1.

OVERVIEW

This document is to explain how the device communicates with the server. And in which
format they communicate. The Command List shows which messages (commands) sent from
the server to the device to request data/information from the device.

Note:
The device uses Epoch & Unix Timestamp. The Unix epoch (or Unix time or POSIX time or
Unix timestamp) is the number of seconds that have elapsed since January 1, 1970 (midnight
UTC/GMT), not counting leap seconds (in ISO 8601: 1970-01-01T00:00:00Z).

The Byte order is related to little-endian in this document. Such as one Uint32_t a =
0x12345678, then the transmission time in accordance with the byte from low to high order
0x78, 0x56, 0x34, 0x12.

All characters should be recognized as 16-bit HEX as default in this document. The special
cases will be stated if other formats used in this document.

In some Bytes Table there are values in the specific byte which contains a Value Table with
Bit format. They should be converted to Decimal system to give the value. We will point out
all of these in the next version of instruction.
For example: Flag Table for Call Records 3.1.12 Call Records (0x25) – Bit 4-7

All the Bit should be converted from HEX to BIN and compare with its own Bit Table.

The digits (phone number digits) should be converted from HEX to Decimal system one by
one. Then checked by the ASCII char table.

In order to ensure the liability of data transmission, the Server must give response if the ACK
Flag bit marked as “1” after receiving the data. Please check the <The ACK Instruction V1> to
have the detailed information related to ACK.

A Sequence ID is requested, and it should be the same ID If the ACK is requested.

Both device and server will communicate by raw String. This means a readable text code
should be converted from raw String to HEX or in other formats.
2. STRUCTURE OF MESSAGE

Each message include header, properties length, sequence id, check sum and
Message body, as shown below:
Header (0xAB) 1 Byte
Properties 1 Byte
Length 2 Bytes
Checksum 2 Bytes
Sequence ID 2 Bytes
Message Body N Bytes

2.1 MESSAGE HEADER

It takes 1 byte. The initial part of the message should be 0xAB

2.2 MESSAGE PROPERTIES

It takes 1 byte. The properties included:
Encryption Bit 7 00: Not encrypted
Bit 6 01: Encrypted by RSA
Error Flag Bit 5 0: Not Applied
1: Not Applied
ACK Flag Bit 4 0: ACK not requested
1: ACK requested
Version Bit 3 Default: 0
Bit 2 Not Applied.
Bit 1
Bit 0
Note：
Bit 6-Bit 7: The encryption will be only for the Message Body.
Bit 5: Error flag. It’s not used yet.
Bit 0-Bit 3: Protocol version number. Default 0. Not used yet.
2.3 MESSAGE LENGTH
Message length is the length of the entire Message Body. It takes 2 bytes.
Maximum 1024 bytes.

2.4 CHECKSUM
Message checksum CRC16 for all bytes of the message body. It takes 2 bytes.

2.5 SEQUENCE ID
Message sequence ID takes 2 bytes. Starting from 0x0100 after device restarted.

2.6 MESSAGE BODY

Command 1 Byte
Key Length 1 Byte
Key 1 Byte
Key Value N Byte(s)
Key Length 1 Byte
Key 1 Byte
Key Value N Byte(s)
…… ……
Note:
Message Body consists of at least and only one Command and one or more Key
Body. Each Key Body consists of Key Length、 Key and Key Value.
Key Value should be NULL if Key Length is 1.
An example:
“AB 10 0F 00 EB 7E 01 01 02 0D 30 E0 31 37 35 31 32 30 39 31 32 38 39”

AB -->Header
10 -->Properties
0F 00 -->Length
EB 7E -->Checksum
01 01 -->Sequence ID
Message Body
02 -->Command
0D -->Key Length
30 -->Key
E0 -->Function Flag (Set up Authorized Number)

31 37 35 31 32 30 39 31 32 38 39 --> Authorized number: 17512091289

To get the Phone number digits

Convert 31 from HEX to Decimal System and we will have 49. Then check the 49th in the ASCII
Char list which is ‘1’.

Convert 37 from HEX to Decimal System and we will have 55. Then check the 55th in the ASCII
Char list which is ‘7’.

And so on. Then we will have the number ‘17512091289’

ASC II Table:
http://www.asciitable.com/

An example for ACK (check ack instruction to get more details):

The structure of ACK should be a complete message
“AB 10 0F 00 EB 7E 01 01 02 0D 30 E0 31 37 35 31 32 30 39 31 32 38 39”

AB -->Header
10 -->Properties
0F 00 -->Length
EB 7E -->Checksum
01 01 -->Sequence ID
Message Body
02 -->Command
0D -->Key Length
30 -->Key
E0 -->Function Flag (Set up Authorized Number)
31 37 35 31 32 30 39 31 32 38 39 --> Authorized number: 17512091289
 To reply the ACK from the server
AB 00 03 00 08 C7 01 01 7F 01 00
Head: AB
properties: 00
Encryption: 00
ERR: N/A
ACK: 00
Version: 00
Length: 00 03
CRC: C7 08
Sequence ID: 01 01 (Corresponding Sequence ID)
Command: 7F (Corresponding command)
Key Length: 01
Key: 00 (Refer to Negative Response List)

3. COMMAND TABLE LIST

Hex Description Remark

01 Data Command 3.1 Data Command (0x01) Key List

3.2 Configuration Command (0x02)

02 Configuration
Key List

03 Services 3.3 Services Command(0x03) Key List

3.4 System Control Command(0x04)

04 System Control
Key List

7E Firmware Update Optional Unfinished

7F Negative Response

FE Factory Test Optional Unfinished

3.1 DATA COMMAND (0X01) KEY LIST

Hex Description Remark

This key should be contained in each data

01 Device ID
command

02 Alarm Code Send this key if there is an alarm

A device ID defined by User rather

03 Custom ID
than IMEI Optional

10 Historical data completed From device to server

 11 Historical data switch N/A

12 Single locating From server to device

13 Continue locating From server to device

20 GPS location

21 Cell Towers

22 WI-FI towers

23 BLE

It contains timestamp, and each

uploaded data and each locally saved
24 General data
record must contain this key. （ only
for locating）

25 Call Records EV09 Only

30 G-sensor data

31 Activity degree

40 Heart Rate data Reserved

Remarks:
1. Multiple data with one Command to be sent at once to the server is allowed. Maximum size
of one message is 1KB.
2. The ACK requested data which has returned ACK will be deleted from the device storage.
The ACK requested data which has NO returned ACK will be stored to the device storage. And
will be proceeded together with new updated data in the next time.

3.1.1 Device ID (0x01)

Byte No. Parameter Description
1 Length 0x10
2 Key 0x01
3-17 Device ID It is IMEI, 15 bytes
Note: Each data frame must contain a Device ID. And fixed at the first KEY.

3.1.2 Alarm Code (0x02)

Byte No. Parameter Description
1 Length 0x09
2 Key 0x02
3-6 Alarm Code Defined by the Alarm Code table below
 7-10 UTC
Alarm Code Table
Bit No. Description Bit No. Description
0 Battery-Low Alert 9 Power ON Alert
1 Over Speed Alert 10 Motion Alert
2 Fall-Down Alert 11 No-Motion Alert
3 Tilt Alert 12 SOS Alert
4 GEO-1 Alert 13 Side Call Button 1
5 GEO-2 Alert 14 Side Call Button 2
6 GEO-3 Alert 15 Reserved
7 GEO-4 Alert 16 Reserved
8 Power OFF Alert 17 Reserved

3.1.3 Custom ID (0x03) Optional

Byte No. Parameter Description
1 Length N
2 Key 0x03
3-N Customized ID An ID to identify the device besides the IMEI

3.1.4 Historical Data completed (0x10)

Byte No. Parameter Description
1 Length 0x01
2 Key 0x10
This command is to confirm the Historical data has completely sent from the device to
the server.

3.1.5 Single Locating (0x12)

Byte No. Parameter Description
1 Length 0x01
2 Key 0x12
This command is sent from server to the device to request the device to update the
latest location data.

3.1.6 Continue Locating (0x13)

Byte No. Parameter Description
1 Length 0x01
 2 Key 0x13
This command is sent from server to the device for keep updating the location data
with a preset duration.

3.1.7 GPS Location (0x20)

Byte No. Parameter Description
1 Length 0x16
2 Key 0x20
Decimal Degrees. Signed number.
3-6 Latitude
4 bytes
Decimal Degrees. Signed number.
7-10 Longitude
4 bytes

11-12 Speed Unit: KM/H. 2 bytes

Indicates the heading direction.

13-14 Direction Unit: Degree. “0” means the North. Range: 0 - 359.
2 bytes

15-16 Altitude Unit: meter. 2 bytes

The smaller value indicates more accurate positioning.

Horizontal
Range: 0.5 to 99.9
17-18 positioning
When the accuracy value is 0, the signal is invalid.
accuracy
2 bytes
Unit: meter
Available if using GPS data to calculate. This value is
19-22 Mileage
editable.
4 bytes

Number of Indicates the number of fixed GPS satellites.

23
Satellites 1 byte

3.1.8 Cell Towers (0x21)

Byte No. Parameter Description
1 Length 1+3+5*n, n is the number of the covered Cell
Towers, and the range is from 1 to 6.
2 Key 0x21
3-4 MCC
5 MNC
 6 RXL
7-8 LAC
9-10 CELLID
Byte 6 to Byte10 will be repeatedly displaying the Cell Tower information if more Cell
Towers detected.

3.1.9 Wi-Fi Towers (0x22)

Byte No. Parameter Description
1 Length 1+7*n, n is the number of Wi-Fi sources (MAC
Addresses).
2 Key 0x22
3 RSSI The measured current signal strength in dBm. Signed
number
4-9 MAC The MAC address of the Wi-Fi source.
Byte 3 to Byte10 will be repeatedly displaying the Wi-Fi information if more Wi-Fi
MACs detected.

3.1.10 BLE Location (0x23)

Byte No. Parameter Description
1 Length 0x01 or 0x07 or 0x0f or more
2 Key 0x23
3-8 MAC MAC address of the device connects to the base.
9-12 Latitude Decimal Degrees. Signed number
13-16 Longitude Decimal Degrees. Signed number
Address
17-N Describe the location in English. Maximum 32 Bytes
description
The device sends a request to read the BLE location from the connected docking or
from connected mobile APP, 0x01+0x23;
If the device has read the preset GPS coordinates from the connected docking or
from the connected mobile APP successfully, it returns: 0x0f+0x23+mac+lat+lot;
Otherwise return: 0x7+0x23+mac.

3.1.11 General Data(0x24)

Byte No. Parameter Description
1 Length 0x09
2 Key 0x24
 3-6 Timestamp Epoch & Unix Timestamp. 4 bytes

7-10 Status Status of device. 4 bytes

Defined by the Status Table below
Timestamp Calibration Cell network (supported by Cell network)
Methods GPS (must be calibrated once GPS positioning fixed)
GPRS (supported by the server)
BLE (supported by the mobile APP)
This key must be included in each stored data and each uploaded data. Timestamp
must be calibrated as described above.
Status Table (4 Bytes)
Bit No. Description Bit No. Description
0 GPS 8 AGPS Data Valid
1 Wi-Fi Source 9 Motion
2 Cell Tower 10 Smart Locating
3 BLE Connected 11-15 Reserved
4 In-Charging 16-18 Work Mode
5 Fully Charged 19-23 Cell Network Signal Strength
6 Reboot 24-31 Battery Level
7 Historical Data

3.1.12 Call Records (0x25) EV09 Only

Byte No. Description Remark
1 Length 10+n
2 Key 0x25

3-6 Timestamp Epoch & Unix Timestamp. 4 bytes

7 Flag Defined by Flag Table below

8-9 Time
10 Return code
11-n Number Phone number, n byte
Flag Table for Call Records
Bit 0 Call Status 1 0: Dialing out / 1: Incoming call
Bit 1 Call Status 2 0: Answered / 1: Missed
Bit 2-3 Reserved
Bit 4-7 Type 0x00 - Normal Dialing /0000
 0x01 - SOS Button Dialing /0001
0x02 - Side Button Dialing /0010
0x03 – Dialing for Alert /0011
0x04 - Call Back /0100
0x05 – Listen-in /0101
0x06 – Auto Answer /0110

3.1.13 BLE Location 2 (0x26) EV04 only

Byte No. Parameter Description
1 Length 0x11
2 Key 0x26
3-8 MAC MAC address of the device scan find nearest.
9-12 Latitude Decimal Degrees. Signed number.
13-16 Longitude Decimal Degrees. Signed number.

Horizontal Unit: 1/10 meter. The smaller the value indicates

17-18 positioning more accurate positioning.
accuracy Range: >= 0.

19-20 Altitude Unit: meter. Signed number. 2 bytes

3.1.14 Smart Location (0x27) EV04 only

Byte No. Parameter Description

1 Length 0xD

2 Key 0x27

3-6 Latitude Decimal Degrees. Signed number.

7-10 Longitude Decimal Degrees. Signed number.

Horizontal Unit: meter. The smaller the value indicates more

11-12 positioning accurate positioning.
accuracy Range: >=0

13-14 Altitude Unit: meter, Signed number. 2 bytes

3.1.15 G-sensor Data (0x30)

Byte No. Parameter Description
1 Length 0x09
2 Key 0x30
 Epoch & Unix Timestamp.
3-6 Timestamp
4 bytes
7-10 Pedometer Step counting. 4 bytes.
This will be recorded and analyzed in every hour

3.1.16 Activity (0x31)

Byte No. Parameter Description
1 Length 0x09

2 Key 0x31

3-6 Timestamp Epoch & Unix Timestamp. 4 bytes

7-10 Activity Activity analyzing. 4 bytes

This will be recorded and analyzed in every 5 minutes

Timestamp Epoch & Unix Timestamp. 4 bytes

Activity Activity analyzing. 4 bytes

This will be recorded and analyzed in every 5 minutes

3.1.17 BLE MAC list (0x32)

Byte No. Parameter Description
1 Length n
2 Key 0x32
Epoch & Unix Timestamp.
3-6 Timestamp
4 bytes
7-12 MAC MAC address of the connected docking.
13 RSSI
MAC MAC address of the connected docking.
RSSI

3.1.18 Beacon List (0x33)

Byte No. Parameter Description
1 Length n
2 Key 0x33
Epoch & Unix Timestamp.
3-6 Timestamp
4 bytes
7-8 Company ID Apple 0x004c
9-24 iBeacon UUID MAC address of the connected Beacon.
 25-26 Major
27-28 Minor
29 Measured RSSI Measured RSSI
30 RSSI Read RSSI
Major
Minor
Measured RSSI Measured RSSI

RSSI Read RSSI

3.1.19 Heart Rate Data (0x40)

Byte No. Parameter Description
1 Length 1+n*6
2 Key 0x40

3-6 Timestamp Epoch & Unix Timestamp. 4 bytes

7 Heart Rate Heart Rate Value:

EC02 Only 0: Not Worn
1: Not Detected
Others are the heart rate value
8 Trust level Percentage, from 0 to 100
9-12 Timestamp
13 Heart rate
14 Trust level Percentage, from 0 to 100

3.2 CONFIGURATION COMMAND(0X02) KEY LIST

Hex Parameter Remark

Systems
01 Module Number
02 Firmware Version
03 IMEI
04 ICCID
05 MAC
06 Setting Time
07 Run Times
08 Firmware Information
09 Initialize Mileage
0A Working Mode
0B Alarm Clock
0C No Disturb
0D Password Protect
0E Time Zone
0F Enable Control
10 Ring-Tone Volume
11 Mic Volume
12 Speaker Volume
13 Device name For BLE connection only
14 Battery
15 BLE locating
16 Set whitelist device
17 SMS GPS URL
18 SMS WI-FI/LBS URL
19 Voice Prompt ON/OFF
1A FW
1B GSM Module
Button Setting
20 SOS button Setting
21 Call 1 button Setting
22 Call 2 button Setting
Phone Setting
30 Set Authorized Number
31 SMS Reply Prefix Text
32 SOS Option
33 Phone Switches
GPRS Setting
40 APN
41 APN User Name
42 APN Password
43 Sever IP &Port
 44 Time Interval
45 Continue Locating Time Interval
46 Heart Rate Interval EC02 only Heart Rate update interval
Alert Setting
50 Power Alert
51 GEO Alert
52 Motion Alert
53 No-motion Alert
54 Over speed Alert
55 Tilt Alert
56 Fall Down Alert
60 Device Power Information
61 SIM MSISDN
LED Settings
E0 LED default state EV202 Only
Operation
0xF0 Read Append keys to Read Only.
Don’t add this key after writing
Configuration file.

3.2.01 Module Number (0x01) Read Only

Byte No. Parameter Description
1 Length 0x05
2 Key 0x01
3-6 Module Number (20 01 18 20,2018-01-20)

3.2.02 Firmware Version (0x02) Read Only

Byte No. Parameter Description
1 Length 0x05
2 Key 0x02
3-6 Firmware Version

3.2.03 IMEI (0x03) Read Only

Byte No. Parameter Description
1 Length 0x10
 2 Key 0x03
3-17 IMEI

3.2.04 ICCID (0x04) Read Only

Byte No. Parameter Description
1 Length 0x15
2 Key 0x04
3-22 ICCID

3.2.05 BLE-MAC (0x05) Read Only

Byte No. Parameter Description
1 Length 0x07
2 Key 0x05
3-8 BLE-MAC

3.2.06 Setting Time (0x06)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x06
3-6 Timestamp Send Time parameter to the device to sync

3.2.07 Run Times (0x07) Read Only

Byte No. Parameter Description
1 Length 0x05
2 Key 0x07
3-6 Runtime Unit: second. Read only
It starts from 0 every time while the device is powered ON.

3.2.08 Firmware Information (0x08) Internal Use Only

Byte No. Parameter Description
1 Length
2 Key 0x08
3-6 Firm Version
7-10 Firmware Size
11-14 Hardware version
15-18 Soft-device version
 19-22 Soft-device FWID
23-34 Firmware complier Date ASCII String
35-42 Firmware complier Time ASCII String
Firmware information is used for debug purpose only.
Firmware Version: ((VER_H<<24)|(VER_M<<16)|(VER_L<<8)|(VER_ML))
Firmware Size: uint32_t
Hardware version: HEX;
Soft-device version: SD_VERSION (SD_MAJOR_VERSION * 1000000 +
SD_MINOR_VERSION * 1000 + SD_BUGFIX_VERSION)
Soft-device FWID: HEX
Firmware complier Date: ASCII String
Firmware complier Time: ASCII String

3.2.09 Initialize Mileage (0x09)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x09
3-6 Mileage Unit: Meter. Default 0.

3.2.10 Working Mode (0x0A)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x0A
Not Applied if Mode = 1/2/3

Time/Interval (For If Mode=4, value range is

3-5 Locating and for data 10*60-60*60*24*7. Default: 60*60
uploading)
If Mode=5, value range is 10*60-
60*60*24*7, Default: 1*60*60
6 Mode Value range: 1 to 5. Default: 1.

3.2.11 Alarm Clock (0x0B)

Byte No. Parameter Description
1 Length 0x07
2 Key 0x0B
3 Index Bit7: Default 1, Enable. Range: 0-3
4 hour Range: 0 to 23 Default: 0
 5 min Range: 0 to 59 Default: 0
6 Workday Workday. Default 0
Alarm clock reminder duration.
7 Time Default: 30. Range: 1-120. Unit: Second
Press SOS button to cancel
8 Ring Ringtone selection 1 to 10. Default: 1
WORKDAY (1 Byte)
Bit 7 6 5 4 3 2 1 0
Reserved SUN SAT FRI THU WED TUS MON

3.2.12 No Disturb (0x0C)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x0C
3 Flag Bit7: 1, Enable. Default: 0
4 Start hour 0-23 Default: 0
5 Start minute 0-59 Default: 0
6 End hour 0-23 Default: 0
7 End minute 0-59 Default: 0

3.2.13 Password Protect(0x0D)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x0D
4 bytes
Bit31: 1, Enable. Default: 0
3-6 Password
Bit 30 to Bit 0: 000000-999999.
Default: 123456

3.2.14 Time Zone (0x0E)

Byte No. Parameter Description
1 Length 0x02
2 Key 0x0E
1 Byte. Signed char. Unit: 15minutes.
3 Time zone
Range: -48 to +56 Default: 0
3.2.15 Enable Control (0x0F)
Byte No. Parameter Description
1 Length 0x05
2 Key 0x0F
Default: 7F
3-6 Enable control
Defined by the Table below
Table for Enable Control
Bit No. Description Bit No. Description
0 LED 7 BLE Stay Connected
1 Beep 8 BLE Locating
2 Vibration 9 SOS Call Voice
3 Cell Tower Locating 10 BLE Always ON
4 Wi-Fi 30 Auto Update
5 SOS Call Speaker ON/OFF 31 AGPS
6 Side Call Speaker ON/OFF

3.2.16 Ring-Tone Volume (0x10)

Byte No. Parameter Description
1 Length 0x02
2 Key 0x10
3 Ring-Tone Volume 0 to 100. Default: 100

3.2.17 Mic Volume (0x11)

Byte No. Parameter Description
1 Length 0x02
2 Key 0x11
3 Mic Volume 0-15. Default: 10

3.2.18 Speaker Volume (0x12)

Byte No. Parameter Description
1 Length 0x02
2 Key 0x12
3 Speaker Volume 0-100, 0 means mute. Default: 100

3.2.19 Device name (0x13)

Byte No. Parameter Description
 1 Length 1+N N maximum 20
2 Key 0x13
Example: “EV201”. For BLE connection
3-N Device name
only

3.2.20 Battery (0x14)

Byte No. Parameter Description
1 Length 1+3
2 Key 0x13
4 Battery level 0-100%
5-6 Voltage mV

3.2.21 Set BLE Location(0x15) for dock. (This is not for the device to store)
Byte No. Parameter Description
1 Length 1 or 8+N
2 Key 0x15
3-6 Latitude
7-10 Longitude
11-N string Describe in English. Maximum 32Bytes

3.2.22 Set whitelist device for docking station (0x16)

Byte No. Parameter Description
1 Length 2 or 8+15*N
2 Key 0x16
3 Flag Bit7: Enable. Bit [0-6]: index
4-9 BLE MAC

3.2.23 Set SMS GPS URL(0x17)

Byte No. Parameter Description
1 Length N
2 Key 0x17
3-N GPS URL Describe in English. Maximum 40Bytes
For example: www.google.com/maps?q=%f,%f

3.2.24 Set SMS WI-FI/LBS URL(0x18)

Byte No. Parameter Description
 1 Length N
2 Key 0x18
3-N URL Describe in English. Maximum 40Bytes
For example: smart-locator.com/web/geolocation/%s/%s

3.2.25 Voice Prompt ON/OFF(0x19)

Byte No. Parameter Description
1 Length 5
2 Key 0x19
3-6 0xFFFFFFFF

3.2.26 Firmware (0x1a)

Byte No. Parameter Description
1 Length
2 Key 0x1a
3-n Internal Version ascii

3.2.27 GSM Module (0x1B) Read Only

Byte No. Parameter Description
1 Length n
2 Key 0x1B
3-n GSM Module

3.2.28 Voice Prompt Volume (0x1c)

Byte No. Parameter Description
1 Length 0x02
2 Key 0x1c
3 Voice Prompt Volume Range: 0-100. Default: 100

3.2.29 SOS button Setting (0x20)

Byte No. Parameter Description
1 Length 0x03
2 Key 0x20
3-4 Value Defined by the Value Table below
Value Table for SOS Button (2 bytes)
Bit No. Parameter Description
 15 Enable 1: enable button
14 Reserve
0: long press (Default)
13 Trigger mode
1: double press
0000: no task
0001-1010: Dial 1st -10th Authorized
12-9 Task
Number
1111: SOS task (Default)
8-2 Time Range: 10-100. Default: 20. Unit: 0.1S
00: no feedback
01: vibrate
1-0 Feedback
10: voice prompt
11: vibrate and voice prompt (Default)

3.2.30 Call 1 Button Setting (0x21)

Byte No. Parameter Description
1 Length 0x03
2 Key 0x21
3-4 Value Defined by the Value Table below
Value Table for Call 1 Button (2 bytes)
Bit No. Parameter Description
15 Enable 1: enable button
14 Reserve
0: long press
13 Trigger mode
1: double press
0000: no task
0001-1010: Dial 1st -10th Authorized
12-9 task
Number
0001: Dial 1st number (Default)
8-2 time Range: 10-100. Default: 20. Unit: 0.1S
00: no feedback
01: vibrate
1-0 feedback
10: voice prompt
11: vibrate and voice prompt (Default)

3.2.31 Call 2 Button Setting (0x22)

 Byte No. Parameter Description
1 Length 0x03
2 Key 0x22
3-4 value Defined by the Value Table below
Value Table for Call 2 Button (2 bytes)
Bit No. Parameter Description
15 Enable 1: enable button
14 Reserve
0: long press
13 Trigger mode
1: double press
0000: no task
0001-1010: Dial 1st -10th Authorized
12-9 task
Number
0001: Dial 1st number (Default)
8-2 time Range: 10-100. Default: 20. Unit: 0.1S
00: no feedback
01: vibrate
1-0 feedback
10: voice prompt
11: vibrate and voice prompt (Default)

3.2.30 Set Authorized Numbers (0x30)

Byte No. Parameter Description
1 Length n+2
2 Key 0x30
3 flag Defined by Flag table below. Default: 0
4-n Number The phone number is less than 20 bytes.
Flag Table for Authorized Numbers
Bit 7 Enable Bit 4 No SIM Dialing
Bit 6 Accept SMS Bit 3-0 Value Range: 0-9.
The serial number of the contacts.
Bit 5 Accept Phone Call 0000/0001/0010/0011/0100/0101
/0111/1000/1001

3.2.31 SMS Reply Prefix Text (0x31)

Byte No. Parameter Description
 1 Length n+1
2 Key 0x31
3 Flag Bit7: enable
4-n Text n byte, n<20. Default: null

3.2.32 SOS Option (0x32)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x32
3-4 Hold-Time Unit: second. Allowed talk time 0-65535s. Default: 600
5 Rings time Unit: second. Allowed ring time,1-60s. Default: 20
6 Cycle Unit: Times. Cycling times, 0-10. 0 means infinite loop
until connected. Default: 1

3.2.33 Phone Switches (0x33)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x33
3-6 Flag Defined by Flag table below
Flag Table for Phone Switches
Byte No. Parameter Description
31-12 reserve 0x05
Enable SMS White List (Only accept SMS Default: 0
11
from Authorized number)
10 Reserved Default: 0
9 Enable Button hang-up Default: 1
Enable Call In White List (Only authorized Default: 0
8
number call in)
7 Auto answer enable Default: 1
6-0 Auto answer after rings 0-10. Default: 3

3.2.34 APN (0x40)

Byte No. Parameter Description
1 Length n+1
2 Key 0x40
3-n APN n byte, n<32. Default: null
3.2.35 APN Username (0x41)
Byte No. Parameter Description
1 Length n+1
2 Key 0x41
3-n APN Username n byte, n<16. Default: null

3.2.36 APN Password (0x42)

Byte No. Parameter Description
1 Length n+1
2 Key 0x42
3-n APN Password n byte, n<16. Default: null

3.2.37 Sever IP &Port (0x43)

Byte No. Parameter Description
1 Length n+5
2 Key 0x43
3 Flag Bit7
1: GPRS enable
Bit0
0: TCP (Default)
1: UDP
4-5 Port 0-65535. Default: 5050
6-n IP Address or Domain Name N byte, n<50.
Default: www.smart-locator.com

3.2.38 Time Interval (0x44)

Byte No. Parameter Description
1 Length 0x0d
2 Key 0x44
3-6 Heartbeat Interval Bit31
1 enable (Default)
Unit: second, Default: 200.
Range: 60s to 86400s.
7-10 Auto Upload Interval Unit: second. Default: 180, >10s
11-14 Auto Upload Lazy Interval Unit: second. Default:600, >300s
3.2.39 Continue Locate Time Parameter (0x45)
Byte No. Parameter Description
1 Length 0x05
2 Key 0x45
3-4 Interval Default: 10s. Range: 10-600
5-6 Time Unit: second. Default: 600. Range: 60-1800s

3.2.40 Heart Rate Interval(0X46) EC02 Only

Byte No. Parameter Description
1 Length 0x05
2 Key 0x46
3-6 Heart Rate Detecting Bit31
Interval 1: Enable (Default); 0: Disable
Unit: second. Default: 600. Range: 60-86400

3.2.41 Device ID (0X47) Optional

Byte No. Parameter Description
1 Length n
2 Key 0x47
3-n Device ID Customized Device ID follows the IMEI in every
message. Default: null

3.2.42 Static AES128 Set (0X48) Write only

Byte No. Parameter Description
1 Length 39
2 Key 0x48
3-6 KEY_ID Please refer to the 4.2 Encryption
7-22 AES Key
23-38 AES IV

3.2.43 Read Static AES128 CRC (0X49) Read Only

Byte No. Parameter Description
1 Length 11
2 Key 0x49
3-6 KEY_ID
7-10 CRC This will be 0 (Default) if Static AES disabled.
 Or should be the value of CRC32 Algorithm from
AES Key & AES IV

3.2.44 Power Alert (0x50)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x50
3-6 Flag Defined by Flag table below
Flag Table For Power Alert
Bit 31 Alert Disabled Bit 27-16 Reserved
Bit 30 Alert Enabled Bit 15-8 Low Power Voice
Prompt Threshold.
Default: 20
Range: 10-50
Bit 29 Low Power Alert Bit 7-0 Low Power Alert
Bit 28 Low Power Voice Prompt Threshold. Default: 15
Range: 10-50

3.2.45 GEO Alert (0x51)

Byte No. Parameter Description
1 Length
2 Key 0x51
3-6 Flag Defined by Flag table below
7-10 Latitude 1
11-14 Longitude 1
Flag for GEO Alert (32 bits)
Bit 31-16 Radius Bit 8 Enable. Default: 0
Bit 15-11 Reserved Bit 7-4 Points
Bit 10 Type Bit 3-0 Index
0: Circle (Default)
1: Polygon
Bit 9 Direction
0: Out (Default)
1: In

3.2.52 Motion Alert (0x52)

 Byte No. Parameter Description
1 Length 0x05
2 Key 0x52
3-6 Value Defined by the below Value table
Value Table (32bits)
Bit 31 Enable 0 (Default)
Bit 30 Dial 0 (Default)
Bit 29-16 Continued moving period to activate the alert. 3 (Default)
Unit: Second
Range: 1-60
Bit 15-0 Cooldown Period 120 (Default)
Unit: Second
Range: 1-60

3.2.53 No-Motion Alert (0x53)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x53
3-6 Value Defined by the below Value table
Value Table (32bits)
Bit 31 1: Enable; 0: Disable 0 (Default)
Bit 30 1: Dial; 0: No action 0 (Default)
Bit 29-0 Continued static period to activate the alert. 300 (Default)
Unit: Second
Range: 60-3600

3.2.54 Over speed Alert (0x54)

Byte No. Parameter Description
1 Length 0x03
2 Key 0x54
3-4 Over speed Threshold Bit 15:
1 Enable. Default: 0.
Bit 14-0:
Range: 20-400. Default: 80
Unit: KM/H
3.2.55 Tilt Alert (0x55)
Byte No. Parameter Description
1 Length 0x05
2 Key 0x55
3-6 Value Default: 0. Defined by the Value Table
below
Value Table (32 bits)
Bit 31 1: Enable; 0: Disable 0 (Default)
Bit 30 1: Dial; 0: No action 0 (Default)
Bit 29-24 Reserved
Bit 23-16 Angle Threshold Unit: Degree
Default: 45
Range: 30-90
Bit 15-0 Time Threshold Unit: Second
Default: 30
Range: 10-3600
Note: Both Angle and Time to be exceeded to activate an alert.

3.2.56 Fall down Alert (0x56)

Byte No. Parameter Description
1 Length 0x02
2 Key 0x56
3 Flag 1 Byte. Defined by the Flag Table
below
Value Table (8bits)
Bit 7 1: Enable; 0: Disable 0 (Default)
Bit 6 1: Dial; 0: No Dial 0 (Default)
Bit 5-4 Reserved
Bit 3-0 Sensitive Level Default: 5. Range: 1-9

3.2.57 Device Power Information (0x60)

Byte No. Parameter Description
1 Length 0x02
2 Key 0x60
3 Calibration Flag BT - 0x01
 FT - 0x10
4 Charging Status 0x00 - Not Charging
0x01 - Fully Charged
0x02 - Charging
5 Battery Level Percentage. Range: 0-100
6-7 Battery Voltage Unit: mV
8-9 Charge Current Unit: mA
10-11 Charge Voltage Unit: mV

3.2.58 SIM card MSISDN (0x61) Read Only

Byte No. Parameter Description
1 Length n+1
2 Key 0x61
The phone number should be less than 20
3-n Number
bytes.
This is the phone number that includes a country code and a National Destination Code
which identifies the subscriber's operator.

3.2.59 BLE Scan beacon (0x70)

Byte No. Parameter Description
1 Length 0x03
2 Key 0x70
3-4 Scan Mode Time Default: 5. Unit: Second

3.2.60 BLE Scan time(0x71)

Byte No. Parameter Description
1 Length 0x05
2 Key 0x71
3-4 Scan Time Default: 5. Unit: Second
5-6 Sleep Time Default: 55. Unit: Second

3.2.61 BLE iBeacon UUID(0x72)

Byte No. Parameter Description
1 Length 0x14
2 Key 0x72
3 Flag 0x80. Default: Enable
 4-5 Company id Apple 0x004c
6-21 UUID

3.2.62 LED Default State (0xE0)

Byte No. Parameter Description
1 Length 0x02
2 Key 0xE0
3 State 0: OFF 1: ON
Led default state when power on

3.2.63 Read (0xF0)

Byte No. Parameter Description
1 Length 1+n
2 Key 0xf0
n Read key No content. Read all parameters. Can be a
combination of any parameter key.

3.3 SERVICES COMMAND(0X03) KEY LIST

Hex Description Remark
01 Device ID Each uploaded data must contain this key
which is IMEI (0x10, default). It’s not fixed.
Could be a Custom ID.
10 Heartbeat
11 Translates addresses
12 Get Timestamp Get UTC timestamp from the server
21 Cell Towers
22 WI-FI Towers
0x24 General data

3.3.1 Heartbeat
Byte No. Parameter Description
1 Length 0x02
2 Key 0x10
3 0x5A Fixed data
It can only be sent from the device to the server and sent at the set time interval to
maintain the connection.
 Heartbeat with status format: Device ID(0x01) + Heartbeat(0x10) + General
data(0x24). For example:
AB 18 1F 00 AC 33 0B 01 ->Head
03 10 01 38 36 38 38 33 32 30 34 37 30 30 30 31 30 31 ->Device ID
02 10 5A ->Heartbeat
09 24 E4 51 E3 5C 10 00 A9 2C ->General data
The 07B serial devices won’t sent General Data. We will update this part in the
future. Please contact us to confirm if it’s included.

3.3.2 Translates Addresses

Byte No. Parameter Description
1 Length 0x09
2 Key 0x11
3-6 Latitude
7-10 Longitude
This is a request sent from the device

Byte No. Parameter Description

1 Length 0x09+n
2 Key 0x11
3-6 Latitude
7-10 Longitude
11-n text String text, end with ‘\0’
This is a response sent from the server

3.3.3 Get Timestamp

Byte No. Parameter Description
1 Length 0x01
2 Key 0x12. sent by device
This is a request sent from the device

Byte No. Parameter Description

1 Length 0x05
2 Key 0x12, send by server
3-6 Timestamp
 This is a response sent from the server

3.3.4 Cell Towers (0x21)

Byte No. Parameter Description
1 Length 1+3+5*n, n is the number of Cell Towers. Range: 1-6

2 Key 0x21
3-4 MCC
5 MNC
6 RXL
7-8 LAC
9-10 CELLID
Byte 6 to Byte 10 will be repeatedly displaying the Cell Tower information if more
Cell Towers detected.
This is scanned Cell Tower information sent from the device

Byte No. Parameter Description

1 Length >=9
2 Key 0x21
3-6 Latitude
7-10 Longitude
n address String
This is converted location data sent from the server

3.3.4 WI-FI Towers (0x22)

Byte No. Parameter Description
1 Length 1+7*n, n is the number of Wi-Fi MAC Addresses
Range: 1-6.
2 Key 0x22
3 RSSI The measured current signal strength in dBm. Signed
number
4-9 MAC The MAC address of the Wi-Fi node.
Byte 3 to Byte 10 will be repeatedly displaying the Wi-Fi information if more Wi-Fi
sources detected.
This is scanned Wi-Fi information sent from the device
 Byte No. Parameter Description
1 Length >=9
2 Key 0x22
3-6 Latitude
7-10 Longitude
n address String
This is converted location data sent from the server

3.4 SYSTEM CONTROL COMMAND(0X04) KEY LIST

Hex Description Remark
01 Device ID Device IMEI
10 Reset All Record Remove historical data
11 Factory Recovery Reset
12 Device Reboot
13 Find Me Looking for equipment
14 Power Off
15 LED Blink
16 Scan BLE
20 File open Internal Use Only

21 File close Internal Use Only

22 File write Internal Use Only

23 File read Internal Use Only

24 File seek Internal Use Only

25 File check Internal Use Only

3.4.1 Device ID (0x01)

Byte No. Parameter Description
1 Length 0x10
2 Key 0x01
3-17 Device ID Here is IMEI, 15 bytes

3.4.2 Reset All Record

Byte No. Parameter Description
1 Length 0x01
2 Key 0x10
3.4.3 Find Me
Byte No. Parameter Description
1 Length 0x01
2 Key 0x13

3.4.4 Power Off

Byte No. Parameter Description
1 Length 0x01
2 Key 0x14

3.4.5 LED Control

Byte No. Parameter Description
1 Length 0x01
2 Key 0x15
3 State 0: LED OFF
1: LED works according to the Settings

3.4.6 Scan BLE

Byte No. Parameter Description
1 Length n
2 Key 0x16
This is the command to activate the Scanning

Byte No. Parameter Description

1 Length n
2 Key 0x16
3-8 MAC MAC address of the device connects to the base.
9 RSSI
MAC MAC address of the device connects to the base.
RSSI
This is the BLE information scanned

3.5 NO ENCRYPTION COMMAND (0X09) OPTIONAL

3.5.1 BLE/USB Password Handshake

Byte No. Parameter Description
 1 Length 0x05
2 Key 0x0D
Bit 30-0:
3-6 Password Range: 000000-999999. Default: 123456
Please convert the bit to Decimal system

3.6 FIRMWARE UPDATE COMMAND(0X7E) KEY LIST OPTIONAL

Hex Description Remark

10 Start DFU with initial command
11 Transfer new firmware text
12 Validate new firmware
13 Query DFU state
14 Reset device
15 Get Pack Max length
The error code for DFU is 0x7F format. (in order to handle the error stream
uniformly)
The correct return is 7E format
7E's length is fixed to 0

3.7 NEGATIVE RESPONSE COMMAND(0X7F) KEY LIST

Hex Description Remark

00 Success If never use this code
Protocol Error
11 Version Invalid Protocol version is not supported
12 Encryption Invalid Encryption method is not supported
13 Length Error Incorrect protocol length
14 Checksum Error Checksum error
15 Command Invalid Command not supported
16 Key Invalid Key invalid
17 Key length error Key length error
Value Error
21 Data Format Invalid
 22 Data Size Error
23 Invalid State
24 Invalid Parameter
25 No Memory Not enough storage
26 Sub Function not supported
27 GPS is not ready No GPS positioning
28 Address resp
30 Out of service
40 BLE 还没有交换密码

F0 Battery Power Low

F1 File open failed Internal Use Only
Meets the length key value format.

4. ENCRYPTION OPTIONAL

为保证 TCP 数据传输的安全性，需要对数据（Message body）进行加密处理。

上报数据内容 Message body，使用 AES 算法加密后发送。接收端，根据 Key ID 查询
到密钥，对 Message body 解密。
每条加密数据有特殊固定的头(0xA5)。加密报文的头如下：

1B 1B 2B 2B 2B 4B 2B 2B NB

header length Check seque Key id Control Head Message body

（0xA5 propert sum nce id Code CRC
） ies
数据安全高度依赖于密钥，密钥需进行严格管理，密钥管理方法：
1. 服务器生成 16 字节的密钥，每个密钥对应一个 ID。
2. 服务器将密码保存在数据库中，管理员可以查看并导出。
3. 生产测试工具将密钥信息写入设备。写入内容包括：密钥 ID、密钥、写入时间。
写入后密钥 ID 可读，密钥内容不可读。重新写入密钥后，设备必须恢复出厂设置才
能正常工作。
4. length 为加密后的长蔗
Head CRC 内容：Properties + length + checksum + sequence id + Key id + control code

4.1 MESSAGE PROPERTIES

Properties 1byte
 Bit 7 6 5 4 3 2 1 0
Encryption ERR flag ACK flag Version
Encryption:（保留）
ERR flag:（保留）
ACK flag（保留）

4.2 KEY ID

Bit31-24 23～0
Type Key id in keyring

Message Body 数据传输加密类别和密钥 ID：

Type Description
0 No use encryption, Key id in keyring invalid.
1 AES Dynamic key（保留）
2 AES static key
3 RSA public key（保留）
4 RSA private key（保留）

4.3 SEQUENCE ID
与 body sequence id 一致

4.3 CONTROL CODE (CC)

请求定义
Type Description
1 数据传输
2 密钥管理(保留)
应答定义
Type Description
200 OK
500 解密失败
501 解密后数据验证错误
403 无效密钥
404 密钥失效（保留）
APPENDIX 1

CRC16 CHECKSUM CALCULATION ALGORITHM:

1. Shifted Algorithm
uint16_t crc16_compute(uint8_t const * p_data, uint32_t size, uint16_t const * p_crc)
{
uint16_t crc = (p_crc == NULL) ? 0x0000 : *p_crc;

for (uint32_t i = 0; i < size; i++)

{
crc = (uint8_t)(crc >> 8) | (crc << 8);
crc ^= p_data[i];
crc ^= (uint8_t)(crc & 0xFF) >> 4;
crc ^= (crc << 8) << 4;
crc ^= ((crc & 0xFF) << 4) << 1;
}
return crc;
}

2. Look-up table
static const uint16_t CRC_Table[ ] = {
0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7,
0x8108, 0x9129, 0xa14a, 0xb16b, 0xc18c, 0xd1ad, 0xe1ce, 0xf1ef,
0x1231, 0x0210, 0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6,
0x9339, 0x8318, 0xb37b, 0xa35a, 0xd3bd, 0xc39c, 0xf3ff, 0xe3de,
0x2462, 0x3443, 0x0420, 0x1401, 0x64e6, 0x74c7, 0x44a4, 0x5485,
0xa56a, 0xb54b, 0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d,
0x3653, 0x2672, 0x1611, 0x0630, 0x76d7, 0x66f6, 0x5695, 0x46b4,
0xb75b, 0xa77a, 0x9719, 0x8738, 0xf7df, 0xe7fe, 0xd79d, 0xc7bc,
0x48c4, 0x58e5, 0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823,
0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969, 0xa90a, 0xb92b,
0x5af5, 0x4ad4, 0x7ab7, 0x6a96, 0x1a71, 0x0a50, 0x3a33, 0x2a12,
0xdbfd, 0xcbdc, 0xfbbf, 0xeb9e, 0x9b79, 0x8b58, 0xbb3b, 0xab1a,
0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03, 0x0c60, 0x1c41,
 0xedae, 0xfd8f, 0xcdec, 0xddcd, 0xad2a, 0xbd0b, 0x8d68, 0x9d49,
0x7e97, 0x6eb6, 0x5ed5, 0x4ef4, 0x3e13, 0x2e32, 0x1e51, 0x0e70,
0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a, 0x9f59, 0x8f78,
0x9188, 0x81a9, 0xb1ca, 0xa1eb, 0xd10c, 0xc12d, 0xf14e, 0xe16f,
0x1080, 0x00a1, 0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,
0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c, 0xe37f, 0xf35e,
0x02b1, 0x1290, 0x22f3, 0x32d2, 0x4235, 0x5214, 0x6277, 0x7256,
0xb5ea, 0xa5cb, 0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d,
0x34e2, 0x24c3, 0x14a0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405,
0xa7db, 0xb7fa, 0x8799, 0x97b8, 0xe75f, 0xf77e, 0xc71d, 0xd73c,
0x26d3, 0x36f2, 0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634,
0xd94c, 0xc96d, 0xf90e, 0xe92f, 0x99c8, 0x89e9, 0xb98a, 0xa9ab,
0x5844, 0x4865, 0x7806, 0x6827, 0x18c0, 0x08e1, 0x3882, 0x28a3,
0xcb7d, 0xdb5c, 0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a,
0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0, 0x2ab3, 0x3a92,
0xfd2e, 0xed0f, 0xdd6c, 0xcd4d, 0xbdaa, 0xad8b, 0x9de8, 0x8dc9,
0x7c26, 0x6c07, 0x5c64, 0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1,
0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba, 0x8fd9, 0x9ff8,
0x6e17, 0x7e36, 0x4e55, 0x5e74, 0x2e93, 0x3eb2, 0x0ed1, 0x1ef0
};

uint16_t crc16_compute(const uint8_t *data, uint32_t len, uint32_t init)

{
uint16_t crc16 = init;

for( uint32_t i = 0; i < len; i++){

crc16 = CRC_Table[ ((crc16 >> 8) & 0xff) ^ data[i] ] ^ ( crc16 << 8);
}

return crc16;
}