancels timers reporting).
Default: 0 – Reporting canceled

Cellocator Cello
Programming Manual
6.4.10 Modem & SIM
6.4.10.1 Shorten Cellular Registration Timeout
Address: 1 bit 1
Description: This programmable bit enables/disables a longer GSM registration to (5
minutes). In case of lack of GSM registration after an expiration of this timeout the
modem will be reset.
0 –5 minutes GSM registration timeout
1 - 30 seconds timeout
Default: 0 - 5 minutes GSM registration timeout
6.4.10.2 Enable Modem Power Control by Door, Shock Input
Address: by “Door” input: Address1, bit 4

By “Shock” input: Address 465, bit 1
Description: If enabled (‘1’), the modem will be switched off by “Door” or “Shock” input
active state detection; it will be turned back on by input inactive state detection; i.e. it is
required two states switch to use this feature (and not just a push button).
6.4.10.3 AHR (Auto Hardware Reset for Modem)

AHR (Auto Hardware Reset) is a process in which the unit performs power recycle to the
Modem (i.e. power down to the Modem for at least 500ms) and to the Micro-processor.
The unit will perform AHR upon occurrence of one of the following scenarios:
 Responsive Modem: The Modem responds to AT commands, but No GSM registration

in Ignition On mode for programmable time (configurable by "Registration Lack
Timeout (for AHR)" parameter, address 515). In that case, the unit will perform AHR.
If there is still no GSM registration according to the above conditions, additional AHRs
will be performed, up to a programmable number of retries (configurable by
"Maximum Number of AHR" parameter, address 504, bits 0-3).
 Non-Responsive Modem: The modem does not respond to AT commands for 5

consecutive queries. In that case, the unit will reset the Modem (SW reset). If there is
still no response for the Modem after 4 resets, a power recycle to the Modem only
(Pre-AHR) will be performed, after which the unit will wait for 1 second, and open a 30
seconds window in which the queries and resets process will be done again. If there is
still no response from the Modem (i.e. the Pre-AHR mechanism didn't work), AHR will
be performed. The process will repeat up to a programmable number of retries
(configurable by "Maximum Number of AHR" parameter, address 504, bits 0-3).
The unit will create a dedicated event per each AHR (if enabled in Second Configuration
Byte).

Cellocator Cello
Programming Manual
6.2.21.3.1 Registration Lack Timeout (for AHR)
Address: 515
Description: stores the timeout value (in minutes), before AHR trigger if the following
conditions are true:
 No GSM coverage
 Ignition On mode
Data format: 1 byte, unsigned integer, resolution of minute. Zero value cancels the AHR
upon lack of GSM registration.
6.2.21.3.2 Maximum Number of AHR

Description: The low nibble of this parameter stores the maximal allowed number of
AHR retires in one session and the high nibble is currently reserved.
After the last AHR attempt, no more attempts will be made, even if the modem continues
to be non-responsive or not registered.
If the AHR mechanism is disabled due to sustained non-responsiveness / non-registration
(as explained above), it will only be re-enabled when achieving a full data connection, or
reaching the idle modem management loop, if data connection is prohibited.
Zero retry number will cancel AHR process. Please note that setting this parameter to 0 is
not recommended.
Reserved Maximum number of AHR retries that will be made
Data format: 1 byte = 2 nibbles.

Default value: bits 4-7 = 0, bits 0-3 = 5.
6.2.21.3.3 Enable AHR Reporting
Address: 1, bit 3
Description: If this bit is enabled the unit will store a plain event with dedicated
transmission reason (address 200) upon each performed AHR.
Default: 0 (Disable)

Cellocator Cello
Programming Manual
6.4.11 Modem Reset Settings
6.4.11.1 Modem Reset Period
Address: 165-166
Description: This parameter defines the time for periodical modem software reset. This
period is restarted upon each manual and automatic modem reset as well as upon
entering full hibernation.
Data format: 2 bytes value, resolution of 1 minutes
Value span: 0 to 65535 (* Zero value in P disables periodical Modem Reset)
Default value (Dec): 1440 (24 hours)
6.4.11.2 Periodical Modem Reset Randomization
Address: 1352
Description: In case of GPRS network failure all the units are reconnecting to CC
simultaneously after the problem is rectified and it causes heavy communication load on
the CC server.
The Periodical Modem Reset timer is also restarted in all the units at the same time, after
concurrent reconnection to GPRS. It causes all the units to repeat simultaneous modem
resets and this way keeps creating peaks of load on customer’s communication server.
Randomization feature allows the unit to use pseudo random time for Periodical Modem
Reset timer.
The timer is restarted each time to a different value, limited by a programmable
threshold.
(P – Tr)≤ Modem Reset interval ≤(P+ Tr)
P - Periodical Modem Reset parameter
Tr - Periodical Modem Reset Threshold
Wrong programming protection: If P≥Tr the unit will NOT use the low limit of
randomization.
Example:
P=30minutes (res=1min) and Tr=45minutes (res=15min) =>-15< modem reset <75
In this case the lower limit of randomization will not be used:
P≤ modem reset interval ≤75
Data format: Resolution of programmable threshold is 15 minutes, 1 byte
Default value (Dec): 0 (no randomization)

Cellocator Cello
Programming Manual
6.4.12 GSM Band & GPRS Auth Type

Setting proper values of network selection and PPP GPRS Connection Authentication type
enables accelerating the GSM and GPRS registration process.
On each modem’s initialization the unit will check network setting and modify it if the
actual setting of the modem differs from the one, programmed in this section.
Same way on each modem’s initialization the unit will check the PPP GPRS Connection
Authentication type and modify it if the actual Authentication type of the modem differs
from programmed in this section.
6.4.12.1 Cellular Network Selection

Description: This parameter enables to allow 3G Modem free switching between
networks (2G, 3G), or to fix it to a certain network (for example in cases which fallback
from 3G to 2G is not allowed).
Range:
Enum Description
0 Automatic
1 Reserved
2 2G Only
3 3G Only
4 4G Only
Default value: 0 – Automatic

Cellocator Cello
Programming Manual
6.4.13 SIM PIN
6.4.13.1 Enable Auto SIM PIN Locking

Description: If this bit is enabled (‘1’) the unit will auto-lock the SIM card with the PIN
code programmed on addresses 1326 – 1329 (dec)
NOTES:
 Once enabled, the SIM PIN locking is irreversible; there is no way to cancel SIM PIN
locking by command.
 The user has to upload the content of the programming after activation of this flag
and programming in order to re-synchronize between the configuration file and the
actual content of the programming.
IMPORTANT: Incorrect usage of this feature might cause SIM card blocking!
Refer to the description in the New SIM PIN section below for further details.
Default: 0 (Disable)
6.4.13.2 Active SIM PIN
Addresses: 197-200
Name in Programmer: SIM PIN
Description: This parameter stores the PIN code that will be entered to unlock the GSM
SIM card when required.
Data format (GSM): The bytes contain the digits of the PIN, encoded in BCD. The order
of the transmission is bytes with lower address first, lower nibbles first. If only the lower
nibble of a byte is used (this is legal only in the last byte – in case this is the last digit of
the PIN), the higher nibble should have all of its bits set (the nibble should contain 15
dec). The rest of the bytes that are not used should contain 0xFF.
Default value (dec): 1234
6.4.13.3 New SIM PIN
Addresses: 1326-1329
This parameter stores the new PIN code that should be used for locking the SIM Card
during the SIM Lock procedure. This code will replace the Active SIM PIN on address 197-
200 upon successful completion of the SIM Lock procedure:

Cellocator Cello
Programming Manual
Boot
Use number from "SIM

PIN" field when PIN code is
requested.
SIM No
Lockin
g
Enable
Yes
SIM Yes
PIN
==New
SIM
No
Lock SIM with new SIM PIN

code" (old code is needed to
accomplish this procedure)
Replace SIM PIN by New PIN Normal operation

(usage of "SIM PIN")
NOTE: Since the unit is actively modifying content of its programming cells (replacing the
old Pin code by the new one) the configuration file and the actual content of programming
will lose synchronization. It is very important to synchronize them by uploading the actual
content of the configuration memory from the unit before next configuration cycle.
WARNING: Programming the same configuration file twice, without uploading an actual
content of programmable cells after the first programming, will cause immediate blocking
of the SIM card.
Data format (GSM): The bytes contain the digits of the PIN, encoded in BCD. The order
of the transmission is bytes with lower address first, lower nibbles first. If only the lower
nibble of a byte is used (this is legal only in the last byte – in case this is the last digit of
the PIN), the higher nibble should have all of its bits set (the nibble should contain 15
dec). The rest of the bytes that are not used should contain FFh.

Cellocator Cello
Programming Manual
Default value (dec): 1234
6.4.13.4 Lock to Certain IMSI
Address: 1914
Description: If this parameter contains a value of 5 or 6 BCD numbers, the unit will
validate an international mobile subscriber identity (MCC + MNC) of its SIM card ~15
seconds after any wake up. If the value of the SIM is different from the value predefined
in this parameter – the unit will switch off the modem. If this parameter contains a value
smaller than 5 digits the feature is disabled.
6.5 Power Management
6.5.1 Power Management Mode
Address: 266
Description: This parameter defines power consumption of the unit during Ignition Off
mode.
Power consumption reduction is achieved as a trade off with availability: as the
availability is lower, the power consumption is lower. The main power consumers of the
unit are GPS and GSM modules; the unit switches them off periodically during parking.
Programmed Mode Description Current

Value Description Consumption
0 No Both GSM and GPS modules are

hibernation fully active during parking, GPRS
session active
2 Full Both GSM and GPS modules are (while both GPS &
Hibernation in asynchronous peeking as per GSM off)
programming below.
The unit does not respond to
RS232 queries as well
Note: In this mode Security
Modification will not be able to
detect Signal Correlation
Default value: 2

Cellocator Cello
Programming Manual
6.5.2 Hibernation Mode Delay
Address: 271-272
Description: This parameter defines time interval between Stop Event and entering any
programmed Hibernation Mode.
Note: a reception of message from server side (except ACK responses) in the delay period
will reset the delay (i.e. the unit will count again the configured delay from last message
reception before going to hibernation).
Data format: 16-bit unsigned integer, 16 seconds resolution
Value span: 0x01 (16 seconds) through 0xFFFF (291 hours)
Default value: 60’, (16 minutes)
6.5.3 Enable Pre-Hibernation Update
Address: 4, bit 6 for event

Description: This parameter enables and disables an update, before entering the full
hibernation mode.
The update is not generated during GSM or GPS communication peeks, only between the
Stop Event and entering the full hibernation; 15 seconds before an expiration of
Hibernation Mode Delay timeout (Address 271).
In case of Hibernation Mode Delay timeout = 0, the event will be generated just after the
Stop event.
Default: Both disable (zeroes)
6.5.4 Enable Data Forwarding from Serial Port by SMS (in Hibernation)
Address: 4 bit 5
Description: If this parameter is disabled, the unit will not try forwarding data from 3 rd
party device connected to unit's COM port (over CSP or Transparent Data protocols)
through SMS in hibernation. (in case GPRS is not available or disabled, the forwarded
data will be accumulated in unit's buffer).
Default value: Disabled (1)

Cellocator Cello
Programming Manual
6.5.5 GPS Peeking
6.5.5.1 GPS Peeking – Max On Time
Address: 263
Description: GPS peeking is a power management of GPS receiver, which enables to
reduce its power consumption.
GPS peeking is activated in Ignition Off mode only, when Power Management mode is
defined as 1or 2. Except for CelloTrack family, which is explained in section 12.1 below.
This parameter defines the maximum amount of time the GPS is kept turned on while
peeking. The GPS will be turned off once a fix is achieved, or if the Max. On Time expires.
Value span: 01h (16 seconds) through 255 (68 minutes); zero value is illegal and
shouldn't be used
Default value: 5’ (1 minute 20 seconds)
6.5.6 GSM Peeking
6.5.6.1 GSM Peeking – Maximum Network Registration Time
Address: 270
Description: GSM Peeking is a power management of GSM Modem, which allow to
reduce its power consumption.
GSM peeking is activated in Ignition Off mode only, when Power management mode is
defined as 2.

Cellocator Cello
Programming Manual
Maximum Network Registration Time: This parameter defines time interval, given to
GSM modem for registration into cellular network. If registration wasn’t accomplished
during that time – the modem is being turned off for Off Time.
Maximum Network Registration Time overlaps with the "stronger" Maximum Modem On
Time (defined in address 267). The modem is switched back off when Maximum Modem
On Time expires and there is no data transfer for at least 10 seconds (even if Maximum
Network Registration Time was configured to a higher value which hasn't expired yet).
Value span: 01h (16 seconds) through 255 (72.8 hours)
Default value: 4 (1 minute and 4 seconds)
6.5.6.2 GSM Peeking – Modem Off time
Address: 268-269
Description: This parameter defines the amount of time between GSM peeks. (Refer to
the chart in GSM Peeking – Maximum Network Registration Time). During this time the
GSM Modem is turned off, to conserve energy).
Data format: 16-bit unsigned integer, 16 seconds resolution.
Value span: 02h (32 seconds between two consecutive peeks) through FFFFh (~12 days
between two consecutive peeks). Values below 32 seconds (<02h) are illegal and
shouldn’t be used.
Default value: 225 (1 hour from the end of one peek to the start of the next one)
6.5.6.3 GSM Peeking – Maximum Modem On time
Address: 267
Description: This parameter defines time the modem is kept turned on after waking up.
Note that Maximum Modem On Time overlaps with the "weaker" Maximum Network
Registration Time (defined in address 270), i.e. the Modem will be turned Off after
Maximum Modem On Time, even if Maximum Network Registration Time was configured
to a higher value which hasn't expired yet. If GPRS is enabled, the unit will dial GPRS and
connect to the communication server during this time.

Cellocator Cello
Programming Manual

Value span: 01h through FFFFh; value of 0 is illegal and shouldn’t be used
Default value: 4 (1 minute and 4 seconds)
6.6 Voice Call Settings
6.6.1 Voice Call Destination Number
Addresses: 273-282
Description: Stores the default target address used by the unit to establish Voice call,
initiated by the driver. Under normal circumstances, this will be a voice line phone
number of Central Control room.
Data format: First byte should contain the total amount of digits that make up the actual
address (not including address type byte). Second byte is the address type byte, which
should be 91h for international address (recommended type to use, to allow roaming) or
81h for local address. The rest of the bytes contain the actual address, encoded in BCD.
The order of the transmission is bytes with lower address first, lower nibbles (nibble = 4
bit) first. If only the lower nibble of a byte is used (this is legal only in the last byte – in
case this is the last digit of the address), the higher nibble should have all of its bits set
(the nibble should contain 15 dec). The rest of the bytes that are not used should contain
FFh.
Default value: Null
6.7 Informative Parameters
6.7.1 Last Distance Event
Address: 85-88
Description: This parameter stores odometer value (in base units) recorded upon last
Distance event generation. This parameter is not recommended for user modification, it is
managed by the unit for recovery situations.
If upon programming the value programmed in this parameter will be higher than the
value of odometer, the unit will overwrite it with the value of odometer.
Data format: The parameter is a 32-bit integer
Value span: 32bits range
Default value: 0

Cellocator Cello
Programming Manual
6.7.2 Field for Customer Use
Address: 1314 – 1317

Description: This field is designed to store customer’s proprietary data (like specific
EEPROM content identifier).
Data format: Customer defined
Default value: zeros

Cellocator Cello
Programming Manual
7 Distance and Speed Events
7.1 Distance Events
7.1.1 Enable Distance Updates
Address: 99 bit 1 for Plain Events

102 bit 1 for Distress Events
Description: This parameter enables generation of the Events and/or Distresses upon
the passage of a certain distance.
The distance updates are generated with respect to Home or Roam GSM network and the
speed of the vehicle. Normally the customer would expect reported distance to be longer
in Roam networks (to save on a communication in roaming GSM) and on high speeds,
where the rear events can still provide a good picture of the root.
Default value: Both zeros (disabled)
7.1.2 Trip for a Distance Event
Address: 89 – 91 for Home Network

32 – 34 for Roam Network
Description: This parameter defines a distance between two consequences Distance
updates (events or distresses). The distance is in basic distance units.
Data format: The parameter is an unsigned a 24-bit integer
Default value: 5
7.1.3 Distance Event Multiplier for HIGH SPEED Mode
Address: 92, bits 0-3 for Home Network

35, bits 0-3 for Roam Network
Description: This parameter defines a multiplying factor of distance update for normal
and high speeds. The speed is considered "high" when higher then programmed in
Velocity threshold for HIGH SPEED mode on address 455.
For example: if Trip for a Distance event is set to 100 meters, and Distance Event
Multiplier for roaming is set to 4, the unit will set distance updates in roaming mode to
every 400 meters.
Default value: Both 1

Cellocator Cello
Programming Manual
7.2 Over and Idle Speed
7.2.1 Velocity Threshold for Over Speed Start Event
Address: 93
Description: This parameter stores velocity threshold used for Over Speeding session
start. If velocity of the vehicle is higher than this threshold, for longer than programmed
in the Over Speed Duration filter parameter, the unit will consider over-speeding. If
corresponding updates are enabled, the unit will generate event or/and distress.
Note that the Overspeed start will be registered on a velocity of ~2km/h higher than
programmed. In addition, this threshold is only used when not in “Trailer mode” and not
in “Input dependent Over Speed” mode
Value resolution: Units in 32 cm/sec
Default value: 91 (105km/h)
7.2.2 Velocity Threshold for Over Speed End Event
Address: 94
Description: This parameter stores velocity threshold used for Over Speeding session
end (only if the Over Speeding session is already open). If velocity of the vehicle gets
lower than this threshold, for longer than programmed in Over Speed Duration filter
parameter (or immediately as per the configuration flag described below), the unit will
consider end of over-speeding.
If corresponding updates are enabled, the unit will generate event or/and distress.
Note that this threshold is only used when not in “Trailer mode” and not in “Input
dependent Over Speed” mode
Default value: 87 (100km/h)
7.2.3 Filter of Over Speed Duration
Address: 95
Description: This parameter stores timeout value, used to consider the speed violation
start/stop. It actually defines the over speed duration which will cause a corresponding
update (if enabled).
Value resolution & span: Duration resolution is 2.5 Seconds. Duration Span from: 0
seconds (0x00h), to 10min 30 sec (0xFEh).

Cellocator Cello
Programming Manual
7.2.4 Do not use Time Filter to Close Over Speed Session
Address: 492, bit 4

Description: If this bit is set, any open over speed sessions will be closed when the
speed of the vehicle will get lower then "Velocity threshold for GPS over Speed End"
threshold.
Default value: 0 (disabled)
7.2.5 Alternative Over Speed Threshold for Input Dependent Mode
Address: 2391
Description: The unit supports automatic change of over-speed thresholds while certain
input is triggered.
This is useful to change over-speed threshold while raining (in this case the input will be
connected to the wipers wire) or at night (in this case the input will be connected to the
vehicle lights).
Function 12 is available in a list of options available for “Function assigned” byte in input’s
configuration. When it is selected for any input (except ignition), and this input is
triggered, the unit will automatically use speed threshold programmed on address 2391
as both Over-speed start and Over-speed end thresholds.
NOTES:
 Over-speed threshold may change only while over-speed session is NOT active.
 If the input changes its state while the over-speed session is active – the unit will
keep using over-speed thresholds selected upon over-speed session start.
 If both the “Trailer mode” and “Input dependent Over Speed” modes are active
concurrently the unit will select the lowest speed threshold out of two.
Specific Transmission Reason byte of Over-Speed alert
Upon detection of over-speed violation the unit is sensing event or/and distress with
transmission reason 34(start)/42 (stop). The “Specific Transmission Reason” byte of
those messages will contain value “1” if the unit is utilizing alternative Over-speed
thresholds while generating them.
This parameter contains an alternative value of Over-speed threshold, used when an
input, programmed as “Over-speed threshold control” is triggered.
The same value is used for both Over-speed start and Over-speed end thresholds.
The over-speed time filter (programmed on address 95) shall expire prior to alert
generation irrespectively to the selected speed thresholds.
Resolution: 32 cm/sec
Default value: 70km/h

Cellocator Cello
Programming Manual
7.2.6 Velocity Threshold for Idle Speed Start Event
Address: 97
Description: This parameter stores velocity threshold used for Idle Speeding session
start (Idle Speeding refers to when the vehicle is parking with a working engine). If
velocity of the vehicle gets lower than this threshold, for longer than programmed in Idle
Speed Duration filter parameter (from ignition on or from higher speed), the unit will
consider Idle Speeding start.
Default value: 14 (16 km/h)
7.2.7 Velocity Threshold for Idle End Event
Address: 96
Description: This parameter stores velocity threshold used for Idle Speeding end (only if
the Idle Speeding session is already open). If velocity of the vehicle gets higher than this
threshold, for longer than programmed in Over Speed Duration filter parameter (or
immediately as per the configuration flag described below), the unit will consider end of
idle-speeding.
Default value: 16 (19 km/h)
7.2.8 Filter of Idle Speed Duration
Address: 98
Description: Timeout value, used to consider the idle speed violation start /end.
Value resolution & span: Duration resolution is 2.5 seconds.
Duration Span from: 0 seconds (0x00), to 10 min 50 sec (0xFE)
7.2.9 Multiplier for Idle Speed Start Detection Time Filter

Description: This parameter contains a value of multiplier, used to increase dramatically
Idle Speed Start detection time.

Cellocator Cello
Programming Manual
Time for generation = Idle Speed * (Multiplier +1)

Idle Speed Start Duration Filter
Value of 0 disables multiplier.

Default: zero
7.2.10 Do not use Time Filter to Close Idle Speed Session
Address: 492, bit 5

Description: If this bit is set, any open idle speed sessions will be closed when the speed
of the vehicle will get higher than "Velocity threshold for GPS Idle Speed End" for longer
than 10 seconds.
7.2.11 Start Idle Speed Timer with Ignition On
Address: 492, bit 6

Description: When this bit is set, the unit will start counting time to Idle Speed Start
from the Ignition On detection. Otherwise (if this bit is zero) the timer activated from the
first time the speed is getting lower than Velocity threshold for GPS Idle Speed Start
7.2.12 Create Idle/Over Speed End Update for an Open Session per
Ignition Off
Address: 492, bit 7

Description: When this bit is set, the unit will close opened Idle/Over Speed sessions
upon ignition off and generate an appropriate updates.
Otherwise (this bit is zero) the unit will not generate an appropriate updates and simply
close any open speed session upon Ignition off.
7.2.13 Events and Distress Control
7.2.13.1 Enable Distress for Idle Speed Start/End
Address: 102, bit 3

Cellocator Cello
Programming Manual
Description: If this bit is set the unit will generate distress session upon every Idle
Speed start /end.
7.2.13.2 Enable Events for Idle Speed Start/End
Address: 99, bit 3

Description: If this bit is set the unit will generate an event upon every Idle Speed start
/end.
7.2.13.3 Enable Events for Over Speed Start/End
Address: 99, bit 2

Description: If this bit is set the unit will generate an event upon every Over Speed start
/end.
7.2.13.4 Enter Distress for Over Speed Start/End
Address: 102, bit 2

Description: If this bit is set the unit will generate distress session upon every Over
Speed start /end.
7.3 Sudden Course Changed and Sudden Speed Change

Sensors
Sudden Course Change and Sudden Speed Change sensors are derived from the GPS
output; they analyze the delta speed and course between GPS fixes.
The speed and course thresholds are provided separately for each of 4 ranges of speed.
7.3.1 Speed Thresholds V0, V1 and V2
Address: V0-473
V1-474
V2-475
Description: The 4 speed ranges are defined by 3 speed thresholds: V0, V1 and V2

Cellocator Cello
Programming Manual
Speed Range 3
V2
Speed Range 2
V1
Speed Range 1
V0
Speed Range 0
0 km/h
The speed ranges threshold (V0, V1, V2) must meet the condition: V0<V1<V2
Data format: 8 bits parameters with resolution of 16 cm/sec
7.3.2 Delta Speed and Delta Course for Speed Range X
Description: The sensors will trigger if the delta speed or/and course between two
adjacent valid fixes (the unit is getting an updated GPS data fix every 1 second)
exceeds a predefined speed or/and course thresholds for the specific speed
range (if the current or last fix is invalid, the sensors won't trigger).
The following table contains address of speed and course thresholds for each speed range:
Harsh Braking Acceleration Course Delta

Threshold Threshold Threshold
Speed Range 8 bits parameters 8 bits parameters 8 bits parameters
with resolution of with resolution of with resolution of
16 cm/sec 16 cm/sec 0.016 rad
Speed Range 0 476 511 480
Zero value in any of the parameters above will cancel the corresponding sensor for the
specific speed range.
Default Values:
Address (Dec) Value (Dec) Value
473 34 19.6 km/h
474 104 60 km/h
475 173 99.6 km/h
476 17 9.8 km/h

Cellocator Cello
Programming Manual
Address (Dec) Value (Dec) Value
477 17 9.8 km/h
478 17 9.8 km/h
479 17 9.8 km/h
480 49 45°
481 49 45°
482 49 45°
483 49 45°
511 17 9.8 km/h
512 17 9.8 km/h
513 17 9.8 km/h
514 17 9.8 km/h
Note: Sudden Course Change events will be masked when the speed is under 5 km/h.
7.3.3 Events, Distress and HRLS Updates Control
7.3.3.1 Sudden Speed Change (Acceleration and Harsh Braking)
Address: 99, bit 4 for Events

102, bit 4 for Distress
103, bit 4 for HRLS
Description: If this bit is set, the unit will generate a corresponding update for any
detected harsh acceleration and harsh braking.
Default Values: zeros (disabled)
7.3.3.2 Sudden Course Change

103, bit 5 for HRLS
Description: If this bit is set, the unit will generate a corresponding update for any
detected harsh course change. Note: sudden course change events which occurred when
the speed is under 5 km/h will be filtered.

Cellocator Cello
Programming Manual
Default Values: zeros (disabled)

Cellocator Cello
Programming Manual
8 Time and Trip Events
8.1 Start and Stop Alerts
8.1.1 Start Alert Generation Time Filter
Address: 104
Name in Programmer: Start Event Time Filter
Description: This parameter stores time filter, defining a required duration of stable
Ignition On state (after ignition state change) for triggering Start (driving session) alert.
Note that when the CelloTrack-Nano is in hibernation state, this time may be prolonged
by up to 10 seconds (it’s a system limitation).
The control of alert type (plain event / distress event) is made from Ignition Input
Settings folder.
Value resolution & span: Duration resolution is 2.56 seconds.
Default value: 10.32 sec.
8.1.2 Stop Alert Generation Time Filter
Address: 105
Name in Programmer: Stop Event Time Filter
Description: This parameter stores time filter, defining a required duration of stable
Ignition Off state (after ignition state change) for triggering Stop (driving session) alert.
Note that when the CelloTrack-Nano is in hibernation state, this time may be prolonged
by up to 10 seconds (it’s a system limitation).
The control of alert type (plain event / distress event) is made from Ignition Input
Settings folder.
Value resolution & span: Duration resolution is 2.56 seconds
Default value: 10.32 sec.
8.2 Time-based Alert
This group of parameter controls time period of the updates, generated by the unit
periodically between "Start" and "Stop" (when ignition switch is on). “Time alerts” or
periodical updates are not generated after "Stop" (when ignition switch is off).
This period is controlled also by the OTA Tracking Command and applied on the fly with
no reset.

Cellocator Cello
Programming Manual
Time-based alert period might be automatically modified by the unit in real time as a
function of the following conditions:
 GSM condition: Home, Roam GSM network or No GSM coverage mode
 Speed: High Speed mode or Normal Speed mode.

There is also a possibility of dynamic Time-based alert period modification as a function of
speed, refer to V-Trek feature below.
8.2.1 Time Alerts Resolution Definer
Address: 106, bit 7 for Home network

499, bit 7 for Roam network
Description: This bit defines resolution of the Timed Event Period. This resolution can be
either 4 (when this bit is 0) or 90 seconds (when this bit is 1).
Resolution of 4 seconds enables setting Time-based alert period up to every ~8.4
minutes, resolution of 90seconds, up to ~3:10 hours
Note: In case 3 parameters: " Force one second resolution Rome Mode ", "Resolution
Definer in Roaming Mode" and "Time Report Period value in Roaming Mode" parameters
are zero (value on address 499 and 526 bit 1 are 0), the unit will use Home parameters
(programmed on address 106 and 526 bit 0) during Roaming.
Default value: 0 – resolution of time-based alert period is 4 seconds
8.2.2 Time Alerts Period Value
Address: 106, bits 0-6 for Home network (TEPH)

499, bits 0-6 for Roam network (TEPR)
Description: This parameter stores a Time-based alert Period value with resolution
configured in previous parameter (4 or 90 seconds). Value 0 disables the time-based
alerts.
Note: In case 3 parameters: " Force one second resolution Rome Mode ", "Resolution
Definer in Roaming Mode" and "Time Report Period value in Roaming Mode" parameters
are zero (value on address 499 and 526 bit 1 are 0), the unit will use Home parameters
(programmed on address 106 and 526 bit 0) during Roaming.
Default value: 75 (300 seconds when resolution is set to 4 seconds)
8.2.3 Force one second resolution Roaming Mode
Address: 526, bit 0 for Home GSM network

526, bit 1 for Roam GSM network

Cellocator Cello
Programming Manual
Description: This parameter forces the resolution of Time-based alert to one second,
irrespectively to the values, programmed on addresses 106 and 499.
Default value: both 0 (disabled)
8.2.4 Time Alert Period Multiplier for High Speed Mode
Address: 92, bits 4-7 for Home GSM network

35, bits 4-7 for Roam GSM network
Description: This parameter stores the Multiplier of time-based alert Period during High
Speed mode. For example if the programmed value is 2, on speed higher then Velocity
Threshold for High Speed mode, the unit will generate two times less time-based alerts in
a given period (i.e. if when not in High Speed mode the unit generates a time-based alert
every x seconds, in High Speed mode the unit will generate a time-based alert every 2x
seconds). Value of zero disables the time-based alerts in High Speed mode.
Default value: 1
8.2.5 Time Report Period Multiplier for NOIP Mode
Address: 485
Description: This parameter enables automatic change of time events period during NO
IP mode (while GPRS is unavailable):
The basic time event period is multiplied by the factor programmed in this parameter.
Note: value of Zero is legal and considered by the unit as "1".
Default value: 1

Cellocator Cello
Programming Manual
8.2.6 Table of Time-based Alert Period Calculation

Home Network Roam Network
Time-based Time-based Time-based Time-based

alerts Resolution alerts Resolution alerts alerts
Definer= 0 Definer= 1 Resolution Resolution
Definer= 0 Definer= 1
Low TEPH * 4 (TEPH +1) * 90 TEPR * 4 (TEPR +1) * 90

Speed seconds seconds seconds seconds
High HSpeedHm * HSpeedHm * HSpeedRm * HSpeedRm *

Speed (TEPH * 4 (TEPH +1)* 90 (BPVR * 4 (BPVR+1)* 90
seconds) seconds seconds) seconds
 TEPH – Time-based alert Period in home network, bits 0:6 of address 106’
 TEPR – Basic period value in roam network, bits 0:6 of address 499 (value of zero will
cause the unit to use Home settings during roaming)
 HSpeedHm – Time-based alert period multiplier for high speed mode in Home
network, (bits 4:7 of address 92)
 HSpeedRm – Time-based alert period multiplier for high speed mode in Roam
network, (bits 4:7 of address 35)
8.3 Curve Smoothing
The idea behind this feature is to provide a good correlation between the reported
locations to the roads on a map without significant increase of communication cost.
Neither time nor distance events enable tracking as a function of road curves (note that it
is possible to utilize sudden course change detection for "curve smoothing" with
significant traffic increase), and the path on the map doesn't appear accurate enough, as
shown below.

Cellocator Cello
Programming Manual
Detecting movement vector change dramatically improves the stickiness to the road and
readability of the reports, but will also dramatically increase the traffic:
The vector change detection has to be supported by data compression in order to ensure
good stickiness to a road curve for a reasonable price.
The vector change detection occurrence may be reported as a plain/distress events with
TR204 (vector change Report), or as a bulk of up to 6 vector change detection
occurrences, compressed into a single message type 9 , sub-data D (refer to a wireless
protocol for more details).
8.3.1 Enable Vector Change Detection Events /Distress

Description: If this bit is enabled, upon generation of Start (or the first GPS Nav. Start
after Start if there is no valid GPS upon Start) the unit stores reference vector of course.

Cellocator Cello
Programming Manual
The unit stores reference GPS stamp value (time, date, latitude, longitude, speed and
course) every time it is detecting change of course's vector.
The stored reference course value is compared with the value of course received with
every new valid GPS frame. If the received value of course differs from stored one more
then the value of vector change programmable parameter (5° by default), the unit
will log vector change detection occurrence (not event in the logged memory yet but in
a volatile memory) and replaces reference course value by the new one.
Note that if compressed vector change report is enabled, the value of this parameter will
be ignored.
If compressed vector change report (next parameter) is disabled the unit will
generate a dedicated event/distress type 0 with TR204 (Vector Change Report).
Default: Both disable
8.3.2 Enable Compressed Vector Change Report

Description: If this bit is enabled, settings of bit's 0 and 1 of this byte (previous
parameter) will be ignored. In this case the compressed vector change data will be sent
by the unit in the following cases:
 Upon detection of 6th vector change detection occurrence. In this case the system
will generate a Msg type 9 containing all 6 vector change detection occurrences.
 Timeout. If at least one vector change event is stored in unit's memory and no other
vector changes were generated by the unit during the pre-programmed period, the
system will generate Msg type 9 containing all previous vector change detection
occurrences.
 Upon Stop. Msg type 9 containing all previous vector change detection occurrences
(if any) will be generated immediately upon stop report.
 Upon reset command the Msg type 9 containing all previous vector change
detection occurrences (if any) will be generated.
The Compressed Vector change Report Msg type 9 will be logged in the same message
stack as plain event type 0, will utilize the same sequence of numerator and acknowledge
rules.
The Compressed Vector change Report Msg type 9 will NEVER be generated as real-time
or distress event, only as logged event.
Upon power up/reset the unit will record reference course/coordinates upon reception of
the first valid GPS packet.
Note: When no significant course changes are detected by the unit (for example when
driving long straight roads), the unit will send periodic “Compressed Vector Change
Reports” to avoid compressed data overflow.

Cellocator Cello
Programming Manual
8.3.3 Compressed Vector Change Report Timeout
Address: 1434
Description: This parameter contains a timeout to generate Msg type 9 containing all
logged vector change detection occurrences before six occurrences were accumulated.
This parameter will take affect when:
 Compress Vector change Detection is enabled,
 At least one vector change detection logged
 No vector change detection occurrence is logged by the unit during the period defined
in this parameter
Range and resolution: Unsigned integer 8 bits, resolution of minutes
Default: 10 minutes
8.3.4 Vector Change Detection Angle
Address: 1435
This parameter defines the minimum course change from last logged event, considered as
Vector change Detection occurrence. Possible values are 0 to 180°.
Range and resolution: 8 bits, unsigned integer, resolution of degrees
Default: 5°
8.4 Communication Idle Alerts
8.4.1 Time between Communication Idle Alerts
Address: 70-71
Name in Programmer: Time between Comm.Idle Transmissions
Description: This parameter defines the maximum time without any communication. If a
message is not received within this timeout, an idle communication alert is registered.
It is possible (configuration bit described below) to wake up the unit from the full
hibernation in order to try delivering this type of alert in real time.
This algorithm is frequently used as a "Heart Bit" of the unit, the "Keep Alive" messaging.
Data format: 16-bit unsigned integer, 1 minute resolution.
Default value: 30 (minutes)

Cellocator Cello
Programming Manual
8.4.2 Event and Distress Controls for Communication Idle Alert

Description: This bit enables alerting Idling of Communication with period programmed
in Time.
Default value: Event enabled (1), distress disabled (0)
8.4.3 Do not Wake Up from Hibernation upon Comm. Idle Distress
Address: 494, bit 7

Description: If this bit is set (1), the unit will not generate a distress Communication
Idle alert in full hibernation, and therefore will not wake up from full hibernation upon
expiration of Time between Communication Idle Alerts timeout.
Default value: 0 - wake up from full hibernation to alert Comm. Idle

Cellocator Cello
Programming Manual

Cellocator Cello
Programming Manual

Cellocator Cello
Programming Manual
9 Inputs Events
9.1 4 – Ignition
Ignition input can be used for detection of journey Start and Stop, which are key events
in unit logic and require an especial treatment, or as a general purpose input (when
journey Start/Stop is detected using an accelerometer).
Journey Start and Stop:
The system will enter hibernation mode between Journey Stop and Journey Start, and will
start generating periodical events between Journey Start and Journey Stop
In case it is used for detection of journey Start and Stop, except "Common Discrete
Inputs Time Filter" applied to every input, the Start/Stop Alert Generation Time Filters are
applied as well.
A general purpose input:
If ignition input is used as a general purpose it is internally pulled down and can recognize
the following signals:
 Low (logical zero) 0V<Vin<3.5V
 High: Vin>9V
Voltages between 3.5V to 9V are undefined.
9.1.1 Reporting Journey Start

488, bit 5 for HRLS
Description: if this bit is set the unit will generate a corresponding alert upon Journey
Start detection (by ignition or by accelerometer).
Default Value: Event enabled (1), Distress and HRLS – disabled (0(
9.1.2 Reporting Journey Stop

486, bit 5 for HRLS
Description: if this bit is set the unit will generate a corresponding alert upon Journey
Stop detection (by ignition or by accelerometer).
Default Value: Event enabled (1), Distress and HRLS – disabled (0(

Cellocator Cello
Programming Manual
9.1.3 Inverting Journey Start/Stop

Address: 100, bit 5
Description:
Once inverted:
The system will report “Journey Start” when low level (by ignition or by accelerometer) is
recognized and vice versa.
Default Value: (0) not inverted
9.1.4 Reporting Signal Falling on Ignition

487, bit 7 for HRLS
Description: if this bit is set the unit will generate a corresponding alert upon detection
of logical level falling from 1 to 0. In case this input is inverted, it will mean generation of
the alert upon disconnection of this input from (-).
Note: This feature will not work when CFE configuration is used.
Default Value: zeros – disabled (0(
9.1.5 Reporting Signal Rising on Ignition

489, bit 7 for HRLS
Description: if this bit is set the unit will generate a corresponding alert upon detection
of logical level rising from 0 to 1. In case this input is inverted, it will mean generation of
the alert upon connection of this input to (-).
Note: This feature will not work when CFE configuration is used.
Default Value: zero – disabled (0(
9.1.6 Inverting Ignition Input

Address: 101, bit 6
Description: Ignition input is internally pulled down and therefore does not require an
inversion in most of the cases.
In case it is serving as a GP and logical levels are opposite to physical levels – the input
shall be inverted.
Default Value: (0) not inverted

Cellocator Cello
Programming Manual
9.2 16 – Panic
This input is equipped by an internal pull up resistor and therefore can only serve as
discrete dry contact.
9.2.1 Function Assigned to Panic Input
Address 1700, bits 0-6

Name in Programmer: Assigned Function
Description: This field enables assignation of certain functionality to a Panic input.
Function Description Comment

number
0 Use as a GP input (default)
1-8 Reserved
9 Volume Up (refer to Volume Control section in this document)
10 Volume Down (refer to Volume Control section in this document)
11 Reserved
12 Over-speed threshold control

If this function is selected, the unit will automatically use speed threshold
programmed on address 2391 as both Over-speed start and Over-speed
end thresholds while this input is triggered.
13-31 Reserved
Default Value: zero – GP input
9.2.2 Inverting Panic Input
Address: 100, bit 6

Description: Panic input is pulled up (internally); therefore it does require an inversion
when it is required to detect activation by low level (-).
Once inverted: the "low" level of signal (below threshold programmed in parameter
above) on this input will be treated as logical "1" (active). The "high" level of signal, as
well as floating state, on this input will be treated as logical "0" (not active).
Default Value: (1) inverted

Cellocator Cello
Programming Manual
9.2.3 Threshold for Panic Input
Address: 1701
Description: This threshold defines the highest voltage on this input, which will still be
considered as logical zero. Any voltage above the value programmed in this parameter
(as well as open contact) will be considered as logical "one".
The unit is continually sampling voltage on this input and comparing the average
measurement (refer to parameter below) with the threshold programmed in this
parameter.
Value span: 57 (0.6V) to 240 (2.7V). Any measured value below 57 or above 240 causes
the unit to convert this value to default (200).
Default Value: 200
9.2.4 Averaging Factor for Panic Input
Address: 1702
Description: The unit is continually sampling voltage on this input every 10 msec. The
moving average of sample's number (preprogrammed in this parameter) is compared
with the threshold (previous parameter) in order to decide concerning the logical level of
the input.
NOTE: In the operational modes listed below the unit is ignoring averaging factor and
processing each measurement sample separately:
 In Full Hibernation mode, including the Modem / GPS On Time
 In Signal Correlation Mode (applicable in security builds only)

Default Value: 10 samples
9.2.5 Reporting Signal Falling on Panic

486, bit 6 for HRLS
Description: If this bit is set the unit will generate a corresponding alert upon detection
of logical level falling from 1 to 0. In case this input is inverted, it will mean generation of
the alert upon disconnection of this input from (-).
Default Value: zeros – disabled (0(

Cellocator Cello
Programming Manual
9.2.6 Reporting Signal Rising On Panic

488, bit 6 for HRLS
Description: If this bit is set the unit will generate a corresponding alert upon detection
of logical level rising from 0 to 1. In case this input is inverted, it will mean generation of
the alert upon connection of this input to (-).
Default Value: zero – disabled (0(

Cellocator Cello
Programming Manual
10 Power Events
10.1 Power Threshold Settings

The thresholds listed below are used to determine if the main and backup power sources
are low.
Each of these conditions for each of the power sources (main and backup) is equipped by
pair of thresholds enabling to alerts in sessions.
10.1.1 Main Power Low Threshold – High/Low levels
Address: 115 – high level

116 – low level
Description: The unit will trigger “Main Battery low” alert if the measured level of the
main power will be lower than the value programmed in Main Power Low Threshold Low
Level parameter.
The unit will trigger “Main Battery OK” alert if the measured level of the main power will
be higher than the value programmed in Main Power Low Threshold High Level.
Data format: 8-bit unsigned,
0.0189V/bit
Default values:
Address 115: 3.591V
Address 116: 3.4965V
10.2 Power Events/Distress Control
10.2.1 Enabled Main Power Disconnected in Ignition Off Mode alert
Address: 121, bit 0 for events

Description: If this bit is set the unit will generate appropriate alerts upon detection
Main Power disconnected session start and end.
Default value: 0 – disabled

Cellocator Cello
Programming Manual
10.2.2 Enabled Main Power Low in Ignition Off Mode Alert

Main Power Low session start and end.
10.2.3 Enabled Backup Battery Disconnected in Ignition Off Mode Alert

Backup Battery Disconnect session start and end.
NOTE: The backup battery disconnection is sensed by voltage on NTC channel.
10.2.4 Enabled Backup Battery Low in Ignition Off Mode Alert

Backup Battery Low session start and end.
10.2.5 Enabled Main Power Disconnected in Ignition On Mode Alert

Main Power disconnected session start and end.

Cellocator Cello
Programming Manual
10.2.6 Enabled Main Power Low in Ignition On Mode Alert

Main Power Low session start and end.
10.2.7 Enabled Backup Battery Disconnected in Ignition On Mode Alert

Backup Battery Disconnect session start and end.
NOTES:
 If backup battery is not installed the unit will not generate the "backup battery
disconnected" alert.
 The backup battery disconnection is sensed by voltage on NTC channel.

10.2.8 Enabled Backup Battery Low in Ignition On Mode Alert

Backup Battery Low session start and end.
10.2.9 Period between the Alerts, Triggered by Detection of Power

Disconnection
Address: 1346
Description: Normally the trigger configured as a "plain event" is only generated once,
and the one configured as "distress" is generating single distress session upon trigger
detection (as described above in this document).

Cellocator Cello
Programming Manual
The "Main Power disconnected" is an exception from this rule. This alert can be generated
many times.
Note that if Main Power Disconnected alert is configured as "Distress" – it will cause a
number of Distress sessions, according to the number, programmed in this parameters.
Resolution and data format: Minutes, from 1 to 255. 0 – backward compatible mode,
cancels the repetitions (event or session will only be generated once)
Default value: 0 – repetitions canceled

Cellocator Cello
Programming Manual
11 Geo-Fences
11.1 Geo-Fence
The group of parameters below contains configuration structures of 100 internal Geo-
Fences of Cellocator unit. Each geo-fence is a rectangular perimeter, activated in a
selected time of the day. It is equipped by violation condition, capable to trigger an alert
or output activity upon occurrence.
During Ignition On mode the unit is continually examining its location and checking if it is
violating a condition of one of the fields.
Each of a 100 geo-fences is a structure of 16 bytes in the following order:
Byte 11
Byte 15
Byte 14
Byte 13
Byte 12
Byte 10
Byte 9
Byte 8
Byte 7
Byte 6
Byte 5
Byte 4
Byte 3
Byte 2
Byte 1
Byte 0
Field Config Maximal Latitude of Fence's Maximal Longitude of Fence's Configuration
description . byte Latitude Centrum Longitude Centrum bytes 1,2 and 3
4 Displace- Displace-
ment ment
Address
Fence 0
2496-2512
2512
2496
Fence 1
2513-2528
2528
2512
Fence 99
4080-4095
4095
4080

Cellocator Cello
Programming Manual
11.1.1 Format of Geographical Perimeter
Address: 2496-4095
Name in Programmer: EdgePoint 0001 – 0100
Description: The perimeter is defined by center coordinates and maximal displacement
for each coordinate (the same structure for longitude and latitude). The coordinates are
the usual 10-8 radians format. The displacement is 10 8 256 radians (the same format like
the coordinates but without the least significant byte and the most significant byte,
keeping only the middle bytes).
Maximal Longitude Displacement Longitude of Fence's Centrum
Segment Byte 8 Segment Byte 7 Segment Byte 6 Segment Byte 5 Segment Byte 4 Segment Byte 3
Maximal Latitude Displacement Latitude of Fence's Centrum
Segment Byte 14 Segment Byte 13 Segment Byte 12 Segment Byte 11 Segment Byte 10 Segment Byte 9
Default value: all bytes are zeroes (all waypoints disabled).
11.1.2 Four Configuration Bytes of the Fence
Address: Bytes 0, 1, 2 and 15 of each fence:

Output Control End time hours3 End time minutes Start time hours Start time minutes
Thresholds Select
Output
31 Speed Limiting
Number
Geo-Fence
1 TOE (LSB)
29 Activation
24 TOE MSB
TOE MSB
pattern
30
28
27
26
25
23
22
21
20
19
18
17
16
15
14
13
12
11
10
9
8
7
6
5
4
3
2
Config. Byte 3 Config. Byte 2 Config. Byte 1 Config. Byte 0
Segment Byte 15 Segment Byte 2 Segment Byte 1 Segment Byte 0
3
In order to set certain fence to be permanently active the start time shall be set to 0:00 and the
end time to 24:00

Cellocator Cello
Programming Manual
11.1.3 TOE - Type of Entry

This field defines the usage of an appropriate Fence entry.
Bit Bit 1 Bit 0 Entry type Geo Fence

24 Heading
Angle
Support
0 0 0 Entry is inactive (the whole 16 No

bytes are ignored by the unit)
0 0 1 Entry is active and treated as Yes

waypoint data
0 1 0 Entry is “keep out” fence data Yes

(unit must be outside location
window)
0 1 1 Entry is “keep in” fence data (unit Yes

must be inside location window)
1 0 0 Entry is treated as Geo-hotspot Yes

(both entering and leaving cause
a trigger)
1 0 1 Entry is treated as Modem Off Yes

zone. The unit generates an
event and switches off the
Cellular modem 10 seconds after
entering the zone.
The modem is turned on
immediately upon exiting from
the "no modem zone".
1 1 0 Speed limiting zone Yes
11.1.4 Waypoint
Waypoints are perimeters, which the unit has to be found at defined time intervals. The
unit must be found in the perimeter for at least one sample in the whole time window.
Once it happens, the waypoint is "checked" (i.e. no additional checks will be done for this
waypoint). If this does not happen, the unit will trigger a dedicated alert.
11.1.5 Geo Hot Spot

Generates trigger on entry and exit to a fenced zone. Transmission reason 191, Trigger's
transmission-reason-specific data: Bits 0-6 is the index of the slot. Most significant bit (bit

Cellocator Cello
Programming Manual
7) indicates direction: entry to hot spot ("1") or exit from hot spot ("0"). Behavior is not
affected by fence logic bit. Please note, Hot-Spot does not trigger outputs.
11.1.6 No Modem Zone

Generates trigger when shutting down modem as a result of entry to "no modem zone".
Trigger is generated only for the first fence that causes the modem's shutdown. Upon
entry to another overlapping (or common boundary) "no modem" zones, while modem is
already turned off, no more triggers are generated. Modem is shut down 10 seconds after
entering "no modem zone", regardless of trigger settings.
The modem is turned on immediately upon exiting from the "no modem zone".
11.2 Fences Configuration
11.2.1 Geo-Fence Logic
Address: 6, bit 5
Description: This parameter defines the reference of the unit to the geo-fences
(Applicable only for Keep In and Keep Out types).
Global context mode (fence logic = 0)
Keep in fences logic:
When position changes, trigger is generated if both terms below are true:
 In the new position *ALL* keep-in fences are in violation state (meaning - position is
outside all keep-in fences).
 Previously at least one of the fences wasn't in violation state (position was in the area
of at least one of the fences).
Trigger's transmission-reason-specific data is the index of latest slot that changed its
status to violation state.
Keep out fences logic:
When position changes, trigger is generated if both the terms below are true:
 In the new position at least one of the fences is in violation state (meaning - position
is inside one of the keep-out fences).
 Previously *ALL* keep-out fences weren't in violation state (position was outside the
area of all keep-out fences).
Trigger's transmission-reason-specific data is the index of latest slot that changed its
status to violation state.
Discrete context mode (fence logic = 1):

Cellocator Cello
Programming Manual
Triggers are generated discretely for violation of each keep-in/out fence, regardless of
other fences status. Trigger's transmission-reason-specific data is the index of the slot
that changed its status to violation state.
Default: 0 - Global context mode
11.2.2 Geo-Fence Violation Filter
Address: 1006
Description: This parameter designed to reduce number of fault Geo-Fence violation
events. It defines required amount of sequential valid GPS packets (GPS packets are
received every second) introducing Geo-Fence violation in order to generate an alert.
Default value: 1
Note: the violation filter is not applicable with waypoint type Geo-Fences (since by
definition, in a waypoint type Geo-Fence one GPS sample in which the unit is inside the
Geo-Fence perimeter is enough to "check" positively this Geo-Fence).
11.2.3 Ignore Geo-Fence Violation on Boot (after Reset)
Address: 1, bit 2
Description: If this bit is set, the "first geo-violation changes ignore" mode is activated.
This mode allows avoiding generation violation repetitions upon any kind of reset. In this
mode, the unit will use the first stable violation state as the baseline for subsequent
processing of geo-fences.
This means that any geo-fences in violation state on the first stable status are not
reported, and only subsequent changes are reported.
Once started, "first geo-violation changes ignore" mode terminates when:
 A valid, stable GPS fix and geo-fence state is achieved. Any geo-violations at this
point are not reported, and used as baseline.
 120 seconds timeout expires. The rationale for this is not ignore important changes
occurring at a later time, if this state started when there is no GPS coverage.
 After "first geo-violation changes ignore mode" ends, subsequent geo-violation

changes are reported as usual.
Note that due to this mode's timeout, if GPS takes longer than 120 seconds to achieve a
fix after boot, any active geo-violation will be reported as usual when GPS fix is finally
achieved
Default value: 0 – Do not ignore violations on boot

Cellocator Cello
Programming Manual
11.2.4 Control of Geo-Fence Alters (Events and Distress)
11.2.4.1 Keep In Geo-Fence Zone Violation

1005, bit 0
Description: If this bit is enabled the unit will generate an alerts upon violation of Keep
In Type of Geo-Zones.
Default: 0 – both Disable
11.2.4.2 Keep Out Geo-Fence Zone Violation

1005, bit 1
Description: If this bit is enabled the unit will generate an alerts upon violation of Keep
Out Type of Geo-Zones.
11.2.4.3 Way Point Violation

1005, bit 2
Description: If this bit is enabled the unit will generate an alerts upon violation of Way
Point Type of Geo-Zones.
11.2.4.4 Geo Hot Spot Violation

1005, bit 3
Description: If this bit is enabled the unit will generate an alerts upon violation of Geo
Hot Spot Type of Geo-Zones.
11.2.4.5 No Modem Zone Entry

1005, bit 4

Cellocator Cello
Programming Manual
Description: If this bit is enabled the unit will generate an alerts upon violation of No
Modem Type of Geo-Zones.
11.2.5 Geo-Fence Heading Angle
Address: 1921-2020
Description: This feature enables each Geo-Fence to be conditioned by the vehicle’s
approach angle. An array of 100 bytes was allocated in the unit’s configuration memory to
hold the Geo-Fence approach angle entries. Each entry holds a number between 0 to 11
representing 12 possible angle ranges of 30 degrees with resolution of +- 30 Degrees.
Each entry also holds control bits to enable the Geo-Fence Angle for direct and opposite
headings.
Enable Enable Spare Geo-Fence Approach Angle
direct Opposite
approach approach Code Engle
Angle angle [Degrease]
0 0
1 30
2 60
3 90
4 120
5 150
6 180
7 210
8 240
9 270
10 300
11 330
7 6 5 4 0-3
The following diagram shows possible scenario of a vehicle approaching geo-Fence with
predefined heading relative to earth’s north and the same vehicle approaching the same
geo-fence from the opposite direction. In this case both enable bits must be set to detect
the event. The feature can trigger outputs just like any Geo-Fence. It is possible to
generate audible alert via CE8 device if PSP is enabled and Geo-Fence output code
number 7 is selected. See Geo-Fence output control. For more information about the
relations between GEO-Fence heading and the TOE (Type of Entry field setting the Goe-
Fence functional settings please refer to: GeoEnceHeadingAngleSupport. Please note Hot-
Spot does not support output activation.

Cellocator Cello
Programming Manual
Opposite Approach
Angle
N
180
Camera
Geo-Fence
N
Direct Approach
180
Angle
Default: 0 – Disable
11.2.6 Geo-Fence Priority
Address: 6550-6574
Description: Geo-Fences are defined by a center coordinate, and latitude + longitude
displacements from center (i.e. only rectangular zones can be defined).
Thus, when trying to cover a road (which obviously has turns and curves) with the
rectangular Geo-Fences, some overlapping between Geo-Fences is necessary.
In some cases, this causes the unit to produce too many speed violation events, which may
cause excess workload and confusion to the operator.
To solve this and create zone "continuity", a configurable priority is assigned for each Geo-
Fence.
The priorities are:
Priority Value
1 (highest) 00
2 01
3 10
4 (lowest) - default 11
Address 6574 ... Address 6550

GeoFence GeoFence GeoFence GeoFence GeoFence GeoFence GeoFence GeoFence
...
100 99 98 97 4 3 2 1
1 1 1 1 1 1 1 1 ... 1 1 1 1 1 1 1 1

Cellocator Cello
Programming Manual
Bit Bit Bit Bit Bit Bit Bit Bit Bit Bit Bit Bit Bit Bit Bit Bit
...
7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
When the priorities of overlapping Geo-Fences are different, the unit considers only the
boundary of the highest priority Geo-Fence:
Priority 1 Priority 1
When the priorities of overlapping Geo-Fences are equal, the unit considers them as one
Geo-Fence with common boundaries:
Priority 2

Cellocator Cello
Programming Manual
12 CelloTrack
This section describes parameters associated with CelloTrack devices (both CelloTrack
and CelloTrack Power). The CelloTrack Power device has more programming features
associated with charging logic. Please refer to here for more CelloTrack Power
configuration options.
12.1 CelloTrack Configuration 1

Address: 1318
Description: This parameter contains a bitmap, allowing controlling different activities of
the CelloTrack unit.
Enable GPS Enable Enable Enable Live Disable LED Disable LED Disable LED Disable LED
peeking in Event on Distress on Tracking 2 in 1 in 2(System 1(GSM
Live Peeking Peeking operation operation LED) LED)
Tracking (COM- mode mode
Location
glancing)
Disable LED 1 (GSM LED) - If this flag is enabled (‘1’), the LED1 (GSM LED) of
CelloTrack unit will be disabled.
The bit is for Infrastructure only and is currently not operational
Disable LED 2 (System LED) - If this flag is enabled (‘1’), the LED2 (System LED) of
CelloTrack unit will be disabled.
The bit is for Infrastructure only and is currently not operational
Disable LED 1 in operation mode - If this bit is enabled (‘1’), the LED1 (GSM LED) of
CelloTrack unit will be disabled in Activated mode, but will still respond in Non-activated
mode during system activities like “Activation/Deactivation” procedures.
Disable LED 2 in operation mode - If this bit is enabled (‘1’), the LED1 (GSM LED) of
CelloTrack unit will be disabled in Activated mode, but will still respond in Non-activated
mode during system activities like “Activation/Deactivation” procedures.
Enable Live Tracking - If this mode is enabled (‘0’) the unit will remain fully active while
movement is detected. This way the unit will not switch off GSM and GPS during the
entire trip. During this mode the unit is capable to generate periodical events (Time and
Distance) according to pre-programmed rules. If this mode is disabled (‘1’), the unit will
be in hibernation during the entire trip. Only Start and Stop reports will be registered.
Note: If Enable Live Tracking is enabled, the “Stop Event Time Filter” (address 105)
minimal value will be limited by FW to 40 seconds.
See also "GPS Peeking in Live Tracking" parameter.
Enable Distress on Peeking - If this bit is enabled (‘1’), then 20 to 30 seconds before
the end of the COM-Location glancing the unit will trigger a distress session, in form of

Cellocator Cello
Programming Manual
standard position message including latest GPS data and an appropriate transmission
reason (252)
Enable Event on Peeking - If this bit is enabled (‘1’), then 20 to 30 seconds before the
end of the COM-Location glancing the unit will trigger an event, in form of standard
position message including latest GPS data and an appropriate transmission reason (252)
GPS peeking during Live tracking - This bit is only applicable if bit 4 of the same
bitmask byte is enabled.
If this bit is enabled (“1”), the GPS will be operated in Live Tracking mode in a way,
enabling an additional power saving as described below.
In the normal Live Tracking mode (see above) all the modules of the unit are activated
and fully operational. When GPS Peeking during Live tracking is enabled the unit operates
a GPS by peeks with preprogrammed length (instead of permanent activation) during the
entire Live Tracking mode.
The GPS Peeks management is activated in the following conditions only:
 GPS peaks in Live Tracking is enabled in EEPROM
 Time Event interval is longer than 90 seconds
 Between the Start event and Stop Event
 Only after the first valid fix is obtained after the Start event
If the feature is enabled, the GPS will be switched off immediately after the Time Event
message generation, and will be activated back programmable time before the next Time
Event message generation.
Start Event
Time Event Time Event Time Event
TE Timeout
Communic.
Stop events when GPS peeking is enabled
GPS power
t
Programmable time (60 sec
by default)
GPS Fix received

Cellocator Cello
Programming Manual
When the "Stop events" are set as distress, the unit will process them as any other
distress event, i.e. upon occurrence the GPS will be switched on for Distress session
period plus Extra GPS Time for distress timeout.
While the "Stop" is set as a plain event, the unit will behave as follows:
 If the event occurs after the time event peek – the unit will not switch GPS on and will
generate the event with the GPS stamp of the last time event. Then, after the
Hibernation Timeout expires, the unit will enter the full hibernation mode.
 If the "Stop" event occurs during the pre-time event GPS peek – the unit will generate
the event with the existing GPS stamp (even if valid location not received yet); then,
after the Hibernation Timeout expires the unit will enter the full hibernation mode.
Default Value: 0x5F
12.2 CelloTrack Configuration 2

Address: 2
Description: This parameter contains a bitmap, allowing controlling different activities of
CelloTrack unit.
Cradle mount GPIO CONTROL 1 GPIO CONTROL 0 Enable Enable Disable Cell
Power save extended FixTime ID packets
charging algorithm on peeking)
temperature
(Non
range
CelloTrack
T)
12.2.1 Disable Cell ID Packets on Peeking

If this bit is enabled (1), the unit will NOT generate a CellID message during glancing
(normal and ST), even if enabled in configuration (bits 6 and 7 of addresses 202, 204)
and there is no valid GPS reading upon glancing event/distress generation.
12.2.2 Enable FixTime Algorithm (Non CelloTrack T Variants only)

During the Sleep mode the GPS, which is a primary source of real time clock is off and the
microcontroller with its crystal is hibernating. The clock of the unit during this time is
based on the RC oscillator, which is very inaccurate due to an inaccuracy of component's
values and ambient affect.
Long Sleep cycles therefore might cause significant time inaccuracy. The FixTime
algorithm switches off the crystal periodically and allows the microcontroller to calculate
the real time correction of the clock based on RC.

Cellocator Cello
Programming Manual
Such a management is significantly improving an accuracy of the self clock, although

increases current consumption by 3%-5% percents. It is recommended to activate
FixTime algorithm only when Specific Time Glancing is used or the sleep periods are
longer than 6 hours.
The FixTime feature is normally needed only for ST (Specific Time) Glancing; the
customers who do not use ST Glancing might save power by switching the FixTime
feature off.
"1" – default value means use FixTime, "0" – do not use FixTime
This feature is automatically enabled in CelloTrack T variants, no Configuration pin
assigned for it.
12.2.3 Enable Extended Charging Temperature Range

This bit is applicable only for CelloTrack Power.
It is setting an ambient temperature range allowed for battery charging.
 0 - for ‘Normal’ range, shall be selected for Li-Poly battery with temperature range of
0-45 °C
 1 - for ‘Extended’ range, shall be selected for Sonata® battery with temperature range
of -10-60 °C
Default Value: 0 – (for range of 0-45 °C)
12.2.4 GPIO Control 0/1 (CelloTrack only)

CelloTrack was built with true GPIO hardware support enabling the user to control the
functionality of the 2 GPIO lines connected via the harness. The configuration bits were
added to select between input functionality, output functionality and output with
feedback. The GPIO inputs 0 and 1 are called “Door” and “Shock” in the inputs description
above.
The user should note that if both GPIOs are disabled the unit will consume less energy
and thus increase the battery operational time.
GPIO CNTL 0 Description
0 GPIO disabled
1 GPIO functions as input only (Door)
2 GPIO functions as Output only (STD IMMOBILIZER)
3 GPIO functions as Output. The output actual state will

be mirrored via the input.
GPIO CNTL 1 Description

Cellocator Cello
Programming Manual
0 GPIO disabled
1 GPIO functions as input only (Shock)
2 GPIO functions as Output only (LED)
3 GPIO functions as Output. The output actual state will

be mirrored via the input.
Default Value: 0 – no input/output connected
12.2.5 Cradle Mount Power Save (CelloTrack only)

This feature enables the user to optimize the unit’s power consumption if the unit’s
mounting policy is known in advance. If the unit will be mounted in the original supplied
cradle and the configuration bit will be set to 0 the unit static current consumption will be
decreased by 40uA. The same is true if the unit will not be mounted in Cradle this
configuration bit will be set to 1.
Cradle mount Description

power save
0 Tamper switch will consume minimal

energy during hibernation when not
inserted to cradle
1 Tamper switch will consume minimal

energy during hibernation when
inserted into the cradle
Default Value: 1 – Cradle mount
12.3 GPS Peeking On Time during Live Tracking

Address: 1616 (dec)
This parameter only applicable when "GPS peeking during live tracking" bit of the bitmask
above is enabled.
The parameter contains a value of time used to power on the GPS before the Time Event
generation.
Resolution: seconds
Data range: 40-80seconds (any value lower than 40 will be mean 40, any value higher
than 80 will mean 80)
Default Value: 40 seconds

Cellocator Cello
Programming Manual
12.4 Activation/Deactivation Procedure Options

Address: 1447(Dec)
The Bitmask:
Enable Enable Enable Enable Send Cell Id GPS based GPS Activation/
Activation Activation Activation Activation upon Start Ignition based Deactivation
mode mode mode mode Report Start procedure
Enable
change: change: change: change: Event
(Infrastructure) Sending Start 1 – Normal
“Active” “Active” move to move to Enable
events on (two buttons)
“Not “Not
Distress Logged timeout (Non 0–
Active” Active”
Event Event CelloTrac Alternative
Distress Logged (Infrastructure) k T)
0-Disable 0-Disable 0-Disable procedure
Event Event 0-Disable 0-Disable (One button)
1-Enable 1-Enable 1-Enable
0-Disable 0-Disable 1-Enable 1-Enable
1-Enable 1-Enable
12.4.1 Activation/Deactivation Procedure

It is possible to select programmatically between a standard Activation/Deactivation
procedure, using two buttons: Tamper switch and Front Button (FB) and alternative
Activation/Deactivation procedure using single button (the FB) only.
Activation/Deactivation Procedures Activation/Deactivation Procedures

using two buttons (Standard) using one button (Alternative)
Deactivation (from activated mode): Deactivation (from activated mode):

1) Deactivation by Button 1) Deactivation by Button:
combination: Deactivation (from activated mode):
The Front Button (FB) is pressed for 3 The Front Button (FB) is pressed for 6
seconds seconds.
Tamper switch should not be pressed (the 2) Deactivation by OTA Command
device is out of the cradle)
Type 0 command to force the CelloTrack
2) Deactivation by OTA Command unit to “Not Active” mode, see “Wireless
Type 0 command to force the CelloTrack Communication Manual” in section 3.3
unit to “Not Active” mode, see “Wireless command code 0x1d.
Communication Manual” in section 3.3
command code 0x1d.
Deactivation process Indication:
The following LED sequence will be
Deactivation process Indication: activated to reflect deactivation request was
The following LED sequence will be granted and the unit has started its
activated to reflect deactivation request deactivation procedures. Please note that
was granted and the unit has started its deactivation procedures include also
deactivation procedures. Please note that

Cellocator Cello
Programming Manual
deactivation procedures include also sending OTA event to reflect the fact the
sending OTA event to reflect the fact the unit is about to be Deactivated (TR 102).
unit is about to be Deactivated (TR 102).
Unit Deactivated indication Unit Deactivated indication
The SYS LED blinks on/off in 200msec The SYS LED blinks on/off in a 200msec
period to acknowledge deactivation period to acknowledge deactivation request.
request. The device enters a Non-Activated The device enters a Non-Activated state
state until the next operation starts. until the next operation starts.
Pressing FB while the device is in a cradle Pressing FB while the device is in a cradle
and activated will cause the unit to trigger and activated will cause the unit to trigger
the "Panic button triggered” procedure the "Panic button triggered” procedure only.
only.
Note: Deactivation using two buttons can

be Disabled if the "Disable Power Off by
On/Off Front Button" parameter (address
1614, bit 7) is set to Disable
Activation (from not-activated mode): Activation (from not-activated mode):

The Tamper switch is pressed (the device is The Front Button (FB) is pressed for 3
in a cradle) seconds
The Front Button (FB) is pressed for 3 Indication of Successful Activation:
seconds SYS LED blinks (second on/second off) while
Indication of Successful Activation: the FB is pressed in deactivated mode. After
SYS LED glows while the FB is pressed. 4 seconds of FB triggering the LED is
After 3 seconds of FB triggering the LED is switching off – here the FB can be released.
switching off – here the FB can be released. When the GPS enters navigation SYS LED
If the FB is pressed while the Tamper start blinking twice (short blink (1/4 sec
switch is not pressed (the unit is out of the blink once in 2 seconds)
cradle) - the SYS LED begins to blink (1sec OTA event can be sent to reflect activation
on/1 sec off) in order to confirm a Non- mode change (TR 102).
Activated state.
When the GPS enters, navigation SYS LED
starts to blink twice (short blink (1/4 sec
blink once in 2 seconds)
OTA event can be sent to reflect activation
mode change (TR 102).
12.4.2 GPS-based Start Event Enable (Non CelloTrack T Variants only)
Address: 1447(dec) bit 1

If this bit is set then start report (logged or distress) will not be sent unless GPS has
detected a deflection from the original location.

Cellocator Cello
Programming Manual
If this bit is cleared then legacy functionality will be maintained: the start report will be
sent only based on the accelerometer.
Default value: 0 – normal procedure (accelerometer based)
12.5 GPS-based Movement Timeout (Non CelloTrack T Variants

only)
Address: 1319 (dec)

This value will determine the GpsFix and Deflection timeout. After this time elapses a
start event will be sent towards the Center if enabled by bit “GPS based Ignition Send
events on timeout”.
Resolution: 1 min
Data range: 0-255
Default Value: 60 min
12.6 Max Extra GPS On Time for Distress Mode

Address: 1618(dec)
12.6.1 Distress Mode during COM-Location Glancing State
In most of the operational scenarios, except of periodical events (COM-Location Glancing)

the customer will need to report additional events. For example – movement Start and
Stop, tampering detection or trigger of front button.
The correct way of reporting of such alerts is to generate a Distress session upon
detection of one of them (refer to a Distress Session definition in Programming manual).

Cellocator Cello
Programming Manual
Last event
sent
GSM 10/90 t
30 Distress GPRS or SMS
sec
sec
GPS acquired
or timeout
GPS Max GPS On Extra GPS t
The trigger
The Distress session, triggered during sleep mode, is managed according to the following
scenario:
Upon trigger of the distress session the unit immediately switches on both GPS and GSM
waits for GPS acquisition or for expiration of Max GPS On time + GPS Extra Time (this
parameter) programmable timeouts. During this time the modem has a chance to
registries into GSM and GPRS.
Once the GPS is acquired or both timeouts expired, the unit initiates another timeout of
30 seconds and then initiates the Distress session.
The unit tries to send each of the distress messages by GPRS; if GPRS is not enabled or
not available the message is sent by SMS. In case of SMS the time to next message of
the same distress session is automatically set to 90 seconds.
10 (or 90 in case of SMS) seconds after the last distress message both GSM and GPS are
switched off if no other Distress traffic is detected.
Data format: 1 byte, decimal value, one second resolution
Default Value: 60 seconds
12.7 Glancing at Specific Time (ST Glancing)

Address: 1614-1615(Dec)
Description: This feature enables reception of a repository update from all the units of
the fleet at the same time by wake up for a Com-Location glancing at the specified time
of the day.
In order to decrease the load on the communication server upon simultaneous update of
many units, the update time might not be absolutely accurate but may vary a bit as per
pre-programmed randomization rule.
Similar to a normal Com-Glancing, the ST Glancing message is generated 20 to 30
seconds before the end of the glancing (the programmed time is the time of the glancing
start, the wake up time) and follows the same rules, except the following items:

Cellocator Cello
Programming Manual
 The unit only will generate ST (Specific Time) event if the Day field of Last Valid GPS
timestamp is not zero, which means that the GPS was navigating in the past and the
time is synchronized. Otherwise the message should not be generated
 If randomization enabled, the actual time of the transmission will vary for every unit's
ID according to the rule below:
A= P+ (ID)Mod10*(6min)
A= Actual Transmission Time
P = Programmed time
ID= Unit's unique ID
The ST transmission is generated with the transmission reason of Glancing (252,
Transmission Reason Specific Data 1).
If both regular, interval-based glancing and ST glancing are enabled they both will be
maintained simultaneously and independently.
If the at the time, specified in the ST Time parameter the unit is in a non-hibernation
mode (like, for example, the Live Tracking), except the Normal Glancing, the unit will not
generate an ST Glancing message.
NOTE: If the ST Glancing events are enabled, certain increase in current consumption is
expected.
The CPU periodically wakes up the GPS module in order to synchronize an internal clock
with the RTC of GPS and in order to be able to send the life signal within a resolution of
no worse than 6 minutes.
The wake up mechanism is adaptive and determines the number of time that the GPS has
to be turned on by measuring the clock deviation size. In most of the cases, only one
synchronization wake up is required prior to the life signal event. From time to time, two
synchronization wake ups may be observed.
In order to make current consumption calculation easier, use "Specific time" event as
equal to (up to) 3 normal glancing events in 24 hours period (this is the worst case but
usually no more than 2).
First byte (1614)
Disable Power Reserved Disable ST ST Hour (0-23)4

Off by On/Off randomization (beginning of the glancing and not the event)
Front Button 0 – enable time
Default value - 12
0 – Enable randomization
1 – Disable 1 – disable time
randomization
(default value)
Second byte (1615)
4
Setting the "ST Hour" to a value bigger than 23, will cancel the ST Glancing.

Cellocator Cello
Programming Manual
Enable ST Enable ST ST Minutes (0-59)5

Glancing Glancing
(beginning of the glancing and not the event)
Distress Event
Default value - 00
(disabled (disabled
by default) by default)
Default Value: 0 on both addresses (including "Disable Power Off by On/Off Front
Button" parameter)
5
Setting the "ST Minutes" to a value bigger than 59, will cancel the ST Glancing.

Cellocator Cello
Programming Manual
12.8 Radio-Off (CelloTrack and CelloTrack Power)

The Radio-Off feature was redesigned and adapted for battery powered CelloTrack
devices. Radio-Off mode starts when CelloTrack battery voltage decreases bellow 3.4
Volts for 30 consecutive seconds and initiates the following set of actions is performed:
1. A Radio-Off event is generated and logged.
2. All log history is saved into nonvolatile memory.
3. Cellular modem and GPS are turned off.
4. The Firmware enters idle state.
The Radio-Off preventive actions taken when battery reaches critical level will insure the
integrity of the logged history and facilitate smooth restart when power reapplied to the
device.
Cellotrack
Batt. Level
3.6Volts
Delay 3.5Volts
3.4Volts Delay
Delay
Radio-Off Radio-Off
Start End
Time
Radio-Off
Unit Mode mode On
OTA Messages
Early Radio Radio Off Message
Off Message sent to Log memory
Early radio off message will be generated by the unit when the battery voltage reaches
3.6 Volts or below for 30 consecutive seconds. The early Radio off message will inform
the server side that the unit’s battery voltage is very low and that Radio off mode is about
to start soon.

Cellocator Cello
Programming Manual
12.9 Advanced Glancing (peeking): CelloTrack and CelloTrack

Power
Addresses:
1337-1338: For Glancing time for movement and not charging state.
1339-1340: For Glancing time for No movement and charging state.
1341-1342: For Glancing time for movement and charging state.
Description: This feature enables the unit’s glancing (Peeking) period to be adapted to
various operational states.
Glancing, or peeking, in CelloTrack units is a self initiated event designed to wake the unit
from hibernation and send a scheduled event. In CelloTrack, unlike other units, we do not
support separate GPS and GSM peeking, both GPS and GSM peeking in CelloTrack are
governed by GSM peeking parameters. The most dominant peeking parameter is the GSM
Peeking – Modem Off time which sets the time between peeks. The Advanced Glancing
(Peeking) feature enables the user to configure the GSM Peeking – Modem Off time
according to the unit’s charging state and its movement state. The motivation would be to
increase peeking frequency if we have reliable charging energy source or if we have both
charging energy source and we are moving (We have the energy, and we want to get
more information about the unit’s location while traveling) etc. The user can configure
new values, overriding the legacy GSM Peeking – Modem Off time when movement or
charging source are detected. The block diagram bellow describes the functionality of the
“Advanced Glancing Mechanism”. The new mechanism selects from the PL configuration
the appropriate Glancing time as function of the system state (Charging or moving).
Please note that when one of the above parameters (1337-1338, 1339-1340, 1341-1342)
is set to 0, The legacy GSM Peeking – Modem Off time will be used as glancing time.
Movement State
Charging State
(CellotrackPower Only) Advanced
Peeking Updated Glancing time
PL Mechanism (Modem Off-Time)
Config
The following table describes the relations between the system state (Charging or
moving) and the glancing time. Each system state glancing-time is represented by a
dedicated configuration parameter. The unit’s firmware will select the relevant
configuration parameter when the system will change its state. The new glancing-time
will be used in the next glancing period or if distress or Active Logged event will be
triggered.

Cellocator Cello
Programming Manual
Glancing No Movement Movement

Time
Not Glancing time = Define by Glancing time = defined by

Charging parameter located at address 268. parameter located at address
See 1337-1338. See
GSM Peeking – Modem Off time CelloTrackGlangingTimeMovement
NoCharge
Legacy time. If the parameter is set to 0, The
glancing time will be taken from
GSM Peeking – Modem Off time
If time is greater than 0 and less
than 5 min it will be considered 5
minutes.
Glancing time shall always be less
than or equal to GSM Peeking –
Modem Off time. Higher
configurable values will be
truncated to GSM Peeking –
Modem Off time.
Charging Glancing Time = defined by Glancing time = defined by

(CelloTrac parameter located at address 1339- parameter located at address
k Power 1340. 1341-1342. See:
Only) See: CelloTrackGlangingTimeMovement
CelloTrackGlangingTimeNoMoveme Charge
ntCharge If the parameter is set to 0, The
If the parameter is set to 0, The glancing time will be taken from
glancing time will be taken from GSM Peeking – Modem Off time
GSM Peeking – Modem Off time If time is greater than 0 and less
If time is greater than 0 and less than 5 min it will be considered 5
than 5 min it will be considered 5 minutes.
minutes. Glancing time shall always be less
Glancing time shall always be less than or equal to GSM Peeking –
than or equal to GSM Peeking – Modem Off time. Higher
Modem Off time. Higher configurable values will be
configurable values will be truncated to GSM Peeking –
truncated to GSM Peeking – Modem Modem Off time.
Off time.
The table below was added to reflect the fact that Charger power connected to CelloTrack
Power is not a sufficient condition for considering unit’s battery is actually being charged.
For example, when charging power is connected and the temperature is out of charging
range the battery will not be charged, in this case we are in NotCharging state.
Charger Power Charging Logic Status Charging Mode

source State

Cellocator Cello
Programming Manual
Connected Charging Charging
Not Charging due to extreme temperature NotCharging
Not Charging due to “Batt high” condition Charging
Disconnected NotCharging

Value span: 01h (16 seconds between two consecutive peeks) through FFFFh (~12 days
between two consecutive peeks)
Default: Disable (zeroes)
12.10 Cradle tamper events definitions
Address: 124, bit 0 for falling event

126, bit 0 for rising event
128, bit 0 for falling distress
130, bit 0 for rising distress
Description: In CelloTrack family, the "door" input signal (mentioned in
_d2h_bmk__Ref450553304_22_d2h_bmk__Ref450553309_22 and _d2h_bmk__Ref450553311_22) is used as the
tamper signal which is an "Active low" signal.
This means that High = TR #159 (Inactive) = inside the cradle, and Low = TR#158
(Active) = outside the cradle.
But the terminology of "Rising" is removal from cradle and the term "Falling" is insertion
to the cradle.
Default Value: zeros – Disable (0(

Cellocator Cello
Programming Manual
13 CelloTrack Power
This section describes dedicated CelloTrack Power configuration parameters. The
CelloTrack Power configuration parameters are an addendum to the standard CelloTrack
programming parameters as described in section 15.
The CelloTrack Power supports the following unique items:
 CelloTrack Power indicates the charger status in its outputs vector (4th outputs byte,
bit 7; 1- charging, 0 – not charging) in both wireless and wire protocols.
 The unit reports the battery temperature measurement (sampled every second) in 4th
byte of analog inputs in both wire and wireless protocols.
 The unit activates an external charger when all of the conditions below become true
concurrently:
1. The temperature is in the correct normal/extended (configurable) range (upon
charging the temperature might increase by 5-6°C due to self heating).
2. An external power supply is detected.
3. The battery measurement is lower than 4.1V.
4. The unit is not in hibernation (configurable).
 The unit shall stop battery charging when:

1. The temperature out of threshold (after the first exceeding measurement).
2. An external power supply is disconnected.
3. The battery measurement is higher than 4.1V.
4. The unit enters hibernation.
NOTE: It is mandatory to select NTC in one of the OTA bytes (26-28) in order to enable
the charging function. See: Bytes 26-29 of OTA Message 0.
13.1 CelloTrack Power and Nano Configuration Settings

Address: 1446
Description: This parameter contains a bitmap controlling charging of CelloTrack power.
Not used Enable Additional Extended Charging Stop upon "Battery

Charging Temperature Range Full" detection
0 – Act according to "Enable 0 – Keep charging

extended charging 1 – Stop charging
temperature range" parameter
1 – Allow battery charging in a
(-20) - (+60) deg temperature
range

Cellocator Cello
Programming Manual
Bit Bit Bit Bit Bit Bit 2 Bit 1 Bit 0

7 6 5 4 3
Charging Stop upon "Battery Full" detection - By default the unit will stop charging
when the battery voltage will reach 4.24V (for 2 consecutive measurements or 1 minute).
It is possible to disable this auto charger deactivation in order to let the CCCV controller
to do the job.
Enabling Charging in Hibernation: it is possible to enable charging in hibernation mode
when:
 The temperature is in the correct normal/extended (configurable) range (upon

charging the temperature might increase by 5-6°C due to self heating)
 An external power supply is detected
 The battery measurement is lower than 3.85V

The unit will stop battery charging when:
 The temperature out of threshold (after the first exceeding measurement)
 An external power supply is disconnected
 The battery measurement is higher than 4.1V

Default values:
For "Enabling Charging in Hibernation": 1 – Enable
For "Charging Stop upon Battery Full Detection" in CelloTrack Nano: 1 – Stop Charging
For "Charging Stop upon Battery Full Detection" in CelloTrack T Power: 0 – Keep Charging
For "Enable Additional Extended Charging Temperature Range" in CelloTrack T Power: 0 –
Act according to "Enable extended charging temperature range" parameter
13.2 Slow charging in extreme temperatures

Address: 1859 bit 6
Description: This parameter enables the option to slow charge the normal internal
battery in extreme temperatures, between -20 to 0C and also from 45 to 60C.
0=Disable, 1=Enable.
Default value: 1 = Enable
A summarizing table for all the possible combinations:
Slow charge Charging Enable Enable

in extreme Stop upon extended Additional
temperatures Battery Full charging Extended
enable detection Charging

Cellocator Cello
Programming Manual
temperature Temperature
range Range
Address Address Address 2.2 Address Behavior

1859.6 1446.1 1446.2
0 X 0 X T < 0C : Stop charging

0C <= T < 45C : Fast charging (330mA)
T >= 45C : Stop charging
0 X 1 0 T < -7C : Stop charging

-7C <= T < 60C : Fast charging (330mA)
0 X 1 1 T < -19C : Stop charging

-19C <= T < 60C : Fast charging (330mA)
1 Keep X X T < 0C : Stop charging

charging 0C <= T < 45C : Fast charging (330mA)
1 Stop charging X 0 T < -7C : Stop charging

-7C <= T < 0C : Slow charging (100mA)
45C <= T < 60C : Slow charging (100mA)
1 Stop charging X 1 T < -19C : Stop charging

-19C <= T < 0C : Slow charging (100mA)
45C <= T < 60C : Slow charging (100mA)

Cellocator Cello
Programming Manual
14 CelloTrack Nano
14.1 Overview
The CelloTrack Nano is an asset tracking solution, aimed at addressing the growing
market of small assets management and cargo delivery and expanding the target markets
to which the CelloTrack family applies: cargo tracking applications, smaller assets and
high value mobile equipment, shorter tracking periods, as well as lone worker and lost
child scenarios.
The target asset types are cargo boxes, airborne containers (temperature controlled or
regular), cargo pallets, small size high-value assets (such as machines and small
generators), high value suitcases and equipment (such as art, medical), and so on.
Target applications may include inventory management throughout short/mid-term Track
& Trace, shipment and distribution management, security (anti-theft), protection (anti-
vandal, break-in detection) and more.
The CelloTrack Nano can interface via a short-range RF link to multiple peripherals called
"MultiSense" devices, which acts as Wireless Sensors Network (WSN). Read more about
MultiSense devices in section 15.
The CelloTrack Nano inherited all CelloTrack-T functionality and added new functionality
described in this section. For further information about the product, please refer to the
CelloTrack Nano Product Overview document.
SR-RF links MultiSense

(Remote sensor with short-
range RF communication)
MultiSense
Cellular link
CelloTrack range RF communication)
Nano
(with its internal sensors)
MultiSense
range RF communication)

Cellocator Cello
Programming Manual
14.2 User Interface – Buttons, LEDs and Buzzer
14.2.1 Buttons
14.2.1.1 General
Each press on a Nano button when the unit is active activates a short audible beep by the
buzzer (if enabled accordingly; read more about this setting here).
14.2.1.2 Right Button
!
The right button, marked " ", when pressed for 2 seconds or more (even if not released),
followed by engagement feedback (buzzer and/or LED - configurable here and here),
generates a panic event which will be sent to the server. An ACK sent by the server will
generate another reception feedback – which is configurable here.
14.2.1.3 Left Button

This button has no related configuration parameters but is mentioned here anyway, just
to give the full scope of the buttons in the CelloTrack Nano.
The left button, marked " ", when pressed for less than 3 seconds, will open the
configurable size indication time window.
In addition, this button is turning the unit ON and OFF:

Cellocator Cello
Programming Manual
 Turn ON: Press 3 seconds while turned OFF. After that the system will self-test, as
described here.
 Turn OFF: Press for 5 seconds while turned ON. At the end of that period, the turning
ON/OFF occurs even if the button is not released.
14.2.1.4 Check-in and Check-out Functions

Pressing simultaneously (with ~200mS tolerance) on both buttons for at least 1 second
(and less than 5 seconds), followed by a 0.5 second buzzer beep for every elapsed second
(if enabled, as described here) and/or LEDs feedback (as configured here), transmits the
current location once.
It is also related to set the baseline reference accelerometer position of the man down
feature detailed here.
From FW release of 34j, there is also a Check-out feature:
If enabled in the PL, (Address 1857 =1) the unit will toggle from check-in state to check-
out state by the short press on the 2 buttons simultaneously.
The initial state (after reset or power up) will be check-out.
There are 3 ways to end check-in state and go back to check-out state:
1. Timeout expiration of the check-in state will be according to PL parameter of
"Check-in timeout" address 1857 (Default=24 Hours). At this case (assuming the
event enable bits in address 2352 bits 4-7 are enabled) a check-out event will be
generated with Type-0, TR=164, STR=17 and/or Type-11, Module-28, Event code-
19.
2. User has terminated the state by pressing check-out buttons. At this case
(assuming the event enable bits in address 2352 bits 4-7 are enabled) a check-out
event will be generated with Type-0, TR=164, STR=18 and/or Type-11, Module-
28, Event code-12.
3. System power-up.
System reset (all kinds of soft-resets) will NOT change the state.
User will be able to check if the Nano is at check-in or check-out state by shortly pressing
the Power button (0.2-5 sec):
 If the Nano is in check-in state - the right LED will blink rapidly (200mS ON,
200mS OFF) Red for 3 sec, postponing the regular GPS/GSM indications.
 If the Nano is in check-out state - the right LED will blink slowly (500mS ON,
500mS OFF) Red for 3 sec, postponing the regular GPS/GSM indications.

Cellocator Cello
Programming Manual
14.2.1.5 MultiSense Pairing Feature

Pressing simultaneously (with ~200mS tolerance) on both buttons for more than 5
seconds will initiate the MultiSense in-field pairing process. See more details in
section 15.2.4.
14.2.2 LEDs
14.2.2.1 Left LED
The left LED, marked " " and " ", gives indication of the power/battery and
deviations (as described here).
When the unit is turned ON, or a short press is made on the left button (shorter than 5
seconds), or following reset command, (also see section 14.2.1.1), all the following LED
indications are restarted according to the "Indications time window" parameter described
here.
Battery status: When the unit is turned ON, short blinks of 100mS every X seconds show
the battery status, according to the following legend:
Battery is 50-100% - Green:
█__________________█__________________█__________________█_...
Battery is 20-49% - Orange:

█__________________█__________________█__________________█_...
Battery is 0-19% - Red:

█__________________█__________________█__________________█_...
Out of range (deviations alert) indications:

When the unit is turned ON, or a short press made (shorter than 5 seconds) on the left
button, only the most severe indication from the following list is displayed once, if that
violation/deviation still exists.
When any sensor creates an out-of-range (alert) event, and if enabled by the bit in this
configuration area, the left LED will signal a 3 second long continuous (once) or non-
continuous pulse according to the following color scheme:
Light sensor out of range: __████████████████___
Accelerometer out of range: __████████████████___

Cellocator Cello
Programming Manual
Temperature out of range: __████████████████___
Geo-fence violation: __█████_█████_█████___
"Light sensor out of range" means the light level of the local sensor crossed the
"open/close package threshold" event.
"Accelerometer out of range" means an orientation change event only.
"Temperature out of range" means the local temperature sensor is either above the upper
TH or below the lower TH.
"Geo-fence violation" means all the possible kinds of violation supported and defined in
the legacy version.
The priority in case more than a single sensor is out of range or deviated: from bottom to
top (geo-fence is the highest priority, going down to light sensor which has the lowest
priority). After that the lowest priority is for the battery status indication mentioned at the
beginning of this section.
In general, switching between different indications is done without any gaps/delays so
they look continuous (overlap).
The non-continuous pulse is: 800mS ON, 300mS OFF, 800mS ON, 300mS OFF, 800mS
ON (once and every time a button is pressed).
All these out-of-range indications are displayed only for the "Indications time window".
This time window also restarts after the left button is pressed again (as described here).
After that they are cleared (turned OFF).
See also the configuration bits described here that enable each sensor out-of-range
indication on the LED.
Charging indications:
When the micro-USB connector is plugged-in and charging is in progress, whether from
the charger (AC wall adaptor) or PC, the left LED will act as described in the following
table.
Unit mode: OFF (inactive) ON (active)

During actual charging Constantly orange Constantly orange
Inside the "Indications Regular LEDs indications

After charge time window"
completion Constantly green
After (outside) the Constantly green
"Indications time
window"
Battery Fault Constantly red Constantly red

Cellocator Cello
Programming Manual
These indications have the highest priority and they override all other indications on this
LED.
14.2.2.2 Right LED
The right LED is marked "GPS" and " ".

This LED has two time slots of 5 seconds long each; the first one is for indications from
cellular modems (in green) and the second one is for GNSS module indications (in
orange).
Each pulse is 500mS ON and 500mS OFF.
Cellular modem indications:
HSDPA/HSUPA (3G) communication:
██________________________________________________________|
GPRS/EDGE communication:
██___██__________________________________________________|
Registered (GSM-2G):
██___██___██____________________________________________|
Not registered (no activated network found):
██___██___██___██______________________________________|
When the user shut down the unit by pressing the power button, and one of the bits are
enabled here, the unit will push to the log the "Transmission before shutdown" event
message.
Address: 2042 bits 0-1

Description: Transmission before shutdown event is created in Type-0 or as
encapsulated inside a type-11 message.
Transmission before Shutdown

messaging
Type-0
Logged Distress
Bit 1 Bit 0
Default value: 0x00 = All disabled
If any form of immediate transmission method is selected by the user ("Active log event"
and/or "Distress"), the unit will also initiate communication with the server and transmit

Cellocator Cello
Programming Manual
its entire log too, while blinking this LED (higher priority than all other indications) green
at 200mS ON and 200mS OFF pace until completion and full shutdown.
Buzzer will beep in 200mS ON and 800mS OFF along the transmission.
Anyway (even if not transmitting), a "Dual short beeps" will be sound before actually
going to inactive mode.
is pressed for >5S: |█_█_█_█_█_█_█_█_█_...█_█_█_█_█_█_█_█_█_|Shutdown

Buzzer: |██___██___██___██_...██___██___██___█_█ |
GNSS module indications:

Tracking good (Fix "Tight"):
██________________________________________________________|
Tracking poor (Fix "Plain"):
██___██__________________________________________________|
Acquisition (from power-up to "Plain" or "Tight"):
██___██___██____________________________________________|
No satellites at all ("no fix" after fix), only at the first operation and cannot be reached if
using A-GPS:
██___██___██___██______________________________________|
For example the light for a GPRS communication and good tracking will look like the
following:
█_█___________________█______________________█_█___________________█__…
--------5Sec--------
All these indications are only displayed for the time set in the "Indications time window".
After that they are cleared and not displayed.
14.2.3 Buzzer
14.2.3.1 Definitions
Buttons feedback beep = 20mS ON |
Short beep = 200mS ON ██

Cellocator Cello
Programming Manual
Dual short beeps = 200mS ON, 200mS OFF, 200mS ON ██___██

Dual long beeps = 1 Sec ON, 200mS OFF, 1 Sec ON █████████___█████████
Long beep = 2 Sec ██████████████████
14.2.3.2 Buzzer Logic

 Upon power-up (turning ON) or system reset from any reason: short beep.
 After a successful BIST process: dual short beeps.
 If enabled here, every valid pressing on the buttons will sound the "Buttons feedback
beep" (20mS).
 If enabled here, Panic /Check-in event activation operates the beeps, as explained in
section 14.2.1.5.
 If enabled here, after a Panic (special distress) event is acknowledged by the server:
long beep.
 Dial-in feature: In lone worker scenarios, some ringing from the unit buzzer may be
needed, to catch the worker’s attention. If enabled here, when the modem receives a
ring/s for a voice call, it rings with its buzzer for 4 seconds and then stops, according
to the ring beeps pattern described above.
 If enabled here, when any active sensors go out of the defined limits (all meanings of
the "out-of-range" are explained here), plus geo-fences (all legacy violations related
to geo-fences are relevant here too), the unit shall sound short beeps every
configurable time if the "Indications time window" defined here is open/active.
 If enabled here (bit 5), a short beep is sounded upon any power-up packet received
from a paired/preregistered MultiSense.
 See BLE pairing (and un-pairing) process related beeps in section 14.2.1.5.
 Upon shutdown sequence completion the buzzer shall sound "Dual short beeps"
pattern. If enabled here, the buzzer shall also act according to shutdown sequence as
described here.
 If any overlap of beeps should occur, the buzzer shall be activated on an OR basis,
meaning the actual sound should be a superposition of all signals together.
14.2.4 Indications after Power Up (Built-In Self-Test)

The unit shall perform a Built-In Self-Test (BIST) upon any of the following cases:
 When battery is connected, while the system was active before disconnection.
 After turning ON (moving unit from inactive to active mode, at the end of the 3
second press duration).
 Upon receiving a reset command.

Cellocator Cello
Programming Manual
The Built-In Self-Test (BIST) includes GNSS module, Cellular modem basic (local)
communication and confirmation a SIM and battery exists.
The indications look like the example below for the first 5÷10 seconds only, on the right
LED:
Turning ON press feedback from the buzzer:
█_____________________________________________________..._...|
If all tested component are OK:
|________________________________________________________██
and on the buzzer:
█______________________________________________________█_█
GNSS module failure (Basic communication):
|__________________________________________________██___██
Cellular modem failure (Basic communication + SIM card valid):
|_____________________________________________██___██___██
Battery failure:
|________________________________________██___██___██___██
---------------------first 5÷10 Sec after turn ON---------------------
Short beep and dual-short beeps are defined in section 14.2.3.1.

The priority of failures is in descending order, battery being the highest. And only the
highest priority is displayed.
Timing is 500mS ON and 500mS OFF.
All buttons are blocked/ignored during the entire BIST period.
14.3 System Modes
14.3.1 Improved Tracking Mode

In this mode, the Nano adds the extra take locations between transmissions.
Since the entire system is hibernating most of the time, the battery life is prolonged.
In this mode, the unit uses an improved glancing of not-live-tracking related to the legacy
mechanism:
 Samples its sensors according to the table below and logs them efficiently. Look for
distress (critical) events (such as tamper, sensor reading crossed some predefined
critical threshold) to report them immediately.
 Takes GNSS locations extra configurable times a day and logs them internally as
Type-0 and/or type-11 with the same message but encapsulated, as mentioned in the
Wireless Protocol document, depending on the configuration bits in PL address 603,
bits 0-1, as defined here.

Cellocator Cello
Programming Manual
 GNSS and cellular modems are also activated upon distress event occurrences to
immediately report the position of the event. A transmission is sent even if the GNSS
has not got a fix after the timeout. As with the legacy version, if no fix is reached the
Cell-ID transmission logic is used.
 The GNSS module is shut down, disregarding any applicative constraints to preserve
energy.
 Turns on the cellular modem and transmits to the server, which is configurable in the
GSM Peeking – Modem Off time parameter, including the logged positions,
measurements and events.
 For all cellular transmissions, the entire log memory is transferred/uploaded, and then
cleared upon an ACK from the server. In case there is no ACK or no link, it acts as per
the legacy behavior.
 At all other times, the main MCU is sleeping (hibernating). During these times, the
"Hibernation Mode Delay" parameter is maintained (the default is 2:40 minutes).
GSM periodic
glancing
GNSS peeking
(legacy)
Nano take location interval Nano take location interval

GNSS peeking
(improved
modes)
Extra GNSS
peeks and log it
Sensor name Sampling rate Comment
All power sources, light 1 Second

sensor, battery NTC and
other analog inputs
Accelerometer 1 Second
Accurate temperature Defined according to In Nano 20 only
this and this
parameters
Barometer/Pressure 1 minute In Nano 20 only
14.3.2 Improved Tracking with POD Mode (Infrastructure)

This mode, which will be supported in the 2nd phase of the project only, is the same as
the regular improved mode, except the Nano is also addressable and available for
communication at all times.
The battery life is much shorter in this mode. Refer to the external battery life calculator
for more details.

Cellocator Cello
Programming Manual
14.4 The Layers Concept

Layer-0: The HW and FW layer
The FW activates the HW to sample the various sensors of the system every predefined
time.
Some of the sensors’ sample rates are configurable and some are constant (i.e.
hardcoded).
The samples always occur and are not conditional.
Layer-1: The periodic glancing layer

Only when the unit is not moving (aka stationary state, "hibernating"), or ST glancing:
 Periodic glancing as defined in legacy (refer to the CelloTrack-T).
 According to a specific time of day (aka "ST glancing", see legacy).
 In every transmission the unit will transmit its location and the last sample of all
sensors in the system.
 There is some ratio between location and full sensors glancing, as described in
section 14.3.1.
Layer-2: Movement related events

When the unit is moving (in motion state, i.e. ignition-ON state):
 Legacy capabilities of offline and online tracking (in future powered variants)
including:
 Time events
 Distance events
 Speed events
 Geo fencing
 Curve smoothing
Layer-3: Sensors layer (data logging)

For each supported sensor, the user is able to determine:
 The applicative sampling/logging rate (if applicable)
 Monitoring rules (what triggers an event)
 Feedback rules (buzzer and LEDs activation patterns)
 Data upload rules

Cellocator Cello
Programming Manual
14.5 USB
14.5.1 Usage
Micro-B female USB connector, through which the unit can perform the following
functions:
 Charge the internal battery from the supplied AC-adaptor or PC USB port.
 Interface via PC USB port for configuration.
 Interface via PC USB port for firmware updating.
14.5.2 Charging Speed

The internal charger supports 2 charging speeds:
 The slow speed is used when the unit recognizes the source as "weak", such as a USB
1.0 PC port, weak AC-adaptors or weak car-adaptors. The charging current in this
case is ~100mA so a complete charge can sometimes take more than 10 hours.
 The faster speed is automatically chosen when the source is recognized to be able to
supply enough current. The charging current in this case is ~330mA, so a complete
charge will take less than 5 hours.
14.5.3 Charging Modes

The unit has 2 modes of charging:
 FW controlled: The Nano FW decides when to start and stop charging. It charges the
battery to a certain hardcoded high-level charge point (e.g. 90%) and then lets the
battery be consumed to the level of a hardcoded low-level charge point (e.g. 75%)
before another charge cycle is started. In this way, the battery oscillates between
90% and 75% forever and the left LED toggles between green and yellow forever.
To set this mode, set the parameter of "Charging Stop upon Battery Full detection" to
"Stop charging".
This mode of operation is more suitable for constantly powered systems and it keeps
the battery healthier in the long run.
 HW controlled: The charger chip decides when the battery has reached full charge
(100%) and then stops charging it. Indication on the left LED turns from orange to
green. This operation is restarted every 5 hours.
To set this mode, set the parameter of "Charging Stop upon Battery Full detection" to
"Keep charging".
This mode is more suitable for systems that get charged from time to time, but the
system is not powered constantly.
If the "Dry contact input selection mode" is set to "Extended battery existence" mode
(=1), then the unit shall ignore the regular mode bit and the actual mode shall be

Cellocator Cello
Programming Manual
changed automatically according to the dry contact input value in the following way:
Grounded  "Keep charging" and Floating/high-voltage  "Stop charging".
In this way we create the most power efficient system, where the Nano internal battery is
charged to 100% as long as the external battery is in charging state (connected to power
supply), but moves to a better efficient way of the "Stop charging" when transferring
energy from a not-being-charged external battery to Nano internal battery.
14.5.4 Power-bank keep alive pulsing

Since many power-banks has some power conservation feature that shut them down if no
load is detected for more than X seconds, if the Nano is about to use it as a secondary
source of power, it has to present a certain load every period that is smaller than X.
The user may control the pulses width, rate and amplitude.
The chosen configuration has to be optimized per battery model and all the above
parameters should be minimized to save energy but keep the power-bank awake on the
other hand.
If one of these parameters is 0, the entire mechanism is disabled.
14.5.4.1 Power bank keep alive pulse rate

Address: 1858
Description: Some power banks shut down their output if the load is not drawing any
current for more than X seconds timeout.
This timer (if >0) create a pulse to keep the power bank awake.
Resolution: 1 seconds
Valid Range: 3-255 seconds, 0-2=Disable
Default value: 0= Disable
14.5.4.2 Power bank keep alive pulse width

This parameter determines the pulse width to keep the power bank awake.
Resolution: 50mS
Valid Range: 50-1550 mS, 0=Disable
Default value: 20= 1 Second
14.5.4.3 Power bank keep alive pulse amplitude

Address: 1859 bit 7

Cellocator Cello
Programming Manual
Note that temperature (configurable) limits for recharging are stronger than this
selection, so if the unit is programmed to lower the recharge current to 100mA under
0°C, then it will pulse at no more than 100mA when in sub-zero temperatures, regardless
of this parameter selection.
This parameter select the pulses amplitude, 0=100mA, 1=330mA
Default value: 0 = 100mA
14.5.4.4 External battery mode

Address: 1863 bit 0
Description: If this bit is set to '1' (enabled), the unit shall save as much power as
possible even when connected to power. For example, the LEDs for charging indication
will canceled when unit is in active state.
In inactive state of the system, the LEDs shall function as before.
This is to improve current consumption when working with external batteries and power-
banks.
0 = Disable
1 = Enable
Default value: 0 = Disable
14.6 Sensors
HW Block Accelerometer Ambient Pressure Accurate Humidity
Function Light Sensor Temperature Sensor (of the
Sensor Sensor MultiSense)
/Feature
Tilt tamper X
Orientation change X
Man-down X
Motion vs.
X
stationary
Report on absolute
X
orientation
Open/Close package X
Altimeter X
Temperature X X
/Humidity

Cellocator Cello
Programming Manual
measuring and
logging
14.6.1 Use of IIR Filters

The IIR (infinite impulse response) filter used in many points in the design acts according
to the following formula:
Upon power-up/reset/init the Sum gets an initial value of: Sum0  Sample0 * Factor
The Avg, which is actually the filtered value, is always: Avg = Sum/Factor
After the initiation point on each sample: Sumn =Sumn-1 – Avg n-1 + samplen
In this way, the actual time that will take the filtered value (Avg) to get from a certain
steady-state value to some TH level is a function of start-point, end-point and the
programmed factor.
Just to demonstrate it, for typical small values of "Factor", and as the response to a "Step
function" this filter will evolve according to the following approximated table:
After X samples Approximate

percentage
1 x "Factor" samples 66%
For example, if IIR7 is configured (Factor=7), after 7 samples the filtered value will
accumulate 66% of the 100% change in value. After 14 samples 88% and after 21
samples 96% etc.
14.6.2 Accelerometer
The accelerometer sensor is sampled once every second, and in addition it gives
interrupts to the Nano when it has an impact larger than the following preconfigured
threshold.
The reported impacts create impact events if enabled in the following mask here.
The sampled X,Y,Z value of the current acceleration are filtered (by IIR filter) and taken
to calculate the RMS value, and roll and pitch angles. From these values it can derive a
variety of features and links to their programming parameters:
 Tilt tamper

Cellocator Cello
Programming Manual
 Orientation change
 Man-down
 Detection when the unit is in motion and when it is stationary. As this is legacy
behaviour, see more details in section 6.2.9 above.
 Reports on the absolute orientation at every transmission in both type-0 and type-11.
14.6.3 Ambient Light Sensor (ALS)

This sensor is used mainly to know if the package that holds the unit inside is closed
(dark) or open (with some light).
The light sensor is sampled once every second and filtered by a configurable IIR filter.
The filtered level is compared against the configured threshold and if events are enabled
here or here the unit creates open package or closed package events respectively.
14.6.4 Pressure Sensor (Altimeter)

The air pressure is measured every 1 minute, and is filtered and converted (by the chip)
to meters.
The unit reports this value on every type-0 (at 32m resolution) and type-11 (at 0.1m
resolution) transmission.
14.6.5 Accurate Temperature Sensor

This ±1°C accuracy sensor is sampled according to a configurable rate when it is within
the configured limits and according to other configurable rate when out those limits for
more than this time.
See more details under section 14.9.11.
14.7 BLE functionality

BLE (Bluetooth6 Low Energy) is described in details in section 15.
14.8 Communication Protocols

Communication protocols and concept are all described in the Cellocator Wireless
Communication Protocol document.
6
BT SIG certification is currently in the product evolution process

Cellocator Cello
Programming Manual
14.9 Parameters Descriptions and Notes
14.9.1 Nano Take Location Interval
Address: 2039 – (LSB)

2040, bits 0-5 (MSB)
Description: The unit performs an extra "take location" between 2 consecutive cellular
transmissions and logs them.
This interval is from the last fix or timeout of "Max GPS on time", and it is parallel to the
legacy "GPS off time" parameter.
GSM periodic
glancing
GNSS peeking
(legacy)
Nano take location interval Nano take location interval

GNSS peeking
(improved
modes)
Extra GNSS
peeks and log it
Resolution: 1 minute
Data format: 14 bits
Data range: 1÷16383 (0=Disable extra peeking = same as legacy)
Default value: 0x168 = 360 = 6 hours
14.9.2 System Tracking Mode

Description: This sets the Nano’s main tracking mode.
Important note: This system mode configuration is stronger than the configuration in the
legacy "Enable live Tracking" bit.
Value Unit mode
00 Tracking legacy
01 Tracking improved
10 Reserved
11 Reserved

Cellocator Cello
Programming Manual
Default value: 00 = 0 = Tracking legacy. See more details about this mode in 14.3.1.
14.9.3 GPS warm start

Description: When "Warm starts" is selected ('1', default), the GPS will never be shut
down when unit hibernates so every GPS peeking will begin with a warm start (faster
time-to-first-fix with optimal energy consumption). When "Cold starts" is selected, the
GPS will be completely shut down when unit hibernates so every GPS peeking will begin
with a cold start.
Default value: 1 = Warm starts.
14.9.4 Legacy Events Type-11 Configuration
First refer to the messaging concept described in section 5.1 of the Cellocator Wireless
Communication Protocol document.
Addresses 540÷603 are allocated to contain a total of 512 bits, 2 bits for each one of
the 256 possible transmission reasons of type-0 legacy events.
This enables the configuration of each transmission reason to be also sent over type-11
messages (if enabled, and regardless of type-0 legacy event configuration) as a Logged
Event, as an "Active Log event" or as both, in the following way:
Address 540:
7 6 5 4 3 2 1 0
TR=3 TR=2 TR=1 TR=0
Logged "Active Logged "Active Logged "Active Logged "Active

log log log log
event" event" event" event"
…
And so on….till:
Address 603:
6 5 4 3 2 1 0
7
TR=254 TR=253 TR=252
TR=255

Cellocator Cello
Programming Manual
"Active Logged "Active Logged "Active Logged "Active

Logged
log log log log
event" event" event" event"
Default value: all zeroes (Disabled)

These fields can only be edited in the specialized table in the Cellocator Programmer tool.
Only relevant transmission reasons will appear in the table, all according to the table in
section 2.2.3.11 of the Cellocator Wireless Communication Protocol document.
14.9.5 Tilt Tamper
In order to detect detachment of the Nano unit from the installation surface (along with
its cradle or when installed without a cradle), a tilt-tamper mechanism can be used.
When orientation (by earth gravity) on each axis changes more than the configured angle
threshold when compared to the steady state for a longer time than the configured timer
threshold, the unit will report it.
This feature utilizes 2 IIR filters: slow (factor is hardcoded = 2) and very slow (factor is
hardcoded = 30). Each IIR filter is implemented as following:
𝑆𝑢𝑚0 = 𝑆𝑎𝑚𝑝𝑙𝑒0 ∗ 𝐹𝑎𝑐𝑡𝑜𝑟
𝑆𝑢𝑚
𝐴𝑣𝑔 =
𝐹𝑎𝑐𝑡𝑜𝑟
𝑆𝑢𝑚𝑛 = 𝑆𝑢𝑚𝑛−1 − 𝐴𝑣𝑔𝑛−1 + 𝑆𝑎𝑚𝑝𝑙𝑒𝑛
When Avg is the filtered value (filter output).

The subtraction of these 2 filters outputs is compared with the configurable threshold.

Cellocator Cello
Programming Manual
Slow IIR Filter

(Hardcoded factor = 2)
Accelerometer
(Xn, Yn, Zn) - Timer and
Comparator repeated Event
Very Slow IIR Filter event logic
(Hardcoded factor = 30)
Tilt-Tamper Angle Tilt-Tamper time filter

Change Threshold (Configurable)
(Configurable)
When a tilt tamper event is created, there is no other such event until the system has
stabilized.
14.9.5.1 Tilt Tamper Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the tilt-tamper
feature.
Tilt-tamper messaging Reserved
Type-11 Type-0
Logged "Active log Logged Distress

event"
Bit 7 Bit 6 Bit 5 Bit 4 Bits 0-3

Note: The Tilt Tamper feature is applicable also in Cello-(CAN)IQ units from FW version
33x, and in CelloTrack T units from FW version 61c.
Type 11 messaging is not applicable for Cello-(CAN)IQ and CelloTrack T.
14.9.5.2 Tilt-Tamper Angle Change Threshold
Address: 2045
Description: Tilt threshold in degrees.
Resolution: 0.588º

Cellocator Cello
Programming Manual
Data format: 1 byte

Data range: 0÷255 = 0.588º÷150º, (0=Disable the entire feature; the recommended
range is 30º÷100º)
Default value: 0x4D= 77 = 45.276º
14.9.5.3 Tilt-Tamper Time Filter

Description: Tilt time filter.
Data format: 4 bits
Data range: 0÷15 Seconds (0=Disable the entire feature)
Default value: 0 = Disabled
14.9.6 Accelerometer Based Impact / Free-fall Detection
Used in order to detect harsh and dangerous incidents such as crashes, haphazard
loading/unloading, and breaching attempts.
It is based on the inherent interrupt mechanism (of the accelerometer chip) for
acceleration passing a certain threshold. Either upwards (usually >1.5g), which is
considered an impact, or downwards (usually < 0.5g), which was probably caused by a
free-fall incident.
This impact or free-fall is configurable by a PL bit in the MultiSense, and fixed to impact
only in the Nano itself. In phase 2, the Nano will also support the same configuration bit
and free-fall feature (Infrastructure).
When the acceleration reading is higher than the configurable threshold, at any axis, for
more than the configurable time, it is considered an impact event and the chip will
generate an interrupt.
If enabled (see below), it is reported via the cellular link along with the peak RMS
acceleration magnitude of that incident.
14.9.6.1 Accelerometer Impact/Free-fall Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the Accelerometer
impact/free-fall feature.
Accelerometer impact/free-fall messaging Reserved
Type-11 Type-0

Cellocator Cello
Programming Manual

event"

NOTE: If none of these bits are enabled, then the entire feature is disabled.
14.9.6.2 Accelerometer Impact Threshold

Description: Nano impact threshold.
Resolution: 63mg [g = Earth gravity units]
Data format: 7 bits, decimal value
Data range: 0÷127 = 0÷8g, valid range for impact is 1÷8g, valid range for free-fall is
0÷1g
Default value: 0x20 = 32 = 2.016g
14.9.6.3 Accelerometer Impact Time Filter

Description: Nano impact/free-fall time filter.
Resolution: 1 ODR cycle (=20mS)
Data range: 0÷63 ODR cycles = 0÷1260mS, Valid range for impact= 20mS-1260mS,
Valid range for Free-fall = 60mS-1260mS
Default value: 0x04 = 4 ODR cycles = 80mS
14.9.6.4 Accelerometer Impact / Free-fall mode selection
Address: 2048 bit 7

Description: Selecting the mode of the accelerometer in the Nano.
Data range: 0=Impact, 1=Free fall
Default value: 0 = Impact
14.9.6.5 Impact_Free-fall repetitions timer

Address: 1860

Cellocator Cello
Programming Manual
Description: After an impact or free-fall event was created, this timer is reset and no
repetitions of this event will be created until the timer expires (per source). This is to
prevent multiple events in a short time.
Resolution: 0.5 minute
Valid Range: 0.5-127.5 minutes, 0=Disable
Default value: 0x01 = 0.5 minute
14.9.7 Orientation Change

This feature can be used to detect rollover situations, where the tracked asset is rolled on
one of its sides or upside down.
When the earth-gravity is moving more than the configured angle threshold, it shall be
considered as an "Orientation change" event.
14.9.7.1 Orientation Change Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the Orientation
change feature.
Orientation change messaging Reserved
Type-11 Type-0

event"
14.9.7.2 Orientation Change Threshold
Address: 2051
Description: When the earth-gravity is moving more than this angle threshold, it shall be
considered as an "Orientation change" event.
Resolution: 0.588º
Data format: 1 byte, decimal value
Data range: 0÷255 = 0.588º÷150º (0 = Disable the entire feature)
Default value: 0x4D = 77 = 45.276º

Cellocator Cello
Programming Manual
14.9.8 Man-down alarm and voice call
The "Check-in" operation fixates the 3 axis accelerometer values as a baseline reference.
Changing the unit orientation value above the threshold (in each axis, separately) related
to the fixated baseline orientation will initiate a "Man down" event.
From FW version 34j and on, man-down events will be detected only within the "Check-
in" window. So it will stop functioning when "Check-out timer" expired or check-out
operation by the user is performed.
If all check-in/out events are disabled (Address 2352 bits 4-7 = 0), then man-down
feature will not work either.
If enabled in the PL parameter of "Man-down delay and beeps enable" (address 2055.7),
when a man-down situation occurs, a buzzer indication will be sound with long beeps (1
Sec on, 1 Sec off, and repeat) for 20 seconds (hardcoded).
The creation of the event will be delayed by that period.
During that period, the user can press the power button shortly (for 0.2-5 Sec) and
cancel the buzzer and event creation (the man-down mechanism, will remain armed
though).
If the event was not canceled by the user, the event will be sent to the server, re-arming
this mechanism will be done when the orientation is back to the non-violation range of
degrees (filtered in the same manner of detecting man-down).
If enabled in the PL parameter of "Man down event initiate outgoing voice call enable"
(address 2055.6) the unit shall initiate a voice call (once) to the predefined phone
number in PL parameter of "Voice call Destination number" (address 273), after getting
all OTA ACKs, or 2 minutes hardcoded timeout, from the event transmission. The same
timeout as the incoming calls ("Listen-in timeout", in address 1847) will be applied for the
outgoing voice call as well.
If unit has no cellular link (not registered) or the unit is in hibernation and only logged
event was enabled, the voice call will not be performed.
14.9.8.1 Man-down Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the Man-down
feature.
Man-down messaging Reserved

Cellocator Cello
Programming Manual
Type-11 Type-0

event"
14.9.8.2 Man-down Threshold
Address: 2054
Description: When the earth gravity is moving more than the defined angle threshold, it
is considered a "Man down" event.
Resolution: 0.667º
Data range: 0÷255 = 0.667º÷170.085º (0= Disable the entire feature)
Default value: 0x43 = 67 = Tilt angle of 44.689º
14.9.8.3 Man-down Time Filter

Description: Man-down time filter, after which the event is created. Since this
mechanism is based on IIR2 and IIR30 filters (explained here) the response time may be
delayed in few more seconds and also dependent on the rate of change in angles.
Data range: 2÷63 Second (0 or 1 values are illegal and should not be set)
Default value: 0x05= 5 = 5 Seconds
14.9.8.4 Man-down delay and beeps enable

Address: 2055.7
Description: When this parameter is set to '1', the man-down event shall be delayed by
20 seconds, accompanied with beeps, letting the user cancel the event (and the beeps)
by pressing the power button shortly.
14.9.8.5 Man-down event initiate outgoing voice call enable

Address: 2055.6

Cellocator Cello
Programming Manual
Description: If this bit is set to '1' (enabled), upon creation of a Man-down event, the
unit shall initiate a voice call (once) to the predefined phone number (configured in PL
parameter of "Voice call Destination number" at address 273).
14.9.9 Package Open/Close Events
This feature is based on a light sensor, a configurable IIR filter and some small
hysteresis.
The events shall be generated upon crossing the threshold (plus the hysteresis) of the
filtered value. Meaning when unit is switched-on in stable environment, no event will be
generated.
Any crossing of the threshold (plus the hysteresis) upwards will generate a "Package
opened" event. Any crossing of the threshold (minus the hysteresis) downwards will
generate a "Package closed" event.
14.9.9.1 Open Package Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the open package
feature (for both Nano and MultiSense).
Open package messaging Reserved

(for both Nano and MultiSense)
Type-11 Type-0

event"
14.9.9.2 Close Package Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the close package
feature (for both Nano and MultiSense).
Close package messaging Reserved

(for both Nano and MultiSense)
Type-11 Type-0

Cellocator Cello
Programming Manual

event"
14.9.9.3 Package Open/Closed Light Threshold
Address: 2058
Description: When the filtered light level crosses this threshold upwards, it will be
considered a "Package open" event. When the filtered light level crosses this threshold
downwards, it will be considered a "Package close" event.
Resolution: 2.5 lux
Data range: 0÷255 = 0÷637.5 lux, Valid range is 12.5÷637.5 lux (values below 12.5
lux will be considered internally as value of 12.5).
Default value: 0x0C = 30 lux
14.9.9.4 Package Open/Closed Filter Factor

Description: This is the IIR filter convergence coefficient. Low values will give a faster
response than higher ones.
Data range: 2÷63 Second (value of 0 will disable the entire feature in the Nano only.
Value of 1 is illegal and should not be set)
Default value: 0x02 = Fastest response
14.9.9.5 MultiSense button press event Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the MultiSense
button press event feature.
When the Nano unit receives an advertisement from a paired MultiSense with indication
for button press it will create an event over Type-11, module-28, Event-code-23 as
described in the Cellocator wireless protocol document.
This can be used to turn the MultiSense button to a panic button, or any other desired
operation trigger.

Cellocator Cello
Programming Manual
MultiSense button press event

messaging
Type-11
Logged "Active log event"
Bit 3 Bit 2
Default value: 00 = All disabled
14.9.10 Analog Source Selection
One of the measured sensors can be selected and routed to one of the type-0 legacy
analog channels.
Note that only a single Nano source and type can be selected.
The selection is done by the following 2 selector parameters, the Source of measurement
and Sensor type, see below.
14.9.10.1 Source of Measurement
Address: 2064
Description: This is the ENUM of this field:
0x00÷0x0F – MultiSense unit (according to its location in the PL, whether
occupied/enabled or not)
0xFC – Guest/Tag MultiSense (not in the list)
0xFD – High accuracy or specialized sensors of the Nano 20 (for example: Accurate
temperature sensor, pressure sensor, etc)
0xFE – MCU internal (temperature only)
0xFF – Reserved
Default value: 0xFD = High accuracy or specialized sensors of the Nano 20
14.9.10.2 Sensor Type
Address: 2065
Description: This in the ENUM of this field:
0 = Reserved
1 = Temperature
2 = Humidity (MultiSense only)
3 = Pressure (Nano only)

Cellocator Cello
Programming Manual
4 = Ambient Light Sensor (4 lux resolution)

NOTE: All units and resolutions are the thin (8-bit) versions as used in type-0.
Default value: 0x01 = Temperature
14.9.11 Temperature and Humidity Measurements

The unit has a buffer, which is divided equally between the existing (defined in the PL)
channels.
There are up to 33 queues in a system; each queue shall contain up to 48 samples.
The multiplication of number of samples and number of queues shall not exceed 1155.
Examples:
 Full system (16 humidity sources + 17 temperature sources), each queue will be 35
samples.
 10 temperature sources, each queue will be 48 samples.
 13 humidity sources + 14 temperature sources, each queue will be 42 samples.

Cellocator Cello
Programming Manual
CelloTrack nano
M.S= MultiSense
M.S
Q1
1
M.S
Q2
2
Log
Wrapping
& Logging
machine
M.S Tx
Q16
16
Flash mem.
10K Events log mem.
Nano
Q17 (Also cyclic)
inherent
Total of 1155 samples

in the cyclic buffers
Each source has its separated state machine, and each buffer includes records and
header.
IMPORTANT: If a specific channel is not configured correctly and/or has illegal values,
for example:
 The lower-TH is higher than the upper-TH
 Out of range values
 Sampling rate or sampling during violation zeroed
 Alert time is less than one sampling time

In such cases, the system will ignore this channel completely: no events, no logging and
no transmissions will be sent.
 If the Alert time is more than one sampling time and less than 2 sampling times it will
wait 2 sampling time periods.
 If the Alert time is more than 2 sampling times the unit will wait the defined sampling
time.

Cellocator Cello
Programming Manual
T or RH%
Back to
limits point
Violation Alert Out of
point state alert
Relaxed Cyclic
sampling Buffer
rate
Alert duration
High
Limit Temp./Humid. Temp./Humid.
Alert time filter Alert time filter
0 t
Transmission
of the buffer Alert Transmission
sampling of the buffer after
Low rate configured timer or after
Limit (higher) alarm cancelation. As
long as the “Alert
retransmissions timeout”
hasn’t expired yet.
(The buffer is cleared
even if the message is not
transmitted)
NOTES:
 Both "Low limit" and "High limit" thresholds are concurrently active. The unit always
takes both of them into account.
 There are two sampling rates; one when not in alarm mode called "Relaxed sampling
rate" and one in alert mode called "Alert sampling rate".
 If logging sampling rate (hours +minutes) or relaxed/alert sampling rates are zeroed
or none of the related events are enabled – the entire feature is disabled.
IMPORTANT: All the parameters in the following sections (from sections 14.9.11.1
to 14.9.11.13) are related to the Nano only. The parallel parameters for MultiSense units
are described in section 15.4.
14.9.11.1 Relaxed Temperature Sampling Rate
Address: 2066
Description: This is the sampling rate when the channel is not in alert state.
Data range: 0÷255 = 0÷510. Valid range is 2÷510 seconds and must be < than
"Temperature alert time", otherwise the entire logger is disabled.
Default value: 0x1E = 60 seconds

Cellocator Cello
Programming Manual
14.9.11.2 Temperature Alert High Limit Threshold
Address: 2067
Description: Temperature high limit threshold; above this is a violation.
Resolution: 1ºC
Data format: 1 byte, Signed (2's complementary) value.
Data range: -127÷128, Valid range is -50÷100 ºC
Default value: 0x00 = 0ºC
14.9.11.3 Temperature Alert Low Limit Threshold
Address: 2068
Description: Temperature low limit threshold; below this is a violation.
Resolution: 1ºC
Data format: 1 byte, Signed (2's complementary) value.
Data range: -127÷128, Valid range is -50÷100 ºC
Default value: 0xEC = -20ºC
14.9.11.4 Temperature Alert Time
Address: 2069
Description: Timeout before alert generation, after a TH is crossed; also used to exit an
alert state after reverting to filter limits.
NOTE: This parameter will be rounded to the closest sampling time units.
Data format: 1 byte, decimal value.
Data range: 0÷255, Valid range is 1÷255 minutes and must be > "Relaxed temperature
sampling rate" and also > "Alert temperature sampling rate", otherwise the entire logger
is disabled.
Default value: 0x02 = 2 minutes
14.9.11.5 Alert Temperature Sampling Rate
Address: 2070
Description: Time for a violation to become an alert, and also reverting from non-
violation to non-alert.

Cellocator Cello
Programming Manual

Data range: 0÷255, Valid range is 1÷255 = 2÷510 seconds and must be < than
"Temperature alert time", otherwise the entire logger is disabled
Default value: 0x1E = 60 seconds
14.9.11.6 Sampling rate multiplier

Address: 2075.5
Description: When this bit is set to '1' the units of the Relaxed and Alert sampling rates
above (Addresses 2066 and 2070) are turned from seconds to minutes (multiplied by 60).
0 = Seconds
1 = Minutes
Note: if the “minutes” multiplier is selected and one of the sampling rates is larger than
few minutes, there might be a case that the “30 min after charging bit” will not cover all
samples in the module 40. For example, relax or alert sampling rate is set to 60 min and
the module 40 contains 10 samples (sent every 10 hours). In this case, the indication bit
of “30 min after charging bit” may not cover and report on a charging periods that
occurred in this 10 hours timeframe.
Default value: 0 = Seconds
14.9.11.7 High Limit Violation Event

Description: These bits enable (=1) or disable (=0) the messaging for the High limit
violation event (both temperature and humidity).
High limit violation event Reserved

(both temperature and humidity)
Type-11 Type-0

event"
Note: When the bits of type-11 are enabled, the message used to convey the event is
module 40 (and not module 28).

Cellocator Cello
Programming Manual
14.9.11.8 Low Limit Violation Event

Description: These bits enable (=1) or disable (=0) the messaging for the Low limit
violation event (both temperature and humidity).
Low limit violation event Reserved

(both temperature and humidity)
Type-11 Type-0

event"
Note: When the bits of type-11 are enabled, the message used to convey the event is
module 40 (and not module 28).
14.9.11.9 Nano Alert Retransmit Time
Address: 2073
Description: If an alert is not canceled by a special command (see the OTA protocol),
the unit will keep retransmitting the buffer over and over again every this defined period,
until the timeout expires.
NOTES:
 The value will be rounded to the closest whole "Alert temperature/humidity sampling
rate" units.
 From this parameter the number of samples to send in a single transmission is

calculated and then this number of samples is kept (and not the time).
For example: If sampling rate is 5 minutes and this parameter is 1 hour, the unit will
transmit every 12 samples (and not 1 hour), even if some samples are missing from a
MultiSense for instance.
 If less than one unit of "Alert temperature/humidity sampling rate" is transmitted, the
feature is disabled.
 If it has a larger value than the queue size, it will retransmit every full queue.
 A buffer can only be transmitted via type-11 messages. The retransmissions are also
sent (if enabled) over type-0 messages with current single measurements only.
Data range: 0÷255 minutes

Cellocator Cello
Programming Manual
Default value: 0x0F = 15 minutes
14.9.11.10 Nano Alert Retransmissions Timeout
Address: 2074
Description: If alert is not cleared, the buffer keeps being retransmitted until this
timeout expires.
Resolution: 10 minutes
Data range: 0÷255, Valid range is 1÷255 = 10÷2550 Minutes, 0=Disable
Default value: 0x00 = Disable
14.9.11.11 Temp. & Humidity Idle Transmission Event Configuration

Description: The Temp. & humidity idle transmission event in context of data logging
transmission when this time elapses since the last transmission.
If no alerts or special events occur for a long time, the system may not transmit anything
for a long time. On the other hand, the user may want to be able to still get the data-
logger functionality more frequently. When the “Temp. & humidity idle transmission
event” bit is set, the data-logger will send its buffers anyway after this time has elapsed.
If "Time base transmissions" parameter is set to "Disable (according to number of
samples)", then the transmissions will occur after sufficient number of samples have been
logged.
These bits enable (=1) or disable (=0) the messaging for the temp. & humidity idle
transmission event configuration.
Temp. & humidity idle transmission

event configuration
Type-11
Logged "Active log event"
Bit 7 Bit 6

Cellocator Cello
Programming Manual
14.9.11.12 Transmit After This Time Elapsed Since Last Transmission

(Hours)

Description: If no alert occurred, the unit will transmit the buffer anyway after the
defined time (hours + minutes; minutes is defined in the next parameter).
If "Time base transmissions" parameter is set to "Disable (according to number of
samples)", then the transmissions will occur after sufficient number of samples have been
logged.
Data range: 0÷31, Valid range is 0÷23 hours
Default value: 0x00 = 0 hours
14.9.11.13 Transmit After This Time Elapsed Since Last Transmission

(Minutes)

Description: If no alert occurred, the unit will transmit the buffer anyway after the
defined time (hours + minutes).
Data range: 0÷63, Valid range is 0÷59 minutes
Default value: 0x00 = 0 Minutes
14.9.11.14 Time base transmissions
Address: 2076 bit 6

Description: If this bit is set to '1' (enabled), the unit shall transmit according to time
base strictly and not number of samples (as done before release 34j), even if the module
40 array is empty (Number of samples in the payload = 0).
0 = Disable (according to number of samples)
1= Enable (according to time only)
Default: 1 = Enable (according to time only)
14.9.12 Indications Time Window
Address: 2080
Description: After power-up or reset, the units indication (Buzzer and LEDs) are shut
down after the defined "Indications time window" value, in order to conserve energy.

Cellocator Cello
Programming Manual
When the unit is in ON state, every button press longer than 200mS but shorter than 5
seconds will prolong or open the indications window by restarting this "Indications time
window".
Note that a zero value can result in an unstable system and therefore should not be used.
Data range: 0÷255, valid range 1÷255 (4÷1020 seconds)
Default value: 0x08= 32 seconds
14.9.13 Buzzer Configuration
14.9.13.1 Buzzer Enable Bits

Description: These bits enable (=1) or disable (=0) the various buzzer indications.
Panic was Ring Beep on Panic Check-in Button User Reserved

ACKed by beeps on registered Buzzer Buzzer press indication =0
server dial in MultiSense feedback feedback Buzzer beeps
Buzzer power-up feedback
feedback
Default value: 0xFC = All enabled except “User indication beeps”
14.9.13.2 Buzzer Beeps Interval On Out Of Limits Alert
Address: 2078
Description: When the configured sensors go out of their limits, repeating beeps are
sounded at the defined interval.
Data range: 0÷255, valid range is 1÷255 seconds
Default value: 0x0A = 10 seconds

Cellocator Cello
Programming Manual
14.9.13.3 User indication beeps timeout
Address: 1855
Description: If user doesn't acknowledge the "user indication beeps" by pressing the
check-in buttons (both buttons for 1>t>5 Sec), the beeps will stop after this timeout.
Data range: 0÷255, valid range is 1÷255 seconds
Default value: 0x0A = 10 seconds
14.9.14 LEDs Configuration
Address: 2079
Description: These bits enable (=1) or disable (=0) the various LED indications.
Panic LED Check-in LED

feedback feedback
Bits 7 Bit 6
Note that all these indications are displayed only for the "Indications time window" time.
Default value: 0x3 = both enabled
14.9.14.1 Battery State LED Interval
Battery state LED interval
Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Description: This is the time between consecutive LED blinks of battery level. See 14.2.2
for more details.
All these battery indications are displayed only for the "Indications time window" time.
Data range: 0÷31 seconds (0=Disable blinks entirely)

Cellocator Cello
Programming Manual
Default value: 0x05= 5 seconds
14.9.15 Check-in_out configuration
14.9.15.1 Check-in_out Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the Check-in and
Check-out events.
Check-in_out messaging Reserved
Type-11 Type-0

event"
14.9.15.2 Check-in timeout

Address: 1857
Description: After this timeout expires, the Check-in state shall be over, and back to
Check-out state.
Resolution: 0.5 hours
Valid Range: 0.5-127.5 hours, 0 =No timeout - infinite time (until power up)
14.9.16 Work-ID Messaging

Description: The unit promotes a "Work ID" counter on every power turn-ON operation
by the user.
This 32-bit counter is initialized to 0 only at the production line.
These bits enable (=1) or disable (=0) the messaging for the work-ID counter feature.
Reserved Work-ID messaging
Type-11 Type-0

Cellocator Cello
Programming Manual

event"
Bits 4-7 Bit 3 Bit 2 Bit 1 Bit 0
Default value: 0x02 = Type-0 Logged is enabled, all the rest are disabled.
14.9.17 Exception Handling

All meanings of "out-of-range" are explained here.
14.9.17.1 Exception Indications Configuration #1
Address: 2082
Description: For each type of event the following can be configured:
 Whether the event activates the buzzer.
 Whether the event activates the LEDs.
Light Light Reserved = 00 Accelerometer Accelerometer Reserved = 00

sensor sensor sensor out-of- sensor out-of-
out-of- out-of- range LED range Buzzer
range range indication indication
LED Buzzer
indication indication
14.9.17.2 Exception Indications Configuration #2
Address: 2083
Description: For each type of event, the following can be configured:
 Whether the event activates the buzzer.
 Whether the event activates the LEDs.
Reserved = 00 Temperature Temperature Geo-Fence Geo-Fence Reserved = 00

out-of-range out-of-range General General
LED Buzzer LED output Buzzer
indication indication indication output
indication

Cellocator Cello
Programming Manual
14.9.18 BLE Block
14.9.18.1 BLE Block Main Configuration
Address: 2084
Description: These bits enable (=1) or disable (=0) the BT classic and BLE (Bluetooth
Low Energy) block functionally feature.
There are three types of "MultiSense Processing Mode" options:
1. "Ignore unpaired MultiSense units" = in this mode, the Nano device will only
accept data from MultiSense units that are paired with the Nano device, and are in
range.
2. "Tag Mode" = in this mode, the Nano will detect all MultiSense units that are in its
range, but will not report sensor values from the MultiSense units. The data that
will be reported include the "MAC address," "battery level, "RSSI", "TX-reason",
"FW version", "BOM mask" and "Sensors mask" fields.
3. "Guest Mode" = in this mode, the Nano will detect all MultiSense units that is in its
range, and will also report all sensor values from the MultiSense units that are
enabled.
Additional Comments:
 In Guest mode, since the communication is bidirectional, it is recommended not to
have more than one Cello/Nano unit in the same BLE coverage range (~100m
radius/Nano).
 In Tag mode, since the communication is unidirectional, there is no such
limitation. Users are allowed to place multiple Cello/Nano units within the same
BLE coverage range.
Enable Reserved MultiSense Processing mode In use of BT Extender

BLE 00 – Ignore unpaired
MultiSense units
01 – "Tag mode": Only report
on existence (advertisements)
of unpaired MultiSense units
10 – "Guest mode": Process
and report on unpaired
MultiSense units
11 – Reserved
Default value: 0x00 = Ignore unpaired MultiSense units

The following 4 parameters are common to all connected MultiSense units in a system.

Cellocator Cello
Programming Manual
14.9.18.2 Guest and Tag MultiSense reporting

Description: These bits enable (=1) or disable (=0) the messaging for the Guest and
Tag mode reports.
Tag or Guest MultiSense event

messaging
(Both for Guest and Tag
modes)
Type-11
Logged "Active log

event"
Bit 7 Bit 6
Important note: If none of the enable bits for the guest/tag messaging are enabled (bits
6-7 above), the entire functionality of guest/tag mode is cancelled and the Nano acts as if
in normal mode (which is "Ignore unpaired MultiSense units").
14.9.18.3 MultiSense added/removed reporting

Description: These bits enable (=1) or disable (=0) the messaging for the adding and
removing of MultiSense units.
MultiSense added/ removed

event messaging
Type-11
Logged "Active log

event"
Bit 3 Bit 2
14.9.18.4 Proximity/Keep-Alive Transmission Timer
Address: 2085-2086
Description: This sets the timer via which MultiSense units transmit their keep-alive
messages. These transmissions will occur only if this timer elapsed since last

Cellocator Cello
Programming Manual
transmission. For example, if “Tx on violation only” mode is enabled and no violation
occurred for more than this timer.
Data range: 0÷65535, valid range is 2÷ 43200 = 4÷86400 seconds, but it is not
recommended to set it below 20 seconds.
Default value: 0x0E10 = 3600 seconds = 1 hour
14.9.18.5 Active Sensors Sampling Relaxed Timer
Address: 2087-2088
Description: This sets the timer via which MultiSense units transmit their measurements
messages if no violation of thresholds occurred.
In case that “Tx on violation only” mode is enabled, this timer will determine the internal
sampling rate of the sensors when there is no violation (of temperature or humidity).
Data range: 0÷65535, valid range is 2÷43200 = 4÷86400 seconds, but it is not
Default value: 0x0096 = 300 seconds
14.9.18.6 Active Sensors Sampling Violating Timer
Address: 2089-2090
Description: This sets the timer via which MultiSense units sample and transmit their
measurements messages if violation of thresholds occurred (of temperature or humidity).
Data range: 0÷65535, valid range is 2÷43200 = 4÷86400 seconds, but it is not
Default value: 0x003C = 60 seconds
14.9.18.7 MultiSense Temperature/Humidity Alert Time Filter
Address: 2091
Description: Timeout before alert generation, after a TH is crossed; also used to exit
alert state after reverting to defined limits.

Cellocator Cello
Programming Manual
Note: This parameter will be rounded to the closest sampling time units.
Data range: 0÷255, valid range is 1÷ 255 minutes
Default value: 0x02= 2 minutes
14.9.19 Dry contact input mode

Description: Sets the mode/meaning of the dry contact input value where:
Data range: 0= Normal
1= Extended battery charging indication
2÷3= Reserved
Default value: 0= Normal (Only reported in type-0 Inputs field, no extended battery).
14.9.20 Add module 44
Address: 2046 bit 6

Description: This bit determine if to add module 44 before any MultiSense related
transmissions or not. Module 44 contains enhanced additional information about the
relevant MultiSense. For more details, look at the wireless protocol doc.
Data range: 0= Disable, 1= Enable
14.9.21 Prevent power button from shutting down (Nano)
Address: 2046 bit 7

Description: If this bit is set, the power button of the Nano is prohibited from shutting
down the unit (the unit cannot go to inactive mode).
Data range: 0= Shutting down possible, 1= Shutting down impossible
Default value: 0= Shutting down possible

Cellocator Cello
Programming Manual
14.9.22 Pressure sudden change
14.9.22.1 Pressure sudden change event messaging

Description: These bits enable (=1) or disable (=0) the messaging for Pressure sudden
change event.
Pressure sudden change event

messaging
Type-11
Logged "Active log

event"
Bit 7 Bit 6
14.9.22.2 Pressure sudden change threshold
Address: 2043
Description: Pressure change threshold to create an event.
Resolution: 0.1m
Data format: 1 byte, Unsigned.
Data range: 0÷255 (0=Disable the entire feature), Valid range is 0.1÷25.5m
Default value: 0x1E = 3m
14.9.23 Voice listen-in
14.9.23.1 Voice listen-in white list numbers
Address: 800-899
Description: 10 white list numbers, each one can contain up to 15 digits in national or
international form.
Data format: First byte should contain the total amount of digits that make up the actual
address (not including address type byte). Second byte is the address type byte, which
should be 91h for international address (recommended type to use, to allow roaming) or
81h for local address. The rest of the bytes contain the actual address, encoded in BCD.
The order of the transmission is bytes with lower address first, lower nibbles (nibble = 4
bit) first. If only the lower nibble of a byte is used (this is legal only in the last byte – in

Cellocator Cello
Programming Manual
case this is the last digit of the address), the higher nibble should have all of its bits set
(the nibble should contain 15 dec). The rest of the bytes that are not used should contain
FFh.
When the list is all empty, the unit will answer any caller.
Default value: Null (empty)
14.9.23.2 Voice listen-in timeout
Address: 1847
Description: The limiting timeout of a single listen-in session.
Data format: 1 byte, Unsigned.
Data range: 0÷255 (0=Disable=No timeout, 1÷255 minutes)
Default value: 0x3C = 1 hour
14.9.24 Airplane mode
14.9.24.1 Automatic Airplane Mode
Address: 1848 bit 7

Description: This bit enables the entire feature of Airplane mode (aka Flight mode).
14.9.24.2 BLE remain powered during Airplane Mode
Address: 1848 bit 6

Description: This bit determines whether the BLE block will be powered off too when
airplane mode decide to shutdown the cellular modem or not.
Default value: 1= Enable

Cellocator Cello
Programming Manual
14.9.24.3 Timeout for longest flight
Address: 1852 bit 4÷7

Description: This parameter is protecting the unit from being in Airplane mode for too
long time. For best results, set it to the real maximal flight duration with some spare.
Data format: 4 bits, Unsigned.
Resolution: 2 hours
Data range: 0÷15 (0=Disable=No timeout) valid range is 1÷15 = 2÷30 hours
14.9.25 Improved power consumption for high transmission rates
If this feature is enabled by setting the PL parameter of "Battery saving mode transmit
interval" (address 1854) to a value ≥ 16 seconds, the unit will conserve up to 30%
energy in high transmission rates.
These special transmissions will be with a new TR=10: "Periodic transmission".
If configuration bit "Periodic Transmission (in battery saving mode) - Type-0" (address
526 bit-6) is enabled, the event will be transmitted over Type-0, and if the bits of Type-
11 encapsulation are enabled (bits 4-5 in address 542, set via “type-11 encapsulation”
tab in MultiSense editor screen), it will be transmitted over type-11 as encapsulated. (or
both, if all these bits are enabled).
14.9.25.1 Battery saving mode transmit interval
Address: 1854
Description: If this parameter is set to 16 or above, the system will enter battery saving
mode and will transmit an independent transmissions in intervals regardless of ignition or
other factors.
It will save more percentage of battery as much as the transmission rate is higher.
Maximum saving (in %) is with transmit interval of 16 seconds.
Format: 1 byte, decimal value.
Units: Seconds
Resolution: 2 Seconds
Valid Range: 0-7 (0-14 Seconds) = Disable, 8-255 (16-510 Seconds) = Active
Default value: 0 (entire feature is disabled).

Cellocator Cello
Programming Manual
14.9.25.2 Periodic Transmission (in battery saving mode) - Type-0

Address: 526, bit 6
Description: This parameter enables to send only logged events of type "Periodic
Transmission (in battery saving mode)" in type-0.
Sending this event in Type-11 (encapsulated) either in addition to type-0 or instead of it,
the bits 4-5 in address 542 should be set accordingly.
Data Range: 1 - Enable, 0 - Disable.
14.10 Installations
The Nano unit can be installed in a variety of ways. For more details, refer to the
Installation Guide.

Cellocator Cello
Programming Manual
15 MultiSense and MultiSense-TH
15.1 Introduction
The MultiSense is a remote peripheral sensor, communicating and configured by the

CelloTrack Nano via a short-range RF link.
There are 2 models of MultiSense: regular devices that can measure temperature called
"MultiSense" and "MultiSense-TH" devices which have a combined temperature and
humidity sensor.
The MultiSense device has the following sensors:
 Temperature sensor
 Humidity sensor (only in the MultiSense-TH model)
 Hall effect magnetic sensor
 Ambient Light Sensor (ALS)
 Accelerometer sensor
The system supports up to 16 fully programmable MultiSense devices.
If "Guest mode" is enabled here, the Nano unit will also connect with MultiSense units not
in its list, read their sensors and pass the data (in raw format) to the server. Only listed
MultiSense units also get configuration blocks and their readings are fully processed by
the Nano.
If "Tag mode" is enabled here, the Nano unit will only report on existence (reception of
advertisements) of unpaired MultiSense units, not reading their sensors.

Cellocator Cello
Programming Manual
15.2 Operation
15.2.1 Marking
The magnet icon symbolizes the location of the magnet sensor. The permanent magnet
should be installed against it with distance of body-to-body of 1-3cm.
The eye icon symbolizes the light sensor direction, to which the source of light should be
directed.
15.2.2 Battery
Use only CR2450 size battery. Be careful not to install the battery at the wrong polarity as
it could damage the device.
Choose the exact battery model and manufacturer of the battery according to the
required temperature range.
To install a battery, unscrew the upper half from the base half until the two triangles on
the side are aligned, and then pull it.
15.2.3 Button and Blue LED

 When the battery is inserted, the unit always goes to active mode and the blue LED
lights for 3 seconds.
 When active, every short press (up to 1 second long) triggers sampling and
transmission and the blue LED blinks 5 times.
 When active, a long press (longer than 4 seconds) will turn the unit OFF (inactive
mode), accompanied by 3 blue LED blinks.
 When the unit is off (inactive mode), a long press (longer than 4 seconds) will turn
the unit ON and the blue LED lights up for 3 seconds (as per the battery insertion
above).
15.2.4 Pairing Process

Closed loop pairing (in the field pairing, over BLE) is performed by pressing
simultaneously on both Nano buttons for 5 consecutive seconds. However, note the
following:
 If an active indications window exists, it will be closed.
 If the 2 buttons are pressed for more than 1 second but released before completing
the 5 consecutive seconds, it will create a check-in event.
 If enabled here, a beep is heard for every elapsed second in the first 4 seconds; if the
check-in buzzer enabled bit is set or not "Dual short beeps" after the 5 th second (0.5

Cellocator Cello
Programming Manual
second each) indicate ‘pairing time frame mode’ is open for “BLE Pairing time
window”.
During this time window:
 The Nano’s left LED flashes orange 0.5 Sec ON, 0.5 Sec OFF (assuming no charger or
PC are connected; if connected it has higher priority on the LED).
 User powers-up a MultiSense device.
 As the Nano pairs with the MultiSense, a long beep (2 seconds) is heard. In addition,
the MultiSense LED blinks twice (after the 3 second long power-on LED pulse): 200mS
OFF, 200mS ON, 200mS OFF, 200mS ON.
 Only one MultiSense device can be paired during a single "BLE Pairing time window"
(to avoid mistakes). The timer for the "BLE Pairing time window" is renewed
automatically after each successful MultiSense pairing in order to give the operator
the opportunity to pair devices one after the other.
 If enabled here, upon every newly added MultiSense to the system a "MultiSense
added" event is created; for every unpaired device a "MultiSense removed" event is
created.
 As the "BLE Pairing time window" expires, and at least one MultiSense was
added/removed, the Nano will automatically perform a system reset.
 If no new MultiSense was paired, and the "BLE Pairing time window" expired, the red
right LED will turn on for 2 seconds (with no beep).
 If all 16 devices are defined (MAC address ≠ 00:00:00:00:00:00), a new MultiSense

unit cannot be paired.
 There are no retries for each step of this process.

IMPORTANT: After pairing and unpairing operations, the queue allocation should be
restarted (by performing a reset to the entire unit).
Pre-configuration before field pairing of units is possible, just note that when a new
MultiSense is paired in field, it will get the first vacant index, starting from #1 and up to
#16, and will get the corresponding pre-configured parameters for its index.
15.2.5 Unpairing Process

As per the pairing process, except that during the "BLE Pairing time window" the user
turn off the MultiSense device; the Nano recognizes it and approves the unpairing with
dual long beeps (1 second each, with OFF time 200mS between them) and with the
orange LED turning off.
If no approval was given, it is possible to reattempt the procedure.

Cellocator Cello
Programming Manual
15.3 Sensors
15.3.1 Accelerometer
The accelerometer sensor is sampled on every wake-up and Tx cycle and in addition
triggers an interrupt (asynchronous transmission) when it has an impact larger than the
preconfigured threshold.
The reported impacts create impact events, if enabled here.
The sampled X,Y,Z values are reported on every MultiSense provisioning message and the
calculated RMS value on every impact/free-fall event.
15.3.2 Ambient Light Sensor (ALS)

This sensor is used mainly to detect if the package that holds the unit inside is closed
(dark) or open (exposed to some light).
The light sensor is sampled once on every wake-up and Tx cycle.
The level is compared against the configured threshold and if events are enabled (as
described here or here) the unit creates open package or closed package events
respectively.
15.3.3 Accurate Temperature Sensor

This ±1°C accuracy sensor is sampled according to a configurable rate when it is within
the configured limits and according to other configurable rates when out those limits for
more than this time.
See more details in section 14.9.11.
15.3.4 Humidity Sensor

This ±4% accuracy relative-humidity sensor is sampled according to a configurable rate
when it is within the configured limits and according to other configurable rates when out
those limits for more than this time.
See more details in section 14.9.11 above.
15.3.5 Magnetic Sensor

This sensor is binary. It recognizes if a strong enough magnetic field exists or not.
If enabled here, upon any change of state, it triggers an interrupt and an asynchronous
wake-up and Tx cycle.

Cellocator Cello
Programming Manual
15.4 Parameter Descriptions and Notes
15.4.1 MultiSense Units Provisioning

If 5 consequent keep alive periods (according to the parameter here) have passed and
no messages whatsoever were received from it (no advertisements at all), the relevant
MultiSense is considered "lost" and should be reported as a "MultiSense provisioning
message" event with the problem code of "1 = Lost communication".
If a marked "lost" MultiSense is received again (any advertisement), a communication-
restore event is sent ("MultiSense provisioning message" event with the problem code of
"2 = Communication restored").
15.4.1.1 MultiSense Provisioning Event Messaging

provisioning.
MultiSense provisioning event messaging
Type-11 Type-0

event"
Bit 3 Bit 2 Bit 1 Bit 0
15.4.2 MultiSense Open/Close Door/Window Feature

The MultiSense comprises a magnetic sensor that can give indication of the presence or
absence of a strong magnetic field (permanent magnet, with specified strength, less than
30mm in distance).
Any change of state is reported immediately to the Nano.
15.4.2.1 MultiSense Open/Close Door/Window Event Messaging

Open/Close door/window feature.

Cellocator Cello
Programming Manual
MultiSense Open/Close door/window event

messaging
Type-11 Type-0

event"
Bit 7 Bit 6 Bit 5 Bit 4

All these parameters are set using the Nano editor screen accessed from the Cellocator
Programmer tool.
15.4.3 BLE Pairing Time Window

Description: Timeout before "in the field" pairing window is closed. See more details
here.
Data range: 0÷31, valid range is 1÷31 (10÷310 seconds)
Default value: 0x02 = 20 seconds
15.4.4 Specific MultiSense parameters
Each MultiSense have MAC address, hardware-ID byte (HW_ID), and 9 bytes of
configuration.
The HW_ID of MultiSense is 0xDC and for MultiSense-TH it's 0xFC.
About MAC address: Deleting a MAC address is done by writing 00:00:00:00:00:00 as the
address. Any other address is considered a valid one.
The address mapping is according to the following table:
MultiSense MAC address HW_ID 9 configuration bytes
# (6 bytes) byte per MultiSense
1 2236÷2241 2332 2092÷2100

2 2242÷2247 2333 2101÷2109
3 2248÷2253 2334 2110÷2118
4 2254÷2259 2335 2119÷2127
5 2260÷2265 2336 2128÷2136

Cellocator Cello
Programming Manual
6 2266÷2271 2337 2137÷2145

7 2272÷2277 2338 2146÷2154
8 2278÷2283 2339 2155÷2163
9 2284÷2289 2340 2164÷2172
10 2290÷2295 2341 2173÷2181
11 2296÷2301 2342 2182÷2190
12 2302÷2307 2343 2191÷2199
13 2308÷2313 2344 2200÷2208
14 2314÷2319 2345 2209÷2217
15 2320÷2325 2346 2218÷2226
16 2326÷2331 2347 2227÷2235
These configuration areas can be read and/or written to by using the wireless commands
"Inbound: Configuration Memory Read Request Module" mentioned in the wireless
protocol doc at section 3.8.5 and "Inbound: Configuration Memory Write Module"
mentioned in the wireless protocol doc at section 3.8.6 respectively.
Addresses: 2092÷2235
Description: These addresses contains an array of 16 configuration blocks; one block of
9 bytes per MultiSense.
Each one of the 16 blocks looks as described in the following parameters.
15.4.4.1 Sensors Enable Bitmask - 1st Byte
Description: Enable bit for every sensor and feature.
Reserved Temperature Humidity Hall- Light Accelerome Tx on Prevent

sensor sensor effect sensor ter sensor violations pushbutton
enable enable sensor enable enable only power
enable (mode) down
Keep-alive
only and
upon
violations

Cellocator Cello
Programming Manual
15.4.4.2 MultiSense Temperature Upper Limit Threshold - 2nd Byte
Description: MultiSense Temperature upper limit threshold.

Resolution: 1ºC
Data format: Signed (2's complementary) decimal value
Data range: 0÷255, valid range is 0÷80, -1÷-40 = -40÷80 ºC
Default value: 0x00 = 0ºC
15.4.4.3 MultiSense Temperature Lower Limit Threshold - 3rd Byte
Description: MultiSense Temperature lower limit threshold.

Resolution: 1ºC
Data format: Signed (2's complementary) decimal value
Data range: 0÷255, valid range is 0÷80, -1÷-40 = -40÷80 ºC
Default value: 0xEC = -20ºC
15.4.4.4 MultiSense Humidity Upper Limit Threshold - 4th Byte
Description: MultiSense Humidity upper limit threshold.

Resolution: 1%
Data range: 0÷255, valid range is 0÷100 %
Default value: 0x50 = 80%
15.4.4.5 MultiSense Humidity Lower Limit Threshold - 5th Byte
Description: MultiSense Humidity lower limit threshold.

Resolution: 1%
Data range: 0÷255, valid range is 0÷100 %
Default value: 0x14 = 20%

Cellocator Cello
Programming Manual
15.4.4.6 MultiSense Impact or Free-fall Selection - 6th Byte, Bit 7
Description: MultiSense Impact or Free-fall selection; 0=Impact, 1=Free-fall.

Default value: 0 = Impact
15.4.4.7 MultiSense Impact/Free-fall Event Threshold - 6th Byte, Bits 0÷6
Description: MultiSense Impact/Free-fall event threshold in g (earth gravity) units.

Recommended values for Impact mode is >1.5g.
Recommended values for free-fall mode is <0.7g.
Resolution: 63mg (full scale is ±8g)
Data range: 0÷127 = 0÷8g
Default value: 0x20 = 2g
15.4.4.8 MultiSense Package Open/Closed Light Threshold - 7th Byte
Description: MultiSense Package open/closed light threshold

Resolution: 2 lux
Data format: 7 bits, 1 byte, decimal value
Data range: 0÷255 = 0÷510 lux, Valid range is 12÷500 lux (values below 12 lux will
disable the entire feature).
Default value: 0x0A = 20 lux
15.4.4.9 Reserved Bytes - 8th and 9th Bytes
Those bytes are empty and reserved (=0x00).

Cellocator Cello
Programming Manual

POINTER TELOCATION LTD. 14 HAMELACHA ST. ROSH HA'AYIN 4809133, ISRAEL ● TEL: 972-3-5723111 ● FAX: 972-3-5723100 ● WWW.POINTER.COM

CelloTrack Nano Programming Manual

Uploaded by

Copyright:

Available Formats

CelloTrack Nano Programming Manual

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CelloTrack Nano Programming Manual

Uploaded by

Copyright:

Available Formats

Cellocator Cello

Proprietary and Confidential

Revised and Updated: April 18, 2018

Copyright © 2018 by Pointer Telocation, Ltd.

Warranty Exceptions and Disclaimers

Cellocator Cello Programming Manual Page 2 of 219

Cellocator Cello Programming Manual Page 3 of 219

Cellocator Cello Programming Manual - CelloTrack Nano ................................................... 1

Cellocator Cello Programming Manual Page 4 of 219

5.2.19 Offline Tracking - Auto Upload Configuration ..................................................................34

Cellocator Cello Programming Manual Page 5 of 219

6.4.5 Enable Warning Output Activation during Gradual Immobilization .....................................88

Cellocator Cello Programming Manual Page 6 of 219

7.3.1 Speed Thresholds V0, V1 and V2 ................................................................................ 111

Cellocator Cello Programming Manual Page 7 of 219

10.1.1 Main Power Low Threshold – High/Low levels ............................................................... 130

Cellocator Cello Programming Manual Page 8 of 219

12.7 Glancing at Specific Time (ST Glancing) ...................................................................... 151

Cellocator Cello Programming Manual Page 9 of 219

14.9.9 Package Open/Close Events ....................................................................................... 186

Cellocator Cello Programming Manual Page 10 of 219

1.1 About this Document

1.2 Applicability Table

CelloTrack All information related to CelloTrack in this document

Cellocator Cello Programming Manual Page 11 of 219

1.4 Document Conventions

Cellocator Cello Programming Manual Page 12 of 219

2 Accessing the Configuration Memory via Wireless

Cellocator Cello Programming Manual Page 13 of 219

3 Accessing the Configuration Memory via Direct

4 Event Types generated by Cellocator devices

4.1 Logged (Plain) Event

4.2 HRLS Event

4.3 Distress Event

Cellocator Cello Programming Manual Page 14 of 219

It is also possible to initiate an endless (or specified duration) distress session by

4.4 Security Event

4.5 Active Logged (Plain) Event

1.5 Minutes 30 Sec

Wait for GPS Fix

Ack. From Server

 During Live Tracking

Cellocator Cello Programming Manual Page 15 of 219

Cellocator Cello Programming Manual Page 16 of 219

5 Address and Bitmask Field Allocation Tables

 Address allocation table, see below

 Bitmask Field allocation tables, page 26

5.1 Address Allocation Table

0 Application Configuration byte 1

1 Application Configuration byte 2

3-4 Hibernation mode communication settings

6 Application Configuration byte 3

7 Application Configuration byte 4

8 - 31 Operational Sever - PPP Username

32-34 Trip for a Distance event in Roaming mode

35 Time/Distance alert multipliers for High Speed in Roaming GSM

36 - 65 Operational Sever - APN

66 - 69 Default Target IP Address (for GPRS)

70 - 71 Time between Idle Transmissions