Navtelecom Communication Protocol

Version 6.2

Moscow
2021
 Table of contents
History of changes ............................................................................................................................ 4
Notation сonventions and accepted abbreviations ............................................................................... 9
Introduction.................................................................................................................................... 11
1. NTCB binary protocol and its FLEX extension ................................................................................ 13
1.1. Transport layer of NTCB protocol ............................................................................................ 14
1.2. FLEX protocol. Working with telematics servers via GPRS ......................................................... 15
1.2.1. Basic procedure for establishing connection with a server via FLEX protocol ........................ 16
1.2.2. List of FLEX versions and basic messages .......................................................................... 23
2. NTCB and FLEX application layer. ................................................................................................. 25
2.1. System commands, queries, messages ................................................................................... 25
2.2. Outputs control ..................................................................................................................... 30
2.3. Inputs control........................................................................................................................ 33
2.4. Telemetry commands, queries, messages ............................................................................... 34
2.5. Device operating modes control.............................................................................................. 39
2.6. Connection to RCS, RFU, DRC services .................................................................................... 41
2.7. Working with identifiers ......................................................................................................... 44
2.8. Working with tachographs...................................................................................................... 47
2.8.1. Control commands and queries ......................................................................................... 47
2.8.2. Generating and transferring DDD file to the server ............................................................. 51
2.8.3. Command and query result codes ..................................................................................... 53
2.9. Working with driver display .................................................................................................... 54
2.10. Working with autoinformer ................................................................................................... 56
2.10.1. Universal commands for autoinformer ............................................................................. 58
2.11. Working with camera ........................................................................................................... 59
2.11.1. Control commands and queries ....................................................................................... 59
2.11.2. Transferring photos to the server .................................................................................... 62
2.11.3. Command and query result codes ................................................................................... 65
2.12. Communication between external interfaces and server ......................................................... 66
2.13. Working with CAN-LOG module ............................................................................................ 69
2.14. Working with built-in accelerometer ...................................................................................... 70
2.15. Accident detection ............................................................................................................... 71
2.16. Working with temperature sensors 1-Wire ............................................................................. 75
2.17. Working with passenger flow counters .................................................................................. 75
2.18. Working with refrigeration units ............................................................................................ 76
3. Encryption AES128 ...................................................................................................................... 78
4. NTCT text protocol ...................................................................................................................... 81
4.1. Formats of SMS messages coming from device ........................................................................ 81
4.2. SMS requests and commands ................................................................................................. 84

2
 4.2.1. System queries and commands ......................................................................................... 85
4.2.2. Outputs ........................................................................................................................... 87
4.2.3. Inputs ............................................................................................................................. 88
4.2.4. Telemetry information ...................................................................................................... 88
4.2.5. Device operating modes ................................................................................................... 90
4.2.6. RCS, RFU, DRC Services ................................................................................................... 91
4.2.7. Working with identifiers .................................................................................................... 93
4.2.8. Tachograph ..................................................................................................................... 94
4.2.9. Driver display................................................................................................................... 95
4.2.10. Autoinformer ................................................................................................................. 96
4.2.11. Digital camera ................................................................................................................ 98
4.2.12. Working with built-in accelerometer ............................................................................... 100
4.2.13. Communication between external interfaces ................................................................... 101
4.3. SMS configuration................................................................................................................. 102
4.3.1. EDITS and READ command formats ................................................................................. 102
4.3.2. SET and GET command formats....................................................................................... 103
5. Tone control .............................................................................................................................. 106
6. Working with device configuration ............................................................................................... 107
6.1. Basic principles and description of commands ........................................................................ 107
6.2. Example of device configuration structure .............................................................................. 109
Annex A. Telemetry record structures .............................................................................................. 110
Annex A.1. Structure of FLEX telemetry records ............................................................................ 110
Annex A.2. Structure of additional FLEX 2.0 telemetry records ....................................................... 136
Annex A.3. Examples of basic FLEX packets .................................................................................. 138
Annex A.4. Compressor configurations and conditions for ThermoKing units ................................... 141
Annex B. Checksum calculation algorithm CRC8 ............................................................................... 143
Annex C. Checksum calculation algorithm CRC16 ............................................................................. 144
Annex D. Summary of NTCB messages ............................................................................................ 145
Annex E. Table of digital FLS error codes ......................................................................................... 149

3
 History of changes
version 5.0:
 removed description of dynamic change of data transfer mask by the server for FLEX;
 removed description of dynamic change of data transfer mask by the server for FLEX;
 added description of FLEX 2.0
 added description of work with autoinformer;
 added description of work with driver display;
 added description of work with tachograph;
 added description of work with digital camera;
 added description of SMS device configuration.

version 5.1:
 fixed a bug in the description of the field " Status of GPS/GLONASS navigation sensor".

version 5.2:
 fixed bugs in the description of commands, requests and responses when working with tachograph;
 fixed bugs in the description of commands, requests and responses when working with camera;
 updated structure of FLEX telemetry records (Annex A.1).

version 5.3:
 fixed bugs in the description of the structure of FLEX telemetry records (Annex A.1), fields No.: 4, 5, 6,
53, 66, 68, 72, 122;
 types of variables in the description are corrected to standard names;
 corrected the field order in the “FLEX 2.0 additional telemetry packet example” table.
 added description of the NTCB and NTCT commands "Command to resend telemetry from non-volatile
memory";
 added a description of the NTCB and NTCT commands "Command to resend telemetry from SD card."

version 5.4:
 updated description of the structure of FLEX telemetry records (Appendix A.1), fields No.: 4, 6;
 made clarifications to the commands: "Command to resend telemetry from non-volatile memory",
"Command to resend telemetry from SD card";
 added SMS command to confirm synchronization of the internal memory with the server;
 added "Format of standard SMS message M: 101";
 added arbitrary USSD NTCT and NTCB requests;
 added sections 2.14, 4.2.12 "Working with built-in accelerometer";
 added section 2.15 "Accident detection";
 changed format of the SMS command "SETTLE";
 added description of the SMS query "POS";
 changed formats of SMS commands and requests "SET" and "GET”;
 added query "*?ERFT";
 added section "5. Tone control";
 adeed " Format of file that stores accident information" to the section "2.15 Accident detection";
 added "Annex E. Table of digital FLS error codes";
 added "Command of arbitrary sound indication by buzzer" to the section "2.1 System commands,
requests, messages";
 added “Standard SMS format M:112” to the section "4.1. Formats of SMS messages coming from
device";
 added “Query location-based service (LBS) information” to the section "4.2.4. Telemetry information”;
 added “Format of standard SMS message M:113” to the section "4.1. Formats of SMS messages coming
from device”;

4
 added “Query information about firmware version of the GPS receiver” to the section "4.2.1. System
queries and commands";
 updated "Annex D. Summary of NTCB messages".

version 5.5:
 updated field “Status of functional modules 2” in the section “Annex A.1. Structure of FLEX telemetry
records”;
 added new type of the field to the section “Structure of the dynamic part of the FLEX 2.0 additional
packet”
 added “Command to change SIM card” to the section “2.1. System commands, queries, messages”;
 added “Command to change SIM card” to the section “4.2.1. System queries and commands”;
 added “Custom command RS485/RS232” to the section “2.12. Communication between external
interfaces and server”;
 added section “4.2.13. Communication between external interfaces”;
 added “Query device status with SMS sending” to the section “2.1. System commands, queries,
messages”;
 added “Standard SMS format M:114” to the section “4.1. Formats of SMS messages coming from
device”;
 added “Query device status” to the section “4.2.1. System queries and commands”;
 added “Query unique SIM serial number” to the section “2.1. System commands, queries, messages”;
 added “Query unique SIM serial number” to the section “4.2.1. System queries and commands”;
 added new error code to the section “Appendix E. Table of digital FLS error codes”.

version 5.6:
 added “Query information about firmware version of the GPS receiver” to the section “2.1. System
commands, queries, messages”;
 updated “Appendix D. Summary of NTCB messages”;

version 5.7:
 “Custom command RS485/RS232” renamed to “Custom command”;
 added GPS interface for "*! UC." NTCB and NTCT commands.

version 5.8:
 removed special value 0xFFFFFFFF from the description of the request for a DDD file block in the
section “2.8.2. Generating and transferring DDD file to the server”;
 removed special value 0xFFFF from the description of the command “Query photo data” and specified
the maximum size of the transmitted block;
 added “Command to reset current calibration” to the section “4.2.12. Working with built-in
accelerometer”;
 fixed errors in the description of parameter No. 77 of the FLEX structure;
 changed description of parameter No. 108 of the FLEX structure.

version 6.0:
 updated table with description of the negotiation protocol version packet description in the “1.2.1. Basic
procedure for establishing connection with a server via FLEX protocol”;
 updated description of the current state packet in the section “1.2.1. Basic procedure for establishing
connection with a server via the FLEX protocol”;
 updated tables “List of supported FLEX protocol versions” and “List of supported FLEX data structure”
in the section “1.2.1. Basic procedure for establishing connection with a server via the FLEX protocol”;
 updated tables “List of supported FLEX protocol versions” and “List of supported FLEX data structure”
in the section “1.2.2. List of FLEX versions and basic messages”;
 changed command formats:
"Arbitrary USSD request",

5
 "Command of arbitrary sound indication by buzzer",
"Command to change SIM card",
"Query device status with SMS sending",
"Query unique SIM serial number",
" Query information about firmware version of the GPS receiver" in the section “2.1. System commands,
queries, messages";
 added description of command format
“Command for microphone listening” to the section “2.1. System commands, queries, messages”;
 added description of command format
"Command to change output state” to the section “2.2. Outputs control”;
 changed command formats:
"Command to lock input",
"Command to unlock input" in the section “2.3. Inputs control”;
 changed command formats:
"Command to confirm synchronization of internal memory with the server",
"Command to resend telemetry from non-volatile memory”,
"Command to resend telemetry from SD card" in the section “2.4. Telemetry commands, queries,
messages”;
 added command formats:
"Command to change operating mode of the device",
"Query current operating mode" to the section “2.5 Device operating modes control”;
 updated command formats:
“Command to connect to the configurator via RCS”,
“Command to update device firmware via RFU” in the section “2.6. Connection to RCS, RFU, DRC
services";
 changed command format “Custom command” in the section “2.12. Communication between external
interfaces and server”;
 added description of the command format “Query CAN-LOG device program number” to the section
“2.13. Working with CAN-LOG module”;
 updated command "Accelerometer calibration command" in the section "2.14 Working with built-in
accelerometer";
 changed description of the accident file format in the table “Format of file that stores accident
information” in the section “2.15. Accident detection”;
 updated the tables:
“Queries”
“Commands” in the section "4.2.1 System queries and commands";
 updated tables:
"Queries"
"Command to resend telemetry from non-volatile memory",
"Command to resend telemetry from SD card" in the section “4.2.2. Telemetry information”;
 updated table “Commands” in the section “4.2.3. Outputs”;
 added table description of the new command format in the section “4.2.5. Services RCS, RFU";
 removed section “4.2.6. Subscribers”, changed section numeration of clause 4.2, starting from clause
4.2.6 (inclusive);
 updated tables:
“Commands”
“Requests” in the section “4.2.6. Device operating modes”;
 updated table “Commands” in the section “4.2.11. Working with built-in accelerometer";
 updated table “Commands” in the section “4.2.12. Communication between external interfaces”;
 added description of the new command format for configuration in the section “4.3 SMS configuration”;
 updated fields 4, 6, 38-44, 78-93, 100, 109 for FLEX1 and FLEX2 protocols in the Annex “A.1. Structure
of FLEX telemetry records”;
 added description of FLEX3 fields format in the Annex “A.1. Structure of FLEX telemetry records”;

6
 added Annex “A.4. Compressor configurations and conditions for ThermoKing units”;
 updated Annex "G. Summary of NTCB messages”.

version 6.1:
 all tables with descriptions of messages or commands were added with information on which
communication channels a message or command can be transmitted;
 added examples to some of the tables with descriptions of messages or commands;
 made minor corrections on the entire text of the document;
 fixed a typo "Command for microphone listening" in the section “2.1. System commands, queries,
messages";
 added description “Command for time adjustment on device” to the section “2.1. System commands,
queries, messages";
 added description “Command for diagnostic information query” to the section “2.1. System commands,
queries, messages";
 added description "Response to unsupported messages" to the section “2.1. System commands,
queries, messages";
 added description “Query current state of the device in the additional packet” to the section “2.4
Telemetry commands, queries, messages”;
 fixed a typo “Command to change device operating mode” in the section “2.5 Device operating modes
control”;
 added description “Command to connect to DRC” to the section “2.6. Connection to RCS, RFU, DRC
services”;
 renamed section “2.7. Working with identifiers”, made minor corrections in the text;
 added description “Command to edit the list of registered Touch Memory keys” in the section “2.7.
Working with identifiers”;
 fixed description of the FLEX command format for editing registered TM keys in the section “2.7.
Working with Identifiers”;
 fixed description “Command to start DDD file generation” and updated description of the logic for
downloading a file from tachograph and the logic of working with file cache in the section “Generating
and transferring DDD file to the server";
 added section “2.10.1. Universal commands for autoinformer";
 updated description in the section “2.11.2. Transferring photos to the server”;
 updated description in the section “2.12. Communication between external interfaces and server”;
 updated description of the unloading process and commands in the section “2.15. Accident detection”;
 added section “2.16. Working with 1-Wire temperature sensors”;
 added section “2.17. Working with passenger flow counters”;
 added section “2.18. Working with refrigeration units;
 added section “2.19. Configuration commands»;
 updated description in the section “4.2 SMS requests and commands”, updated style of description of
all SMS commands and requests;
 added description “Query unique device ID” to the section “4.2.1. System queries and commands”;
 added description “Command of arbitrary sound indication by buzzer” to the section “4.2.1 System
queries and commands”;
 added description “Command for time adjustment on device” to the section “4.2.1. System queries and
commands”;
 added description " Command for diagnostic information query " to the section “4.2.1. System queries
and commands”;
 fixed a typo “Command to switch security modes” in the section “4.2.5 Device operating modes”;
 added description "Command to connect to DRC" to the section “4.2.6. RCS, RFU, DRC services";
 added section “4.2.7. Working with identifiers";
 added description of “Command to change the route” to the section “4.2.10 Autoinformer”;
 added description “Command to playback audio file” to the section “4.2.10 Autoinformer”;

7
 added description “Command to change autoinformer operating mode” to the section “4.2.10
Autoinformer”;
 added description “Command to change the current stop” to the section “4.2.10 Autoinformer”;
 added section “4.3.1. EDITS and READ command formats";
 updated description in the section “4.3.2 SET and GET command formats”;
 added section “6. Working with device configuration”;
 added “Navigation Antenna Status” to the field #123 in the section “Annex A.1. Structure of FLEX
telemetry records”;
 added explanation regarding the direction of roll and pitch to the field #141 in the section Annex A.1.
Structure of FLEX telemetry records”;
 changed parameter types: S8 to I8, S16 to I16, S32 to I32, S64 to I64 in the fields #207…255 in the
section Annex A.1. Structure of FLEX telemetry records”;
 added information about new messages to the section “Annex D. Summary of NTCB messages”.

version 6.2:
 added description of the standard SMS M:115 (format of response to a diagnostic request with a
list of GSM error codes) to the section “4.1. Formats of SMS messages coming from device”

8
 Notation сonventions and accepted abbreviations
Designation Interpretation
AES128 (Advanced Encryption Standard) symmetric block encryption algorithm, block size 128 bits.
ASCII (American standard code for American character encoding table.
information interchange)
CAN (Controller Area Network) industrial network standard, focused primarily on combining
various executive devices into a single network.
COM (Communications Port) RS-232 interface.
GPRS (General Packet Radio Servic) public packet radionetwork.
Handshake packet consisting of a message with an individual device ID
string.
GPS (Global Positioning System) satellite navigation system, which provides measurement of
distance, time and determines location in the WGS 84 world
coordinate system.
GSM (Global System for Mobile a global digital standard for mobile cellular communications.
communications)
ID (Identifier) identifier.
IP (Internet Protocol) routable protocol of the TCP/IP stack network layer.
IMEI (International Mobile Equipment international mobile equipment identifier.
Identity)
NTCB (Navtelecom Binary) binary communication protocol of Navtelecom LLC.
NTCT (Navtelecom Text) text communication protocol of Navtelecom LLC.
RCS (Remote Configuration Service) remote configuration service.
RFU (Remote Firmware Update) remote firmware update service.
RS-232 (Recommended Standard 232) standard describing a serial communication interface
supporting asynchronous communication.
RS-485 (Recommended Standard 485) standard for transmitting data over a two-wire half-duplex
multipoint serial symmetrical communication channel.
SMS (Short Messaging Service) technology that allows receiving and transmitting short text
messages over mobile radiotelephone networks.
TCP (Transmission Control Protocol) network data transfer protocol.
TCP/IP (Transmission Control Protocol / set of network data protocols.
Internet Protocol)
UDP (User Datagram Protocol) user datagram protocol.
USB (Universal Serial Bus) universal serial wire bus.
UTC (Coordinated Universal Time) international time format.
WGS-84 (World Geodetic System 1984) world geodetic coordinate system 1984
XOR boolean exclusive-OR function.
GLONASS global navigation satellite system of the Russian Federation.
PZ-90.11 state geocentric coordinate system "Land parameters 1990."
PC personal computer.
soft software.

9
 Notation сonventions

Following designations are used in this document:

I8 - signed integer with a length of 1 byte (character);
I16 - signed integer with a length of 2 bytes;
I32 - signed integer with a length of 4 bytes;
I64 - signed integer with a length of 8 bytes;
U8 - unsigned integer with a length of 1 byte;
U16 - unsigned integer with a length of 2 bytes;
U32 - unsigned integer with a length of 4 bytes;
U64 - unsigned integer with a length of 8 bytes;
Char - character type with a length of one byte.

For all specified integer types, there is little-endian bytes order.

The following types of records can be used to designate an array:

1) 16*U8 - array of 16 unsigned integer bytes;
2) char[7] - array of 7 characters.

To designate a string of arbitrary size without null-terminated, used following record type: char[].

10
 Introduction
In telematic devices (Signal and Smart series) manufactured by Navtelecom LLC, there are two protocols
used for all options for transmitting telematic information via communication channels:
- NTCB binary (Navtelecom Binary) protocol with FLEX extension;
- NTCT text (Navtelecom Text) protocol.

NTCT text (symbolic) protocol is used to transmit telemetry through the SMS service of cellular operators.
Packets of this protocol are limited by the length of one SMS message (140 characters) and include the
main telematic information about the monitored object.

To transmit complete information about the device, change settings and internal firmware, binary NTCB
protocol for data exchange via USB, GPRS is used. NTCB protocol is divided into application and transport
layers.

When exchanging over GPRS, device supports various options for presentation and transport layers.
Presentation layers: 1) ASCII - data without encryption using the corresponding encoding table; 2) AES128
- data encrypted by a symmetric block encryption algorithm.
Transport layers: 1) TCP - communication protocol, provides data transfer in networks and subnets TCP/IP;
2) UDP - communication protocol for data transmission in IP networks without connection. Operation via
UDP is no different from TCP in terms of device interaction with the server.

Device-Computer interaction diagram

Device Computer

NTCB NTCB Application layer

ASCII ASCII Presentation layer

Session layer
USB USB Transport layer
Data layers

11
 Device-Server interaction diagram

Device Server

NTCB, FLEX NTCB, FLEX Application layer

ASCII, AES128 ASCII, AES128 Presentation layer

TCP, UDP TCP, UDP Transport layer

GPRS Internet

Data layers

GSM GSM

Device-GSM phone (SMS) interaction diagram

Device Phone

NTCT NTCT Application layer

Presentation layer
UCS2 UCS2

Session layer
GSM GSM Transport layer
Data layers

12
 1. NTCB binary protocol and its FLEX extension
NTCB is a basic protocol with static telemetry packets. Static refers to the structures of telemetry records:
F1, F2, F3, F4, F5, F5.1, F5.2, F6. At the moment, the part of the protocol related to static telemetry
messages is not used, FLEX protocol extension is used. FLEX protocol is a set of telemetry messages that
allows flexible customization of the transmitted information. FLEX also includes an extension of the set of
commands and messages for working with the device and peripherals.

NTCB protocol allows packets with a maximum length of 65551 bytes. Each message within this protocol
consists of two parts: ransport header and application layer data (telemetry information).

NTCB message structure

<HEAD> <BODY>
Protocol Fields
(transport layer header) (application layer data)
Fields size in bytes 16 from 0 to 65535

When device is connected to the server via GPRS, packets can be transmitted both at the initiative of the
server and at the initiative of the device. However, the NTCB protocol is not full duplex, i.e. full transmission
of packets in both directions is impossible at the same time. When working with telematic server, device
initiates the transmission of telemetry packets. If there is a situation of simultaneous data transfer from
the device and a command from the server, above exchange procedure may be violated. Initially, device
executes a command or request and sends an acknowledgment to the server. After that, device proceeds
to wait for confirmation of reception of telemetry information by the server. In some cases, device may
miss incoming packet if at the same time it sends another packet (packet entering the device may be very
delayed or not received at all). In this case, it is necessary, in the absence of reaction to the sent command,
to provide for a repetition of the command. During active communication between server and device, it is
necessary to send a command to the device instead of an acknowledgement to the telemetry message,
then, after waiting for the command to be executed, it is necessary to send an acknowledgement or wait
for the retransmission of the telemetry packet.

If there is no confirmation of receiving information from the server, device will repeat sending the
telematics packet after pauses of 20 to 90 seconds, depending on the quality of the cellular network signal.
It should also be noted that the indicated time intervals also depend not only on the signal quality, but
also on the degree of availability of the GPRS channel.

During information exchange via USB interface, packet exchange begins exclusively at the initiative of the
"host". For each packet from "host," the device sends an acknowledgement or response to the request.
Before sending a new packet, "host" must wait for confirmation or take a pause. If the command or
request does not meet the protocol requirements (incorrect type, broken structure, checksum does not
match), confirmation of the reception of this command is not sent. Similarly, when sending incorrect
telemetry data from a device when connecting over GPRS, server should not send back an
acknowledgement of the reception of this data.

When device is connected to a personal computer via USB, device is defined as a virtual COM port. Waiting
time for a response must not be less than a second. It is advisable to select the value of this pause equal
to 1... 5 seconds. If there is no response, we recommend to try sending the packet to device again.

13
 1.1. Transport layer of NTCB protocol

In the NTCB protocol, in the information packet, application layer data (commands, requests,
acknowledgements and responses) is preceded by a 16-byte transport layer header.

Transport layer header structure

Bytes order 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Number of CSp
Recipient ID Sender ID CSd Data
Header field Preamble data bytes Header
IDr IDs Checksum
n Checksum
Extension and
format of the char[4] U32 U32 U16 U8 U8
field
Default packet @NTC 1 0 0 0x00 0x18
field values when
it is sent from
the device to the 0x40 0x4e 0x01 0x00 0x00 0x00
0x00 0x00 0x00 0x18
server without 0x54, 0x43 0x00 0x00 0x00 0x00
application data
(n=0)
Default packet @NTC 0 1 0 0x00 0x18
field values when
it is sent from
the server to the 0x40 0x4e 0x00 0x00 0x01 0x00
0x00 0x00 0x00 0x18
device without 0x54, 0x43 0x00 0x00 0x00 0x00
application data
(n=0)

The first three fields (preamble, recipient ID, sender ID) serve to uniquely identify device and server when
trying to establish a connection. Values of these fields are set at the stage of device configuration. If you
do not configure these settings for the device, device will use default values for these fields.

The preamble consists of any four characters. By default, the first four characters of this packet form the
string "@NTC." When the computer communicates with the device via USB interface, preamble is always
"@NTC" regardless of the device settings.

"Host" (server) and device IDs are specified in the device settings. In case of transmitting a packet from
host to device, packet recipient ID corresponds to the device ID and sender ID corresponds to the host
ID. When sending a reverse packet (confirmation), identifiers are replaced: identifier of the packet
recipient corresponds to the “host identifier and sender identifier corresponds to the device identifier.
To connect via USB and for devices in which these parameters are not set, default parameters are: host
ID (PC) - 1, device ID - 0.

Number of data bytes indicates the number of bytes of this packet following this 16-byte header. Number
of bytes cannot exceed 65535.

14
Checksums used in the header are calculated over the data entire length specified in the previous field
using the XOR algorithmthe following function:

unsigned char xor_sum

(
unsigned char *buffer, / * (in) pointer to the data buffer */
unsigned int length / * (in) number of bytes to count */
)
{
unsigned char temp_sum = 0;

while ( length-- > 0 )

{
temp_sum ^= *buffer++;
}

return ( temp_sum );
}

First, data checksum Csd is calculated along the length of the data n.

Then checksum of the Csp header is calculated for the first 15 bytes: from the 1st to the 15th. Use this
procedure to monitor the integrity of the transport layer header data.

If identifiers, preamble or checksums calculated on both sides do not match, packet is considered
corrupted and no response messages are sent from the receiving side.

It is allowed to transmit an "empty" transport layer packet to maintain a communication channel consisting
of 16 overhead bytes without application layer data. The receiving party should not send a response to
this packet.

1.2. FLEX protocol. Working with telematics servers via GPRS

Working in FLEX protocol, preamble of the NTCB packet remains fixed, containing default value "@ NTC".

FLEX message headers contain a preamble starting with the character '~'. There are no sixteen-byte
headers in these messages. To inform the server that the data transfer will be carried out in the FLEX
protocol, additional protocol version negotiation message is sent.

To maintain communication (ping), a packet consisting of one byte with a fixed 0x7F value is used. Server
confirmation for this packet is not required.

Thus, FLEX messages can be distinguished from other NTCB messages by the first character:
@ - NTCB message containing a 16-byte header;
~ - FLEX message;
DEL (0x7F) - FLEX ping message.

This protocol uses a universal telemetry configurable data table to transmit telemetry information. Each
field of this table is indicated by a flag, they are transmitted to the server during the authorization process
as a set of bits. If the value of the flag is "1," then the corresponding field will be transmitted, and if the
flag is "0," then the field will not be transmitted. Fields are transmitted without gaps in case of their
absence, there is offset to the end of the last recorded field.

15
 1.2.1. Basic procedure for establishing connection with a server via FLEX protocol

When working via GPRS channel, device is always the initiator of establishing a connection with the server.

General case of communication with the server:

Device Server

Individual Device ID (handshake)

Device ID confirmation

FLEX parameters bit field

FLEX parameters bit field confirmation

Telemetry records array

Telemetry records array confirmation

…
Telemetry records array

Telemetry records array confirmation

Communication with telematic servers is carried out according to the settings of the device itself. After
opening a connection (socket), device independently sends a packet to the server, consisting of a message
with a string of an individual device identifier - handshake. From this packet, it can be extracted the
protocol settings: preamble, object ID and server ID, as well as the unique device ID (IMEI number of the
GSM modem).

Parameters obtained during connection are compared with the settings available for this device and, based
on the result, decision is made: to allow further work or to break connection. If the parameters match,
response to this handshake packet is sent to the device, which informs the device that it is possible to
start transmitting telemetry data.

16
After opening the connection (socket), device sends a handshake packet:

Message <HEAD>*>S:<s>
Response <HEAD>*<S
Exchange
GPRS
channels
Designations Interpretation Data Format
<HEAD> 16-byte NTCB packet header with @NTC preamble U8[16]
*>S 0x2A 0x3E 0x53 char[3]
*<S 0x2A 0x3C 0x53 char[3]
<s> ID String * char[15]
* This line includes IMEI of the modem, so modem must be enabled at least once to receive it. When
replacing a modem, unique identifier changes.

Next, message is sent to negotiate protocol versions. This message defines the composition and quantity
of data to be transmitted, FLEX protocol version and version of the data structure.

Message <HEAD>*>FLEX<protocol><protocol_version><struct_version><data_size><bit field[data_size/8]>

Response <HEAD>*<FLEX<protocol><protocol_version><struct_version>
Exchange GPRS
channels
Designations Interpretation Data Format
<HEAD> 16-byte NTCB packet header with @NTC preamble U8[16]
*>FLEX 0x2A 0x3E 0x46 0x4C 0x45 0x58 char[6]

*<FLEX 0x2A 0x3C 0x46 0x4C 0x45 0x58 char[6]

Symbol of the protocol in which device is going to work:
<protocol> U8
0xB0 – FLEX
Protocol version is needed to identify compatibility of the command set and
packet format on the server and in the device.
<protocol_version> For version 1.0 - 10 (0x0A) U8
For version 2.0 - 20 (0x14)
For version 3.0 - 30 (0x1E)
Data structure version is needed to identify compatibility of the transmitted
data format on the server and in the device.
<struct_version> For version 1.0 - 10 (0x0A) U8
For version 2.0 - 20 (0x14)
For version 3.0 - 30 (0x1E)
Subsequent configuration field size < bit field [data _ size/8 + (1)] >
For structure version 1.0- 69
<data_size> U8
For structure version 2.0 - 122
For structure version 3.0 - 255
Bit array with information about transmitted fields of the data structure. Set
bit corresponds to the transmitted field, if the bit is zero, corresponding field
is not transmitted.
Array value is determined by the device configuration. [U8]
<bit
field[data_size/8+(1 (byte array)
The length in bytes is calculated as an integer number of bytes that can fit
)]>
number specified in the <data_size> field.
For structure version 1.0 - 9 bytes
For structure version 2.0- 16 bytes
For structure version 3.0 - 32 bytes

17
 Command bit field structure

When the number of fields "n" is a multiple of eight, the bytes are filled completely.

Bytes 0 1 .. n/8
Bits 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 .. 76543210
FLEX Fields 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 .. n-7….............. n

When the number of fields "n" is not a multiple of eight, the filling of the last "incomplete" byte starts from
the 7th high bit, and the low bits remain insignificant.

Bytes 0 1 .. n/8+1
Bits 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 .. 76543210
FLEX
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 .. n/8*8+1……..(n/8+1)*8
Fields

For example, the number of fields n = 21. The number of bytes is equal to 21/8 + 1 = 3 (division is carried
out to integers). The first two bytes are full. In the third byte, only the last 21-16 = 5 bits are filled.

Bytes 0 1 2
Bits 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
FLEX
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 0 0 0
Fields

Fields of the FLEX table for which the corresponding bits are not set are omitted. For example, for a field
that takes form 0x00 0xE0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 for a FLEX table version 1.0, the
transmitted telemetry information will look as follows:

Record Data
№ № FLEX Record Field Accepted values
Item Size Format
Time of the last valid Number of seconds since 1970
U32
1 9 coordinates (before the 4
event)
Latitude angle recorded when
the last valid coordinates were
obtained.
2 10 Last valid latitude 4 I32
In ten thousandths of a minute.
For example, 55° 42,2389' will
be represented as 33422389
Longitude angle recorded when
the last valid coordinates were
obtained.
3 11 Last valid longitude 4 I32
In ten thousandths of a minute.
For example, 37° 41,6063' will
be represented as 22616063

In order device can start transmitting data specified in the protocol packet, version of the bit mask
transmitted from the device and in the response from the server must match. FLEX data formats are
backward compatible, i.e. version 2.0 of the data format includes version 1.0, with the added data fields
at the end of the data structure. The protocol version is updated when the format and composition of the
packets change. Device does not send new FLEX messages to incompatible server software. Thus, the
device and the server always operate with compatible sets of commands and data.

Consider an example of an exchange between a device with an updated version of the protocol and a
server that does not support this update. For example, the device supports version 2.0 of the data format,
while the server only supports version 1.0 of the data format.

18
Negotiation process looks as follows:
- device sends a negotiation message with a version 2.0 data bit mask;
- server returns a response containing a 1.0 bit mask;
- device, processing the packet, remembers the server's response and sends a new FLEX message with a
version 1.0 bit mask.

If the server again returns a response that specifies the version 1.0 bit mask, then the data transfer starts.
If the server returns a response that contains a mismatched bit mask, then the device disconnects from
that server. The negotiation of the protocol version looks the same and can be carried out at the same
time as the negotiation of the data version, it is enough for the server in the response to immediately
indicate the required protocol version and data structure.

Device monitors the number of failed attempts to connect to the server. After three attempts, the server
is locked for the interval specified in the configuration.

Example of switching to an old version of the FLEX protocol if the server does not support the new one:

Device Server

Individual device ID (handshake)

Device ID confirmation

FLEX 2.0 parameters bit field

FLEX 1.0 parameters bit field confirmation

FLEX 1.0 parameters bit field

FLEX 1.0 parameters bit field confirmation

Telemetry records array

Telemetry records array confirmation

After successful connection to the server, device sends telematic data. In this case, three types of
telematics packets are used:
 telemetry record array packet with events that have occurred earlier and are not currently
transmitted to the server for some reason; they are contained in non-volatile memory;

19
  out-of-order messages packet with the current event. These packets are out-of-order and have a
higher priority than the archived one. The telemetry transmitted by the device in the out-of-order
message may not be duplicated in the archive message, so parsing these packets is mandatory.
 current state packet does not have a corresponding event to be archived. It is sent if the device
should transmit telemetry instead of "ping," or is added to the telemetry array packet if a large
fragment of old data is transmitted. The current state has a record index of zero and a 0xFF00
event ID.

Telemetry record array packet structure

ATTENTION!
Implementation of responses from the server to the structures listed in this section is required for the
correct operation of the device.

Data accumulated in the non-volatile memory is always transmitted in the “Array of telemetry messages”.
The packet contains a certain number of entries from the non-volatile memory. The packet size does not
exceed 1.3 KB (excluding the header). Packets with a single record are allowed.

Message ~A<size><x[0]-x[size-1]><crc8>
Response ~A<size><crc8>
Exchange
GPRS
channel
Designations Interpretation Data Format
~A 0x7E 0x41 char[2]
<size> Number of telemetry records transferred in the array U8
Array of telemetry records with FLEX structure. The number of
parameters passed and the size in bytes correspond to the value in
<x[0]-x[size-1]> -
the <bit field [data_size/8 + (1)] > field of FLEX packet.
The entries follow each other without any separators.
8-bit byte CRC8 ~A characters and fields
<crc8> <size><x[0]-x[size-1]> See Annex B. Checksum calculation U8
algorithm CRC8.

To store and transfer some rarely changing data, additional packets and telemetry recording introduced
in the protocol extension starting with FLEX 2.0 are used. These packets replace the standard telemetry
packets.

Message ~E<count><x[0]-x[count-1]><crc8>
Response ~E<count><crc8>
Exchange channel GPRS
Designations Interpretation Data Format
<count> Number of telemetry records transferred in the array U8
Array of additional telemetry records. The entries follow each other
<x[0]-x[size-1]> -
without any separators.
8-bit byte CRC8 ~E characters <count><x[0]-x[count-1]> See
<crc8> U8
Annex B. Checksum calculation algorithm CRC8.

20
 Out-of-order message packet structure

ATTENTION!
Implementation of responses from the server to the structures listed in this section is required for the
correct operation of the device.

Device may transmit important events out of sequence, i.e. out of order of increasing message index in
the non-volatile memory. If the event is the last one and has been sent to the server, it will not be sent in
an archived message. Sending an out-of-order message has a higher priority than all other packets. Until
a response to this message is received, the device will suspend transmission of other packets.

Message ~T<eventindex><x><crc8>
Response ~T<eventindex><crc8>
Exchange GPRS
channel
Designations Interpretation Data Format
~T 0x7E 0x54 char[2]
Telemetry record, with FLEX structure. The number of parameters
<x> passed and the size in bytes correspond to the value in the <bit -
field[data_size/8+(1)]> field of FLEX packet
<eventindex> The index of the received telemetry record. U32
8-bit byte CRC8 ~T characters and fields
<crc8> <size><x[0]-x[size-1]> See Annex B. Checksum calculation U8
algorithm CRC8.

Similar to the array of telemetry messages, there are additional out-of-order packets for out-of-order
messages introduced in the protocol extension from FLEX 2.0.

Message ~X<eventindex><x><crc8>
Response ~X<eventindex><crc8>
Exchange channel GPRS
Designations Interpretation Data Format
<x> Additional telemetry record. -
<eventindex> Index of the received telemetry record. U32
8-bit byte CRC8 ~X characters and fiels <count> and <x[0]-x[count-
<crc8> U8
1]> See Annex B. Checksum calculation algorithm CRC8

21
 Current state packet structure

ATTENTION!
Implementation of responses from the server to the structures listed in this section is required for the
correct operation of the device.

Device can also send current state data.

Packet can be added to the transmitted arrays (~A) as the last record, or contained in a separate packet
(~C). The current state has a zero record index and eveny code 0xFF00.

Message ~С<x><crc8>
Response ~С<crc8>
Exchange channel GPRS
Designations Interpretation Data Format
~ 0x7E 0x43 char[2]
Telemetry record, with FLEX structure. The number of parameters
<x> passed and the size in bytes correspond to the value in the field -
<bit field [data_size/8+(1)]> of FLEX packet.
8-bit byte CRC8 ~C characters and fields
<crc8> <size><x[0]-x[size-1]> See Annex B. Checksum calculation U8
algorithm CRC8

Examples of basic FLEX packets are provided in Appendix A.3. Examples of basic FLEX packets.

22
 1.2.2. List of FLEX versions and basic messages

List of supported FLEX protocol versions:

Protocol Version Description

FLEX 1.0 Basic version includes messages described in FLEX Message List for FLEX 1.0.
Includes messages described in FLEX 2.0 FLEX Message List.
Added option for work with following devices: camera, tachograph, transparent port.
FLEX 2.0
Has its own peculiarities: if camera is configured, a special message will be sent to the
server. It informs about the presence of photos.
Protocol version has been increased due to the introduction of a new version of the data
FLEX 3.0
structure.

Each next version of the protocol includes the features of the previous one.
If the FLEX version is not supported, you must upgrade to the previous version of the protocol when you
connect the device.
It is allowed to use different versions of the protocol and data structure at the same time. For example,
FLEX protocol version 1.0, FLEX data structure version 2.0.

List of supported FLEX data structure versions:

Structure Version Description

Basic data structure is presented in Appendix A.1. Structure of FLEX telemetry records for
FLEX 1.0
FLEX 1.0.
Extension of the basic data structure is presented in Appendix A.1. Structure of FLEX
telemetry records for FLEX 2.0.
FLEX 2.0
Structure of the FLEX 2.0 extension additional telemetry record is presented in Annex A.2.
Structure of additional FLEX 2.0 telemetry records
Extension of the basic data structure is presented in Annex A.1. Structure of FLEX
FLEX 3.0
telemetry records for FLEX 3.0.

List of FLEX messages

Message Type Appointment

FLEX 1.0 Telemetry Messages
(implementation of responses from the server is mandatory for correct operation of the device)
Transmission of accumulated telemetry messages from non-
volatile memory with a FLEX type structure. Field flags are
~A<size><x[0]-x[size-1]><crc8> either taken from the device settings or from the server and
specified in a separate command at the beginning of the
connection.
Transmission of out-of-order messages with a FLEX type
structure. Field flags are either taken from the device settings
~T<eventindex><x><crc8>
or from the server and specified in a separate command at the
beginning of the connection.
Transmission of current telemetry messages with a FLEX type
structure. Field flags are either taken from the device settings
~С<x><crc8>
or from the server and specified in a separate command at the
beginning of the connection.
DEL (0x7F) FLEX Protocol Connection Support Message.
FLEX 2.0 Telemetry Messages
(implementation of responses from the server is mandatory for correct operation of the device)
Transmission of accumulated additional telemetry messages
~E<count><x[0]-x[count-1]><crc8>
from non-volatile memory with a FLEX 2.0 structure.

23
 Transmission of additional out-of-order messages with a FLEX
~X<eventindex><x><crc8>
2.0 structure.
FLEX 2.0 Service Messages List
Q (query) Data query (version, device status, etc.).
Response to the request if the requested information is
I (information)
available.
Response to the request if the requested information is not
U (unavailability)
available.
O (order) Command (activation of output lines, protection, etc.).
R (response) Response to the command if executed.
F (failure) Response to the command if it is not executed.
N (notification) Notification.
G (get) Data block query.
L (lack) Negative response to block query.
D (data) Data block transmitted on query.
P (put) Loading data block.
S (saturation) Negative response to data block loading.
M (more) Confirms the load of the data block.

For detailed examples of FLEX service messages, see the sections that describe specific functions.

24
 2. NTCB and FLEX application layer.
Description of the structure of request packets, commands and
information messages
The main types of the messages are:
1) requests - transmitted from the "host" to the device. Requests are not captured in the device's
non-volatile memory, excluding requesting the current state of the device;
2) information messages and requests from the device - transmitted at the initiative of the device
itself and used to transmit telemetry from the device to the server and exchange information with RCS
(Remote Configuration Service) and RFU (Remote Firmware Update) services;
3) commands - transmitted from the server ("host") to the device. Execution of the "host" command
is monitored when a response to commands is received. Commands are mapped to events that occur in
the device, and when executed, they are recorded in a non-volatile memory.

2.1. System commands, queries, messages

Query model and firmware version

Query <HEAD>*?V
<HEAD>*#V:<n>:<v1>.<v2>.<v3>:<d>.<m>.<y>:<loc>
Response Example:
<HEAD>*#V:E-1110:01.00.53:07.02.08:RU
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?V 0x2A 0x3F 0x56 char[3]
*#V 0x2A 0x23 0x56 char[3]
<n> Device model string (6 characters). char[6]
<v1>.<v2>.<v3> Firmware version indexes of 2 characters. char[2]
Accordingly, day, month and year of this firmware version are 2 characters
<d>.<m>.<y> char[2]
each.
<loc> Firmware language version 2 characters (RU, DE, EN). char[2]

Query unique device ID

Query <HEAD>*?S
<HEAD>*#S:<s>
Response Example:
<HEAD>*#S:123456789012345
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?S 0x2A 0x3F 0x53 char[3]
*#S 0x2A 0x23 0x53 char[3]
<s> Identifier string. char[]

Note
This line includes IMEI of the modem, so the modem must be enabled at least once to receive it. When
replacing a modem, the unique identifier changes.

25
 Message with a string of unique device ID,
sent during handshake procedure

Message <HEAD>*>S:<s>
Response <HEAD>*<S
Exchange channel GPRS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*>S 0x2A 0x3E 0x53 char[3]
*<S 0x2A 0x3C 0x53 char[3]
<s> Identifier string. char[]

Note
This line includes IMEI of the modem, so the modem must be enabled at least once to receive it. When
replacing a modem, the unique identifier changes.

Device restart command

Command <HEAD>*!DEV_RESET
Response <HEAD>*@DEV_RESET
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!DEV_RESET 0x2a 0x21 0x44 0x45 0x56 0x5f 0x52 0x45 0x53 0x45 0x54 char[11]
*@DEV_RESET 0x2a 0x40 0x44 0x45 0x56 0x5f 0x52 0x45 0x53 0x45 0x54 char[11]

Arbitrary USSD request

Command <HEAD>*?USSD<s><code>
Response <HEAD>*#USSD<s><string>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?USSD 0x2A 0x3F 0x55 0x53 0x53 0x44 char[6]
*#USSD 0x2A 0x23 0x55 0x53 0x53 0x44 char[6]
<s> Parameter separator - space (0x20). char
<code> USSD code string of the request. char[]
<string> Response string of the cellular operator. char[]

Command of arbitrary sound indication by buzzer

Command <HEAD>*!BEEP<s><count>,<group>,<interval>,<freq>
Response <HEAD>*@BEEP<s><result>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!BEEP 0x2A 0x21 0x42 0x45 0x45 0x50 char[6]
*@BEEP 0x2A 0x40 0x42 0x45 0x45 0x50 char[6]
<s> Parameter separator - space (0x20). char
Command Processing Result (ASCII):
<result> "OK" - commands executed; char[]
"FAIL" - command execution error;
Number of pulses in each pulse group.
<count> char[]
If >=32, sound indication is continuous.
<group> Number of groups in audible indication. char[]

26
 <interval> Duration of the group's sound in 1/128 fractions of a second. char[]
<freq> Frequency of audible indication of each pulse (Hz). char[]

Command to change SIM card

Command <HEAD>*!CHNGSIM
Response <HEAD>*@CHNGSIM<s><x>-><y>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!CHNGSIM 0x2A 0x21 0x43 0x48 0x4E 0x47 0x53 0x49 0x4D char[9]
*@CHNGSIM 0x2A 0x40 0x43 0x48 0x4E 0x47 0x53 0x49 0x4D char[9]
<s> Parameter separator - space (0x20). char
-> Separating characters - 0x2D 0x3E char[2]
Current working SIM card:
<x> "1" - SIM 1 (External), char
"2" - SIM 2 (Internal).
SIM card to switch to:
<y> "1" - SIM 1 (External), char
"2" - SIM 2 (Internal).

Query device status with SMS sending

Upon this request, SMS message M:114 is forwarded to the number specified in it.
Command <HEAD>*?ES<s><phone>
Response <HEAD>*#ES<s><phone>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
<s> Parameter separator - space (0x20). char
*?ES 0x2A 0x3F 0x45 0x53 char[4]
*#ES 0x2A 0x23 0x45 0x53 char[4]
<phone> Phone number (starting from “+”) from which you need to send an SMS. char[]

Query unique SIM serial number

Command <HEAD>*?ICCID
Response <HEAD>*#ICCID<s><id>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
<s> Parameter separator - space (0x20). char
*?ICCID 0x2A 0x3F 0x49 0x43 0x43 0x49 0x44 char[7]
*#ICCID 0x2A 0x23 0x49 0x43 0x43 0x49 0x44 char[7]
<id> Unique SIM serial number char[]

Query information about firmware version of the GPS receiver

Command <HEAD>*?VGPS
Response <HEAD>*#VGPS<s><n>,<v1>.<v2>.<v3>,<d>.<m>.<y>,<gps_ver>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?VGPS 0x2A 0x3F 0x56 0x47 0x50 0x53 char[6]
*#VGPS 0x2A 0x23 0x56 0x47 0x50 0x53 char[6]
<s> Parameter separator - space (0x20). char
<n> Device model string (6 characters). char[6]

27
 <v1>.<v2>.<v3> Device firmware version indexes of 2 characters. char[2]
Accordingly, day, month and year of this version of the device firmware are
<d>.<m>.<y> char[2]
2 characters each.
<gps_ver> String with model and version of navigation receiver char[]

Command for microphone listening

Command <HEAD>*!O<s><phnumber>
Response <HEAD>*@O<s><phnumber>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!O 0x2A 0x21 0x4F char[3]
*@O 0x2A 0x40 0x4F char[3]
<s> Parameter separator - space (0x20). char
<phnumber> - number to be called. Phone number (starting with "+").
<phnumber> char[]

Command for time adjustment on device

Command <HEAD>*!SETTIME<s><offset>
Response <HEAD>*@SETTIME<s><ans>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!SETTIME 0x2A 0x21 0x53 0x45 0x54 0x54 0x49 0x4D 0x45 char[9]
*@SETTIME 0x2A 0x40 0x53 0x45 0x54 0x54 0x49 0x4D 0x45 char[9]
<s> Parameter separator - space (0x20). char
Offset in seconds with a character in text format.
<offset> char
For example: +60 or -30
Response:
<ans> "OK" - "time synchronized"; char
"FAIL" - "synchronization error."

Command for diagnostic information query

<HEAD>*?DATA<s><id1>,<id2>, ... ,<idN>

Command Example:
<HEAD>*?DATA 21,22
<HEAD>*#DATA<s><id1>:<data1>,<id2>:<data2>,...,<idN>:<dataN>
Response Example:
<HEAD>*#DATA 21:0026,22:0000
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?DATA 0x2A 0x3F 0x44 0x41 0x54 0x41 char[6]
*#DATA 0x2A 0x23 0x44 0x41 0x54 0x41 char[6]
<s> Parameter separator - space (0x20). char
Parameter ID in text decimal form.
<idX> 1 .. 255 - parameters correspond to table FLEX 3.0 (Annex A.1. Structure of char[]
FLEX telemetry records)
Value of the parameter in the form of a HEX (ASCII) string with the
<dataX> char[]
BigEndian byte order.

28
 Response to unsupported messages

Response to NTCB
<HEAD>*Z:<msg>
message
Response to FLEX
~Z:<msg><crc8>
message
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*Z: 0x2A 0x5A 0x3A char[3]
~Z: 0x7E 0x5A 0x3A char[3]
Unsupported FLEX or NTCB message is sent back.
For NTCB, entire message is forwarded.
<msg> char[]
For FLEX, first 2 characters after "~" are significant during validation, only
they are sent (if any).
<crc8> FLEX checksum. See Annex B. Checksum calculation algorithm CRC8 U8

29
 2.2. Outputs control
Command to change output state

<HEAD>*!SETOUT<s><num><new_state>[,<num><new_state>]
Command For example:
*!SETOUT 1Y,2N
<HEAD>*@SETOUT<s><result>,<num><cur_state>[,<num><cur_state>]
Response For example:
*@SETOUT OK,1Y,2N или *@SETOUT FAIL,1N,2Y
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!SETOUT 0x2A, 0x21, 0x53, 0x45, 0x54, 0x4F, 0x55, 0x54 char[8]
*@SETOUT 0x2A, 0x40, 0x53, 0x45, 0x54, 0x4F, 0x55, 0x54 char[8]
<s> Parameter separator - space (0x20). char
Command Processing Result (ASCII):
<result> "OK" - commands executed; char[]
"FAIL" - command execution error;
<num> Number of the output to be changed (ASCII). Numbering starts with 1. char
Output state to be set (ASCII):
<new_state> "Y" - enable; char
"N" - disable.
Output status after command execution (ASCII):
<cur_state> "Y" - on; char
"N" - off.

Command to activate output 1

Command <HEAD>*!1Y
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!1Y 0x2A 0x21 0x31 0x59 char[4]
*@C 0x2A 0x40 0x43 char[3]
Telemetry record with a structure dependent on the storage and exchange
<x> -
protocol.

Command to disactivate output 1

Command <HEAD>*!1N
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!1N 0x2A 0x21 0x31 0x4E char[4]
*@C 0x2A 0x40 0x43 char[3]
Telemetry record with a structure dependent on the storage and
<x> -
exchange protocol.

30
 Command to activate output 2

Command <HEAD>*!2Y
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!2Y 0x2A 0x21 0x32 0x59 char[4]
*@C 0x2A 0x40 0x43 char[3]
Telemetry record with a structure dependent on the storage and exchange
<x> -
protocol.

Command to disactivate output 2

Command <HEAD>*!2N
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!2N 0x2A 0x21 0x32 0x4E char[4]
*@C 0x2A 0x40 0x43 char[3]
Telemetry record with a structure dependent on the storage and
<x> -
exchange protocol.

Command to activate output 3

Command <HEAD>*!3Y
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!3Y 0x2A 0x21 0x33 0x59 char[4]
*@C 0x2A 0x40 0x43 char[3]
Telemetry record with a structure dependent on the storage and exchange
<x> -
protocol.

Command to disactivate output 3

Command <HEAD>*!3N
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!3N 0x2A 0x21 0x33 0x4E char[4]
*@C 0x2A 0x40 0x43 char[3]
Telemetry record with a structure dependent on the storage and
<x> -
exchange protocol.

31
 Command to activate output 4

Command <HEAD>*!4Y
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!4Y 0x2A 0x21 0x34 0x59 char[4]
*@C 0x2A 0x40 0x43 char[3]
Telemetry record with a structure dependent on the storage and exchange
<x> -
protocol.

Command to disactivate output 4

Command <HEAD>*!4N
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!4N 0x2A 0x21 0x34 0x4E char[4]
*@C 0x2A 0x40 0x43 char[3]
Telemetry record with a structure dependent on the storage and exchange
<x> -
protocol.

32
 2.3. Inputs control

Command to lock input

Command <HEAD>*!OFF<s><index>
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!OFF 0x2A 0x21 0x4F 0x46 0x46 char[5]
*@C 0x2A 0x40 0x43 char[3]
<s> Parameter separator - space (0x20). char
Index of the input to be locked (starting with 1). The parameter is written
<index> char
in symbolic form: "1"... "9" (0x31 - 0x39).
Telemetry record with a structure dependent on the storage and exchange
<x> -
protocol.

Command to unlock input

Command <HEAD>*!ON<s><index>
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!ON 0x2A 0x21 0x4F 0x4E char[4]
*@C 0x2A 0x40 0x43 char[3]
<s> Parameter separator - space (0x20). char
Index of the input to be unlocked (starting with 1). The parameter is written
<index> char
in symbolic form: "1"... "9" (0x31 - 0x39).
Telemetry record with a structure dependent on the storage and exchange
<x> -
protocol.

33
 2.4. Telemetry commands, queries, messages
FLEX telemetry messages array

Message ~A<size><x[0]-x[size-1]><crc8>
Response ~A<size><crc8>
Exchange channel GPRS
Designations Interpretation Data Format
~A 0x7E 0x41 char[2]
<size> Number of telemetry records transferred in the array U8
The number of parameters passed and the size in bytes corresponds to
<x[0]-x[size-1]> the value in the <bit field[data_size/8+(1)]> field of the FLEX packet. -
The entries follow each other without any separators.
8-bit byte CRC8 ~A characters and fields
<crc8> <size><x[0]-x[size-1]> See Annex B. Checksum calculation algorithm U8
CRC8

Out-of-order FLEX message packet structure

Message ~T<eventindex><x><crc8>
Response ~T<eventindex><crc8>
Exchange channel GPRS
Designations Interpretation Data Format
~T 0x7E 0x54 char[2]
Telemetry record with FLEX structure. The number of parameters passed
<x> and the size in bytes corresponds to the value in the <bit -
field[data_size/8+(1)]> field of the FLEX packet.
<eventindex> Index of the received telemetry record. U32
8-bit byte CRC8 ~T characters and fields
<crc8> <size><x[0]-x[size-1]> See Annex B. Checksum calculation algorithm U8
CRC8

FLEX state packet structure

Message ~С<x><crc8>
Response ~С<crc8>
Exchange channel GPRS
Designations Interpretation Data Format
~ 0x7E 0x43 char[2]
Telemetry record, with FLEX structure. The number of parameters passed
<x> and the size in bytes correspond to the value in the <bit -
field[data_size/8+(1)]> field of the FLEX packet.
8-bit byte CRC8 ~T characters and fields
<crc8> <size><x[0]-x[size-1]> See Annex B. Checksum calculation algorithm U8
CRC8

Array of additional FLEX telemetry messages

Message ~E<count><x[0]-x[count-1]><crc8>
Response ~E<count><crc8>
Exchange channel GPRS
Designations Interpretation Data Format
<count> Number of telemetry records transferred in the array U8
Array of additional telemetry records. Records follow each other without any
<x[0]-x[size-1]> -
separators.
8bit byte CRC8 ~E characters <count><x[0]-x[count-1]> See Annex B.
<crc8> U
Checksum calculation algorithm CRC8

34
 Structure of additional out-of-order FLEX message packet

Message ~X<eventindex><x><crc8>
Response ~X<eventindex><crc8>
Exchange channel GPRS
Designations Interpretation Data Format
<x> Additional telemetry record. -
<eventindex> Index of the received telemetry record. U32
8bit byte CRC8 ~X characters <count><x[0]-x[count-1]> See Annex B.
<crc8> U8
Checksum calculation algorithm CRC8

Query the nearest telemetry record before the specified date

Query <HEAD>*?L<h><mn><s><d><m><y>
Response <HEAD>*#L<h><mn><s><d><m><y><page><x>
Exchange
GPRS, USB, Bluetooth
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?L 0x2A 0x3F 0x4C char[3]
*#L 0x2A 0x23 0x4C char[3]
<h><mn><s><d> Hour, minute, second, day, month, year of the event record.
U8 (of each field)
<m><y> If h=m=s=d=m=y=0, record with a minimum number is searched.
<page> Page number of the non-volatile memory on which the record is stored. U32
Telemetry record, with a structure dependent on the storage and exchange
<x> -
protocol.

Query the nearest telemetry record after the specified date

Query <HEAD>*?R<h><m><s><d><m><y>
Response <HEAD>*#R<h><min><s><d><m><y><page><x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?R 0x2A 0x3F 0x52 char[3]
*#R 0x2A 0x23 0x52 char[3]
<h><mn><s><d> Hour, minute, second, day, month, year of the event record.
U8 (of each field)
<m><y> If h=m=s=d=m=y=255, record with a maximum number is searched.
<page> Page number of the non-volatile memory on which the record is stored. U32
<x> Telemetry record, structure depends on the protocol. -

Query telemetry record by its index

Query <HEAD>*?I<index>
Response <HEAD>*#I<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?I 0x2A 0x3F 0x49 char[3]
*#I 0x2A 0x23 0x49 char[3]
<index> Absolute index of the record in the non-volatile memory. U32
<x> Telemetry record, structure depends on the protocol. -

35
 Command to confirm synchronization of internal memory with the server

Command <HEAD>*!SYNC<s><index>
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!SYNC 0x2A 0x21 0x53 0x59 0x4E 0x43 char[6]
*@C 0x2A 0x40 0x43 char[3]
<s> Parameter separator - space (0x20) or colon (0x3A). char
Server index specified in the device settings (starting from 1). The record
<index> U8 / char
is binary - 0x01 or symbolic (ASCII) - "1."
<x> Telemetry record, structure depends on the protocol. -

Note
This command is issued when data has been removed from the device bypassing the GPRS algorithm (for
example, via USB), and is sent in order to cancel the subsequent transfer according to the main operation
algorithm.

Query current state of the device in the main packet

Query <HEAD>*?A
Response <HEAD>*#A<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?A 0x2A 0x3F 0x41 char[3]
*#A 0x2A 0x23 0x41 char[3]
<x> Main telemetry record, structure depends on the protocol. -

Query current state of the device in the additional packet

Query <HEAD>*?E<s><type>
Response <HEAD>*#E<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?E 0x2A 0x3F 0x45 char[3]
*#E 0x2A 0x23 0x45 char[3]
<s> Parameter separator - space (0x20). char[1]
Type of the dynamic part of the additional packet:
‘1’ – TouchKey
<type> char[1]
"2" - not used
‘3’ - RFID
Additional telemetry record, structure depends on the protocol (see Annex
<x> -
A.2. Structure of additional FLEX 2.0 telemetry records)

36
 Command to resend telemetry from non-volatile memory

<HEAD>*!REP_FL<s><srvindex>,<leftdate>[/<lefttime>],<rightdate>[/<righttime>]
Example:
Command
<HEAD>*!REP_FL 1,09.04.18/13:00:59,10.04.18/03:00:00
<HEAD>*!REP_FL 1,09.04.18,10.04.18
Response <HEAD>*@REP_FL<s><result>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!REP_FL 0x2A 0x21 0x52 0x45 0x50 0x5F 0x46 0x4C char[8]
*@REP_FL 0x2A 0x40 0x52 0x45 0x50 0x5F 0x46 0x4C char[8]
<s> Parameter separator - space (0x20). char
/ Date/Time field separator (0x2F) char
Command processing result (ASCII):
<result> "OK" - commands executed; char[]
"FAIL" - command execution failed.
Server index to repeat in text format:
<srvindex> "0" - to all servers; char
"1.." "3" –server index.
Date of the left border of the interval of the requested telemetry in
<leftdate> char[8]
text format (in UTC): "DD.MM.YY."
Optional parameter.
Time of the left border of the interval of the requested telemetry in
<lefttime> char[8]
text format (in UTC) is "HH: MM: SS
Absence of a parameter is equal to the value "00:00:00."
Date of the right border of the interval of the requested telemetry in
<rightdate> char[8]
text format (in UTC): "DD.MM.YY."
Optional parameter.
Time of the right border of the requested telemetry interval in text
<righttime> char[8]
format (in UTC) is "HH: MM: SS
Absence of a parameter is equal to the value "23:59:59."

37
 Command to resend telemetry from SD card

<HEAD>*!REP_SD<s><srvindex>,<leftdate>[/<lefttime>],<rightdate>[/<righttime>]
Example:
Command
< HEAD > *! REP _ SD 1.09.04.18/13: 00: 59.10.04.18/03: 00:00 (time will not be
< HEAD > *! REP _ SD 1.09.04.18. 10.04.18 (only 09.04.18 will be unloaded
Response <HEAD>*@REP_SD<s><result>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!REP_SD 0x2A 0x21 0x52 0x45 0x50 0x5F 0x53 0x44 char[8]
*@REP_SD 0x2A 0x40 0x52 0x45 0x50 0x5F 0x53 0x44 char[8]
<s> Parameter separator - space (0x20). char
/ Date/Time field separator (0x2F) char
Command processing result (ASCII):
<result> "OK" - commands executed; char[]
"FAIL" - command execution failed.
Server index to repeat in text format:
<srvindex> "0" - to all servers; char
"1.." "3" – server index.
Date of the left border of the interval of the requested telemetry in
<leftdate> char[8]
text format (in UTC): "DD.MM.YY."
Device does not parse the parameter.
Always equates to "00:00:00."
<lefttime> char[8]
Time of the left border of the interval of the requested telemetry in
text format (in UTC) is "HH: MM: SS
Ddate of the right border of the interval of the requested telemetry in
<rightdate> char[8]
text format (in UTC): "DD.MM.YY."
Device does not parse the parameter.
Always equates to "00:00:00."
<righttime> char[8]
Time of the right border of the requested telemetry interval in text
format (in UTC) is "HH: MM: SS

38
 2.5. Device operating modes control
Сommand to enable security mode

Command <HEAD>*!GY
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!GY 0x2A 0x21 0x47 0x59 char[4]
*@C 0x2A 0x40 0x43 char[3]
<x> Telemetry record -

Command to disable security mode

Command <HEAD>*!GN
Response <HEAD>*@C<x>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!GN 0x2A 0x21 0x47 0x4E char[4]
*@C 0x2A 0x40 0x43 char[3]
<x> Telemetry record -

39
 Command to change device operating mode

Command <HEAD>*!M<s><x>
<HEAD>*@M<s><x>,<e>,<i>
Example:
Response
*@M G
*@M O,5,IN1/IN2/ENG
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!M 0x2A 0x21 0x4D char[3]
*@M 0x2A 0x40 0x4D char[3]
<s> Parameter separator - space (0x20). char
Operating mode of the device to be switched to:
"G" - security;
<x> char
"O" - surveillance.
Response <x> is the current operating mode.
Reason for not switching to security mode:
"1" - security mode in the device configuration is disabled;
"2" - timeout of the mode change prohibition has not expired;
"3" - mode is on: do not switch to the security mode when the ignition is
<e> char
on;
"4" - device is already in this mode;
"5" - mode is on: do not go into security if one of the security sensors is
triggered.
Only if <e> = 5
Aliases of trigerred sensors via /.
For S-25xx, S-23xx devices:
"IN1," "IN2," "IN3," "IN4," "AIN1," "AIN2" - inputs;
"VOLT" - external supply voltage sensor;
<i> char[]
"ENG" - engine operation sensor.
For S-26xx, S-24xx devices:
"IN1," "IN2," "IN3," "IN4," "IN5," "IN6" - inputs;
"VOLT" - external supply voltage sensor;
"ENG" - engine operation sensor.

Query current operating mode

Command <HEAD>*?M
Response <HEAD>*#M<s><x>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?M 0x2A 0x3F 0x4D char[3]
*#M 0x2A 0x23 0x4D char[3]
<s> Parameter separator - space (0x20). char
Device operating mode:
<x> "G" - security; char
"O" - surveillance.

40
 2.6. Connection to RCS, RFU, DRC services
Device is connected to RCS, RFU servers by sending corresponding commands via SMS channels (5.2.5
RCS, RFU, DRC services) or GPRS.

RCS Remote Configuration Service is designed to provide information interaction between the NTC
Configurator and the device via GPRS to change its configuration, update frimware and read telemetry
from the device. RCS service is a router server that provides information exchange between the device
and the program running on it on the PC. Switching occurs by the unique ID (session ID) of this router,
which receives the program that opens the connection to this service. The identifier is passed to the device.

Command to connect to the configurator via RCS

<HEAD>*!CNCT_RCS<s><ip>,<port>,<commID>,<apn>,<login>,<password>
Command or (for backward compatibility)
<HEAD>*!CNCT_RCS:<ip>:<port>:<commID>:<apn>:<login>:<password>
Response <HEAD>*@C<x>
Exchange
GPRS, USB, Bluetooth
channel
Designations Interpretation Data Format
<HEAD> 16-byte NTCB packet header U8[16]

*!CNCT_RCS 0x2A 0x21 0x43 0x4E 0x43 0x54 0x5F 0x52 0x43 0x53 char[10]

*@C 0x2A 0x40 0x43 char[3]

<s> Parameter separator - space (0x20). char
char[]
String containing the IP address of the RCS server.
<ip> minimum 7,
For example: 89.208.152.55.
maximum 15
String containing the port on which the RCS service on the server is routed. char[]
<port>
For example: 8100. maximum 5
Session ID to connect to the configurator. char[]
<commID>
For example: 43644176. maximum 8
Optional parameter.
Access point name of the cellular operator. If the field in the cellular operator char[]
<apn>
settings is empty, the field should be omitted. maximum 30
For example: internet.mts.ru.
Optional parameter.
Login of the cellular operator. If the field in the cellular operator settings is char[]
<login>
empty, the field should be omitted. maximum 20
For example: mts.
Optional parameter.
Password of the cellular operator. If the field in the cellular operator settings is char[]
<password>
empty, the field should be omitted maximum 20
For example: mts.
Telemetry record, with a structure dependent on the storage and exchange
<x> U8[]
protocol.

RFU service is designed to automatically change the firmware in the device. Device connects to the RFU
server by command: via SMS channel (5.2.5 RCS, RFU services) or GPRS.
Principle of operation of the device with the RFU server is as follows: first, device is remotely connected,
then device downloads a new version of the program from the server. Then it reboots, then the work is
carried out on the new version of the program.

41
 Command to update device firmware via RFU

<HEAD>*!CNCT_RFU<s><ip>,<port>,<firmware>,<apn>,<login>,<password>
Command or (for backward compatibility)
<HEAD>*!CNCT_RFU:<ip>:<port>:<firmware>:<apn>:<login>:<password>
Response <HEAD>*@C<x>
Exchange
GPRS, USB, Bluetooth
channel
Designations Interpretation Data Format
<HEAD> 16-byte NTCB packet header U8[16]

*!CNCT_RFU 0x2A 0x21 0x43 0x4E 0x43 0x54 0x5F 0x52 0x46 0x55 char[10]

*@C 0x2A 0x40 0x43 char[3]

<s> Parameter separator - space (0x20). char
char[]
String containing the IP address of the RCS server.
<ip> minimum 7,
For example: 89.208.152.55.
maximum 15
String containing the port on which the RCS service on the server is routed. char[]
<port>
For example: 9100. maximum 5
Requested firmware version.
char[]
<firmware> For example: 02.01.00.
maximum 8
If the latest version is needed, the keyword "LAST is used.
Optional parameter.
Access point name of the cellular operator. If the field in the cellular operator char[]
<apn>
settings is empty, the field should be omitted. maximum 30
For example: internet.mts.ru.
Optional parameter.
Login of the cellular operator. If the field in the cellular operator settings is char[]
<login>
empty, the field should be omitted. maximum 20
For example: mts.
Optional parameter.
Password of the cellular operator. If the field in the cellular operator settings is char[]
<password>
empty, the field should be omitted maximum 20
For example: mts.
Telemetry record, with a structure dependent on the storage and exchange
<x> U8[]
protocol.

After receiving the RCS and RFU commands, device generates and transmits response to the telematic
server, and then breaks communication with the telematic server and establishes communication with the
corresponding RCS and RFU server. Only request packets are used when the device is connected to the
RFU service. When connecting to the RCS service, only packet to establish communication is sent. Further,
device works the same way as via the USB interface.

DRC service is designed for remote device management.

Devices with a user-defined period or command are connected to the DRC.
When device connects to the service, it checks the task queue for the device. If the task queue is empty,
then the service disconnects the device, if there are tasks in the queue, then they are executed one by
one (in the order of creation). Tasks queued but not completed can be canceled (deleted) by the user.

42
 Command to connect to DRC

<HEAD>*!CNCT_DRC[<s><time>,<ip>,<port>]
Example:
Command
*!CNCT_DRC
*!CNCT_DRC 300,89.208.152.54,10000
Response <HEAD>*@CNCT_DRC<s><ack>
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16-byte NTCB packet header U8[16]

*!CNCT_DRC 0x2A 0x21 0x43 0x4E 0x43 0x54 0x5F 0x44 0x52 0x43 char[10]

*@CNCT_DRC 0x2A 0x40 0x43 0x4E 0x43 0x54 0x5F 0x44 0x52 0x43 char[10]
(optional) char[]
<time>
Time, in seconds, for which the device is connected.
(optional)
IP or DNS of the DRC service.
<ip> char[]
If not specified, device uses the server IP address hard-coded in the
firmware.
(optional)
<port> PORT of the DRC service. char[]
If not specified, device uses the server port hard-coded in the firmware.
Confirmation of command reception:
<ack> char[]
OK - command is accepted for execution.

43
 2.7. Working with identifiers
Among other telemetry data, server may receive data about the attached Touch Memory keys. When such
a key is applied to the Touch Memory reader, its number and current read time are written to the non-
volatile memory of the system, and then this message is transmitted to the server. This packet has a
higher priority than sending telemetry records array or the current state, but a lower priority than an out-
of-order message.

NTCB packet structure of sending unregistered Touch Memory key

Message <HEAD>*>TMKEY<datetime>:<code>
Response from
<HEAD>*<TMKEY
the server
Exchange channel GPRS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*>TMKEY 0x2A 0x3E 0x54 0x4D 0x4B 0x45 0x59 char[7]
*<TMKEY 0x2A 0x3C 0x54 0x4D 0x4B 0x45 0x59 char[7]
Event time (record generation) on the device.
Time and date of fixing the event:
Hour 0 – 23
Minute 0 –59
<datetime> Second 0 – 59 U8 U8 U8 U8 U8 U8
Day 1–1
Month 0–1
Year 0 – 255 (since 2000)

Applied TM device ID in its entirety without device type and without

<code> U64
checksum.

When using the FLEX 2.0 or FLEX 3.0 protocol, key codes, driver cards, RFID tags are sent only in the
form of additional telemetry records. See Annex A.2. Structure of additional FLEX 2.0 telemetry records.

Keys registered in the device are transmitted in telemetry packets as an event indicating the number of
the slot in the configuration where the corresponding key is written.
See events 0x1900 - 0x2040 in the “Telematic event codes table” file.

Query code of the last Touch Memory key read by the device

Query <HEAD>*?TM
Response <HEAD>*#TM<key>
Exchange
GPRS, USB, Bluetooth
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?TM 0x2A 0x3F 0x54 0x4D Char[4]
*#TM 0x2A 0x23 0x54 0x4D Char[4]
<key> Key code and checksum is zero when the key was not read. U64

44
 Query the last active radio tag

Query <HEAD>*?ERFT
Response <HEAD>*#ERFT<ID><pwr>
Exchange
GPRS, USB, Bluetooth
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?ERFT 0x2a 0x3f 0x45 0x52 0x46 0x54 6*U8
*#ERFT 0x2a 0x23 0x45 0x52 0x46 0x54 6*U8
ID Radio tag ID U64 (little-endian)
pwr Radiometer signal power in dBm S8

Command to edit the list of registered Touch Memory keys

ATTENTION!
List with theTouch Memory key parameters must be loaded into the device in advance. Only one key can
be edited at a time.

Command <HEAD>*!SETTM<s><num>,<addr>,<mode>
Response <HEAD>*@SETTM<s><res>[,<code>]
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!SETTM 0x2A 0x21 0x53 0x45 0x54 0x54 0x4D char[7]
*@SETTM 0x2A 0x40 0x53 0x45 0x54 0x54 0x4D char[7]
<s> Parameter separator - space (0x20). char
<num> Key number in the configuration: 1-510. char[]
<addr> Key address (12 characters). char[12]
Key operating mode:
"NOACT" - no action;
<mode> char[]
"GUARD" - changes the security mode;
"IMMOB" - immobilizer.
Command execution result:
<res> "OK" - command was executed successfully; char[]
"FAIL" - command failed, error.
Additional error code (optional):
"1" - module is busy;
<code> "2" - incorrect TM key number; char
"3" - no parameters;
"4" - incorrect operating mode.

45
Sending a command causes device to reboot
Command: ~O<module><id><msg_length><message><crc8>
Negative response ~F<module><command><result><crc8>
Positive response ~R<module><command><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~O 0x7E 0x4F 2*U8
~F 0x7E 0x46 2*U8
~R 0x7E 0x52 2*U8
Module ID:
<module> U8
0x7D - settings editor.
Command Code:
<command> U8
4 – command to edit Touch Memory keys.
<msg_length> Length of the message. Up to and including 139 characters. U8 (little-endian)
Text message in CP1251 encoding. No terminal zero is required at the
end of the message.
Content: <num><sp><address><sp><mode><nick_name>
Decryption:
<sp> - space;
<num> - number of the key in the configuration (2 characters always, 1-
<message> 16, for example "01"); <msg_length>*U8
<address> - key address (16 characters);
<mode> - key operation mode (5 characters);
"NOACT" - no action;
"GUARD" - changes the security mode;
"IMMOB" - "immobilizer";
<nick_name> - key alias (10 characters).
Command Result Code:
0x20 - error: parameters are not set;
0x21 - error in parameter No. 1
0x22 - error in parameter No. 2
0x23 - error in parameter No. 3
<result> U8
0x24 - error in parameter No. 4
0x25 - error in parameter No. 5
0x26 - error in parameter No. 6
0x27 - error in parameter No. 7
0x28 - error in parameter No. 8
<crc8> FLEX checksum. See Annex B. Checksum calculation algorithm CRC8. U8

46
 2.8. Working with tachographs

2.8.1. Control commands and queries

Obtaining information that is not recorded in telemetry and uploading DDD files is carried out using
commands and requests using the FLEX 2.0 protocol. Information about the number of the inserted driver
card is transmitted to the server in additional FLEX 2.0 telemetry packets, see Annex A.2. Structure of
additional FLEX 2.0 telemetry records.

Information queries:
1. Query information on the current state of the tachograph;
2. Query information on card No. 1
3. Query information on card No. 2
4. Query registration information.

Control commands:
1. Device authorization in the tachograph;
2. Setting a new device authorization key in the tachograph;

Query the current state of the tachograph

Query ~Q<module><query><crc8>
~I<module><query><time><state><cards_state><drivercard1><drivercard2>
Positive response <mileageTRIP><voltage><drv1AT><drv1DT><drv1CT><drv1RT><drv2AT>
<drv2DT><drv2CT><drv2RT><crc8>
Negative
~U<module><query><result><crc8>
response
Exchange channel GPRS
Designation Interpretation Data Format
~Q 0x7E 0x51 2*U8
~I 0x7E 0x49 2*U8
~U 0x7E 0x55 2*U8
Module ID:
<module> U8
0x81 - tachograph
Request ID:
<query> U8
0x00 - query information about the current state of the tachograph
<time> Tachograph time in Unix time format U32 (little-endian)
CIPF operation mode:
Bits Description Values
Tachograph
0…3 Depends on tachograph
<state> operation mode U8
CIPF operation
4…7 Depends on tachograph
mode

Status of cards:
Bits Description Values
Status of card 0 = no card, 1 = not authorized, 2 = authorized,
0…3
<cards_state> No. 3 = unable to U8
0 = no card, 1 = not authorized, 2 = authorized,
4…7 Status of card
3 = unable to

Card type No. 1 and driver activity No. 1:

<drivercard1> U8
Bits Description Values

47
 0…3 Driver activity 0 = rest, 1 = availability, 2 = work, 3 =
0 = No card; 1 = driver; 2 = Master; 3 =
4…7 Card Type
Inspector; 4 = Enterprise

Card type No. 2 and driver activity No. 2 (see Card type No. 1 and driver
<drivercard2> U8
activity No.1)
<mileageTRIP> TRIP distance 0.005 km U32 (little-endian)
<voltage> On-board power system voltage 0.2 V U8
<drv1AT> Time spent by driver No. 1 in the current mode (minutes) U16 (little-endian)
<drv1DT> Total driving time of driver No. 1 per day (minutes) U16 (little-endian)
<drv1CT> Continuous driving time of driver No. 1 (minutes) U16 (little-endian)
<drv1RT> Cumulative break times for driver No. 1 (minutes) U16 (little-endian)
<drv2AT> Time spent by driver No. 2 in the current mode U16 (little-endian)
<drv2DT> Total driving time of driver No. 2 per day (minutes) U16 (little-endian)
<drv2CT> Continuous driving time of driver No. 2 (minutes) U16 (little-endian)
<drv2RT> Cumulative break times for driver No. 2 (minutes) U16 (little-endian)
<result> Command execution result code U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8. U8

Query information on cards No. 1 and No. 2

Query ~Q<module><query><crc8>
~I<module><query><type_state><reserved1><issuing><number><reserved2><cp1><text1
Positive response
><cp2><text2><cp3><text3><cp4><text4><crc8>
Negative response ~U<module><query><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~Q 0x7E 0x51 2*U8
~I 0x7E 0x49 2*U8
~U 0x7E 0x55 2*U8
Module ID:
<module> U8
0x81 - tachograph
Request ID:
<query> 0x01 - request for information on card No. 1 U8
0x02 - request for information on card No. 2
Card status and type:
Bits Description Values
0 = no card, 1 = not authorized, 2 =
0…3 Map Status
<type_state> authorized, 3 = unable to U8
0 = No card; 1 = driver; 1 = Master; 2 =
4…7 Card Type
Inspector; 3 = Enterprise

<reserved1> Authentication type (reserve = 0) U8

<issuing> Country code (Russia - 0x2B) U8
<number> Card number (for example, "RUD1000002718000") 16*U8
<reserved2> Card validity period (reserve = 0) U32 (little-endian)
<cp1> ISO 8859 code page number in which string No.1 is transmitted U8
<cp2> ISO 8859 code page number in which string No.2 is transmitted U8
<cp3> ISO 8859 code page number in which string No.3 is transmitted U8
<cp4> ISO 8859 code page number in which string No.4 is transmitted U8
<text1> String No.1 35*U8
<text2> String No.2 35*U8

48
 <text3> String No.3 35*U8
<text4> String No.4 35*U8
<result> Command execution result code U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8. U8

Query registration information

Query ~Q<module><query><crc8>
~I<module><query><version><vin><nation><vrn_cp><vrn><reserved1><speed_limit><ne
Positive response
xt_calib><activation><expiry><serial><reg_no><crc8>
Negative response ~U<module><query><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~Q 0x7E 0x51 2*U8
~I 0x7E 0x49 2*U8
~U 0x7E 0x55 2*U8
Module ID:
<module> U8
0x81 - tachograph
Request ID:
<query> U8
0x03 - request for registration information of the vehicle and tachograph.
<version> Tachograph version in text representation 32*U8
<vin> Vehicle identification number (VIN). 17*U8
<nation> Code of the country in which the vehicle is registered (Russia - 0x2B) U8
Code page ISO 8859, which contains the registration number of the
<vrn_cp> U8
vehicle
<vrn> Vehicle registration number. 13*U8
<reserved1> Reserve = 0 2*U8
<speed_limit> Vehicle speed limit (km/h) U8
<next_calib> Next tachograph calibration time (Unix time) U32 (little-endian)
<activation> CIPF activation time (Unix Time) U32 (little-endian)
<expiry> CIPF activation end time (Unix time) U32 (little-endian)
<serial> CIPF serial number 16*U8
<reg_no> CIPF registration number 16*U8
<result> Command execution result code U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8. U8

49
 Device authorization in the tachograph

Command ~O<module><command><login><psswrd><crc8>
Positive response ~R<module><command><crc8>
Negative response ~F<module><command><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~O 0x7E 0x4F 2*U8
~R 0x7E 0x52 2*U8
~F 0x7E 0x46 2*U8
Module ID:
<module> U8
0x81 - tachograph
Command code:
<command> U8
0x00 - Authorization:
<login> User ID. 3*U8
<psswrd> Password. 16*U8
<result> Command execution result code U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8. U8

Setting a new device authorization key in the tachograph

Command ~O<module><command><old_login><old_psswrd><new_login><new_psswrd><crc8>
Positive response ~R<module><command><crc8>
Negative response ~F<module><command><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~O 0x7E 0x4F 2*U8
~R 0x7E 0x52 2*U8
~F 0x7E 0x46 2*U8
Module ID:
<module> U8
0x81 - tachograph
Command Code:
<command> U8
0x01 - set a new authorization key:
<old_login> Old user ID. 3*U8
<old_psswrd> Old password. 16*U8
<new_login> New User ID. 3*U8
<new_psswrd> New Password. 16*U8
<result> Command execution result code U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8. U8

50
 2.8.2. Generating and transferring DDD file to the server

Device supports generation of an unloading file (DDD file) containing information on the activities of drivers
and operation of the vehicle from a tachograph.
To start generation of a DDD file, device is sent a corresponding command, which indicates type of file,
the slot number in which the card is installed and additional parameters, if necessary. It is possible to
generate a DDD file with automatic sending to the e-mail specified in the device settings.

Command to start DDD file generation

Command ~O<module><command><type><param><crc8>
~ R < module > < command > < size > < crc8 > (see
Positive response
~R<module><command><size><fn_len><fn><crc8>
Negative response ~F<module><command><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~O 0x7E 0x4F 2*U8
~R 0x7E 0x52 2*U8
~F 0x7E 0x46 2*U8
Module ID:
<module> U8
0x81 - tachograph
Command Code:
<command> 0x02 - generation of the upload file; U8
0x03 - generation of the upload file with sending to email.
Type of file to be generated:
0x00 -tachograph (overview);
0x01 -tachograph (activity as of the specified date)
<type> 0x02 -tachograph (events and faults) U8
0x03 -tachograph (speed mode details)
0x04 - tachograph (technical data)
0x05 - tachograph (unloading data from the card)
Parameter depending on the type of file being generated:
- tachograph (activity on the specified date): date in UNIX format time.

- tachograph (data unloading from the card):

Bits Description Values
<param> 0x01 - slot No. 1 U32 (little-endian)
0 Slot number
0x02 - Slot #
1…3 Mask for elementary files Reserve = 0xFFFFFF

Note: Files with codes 0x00... 0x04 are service. Therefore, on some
tachographs and for the driver's card, their unloading is impossible
<fn_len> Standard file name length for DDD file up to and including 74 bytes U8
<fn> Default name for DDD file (no "\0 "at end) <fn_len>*U8
<result> Command execution result code U8
<size> Size of the generated upload file U32 (little-endian)
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8. U8

Note: Devices with older firmware versions (up to 06.10.00) can send an abbreviated response to the
command to start generating a DDD file that does not contain the standard name for the generated DDD
file (~R module><command><size<crc8>).

Downloading a DDD file takes an average of no more than 10 minutes. The size of the downloaded file
does not exceed 64 KB. The downloaded file is stored in the internal memory of the device. If the device
repeatedly receives a command to start generating a DDD file within 30 minutes from the moment of its
51
last generation, it will not download it from the tachograph again, but uses the file previously saved in
non-volatile memory.

Note: Non-volatile memory for storing the DDD file will be automatically cleared in the following cases
(will download the file again when requesting device generation):
- if device recorded the removal of the card from the tachograph (Important! Card withdrawal is
controlled not by the state of the tachograph, but by the disappearance of the card code).
- after updating device firmware (due to the fact that one address space is used to store the DDD file and
the temporary firmware file).
- after accident file is generated (due to the fact that one address space is used to store the DDD file and
accident file).

DDD file transfer is carried out by blocks of arbitrary length at the initiative of the server. The server
alternately requests data blocks using an appropriate request, monitors their integrity and transmission
order. In each request, the server must specify the number of bytes to read from the DDD file and the
offset from its startwhich reading begins. In response, the device sends a block of data indicating the
number of bytes that have been read from the file. The maximum block size that a device can transmit at
a time is 960 bytes. If the data block was not received by the server, it is possible to request the block
again with the same offset and the number of bytes. The file transfer is considered complete when the
device sends a block of filewhich the read number of bytes will be 0.

Query DDD file block

Command ~G<module><get_idx><offset><size_need><crc8>
Positive response ~D<module><get_idx><offset><size_read><data><crc8>
Negative response ~L<module><get_idx><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~G 0x7E 0x47 2*U8
~D 0x7E 0x44 2*U8
~L 0x7E 0x4C 2*U8
<module> 0x81 - tachograph U8
Request ID:
<get_idx> U8
0x00 - query DDD file block
<offset> Offset from the beginning of the DDD filebytes. U32 (little-endian)
<size_need> Number of bytes to read. U16 (little-endian)
Number of data read in bytes.
<size_read> Read block size may be different from the requested block size, but only U16 (little-endian)
downward.
<data> Data block <size_read>*U8
<result> Command execution result code U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8. U8

In general, procedure for generating and transferring a DDD file to the server can be represented by the
following diagram

52
 Server Device Tachograph

Command to start generating

DDD file

Server response. Generating DDD file

File size 300 bytes *.

Query block of data.

Offset 0, size 200 *.

Transferring block of data.

Offset 0, size 200 *.

Transferring block of data.

Offset 200, size 100 *.

Transferring block of data.

Offset 300. Size 0. *
Transfer completed.

2.8.3. Command and query result codes

Code Description
0x10 command cannot be executed because the previous command has not been completed.
0x20 unknown command/query
0x21 incorrect parameters are specified in the command (for the command to change the authorization key)
0x30 device is not configured to work with tachograph
0x31 no connection with tachograph
0x32 upload file not generated
0x33 failed to log in to the tachograph
0x34 error saving/reading data from non-volatile memory
0x35 DDD generation: trequest contains incorrect parameters (date, card number)
0x36 DDD generation: tachograph cannot generate file in current operating mode
0x37 DDD generation: unsupported file type
0x38 DDD generation: no data to generate file
0x39 DDD Generation error receiving file from tachograph
0x3A DDD generation: generation aborted (when updating device firmware)
0x3B DDD generation: file has incorrect structure (failed to generate filename)
0x3C failed to send file to e-mail
0x70 confirmation of command receipt (for command of upload file generation)

53
 2.9. Working with driver display
Command to send message to driver display via FLEX protocol via GPRS

Command ~O<module><id><index><confirm><msg_length><message><crc8>
Positive response ~R<module><id><crc8>
Negative response ~F<module><id><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~O 0x7E 0x4F 2*U8
~F 0x7E 0x46 2*U8
~R 0x7E 0x52 2*U8
Module ID:
<module> U8
0x82 - driver display DV-01
Command code:
<id> U8
0 - sending a message to the driver.
Reserved space for the index assigned to the message by the server (not
<index> U32 (little-endian)
used at this stage and equal to 0xFFFFFFFF)
Symbol that determines whether confirmation of message reception is
required:
<confirm> U8
! (0x21) - confirmation required,
Other characters - no confirmation required.
<msg_length> Length of the message. Up to and including 139 characters. U8 (little-endian)
Text message to the driver in CP1251 encoding. No terminal zero is
<message> <msg_length>*U8
required at the end of the message.
Command execution result code:
0x01 - command was executed, but the message was truncated due to
exceeding the maximum length;
<result> 0x10 - device has not yet transmitted the previous message to the display; U8
0x20 - message length is 0;
0x30 - device is not configured to work with the display;
0x31 - no connection to the display.
<crc8> FLEX checksum. See Annex B. Checksum calculation algorithm CRC8 U8

Command to send message to driver display via NTCB protocol via GPRS

Command <HEAD>*!DV<index><confirm><message>
Response <HEAD>*@DV<result>
Exchange
GPRS, USB, Bluetooth
channel
Designation Interpretation Data Format
<HEAD> 16-byte NTCB header 16*U8
*!DV 0x2A 0x21 0x44 0x56 4*U8
*@DV 0x2A 0x40 0x44 0x56 4*U8
Reserved space for the index assigned to the message by the server
<index> U32
(not used at this stage and equal to 0xFFFFFFFF)
A symbol that determines whether confirmation of message reception is
required:
<confirm> U8
! (0x21) - confirmation required,
Other characters - no confirmation required.
Text message to the driver in CP1251 encoding and up to 139 N*U8,
characters inclusive. No terminal zero is required at the end of the N is the message length
<message>
message. (calculated from the
transport layer header)
<result> Command execution result code: U8

54
0x01 - command was executed, but the message was truncated due to
exceeding the maximum length;
0x10 - device has not yet transmitted the previous message to the
display;
0x20 - message length is 0;
0x30 - device is not configured to work with the display;
0x31 - no connection to the display.

55
 2.10. Working with autoinformer

Working with autoinformer is carried out using the NTCB protocol. Notification of events in geozones is
transmitted only via USB when the corresponding setting is turned on. Alerts can be used to interact with
a mobile application.

Autoinformer Control Command

This command is used both when working via USB and when working via GPRS.

Command <HEAD>*!AINF<code><data>
Response <HEAD>*@AINF<code><cop>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!AINF 0x2A 0x21 0x41 0x49 0x4E 0x46 char[6]
*@AINF 0x2A 0x40 0x41 0x49 0x4E 0x46 char[6]
Command code:
0x01 - change of the current route;
<code> U8
0x02 - starts playback of the sound file;
0x03 - change of the current movement mode.
Command dependent data:
- change of the current route: route identifier;
<data> U16
- start sound file playback: sound file ID;
- change of the current driving mode: ID of the driving mode.
Parameter indicatingsuccess of the command. Takes the following
meanings:
0x00 - command was executed successfully;
0x01 - command was executed, but the settings could not be updated
(for route change commands and movement mode);
0x10 - command cannot be executed because execution of the previous
command is not completed;
<cop> 0x20 - unknown command (for command codes greater than 0x03); U8
0x30 - route cannot be loaded (not in the correct format);
0x31 - failed to load route (route not listed)
0x32 - failed to play sound file;
0x33 - sound file not found;
0x34 - failed to set motion mode (mode not found in the list);
0x35 - failed to load geofence list.

There are text analogues for the specified command:

Command to change the route

Command <HEAD>*!AINF:<number><char>
Response <HEAD>*@AINF:<result>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!AINF 0x2A 0x21 0x41 0x49 0x4E 0x46 0x3A char[7]
*@AINF 0x2A 0x40 0x41 0x49 0x4E 0x46 0x3A char[7]
<number> Route number in text view cp1251
<char> Letter of route cp1251
Alphabetic code of the command execution result:
"S0" (0x53 0x30) - command executed successfully;
"S1" (0x53 0x31) - command was executed, but the settings could not
<result> char[2]
be updated (for route change commands and movement mode);
"B0" (0x42 0x30) - command cannot be executed because the execution
of the previous command is not completed;

56
 "E0" (0x45 0x30) - route cannot be loaded (incorrect format);
"E1" (0x45 0x30) - failed to load route (route not listed)
"E5" (0x45 0x30) - failed to load geofence list.

Command to playback sound file

Command <HEAD>*!AINF!<soundid>
Response <HEAD>*@AINF!<result>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!AINF! 0x2A 0x21 0x41 0x49 0x4E 0x46 0x3A 0x21 char[7]
*@AINF! 0x2A 0x40 0x41 0x49 0x4E 0x46 0x3A 0x21 char[7]
<soundid> Sound file ID in text view cp1251
Alphabetic code of the command execution result:
"S0" (0x53 0x30) - command executed successfully;
"B0" (0x42 0x30) - command cannot be executed because the execution
<result> char[2]
of the previous command is not completed;
"E2" (0x45 0x30) - failed to play sound file;
"E3" (0x45 0x30) - sound file not found.

Command to change speed mode

Command <HEAD>*!AINF#<spdmodeid>
Response <HEAD>*@AINF#<result>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!AINF# 0x2A 0x21 0x41 0x49 0x4E 0x46 0x3A 0x21 0x23 char[7]
*@AINF# 0x2A 0x40 0x41 0x49 0x4E 0x46 0x3A 0x21 0x23 char[7]
<spdmodeid> Speed mode identifier in text view cp1251
Alphabetic code of the command execution result:
"S0" (0x53 0x30) - command executed successfully;
"S1" (0x53 0x31) - command was executed, but the settings could not
be updated (for route change commands and movement mode);
<result> char[2]
"B0" (0x42 0x30) - command cannot be executed because execution of
the previous command is not completed;
"E4" (0x45 0x30) - failed to set motion mode (mode not found in the
list).

Autoinformer event alerts

Message <HEAD>*&AINF<title><id><data>
Response Not required
Exchange channel GPRS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*&AINF 0x2A 0x26 0x41 0x49 0x4E 0x46 char[6]
Alert type:
0 - entrance to geofence;
<title> U8
1 - exit from geofence;
2- playback of the sound file.
<id> Current route ID U16
Depends on the type of alert:
- entrance to geofence: geofence identifier;
<data> U16
- exit to geofence: geofence identifier;
- startof sound file playback: sound file ID.

57
 2.10.1. Universal commands for autoinformer

Command to change the route

Message <HEAD>*!AINF<s>ROUTE,<route>
Response <HEAD>*@AINF<s>ROUTE,<result>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Format
<HEAD> 16 byte NTCB packet header U8[16]
<s> Field separator - space (0x20). char
String containing the number and letter of the route (encoded as windows-
<route> char[]
1251)
Command execution result
OK - command executed successfully.
BUSY - command cannot be executed because the previous command has
<result> not been completed. char[]
INVALIDROUTE – route is formed incorrectly.
NOROUTE - route not found.
NOZONES - failed to load stop list.

Command to playback sound file

Message <HEAD>*!AINF<s>PLAY,<sound_id>
Response <HEAD>*@AINF<s>PLAY,<result>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Format
<HEAD> 16 byte NTCB packet header U8[16]
<s> Field separator - space (0x20). char
<sound> - sound file ID (1 to 65535 ).
<sound_id> char[]
If 0, stops playing the current sound.
OK - command executed successfully.
BUSY - command cannot be executed because the previous command has
not been completed.
<result> char[]
INVALID SOUND - failed to play sound file.
NO SOUND - sound file not found.

Command to change autoinformer operating mode

Message <HEAD>*!AINF<s>MODE,<mode>
Response <HEAD>*@AINF<s>MODE,<result>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Format
<HEAD> 16 byte NTCB packet header U8[16]
<s> Field separator - space (0x20). char
Autoinformer operating mode:
<mode> 0 - automatic mode; char[]
1 - manual mode.
Command execution result
OK - command executed successfully.
<result> BUSY - command cannot be executed because the previous command has char[]
not been completed.
INVALID ROUTE – route is formed incorrectly.

58
 Command to change the current stop

Message <HEAD>*!AINF<s>STOP,<stop>
Response <HEAD>*@AINF<s>STOP,<result>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Format
<HEAD> 16 byte NTCB packet header U8[16]
<s> Field separator - space (0x20). char
Stop ID (1 to 65534). If 0 - exit from the current stop
<stop> char[]
Command execution result
OK - command executed successfully.
BUSY - command cannot be executed because the previous command has
<result> not been completed. char[]
INVALID ROUTE – route is formed incorrectly.
INVALID MODE - manual mode is not enabled.
NOSTOP - stop not found.

2.11. Working with camera

2.11.1. Control commands and queries

The following commands and queries are used to control the operation of the camera and obtain
information about it:
1) Command "Automatic shooting control " - takes the specified number of photos with a specified
pause between them;
2) Command "Take a photo" - checks the availability of photos for the specified period of time;
3) Query "Get information about camera" - checks availability of photos for the specified period of
time;

Automatic shooting control command

Command ~O<module><cmd_id><param><crc8>
Positive response ~R<module><cmd_id><crc8>
Negative response ~F<module><cmd_id><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~O 0x7E 0x4F 2*U8
~F 0x7E 0x46 2*U8
~R 0x7E 0x52 2*U8
Module ID:
<module> U8
0x80 - digital camera
Command code:
<cmd_id> U8
0x00 - automatic shooting control.
Automatic shooting control:
<param> 0x00 - enable automatic shooting, U8
0x01 - disable automatic shooting.
<result> Command execution result code 2.11.3. Command and query result codes. U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8 U8

59
 Command to take a photo

Command ~O<module><cmd_id><count><delay><crc8>
Positive response ~R<module><cmd_id><crc8>
Negative response ~F<module><cmd_id><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~O 0x7E 0x4F 2*U8
~F 0x7E 0x46 2*U8
~R 0x7E 0x52 2*U8
Module ID:
<module> U8
0x80 - digital camera
Command code:
<cmd_id> 0x01 - take a photo; U8
0x02 - take a photo and then send it to email.
<count> Number of photos: 1... 65535 U16 (little-endian)
<delay> Pause between shots (seconds): 1... 65535 U16 (little-endian)
<result> Command execution result code 2.11.3. Command and query result codes. U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8 U8

Text analog of commands for working with the camera

Command <HEAD>*!<cmd>
Response <HEAD>*@<Response>
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*! 0x2A 0x21 char[2]
*@ 0x2A 0x40 char[2]
<cmd> Command in test form. All commands are supported 4.2.11. Digital camera char[]
Response in text form. See table "Responses to camera control commands"
<Response> char[]
(4.2.11. Digital camera).

60
 Query to get information about camera

Query ~Q<module><query><crc8>
Positive response ~I<module><query><flags><version><dir><crc8>
Negative response ~U<module><query><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~Q 0x7E 0x51 2*U8
~I 0x7E 0x49 2*U8
~U 0x7E 0x55 2*U8
Module ID:
<module> U8
0x80 - digital camera
Request ID:
<query> U8
0x00 - get camera information.
Bits Description Values
0 - disabled,
0 Automatic shooting
<flags> 1 - enabled U8
1-7 Reserve 0

Camera version (16 characters + "\0 "):

<version> 17*U8
For example, "VC0706 1.00."
Directory where the photos are stored (8 characters + "\0 "):
<dir> 9*U8
For example, "PHOTOS."
<result> Command execution result code 2.11.3. Command and query result codes U8
<crc8> Checksum. See attachment Annex B. Checksum calculation algorithm CRC8. U8

61
 2.11.2. Transferring photos to the server

Photos stored on the device are identified by the UTC of their creation time, recorded in unsigned Unix-
time format (number of seconds from 00:00:00 on January 1, 1970). Each main photo with size of
640×480 or 320×240, depending on the settings, has a corresponding overview photo with size of
160×120, which is a reduced copy of the main photo.

To quickly notify the server about the appearance of a new photo, device sends "New photo notofocation"
to the server every time a new photo is created every 10 minutes and after establishing communication
with the server.

New photo notification

Notification ~N<module><id><time><crc8>
Response Not required
Exchange channel GPRS,
Designation Interpretation Data Format
~N 0x7E 0x4E 2*U8
Module ID:
<module> U8
0x80 - digital camera.
Notification code:
<id> U8
0x00 - notification about creation of a new photo.
Date and time of creation of the last photo: Unix-time (number of seconds
<time> U32 (little-endian)
from 00:00:00 January 1, 1970) in unsigned format.
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8 U8

Information on the size of the main and overview photos, on the presence of photos for a certain period
of time can be obtained using the query "Query information about the photo." Query specifies the time
for which the search is performed and the search mode. Response to the query contains the photo creation
time, which is the closest to the search time and meets the search criteria.

Example of getting a list of files for period from A to B:

1. Send a query with search time A and search mode "after the specified time inclusive." If in the
response the time of taking a photo C exceeds the time B, then the pictures were not found and
search was completed, otherwise the information about the picture is entered in the list of search
results;
2. Send a query with search time C and search mode "after the specified time not inclusive." If in the
response the time of taking a photo D exceeds the time B, then search is completed, otherwise the
information about the photo is entered in the list of search results and the query is repeated, but
with the search time D;

62
 Query photo information

Query ~Q<module><query><flags><search_time><crc8>
Positive response ~I<module><query><time><size_fair><size_rough><crc8>
Negative
~U<module><query><result><crc8>
response
Exchange channel GPRS
Designation Interpretation Data Format
~Q 0x7E 0x51 2*U8
~I 0x7E 0x49 2*U8
~U 0x7E 0x55 2*U8
Module ID:
<module> U8
0x80 - digital camera
Request ID:
<query> U8
0x01-query photo information.
Bits* Description Values
0 Search for a photo whose creation time is 0 - no,
the same as the time <search_time> 1 - yes
1 Search for a photo taken before 0 - no,
<search_time> (not inclusive) 1 - yes
<flags> 2 Search for a photo taken after 0 - no, U8
<search_time> (not inclusive) 1 - yes
3-7 Reserve

* Bit values can be combined to obtain additional search conditions. For

example, the combination of bit 0 and bit 1 forms the search condition
“Search for a photo taken before <search_time> inclusive".
Search date and time: Unix-time (number of seconds from 00:00:00 January
<search_time> U32 (little-endian)
1, 1970) in unsigned format.
Date and time when the found photo was created. (If a photo is not found, a
<time> U32 (little-endian)
response is sent ~ U with the appropriate code.)
<size_fair> Primary photo size (bytes). U16 (little-endian)
<size_rough> Size of the overview photo (bytes). U16 (little-endian)
<result> Command execution result code 2.11.3. Command and query result codes. U8
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8 U8

Photos are sent to the server in blocks using the “Query photo data” command. The command specifies
the type of photo (main or overview), the time the photo was taken, the offset in bytes from the beginning
of the photo, and the size of the block for transmission, so that arbitrary access to the photo data is
possible. The latter is necessary when organizing a photo upload and re-requesting photo data blocks.
The maximum block size that a device can transmit at a time is 960 bytes.

63
 Query photo data command

Command ~G<module><get_id><utc_time><offset><size_need><crc8>
Positive response ~D<module><get_id><utc_time><offset><size_read><data><crc8>
Negative response ~L<module><get_id><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~G 0x7E 0x47 2*U8
~D 0x7E 0x44 2*U8
~L 0x7E 0x4C 2*U8
Module ID:
<module> U8
0x80 - digital camera
Request ID:
<get_id> 0x00 - query overview photo data; U8
0x01- querie the main photo data.
Time to create the required photo: Unix-time (number of seconds from
<utc_time> U32 (little-endian)
00:00:00 on January 1, 1970) in unsigned format.
<offset> Offset in bytes from the start of the photo file. U16 (little-endian)
<size_need> Size of the requested data block in bytes. U16 (little-endian)
Size of the read photo data block in bytes.
<size_read> Read block size may be different from the requested block size, but only U16 (little-endian)
downward.
<data> Photo data block. <size_read>*U8
<result> Command execution result code 2.11.3. Command and query result codes. U8
<crc8> Checksum. U8

In general, procedure for sending photos to the server can be represented by the following diagram:

64
 Device Server

Getting a new photo

notification

Query photo information

Getting photo information.

Photo size 300 bytes *.

Query block of data.

Offset 0, size 200 *.

Transferring block of data.

Offset 0, size 200 *.

Query block of data.

Offset 200, size 200 *.

Transferring block of data.

Offset 200, size 200 *.

Query block of data.

Offset 200, size 200 *.

Transferring block of data.

Offset 300, size 0 *.
Transfer completed.

*offsets and sizes are given as an example

Completion of the photo transfer is determined based on the size of the photo, offset from the beginning
of the photo and the length of the resulting block. When sequentially requesting data, download is
considered complete if response is received from the device with a block length of 0.

2.11.3. Command and query result codes

Code Description
0x10 command cannot be executed because the previous command has not been completed
0x20 unknown command
0x30 device is not configured to work with camera
0x31 no communication with the camera
0x32 automatic shooting is disabled
0x33 SD card error
0x34 photo not found
0x35 error getting picture from camera
0x36 failed to send photo to e-mail

65
 2.12. Communication between external interfaces and server
Data transfer command from device to server via USB

From application to device

Command <HEAD>*!U2S<data>
Response <HEAD>*@U2S<cop>
Exchange
GPRS, USB
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!U2S 0x2A 0x21 0x55 0x32 0x53 char[5]
*@U2S 0x2A 0x40 0x55 0x32 0x53 char[5]
Array of binary data between 1 and 1003 bytes. Amount of data is calculated
<data> U8 * size_of_data
from the transport layer header.
Parameter indicating the successfully executed command. Takes the following
meanings:
0x31 - command executed, data sent;
<cop> 0x32 - command cannot be executed, server is not configured; U8
0x33 - command cannot be executed, server is not available;
0x34 - command cannot be executed, server returned an error, or is not
responding to a message.

From device to server

Message <HEAD>*>U2S<data>
Response <HEAD>*<U2S<cop>
Exchange
GPRS, USB
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!U2S 0x2A 0x21 0x55 0x32 0x53 char[5]
*@U2S 0x2A 0x40 0x55 0x32 0x53 char[5]
Array of binary data between 1 and 1003 bytes. Amount of data is calculated
<data> U8 * size_of_data
from the transport layer header.
Parameter indicating the successfully executed command. Takes the following
meanings:
<cop> U8
0x31 - command executed, data received;
0x34 - receive error.

Data transfer command from server via USB

From server to device

Command <HEAD>*!S2U<data>
Response <HEAD>*@S2U<cop>
Exchange
GPRS, USB
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!S2U 0x2A 0x21 0x53 0x32 0x55 char[5]
*@S2U 0x2A 0x40 0x53 0x32 0x55 char[5]
Array of binary data between 1 and 1003 bytes. Amount of data is calculated
<data> U8 * size_of_data
from the transport layer header.
Parameter indicating the successfully executed command. Takes the
following meanings:
0x31 - command executed, data sent;
<cop> U8
0x33 - command cannot be executed, USB is not connected;
0x34 - command cannot be executed, host returned an error, or does not
respond to a message.

66
From device to application
Message <HEAD>*>S2U<data>
Response <HEAD>*<S2U<cop>
Exchange
GPRS, USB
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*>S2U 0x2A 0x3E 0x53 0x32 0x55 char[5]
*<S2U 0x2A 0x3C 0x53 0x32 0x55 char[5]
Array of binary data between 1 and 1003 bytes. Amount of data is calculated
<data> U8 * size_of_data
from the transport layer header.
Parameter indicating the successfully executed command. Takes the following
meanings:
<cop> U8
0x31 - command executed;
0x34 - receive error.

Data transfer command from device to server via USB, RS232, RS485

Message ~P<module><put_id><data_length><data><crc8>
Positive response ~M<module><put_id><crc8>
Negative response ~S<module><put_id><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~P 0x7E 0x50 2*U8
~S 0x7E 0x53 2*U8
~M 0x7E 0x4D 2*U8
<module> Module ID: U8
0x7F - repeater RS232/RS485/USB
<put_id> Message ID: U8
0x00 - data transfer in transparent mode from USB.
0x01 - data transfer in transparent mode from RS232.
0x02 - data transfer in transparent mode from RS485.

Note: Devices with older firmware versions (up to 7.00.00) only support
messages with code 0x00.
<data_length> Size of the data block transmitted by the device. From 1 to 512 bytes U16 (little-endian)
inclusive.
<data> Data block transmitted by the device. <data_length>*U8
<result> Parameter indicating the successfully executed command. Takes the following U8
meanings:
0x31 - successful execution of the command;
0x34 - command cannot be executed, receive failed.
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8 U8

67
 Data transfer command from server to USB, RS232, RS485 devices

Message ~P<module><put_id><data_length><data><crc8>
Positive response ~M<module><put_id><crc8>
Negative response ~S<module><put_id><result><crc8>
Exchange channel GPRS
Designation Interpretation Data Format
~P 0x7E 0x50 2*U8
~S 0x7E 0x53 2*U8
~M 0x7E 0x4D 2*U8
Module ID:
<module> U8
0x7F - repeater RS232/RS485/USB
Message ID:
0x00 - data transfer in transparent mode to USB.
0x01 - data transfer in transparent mode to RS232.
<put_id> 0x02 - data transfer in transparent mode to RS485. U8

Note: Devices with older firmware versions (up to 7.00.00) only support
messages with code 0x00.
Size of the data block transmitted by the device. From 1 to 512 bytes
<data_length> U16 (little-endian)
inclusive.
<data> Data block transmitted by the device. <data_length>*U8
Parameter indicating the successfully executed command. Takes the
following meanings:
0x30 or 0x31 - successful execution of the command;
<result> U8
0x33 - command cannot be executed, USB, RS232, RS485 not connected;
0x34 - command cannot be executed, receive error;
0x35 - command cannot be executed, previous command is processed.
<crc8> Checksum. See Annex B. Checksum calculation algorithm CRC8. U8

Custom command

This command allows you to send an arbitrary data string to the device interface or internal module. After
sending data, device “listens to” the interface for 500 ms and returns a response without formatting. If no
response is received within 500 ms, response field will be empty.

<HEAD>*!UC<s><i>,<msg>
Command Example:
<HEAD>*!UC RS485,3101066С
Response <HEAD>*@UC<s><i>,<ans>
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!UC 0x2A 0x21 0x55 0x43 char[4]
*@UC 0x2A 0x40 0x55 0x43 char[4]
<s> Parameter separator - space (0x20). char
Interface:
 "RS485" - interface of RS-485 device,
<i> char[]
 "RS232" – interface of RS-232 device,
 "GPS" - built-in navigation module.

For RS232, RS485: Packet as HEX string (ASCII).

<msg> char[]
For GPS: Packet in NMEA protocol without checksum (device adds checksum).

If response was received - HEX String (ASCII);

<ans> char[]
If response was not received - empty string.

68
 2.13. Working with CAN-LOG module
Setting CAN-LOG device program number

Message <HEAD>*!CANLOG<ver>
Response from
<HEAD>*@CANLOG<cop>
the server
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!CANLOG 0x2A 0x21 0x43 0x41 0x4E 0x4C 0x4F 0x47 char[8]
*@CANLOG 0x2A 0x40 0x43 0x41 0x4E 0x4C 0x4F 0x47 char[8]
Text version of the required CAN-LOG program
<ver> char[]
For example, "123"
Result of the program change operation:
0x31 - program is set;
<cop> 0x32 - incorrect program designation; U8
0x33 - module does not respond;
0x34 - device is not configured to work with CAN-LOG.

Query CAN-LOG device program number

Message <HEAD>*?CANLOG
Response from
<HEAD>*#CANLOG<s><result>[,<ver>]
the server
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?CANLOG 0x2A 0x3F 0x43 0x41 0x4E 0x4C 0x4F 0x47 char[8]
*#CANLOG 0x2A 0x23 0x43 0x41 0x4E 0x4C 0x4F 0x47 char[8]
<s> Parameter separator - space (0x20). char
Text version of the required CAN-LOG program
<ver> char[]
For example, "123"
Result of the program change operation:
0x31 - completed;
<result> U8
0x33 - module does not respond;
0x34 - device is not configured to work with CAN-LOG.

69
 2.14. Working with built-in accelerometer

Accelerometer calibration command

Message <HEAD>*!ACL_C:<command><param>
Response <HEAD>*@ACL_C:<command><result>
Exchange
GPRS, USB, Bluetooth
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!ACL_C: 0x2a 0x21 0x41 0x43 0x4c 0x5f 0x43 0x3a 6*U8
*@ACL_C: 0x2a 0x40 0x41 0x43 0x4c 0x5f 0x43 0x3a 6*U8
<command> "G" (0x47) - calibration (calibration check) of the accelerometer. U8
Additional parameter that explains how the command works.
0x30 - start accelerometer calibration;
0x31 - start checking of accelerometer calibration;
<param> U8
0x32 – canceling previously started calibration;
0x33 - start accelerometer calibration according to GNSS data;
0x34 - erasing current calibration.
Result of the command execution.
0x30 - unknown command;
0x31 - command executed successfully;
0x32 - error: car was moving or vibrating strongly;
0x33 - dynamic calibration started;
0x34 - error: car did not start;
<result> 0x35 - calibration completed, check if direction is correct; U8
0x36 - error: insufficient number and/or intensity of acceleration/braking;
0x37 - dynamic checking started;
0x38 - calibration must be repeated;
0x39 - calibration is correct;
0x3A - error: failed to measure gravity;
0x3B - GNSS calibration started.

70
 2.15. Accident detection

It is possible to understand that the file with information about the accident was generated by the
device on two factors:
1. When receiving an archival (alarm) message with an event code 0xA03B - Event of completion of the
generation of a file with accident profile;
2. When getting response to the query "Query information about file with information about the
accident" that accident was detected (time and length fields are not zero).

Sequence of commands for uploading a file is schematically shown in the figure below:

Server Device

Archived message with event ID 0xA03B

Query information about file with accident information

File information
(time = = file identifier)

Query file block

offset = 0, size_need = <block size>

File block
offset = 0, size_need = <block size>

Query file block

offset = <number of bytes read before>,
size_need = <block size>

File block
offset = <number of bytes read before>
size_need = <block size>

Overwrite protection reset command

key = <file CRC>

Response to the reset protection command

71
 Query information about detected accident

Message <HEAD>*?KRAI
Response <HEAD>*#KRAI<time><size><flags><filename>
Exchange
GPRS, USB, Bluetooth
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?KRAI 0x2a 0x3f 0x4b 0x52 0x41 0x49 U8[6]
*#KRAI 0x2a 0x23 0x4b 0x52 0x41 0x49 U8[6]
UTC time of accident detection in unix time format.
<time> U32 (little-endian)
0 - accident was not detected.
Size of the file with information about the accident.
<size> U32 (little-endian)
0 -file not generated.
Overwrite protection mode:
<flags> 0 - protection mode is disabled; U8
Other values - protection mode is enabled.
Name (including extension) with which you want to save the file. Contains a
<filename> terminal zero at the end. char[]
Size is calculated from the transport layer header

Command to reset overwrite protection

Message <HEAD>*!KRAI<key>
Response <HEAD>*@KRAI<result>
Exchange
GPRS, USB, Bluetooth
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!KRAI 0x2a 0x21 0x4b 0x52 0x41 0x49 6*U8
*@KRAI 0x2a 0x40 0x4b 0x52 0x41 0x49 6*U8
Key for resetting accident information. Equal to the value of block "10.
<key> U32 (little-endian)
Checksum "from the file.
Command execution result:
0x31 - command executed successfully;
<result> 0x32 - error working with internal memory; U8
0x33 - invalid reset key specified;
0x35 - no accident data, no reset required.

72
 Command to read a file page from non-volatile device memory

Command <HEAD>*!FR<file><time><offset><size>
Response <HEAD>*@FR<cop><file><time><offset><size><fileSize><y>
Exchange channel GPRS, USB, Bluetooth
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!FR 0x2A 0x21 0x46 0x52 char[4]
*@FR 0x2A 0x40 0x46 0x52 char[4]
Recorded file type:
<file> U8
3 - accident file
It is a unique file identifier created by the device. Needed to track the
<time> exchange failure when changing a file. The first packet comes with time U32 (little-endian)
equal to 0, then time is taken from response.
<offset> Offset from file beginning (in bytes) U32
Size of the requested data (in bytes). Response returns number of the bytes
<size> read. U16
At the moment, the constant is 512 bytes.
<fileSize> Total size of the file in bytes. U32
Data read from the non-volatile memory page in the appropriate data
<y> storage format (see below). U8 * <size>
Parameter indicating the successfully executed command. Takes the
following meanings:
0x31 – reading completed successfully;
<cop> U8
0x32 - error occurred while reading page (data integrity is broken);
0x33 - invalid offset in file;
0x34 - file is missing.

73
 Format of file that stores accident information

File Block Size Description

1. Prefix uint32_t “RAIF”
2. File version uint16_t 0x0101
3. File size uint16_t Total block size 4 - 7.
4. Accident detection time
4.1. Accident detection time uint32_t UTC time of accident detection in unix time format
Precision timer readings at the moment of accident detection (0...
4.2. Precision timer readings uint16_t
65535
5. Navigation information
Bit field:
Categories Values
0 0 - navigation receiver is off;
5.1. Status of GPS/GLONASS 1 - navigation receiver is on.
uint8_t
navigation sensor 1 0 - invalid navigation;
1 - valid navigation.
2..7 Number of navigation satellites 0-31

5.2. Time uint32_t Unix last valid navigation time

Latitude angle recorded when obtaining the last valid
5.3. Latitude uint32_t
coordinates. In ten thousandths of a minute.
Longitude angle recorded when obtaining the last valid
5.4. Longitude uint32_t
coordinates. In ten thousandths of a minute.
Altitude relative to sea level recorded when obtaining the last
5.5. Altitude int32_t
valid coordinates. In decimeters.
Speed recorded when obtaining the last valid coordinates. In
5.6. Speed float
km/h.
Course recorded when obtaining the last valid coordinates. 0° …
5.7. Course uint16_t
360°.
6. Accelerometer status
0xAA - accelerometer is calibrated by displacement;
6.1. Current сalibration сode uint8_t 0XBB - accelerometer is calibrated along axes;
Other values - accelerometer is not calibrated.
6.2. Accelerometer basis
Along X, Y, Z axes. Scale factor 16 384
6.2.1. X axis int16_t[3] To get a real value, the value stored in the file must be divided
into a scale factor.
6.2.2. Y axis int16_t[3] see 6.2.1
6.2.3. Z axis int16_t[3] see 6.2.1
6.2.4. Offset int16_t[3] see 6.2.1
6.3. Total number of recorded
uint16_t
acceleration points
6.4. Accident detection point in the
uint16_t
data array from the accelerometer
struct {
Data array from accelerometer along X, Y, Z axes in m/s2 with
int16_t x;
scale factor 128.
6.5. Axis accelerations int16_t y;
To get a real value, the value stored in the file must be divided
int16_t z;
into a scale factor.
} []
7. Speed data
7.1. Total number of recorded
uint16_t
velocity points
7.2. Accident detection point in the
uint16_t
speed data array
struct {
Speed data array:
7.3. Speed data (point validity and uint8_t valid;
valid - validity of point coordinates (1 - valid, 0 - not valid);
speed value) uint8_t speed;
speed - speed km/h at a point.
} []
Checksum CRC32 with polynomial 0x77073096, original
8. Checksum uint32_t 0xFFFFFFFF value and without inversion of the result bits.
Calculation is performed for units 4...7.

74
 2.16. Working with temperature sensors 1-Wire

Query temperature sensors

Query <HEAD>*?TM<s><rt>
Response <HEAD>*#TM<s><rt>,<num>:<tkey>,<num>:<tkey>,…
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*?TM 0x2A 0x3F 0x54 0x4D Char[4]
*#TM 0x2A 0x23 0x54 0x4D Char[4]
<s> Parameter separator - space (0x20). char
Query type:
<rt> TSV - query of all visible temperature sensors; char[]
TSU - quert of all visible unregistered temperature sensors.
<num> Sensor sequence number in text form (for example, "1") char[2]
<tkey> Sensor code as HEX string char[12]
Key code without family digits and checksum is zero when the key was not
<key> U64
read.

Command for temperature sensors

Query <HEAD>*!TM<s><ct>
Response <HEAD>*@TM<s><ct>,<num>:<tkey>,<num>:<tkey>,…
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!TM 0x2A 0x21 0x54 0x4D Char[4]
*@TM 0x2A 0x40 0x54 0x4D Char[4]
<s> Parameter separator - space (0x20). char
Command type:
<ct> char[]
SAVE - save unregistered temperature sensors to configuration.
<num> Sensor sequence number in text form (for example, "1") char[2]
<tkey> Sensor code as HEX string char[12]

2.17. Working with passenger flow counters

Command for "Autoconductor" counter

Command <HEAD>*!ACOND<s><cmd>
Response <HEAD>*@ACOND<s><ans>[,<cmd>]
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!ACOND 0x2A, 0x21, 0x41, 0x43, 0x4F, 0x4E, 0x44 char[7]
*@ACOND 0x2A, 0x40, 0x41, 0x43, 0x4F, 0x4E, 0x44 char[7]
<s> Parameter separator - space (0x20). char
Command (ASCII):
<cmd> char[]
"RESET" - reboot.
Command response (ASCII):
"NOINIT" - device is not configured to work with the counter;
<ans> char
"FAIL" - unknown command;
"OK" - command is accepted.

75
 2.18. Working with refrigeration units

Query additional information

Query ~Q<module><query>
Response ~I<module><query><reftype><ver><btname><sn><refsn><trsn>
Exchange channel GPRS
Designation Interpretation Data Format
~Q 0x7E 0x51 U8[2]
~I 0x7E 0x49 U8[2]
<module> 0x7A - iQFreeze polling module. U8
Request ID:
<query> U8
0x00 - query information about iQFreeze.
<reftype> Installation type U16
<ver> iQFreeze firmware version (with terminal zero at the end) char[19+1]
<btname> iQFreeze bluetooth name (with terminal zero at the end) char[19+1]
<sn> iQFreeze serial number (with terminal zero at the end) char[19+1]
<refsn> Installation serial number (with terminal zero at the end) char[19+1]
<trsn> Trailer serial number (with terminal zero at the end) char[19+1]
Checksum (Navtelecom Communication Protocol. Version 5.3. Annex B.
<crc8> U8
Checksum calculation algorithm CRC8)

2.19. Configuration commands

For a detailed description of commands and general rules for working with them, see “6. Working with
device configuration”.

Writing configuration

Sending a command causes the device to reboot

<HEAD>*!EDITS<s><p>:<t>(<a1>,<a2>,…<aX>)
Command Example:
<HEAD>*!EDITS TRANS:SRV1(,,,193.193.165.165,20966)
<HEAD>*@EDITS<s><result>,<p>:<t>(<a1>,<a2>,…<aX>)
Response Example:
<HEAD>*@EDITS OK,TRANS:SRV1(FLEX,0,1,193.193.165.165,20966)
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!EDITS 0x2A 0x21 0x45 0x44 0x49 0x54 0x53 char[7]
*@EDITS 0x2A 0x40 0x45 0x44 0x49 0x54 0x53 char[7]
<s> Parameter separator - space. char
<p> name of the page on which the tag is located. Must end with ":". char[]
<t> name of the tag you want to edit. Must end with "(". char[]
values of parameters written to the device. The last tag parameter
<aX> char[]
must end with ")".
command execution result:
<result> - "OK" - command is executed; char[]
- "FAIL" - error in the command.

76
 Reading configuration

<HEAD>*!READ<s><p>:<t>
Command Example:
<HEAD>*!READ TRANS:AP1
<HEAD>*@READ<s><result>,<p>:<t>(<a1>,<a2>,…<aX>)
Response Example:
<HEAD>*@READ OK,TRANS:AP1(internet.mts.ru,mts,mts)
Exchange channel GPRS, USB, Bluetooth, SMS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!EDITS 0x2A 0x21 0x52 0x45 0x41 0x44 char[6]
*@EDITS 0x2A 0x40 0x52 0x45 0x41 0x44 char[6]
<s> Parameter separator - space. char
<p> name of the page on which the tag is located. Must end with ":". char[]
<t> name of the tag you want to edit. Must end with "(". char[]
values of parameters written to the device. The last tag parameter
<aX> char[]
must end with ")".
command execution result:
<result> - "OK" - command executed; char[]
- "FAIL" - error in the command.

FLEX bit mask edit command

Sending this command causes device to reboot

<HEAD>*!SETFM<s><n>:<m>[,<n>:<m>]
Command Example:
<HEAD>*!SETFM 7:1111,20:11
Response <HEAD>*@SETFM<s><n>:<m>
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!SETFM 0x2A 0x21 0x53 0x45 0x54 0x46 0x4D char[7]
*@SETFM 0x2A 0x40 0x53 0x45 0x54 0x46 0x4D char[7]
<s> Parameter separator - space (0x20). char
Index from which bits will be set, starts from 1. Parameter number corresponds
<n> char
to the number from the table “Structure of FLEX telemetry records”.

77
 3. Encryption AES128
Advanced Encryption Standard (AES) algorithm in Cipher Block Chaining (CBC) mode with a 128-bit key is
used for data encryption in device. PKCS7 algorithm described in RFC 5652 is used as an algorithm for
padding data to a multiple of the size of the encryption block: padding is done in bytes, each of which is
equal to the number of bytes that need to be added to the open data.

Basic definitions

Definition Meaning
Cryptic key used to encrypt data transmitted from both the device and the server. This key is
Device key generated using the server key from the IMEI of the device, terminated with '*' and encoded in
ASCII.
Vector used to initialize the CBC algorithm. This vector is generated by the device itself when
Initialization
connecting to the server and every 12 hours if the device remains in touch. Initialization vector is
vector
generated based on 4 random numbers obtained from a random number generator (RNG).

Procedure for connecting device to the server when encryption mode is enabled

After opening connection, device sends an unencrypted handshake packet. In response, server either
sends a corresponding unencrypted response if the device is registered in the database, or breaks the
connection.
Upon successful completion of the handshake procedure, device sends to the server an unencrypted
command to switch to encryption mode, which indicates the required encryption mode and initialization
vector of the data block chaining algorithm.
When receiving a command to switch to encryption mode, server must confirm that the specified
encryption mode is supported by sending an unencrypted response. If the server does not confirm
encryption, you should disconnect the connection to the device.
If the server confirms support for the required encryption, the device begins data transmission only in
encrypted form in a special container packet. At the same time, connection procedure itself remains the
same.

78
 Device Server

Individual device ID (handshake)

Device ID confirmation

Request to switch to encryption mode

Confirmation of switching to encryption mode

FLEX parameters bit field*

FLEX parameters bit field confirmation*

Telemetry records array*

Telemetry records array confirmation*

…
Telemetry records array*

Telemetry records array confirmation*

* transmitted in encrypted form in a special container packet

Command to switch to encryption mode

Command <HEAD>*>CODE<mode><vector>
Response <HEAD>*<CODE<mode>
Exchange channel GPRS
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*>CODE 0x2A 0x3E 0x43 0x4F 0x44 0x45 char[5]
*<CODE 0x2A 0x3C 0x43 0x4F 0x44 0x45 char[5]
In command:
Encryption mode:
0x00 - no encryption;
0x01 – AES128 CBC.
<mode> U8
In response:
Value from the command if the server supports the required encryption, 0 if
the server does not support the required encryption.
N*U8
N - length of the
<vector> Encryption initialization vector. Generated by the device. vector, determined
by the transport
layer header.

79
 Container packet for encrypted data transferring

Container #<count><blocks><crc16>
Exchange channel GPRS
Designations Interpretation Data Format
# 0x23 U8
<count> Number of units to be transferred minus 1. U8
<blocks_count> ×
N × U8
<blocks> Blocks of encrypted data. N - Encryption block
size. For AES128, it
is equal to 16.
Checksum. Polynomial 0x1021, initial value 0. See Annex B. Checksum
<crc16> U16 (little-endian)
calculation algorithm CRC8

80
 4. NTCT text protocol
NTCT text protocol messages are used to send information via SMS. Format of a standard SMS message
depends on the structure of the telemetry record used in the device.

4.1. Formats of SMS messages coming from device

F2, F5, F5.1F5.2, F6, FLEX records use message format M:111

String
String content Interpretation
#
1 M:111 Message type
2 __________ Type of event that occurred, see Event code table file.
3 HH.MM.SS Event time UTC
4 DD/MM/YY Event date UTC
Operating mode
where X:
5 G:X 0 "surveillance";
1 "security";
2 "service mode."
State of inputs at the moment of fixing the event in the non-volatile memory. From I1
to I8 from left to right.
X - not used;
6 I:XXXXXXXX
Y - triggered;
N – not triggered;
L - locked by command.
Status of outputs at the moment fixing the event in the non-volatile memory. From O1
to O4 from left to right.
7 O:XXXX X - not used;
Y – on;
N - off.
8 AK:XX.X XX.X Voltage at the inputs of main and backup power supply in volts (with tenths)
Temperature in degrees Celsius
9 T:ZXX
Z - sign "+" or "-," XX - value
10 AN:XX.X XX.X Field is left for compatibility with the E-1111 device. It will contain only zero values.
11 HH.MM.SS Time of obtaining the last valid coordinates according to UTC
12 DD/MM/YY Date of obtaining the last valid coordinates according to UTC
Latitude in degrees, minutes and fractions of minutes.
13 NXXX XX.XXXX N - northern latitude;
S - southern latitude.
Longitude in degrees, minutes and fractions of minutes.
14 EXXX XX.XXXX E - east longitude;
W - west longitude.
15 XXX Speed in km/h
16 XXX Course in degrees (0 to 359)
17 hhhhhhhh Record index in non-volatile memory (in hexadecimal)

Standard SMS format M:100

String
String content Note
#
1 M:100 Message type
2 <vendor> Manufacturing company
3 X-XXXX Device model string (6 characters)
4 Software version: Firmware version
5 XX.XX.XX Version number
6 XX.XX.XX Version date
7 XX Localization (RU - Russian version, DE - German version)

81
 Standard SMS format M:101

String
String content Note
#
1 M:101 Message type
Message text generated by the cellular operator response to the USSD
2 <text>
request

Standard SMS format M:104

String
String content Note
#
1 M:104 Message type
Current operating mode of the device:
NOGUARD - surveillence mode;
2 <MODE> GUARD - security mode;
GUARD2 - additional security mode 1;
GUARD3 - additional security mode 2;
Character-numeric name:
IX - inputs, where X = 1...
OX - outputs, where X = 1...
UG - main power supply;
3 <NAME>
UR - backup power supply;
T - temperature;
A1 - voltage at analog input of I7/A1;
A2 - voltage at analog input of I8/A2.
Condition:
LOCKED - locked by command (only for I1... I8);
OFF - for I1..I8 and O1..O4 means inactive state;
4 <STATE> ACTIVE - for I1..I8 and O1..O4 means active state;
SHORT - for I7..I8 means short circuit on the line;
<numerical value> - for voltage and temperature;
NOT DEFINED - if parameter is unknown or incorrect.

Standard SMS format M:105

String
String content Note
#
1 M:105 Message type
Type of phone list;
PVD - list of subscribers for voice alerts;
2 <alert type>
PST - list of subscribers for alerts by standard SMS;
PU - list of subscribers for alerts by user SMS.
3 <phone alias 1 >:<flag> First subscriber name and alert status
4 <phone alias 2>: <flag> Second subscriber name and alert status
5 <phone alias 3>: <flag> Third subscriber name and alert status
6 <phone alias 4>: <flag> Fourth subscriber name and alert status
7 <phone alias 5>: <flag> Fifth subscriber name and alert status

Standard SMS format M:106

String
String content Note
#
1 M:106 Message type
Response to RESET command
2 Reset device
Device will be rebooted

82
 Standard SMS format M:107

String
String content Note
#
1 M:107 Message type
Firmware OK Confirmation that the firmware was successfully downloaded through the RFU
service and it will be written to device.

Firmware <string> error Error was detected while downloading the firmware.
<error code> <string> - string with the firmware version;
<error code> - code of the detected error.
2
<ip>:<port> not Specified server and port are not responding to communication requests.
responding
Command to update the firmware was accepted, attempt is made to establish
connection with the specified server.
Start connect to <ip>: <ip> - RFU IP address specified in the command.
<port> <port> - RFU IP port specified in the command.

Standard SMS format M:112

String
String content Interpretation
#
1 M:112 Message type
2 HH.MM.SS Event time UTC
3 DD/MM/YY Event date UTC
X - station sequence number
CX,MCC:Y,MNC:Y,
4 Y - parameters identifying the station
CID:Y, LAC:Y,R:Z
Z - dBm signal attenuation to the station
X - station sequence number
CX,MCC:Y,MNC:Y,
5 Y - parameters identifying the station
CID:Y, LAC:Y,R:Z
Z - dBm signal attenuation to the station
X - station sequence number
CX,MCC:Y,MNC:Y,
6 Y - parameters identifying the station
CID:Y, LAC:Y,R:Z
Z - dBm signal attenuation to the station

Standard SMS format M:114

String
String content Note
#
1 M:114 Message type
2 X-XXXX Device model string (6 characters)
3 XX.XX.XX Version number
4 IMEI International mobile equipment identifier
5 HH.MM.SS Event time UTC
6 DD/MM/YY Event fate UTC
7 … Googlemap hyperlink

83
 Standard SMS format M:115

String
String content Note
#
1 M:115 Message type
2 ХХХ: hhmmssDDMMYY ХХХ - GSM error code
3 ХХХ: hhmmssDDMMYY
4 ХХХ: hhmmssDDMMYY hmmssDDMMYY - time of error code generation, where:
5 ХХХ: hhmmssDDMMYY hh - hour
6 ХХХ: hhmmssDDMMYY mm - minute
7 ХХХ: hhmmssDDMMYY ss - second
8 ХХХ: hhmmssDDMMYY DD - day
9 ХХХ: hhmmssDDMMYY MM - month
10 ХХХ: hhmmssDDMMYY YY - year

SMS message format according to GOST R 56361-2015

String
String content Interpretation
#
1 IMEI International mobile equipment identifier
Location coordinates correspond to the system:
2 X 0 - PZ-90;
1 — WGS-84.
Latitude in degrees, minutes and fractions of minutes.
3 NXXX XX.XXXX N - northern latitude;
S - southern latitude.
Longitude in degrees, minutes and fractions of minutes.
4 EXXX XX.XXXX E - east longitude;
W - west longitude.
5 G:XXXX Altitude relative to sea level in decimeters.
6 XXX Speed in km/h.
7 XXX Course in degrees (0 to 359).
8 HH.MM.SS Time of obtaining the last valid coordinates according to UTC
9 DD/MM/YY Date of obtaining the last valid coordinates according to UTC
State of the inputs at the time the event was committed in the black box. From
I1 to I8 from left to right.
X - not used;
10 I:XXXXXXXX
Y - worked;
N - did not work;
L - blocked by command.

4.2. SMS requests and commands

Via the SMS communication channel it is possible to request information from non-volatile memory of
the system, send commands and standard requests.

When sending SMS commands and requests, following rules are applied:
1. All commands are case-sensitive specified in the command description.
2. All Commands are typed in Latin.
3. If password for SMS control is set in the device configuration, then when sending a command, a
construction of the form is used:
<password><sp><command> Example *?V with password "123": 123 *?V
If password is not set in the configuration, then it is sent like this:
<command> Example *?V without password *?V

Device sends a response to the command only if password check is passed, command format is correct
and response is not prohibited by the device configuration.

84
 4.2.1. System queries and commands

Query model and firmware version

Command *?V
*#V:<n>:<v1>.<v2>.<v3>:<d>.<m>.<y>:<loc>
Response Example:
*#V:S-2651:01.00.72:13.05.20:RU
Designations Interpretation
<n> Device model string (6 characters).
<v1>.<v2>.<v3> Firmware version indexes of 2 characters.
<d>.<m>.<y> Respectively, day, month and year of this firmware version are 2 characters.
<loc> Firmware language version 2 characters (RU, DE, EN).

Query unique device ID

Command *?S
*#S:<s>
Response Example:
*#S:123456789012345
Designations Interpretation
<s> Identifier string.

Query personal SIM account balance

Command B
Response M:101 (see 4.1. Formats of SMS messages coming from device)
Designations Interpretation
<n> Device model string (6 characters).
<v1>.<v2>.<v3> Firmware version indexes of 2 characters.
<d>.<m>.<y> Respectively, day, month and year of this firmware version are 2 characters.
<loc> Firmware language version 2 characters (RU, DE, EN).

Device restart command (old format)

Command RESET
Response M:106 (see 4.1 Formats of SMS messages coming from device)

Device restart command (new format)

Command *!DEV_RESET
Response *@DEV_RESET

Arbitrary USSD request

Command *?USSD<s><code>
Response *#USSD<s><string>
Designations Interpretation
<s> Parameter separator - space (0x20).
<code> USSD code string of the request.
<string> Response string of the cellular operator.

Command of arbitrary sound indication by buzzer

Command *!BEEP<s><count>,<group>,<interval>,<freq>
Response *@BEEP<s><result>
Designations Interpretation
<s> Parameter separator - space (0x20).
Command processing result (ASCII):
<result> "OK" - commands executed;
"FAIL" - command execution error;
<count> Number of pulses in each pulse group. If >=32, indication is continuous
<group> Number of groups in audible indication.
<interval> Duration of each group operating in 1/128 fractions of a second.
<freq> Frequency of audible indication of each pulse (Hz).

85
Command to change SIM card
Command *!CHNGSIM
Response *@CHNGSIM<s><x>-><y>
Designations Interpretation
<s> Parameter separator - space (0x20).
-> Separating characters - 0x2D 0x3E
Current working SIM card:
<x> "1" - SIM 1 (External),
"2" - SIM 2 (Internal).
SIM card to switch to:
<y> "1" - SIM 1 (External),
"2" - SIM 2 (Internal).

Query device status

Command *?ES
Response M:114 (see 4.1 Formats of SMS messages coming from device)

Query unique SIM serial number

Command *?ICCID
Response *#ICCID<s><id>
Designations Interpretation
<s> Parameter separator - space (0x20).
<id> Unique SIM serial number

Query information about firmware version of the GPS receiver

Command *?VGPS
Response *#VGPS<s><n>,<v1>.<v2>.<v3>,<d>.<m>.<y>,<gps_ver>
Designations Interpretation
<s> Parameter separator - space (0x20).
<n> Device model string (6 characters).
<v1>.<v2>.<v3> Device firmware version indexes of 2 characters.
Respectively, day, month and year of this version of the device firmware are 2 characters
<d>.<m>.<y>
each.
<gps_ver> String with model and version of navigation receiver

Command for microphone listening

Command *!O<s><phnumber>
Response *@O<s><phnumber>
Designations Interpretation
<s> Parameter separator - space (0x20).
<phnumber> <phnumber> - number to be called. Phone number (starting with "+").

Command for time adjustment on device

*!SETTIME<s><offset>
Command Example:
*!SETTIME +60
Response *@SETTIME<s><ans>
Designations Interpretation
<s> Parameter separator - space (0x20).
<offset> Offset in seconds with a character in text format. For example: + 60 or -30
Response:
<ans> "OK" - "time synchronized";
"FAIL" - "synchronization error."

86
Command for diagnostic information query
*?DATA<s><id1>,<id2>, ... ,<idN>
Command Example:
*?DATA 21,22
*#DATA<s><id1>:<data1>,<id2>:<data2>,...,<idN>:<dataN>
Response Example:
*#DATA 21:0026,22:0000
Designations Interpretation
<s> Parameter separator - space (0x20).
Parameter ID in text decimal form.
<idX> 1 .. 255 - parameters correspond to table FLEX 3.0 (Annex A.1. Structure of FLEX telemetry
records)
<dataX> Parameter value as a HEX string with BigEndian byte order.

4.2.2. Outputs

Command to change output state

*!SETOUT<s><num><new_state>[,<num><new_state>]
Command Example:
*!SETOUT 1Y,2N
*@SETOUT<s><result>,<num><cur_state>[,<num><cur_state>]
Response Example:
*@SETOUT OK,1Y,2N или *@SETOUT FAIL,1N,2Y
Designations Interpretation
<s> Parameter separator - space (0x20).
Command processing result (ASCII):
<result> "OK" - commands executed;
"FAIL" - command execution error;
<num> Number of the output to be changed (ASCII). Numbering starts with 1.
Output state to be set (ASCII):
<new_state> "Y" - enable;
"N" - disablef.
Output status after command execution (ASCII):
<cur_state> "Y" - on;
"N" - off.

Command to enable/disable output

<num><state>
Command Example:
1Y
Response M:111 (see 4.1 Formats of SMS messages coming from device)
Designations Interpretation
<num> Output number starting from 1
Output state to be set (ASCII):
<state> "Y" - enable;
"N" - disable.

87
 4.2.3. Inputs

Command to lock input

LOCK<s>I<num>
Command Example:
LOCK I1
Response M:105 (see 4.1 Formats of SMS messages coming from device)
Designations Interpretation
<s> Parameter separator - space (0x20).
<num> Input number starting from 1

Command to unlock input

UNLOCK<s>I<num>
Command Example:
UNLOCK I1
Response M:105 (see 4.1 Formats of SMS messages coming from device)
Designations Interpretation
<s> Parameter separator - space (0x20).
<num> Input number starting from 1

4.2.4. Telemetry information

Query current state of the device

Command *?A
Response M:111 (see 4.1 Formats of SMS messages coming from device)

Query current status of <X> sensor

A<x>
Command Example:
AUG or AI1
Response M:111 (see 4.1 Formats of SMS messages coming from device)
Designations Interpretation
<x> - alphanumeric value of the sensor in the system:
I1-I8 - inputs;
O1-O4 - outputs;
UG - power supply voltage;
<x> UR – back-up battery voltage;
T1-T4 - temperature;
IGN - "Ignition" sensor state (by input or voltage);
ACC - disconnection of back-up battery;
PWR - disconnection of external power supply.

Query current location as a hyperlink

Command *?POS
Response M:114 (see 4.1 Formats of SMS messages coming from device)

Query location-based service (LBS) information

Command *?LBS
Response M:112 (see 4.1 Formats of SMS messages coming from device)

Command to confirm synchronization of internal memory with the server

*!SYNC<s><index>
Command Example:
*! SYNC 1 or *! SYNC: 1
Response M:111 (see 4.1 Formats of SMS messages coming from device)
Designations Interpretation
<s> Parameter separator - space (0x20) or colon (0x3A).
<index> Server index of the device specified in the settings (starting from 1).

88
Command to resend telemetry from non-volatile memory
*!REP_FL<s><srvindex>,<leftdate>[/<lefttime>],<rightdate>[/<righttime>]
Example:
Command
*!REP_FL 1,09.04.18/13:00:59,10.04.18/03:00:00
*!REP_FL 1,09.04.18,10.04.18
Response *@REP_FL<s><result>
Designations Interpretation
<s> Parameter separator - space (0x20).
/ Date/Time field separator (0x2F)
Command processing result (ASCII):
<result> "OK" - command executed;
"FAIL" - command execution failed.
Server index to repeat in text format:
<srvindex> "0" - to all servers;
"1.." "3" – server index.
Date of the left border of the interval of the requested telemetry in text format (in UTC):
<leftdate>
"DD.MM.YY."
Optional parameter.
Time of the left border of the interval of the requested telemetry in text format (in UTC): "HH:
<lefttime>
MM: SS
Absence of a parameter is equal to the value "00:00:00."
Date of the right border of the interval of the requested telemetry in text format (in UTC):
<rightdate>
"DD.MM.YY."
Optional parameter.
Time of the right border of the requested telemetry interval in text format (in UTC): "HH: MM:
<righttime>
SS
Absence of a parameter is equal to the value "23:59:59."

Command to resend telemetry from SD card

*!REP_SD<s><srvindex>,<leftdate>[/<lefttime>],<rightdate>[/<righttime>]
Example:
Command
*! REP _ SD 1.09.04.18/13: 00: 59.10.04.18/03: 00:00 (time will not be taken into account
*! REP _ SD 1.09.04.18. 10.04.18 (only 09.04.18 will be unloaded
Response *@REP_SD<s><result>
Designations Interpretation
<s> Parameter separator - space (0x20).
/ Date/Time field separator (0x2F)
Command processing result (ASCII):
<result> "OK" - commands executed;
"FAIL" - command execution failed.
Server index to repeat in text format:
<srvindex> "0" - to all servers;
"1.." "3" – server index.
Date of the left border of the interval of the requested telemetry in text format (in UTC):
<leftdate>
"DD.MM.YY."
Device does not parse the parameter.
Always equates to "00:00:00."
<lefttime>
Time of the left border of the interval of the requested telemetry in text format (in UTC): "HH:
MM: SS
Date of the right border of the interval of the requested telemetry in text format (in UTC):
<rightdate>
"DD.MM.YY."
Device does not parse the parameter.
Always equates to "00:00:00."
<righttime>
Time of the left border of the interval of the requested telemetry in text format (in UTC): "HH:
MM: SS

89
 4.2.5. Device operating modes

Command to enable security mode

*!M<s><x>
Command Example:
*!M G
*@M<s><x>,<e>,<i>
Response Example:
*@M O,5,IN2/VOLT
Designations Interpretation
Operating mode of the device to be switched to:
"G" - security;
<x>
"O" - surveillence.
Response <x> is the current mode of operation
Reason for not switching to security:
"1" - security mode in the device configuration is disabled;
"2" - mode change switching timeout has not expired;
<e>
"3" - mode is on: do not switch to security mode when ignition is on;
"4" - device is already in this mode;
"5" - mode is on: do not switch to security mode if one of the security sensors is triggered.
Aliases of the triggered sensors via separator - / .
For S-25xx, S-23xx devices:
"IN1," "IN2," "IN3," "IN4," "AIN1," "AIN2" – inputs;
"VOLT" - external supply voltage sensor;
<i> "ENG" - engine operation sensor.
For S-26xx, S-24xx devices:
"IN1," "IN2," "IN3," "IN4," "IN5," "IN6" - inputs;
"VOLT" - external supply voltage sensor;
"ENG" - engine operation sensor.

Query current security mode

Command *?M
Response *#M<s><x>
Designations Interpretation
<s> Parameter separator - space (0x20).
Device operating mode:
<x> "G" - security;
"O" - surveillance.

Command to switch security mode (old format)

G<mode>
Command Example:
G1 or GY
Response M:111 (see 4.1 Formats of SMS messages coming from device)
Designations Interpretation
Operating mode:
<mode> "Y" or "1" - "Security" mode;
"N" or "0" - "Surveillence" mode.

90
 4.2.6. RCS, RFU, DRC Services

To connect device to RCS, RFU, DRC servers, it is necessary to send it an appropriate command via SMS.

Command to connect to the configurator via RCS

*!CNCT_RCS<s><ip>,<port>,<commID>,<apn>,<login>,<password>
Example:
Command
*!CNCT_RCS 89.208.152.55,8100,43644176
*!CNCT_RCS 89.208.152.55,8100,43644176,internet.mts.ru,mts,mts
Response M:107 (see 4.1 Formats of SMS messages coming from device)
Designations Interpretation
<s> Parameter separator - space (0x20).
<ip> String containing the IP address of the RCS server.
<port> String containing the port on which the RCS service on the server is routed.
<commID> Session ID to connect to the configurator.
Optional parameter.
<apn> Access point name of the cellular operator. If the field in the cellular operator settings is empty,
the field should be omitted.
Optional parameter.
<login> Login of the cellular operator. If the field in the cellular operator settings is empty, the field
should be omitted.
Optional parameter.
<password> Password of the cellular operator. If the field in the cellular operator settings is empty, the field
should be omitted

Command to update device firmware via RFU

*!CNCT_RFU<s><ip>,<port>,<firmware>,<apn>,<login>,<password>
Example:
Command *!CNCT_RFU 89.208.152.55,9100,LAST
*!CNCT_RFU 89.208.152.55,9100,01.00.72
*!CNCT_RFU 89.208.152.55,9100,LAST,internet.mts.ru,mts,mts
Response M:107 (see 4.1 Formats of SMS messages coming from device)
Designations Interpretation
<s> Parameter separator - space (0x20).
<ip> String containing IP address of the RCS server.
<port> String containing the port on which the RCS service on the server is routed.
Requested firmware version.
<firmware>
If the latest version is needed, the keyword "LAST” is used.
Optional parameter.
<apn> Access point name of the cellular operator. If the field in the cellular operator settings is empty,
the field should be omitted.
Optional parameter.
<login> Login of the cellular operator. If the field in the cellular operator settings is empty, the field
should be omitted.
Optional parameter.
<password> Password of the cellular operator. If the field in the cellular operator settings is empty, the field
should be omitted

91
Old command formats:
(temporarily supported for backward compatibility)
Response
№ Command Text Command Description
Message
RFU service connection command:
UPFRM
Separator between parameters is space.
<IP>
<IP> - IP address of the RFU server; For example: 89.208.152.55
<PORT>
<PORT> - IP port of the RFU server; For example: 9100
1 <FIRMWARE> M:107
<FIRMWARE> - firmware version number (LAST) for the newest;
<APN>
<APN> - cellular operator apn;
<LOGIN>
<LOGIN> - cellular operator login;
<PASSWORD>
<PASSWORD> cellular operator password.
RCS service connection command:
NTC_CONNECT
Separator between parameters is space.
<IP>
<IP> - IP address of the RCS server; For example: 89.208.152.55
<PORT>
<PORT> - IP port of the RCS server; For example: 8100
2 <COMID> M:107
<COMID> - RCS session ID; For example: 43644176
<APN>
<APN> - cellular operator apn;
<LOGIN>
<LOGIN> - cellular operator login;
<PASSWORD>
<PASSWORD> cellular operator password.

Command to connect to DRC

*!CNCT_DRC[<s><time>,<ip>, <port>]
Example:
Command *!CNCT_DRC
*!CNCT_DRC 300
*!CNCT_DRC 300,89.208.152.54,10000
Response *@CNCT_DRC<s><ack>
Designations Interpretation
(optional)
<time>
Ttime, in seconds, for which the device is connected.
(optional)
<ip> IP or DNS of the DRC service.
If not specified, device uses the server IP address hard-coded in the firmware.
(optional)
<port> PORT of the DRC service.
If not specified, device uses the server port hard-coded in the firmware.
Confirmation of command reception:
<ack>
OK - command is accepted for execution.

92
 4.2.7. Working with identifiers

Command to edit the list of registered Touch Memory keys

ATTENTION!
List with theTouch Memory key parameters must be loaded into the device in advance. Only one key can
be edited at a time.

*!SETTM<s><num>,<addr>,<mode>
Command Example:
*!SETTM 1,0002de031122,NOACT
Response *@SETTM<s><res>[,<code>]
Designations Interpretation
<s> Parameter separator - space (0x20).
<num> Key number in the configuration is 1-510.
<addr> Key address (12 characters).
Key operating mode:
"NOACT" - no action;
<mode>
"GUARD" - changes the security mode;
"IMMOB" - immobilizer.
Command execution result:
<res> "OK" – command executed successfully;
"FAIL" - command failed, error.
(optional)
Additional error code:
"1" - module is busy;
<code>
"2" - incorrect TM key number;
"3" - no parameters;
"4" - incorrect operating mode.

93
 4.2.8. Tachograph

Command to generate a DDD file and send it to e-mail

Command TACH<s>EMAIL<s><card_num>
Response TACH<s>EMAIL:<s><ans>
Designations Interpretation
<s> Parameter separator - space (0x20).
Card number to unload:
<card_num> "1" - card from the first slot;
"2" - card from the second slot.
Command execution results:
"OK" - command executed successfully.
"BUSY" - command cannot be executed at the moment.
"NO TACHOGRAPH" - device is not configured to work with tachograph.
"NOT CONNECTED" – no connection to the tachograph.
"AUTH ERROR" - failed to log in to the tachograph.
"DISK ERROR" - error saving/reading data from non-volatile memory.
"DDD WRONG PARAMS" - DDD generation: specified incorrect parameters (date, card
number) in the request.
<ans> "DDD WRONG STATE" - DDD generation: tachograph is not allowed to generate a file in the
current operating mode.
"DDD NOT SUPPORTED" - DDD generation: unsupported file type.
"DDD NO DATA" - DDD generation: no data to generate file.
"DDD LOAD ERROR" – DDD generation: error getting file from tachograph.
"DDD BUILD ABORTED" - DDD generation: generation interrupted (when updating device
firmware).
"DDD BROKEN" - DDD generation: file has incorrect structure (file name could not be
generated).
"EMAIL SEND ERROR" - failed to send file to e-mail.

Query status of tachograph cards

Command TACH<s>INFO
TACH<s>INFO:<s><err>
TACH<s>INFO:<s><ans>
Example:
Response
TACH INFO: ATOL
1 – RUD0000000002100
2 – NONE
Designations Interpretation
<s> Parameter separator - space (0x20).
Card number to unload:
<card_num> "1" - card from the first slot;
"2" - card from the second slot.
Error information:
<err> "NO TACHOGRAPH" - device is not configured to work with tachograph
"NOT CONNECTED" - no connection to the tachograph
If successful, format of the <ans> field is as follows

<serial>
1 - <card_num>
<ans> 2 - <card_num>

, where
<serial> - tachograph model and serial number
<card_num> - card number, if any, or "NONE" if none is present

94
 4.2.9. Driver display

Send message without confirmation

Command DV<msg>
Response DV:<s><ans>
Designations Interpretation
<s> Parameter separator - space (0x20).
<msg> Text message to the driver up to 229 characters inclusive (encoded as CP1251).
Command execution result:
"OK" - message is accepted.
"BUSY" - message was not accepted, because the previous message was not sent to the
<ans> display.
"NO DV" - device is not configured to work with the display.
"INVALID MSG" - message length = 0.
"NOT CONNECTED" - no connection to the display.

Send message with confirmation request

Command DV!<msg>
Response DV:<s><ans>
Designations Interpretation
<s> Parameter separator - space (0x20).
! Sign of waiting for confirmation
<msg> Text message to the driver up to 229 characters inclusive (encoded as CP1251).
Command execution result:
"OK" - message is accepted.
"BUSY" - the message was not accepted, because the previous message was not sent to the
<ans> display.
"NO DV" - device is not configured to work with the display.
"INVALID MSG" - message length = 0.
"NOT CONNECTED" - no connection to the display.

Read receipt for confirmation messages

Command is not required, receipt is generated by the device itself
Response DV:<date>
Designations Interpretation
<s> Parameter separator - space (0x20).
Time and date when device received a message for the driver in HH:MM:SS DD/MM/YYYY
<date>
format

95
 4.2.10. Autoinformer

Route change command (old format)

Command AINF<s>ROUTE<s><n><m>
Response AINF<s>ROUTE:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
<n> Route number
<m> Route letter (CP1251 encoded)
Command execution result:
"OK" - command executed successfully.
"BUSY" - command cannot be executed because the execution of the previous command has
<ans> not completed.
"INVALID ROUTE" - route is formed incorrectly.
"NO ROUTE" - route not found.
"NO ZONES" – failed to load the list of geofences.

Audio file playback command (old format)

Command AINF<s>PLAY<s><n>
Response AINF<s> PLAY:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
<n> Audio file numeric ID
Command execution result:
"OK" - command executed successfully.
"BUSY" - command cannot be executed because the execution of the previous command has
<ans>
not completed.
INVALID SOUND - failed to play audio file.
"NO SOUND" - audio file not found.

Speed mode change command

Command AINF<s>SM<s><n>
Response AINF<s>SM:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
<n> Speed mode numeric identifier
Command execution result:
"OK" - command executed successfully.
<ans> "BUSY" - command cannot be executed because the execution of the previous command has
not completed.
"NO SM" - speed mode is not found in the mode list.

Route сhange сommand

Command *!AINF<s>ROUTE,<route>
Response *@AINF<s>ROUTE,<result>
Designations Interpretation
<s> Field separator - space (0x20)
<route> String containing the number and letter of the route (encoded as CP1251)
Command уxecution кesult
"OK" - command executed successfully.
"BUSY" - command cannot be executed because the previous command has not completed.
<result>
"INVALID ROUTE" - route is formed incorrectly.
"NO ROUTE" - route not found.
"NO ZONES" - failed to load stop list.

96
Audio file playback command
Command *!AINF<s>PLAY,<sound_id>
Response *@AINF<s>PLAY,<result>
Designations Interpretation
<s> Field separator - space (0x20)
Sound file ID (1 to 65535).
<sound_id>
If 0, stops playing the current audio file.
"OK" - command executed successfully.
"BUSY" - command cannot be executed because the previous command has not completed.
<result>
INVALID SOUND - failed to play audio file.
"NO SOUND" - audio file not found.

Command to change autoinformer operating mode

Command *!AINF<s>MODE,<mode>
Response *@AINF<s>MODE,<result>
Designations Interpretation
<s> Field separator - space (0x20)
Autoinformer operating mode:
<mode> "0" - automatic mode;
"1" - manual mode.
Command execution result
"OK" - command executed successfully.
<result>
"BUSY" - command cannot be executed because the previous command has not completed.
"INVALID ROUTE" - route is formed incorrectly.

Command to change current stop

Command *!AINF<s>STOP,<stop>
Response *@AINF<s>STOP,<result>
Designations Interpretation
<s> Field separator - space (0x20)
Stop ID (1 to 65534).
<stop>
If 0 - exit from the current stop
Command execution result
"OK" - command executed successfully.
"BUSY" - command cannot be executed because the the previous command has not
<result> completed.
"INVALID ROUTE" - route is formed incorrectly.
"INVALID MODE" - manual mode is not enabled.
"NO STOP" - stop not found.

97
 4.2.11. Digital camera

Command to take a photo or series of photo

DCAM<s>SS[<s><n><s><m>]
Example:
Command
DCAM SS
DCAM SS 3 5
Response DCAM<s>SS:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
(optional)
<n> Number of photos.
If the parameter is not specified, then it is taken as 1.
(optional)
<m> Interval between photos in seconds.
If the parameter is not specified, then it is taken as 1.
Command execution result:
"OK" - command executed successfully
"BUSY" - command cannot be executed at the moment
"NO CAMERA" - device is not configured to work with the camera
<ans>
"NOT CONNECTED" - no communication with the camera
"TURNED OFF" - automatic shooting is disabled
"DISK ERROR" - SD card error
"SS ERROR" - error retrieving camera photo

Command to take a photo and then send it to e-mail

Command DCAM<s>EMAIL<s><date>
Response DCAM<s>EMAIL:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
Date when the photo is created, if it is not in the command, a new photo is created.
<date>
Format: HH.MM.SS<space>DD/MM/YY (UTC). For example: “15.30.45 17/09/15”
Command execution result:
"OK" - command executed successfully
"BUSY" - command cannot be executed at the moment
"NO CAMERA" - device is not configured to work with the camera
"NOT CONNECTED" - no communication with the camera
"TURNED OFF" - automatic shooting is disabled
"DISK ERROR" - SD card error
"NO PHOTO" - photo not found
<ans> "SS ERROR" - error retrieving camera photo
"EMAIL SEND ERROR" - failed to send photo to e-mail

<state><s><version><s>DIR<s><dir> - Response to get camera information

<state> - automatic shooting mode
"ON" - enabled;
"OFF" - disabled;
<version> - camera version: "VC0706 1.00
<dir> - directory in which the photos are saved: “PHOTOS”

98
Command to enable/disable automatic shooting
DCAM<s><cmd>
Example:
Command
DCAM ON
DCAM OFF
Response DCAM<s><cmd>:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
Command execution result:
"OK" - command executed successfully
<ans> "BUSY" - command cannot be executed at this time
"NO CAMERA" - device is not configured to work with the camera
"TURNED OFF" - automatic shooting is disabled

Command to get information about camera

Command DCAM<s>INFO
Response DCAM<s>INFO:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
Command execution result:
<state><s><version><s>DIR<s><dir>
Field Description:
< state > - automatic shooting mode
<ans>
"ON" - enabled;
"OFF" - disabled;
<version> - camera version: "VC0706 1.00
<dir> - directory in which the photos are saved: “PHOTOS”.

Responses to camera control commands

Note: <cmd> - passed command without parameters
Response Description
<cmd>: OK Command executed successfully
<cmd>: BUSY Command cannot be executed at this time
<cmd>: NO CAMERA Device is not configured to work with the camera
<cmd>: NOT CONNECTED No communication with camera
<cmd>: TURNED OFF Automatic shooting is disabled
<cmd>: DISK ERROR SD card error
<cmd>: NO PHOTO Photo not found
<cmd>: SS ERROR Error getting photo from camera
<cmd>: EMAIL SEND ERROR Failed to send photo to e-mail
Response to get camera information command:
<state> - automatic shooting mode
DCAM INFO: <state> <version> DIR "ON" - enabled;
<dir> "OFF" - disabled;
<version> - camera version"VC0706 1.00
<dir> - directory in which the photos are saved “PHOTOS”
Reply to the nearest photo request regarding <date>
<date> - date when photo was created, if not in the command, new photo is
DCAM PHOTO: <date>
created. Format: HH.MM.SS<space>DD/MM/YY (in UTC).
“15.30.45 17/09/15”

99
 4.2.12. Working with built-in accelerometer

Query the current calibration information

Command CALIB<s>ACL<s>?
Response CALIB<s>ACL:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
explanatory message:
- "Accelerometer calibration is not supported";
<ans> - "Accelerometer is not calibrated";
- "Accelerometer calibrated by displacement";
- "Accelerometer is calibrated along axes."

Command to start offline calibration (fully manual)

Command CALIB<s>ACL<s>S
Response CALIB<s>ACL:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
explanatory message:
- "Accelerometer calibration is not supported";
- "Static calibration started";
- "Dynamic calibration started";
<ans> - "Calibration completed";
- "Error: failed to measure gravity";
- "Error: car was moving (vibrating strongly)";
- "Error: car did not move";
- "Error: not enough sharp acceleration/braking."

Command to start GNSS calibration (semi-automatic)

Command CALIB<s>ACL<s>G
Response CALIB<s>ACL:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
explanatory message:
- "Accelerometer calibration is not supported";
- "GNSS static calibration started";
<ans> - "GNSS dynamic calibration started";
- "Calibration completed";
- "Error: failed to measure gravity";
- "Error: car was moving (vibrating strongly)."

Command to start calibration status check (fully manual)

Command CALIB<s>ACL<s>C
Response CALIB<s>ACL:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
explanatory message:
- "Accelerometer calibration is not supported";
- "Static check started";
- "Dynamic check started";
<ans>
- "Error: failed to measure gravity";
- "Error: car did not move";
- "Calibration is correct";
- "Calibration must be repeated.

100
Command to cancel the previously started calibration
Command CALIB<s>ACL<s>R
Response CALIB<s>ACL:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
explanatory message:
<ans> - "Accelerometer calibration is not supported";
- "Calibration interrupted."

Command to reset current calibration

Command CALIB<s>ACL<s>E
Response CALIB<s>ACL:<s><ans>
Designations Interpretation
<s> Field separator - space (0x20)
explanatory message:
<ans>
- "Calibration reset."

4.2.13. Communication between external interfaces

This command allows you to send an arbitrary data string to the device interface or internal module.
After sending data, device “listens to” the interface for 500 ms and returns a response without
formatting. If no response is received within 500 ms, the response field will be empty.

*!UC<s><i>,<msg>
Command Example:
*! UC RS485,3101066C
Response *@UC<s><i>,<ans>
Designations Interpretation
<s> Parameter separator - space (0x20).
Interface:
 "RS485" - RS-485 device interface,
<i>
 "RS232" - RS-232 device interface,
 "GPS" - built-in navigation module.

For RS232, RS485: Packet as HEX string (ASCII).

<msg>
For GPS: Packet in NMEA protocol without checksum (device adds checksum).

If response was received - HEX String (ASCII);

<ans>
If response was not received - empty string.

101
 4.3. SMS configuration

4.3.1. EDITS and READ command formats

For detailed description of commands and general rules for working with them, see "6. Working with
device configuration”.

Writing configuration

Sending a command causes the device to reboot

*!EDITS<s><p>:<t>(<a1>,<a2>,…<aX>)
Command Example:
*!EDITS TRANS:SRV1(,,,193.193.165.165,20966)
*@EDITS<s><result>,<p>:<t>(<a1>,<a2>,…<aX>)
Response Example:
*@EDITS OK,TRANS:SRV1(FLEX,0,1,193.193.165.165,20966)
Designations Interpretation
<s> parameter separator - space (0x20).
<p> name of the page on which the tag is located. Must end with ":".
<t> name of the tag you want to edit. Must end with "(".
<aX> values of parameters written to the device. The last tag parameter must end with ")".
command execution result:
<result> - "OK" - command executed;
- "FAIL" - error in the command.

Reading configuration

*!READ<s><p>:<t>
Command Example:
*!READ TRANS:AP1
*@READ<s><result>,<p>:<t>(<a1>,<a2>,…<aX>)
Response Example:
*@READ OK,TRANS:AP1(internet.mts.ru,mts,mts)
Designations Interpretation
<s> parameter separator - space (0x20).
<p> name of the page on which the tag is located. Must end with ":".
<t> name of the tag you want to edit. Must end with "(".
<aX> values of parameters written to the device. The last tag parameter must end with ")".
command execution result:
<result> - "OK" - command executed;
- "FAIL" - error in the command.

FLEX bit mask edit command

Sending a command causes the device to reboot

<HEAD>*!SETFM<s><n>:<m>[,<n>:<m>]
Command Example:
<HEAD>*!SETFM 7:1111,20:11
Response <HEAD>*@SETFM<s><n>:<m>
Designations Interpretation
<s> Parameter separator - space (0x20).
Index from which the bits will be set starts from 1. The parameter number corresponds to the number
<n>
from the table “Structure of FLEX telemetry records”.
<m> Bit mask.

102
 4.3.2. SET and GET command formats
ATTENTION!
This section lists old command formats that are temporarily supported for backward compatibility.

Commands

№ Command text Command description Response message

Writes the main parameters necessary to
work with the server to the device:
<x> - server number from 1 to 3, if not,
the settings are edited for the first server Contains the current device settings:
<y> - SIM card number from 1 to 2, if not CUR. <x>. <y> - message type
available, the settings are edited for the <IP> - IP address or domain name of the server
first card <port> - server port
<IP> - IP address or domain name of the <IDo> - identification number of the object
server. For example: 90.156.232.36 <IDc> - personal account number
<port> - port. For example: 4000 <apn> - name of the access point of the cellular
SET.<x>.<y>
< IDo > - identification number of the operator
<IP>
object <login> - login of the cellular operator
<port>
<IDc> - personal account number <password> - password of the cellular operator
<IDo>
<apn> - name of the cellular operator <protocol> - communication protocol with the
1 <IDc>
access point. For example: internet.mts.ru server
<apn>
<login> - login of the cellular operator. For <IMEI> - unique number of the object
<login>
example: mts Comes after the reboot.
<password>
<password> - password of the cellular
<protocol>
operator. For example: mts Where:
<protocol> - communication protocol with <x> - server number from 1 to 3, if not, the
the server. Accepted values: settings are edited for the first server
“F6”; <y> - SIM card number from 1 to 2, if not
“F5.2”; available, the settings are edited for the first
“FLEX”; card
"EGTS" - without authorization;
"EGTS_A" - EGTS with authorization.
Separator between parameters is space or
row wrap.
Writes the main parameters necessary to Contains the current device settings:
work with the server to the device: CUR1. <x>. <y> is the message type
<x> - server number from 1 to 3, if not, <IP> - IP address or domain name of the server
the settings are edited for the first server <port> - server port
<y> - SIM card number from 1 to 2, if not <IDo> - identification number of the object
SET1.<x>.<y>
available, the settings are edited for the <IDc> - personal account number
<IP>
first card <IMEI> - unique number of the object
<port>
2 <IP> - IP address or domain name of the Comes after the reboot.
<IDo>
server. For example: 90.156.232.36
<IDc>
<port> - port. For example: 4000 Where:
<IDo> - identification number of the <x> - server number from 1 to 3, if not, the
object. settings are edited for the first server
<IDc> - personal account number <y> - SIM card number from 1 to 2, if not
Separator between parameters is space or available, the settings are edited for the first
row wrap. card
Writes to the device the parameters
Contains the current device settings:
necessary for accessing the Internet (GPRS
CUR2. <x>. <y> - message type
settings):
<apn> - name of the access point of the cellular
<x> - server number from 1 to 3, if not,
SET2.<x>.<y> operator
the settings are edited for the first server
<apn> <login> - login of the cellular operator
<y> - SIM card number from 1 to 2, if not
3 <login> <password> - password of the cellular operator
available, the settings are edited for the
<password> <protocol> - communication protocol with the
first card
<protocol> server
<apn> - name of the cellular operator
Comes after the reboot.
access point. For example: internet.mts.ru
<login> - login of the cellular operator. For
Where:
example: mts

103
 <password> - password of the cellular <x> - server number from 1 to 3, if not, the
operator. For example: mts settings are edited for the first server
<protocol> - communication protocol with <y> - SIM card number from 1 to 2, if not
the server available, the settings are edited for the first
Accepted values: card
“F6”;
“F5.2”;
“FLEX”;
"EGTS" - without authorization;
"EGTS_A" - EGTS with authorization.
Separator between parameters is space or
row wrap.
Edits the TM key settings (the key page
must already be in the device):
<num> - number of the key in the
configuration (2 characters always, 01-16,
for example "01");
If command successfully executed:
SETTM<num> <address> - key address (12 characters
SETTM OK.
<address> <mode> - key operation mode (5
4 <mode> characters
If there is error in the command, a standard text
<nick_name> "NOACT" - no action;
response for the SET command will be
"GUARD" - changes the security mode;
generated.
"IMMOB" - immobilizer.
<nick_name> - key alias (10 characters,
there is no extended key storage format
Separator between parameters is space or
row wrap.

Queries

Text
№ Command Description Reply Message
Commands
Contains the current device settings:
CUR. <x>. <y> - message type
<IP> - IP address or domain name of the server
<port> - server port
<IDo> - identification number of the object
<IDc> - personal account number
<apn> - name of the access point of the cellular
operator
<login> - login of the cellular operator
Gets the current device settings required to <password> - password of the cellular operator
1 GET.<x>.<y> work with the server and generated in the <protocol> - communication protocol with the
template. server
<IMEI> - unique object number

Where:
<x> - server number from 1 to 3, if not, the
settings are edited for the first server
<y> - SIM card number from 1 to 2, if not
available, the settings are edited for the first
card

Contains the current device settings:

CUR1. <x>. <y> - message type
<IP> - IP address or domain name of the
server
Gets the current device settings required to
<port> - server port
2 GET1.<x>.<y> work with the server and generated in the
<IDo> - identification number of the object
template.
<IDc> - personal account number
<IMEI> - unique number of the object

Where:

104
 <x> - server number from 1 to 3, if not, the
settings are edited for the first server
<y> - SIM card number from 1 to 2, if not
available, the settings are edited for the first
card
CUR2. <x>. <y> - message type
<apn> - name of the access point of the cellular
operator
<login> - login of the cellular operator
<password> - password of the cellular operator
Gets the current device settings required to <protocol> - exchange protocol with the server
3 GET2.<x>.<y> access the Internet and generated in the
template. Where:
<x> - server number from 1 to 3, if not, the
settings are edited for the first server
<y> - SIM card number from 1 to 2, if not
available, the settings are edited for the first
card

If error occurs while reading the configuration SMS command, SMS message error information will be
generated. The settings will not be edited.

Structure of the response SMS error message:

<Title>
<Error type>

<Title> field contains the fixed string "Error!"

<Error type > field can have the following values:
"No settings have been set."
“Parameter # < Parameter number> contains an invalid length”.
“Parameter # < Parameter number> contains an invalid character”.
“Value for <Parameter number> exceeds the allowed size”.

<Parameter number> field is the sequence number of the parameter from the beginning of the SMS,
not including the message header

List of excluded characters for parameters of general type: <,>, control characters.
Numeric parameters do not allow all characters except digits.

105
 5. Tone control
When dialing, it is possible to control device using tone commands. The command end sign is always the
"*" key (asterisk). If you want to break the link after executing the command, enter the "#" sign (number
sign). In this case, the device will disconnect as soon as commands are received. At the same time,
commands and password must be entered as additional parameters of a single long phone number after
the phone number itself, for example:

+79999999999P1234*1#
where:
+79999999999 - SIM card phone number in the device;
P - Latin letter "P," meaning pause in the set of tones;
1234 * - password with the sign of its completion;
1 - command to activate the first control output O1;
# - sign of the end of command entry and disconnecting connection.

Thus, it is possible to enable output control selecting subscriber from the phone book, whose phone
number is written in the form: +79999999999P1234*1#, and call him. After receiving the command, the
connection will be broken.

Command
№ Description
(key sequence)
1 1* Enable the first control output O1
2 10* Disable the first control output O1
3 2* Enable the second control output O2
4 20* Disable the second control output O2
5 3* Enable the third control output O3
6 30* Disable the third control output O3
7 4* Enable the forth control output O4
8 40* Disable the forth control output O4
9 54x* Locking sensor with sequence number X = 1..5
10 55x* Unlocking sensor with sequence number X = 1..5
11 549* Locking internal impact, tilt and movement sensors
12 559* Unlocking internal impact, tilt and movement sensors

106
 6. Working with device configuration
6.1. Basic principles and description of commands
Remote configuration allows you to remotely change the device configuration without using computer.
Command structure depends on the configuration structure of the device (short example of the structure
is given in “6.2. Example of device configuration structure”.
Parameters are accessed using the following scheme: Page -> Tag -> Parameters.
Parameters are arranged in strict order according to the configuration structure. The command specifies
the parameters from the first to the last to be changed.
If the command is incomplete, then the filled fields will be replaced, and empty (two commas in a row)
will be ignored.
If "!" is entered instead of the parameter in the command then the parameter in the device configuration
is reset to zero (if the parameter is text - it is erased, if numeric, it is set to 0).

Writing configuration

Sending a command causes the device to reboot

*!EDITS<s><p>:<t>(<a1>,<a2>,…<aX>)
Command Example:
*!EDITS TRANS:SRV1(,,,193.193.165.165,20966)
*@EDITS<s><result>,<p>:<t>(<a1>,<a2>,…<aX>)
Response Example:
*@EDITS OK,TRANS:SRV1(FLEX,0,1,193.193.165.165,20966)
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation
<s> parameter separator - space.
<p> name of the page on which the tag is located. Must end with ":".
<t> name of the tag you want to edit. Must end with "(".
<aX> values of parameters written to the device. The last tag parameter must end with ")".
command execution result:
<result> - "OK" - command executed;
- "FAIL" - error in the command.

107
 Reading configuration

*!READ<s><p>:<t>
Command Example:
*!READ TRANS:AP1
*@READ<s><result>,<p>:<t>(<a1>,<a2>,…<aX>)
Response Example:
*@READ OK,TRANS:AP1(internet.mts.ru,mts,mts)
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation
<s> parameter separator - space.
<p> name of the page on which the tag is located. Must end with ":".
<t> name of the tag you want to edit. Must end with "(".
<aX> values of parameters written to the device. The last tag parameter must end with ")".
command execution result:
<result> - "OK" - command executed;
- "FAIL" - error in the command.

The command format supports accessing multiple pages and tags in one command, for this you need to
write the name of the following page or tag separated by a comma:

*!EDITS TRANS:SRV1(FLEX,,,193.193.165.165,20966),AP1(internet.mts.ru,mts,mts)
*!READ TRANS:SRV1,AP1

FLEX bit mask edit command

Sending a command causes the device to reboot

<HEAD>*!SETFM<s><n>:<m>[,<n>:<m>]
Command Example:
<HEAD>*!SETFM 7:1111,20:00
Response <HEAD>*@SETFM<s><n>:<m>
Exchange
GPRS, USB, Bluetooth, SMS
channel
Designations Interpretation Data Format
<HEAD> 16 byte NTCB packet header with preamble 16*U8
*!SETFM 0x2A 0x21 0x53 0x45 0x54 0x46 0x4D char[7]
*@SETFM 0x2A 0x40 0x53 0x45 0x54 0x46 0x4D char[7]
<s> Parameter separator - space (0x20). char
Index from which the bits will be set, starts with 1. Parameter number
<n> char
corresponds to the number in the “FLEX telemetry record structure” table.
<m> Bit mask. char

Additionally, to be able to edit the FLEX mask using SMS, the service symbol "&" is entered. If you use
the construction described below in the EDITS command in the parameter field, this will allow you to edit
the parameter bitwise.

Field format Description of parameters

Format for bitwise editing FLEX mask settings:
<n> - index from which the bits will be set, starts with 1. Parameter number
&<n>[<m>]...<n>[<m>]
corresponds to the number in the “FLEX telemetry record structure” table.
<m> - bit mask.

Example of a command that includes 4 bits in 1 starting with the 6th bit (7th parameter from the FLEX
Telemetry Record Structure table) and disables 124 and 125 bits (125th and 126th parameters from the
“FLEX telemetry record structure” table):

*!EDITS PROTOCOL:FLEX(,&7[1111]20[00])

108
 6.2. Example of device configuration structure

For a complete configuration structure, see the document "24xx. 26xx. Device Configuration”

Parameter Value Type Zeroing

Page: TRANS Parameters that determine the order in which data is transferred.
Tag: OBJECT Object parameters.
Object name (up to 64 characters).
name Char[24] Yes
By default, "NONAME."
Tag: SRV1 Transfer parameters for the 1st server.
Data transfer protocol:
1. “F5.2”,
2. “F6”,
protocol 3. “FLEX”, Char[8] Yes
4. "EGTS" - EGST without authorization,
5. "EGTSAUTH" - EGST with authorization.
The default is FLEX.
Object ID.
objID U32 Yes
The default is 0.
ID of the dispatch center (personal account number).
dcID U32 Yes
The default is 1.
IP address or domain name of the server. For example, "89.208.152.54."
addr Char[35] Yes
The default is "0.0.0.0" (This value indicates that the server is not in use).
Port. For example: "5100."
port Char[7] Yes
The default is "0."
Transport layer protocol:
 “TCP”,
transProto Char[3] Yes
 “UDP”.
The default is "TCP."
Tag: SRV2 Parameters of the 2nd server.
See tag: SRV1
Tag: SRV3 Parameters of the 3rd server.
See tag: SRV1
Tag: AP1 Access point settings for SIM1.
Name of the access point of the cellular operator. For example:
"internet.mts.ru"
name Char[30] Yes
The default is "". Blank entry in the name, login, pass parameters indicates
that the access point is set to Automatic.
Login of the mobile operator. For example: "mts"
login The default is "". Blank entry in the name, login, pass parameters indicates Char[20] Yes
that the access point is set to Automatic.
Password of the cellular operator. For example: "mts"
pass The default is "". Blank entry in the name, login, pass parameters indicates Char[20] Yes
that the access point is set to Automatic.
SIM card PIN.
pin Char[9] Yes
The default is. "" This value disables PIN verification on the SIM card
Tag: AP2 Access point settings for SIM2.
See tag: AP1

109
 Annex A. Telemetry record structures
Annex A.1. Structure of FLEX telemetry records

This table contains the current structure of the telemetry packet with separation by versions.

Size of
Data
№ Record field record Accepted value
format
item
FLEX 1.0
End-to-end record number in non- Starts from zero, increments on each record. Never
1 4 U32
volatile memory decreases.
The codes specified in the table are recorded in the
2 Event ID corresponding to this record 2 U16
protocol
3 Event time 4 U32 Number of seconds since 1970
Bit field:
Bits Value
0 Test mode
1 - test mode
0 - operating mode
1 Alarm alert
1 - enabled
0 - disabled
2 Alarm
1 - enabled
0 - disabled
3-4 Operating mode:
0 - surveillance
4 Device status 1 U8
1 - security
2 - additional security
3 - service
5 Evacuation:
0 - not fixed
1 - fixed
6 Power saving mode:
0 - no;
1 - yes.
7 Accelerometer calibration:
0 - not calibrated
1 - calibrated

110
 Bit field:
Categori Value
es
0 0 - GSM is on
1 - GSM is off
1 0 - USB disabled
1 - USB enabled
2 0 - additional high-precision
navigation receiver is disabled
1 - additional high-precision
navigation receiver is connected

5 Status of function modules 1 1 U8

3 0 - clock is not synchronized by GPS
1- clock synchronized by GPS
4 0 - the first SIM card works
1 - the second SIM card works
5 0 - no registration in the cellular
network
1- registration in the cellular
network
6 0 - home cellular network
1- roaming
7 0 - engine (generator) is off
1 - engine (generator) is on

Bit field:
Bits Value
0-1 0 - no GSM jamming
1 - GSM jamming detected
2 - industrial interference detected
2 0 - no GNSS jamming
1 - GNSS jamming detected
3 GNSS coordinate averaging:
0 - no;
1 - yes.
6 Status of function modules 2 1 U8 4 Accelerometer status:
0 - regular operation;
1 - error.
5 Bluetooth module status:
0 - off
1 - on
6 Wi-Fi module status:
1 - on
0 - off
7 Reserve

0: -113 dB/m or less

1: - 111 dB/m
7 GSM layer 1 U8 2.. 30: -109.. -53 Db/m
31: -51 dB/m or more
99: no cellular signal.
Bit field:
Bits Values
0 0 - navigation receiver is off;
1 - navigation receiver is on.
Status of GPS/GLONASS navigation 1 0 - not valid navigation;
8 1 U8
sensor 1 - valid navigation.
2..7 Number of navigation satellites 0-32

9 Time of last valid coordinates 4 U32 Number of seconds since 1970

111
 Latitude angle recorded when obtaining the last
valid coordinates.
10 Last valid latitude 4 I32 ten thousandths of a minute.
For example, 55 ° 42,2389'will be represented as
33422389
Longitude angle recorded when obtaining the last
valid coordinates.
11 Last valid longitude 4 I32 ten thousandths of a minute.
For example, 37 ° 41,6063'will be represented as
22616063
Altitude relative to sea level recorded when
obtaining the last valid coordinates:
12 Last valid height 4 I32 decimeters
For example, 205 meters will be presented as 2050
decimeters
Speed recorded when obtaining the last valid
13 Speed 4 Float coordinates.
km/h
Course recorded when obtaining the last valid
14 Course 2 U16 coordinates.
0° … 360°
Mileage recorded at the time of the event,
15 Current mileage 4 Float calculated during the arrival of valid navigation data.
km.
Mileage calculated between this event and the
16 Last track segment 4 Float previous one. (between two track points)
km.
Total number of seconds in the last Total number of computation points by the
17 2 U16
track segment navigation receiver at a rate of once per second.
Number of seconds on the last track Number of calculation points by the navigation
18 segment along which the mileage was 2 U16 receiver of coordinates at a rate of once per second
calculated (valid navigation) with valid navigation data.
millivolts
19 Main power supply voltage 2 U16
0-65535 mV
millivolts
20 Backup power supply voltage 2 U16
0-65535 mV
millivolts
21 Voltage at analog input 1 (Ain1) 2 U16
0-65535 mV
millivolts
22 Voltage at analog input 2 (Ain2) 2 U16
0-65535 mV
millivolts
23 Voltage at analog input 3 (Ain3) 2 U16
0-65535 mV
millivolts
24 Voltage at analog input 4 (Ain4) 2 U16
0-65535 mV
millivolts
25 Voltage at analog input 5 (Ain5) 2 U16
0-65535 mV
millivolts
26 Voltage at analog input 6 (Ain6) 2 U16
0-65535 mV
millivolts
27 Voltage at analog input 7 (Ain7) 2 U16
0-65535 mV
millivolts
28 Voltage at analog input 8 (Ain8) 2 U16
0-65535 mV

112
 Bit field:
Bits Values
0 input In1
1 input In2
2 input In3
3 input In4
29 Current readings of discrete sensors 1 1 U8
4 input In5
5 input In6
6 input In7
7 input In8
0 - sensor in normal condition
1 - sensor triggered
Bit field:
Bits Values
0 input In9
1 input In10
2 input In11
3 input In12
30 Current readings of discrete sensors 2 1 U8
4 input In13
5 input In14
6 input In15
7 input In16
0 - sensor in normal condition
1 - sensor triggered
Bit field:
Bits Values
0 1st output
1 2nd output
2 3rd output
3 4th output
31 Current state of outputs 1 1 U8
4 5th output
5 6th output
6 7th output
7 8th output
0- output disabled
1- output enabled
Bit field:
Bits Values
0 9th output
1 10th output
2 11th output
3 12th output
32 Current state of outputs 2 1 U8
4 13th output
5 14th output
6 15th output
7 16th output
0- output disabled
1- output enabled
Number of pulses counted at the time of the event
33 Readings of pulse counter 1 4 U32
0-232
Number of pulses counted at the time of the event
34 Readings of pulse counter 2 4 U32
0-232
Frequency on analog-frequency fuel
35 2 U16 Frequency value 0-20000 Hz
level sensor 1
Frequency on analog-frequency fuel
36 2 U16 Frequency value 0-20000 Hz
level sensor 2
Engine hours counted at generator
37 4 U32 0-232 sec
operation sensor trigger

113
 Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
38 2 U16 Notes:
sensor 1 RS-485
1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
39 2 U16 Notes:
sensor 2 RS-485
1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
40 2 U16 Notes:
sensor 3 RS-485
1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
41 2 U16 Notes:
sensor 4 RS-485
1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
42 2 U16 Notes:
sensor 5 RS-485
1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
43 2 U16 Notes:
sensor 6 RS-485
1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
44 2 U16 Notes:
sensor RS-232
1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.

114
 Temperature from digital sensor 1 (in -55 ° С... + 125
45 1 I8
degrees Celsius) (-128 ° C - sensor not connected
Temperature from digital sensor 2 (in -55 ° С... + 125
46 1 I8
degrees Celsius) (-128 ° C - sensor not connected
Temperature from digital sensor 3 (in -55 ° С... + 125
47 1 I8
degrees Celsius) (-128 ° C - sensor not connected
Temperature from digital sensor 4 (in -55 ° С... + 125
48 1 I8
degrees Celsius) (-128 ° C - sensor not connected
Temperature from digital sensor 5 (in -55 ° С... + 125
49 1 I8
degrees Celsius) (-128 ° C - sensor not connected
Temperature from digital sensor 6 (in -55 ° С... + 125
50 1 I8
degrees Celsius) (-128 ° C - sensor not connected
Temperature from digital sensor 7 (in -55 ° С... + 125
51 1 I8
degrees Celsius) (-128 ° C - sensor not connected
Temperature from digital sensor 8 (in -55 ° С... + 125
52 1 I8
degrees Celsius) (-128 ° C - sensor not connected
Bits Values
0-14 If bit 15 is equal to one
0-100 in% (accuracy up to 1%)

If bit 15 is zero
CAN
53 2 U16 0-32766 in 0.1 liters (0-3276.6 liters)
Fuel level in the tank
32767 (0x7FFF) – parameter not
read
15 1 - percentage of volume
0 - volume in tenths of Liters

Liters
CAN
54 4 Float 0 - (3.4 • 1038) L
Total fuel consumption
If the value is negative, the parameter is not read
Revolutions per minute
CAN
55 2 U16 0-65534
Engine RPM
65535 (0xFFFF) - parameter not read
In degrees Celsius
CAN
56 1 I8 -127 to 127 ° С
Coolant (engine) temperature
-128 ° C (0x80) - parameter not read
Kilometers
CAN
57 4 Float 0 - (3,4 • 1038) km
Total vehicle mileage
If value is negative, parameter is not read
kilograms
CAN
58 2 U16 0-65534 kg
Axle load 1
65535 (0xFFFF) - parameter not read
kilograms
CAN
59 2 U16 0-65534 kg
Axle load 2
65535 (0xFFFF) - parameter not read
kilograms
CAN
60 2 U16 0-65534 kg
Axle load 3
65535 (0xFFFF) - parameter not read
kilograms
CAN
61 2 U16 0-65534 kg
Axle load 4
65535 (0xFFFF) - parameter not read
kilograms
CAN
62 2 U16 0-65534 kg
Axle load 5
65535 (0xFFFF) - parameter not read
CAN 0-100%
63 1 U8
Gas pedal position 255 (0xFF) - parameter not read
CAN 0-100%
64 1 U8
Brake pedal position 255 (0xFF) - parameter not read
CAN 0-100%
65 1 U8
Engine load 255 (0xFF) - parameter not read

115
 Bits Value
0-14 If bit 15 is equal to one
0-100 in% (accuracy up to 1%)

If bit 15 is zero
CAN 0-32766 in 0.1 liters (0-3276.6
66 2 U16
Liquid level in the diesel exhaust filter liters)
32767 (0x7FFF) - parameter not
read
15 1 - percentage of volume
0 - volume in tenths of a liter

CAN seconds
67 4 U32
Total engine hours 0-232 sec
kilometers
CAN
68 2 I16 0-32767 * 5km
Distance up to maintenance
-1 (0xFFFF) - parameter not read
kilometers per hour
CAN
69 1 U8 0-254
Vehicle speed
255 (0xFF) - parameter not read
FLEX 2.0
Number of visible GLONASS satellites
U8
0-32
Number of visible GPS satellites
U8
0-32
Number of visible Galileo satellites
U8
0-32
Number of visible Compass satellites
U8
0-32
70 Navigation information 8
Number of visible Beidou satellites
U8
0-32
Number of visible DORIS satellites
U8
0-32
Number of visible IRNSS satellites
U8
0-32
Number of visible QZSS satellites
U8
0-32
HDOP of the operational receiver U8 0.1... 25.0 (1-250, value multiplied by 10)
71 2
PDOP of the operational receiver U8 0.1... 25.0 (1-250, value multiplied by 10)
Bit field:
Bits Values
0 0 - navigation information in float
point
1 - navigation information in fixed
State of additional high-precision point
72 1 U8 1 0 - receiver does not operate in RTK
navigation receiver
mode;
1 - receiver operates in RTK mode
(float or fixed)
2..7 Number of navigation satellites 0-32

Latitude angle recorded when obtaining the last

Latitude of coordinate from high-
I64 valid coordinates.
precision receiver
destimilational fractions of a minute.
73 16
Longitude angle recorded when obtaining the last
Longitude of coordinate from high-
I64 valid coordinates.
precision receiver
destimilational fractions of a minute.

116
 Altitude relative to sea level recorded when
obtaining the last valid coordinates:
74 Altitude from high-precision receiver 4 I32 millimeters
For example, 205 meters will be represented by
205,000 millimeters
Course recorded when obtaining the last valid
coordinates.
75 Course from high-precision receiver 2 U16
hundredths of a degree.
For example, 270 ° will be represented as 27,000
Speed recorded when obtaining the last valid
76 Speed from high-precision receiver 4 Float coordinates.
km/h
U32 Cell id
U16 Local area code (lac)
Mobile country code where the base station is
U16
located (mcc)
Location-based service (LBS)
U16 Mobile network code (mnc)
information
Level of radio signal received via this channel at the
telephone receiver input. Measured in "decibels to
S8
milliwatt" (dBm). It ranges − about 35 dBm - − 111
dBm
U32 Cell id
U16 Local area code (lac)
Mobile country code where the base station is
U16
located (mcc)
Nearby station #1 (LBS) information U16 Mobile network code (mnc)
77 37
Level of radio signal received via this channel at the
telephone receiver input. Measured in "decibels to
S8
milliwatt" (dBm). It ranges − about 35 dBm - − 111
dBm
U32 Cell id
U16 Local area code (lac)
Mobile country code where the base station is
U16
located (mcc)
Nearby station #2 (LBS) information U16 Mobile network code (mnc)
Level of radio signal received via this channel at the
telephone receiver input. Measured in "decibels to
S8
milliwatt" (dBm). It ranges − about 35 dBm - − 111
dBm
Last data time received from LBS U32 Number of seconds since 1970
Temperature measured by fuel level Temperature value for SCL
78 1 I8
sensor 1 RS485 -128 ° С... + 127
Temperature measured by fuel level Temperature value for SCL
79 1 I8
sensor 2 RS485 -128 ° С... + 127
Temperature measured by fuel level Temperature value for SCL
80 1 I8
sensor 3 RS485 -128 ° С... + 127
Temperature measured by fuel level Temperature value for SCL
81 1 I8
sensor 4 RS485 -128 ° С... + 127
Temperature measured by fuel level Temperature value for SCL
82 1 I8
sensor 5 RS485 -128 ° С... + 127
Temperature measured by fuel level Temperature value for SCL
83 1 I8
sensor 6 RS485 -128 ° С... + 127
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 7 RS485
84 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 7 RS485 -128 ° С... + 127

117
 Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 8 RS485
85 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 8 RS485 -128 ° С... + 127
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 9 RS485
86 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 9 RS485 -128 ° С... + 127
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 10 RS485
87 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 10 RS485 -128 ° С... + 127
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 11 RS485
88 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 11 RS485 -128 ° С... + 127
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 12 RS485
89 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 12 RS485 -128 ° С... + 127

118
 Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 13 RS485
90 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 13 RS485 -128 ° С... + 127
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 14 RS485
91 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 14 RS485 -128 ° С... + 127
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 15 RS485
92 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 15 RS485 -128 ° С... + 127
Relative level value for the digital sensor
0 - 65499 - level,
65500 - 65535 - error code (see Annex E)
Fuel level measured by fuel level
U16 Notes:
sensor 16 RS485
93 3 1. If calibration for the sensor is loaded into the
device, then 1 level unit corresponds to 0.1 l of fuel.
2. Depending on the setting, the entire range 0 to
65535 can be used to transfer level.
Temperature measured by fuel level Temperature value for SCL
I8
sensor 16 RS485 -128 ° С... + 127
Wheel No.
U8
If no sensor = 0
Information about 1st tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
94 6
Wheel No.
U8
If no sensor = 0
Information about 2nd tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 3rd tire pressure Pressure in 0.1 bar
95 12 U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128

119
 Wheel No.
U8
If no sensor = 0
Information about 4th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 5th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 6th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 7th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 8th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 9th tire pressure Pressure in 0.1 bar
U8 If no sensor = 0
sensor
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 10th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
96 24 Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 11th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 12th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 13th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Information about 14th tire pressure Wheel No.
U8
sensor If no sensor = 0

120
 Pressure in 0.1 bar
U8
If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 15th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 16th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 17th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 19th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 20th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
97 48 if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 21st tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 22nd tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 23rd tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 24th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
Information about 25th tire pressure If no sensor = 0
sensor Pressure in 0.1 bar
U8
If no sensor = 0

121
 Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 26th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 27th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 28th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 29th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 30th tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Wheel No.
U8
If no sensor = 0
Information about 31st tire pressure Pressure in 0.1 bar
U8
sensor If no sensor = 0
Temperature in degrees,
I8
if no sensor = -128
Bit field:
Bits Values
0..1 Driver activity 1:
0 - Rest,
1 – Ready to work,
2 - Work is not related to vehicle
driving,
3 - Vehicle driving
2..3 Driver card slot 1:
0 - No card,
1 - Not authorized,
Tachograph data: 2 - Authorized,
98 1 U8 3 - Failed to eject
Driver activity and status of card slots. 4..5 Driver activity 2:
0 - Rest,
1 – Ready to work,
2 - Work is not related to vehicle
driving,
3 - Vehicle driving
6..7 Driver card slot 2:
0 - No card,
1 - Not authorized,
2 - Authorized,
3 - Failed to eject

122
 0 - Tachograph disabled,
1 - Driver,
2 - Master,
99 Tachograph operation mode/card 1 U8
3 - Inspector,
4 - Enterprise,
5 - Crew.
Bit field:
Bits Values
0 Ignition:
0 - off;
1 - on.
1 GND disabled:
0 - no;
1 - yes.
2 "Ferry/Train" mode:
0 - off;
1 - on.
3 "Not applicable" mode:
0 - off;
1 - on.
4 Backlight:
0 - off;
1 - on.
5 Tachograph communication error:
0 - no;
1 - yes.
100 Status flags from tachograph 2 U16 6-8 Driver 1 working modes defined in
time:
0 - no time limit warnings found;
1 - limit #1:15 min before the onset
of 4.5 hours of continuous driving;
2 - limit #2: exceeding 4.5 hours of
continuous driving
3 - limit #3: 15 min to additional
Warning 1
4 - constraint #4: Warning 1
occurred
5 - limit #5: 15 min to additional
Warning 2
6 - Constraint # 6: Warning 2
occurred
7 - reserve.
9-11 Driver 2 working modes defined in
time:
See "Driver 1 working modes
defined in time”
12-15 Reserve

0-254 km/h
101 Speed by tachograph 1 U8
No value - 255.
Value of 1/10 km
102 Odometer by tachograph 4 U32
No value - 0xFFFFFFFF.
103 Time by tachograph 4 U32 Number of seconds since 1970

123
 0 - driver status unknown (no display);
1 - "On call";
2 - "On the road";
3 - "Available";
4 - "Waiting";
5 - "Return";
6 - "Reserve";
7 - "Working";
Current status of the driver received 8 - "Break";
104 1 U8
from display module
9 - "Ready";
10 - "Lunch";
11 - "Rest";
12 - "Repair";
13 - "Loading";
14 - "Unloading";
15 - "Breakdown";
16 - "Accident"
0 - no messages received/read;
0xFFFFFFFF - received/read message sent by NTCT
Index of the last message
105 4 U32 command;
received/read on the display module.
Other values correspond to the index of the last
received/read message
Time increment relative to previous 0-65534 - 1/100 second
106 2 U16
record 0xFFFF - value irrelevant, overflow occurred
-24000.. + 24000 (-24.. + 24 g multiplied by 1000)
X-axis linear acceleration I16
No value: -32768
-24000.. + 24000 (-24.. + 24 g multiplied by 1000)
107 Y-axis linear acceleration 6 I16
No value: -32768
-24000.. + 24000 (-24.. + 24 g multiplied by 1000)
Z-axis linear acceleration I16
No value: -32768
0-65534 - 0.01 seconds
EcoDriving. Threshold exceeding
108 2 U16 0xFFFF - value is irrelevant, duration is more than
duration
655.34 sec.
EcoDriving. Maximum value of positive 0..+24000 (-24000..+24000 mg)
I16
acceleration for the period
EcoDriving. Maximum value of 0..+24000 (-24000..+24000 mg)
109 negative acceleration (braking) for the 6 I16
period
EcoDriving. Maximum value of lateral 0..+24000 (-24000..+24000 mg)
I16
acceleration for the period
0-254
Data of passenger flow counters 1 U8
255 - no data
110 2
0-254
Data of passenger flow counters 2 U8
255 - no data
0-254
Data of passenger flow counters 3 U8
255 - no data
111 2
0-254
Data of passenger flow counters 4 U8
255 - no data
0-254
Data of passenger flow counters 5 U8
255 - no data
112 2
0-254
Data of passenger flow counters 6 U8
255 - no data
0-254
Data of passenger flow counters 7 U8
255 - no data
113 2
0-254
Data of passenger flow counters 8 U8
255 - no data
0-254
Data of passenger flow counters 9 U8
255 - no data
114 2
0-254
Data of passenger flow counters 10 U8
255 - no data

124
 0-254
Data of passenger flow counters 11 U8
255 - no data
115 2
0-254
Data of passenger flow counters 12 U8
255 - no data
0-254
Data of passenger flow counters 13 U8
255 - no data
116 2
0-254
Data of passenger flow counters 14 U8
255 - no data
0-254
Data of passenger flow counters 15 U8
255 - no data
117 2
0-254
Data of passenger flow counters 16 U8
255 - no data
Bit field:
Bits Values
0 0 - autoinformer disabled
1 - autoinformer enabled
1 0 - object outside the geofence
1 - object inside the geofence
2 0 - geofence does not correspond to
the route
1 - geofence corresponds to the
route
118 Autoinformer status 1 U8
3 0 - no errors
1 - error on the route
4 0 - no errors
1 - error when working with SD card
5 0 - no violation
1 - violation of driving mode
6 0 - automatic mode
1 - manual mode
7 reserve

1-65535
119 Last geofence ID 2 U16
0 - was not in the geofence
1-65535
120 Last stop ID 2 U16
0 - did not arrive at the stop
1-65535
121 Current route ID 2 U16
0 - route not set
Bit field:
Bits Values
0 0 - camera not available
1 - camera available
1 0 - automatic shooting is off
1 - automatic shooting is on
122 Camera status 1 U8
2 0 - normal operation mode
1 - not enough card space
3 0 - no errors
1 - error when working with SD card
4..7 reserve

125
 FLEX 3.0
Bit field:
Bits Value
0 Tamper button:
0 - normal;
1 - case is opened.
1-2 Navigation antenna status:
123 Device 2 status 1 U8 0 - no measurements are made
1 - closing in GNSS antenna
2 - GNSS antenna not
connected/break
3 - GNSS antenna connected
3-7 Reserve

Bit field:
Bits Value
0 Iridium module status:
1 - on;
124 Status of function modules 3 0 - off.
1 U8
1 Inertial navigation module status:
1 - on;
0 - off.
2-7 Reserve

Bit Field:
Bits Value
0-2 Communication status:
0 - missing;
1 - via GSM;
2 - via GPRS;
3 - via WiFi;
4 - via Iridium;
5 – WCDMA (3G);
6.. 7 - reserve
3 Working with server 1
0 - not connected;
1 - connected.
125 Communication status 1 U8 4 Working with server 2
0 - not connected;
1 - connected.
5 Working with server 3
0 - not connected;
1 - connected.
6 Working with RCS/RFU
0 - not connected;
1 - connected.
7 Working with configurator via
Bluetooth:
0 - not connected;
1 - connected.

126
 Bit field:
Bits Values
0 input In17
1 input In18
2 input In19
126 Current readings of discrete sensors 3 3 input In20
1 U8
4 input In21
5 input In22
6 input In23
7 input In24
0 - sensor in normal state;
1 – sensor triggered.
127 Pulse counter 3 readings Number of pulses counted at the time of the event
4 U32
0-232
128 Pulse counter 4 readings Number of pulses counted at the time of the event
4 U32
0-232
129 Pulse counter 5 readings Number of pulses counted at the time of the event
4 U32
0-232
130 Pulse counter 6 readings Number of pulses counted at the time of the event
4 U32
0-232
Number of pulses counted at the time of the event
131 Pulse counter 7 readings 4 U32
0-232
132 Pulse counter 8 readings Number of pulses counted at the time of the event
4 U32
0-232
133 Frequency on analog frequency sensor
2 U16 Frequency value 0-20000 Hz
3
134 Frequency on analog frequency sensor
2 U16 Frequency value 0-20000 Hz
4
135 Frequency on analog frequency sensor
2 U16 Frequency value 0-20000 Hz
5
136 Frequency on analog frequency sensor
2 U16 Frequency value 0-20000 Hz
6
137 Frequency
on analog frequency sensor
2 U16 Frequency value 0-20000 Hz
7
138 Frequency on analog frequency sensor
2 U16 Frequency value 0-20000 Hz
8
Bit field:
Bits Value
0 SH1 sensor status
1 SH2 sensor status
2 SH3 sensor status
139 Accelerometer virtual sensor status 1 U8
3 SH4 sensor status
4 WAKEUP sensor state
5..7 Reserve
0 - normal;
1 - triggered.
140 Internal tilt angle sensor. Angle of 1 U8
degrees from 0 to 25 in 0.25 degree increments.
inclination relative to local vertical
Pitch angle degrees
-90 to 90 in increments of 1
I8
forward tilt < 0
141 Internal tilt sensor. Inclination angles tilt back >
2
relative to the vertical line Roll angle degrees
-180 to 180 in 1.5 increments
I8
left roll < 0
roll to the right > 0
X axis in degrees
U8
to 180 in increments of 1
142 External tilt angle sensor. Axis 3 U8
Y-axis in degrees
deviations to 180 in increments of 1
Z-axis in degrees
U8
to 180 in increments of 1

127
 EcoDriving. Maximum value of vertical 0..+24000 (0..+24000 mg)
143 2 I16
acceleration per period
144 EcoDriving. Maximum speed per 1 U8
0.. 254 km/h
period
Bit field:
Bits Value
0 Threshold 1 state
1 Threshold 2 state
2 Threshold 3 state
145 EcoDriving. Speed thresholds state 1 U8 3 Threshold 4 state
4 Threshold 5 state
5 Threshold 6 state
6..7 Reserve
0 – threshold in normal;
1 - threshold triggered.
Bit field:
Bits Value
0 Acceleration threshold 1 state
1 Acceleration threshold 2 state
2 Acceleration threshold 3 state
3 Acceleration threshold 4 state
U8
4 Braking threshold 1 state
5 Braking threshold 2 state
6 Braking threshold 3 state
7 Braking threshold 4 state
0 – threshold in normal;
1 - threshold triggered.
Bit field:
Bits Value
0 Leftward acceleration threshold 1 state
1 Leftward acceleration threshold 2 state
2 Leftward acceleration threshold 3 state
3 Leftward acceleration threshold 4 state
146 EcoDriving. Acceleration thresholds 3 4 Rightward acceleration threshold 1
state
state
U8
5 Rightward acceleration threshold 1
state
6 Rightward acceleration threshold 1
state
7 Rightward acceleration threshold 1
state
0 – threshold in normal;
1 - threshold triggered.
Bit field:
Bits Value
0 Vertical acceleration threshold 1 state
1 Vertical acceleration threshold 2 state
U8 2 Vertical acceleration threshold 3 state
3 Vertical acceleration threshold 4 state
4..7 Reserve
0 – threshold in normal;
1 - threshold triggered.
147 Frequency at output of FLS 485 #1 0... 65534 Hz
2 U16
65535 - no data
148 Frequency at output of FLS 485 #2 0... 65534 Hz
2 U16
65535 - no data
149 Frequency at output of FLS 485 #3 0... 65534 Hz
2 U16
65535 - no data
150 Frequency at output of FLS 485 #4 0... 65534 Hz
2 U16
65535 - no data
151 Frequency at output of FLS 485 #5 0... 65534 Hz
2 U16
65535 - no data

128
 0... 65534 Hz
152 Frequency at output of FLS 485 #6 2 U16
65535 - no data
153 Frequency at output of FLS 485 #7 0... 65534 Hz
2 U16
65535 - no data
154 Frequency at output of FLS 485 #8 0... 65534 Hz
2 U16
65535 - no data
155 Frequency at output of FLS 485 #9 0... 65534 Hz
2 U16
65535 - no data
156 Frequency at output of FLS 485 #10 0... 65534 Hz
2 U16
65535 - no data
157 Frequency at output of FLS 485 #11 0... 65534 Hz
2 U16
65535 - no data
0... 65534 Hz
158 Frequency at output of FLS 485 #12 2 U16
65535 - no data
159 Frequency at output of FLS 485 #13 0... 65534 Hz
2 U16
65535 - no data
160 Frequency at output of FLS 485 #14 0... 65534 Hz
2 U16
65535 - no data
161 Frequency at output of FLS 485 #15 0... 65534 Hz
2 U16
65535 - no data
162 Frequency at output of FLS 485 #16 0... 65534 Hz
2 U16
65535 - no data
163 High-precision temperature sensor 1 − 273.15 to + 1638.35 in 0.05 increments
2 I16
0x8000 - no data
− 273.15 to + 1638.35 in 0.05 increments
164 High-precision temperature sensor 2 2 I16
0x8000 - no data
165 High-precision temperature sensor 3 − 273.15 to + 1638.35 in 0.05 increments
2 I16
0x8000 - no data
166 High-precision temperature sensor 4 − 273.15 to + 1638.35 in 0.05 increments
2 I16
0x8000 - no data
0 to 100 in 0.5% increments
167 High-precision humidity sensor 1 1 U8
0xFF - No Data
168 High-precision humidity sensor 2 0 to 100 in 0.5% increments
1 U8
0xFF - No Data
169 High-precision humidity sensor 3 0 to 100 in 0.5% increments
1 U8
0xFF - No Data
0 to 100 in 0.5% increments
170 High-precision humidity sensor 4 1 U8
0xFF - No Data
Bit field:
Bits Value
0..3 Fuel feed line operating mode
4..7 Fuel return line operating mode
8..11 Engine operating mode by flow rate
12..13 Power status
14..15 Reserve
171 Fuel flow sensor. Sensor status 2 U16 Operating modes of chambers and engine:
0 - idle run
1 - nominal mode
2 - overload
3 - tampering
4 - negative
5 - interference
6.. 15 - reserve
Bit field:
172 Fuel flow sensor. Fault information 4 U32 Bits Value
0..31 Reserve
173 Fuel flow sensor. Total fuel 4 U32
0.01 l.
consumption No value: 0xFFFFFFFF
174 Fuel flow sensor. Fuel consumption 4 U32
0.01 l.
per trip No value: 0xFFFFFFFF
175 Fuel flow sensor. Current flow rate 2 I16
0.1 l/h.
No value: 0x8000

129
 Fuel flow sensor. Total fuel volume of 0.01 l.
176 4 U32
the feed line No value: 0xFFFFFFFF
177 Fuel flow sensor. Current flow rate of 0.1 l/h
2 I16
the feed line No value: 0x8000
178 Fuel flow sensor. Temperature of the 0.1 ° С
2 I16
feed line No value: 0x8000
179 Fuel flow sensor. Total fuel volume of 0.01 L
4 U32
the return line No value: 0xFFFFFFFF
180 Fuel flow sensor. Current flow rate of 0.1 l/h
2 I16
the return line No value: 0x8000
181 Fuel flow sensor. Temperature of the 0.1 ° С
2 I16
return line No value: 0x8000
Bit field:
Bit Value
0 Communication with refrigeration unit:
0 – no communication, 1 - in
communication
1 Door status:
0 - closed, 1 - open.
2..4 Unit type:
U8
0 - unknown;
1 - ThermoKing SLX series;
2 – Carrier Standard32;
3 – Zanotti;
4 – ThermalMaster;
182 Refrigeration unit. 2 5 – Carrier NDP33LN6FB.
Unit status
5..7 Reserve

Operating mode:
0 - no data
1 - engine is off;
2 - heating;
3 - cooling;
U8 4 – thawing;
129... 170 - one of the states of the ThermoKing
SLX series installation (see Annex A4);

Other values - reserve.

Refrigeration unit. Refrigeration -273.15 to 327.67 in 0.01 °С increments

183 temperature in section 1 2 I16 No value: 0x8000
(Refrigeration temperature)
184 Refrigeration unit. Refrigeration 2 I16
-273.15 to 327.67 in 0.01 °С increments
temperature in section 2 No value: 0x8000
185 Refrigeration unit. Refrigeration 2 I16
-273.15 to 327.67 in 0.01 °С increments
temperature in section 3 No value: 0x8000
186 Refrigeration unit. Temperature set 1 -273.15 to 327.67 in 0.01 °С increments
2 I16
No value: 0x8000
187 Refrigeration unit. Temperature set 2 -273.15 to 327.67 in 0.01 °С increments
2 I16
No value: 0x8000
188 Refrigeration unit. Temperature set 3 -273.15 to 327.67 in 0.01 °С increments
2 I16
No value: 0x8000
189 Refrigeration unit. Ambient air 2 I16
-273.15 to 327.67 in 0.01 °С increments
temperature No value: 0x8000
190 Refrigeration unit. Coolant 2 I16
-273.15 to 327.67 in 0.01 °С increments
temperature No value: 0x8000
0 to 65534 in 1mV increments
191 Refrigeration unit. Battery voltage 2 U16
No value: 0xFFFF
192 Refrigeration unit. Battery current 0 to 65534 in 1 mA increments
2 U16
No value: 0xFFFF
193 Refrigeration unit. Engine hours of 4 U32
0 to 42949672.94 in 0.01 h increments
operation from the engine No value: 0xFFFFFFFF

130
 Refrigeration unit. Engine hours of 0 to 42949672.94 in 0.01 h increments
194 4 U32
operation from the network No value: 0xFFFFFFFF
Refrigeration unit. Number of errors U16 0…65535
195 Refrigeration unit. Most important 4 0…65535
U16
error code
Refrigeration unit. Code 2nd most 0…65535
U16
important error
196 4
Refrigeration unit. Code 3rd most 0…65535
U16
important error
Refrigeration unit. Code 4th most 0…65535
U16
important error
197 Refrigeration unit. Code 5th most 6 U16
0…65535
important error
Refrigeration unit. Code 6th most 0…65535
U16
important error
Operating mode:
0 - no data;
1 - no RPM, engine is stopped;
U8
2 - diesel engine works, low speed;
198 Refrigeration unit. Engine condition 3 3 - diesel engine works, high speed;
4 – powered by the network.
Engine RPM:
U16 From 0 to 65534 rpm.
0xFFFF - no data.
0 - no data;
1 - Start/Stop - mode with engine shutdown;
2 - Continuous - continuous operating mode
199 Refrigeration unit. Compressor 1 U8 129... 156 - one of the ThermoKing SLX series unit
configuration
modes of the (See Annex A4);

Other values - reserve.

Bit field:
Bits Value
0 Geofence 1
1 Geofence 2
2 Geofence 3
3 Geofence 4
4 Geofence 5
200 Information about location in 2 U16 5 Geofence 6
geofences
6 Geofence 7
7 Geofence 8
8 Geofence 9
9 Geofence 10
10..15 reserve
0 - device outside the geofence;
1 - device inside the geofence.

131
 Status flags.
Bit field:
Bits Value
0 Ignition on
1 Alarm system is switched to security
mode (in alarm mode)
2 Car is locked using a key fob
3 Key is in the ignition
4 Dynamic ignition 2 enabled
5 Front passenger door opened
201 CAN. Security status flags 2 U16 6 Rear passenger doors open
7 Reserved
8 Driver’s door open
9 Passenger doors open
10 Trunk open
11 Hood open
12 Tightened hand brake lever
13 Foot brake pressed
14 Engine is running
15 Webasto

Last event:
0 - No event;
1 - Car is locked using a key fob;
2 - Car is opened using a key fob;
3 - Trunk is opened using a key fob;
202 CAN. Security status events 1 U8 4 - Module sent a reset signal to the alarm
5 - Reserved
6 - Reserved
7 - Module switched to "sleep mode" energy saving
mode
8... 255 - Reserved

132
 Bit field:
Bit Value
0 STOP
1 Oil pressure/level
2 Refrigerant temperature/level
3 Hand brake system
4 Battery charging
5 AIRBAG (airbag)
6 Reserved
7 Reserved
8 Check the engine
9 Lighting malfunction
10 Low air pressure in the tire
11 Worn brake pads
12 Prevention
13 ABS (anti-block system)
14 Low fuel level
203 CAN. Emergency controllers 4 U32 15 Approaching Service
16 ESP (electronic stability program)
17 Glow plug indicator
18 FAP (particulate filter)
19 EPC (electrical pressure control)
20 Overall lights
21 Dipped headlights
22 High beam headlights
23 Reserved
24 Ready to start moving
25 Cruise control
26 Retarder automatic
27 Hand retarder
28 Air conditioner on
29 Reserved
30 Driver's belt
31 Passenger belt

Status of fault indication lamps.

Bit field:
Bit Value
0 Fault indication lamp is on
1 Red "Stop" lamp is on
2 Yellow "Warning" lamp is on
U8
3 "Protection" lamp is on
204 CAN. Fault information 5
4 Fault lamp flashes
5 Red "Stop" lamp flashes
6 "Warning" yellow lamp flashes
7 "Protection" lamp flashes

Diagnostics Trouble Code.

U32
0x00000000…0xFFFFFFFF
205 Custom engine hours 1 (on-load 4 U32 0-232 sec
operation)
206 Custom engine hours 2 (no load 4 U32 0-232 sec
operation)
207 User parameter #1 1 byte 1 U8, I8 A universal field can be represented as:
208 User parameter #2 1 byte 1 U8, I8 1. Unsigned integer 0... 255
209 User parameter #3 1 byte 2. Signed integer -128... 127
1 U8, I8
3. Bit field with bits 0.. 7
210 User parameter #4 1 byte 1 U8, I8
211 User parameter #5 1 byte 1 U8, I8
212 User parameter #6 1 byte 1 U8, I8
213 User parameter #7 1 byte 1 U8, I8

133
214 User parameter #8 1 byte 1 U8, I8
215 User parameter #9 1 byte 1 U8, I8
216 User parameter #10 1 byte 1 U8, I8
217 User parameter #11 1 byte 1 U8, I8
218 User parameter #12 1 byte 1 U8, I8
219 User parameter #13 1 Byte 1 U8, I8
220 User parameter #14 1 Byte 1 U8, I8
221 User parameter #15 1 byte 1 U8, I8
222 User parameter #16 1 byte 1 U8, I8
223 User parameter #1 2 bytes 2 U16, I16 Universal field can be represented as:
224 User parameter #2 2 Bytes 2 U16, I16 1. Unsigned integer 0... 65535;
225 2. Signed integer -32768... 32767;
User parameter #3 2 Bytes 2 U16, I16
3. Bit field with bits 0..15.
226 User parameter #4 2 Bytes 2 U16, I16
227 User parameter #5 2 Bytes 2 U16, I16
228 User parameter #6 2 Bytes 2 U16, I16
229 User parameter #7 2 Bytes 2 U16, I16
230 User parameter #8 2 Bytes 2 U16, I16
231 User parameter #9 2 bytes 2 U16, I16
232 User parameter #10 2 bytes 2 U16, I16
233 User parameter #11 2 bytes 2 U16, I16
234 User parameter #12 2 bytes 2 U16, I16
235 User parameter #13 2 bytes 2 U16, I16
236 User parameter #14 2 bytes 2 U16, I16
237 User parameter #15 2 bytes 2 U16, I16
U32, I32, Universal field can be represented as:
238 User parameter #1 4 bytes 4
float 1. Unsigned integer 0...4294967295
U32, I32, 2. Signed integer
239 User parameter #2 4 bytes 4
float -2147483648…2147483647;
U32, I32, 3. Bit field with bits 0.. 31
240 User parameter #3 4 bytes 4
float 4. Real number
U32, I32, -3.40282347e+38…-1.17549435e-38, 0,
241 User parameter #4 4 bytes 4
float 1.17549435E-38e …3.40282347e+38
242 User parameter #5 4 bytes U32, I32,
4
float
243 User parameter #6 4 bytes U32, I32,
4
float
244 User parameter #7 4 bytes U32, I32,
4
float
245 User parameter #8 4 bytes U32, I32,
4
float
246 User parameter #9 4 bytes U32, I32,
4
float
U32, I32,
247 User parameter #10 4 bytes 4
float
248 User parameter #11 4 bytes U32, I32,
4
float
249 User parameter #12 4 bytes U32, I32,
4
float
250 User parameter #13 4 bytes U32, I32,
4
float
251 User parameter #14 4 bytes U32, I32,
4
float
252 User parameter #15 4 bytes U32, I32,
4
float

134
 A universal field can be represented as:
1. Unsigned integer 0...18446744073709551615
2. Signed integer
U64, I64, -9223372036854775808…
253 User parameter #1 8 bytes 8
double 9223372036854775807;
3. Bit field with bits 0.. 63
4. Real number
-1.7976931348623158e+308…
-2.2250738585072014e-308, 0,
2.2250738585072014e-308e…
U64, I64, 1.7976931348623158e+308
254 User parameter #2 8 bytes 8
double

U64, I64,
255 User parameter #3 8 bytes 8
double

135
 Annex A.2. Structure of additional FLEX 2.0 telemetry records
Record Data
№ Record field Accepted value
item size format
1 Data length 2 U16 Total size of packet fields (numbered 2-15)
Version of the data structure of the static part of the
Packet to identify the compatibility of the format of
2 Data structure version 1 U8
the transmitted data on the server and in the device.
For version 1.0 10 (0x0A)
3 Data length 1 U8 Length of the static part of the packet (fields 4-14)
End-to-end record number in the Starts from zero, increments with each record. Never
4 4 U32
non-volatile memory decreases.
Event code corresponding to this Codes specified in the table are recorded in the
5 2 U16
record protocol
6 Event time 4 U32 Number of seconds since 1970
Bit field:
Bits Values
0 0 - navigation receiver is off;
Status of GPS/GLONASS 1 - navigation receiver is on.
7 1 U8
navigation sensor 1 0 - invalid navigation;
1 - valid navigation.
2..7 Number of navigation satellites 0-32

Time of the last valid coordinates

8 4 U32 Number of seconds since 1970
(before the event)
Latitude angle recorded when obtaining the last valid
coordinates.
In ten thousandths of a minute.
9 Last valid latitude 4 I32 For example
55° 42,2389'
will be presented as
33422389
Longitude angle recorded when obtaining the last
valid coordinates.
In ten thousandths of a minute.
10 Last valid longitude 4 I32 For example
37° 41,6063'
will be presented as
22616063
Altitude relative to sea level recorded when obtaining
the last valid coordinates:
In decimeters
11 Last valid altitude 4 I32 For example
205 meters
will be submitted by any
2050 decimeters
Speed recorded when obtaining the last valid
12 Speed 4 Float coordinates.
km/h
Course recorded when obtaining the last valid
13 Course 2 U16 coordinates.
0° … 360°
Mileage recorded at the time of the event, calculated
14 Current mileage 4 Float during the arrival of valid navigation data.
km.
15 Dynamic part of the packet - U8 Dataset depends on the event that occurred.

136
 Structure of the dynamic part of the FLEX 2.0 additional packet

Dynamic part of the packet contains a set of fields of various formats and contents.

General field format

Record Data
№ Record field Accepted value
item size format
1 Field type 1 U8 Variable that defines the format of the next field.
2 Field length 1 U8 Field length
Data dependent on field type and size specified by
3 Field contents - -
field length

List of possible field types for the dynamic part of the packet

0x01 - Touch Memory key.

Record Data
№ Record field Accepted value
item size format
Touch Memory key code read by the device at the
3 Touch Memory Key 8 U64
time of the event.

0x02 - driver card 1,2 (tachograph). Card number depends on the event code.

Record Data
№ Record field Accepted value
item size format
3 Driver card number 16 U8[16] Card identification number for the tachograph.

Event codes for which this packet is generated allow you to determine which card was installed.

Code Code
Interpretation
(in hexadecimal) (in decimal)
2530 9520 Installing the card in slot #1
2531 9521 Installing the card in slot #2

0x03 - RFID radio tag code.

Record Data
№ Record field Accepted value
item size format
RFID tag code read by the device at the time of the
3 RFID tag code 8 U64
event.

0x04 … 0xFF - Reserved for further expansion.

137
 Annex A.3. Examples of basic FLEX packets
FLEX 2.0 Protocol negotiation packet example

Byte number Byte Value

1 0x40
2 0x4e
@ NTC – preamble.
3 0x54
4 0x43
5 0x01
6 0x00
1 - recipient ID.
7 0x00
8 0x00
9 0x00
10 0x00
0 - sender ID.
11 0x00
12 0x00
13 0x1a
26 - number of bytes of data in the packet.
14 0x00
15 0x1b Checksum of data.
16 0x19 Header checksum.
17 0x2a
18 0x3e
19 0x46
*>FLEX
20 0x4c
21 0x45
22 0x58
23 0xb0 Symbol of FLEX protocol.
24 0x14 2.0 - protocol version.
25 0x14 2.0 - data structure version.
26 0x7a 122 - configuration field size.
27 0xf2
28 0x00
29 0x20
30 0x00
31 0x00 Bit array with information about the transmitted fields of the data structure. In this case, the
32 0x00 following fields are selected:
33 0x00 - number of record in non-volatile memory;
34 0x00 - event code corresponding to this record;
35 0x00 - event time;
36 0x00 - device status;
37 0x00 - GSM layer;
38 0x00 - voltage at the main power supply.
39 0x00
40 0x00
41 0x00
42 0x00

138
 FLEX 2.0 telemetry packet example

Byte number Byte Value

1 0x7e
~A
2 0x41
3 0x01 1 – telemetry record in a packet.
4 0x1e 30 - number of the record in the non-volatile memory.
5 0x00
6 0x00
7 0x00
8 0xb0
9 0x17 6064 - code of the incident.
10 0xe1
11 0x1d
12 0x74 1450450401 - event time in UTC (18.12.2015 @ 17:53:21 MSK GTM + 03:00)
13 0x56
14 0x00 Device status.
15 0x1f 31 - GSM level.
16 0x14
12052 - voltage at the main power supply.
17 0x2f
18 0x24 8-bit byte CRC8 of the packet.

FLEX 2.0 additional telemetry packet example

Byte number Byte Value

1 0x7e
~E
2 0x45
3 0x01 1 - one packet in the archive message.
4 0x39
Total size of the first packet - 57 bytes.
5 0x00
6 0x0a 1.0 - version of the static part of the packet.
7 0x25 Length of the static part of the packet - 37 bytes.
8 0x10
9 0x00
10 0x00 End-to-end record number - 16.
11 0x00
12 0x30
Event code - 2530 (installing card in slot #1).
13 0x25
14 0x05
15 0x37
16 0xd7 Event time.
17 0x55
18 0x33 Status of the navigation sensor.
19 0xec
20 0x36
Time of the last valid coordinates.
21 0xd7
22 0x55
23 0x7e
24 0x2d Last valid latitude.
25 0xf9

139
26 0x01
27 0x3b
28 0xcc
Last valid longitude.
29 0x14
30 0x01
31 0x0f
32 0x07
33 0x00 Last valid altitude.
34 0x00
35 0x00
36 0x00
Speed.
37 0x00
38 0x00
39 0x00
Course.
40 0x00
41 0x00
42 0x00
Current mileage.
43 0x00
44 0x00
45 0x02 Subpacket of type 2 - driver's card.
46 0x10 Length of the subpacket - 16 bytes.
47 0x12
48 0x00
49 0x00
50 0x00
51 0x00
52 0x00
53 0x00
54 0x00
Driver card number.
55 0x00
56 0x00
57 0x00
58 0x00
59 0x00
60 0x00
61 0x00
62 0x34
63 0x9a 8-bit byte CRC8 of the packet.

140
 Annex A.4. Compressor configurations and conditions for ThermoKing units
Compressor configurations for ThermoKing units

Value Configuration
129 "Diesel, Cycle-Sentry" (Standard RA Diesel Cycle-Sentry Fresh Recip)
130 "Diesel, Cycle-Sentry" (Standard RA Diesel Cycle-Sentry Frozen Recip)
131 "Diesel, Continuous" (Standard RA Diesel Continuous Fresh Recip)
132 "Diesel, Continuous" (Standard RA Diesel Continuous Frozen Recip)
133 "Electric, Cycle-Sentry" (Standard RA Electric Cycle-Sentry Fresh Recip)
134 "Electric, Cycle-Sentry" (Standard RA Electric Cycle-Sentry Frozen Recip)
135 "Electric, Continuous" (Standard RA Electric Continuous Fresh Recip)
136 "Electric, Continuous" (Standard RA Electric Continuous Frozen Recip)
137 "Diesel, Cycle-Sentry" (Standard DA Diesel Cycle-Sentry Fresh Recip)
138 "Diesel, Cycle-Sentry" (Standard DA Diesel Cycle-Sentry Frozen Recip)
139 "Diesel, Continuous" (Standard DA Diesel Continuous Fresh Recip)
140 "Diesel, Continuous" (Standard DA Diesel Continuous Frozen Recip)
141 "Electric, Cycle-Sentry" (Standard DA Electric Cycle-Sentry Fresh Recip)
142 "Electric, Cycle-Sentry" (Standard DA Electric Cycle-Sentry Frozen Recip)
143 "Electric, Continuous" (Standard DA Electric Continuous Fresh Recip)
144 "Electric, Continuous" (Standard DA Electric Continuous Frozen Recip)
145 "Diesel, Cycle-Sentry" (Economy RA Diesel Cycle-Sentry Fresh Recip)
146 "Diesel, Cycle-Sentry" (Economy RA Diesel Cycle-Sentry Frozen Recip)
147 "Diesel, Continuous" (Economy RA Diesel Continuous Fresh Recip)
148 "Diesel, Continuous" (Economy RA Diesel Continuous Frozen Recip)
149 "Electric, Cycle-Sentry" (Economy RA Electric Cycle-Sentry Fresh Recip)
150 "Electric, Cycle-Sentry" (Economy RA Electric Cycle-Sentry Frozen Recip)
151 "Electric, Continuous" (Economy RA Electric Continuous Fresh Recip)
152 "Electric, Continuous" (Economy RA Electric Continuous Frozen Recip)
153 "Diesel, Continuous" (Standard RA Diesel Modulation Recip)
154 "Diesel, Continuous" (Standard DA Diesel Modulation Recip)
155 "Electric, Continuous" (Standard RA Electric Modulation Recip)
156 "Electric, Continuous" (Standard DA Electric Modulation Recip)

States for ThermoKing units

Value State
129 "INVAL" (Invalid)
130 "COOL " (Cool)
131 "NULL " (Normal Null)
132 "HEAT " (Heat)
133 "DFRST" (Defrost)
134 "SHTDN" (Shutdown)
135 "LKCOL" (Lockout Cool)
136 "FACOL" (Frozen Algorithm Cool)
137 "FANUL" (Frozen Algorithm Null)

141
138 "PULUP" (Pull Up)
139 "PULDN" (Pull Down)
140 "STABL" (Stabilize)
141 "PMPDN" (Pump Down)
142 "OVLSH" (Overload Shutdown)
143 "DSABL" (Disable Controller)
144 "LPTRP" (Long Pretrip)
145 "SPTRP" (Short Pretrip)
146 "NORML" (Normal)
147 "PWROF" (Power Off)
148 "WSTRT" (Warm Restart)
149 "RACTL" (Return Air Control)
150 "DACTL" (Discharge Air Control)
151 "FACTL" (Frozen Algorithm Control)
152 "DSANP" (Disable Controller No Protect)
153 "FACHI" (Frozen Algorithm Cool High)
154 "FACLO" (Frozen Algorithm Cool Low)
155 "COOLH" (Cool High)
156 "DSCHK" (Dual Scroll Compressor Check)
157 "RRACL" (Remote Return Air Control)
158 "OTCTL" (Evaporator Control)
159 "SLEEP" (Sleep Mode)
160 "EVAC" (Evacuation Mode)
161 "SERVICE" (Service Test Mode)
162 "RLYBD" (Relay Board Test Mode)
163 "TEMP CTL" (Temperature Control)
164 "ENGSTRT" (Diesel Engine Start)
165 "MOTSTRT" (Electric Motor Start)
166 "EM FLASH" (EM Flash Load)
167 "NO ZONE" (Zone Not Configured)
168 Countdown Logging Mode
169 Conservative Logging Mode
170 Profile Upload Mode

142
 Annex B. Checksum calculation algorithm CRC8
To check the integrity of data in FLEX messages, a checksum calculated using the CRC8 algorithm is used.
The checksum is counted from the beginning of the packet (including the '~' character) to the last byte of
data and is usually written at the end of the packet. You can use the table function (programming language
C) to calculate the CRC8.

const unsigned char crc8_table[256] =

{
0x00, 0x31, 0x62, 0x53, 0xC4, 0xF5, 0xA6, 0x97, 0xB9, 0x88, 0xDB, 0xEA, 0x7D, 0x4C, 0x1F, 0x2E,
0x43, 0x72, 0x21, 0x10, 0x87, 0xB6, 0xE5, 0xD4, 0xFA, 0xCB, 0x98, 0xA9, 0x3E, 0x0F, 0x5C, 0x6D,
0x86, 0xB7, 0xE4, 0xD5, 0x42, 0x73, 0x20, 0x11, 0x3F, 0x0E, 0x5D, 0x6C, 0xFB, 0xCA, 0x99, 0xA8,
0xC5, 0xF4, 0xA7, 0x96, 0x01, 0x30, 0x63, 0x52, 0x7C, 0x4D, 0x1E, 0x2F, 0xB8, 0x89, 0xDA, 0xEB,
0x3D, 0x0C, 0x5F, 0x6E, 0xF9, 0xC8, 0x9B, 0xAA, 0x84, 0xB5, 0xE6, 0xD7, 0x40, 0x71, 0x22, 0x13,
0x7E, 0x4F, 0x1C, 0x2D, 0xBA, 0x8B, 0xD8, 0xE9, 0xC7, 0xF6, 0xA5, 0x94, 0x03, 0x32, 0x61, 0x50,
0xBB, 0x8A, 0xD9, 0xE8, 0x7F, 0x4E, 0x1D, 0x2C, 0x02, 0x33, 0x60, 0x51, 0xC6, 0xF7, 0xA4, 0x95,
0xF8, 0xC9, 0x9A, 0xAB, 0x3C, 0x0D, 0x5E, 0x6F, 0x41, 0x70, 0x23, 0x12, 0x85, 0xB4, 0xE7, 0xD6,
0x7A, 0x4B, 0x18, 0x29, 0xBE, 0x8F, 0xDC, 0xED, 0xC3, 0xF2, 0xA1, 0x90, 0x07, 0x36, 0x65, 0x54,
0x39, 0x08, 0x5B, 0x6A, 0xFD, 0xCC, 0x9F, 0xAE, 0x80, 0xB1, 0xE2, 0xD3, 0x44, 0x75, 0x26, 0x17,
0xFC, 0xCD, 0x9E, 0xAF, 0x38, 0x09, 0x5A, 0x6B, 0x45, 0x74, 0x27, 0x16, 0x81, 0xB0, 0xE3, 0xD2,
0xBF, 0x8E, 0xDD, 0xEC, 0x7B, 0x4A, 0x19, 0x28, 0x06, 0x37, 0x64, 0x55, 0xC2, 0xF3, 0xA0, 0x91,
0x47, 0x76, 0x25, 0x14, 0x83, 0xB2, 0xE1, 0xD0, 0xFE, 0xCF, 0x9C, 0xAD, 0x3A, 0x0B, 0x58, 0x69,
0x04, 0x35, 0x66, 0x57, 0xC0, 0xF1, 0xA2, 0x93, 0xBD, 0x8C, 0xDF, 0xEE, 0x79, 0x48, 0x1B, 0x2A,
0xC1, 0xF0, 0xA3, 0x92, 0x05, 0x34, 0x67, 0x56, 0x78, 0x49, 0x1A, 0x2B, 0xBC, 0x8D, 0xDE, 0xEF,
0x82, 0xB3, 0xE0, 0xD1, 0x46, 0x77, 0x24, 0x15, 0x3B, 0x0A, 0x59, 0x68, 0xFF, 0xCE, 0x9D, 0xAC
};

unsigned char crc8_calc

(
unsigned char *lp_block, / * (in) pointer to the data buffer */
unsigned int len / * (in) number of bytes to count */
)
{
unsigned char crc = 0xFF;
while (len--)
{
crc = crc8_table[crc ^ *lp_block++];
}
return crc;
}

Or use the following function (java language):

public static byte crc8 (byte[] buffer)

{
byte crc = (byte) 0xFF;
for (byte b : buffer) {
crc ^= b;
for (int i = 0; i < 8; i++) {
crc = (crc & 0x80) != 0 ? (byte) ((crc << 1) ^ 0x31) : (byte) (crc << 1);
}
}
return crc;
}

143
 Annex C. Checksum calculation algorithm CRC16
To check the integrity of data in encrypted messages, a checksum is used, calculated using the CRC16
algorithm with the polynomial 0x1021the initial value 0. The checksum is counted from the beginning of
the packet (including the '#' character) to the last byte of data and is written at the end of the packet.
You can use the table function (programming language C) to calculate the CRC16.
static const unsigned short crc16_poly1021_table[256] =
{
0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7, 0x8108, 0x9129, 0xa14a, 0xb16b,
0xc18c, 0xd1ad, 0xe1ce, 0xf1ef, 0x1231, 0x0210, 0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6,
0x9339, 0x8318, 0xb37b, 0xa35a, 0xd3bd, 0xc39c, 0xf3ff, 0xe3de, 0x2462, 0x3443, 0x0420, 0x1401,
0x64e6, 0x74c7, 0x44a4, 0x5485, 0xa56a, 0xb54b, 0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d,
0x3653, 0x2672, 0x1611, 0x0630, 0x76d7, 0x66f6, 0x5695, 0x46b4, 0xb75b, 0xa77a, 0x9719, 0x8738,
0xf7df, 0xe7fe, 0xd79d, 0xc7bc, 0x48c4, 0x58e5, 0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823,
0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969, 0xa90a, 0xb92b, 0x5af5, 0x4ad4, 0x7ab7, 0x6a96,
0x1a71, 0x0a50, 0x3a33, 0x2a12, 0xdbfd, 0xcbdc, 0xfbbf, 0xeb9e, 0x9b79, 0x8b58, 0xbb3b, 0xab1a,
0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03, 0x0c60, 0x1c41, 0xedae, 0xfd8f, 0xcdec, 0xddcd,
0xad2a, 0xbd0b, 0x8d68, 0x9d49, 0x7e97, 0x6eb6, 0x5ed5, 0x4ef4, 0x3e13, 0x2e32, 0x1e51, 0x0e70,
0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a, 0x9f59, 0x8f78, 0x9188, 0x81a9, 0xb1ca, 0xa1eb,
0xd10c, 0xc12d, 0xf14e, 0xe16f, 0x1080, 0x00a1, 0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,
0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c, 0xe37f, 0xf35e, 0x02b1, 0x1290, 0x22f3, 0x32d2,
0x4235, 0x5214, 0x6277, 0x7256, 0xb5ea, 0xa5cb, 0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d,
0x34e2, 0x24c3, 0x14a0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405, 0xa7db, 0xb7fa, 0x8799, 0x97b8,
0xe75f, 0xf77e, 0xc71d, 0xd73c, 0x26d3, 0x36f2, 0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634,
0xd94c, 0xc96d, 0xf90e, 0xe92f, 0x99c8, 0x89e9, 0xb98a, 0xa9ab, 0x5844, 0x4865, 0x7806, 0x6827,
0x18c0, 0x08e1, 0x3882, 0x28a3, 0xcb7d, 0xdb5c, 0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a,
0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0, 0x2ab3, 0x3a92, 0xfd2e, 0xed0f, 0xdd6c, 0xcd4d,
0xbdaa, 0xad8b, 0x9de8, 0x8dc9, 0x7c26, 0x6c07, 0x5c64, 0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1,
0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba, 0x8fd9, 0x9ff8, 0x6e17, 0x7e36, 0x4e55, 0x5e74,
0x2e93, 0x3eb2, 0x0ed1, 0x1ef0
};

unsigned short eval_crc16(unsigned short crc, const unsigned char *msg, unsigned int msg_len)
{
/* Calculation of 16-bit cyclic redundancy code (CRC) by the table method
* DESCRIPTION
* Calculates 16-bit cyclic redundancy using a table.
* PARAMETERS
* crc - initial CRC value, 0 on the first call;
* msg - indicator of the message block;
* msg_len - number of bytes in the block.
* RETURN VALUE
* 16-bit CRC.
*/

unsigned char temp;

while (msg_len--)
{
temp = (*msg++ ^ (crc >> 8)) & 0xFF;
crc = crc16_poly1021_table[temp] ^ (crc << 8);
}
return (crc);
}

144
 Annex D. Summary of NTCB messages
Packet Appointment
System
*?V Query model and version of the device.
*?VGPS Query information about the firmware version of the GPS receiver
*?S Query unique device ID.
*>S Message with individual device ID string.
*!DEV_RESET Device restart command.
*?USSD Arbitrary USSD request
*!BEEP Command of arbitrary sound indication by buzzer
*!CHNGSIM Command to change SIM card
*?ICCID Query unique SIM serial number
*!O Command for microphone listening
*!SETTIME Command for time adjustment on device
*?DATA Command for diagnostic information query
*Z Response to unsupported messages
~Z Response to unsupported messages
Outputs
*!1Y Command to activate output 1
*!1N Command to disactivate output 1
*!2Y Command to activate output 2
*!2N Command to disactivate output 2
*!3Y Command to activate output 3
*!3N Command to disactivate output 3
*!4Y Command to activate output 4
*!4N Command to disactivate output 4
*!SETOUT Command to change output state
Inputs
*!OFF Command to lock input
*!ON Command to unlock input
Telemetry
~A Array of telemetry messages in FLEX format.
~T Structure of out-of-order message sending packet in FLEX format.
~C Structure of the current state sending packet in FLEX format.
~E Array of additional FLEX 2.0 telemetry messages.
~X Structure of additional FLEX 2.0 telemetry messages sending packet.
*?L Query the nearest telemetry record before the specified date
*?R Query the nearest telemetry record after the specified date
*?I Query telemetry record by its index
*?A Query current state of the device in the main packet.
*?E Query current state of the device in the additional packet.
*?ES Query device status with SMS sending

145
 *!SYNC Command to confirm synchronization of internal memory with the server
*!REP_FL Command to resend telemetry from non-volatile memory
*!REP_SD Command to resend telemetry from SD card
Operating modes of the device
*!GY Сommand to enable security mode
*!GN Command to disable security mode
*!M Command to change device operating mode
*?M Query current operating mode
RCS, RFU, DRC Services
*!CNCT_RCS Command to connect to the configurator via RCS
*!CNCT_RFU Command to update device firmware via RFU
*!CNCT_DRC Command to connect to DRC
Touch Memory keys
*>TMKEY NTCB packet structure of sending unregistered Touch Memory key
*?TM Query code of the last Touch Memory key read by the device
*?ERFT Query the last active radio tag
*!SETTM Command to edit the list of registered Touch Memory keys
Module ID: 0x7D
~O Command code:
4 - command to edit the list of registered Touch Memory keys
Tachograph (Module code: 0x81)
Request ID:
0 - query information on the current state of the tachograph;
~Q 2 - query information on card No. 1
3 - query information on card No. 2
4 - query vehicle registration information.
Command code:
0 - authorization of the device in the tachograph;
~O 1 - installation of a new authorization key;
2 - generation of the upload file;
3 - generation of the upload file with sending to email.
Request ID:
~G
0 – request of DDD file block.
Driver display (Module code: 0x82)
Command code:
~O
0 - sending a message to the driver.
*!DV Command to send a message to the driver display.
Autoinformer
Command code:
0x01 - change of the current route;
*!AINF
0x02 - starts playback of the sound file;
0x03 - change of the current movement mode.
*!AINF: Command to change the route
*!AINF! Command to playback sound file
*!AINF# Command to change speed mode
*&AINF Autoinformer event alerts
*!AINF ROUTE Command to change the route

146
*!AINF PLAY Command to playback sound file
*!AINF MODE Command to change current mode
*!AINF STOP Command to change current stop
Camera (Module Code: 0x80)
Command code:
0 - automatic shooting control;
~O
1 - take a photo;
2 - take a photo and then send it to email.
Request ID:
~Q 0 - obtaining information about camera;
for photo information.
Alert Code:
~N
0 - notification of the creation of a new photo.
Request ID:
~G 0 - query overview photo data;
1 - query the main photo data.
*!DCAM Text analogue of camera commands
Communication between external interfaces and the server (Module ID: 0x7F)
*!U2S, *>U2S Command to transfer data via USB device to the server.
*!S2U, *>S2U Command to transfer from the server via USB.
Message ID:
0x00 - data transfer in transparent mode from USB;
~P
0x01 - data transfer in transparent mode from RS232;
0x02 - data transfer in transparent mode from RS485.
*!UC User command for transfering data to interfaces
CAN-LOG
*!CANLOG Setting CAN-LOG device program number.
*?CANLOG Query CAN-LOG device program number.
Working with built-in accelerometer
*!ACL_C Accelerometer calibration command
Accident detection
*?KRAI Query information about detected accident
*!KRAI Command to reset overwrite protection
Working with temperature sensors 1-Wire
*?TM TSV Query all visible temperature sensors
*?TM TSU Query all visible undefined temperature sensors
*!TM Command for temperature sensors
Working with passenger flow counters
*!ACOND Command for "Autoconductor" counter
Working with refrigeration units (module code: 7A)
Request ID:
~Q
0 – query information about IQFreeze.
Device configuration commands
*!EDITS Command to write settings to the device with saving and following reboot
*!EDIT Command to write settings to the device without saving
*!READ Command to read setting from device

147
*!SETFM FLEX bit mask edit command
Encryption
*>CODE Command to switch to encryption mode
# Container package for transferring encrypted data

148
 Annex E. Table of digital FLS error codes
Error code Appointment
SIGNAL/SMART devices errors
Invalid response from sensor or incorrect response prefix
65535 (or -1)
(general error code)
65534 (or -2) Invalid command code in response
65533 (or -3) Invalid sensor address in response
65532 (or -4) CRC Error
65531 (or -5) Sensor not initialized
65530 (or -6) Line break, no response packet or it is incomplete
FLS Technoton errors
65529 (or -7) Calibration error (Technoton)
65528 (or -8) Hardware Error (Technoton)
Ultrasonic FLS TC SENSOR" UZI-0.8 and UZI-2.5 errors
65527 (or -9) Cable break from sensor
65526 (or -10) No signal
65525 (or -11) Low battery power
65524 (or -12) Low battery charge + cable break from sensor
65523 (or -13) Low battery + no signal
LLS FLS errors
Incorrect value of fuel level
65522 (or -14)
(level value greater than 4095)

149