4G Terminal Communication Protocol

Data Example:
FA AF 01 00 00 10 86 39 21 03 29 53 89 80 01 37 B7 67 31 35 2C 31 35 39 39 31 34 36 34 30 36 2C
30 2C 36 35 37 39 32 2C 38 36 33 39 32 31 30 33 32 39 35 33 38 39 38 2C 35 32 35 30 31 36 31 32
30 31 33 32 37 31 35 2C 38 39 36 35 30 31 31 38 30 32 30 37 30 30 38 35 30 37 33 2C 30 2C 30 2C
31 7C 36 39 7C 30 7C 30 7C 30 2E 30 30 24 30 2E 30 30 24 30 2E 30 30 24 33 36 2E 35 30 7C 32 2C
34 2E 30 39 7C 39 30 2C 32 2C 2C 35 7C 35 30 3A 66 61 3A 38 34 3A 36 62 3A 38 65 3A 66 65 24
24 2D 34 35 7C 30 63 3A 65 34 3A 61 30 3A 35 32 3A 63 37 3A 65 35 24 24 2D 36 32 7C 30 63 3A
65 34 3A 61 30 3A 35 32 3A 63 37 3A 65 31 24 24 2D 36 34 7C 64 30 3A 37 36 3A 65 37 3A 37 32
3A 61 36 3A 66 35 24 24 2D 37 31 7C 35 30 3A 66 61 3A 38 34 3A 35 66 3A 63 32 3A 66 34 24 24
2D 37 35 2C 34 36 35 32 34 39 34 30 7C 2D 31 34 32 7C 32 30 2C 53 49 30 32 30 30 39 30 33 31
7C 32 30 30 39 30 33 30 31 7C 31 2C 31 32 38 2C 35 31 34 39 7C 30 7C 36 30 7C 32 7C 34 35 7C
38 2C 31 37 7C 30 7C 37 31 24 38 24 30 24 30 FA AF

Description
No. Data Description
1 FA AF Flag first, fixed
2 01 00 Tracking flag, fixed
3 00 10 Serial number，0000-ffff
4 86 39 21 03 29 53 89 80 IMEI，BCD number
5 01 37 Message length, hexadecimal to
decimal, 0137 from
hexadecimal to decimal is 311,
which means that the current
message length is 311 bytes
6 B7 67 Check code, refer to "Java
check" or "C check"
7 31 35 2C 31 35 39 39 31 34 36 34 30 36 2C 30 2C 36 35 37 39 32 2C 38 36 33 39 32 Message content, to be
31 30 33 32 39 35 33 38 39 38 2C 35 32 35 30 31 36 31 32 30 31 33 32 37 31 35 2C converted to string.
38 39 36 35 30 31 31 38 30 32 30 37 30 30 38 35 30 37 33 2C 30 2C 30 2C 31 7C 36
39 7C 30 7C 30 7C 30 2E 30 30 24 30 2E 30 30 24 30 2E 30 30 24 33 36 2E 35 30 7C
32 2C 34 2E 30 39 7C 39 30 2C 32 2C 2C 35 7C 35 30 3A 66 61 3A 38 34 3A 36 62 3A
38 65 3A 66 65 24 24 2D 34 35 7C 30 63 3A 65 34 3A 61 30 3A 35 32 3A 63 37 3A 65
35 24 24 2D 36 32 7C 30 63 3A 65 34 3A 61 30 3A 35 32 3A 63 37 3A 65 31 24 24 2D
36 34 7C 64 30 3A 37 36 3A 65 37 3A 37 32 3A 61 36 3A 66 35 24 24 2D 37 31 7C 35
30 3A 66 61 3A 38 34 3A 35 66 3A 63 32 3A 66 34 24 24 2D 37 35 2C 34 36 35 32 34
39 34 30 7C 2D 31 34 32 7C 32 30 2C 53 49 30 32 30 30 39 30 33 31 7C 32 30 30 39
30 33 30 31 7C 31 2C 31 32 38 2C 35 31 34 39 7C 30 7C 36 30 7C 32 7C 34 35 7C 38
2C 31 37 7C 30 7C 37 31 24 38 24 30 24 30
8 FA AF Flag end, fixed

1
Note: if "0xfa 0xaf" appears outside the Flag first / Flag end, The terminal is adjusted to "0xfb
0xbf 0x01" for uploading, and "0xfb 0xbf" appears, and the terminal is adjusted to "0xfb 0xbf
0x02" for uploading; the platform needs to do corresponding processing.

For example, if the "message content" to be sent by the terminal is:

FA AF FB BF

Terminal process:
1, No.2+No.3+No.4+No.5+No.6
01 00 00 10 86 39 21 03 29 53 89 80 00 04 00 00 FA AF FB BF
2, Adjusted to, Byte length unchanged
01 00 00 10 86 39 21 03 29 53 89 80 00 04 00 00 FB BF 01 FB BF 02
3，Add Flag first and Flag end
FA AF 01 00 00 10 86 39 21 03 29 53 89 80 00 04 00 00 FB BF 01 FB BF 02 FA AF

Systeml process:
1, Received:
FA AF 01 00 00 10 86 39 21 03 29 53 89 80 00 04 00 00 FB BF 01 FB BF 02 FA AF
2, Delete Flag first and Flag end
01 00 00 10 86 39 21 03 29 53 89 80 00 04 00 00 FB BF 01 FB BF 02
3, Adjusted to
01 00 00 10 86 39 21 03 29 53 89 80 00 04 00 00 FA AF FB BF

2
Java check:
public static int checksum(byte[] data, int len) {
int sum = 0;
for (int j=0; len > 1; len--) {
sum += data[j++]&0xff;
if ((sum & 0x80000000)>0) {
sum = (sum & 0xffff) + (sum >> 16);
}
}
if (len == 1) {
sum += data[data.length-1]&0xff;
}
while ((sum >> 16)>0) {
sum = (sum & 0xffff) + sum >> 16;
}
sum=(sum == 0xffff) ? sum& 0xffff : (~sum)&0xffff;
return sum;
}

C check：
unsigned short sw_tcp_checksum(unsigned char *data,int len)
{
unsigned long sum=0;
for(;len>1;len-=1)
{
sum+=*data++;
if(sum&0x80000000)
sum=(sum&0xffff)+(sum>>16);
}
if(len=1)
{
unsigned short i=0;
*(unsigned char *)(&i)=*(unsigned char *)data;
sum+=i;
}
while(sum>>16)
sum=(sum&0xffff)+sum>>16;
return (sum==0xffff)?sum:~sum;
}

3
 Message content converted to string Data example:
113,1598997660,0,131200,863921032986898,525016120367255,8965011904070322553,0,138,
119|98|137|75|0.00$0.00$0.00$36.50|2,3.58|20,7,E|11403.074218|N|2234.006591|10|15|6
2.90|0.00|0.00|42|16|12|44$44$42$41$,3|0c:2a:86:dd:a8:dd$$-65|d0:76:e7:72:a6:f5$$-68|7c:
1e:06:82:d5:71$$-71,46524940|-100|24|1/460$0$9351$46524940$0$-100,SI02008071|200807
01|1,64,5149|1|60|2|45|8,17|0|232$0$0$0,,,20:00$20:30$3$1$D1D3CD9C|1598890298|0.97

No. Data Description

1 113 Serial number
2 1598997660 Time stamp
3 0 Ignore
4 131200 Alarm data (see table below)
5 863921032986898 IMEI
6 525016120367255 IMSI
7 8965011904070322553 ICCID
8 0,138,119|98|137|75|0.00$0. 0 is Ignore, Step count is 138, heart rate data serial number is 119,
00$0.00$36.50|2 heart rate is 98, systolic blood pressure is 137, diastolic blood
pressure is 75, 0.00$0.00$0.00$36.50|2 is Ignore.
9 3.58|20 The battery voltage is 3.58 and the percentage of charge is 20%.
10 7 For tracking mode, decimal system needs to be converted to binary
system, from right to left, the first “1” represents lbs data, the
second “1” represents WiFi data, and the third “1” represents GPS
data; if the current value is 7, it will be 111 after being converted to
binary system, which means that the current tracking data contains
three kinds of data: "lbs + WiFi + GPS".
11 E|11403.074218|N|2234.006 GPS data: longitude is e11403.074218, latitude is n よ
591|10|15|62.90|0.00|0.00| 2234.006591, the number of satellites that can be tracked is 10, the
42|16|12|44$44$42$41$ number of visible satellites is 15, the altitude is 62.90, the speed is
0.00, and the direction is 0.00,
42|16|12|44$44$42$41$ is Ignore.
12 3|0c:2a:86:dd:a8:dd$$-65|d0: WiFi data: the number of WiFi hotspots received is 3,
76:e7:72:a6:f5$$-68|7c:1e:06: The MAC address is 0C: 2A: 86: DD: A8: DD, and the signal is - 65;
82:d5:71$$-71 The MAC address is d0:76: e7:72: A6: F5, and the signal is - 68; The
MAC address is 7C: 1E: 06:82: d5:71, and the signal is - 71
13 46524940|-100|24|1/460$0$ LBS data: 46524940 is ignored; - 100 is ignored, CSQ is 24, LBS
9351$46524940$0$-100 number is 1; MCC is 460, MNC is 0, LAC is 9351, CID is 46524940,
ARFCN is 0, RSSI is - 100
14 SI02008071|20080701|1 The upper version of the terminal is SI02008071, and the bottom
version of the terminal is 20080701, “1“is Ignore.
15 64,5149|1|60|2|45|8,17|0|2 Ignore
32$0$0$0
16 20:00$20:30$3$1$D1D3CD9C 20: 00: start ranging time
|1598890298|0.97 20:: 30 Ranging end time
3: Over distance threshold (m)

4
1: There is a binding tag / base station. If it is 0, there is no data
behind it
D1D3CD9C: Tag / base station ID, ranging object
1598890298: timestamp of last successful ranging
0.97: ranging value (m)

5
 Alarm Data：
0 1 2 3 4 5 6 7 8 9
SOS Ignore Ignore Ignore State of Ignore First Ignore Ignore Tamper
charge tracking proof
after power alarm
on
10 11 12 13 14 15 16 17 18 19
Tamper Ignore Ignore Ignore Ignore Motion Ignore The light No feedback No
proof alarm sensor has from light ranging
normal feedback sensor value
20
Over
distanc
e alarm

Note: 131200 to binary system is 10000000000, from right to left, the 10th and 18th bits are valid,
indicating tamper proof alarm and The light sensor has feedback.

6
 Example of IP settings:
FA AF 00 07 00 02 32 96 21 62 47 D3 CF 17 00 17 FB 18 69 70 3D 31 32 30 2E 32 35 2E 37 35 2E
31 30 31 3A 33 38 38 39 39 00 FA AF

No. Data Analysis Description

1 FA AF FA AF Flag first, fixed
2 00 07 7 From hexadecimal to decimal, Set ID, fixed
3 00 02 2 From hexadecimal to decimal, Serial number, 0000-FFFF
4 32 96 21 62 47 D3 CF 17 3296216247D3CF17 BCD，terminal IMEI
5 00 17 23 From hexadecimal to decimal, Content length (bytes)
6 FB 18 FB18 Calibration, same as above
7 69 70 3D 31 32 30 2E 32 ip=120.25.75.101:388 Instruction content: when hexadecimal is converted into
35 2E 37 35 2E 31 30 31 99 a string, it must end with 00. If there is no 0, 0 will be
3A 33 38 38 39 39 00 added. It means that the data will be sent to the server
with IP 120.25.75.101 and port 38899
8 FA AF FA AF Flag end, fixed

The contents of the "tracking time modification" instruction are as follows:

St = 10 (73 74 3D 31 300) means tracking once in 10 seconds.

The command content of "GPS ankle binding to base station" is as follows:

For example:
The GPS ankle with the last 8 digits of ID is 11111111, which is bound to the base station of
22222222 in the last 8 bits of ID. every night from 1830 to 0710 the next morning, the alarm will
be given when the distance between the ankle and the base station is more than 20 meters.
The system sends GPS ankle content as follows:
curfew=183,71,20,22222222（63 75 72 66 65 77 3D 31 38 33 2C 37 31 2C 32 30 2C 32 32 32 32 32
32 32 32 00）
The contents sent by the system to the base station are as follows:
curfew=183,71,20,22,11111111（63 75 72 66 65 77 3D 31 38 33 2C 37 31 2C 32 30 2C 32 32 2C 31
31 31 31 31 31 31 31 00）

7
 OTA
1, The system issues upgrade instructions / examples:
FA AF 00 05 13 61 86 07 44 03 61 60 31 70 00 22 FA E2 66 30 33 31 38 30 33 30 31 44 31 00 00 00
00 00 00 00 00 00 2E 76 78 70 00 00 00 13 00 02 71 66 01 39 FA AF
No. Data Analysis Description
1 00 05 5 From hexadecimal to decimal, Upgrade instruction ID,
fixed
13 61 4961 From hexadecimal to decimal, Serial number, 0000-FFFF
86 07 44 03 61 60 31 70 8607440361603170 BCD，terminal IMEI
00 22 34 From hexadecimal to decimal, Content length (bytes)
FA E2 FAE2 Calibration, same as above
2 66 30 33 31 38 30 33 30 31 44 f03180301D1 Hexadecimal parsing to a string, this file name must be
31 00 00 00 00 00 00 00 00 00 consistent with the package file name
3 2E 76 78 70 .vxp Hexadecimal parsing to string, upgrade package
extension
4 00 00 00 13 19 From hexadecimal to decimal, Upgrade file ID of the
server
5 00 02 71 66 160102 From hexadecimal to decimal, The upgrade file is
160102 bytes
6 01 39 313 From hexadecimal to decimal, The upgrade file is
divided into 313 packages, 512 bytes each

2, The terminal replies the upgrade instruction issued by the system, for example:
FA AF 00 05 13 61 86 07 44 03 61 60 31 70 00 01 FF FE 01 FA AF
No. Data Analysis Description
1 0005 5 From hexadecimal to decimal, Upgrade command reply ID, fixed
2 01 1 From hexadecimal to decimal, 01 to prepare for upgrade (00 is version
consistent, no need to upgrade, 02 is version incompatibility)

3, The terminal requests to download the upgrade file, for example:

FA AF 00 06 30 26 86 07 44 03 61 60 31 70 00 06 FF EB 00 00 00 13 00 01 FA AF
No. Data Analysis Description
1 00 06 6 From hexadecimal to decimal, Take the upgrade package ID, fixed
2 00 00 00 13 19 From hexadecimal to decimal, Upgrade file ID of the server
3 00 01 1 From hexadecimal to decimal, Apply to download package 1th data

4, Platform push upgrade file to terminal, for example:

FA AF 00 06 30 26 86 07 44 03 61 60 31 70 02 08 FF FE 00 00 00 13 01 39 00 01 78 DA B4
7D......C3 E3 0F 5A DC FA AF
No. Data Analysis Description
1 00 06 6 From hexadecimal to decimal, Take the upgrade package ID, fixed
2 00 00 00 13 19 From hexadecimal to decimal, Upgrade file ID of the server
3 01 39 313 From hexadecimal to decimal, Number of packets is 313

8
4 00 01 1 From hexadecimal to decimal, The current push is package 1th
5 78 DA B4 7D......E3 78 DA B4 7D......E3 0F The contents of the current packet
0F 5A DC 5A DC

5，After receiving the upgrade package, the terminal will continue to "request to download the
upgrade file" until the upgrade is completed.