Communication protocol for ThinkPower

device with server

1
Revision history

Rev Date Author Changes

1.0 2020-07-12 Yasin Initial version - Basic requirements

1.1 2021-01-11 Andrea Add Eld

1.2 2021-01-18 Andrea Add record value for Environmental records

Add record value for light records
Add configure value of device password
Change configure value of GPS report mode
Change configure value of Sensor
Change configure value of I-Button configure section
Add configure value of BLE configure section
1.3 2021-05-08 Andrea Add configure value of Device configure section

1.4 2021-08-16 Andrea Add configure value of remaining battary report function
Add record value type of remaining battary report
1.5 2021-08-17 Andrea Modification record value type of remaining battary
report
1.6 2021.-09-01 Andrea Add record value for Engine idling alarm

1.7 2021.-09-03 Jacks Modify Engine idling alarm definitions

2
Table of contents
Revision history 2

Table of contents 3

Protocol for uplink 4

Binary message format 4
Message type 4
Packet identifier 4
Payload length 4
Payload 5
CRC 5
Login request 7
Login reply 7
Heartbeat request 8
Heartbeat response 8
Record report 9
Record format 9
Value format 9
Coordinates encoding (lat / lon) 9
Valu type encoding 10
Record value types 10
Config value types 13
Record acknowledgement 17
Read request 18
Read response 18
Response value 18
Write request 19
Write response 19
Action request 20
Action types 20
Action response 20

3
Protocol for uplink
All data transfer from the device to an upstream server should use an efficient binary
protocol. This also includes commands sent from the server to the device for configuration.

Binary message format

Every message, both uplink messages from the device to the server or commands sent
back from the server to the device, contain 5 fields. The format of such a message is
depicted below:

Message Packet Payload Payload data CRC-16-CCITT

type identifier length

1 byte 1 byte 2 bytes N bytes 2 bytes

Message type
The first byte defines the message type:

Message Message
type description(directio
n)
0x01 Login request(device->platform)

0x02 Login reply(platform ->device)

0x03 Heartbeat request(device->platform)

0x04 Heartbeat response(platform ->device)

0x05 Record report(device->platform)

0x06 Record ack(platform ->device)

0x07 Read request(platform ->device)

0x08 Read response(device->platform)

0x09 Write request(platform ->device)

0x0A Write response(device->platform)

0x0B Action request(platform ->device)

0x0C Action response(device->platform)

Packet identifier
The second byte of a packet is the packet identifier. This field acts as a correlation
identifier between the requests and responses. Each reply message should contain a
packet identifier matching the unique identifier of the request message. The packet
identifier is only 1 byte so there is a wrap around after reaching 255. In normal state, we
should add 1 to the identifier each time we send a packet.

Payload length

4
This field indicates the variable length of the payload in bytes.This field contains two
bytes, so the maximum packet length supported theoretically is 65535, but the actual
length is related to CPU ram resources.

Payload
The payload depends on the packet type. Please check the documentation of each
specific packet type to get the correct encoding.

CRC
The CRC field contains an error-detecting code, used to verify the packet's validity. For
calculation we are using CRC-16/IBM. The CRC is calculated over the full packet, which
includes the following fields:
● Message type
● Packet identifier
● Payload length
● Payload data

Example code and lookup table for CRC16-CCITT can be found below:

static unsigned short crc_table [256] = {

0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5,

0x60c6, 0x70e7, 0x8108, 0x9129, 0xa14a, 0xb16b,
0xc18c, 0xd1ad, 0xe1ce, 0xf1ef, 0x1231, 0x0210,
0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6,
0x9339, 0x8318, 0xb37b, 0xa35a, 0xd3bd, 0xc39c,
0xf3ff, 0xe3de, 0x2462, 0x3443, 0x0420, 0x1401,
0x64e6, 0x74c7, 0x44a4, 0x5485, 0xa56a, 0xb54b,
0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d,
0x3653, 0x2672, 0x1611, 0x0630, 0x76d7, 0x66f6,
0x5695, 0x46b4, 0xb75b, 0xa77a, 0x9719, 0x8738,
0xf7df, 0xe7fe, 0xd79d, 0xc7bc, 0x48c4, 0x58e5,
0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823,
0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969,
0xa90a, 0xb92b, 0x5af5, 0x4ad4, 0x7ab7, 0x6a96,
0x1a71, 0x0a50, 0x3a33, 0x2a12, 0xdbfd, 0xcbdc,
0xfbbf, 0xeb9e, 0x9b79, 0x8b58, 0xbb3b, 0xab1a,
0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03,
0x0c60, 0x1c41, 0xedae, 0xfd8f, 0xcdec, 0xddcd,
0xad2a, 0xbd0b, 0x8d68, 0x9d49, 0x7e97, 0x6eb6,
0x5ed5, 0x4ef4, 0x3e13, 0x2e32, 0x1e51, 0x0e70,
0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a,

0x9f59, 0x8f78, 0x9188, 0x81a9, 0xb1ca, 0xa1eb,

0xd10c, 0xc12d, 0xf14e, 0xe16f, 0x1080, 0x00a1,
0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,
0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c,
0xe37f, 0xf35e, 0x02b1, 0x1290, 0x22f3, 0x32d2,
0x4235, 0x5214, 0x6277, 0x7256, 0xb5ea, 0xa5cb,
0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d,
0x34e2, 0x24c3, 0x14a0, 0x0481, 0x7466, 0x6447,
0x5424, 0x4405, 0xa7db, 0xb7fa, 0x8799, 0x97b8,
0xe75f, 0xf77e, 0xc71d, 0xd73c, 0x26d3, 0x36f2,
0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634,
0xd94c, 0xc96d, 0xf90e, 0xe92f, 0x99c8, 0x89e9,

5
0xb98a, 0xa9ab, 0x5844, 0x4865, 0x7806, 0x6827,
0x18c0, 0x08e1, 0x3882, 0x28a3, 0xcb7d, 0xdb5c,
0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a,
0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0,
0x2ab3, 0x3a92, 0xfd2e, 0xed0f, 0xdd6c, 0xcd4d,
0xbdaa, 0xad8b, 0x9de8, 0x8dc9, 0x7c26, 0x6c07,
0x5c64, 0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1,
0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba,
0x8fd9, 0x9ff8, 0x6e17, 0x7e36, 0x4e55, 0x5e74,
0x2e93, 0x3eb2, 0x0ed1, 0x1ef0
};

unsigned short CRCCCITT(unsigned char *data, size_t length)

{

size_t count;
unsigned int crc = 0xffff;
unsigned int temp;

for (count = 0; count < length; ++count)

{
temp = (*data++ ^ (crc >> 8)) & 0xff;
crc = crc_table[temp] ^ (crc << 8);
}

return (unsigned short) crc;

6
Login request
The packet is used for the device authorization on the server. Every TCP connection starts
with sending this packet from the device to the server. Other data should be transferred
only after the server confirms the successful authorization of the device. The login payload
looks as follows:

Field name Length Field description

Protocol major 1 byte The major protocol version, as an unsigned byte (0 - 255)
version

Protocol minor 1 byte The minor protocol version, as an unsigned byte (0 - 255)
version

IMEI length 1 byte The length of the IMEI field, in bytes as an unsigned byte (0-255)

IMEI variable IMEI, ID or serial number of the controller

Model length 1 byte The length of the next make / model field, in bytes as an
unsigned byte (0-255)

Model variable The make / model of the tracker (eg. TE304)

Firmware version 1 byte The length of the next firmware version field, in bytes as an
length unsigned byte (0-255)

Firmware version variable The firmware version of the tracker (eg. V3.12.0.18.2004171625-b0)

Password length 1 byte The length of the password field, in bytes as an unsigned byte
(0-255). Can be ‘0’ if no password is configured.

Login reply

After sending the login request, the device waits for the login reply from the server. The
login replay payload looks like this:

Field name Length Field description

login_result 1 byte The login result code:

Success = 0

Failure codes:
● 1 = Unsupported protocol
● 2 = Authentication required
● 3 = Invalid password
● 4 = Unknown device
● 5 = Server busy

7
Heartbeat request
Heartbeats are used to test GPRS connection status and maintain GPRS connectivity. If a
GPRS connection is established successfully, the terminal will send heartbeat information
to the platform when no data is received for a configurable time using the following
parameters:

● heartbeat_idle_time = minimum period of communication silence before the

tracker can send a heartbeat packet, in milliseconds, the length is 4 bytes.
● heartbeat_timeout = timeout in milliseconds before the tracker can assume that
the link is closed.the length is 4 bytes.

After receiving the heartbeat information, the platform should send a heartbeat reply. If
no heartbeat reply is received after ‘heartbeat_timeout’ milliseconds, the tracker closes
the connection and only reconnects again when data has to be sent. When the platform
closes the connection, the tracker also only reconnects when data has to be sent.

Heartbeat response
After receiving the heartbeat information, the platform should send a heartbeat reply. If
no response is sent within this period, the tracker will close the connection. As with any
other response, a heartbeat response is only valid if the packet identifier matches with the
request.

8
Record report

Field name Length Field description

Record count 1 byte The number of records in this report. The maximum number or
records in a single report is limited to 255 entries.

List of records Variable The list of appended records. A record is described in the table
size below.

Record format
Record field name Length Record field description

Record timestamp 4 bytes The exact timestamp when the data in this record was
captured, as an epoch time in seconds (UTC,from 1970
to 2099)
List of values Variable The list of appended values. A value is described in the table
size below.

Value format

Value field name Length Value field description

Value type 1byte The type id of the value (see type id’s below). Encoded as a
variable type field.

Value Variable The captured value. Size and encoding depends on the value
size type.

Coordinates encoding (lat / lon)

Longitude and latitude are 4-byte integer values built from degrees, minutes, seconds
and milliseconds by the following formula:

Where:

d – Degrees
m – Minutes
s – Seconds
ms – Milliseconds
p – Precision (10000000)

Coordinates in the western hemisphere multiply the longitude by -1, coordinates on the
southern hemisphere multiply the latitude by -1. Multiplying the coordinates by minus
one is done following the two’s complement.

Example:

A 4-byte integer latitude value of 1E 61 47 2B. First bit is ‘0’ which means a positive

9
coordinate. Converting this integer to decimal gives: 509691691. Applying the precision
again to get a decimal coordinate gives you 50.9691691° and in north hemisphere.

A 4-byte integer longitude value of E8 73 42 65. First bit is ‘1’ which means a negative
coordinate. Converting this integer to decimal gives: 1752384101. Applying the precision
again to get a decimal coordinate gives you 175.2384101° and in western hemisphere.

Value type encoding

All common value types have a value less than 256, which allows you to encode this type
as a single unsigned byte, ranging from 0-255.

Record value types

Type name Identifier Length Content

GPS record type section

GPS Location 0x01 12bytes Latitude: 4 byte

This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition
Coordinates encoding (lat / lon)

Speed: 2 byte
calculated from satellites, in 1/10th of a
km/h, encoded as a 2-byte unsigned integer.

Directon: 2 byte
Degrees from the North pole, as an angle
ranging from 0 up to 36000, in 1/100th of a
degree, as a 2 byte unsigned value.

GPS State 0x02 1 byte GPS location alarm state:

0x00 = lost location
0x01 = location success

GPS Geo-fence 0x03 3 byte

Geo-fence shape attribute: 1 byte
0x01 = circle
0x02 = rectangle
0x03 = polygon
Geo-fence ID number: 1 byte
Value from 0 - 255
Geo-fence event: 1 byte
0x01 = inside
0x02 = outside

G-sensor record type section

G-sensor X 0x06 2 bytes Accelerometer X-axis value in mG, signed

acceleration 2-byte value.

G-sensor Y 0x07 2 bytes Accelerometer Y-axis value in mG, signed

10
acceleration 2-byte value.

G-sensor Z 0x08 2 bytes Accelerometer Z-axis value in mG, signed

acceleration 2-byte value.

G-sensor Collision 0x09 1 byte Collision alarm state:

alarm 0x00 = Not active
0x01 = Active
G-sensor drop alarm 0x0A 1 byte Drop alarm state:
0x00 = Not active
0x01 = Active
G-sensor towed 0x0B 1 byte Towed away alarm state:
alarm 0x00 = Not active
0x01 = Active
SOS record type section

SOS 0x10 1 byte SOS state:

0x00 = Not active
0x01 = Active
Battery record type section

Battery voltage 0x12 2 byte Battery voltage in 1/10th V as an unsigned

2-byte value.
Battery low 0x13 1 byte Battery low battery alarm state:
voltage alarm 0x00 = Not active
0x01 = Active
Percentage of remaining battery in %
Percentage of 0x14 1 byte
remaining
battery
Environment record type section

Temperature 0x16 2 bytes Temperature in centigrade, as an signed

2-byte value.

Humidity 0x17 1 bytes Humidity in %, ranging between 0-100 as

an unsigned byte.

High 0x18 2 bytes Temperature in centigrade, as an signed 2-

temperature byte value.

High humidity 0x19 1 bytes Humidity in %, ranging between 0-100 as

an unsigned byte.

IO record type section

INP 0x1A 1 byte Digital inputs where each bit represents

a digital input
0x00 = Not active
0x01 = Active

OUP 0x1B 1 byte Digital outputs where each bit represents a

digital input
0x00 = Not active
0x01 = Active

Car general record type section

Car B+ cut alarm 0x20 1 byte Car B+ cut alarm state:

0x00 = Not active
0x01 = Active

11
Car ACC status 0x21 1 byte Ignition input state:
0x00 = Not active
0x01 = Active

Speeding 0x22 1 byte Speeding alarm state:

0x00 = Not active
0x01 = Active

Car Short drive 0x23 2 bytes Car Short mileage value in 1/10th of a km,
mileage calculated from GPS location

Car Short drive 0x24 2 bytes Short drive time value in minutes,
time calculated from car ACC status

Fuel level 0x25 1 bytes Fuel level in %, ranging between 0-100 as

an unsigned byte, get from fuel sensor.

I-button 0x26 8 byte Driver identifier

Car special record type section based CAN Bus

Car short mileage: 4 byte
Car drive 0x30 8 byte
value in 1/10th of a km, encoded as a 4-byte
mileage unsigned integer

Car total mileage: 4 byte

value in 1/10th of a km, encoded as a 4-byte
unsigned integer

Car speed: 2 byte

Car speed 0x31 5 byte
in 1/10th of a km/h, encoded as a 2-byte
unsigned integer

Engine speed: 2 byte

In prm, encoded as a 2-byte unsigned integer

Engine load: 1 byte

Engine load encoded as a 1-byte signed
integer(range from -125 to 125)

Car short oil consumption: 4 byte

Car oil 0x32 9 byte
value in L, encoded as a 4-byte unsigned
integer

Car total oil consumption: 4 byte

value in L, encoded as a 4-byte unsigned
integer

Oil level: 1 bye

value in %, ranging between 0-100 as an
unsigned byte,

Car idle work time: 4 byte

Car Engine time 0x33 8 byte
value in 1/10th of hour, encoded as a 4-byte
unsigned integer

Car total work time: 4 byte

value in 1/10th of hour, encoded as a 4-byte
unsigned integer

Car battery voltage: 2 byte

Car Device info 0x34 9 byte
value in 1/10th V, encoded as an unsigned
2-byte value.

Car air temperature: 2 byte

value in centigrade, encoded as an signed 2-

12
 byte value.

Car coolant temperature: 2 byte

value in centigrade, encoded as an signed 2-
byte value.

Car coolant level: 1 byte

value in %, ranging between 0-100 as an
unsigned byte,

Car engine oil pressure level: 2 byte

value in kpa, encoded as an unsigned 2-byte
value.

Car ACC status:1 byte

Engine idling 0x35 5 byte
0x00 = Not active
alarm
0x01 = Active

Hold time: 1 byte (minute)

Car speed: 1 byte
in 1/10th of a km/h, encoded as a 2-byte unsigned
integer

Engine speed: 2 byte

In prm, encoded as a 2-byte unsigned integer
ELD event record type section
Car short mileage: 2 byte
Change in 0x40 14 byte
value in miles, encoded as a 2-byte unsigned
Driver’s Duty integer
Status
Elapsed Engine Hours: 1 byte
value in hour, encoded as a 1-byte unsigned
integer
Latitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)

Distance Since Last Valid Coordinates:1 byte

Range 0-6, value in miles,encoded as a 1-
byte unsigned integer

Malfunction Indicator Status: 1 byte

encoded as a 1-byte Boolean
Data Diagnostic Event Indicator Status:1
byte
encoded as a 1-byte Boolean

Car short mileage: 2 byte

Event: 0x41 14 byte
value in miles, encoded as a 2-byte unsigned
Intermediate integer
Logs

13
 Elapsed Engine Hours: 1 byte
value in hour, encoded as a 1-byte unsigned
integer
Latitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)

Distance Since Last Valid Coordinates:1 byte

Range 0-6, value in miles,encoded as a 1-
byte unsigned integer

Malfunction Indicator Status: 1 byte

encoded as a 1-byte Boolean
Data Diagnostic Event Indicator Status:1
byte
encoded as a 1-byte Boolean

Event: Change in Car short mileage: 2 byte

0x42 14 byte
Driver’s Indication value in miles, encoded as a 2-byte unsigned
of Allowed integer
Conditions That
Impact Driving Elapsed Engine Hours: 1 byte
Time Recording value in hour, encoded as a 1-byte unsigned
integer
Latitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)

Distance Since Last Valid Coordinates:1 byte

Range 0-6, value in miles,encoded as a 1-
byte unsigned integer

Malfunction Indicator Status: 1 byte

encoded as a 1-byte Boolean
Data Diagnostic Event Indicator Status:1
byte
encoded as a 1-byte Boolean

Event: Driver’s
0x43 1 byte Time Zone Offset from UTC: 1 byte
Certification of Own
Records encoded as a 1-byte unsigned interger

Car total mileage: 4 byte

Event: Driver’s 0x44 8 byte
Login/Logout value in miles, encoded as a 4-byte
Activity unsigned integer

14
 Car total work time: 4 byte
value in hour, encoded as a 4-byte unsigned
integer

Event: CMV’s Engine Car total mileage: 4 byte

0x45 17 byte
Power Up and Shut
value in miles, encoded as a 4-byte
Down Activity
unsigned integer

Car total work time: 4 byte

value in hour, encoded as a 4-byte unsigned
integer
Latitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)

Distance Since Last Valid Coordinates:1 byte

Range 0-6, value in miles,encoded as a 1-
byte unsigned integer

Event: ELD
0x46 9 byte Malfunction/Diagnostic Code: 1 byte
Malfunction and
Data encoded as a 1-byte character(ASCII code)
Diagnostics
Occurrence Car total mileage: 4 byte
value in miles, encoded as a 4-byte
unsigned integer

Car total work time: 4 byte

value in hour, encoded as a 4-byte unsigned
integer

Light record type section

Theft alarm 0x50 1 byte Theft alarm state:

0x00 = Not active
0x01 = Active
Light alarm 0x51 1 byte Light alarm state:
0x00 = Not active
0x01 = Active
LBS record type section

Lbs state 0x56 1 byte LBS location state:

0x00 = lost location
0x01 = location success

15
Configure value types

Configure name Identifier Length Description

Device section

SN 0x70 Variable size Device IMEI number as a zero (0x00)

terminated string, just Read and can’t be
write
SW 0x71 Variable size Device software version as a zero (0x00)
terminated string, just Read and can’t be
write
Password 0x72 Variable size Device password as a
zero(0x00)terminated string
Server configure section

IP address 0x73 Variable size Platform IP address or host name as a zero

(0x00) terminated string

Port 0x74 2 bytes Platform port number as a 2 byte

unsigned value
The heartbeat idle time in seconds
Heartbeat_idletim 0x75 2 bytes
e , as a 2 byte unsigned value.

Response_timeout 0x76 2 bytes The response timeout in seconds, as a 2

byte unsigned value.

FTP configure section

FTP address 0x78 Variable size Firmware update ftp server IP address or
host name as a zero (0x00) terminated
string
FTP URL 0x79 Variable size Firmware update ftp server URL/ path as a
zero (0x00) terminated string

FTP user name 0x7A Variable size Firmware update ftp server username as
a zero (0x00) terminated string

FTP password 0x7B Variable size Firmware update ftp server password as
a zero (0x00) terminated string

APN configure section

APN name 0x7D Variable size The name of Mobile APN as a zero (0x00)
terminated string

APN username 0x7E Variable size The username of Mobile APN as a zero
(0x00) terminated string

APN password 0x7F Variable size The password of Mobile APN as a zero
(0x00) terminated string

SOS configure section

SOS number 1 0x80 Variable size SOS number 1 as a zero (0x00) terminated
string

SOS number 2 0x81 Variable size SOS number 2 as a zero (0x00) terminated
string

16
SOS number 3 0x82 Variable size SOS number 3 as a zero (0x00) terminated
string

SOS number 4 0x83 Variable size SOS number 4 as a zero (0x00) terminated
string

SOS Alarm 0x84 1 byte SOS alarm switch

0x00 = disabled
0x01 = enabled

Dial configure section

Dial username 0x88 Variable size Mobile username as a zero (0x00)

terminated string

Dial password 0x89 Variable size Mobile password as a zero (0x00)

terminated string

Call mode 0x8A 1 byte Call mode

0x00 = 2-way talk
0x01 = listen
Call volume 0x8B 1 byte Volume ranging from 0-100 as single
unsigned byte. Values above 100 are
clipped to 100.
Ring volume 0x8C 1 byte Volume ranging from 0-100 as single
unsigned byte. Values above 100 are
clipped to 100.
SMS switch 0x8D 1 byte SMS function switch
0x00 = disabled
0x01 = enabled
G-sensor configure section

Impact_threshold 0x90 2 bytes The impact X axis threshold in milli G, as a

_x 2 byte unsigned value.

Impact_threshold 0x91 2 bytes The impact Y axis threshold in milli G, as a

_y 2 byte unsigned value.

Impact_threshold_ 0x92 2 bytes The impact Z axis threshold in milli G, as a

z 2 byte unsigned value.

Collision sensitivity 0x93 1 byte The Sensitivity of collision, the level is

from 0 to 10(0 is most high sensitivity)

Collision Alarm 0x94 1 byte Collision alarm switch

0x00 = disabled
0x01 = enabled

GPS configure section

Offline Mode 0x98 1 byte Offline mode switch

0x00 = disabled
0x01 = enabled
GPS report mode 0x99 1 byte GPS location report rule:
Report mode where every bit indicates
whether a certain report rule is disabled

17
 (0)/enabled (1):
1st bit: reportoninterval
2nd bit: reportoffinterval
3rd bit: reportangle
4th bit: reportdistance

Report interval 0x9A 2 bytes Time interval for GPS position report while
power on ignition is on, in seconds. Encoded as a 2
byte unsigned value.

Report interval 0x9B 2 bytes Time interval for GPS position report while
power off ignition is off, in seconds. Encoded as a 2
byte unsigned value.

Report distance 0x9C 2 bytes Distance for GPS position report, in meters.
Encoded as a 2 byte unsigned value.

Speeding report 0x9D 1 byte Speeding alarm switch

0x00 = disabled
0x01 = enabled
The threshold of speeding,Encoded as a 1
Speeding 0x9E 1 byte
byte unsigned value.
threshold
Heading angle change threshold for GPS
Heading angle 0x9F 2 byte
position report, in degree(0-360). Encoded
threshold
as a 2 byte unsigned value

GPS location state 0xA0 1 byte GPS location state change report switch
report 0x00 = disabled
0x01 = enabled

Geo-fence report 0xA1 1 byte Geo-fence function switch

0x00 = disabled
0x01 = enabled

Geo-fence circle set 0xA2 11 byte Geo-fence ID number: 1 byte

Value from 0-255
Latitude Center point of circle: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude Center point of circle: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)

Radius size of circle:2 byte

value in meters

18
Geo-fence rectangle 0xA3 13 bytes Geo-fence ID number: 1 byte
set
Value from 0-255
Latitude top-left of rectangle: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude top-left of rectangle: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Latitude right-bottom of rectangle: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude right-bottom of rectangle: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)

Geo-fence polygon set 0xA4 2+(byte 2)*8 Geo-fence ID number: 1 byte

bytes
Value from 0-255
The number of polygon vertices : 1 byte
Value from 0-8
Latitude of point number 1: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)
Longitude of point number 1: 4 byte
This coordinate is encoded as a 4 byte
signed integer value.
See coordinate type definition Coordinates
encoding (lat / lon)

Device configure section

Sensor 0xA8 1 byte Sensor device type

0x00 = none
0x01 = temperature
0x02 = temperature humidity

Tailrs232 0xA9 1 byte Tailrs232 device type

0x00 = none and used as print
0x01 = BLE lock
0x02 = Capacitive fuel sensor
0x03 = Ultrasonic fuel sensor
ACC state report 0xAA 1 byte ACC state change report alarm switch
0x00 = disabled
0x01 = enabled

Low power report 0xAB 1 byte Low battery alarm switch

0x00 = disabled
0x01 = enabled

19
 Power safe mode switch
Power safe mode 0xAC 1 byte
0x00 = disabled
0x01 = enabled

Serianet mode switch

Serianet mode 0xAD 1 byte
0x00 = disabled
0x01 = enabled

High temperature alarm value

High temperature 0xAE 1 byte
Value from 0-60
value

High humidity alarm value

High humidity value 0xAF 1 byte
Value from 0-100

Percentage of remaining battary report

Percentage of 0xB0 1 byte
function switch
remaining battary
0x00 = disabled
report function
0x01 = enabled
I-Button configure section

Ibutton function swith

Ibutton function 0xC0 1 byte
0x00 = disabled
0x01 = enabled

Driver_id_valid_ti 0xC1 2 byte Specifies time in seconds to remain

me unlocked after authorized ID check, in
seconds. Value can range from 0-14400
seconds, as a 2-byte unsigned.

Driver_id_ignition 0xC2 1 byte Specifies the grace time in seconds after

_off_timeout ignition off before re-authentication is
required again. Value can range from 0-30
seconds, as a single unsigned byte.

Ibutton check authorization list switch

Driver_id_check_a 0xC3 1 byte
0x00 = disabled
uthorization_list 0x01 = enabled
Driver_id_relay_ty 0xC4 1 byte The type of relay used:
pe 0x00 = Normal closed relay
0x01 = Normal open relay

I-Button ID Set 0xC5 10 bytes I-Button ID index : 2 byte

I-Button ID index from 1-512
I-Button ID number: 8 byte
The authorized i-Button ID on position given
by first byte.Encode as a 8 byte id value
I-Button ID Delete 0xC6 2 byte I-Button ID index : 2 byte
The delete I-Button ID index, value from 1-
512
BLE configure section

BT static password as a zero (0x00)

BLE static password 0xC8 6 byte
terminated string

BT transmit power level as a 1 byte

BLE transmit power 0xC9 1 byte
unsigned value. Value can range form 0-7
level.

20
 BT scan timeout as a 1 byte unsigned
BLE scan timeout 0xCA 1 byte
value. Value can range from 5-60 seconds.

BT slave Mac as a 9 byte string value

BLE slave MAC1 0xCB 9 byte

BT slave Mac as a 9 byte string value

BLE slave MAC2 0xCC 9 byte

BT slave Mac as a 9 byte string value

BLE slave MAC3 0xCD 9 byte

BT slave Mac as a 9 byte string value

BLE slave MAC4 0xCE 9 byte

BT slave Mac as a 9 byte string value

BLE slave MAC5 0xCF 9 byte

BT slave Mac as a 9 byte string value

BLE slave MAC6 0xD0 9 byte

BT slave Mac as a 9 byte string value

BLE slave MAC7 0xD1 9 byte

BT slave Mac as a 9 byte string value

BLE slave MAC8 0xD2 9 byte

Note: for variable size configure item, the max size should not large than 50 bytes

Record acknowledgement
Every record report needs to be acknowledged to make sure that the platform has
successfully received and stored the records. The platform can confirm this by sending a
Record acknowledgement packet. A tracker can only mark records as delivered or ‘acked’
once this message is received, with the correct packet identifier.

21
Read request
A read request allows the platform to read out configuration parameters and values ad-
hoc.
Field name Length Field description

Number of 1 byte The number of requested value types, as an unsigned byte

requested value ranging from 0-255
types

List of requested Variable A list of requested type ids where each type id is encoded as a
value type size variable type id. These types can both be record value types as
config value types

Read response
After a read request, the tracker responds with a read response containing the values.

Field name Length Field description

Number of 1 byte The number of response value types, which should match with
response value the number of requested value types
types

List of response Variable A list of response values, which contain the value type id, result
values size code and value (see below)

Response value
A response value contains a readout result for a single value. It can indicate a success
(with data) or a failure.

Response value Length Response value field description

field name

Value type id 1 byte The type id, encoded as a variable type id in 1 byte.

Result code 1 byte A value of ‘0’ means success, any other value is an error code.

Value Variable This field is available in case of a success result code and is
size encoded according to the value type.

22
Write request
A read request allows the platform to write configuration parameters.

Field name Length Field description

Number of 1 byte The number of parameters written in this request

parameters in
request

List of new write Variable A list of new parameter values to write. Each item to write is
parameter values size encoded as defined in the table below

Write parameter Length Write parameter field description

field name

Write parameter id 1 byte The type id, encoded as a variable type id in 1 byte.

Write parameter Variable The new parameter value, encoded according to the value type.
value size

Write response
The device reports the results of a write request back to the platform using a write
response.

Field name Length Field description

Number of 1 byte The number of write results in the response

parameters in
response

List of write results Variable A list of write results, containing the written parameter id and a
size result code (success / error). See below

Write result field Length Write result field description

name

Value type id 1 byte The type id, encoded as a variable type id in 1 byte.

Result code 1 byte A value of ‘0’ means success, any other value is an error code.

23
Action request
An action request is used to execute a certain procedure on the device.

Field name Length Field description

Action type 1 byte The action that should be executed on the device. A list of
different action types can be found below.

Action payload Variable The optional payload or parameters required for the given
length command. This value depends on the action type

Action types

Action name Identifier Length Description

Reset 1 0 bytes Resets the unit (reboot). This action has no payload.

Factory 2 0 bytes Reverts the units settings back to factory defaults and
does a reboot. This action has no payload.

Update 3 Variable Requests the unit to initiate a firmware update. The

firmware length payload is a 0x00 terminated string, containing the
download url. Or just 0x00 to use the default location.

Output control 4 2 bytes First byte contains the output:

0x01 = Digital output 1
0x02 = Digital output 2

Second byte contains the new state:

0x00 = off
0x01 = on

Action response
Each action has a result, which is reported from the device back to the platform using an
action response.

Field name Length Field description

Action type 1 byte The action type that was triggered on the device.

Result code 1 byte The result of the action, where ‘0’ means success and any other
value is an error code.

Action response Variable The optional response of the action, depending on the action
size type.

24