Dynamic IoT SP Protocol V3.

3 A0

2
Preface

Switch device PROTOCOL,X# OK! X=1 0x12 protocol (GT06) default

protocol
X=4 0 x AX protocol (4G device)

Current device PROTOCOL# PROTOCOL:1 Query the current device protocol

protocol query

Use when the device protocol is set to G T06 protocol:

Positioning package: 0x12
Heartbeat packet: 0x13
Alarm packet: 0x16
WIFI information packet: 0x2c

When the device protocol is set to 4G device protocol:

Positioning package: 0xA0

Heartbeat packet: 0xA3
Alarm packet: 0xA5
WIFI information packet: 0xA2
Table of contents

1. Communication Protocol 1

2. Terms and definitions 1

3. Basic Rule 3

4. Data packet format 5

4.1. Starting bit 5

4.2. Packet length 5

4.3. Agreement number 5

4.4. Information content 6

4.5. Information sequence number 6

4.6. Error checking 6

4.7. Stop bit 6

5. Detailed explanation of the terminal sending data packets to the server 7

5.1. Login information package (0x01) 7

5.1.1. The terminal sends data packet 7 to the server

5.1.2. Server response packet 8

5.2. Positioning data packet (GPS, LBS combined information packet: 0x12) 9

5.2.1. The terminal sends positioning data packet 9 to the server

 5.2.2. The terminal sends the mileage positioning data packet 12 to the server

5.2.3. Server reply 13

5.3. Positioning data packet ( add ACC, data reporting mode: 0x22 ) 14

5.3.1. The terminal sends positioning data packet 14 to the server

5.3.2. Server reply 17

5.4. Heartbeat packet ( 0x13 ) 18

5.4.1. The terminal sends a heartbeat packet to the server 18

5.4.2. The server responds with heartbeat packet 20

5.5.Alarm package (0 x16 ) 22

5.5.1. The terminal sends alarm data packet 22 to the server

5.5.2. The server sends alarm data packet reply 26 to the terminal

5.7. LBS+WIFI information (0x2C) 29

5.8. The terminal sends the IMSI number to the server (0x90) 32

5.9. The terminal sends the ICCID number to the server (0x94) 33

5.10. Recording protocol package (0x8D) 34

5.10.1. The terminal sends a data packet to the server: 34

5.10.2. Server responds to terminal: 34

5.11. 4G device positioning data packet (0xA0) 35

 5.11.1. The terminal sends positioning data packet 35 to the server

5.3.2. Server reply 38

5.12. 4G device LBS alarm package (0 xA5 ) 38

5.12.1. The terminal sends alarm data packet 38 to the server

5.12.2. The server sends alarm data packet reply 42 to the terminal

5.7. 4G device WIFI information packet (0xA2) 43

6. The server sends data packet 46 to the terminal

6.1. Server sends command ( 0x80 ) 46

6.1.1. Starting bit 46

6.1.2. Packet length 47

6.1.3. Agreement number 47

6.1.4. Instruction length 47

6.1.5. Server flag 47

6.1.6. Instruction content 47

6.1.7. Message sequence number 47

6.1.8. Error checking 47

6.1.9. Stop bit 47

6.2. Terminal returns data packet ( 0x15 ) 47

 6.2.1. Starting bit 48

6.2.2. Packet length 48

6.2.3. Protocol number 48

6.2.4. Command length 48

6.2.5. Server flag 48

6.2.6. Instruction content 48

6.2.7. Language 48

6.2.8. Message sequence number 48

6.2.9. Error checking 48

6.2.10. Stop bit 48

6.2.11. Server command issuance example 49

7. Attached is the AAU CRC-ITU table lookup algorithm CC language code snippet 51
 1. Communication protocol
introduction
This document defines the description of the application layer interface protocol of the vehicle GPS
locator and positioning service platform. This interface protocol is only suitable for interactive
communication between the server platform and the positioning terminal .

2. Terms and definitions

Terms,abbreviations English meaning Chinese meaning

CMPP China Mobile Peer to Peer China Mobile Peer-to-Peer Agreement

GPS Global Positioning System global satellite positioning system

Global System for Mobile

GSM global system for mobile communications
Communication

GPRS General Packet Radio Service Universal Radio Packet Service

TCP Transport Control Protocol Transmission Control Protocol

LBS Location Based Services Assisted location services

International Mobile Equipment International Mobile Equipment Identity

IMEI
Identity Number

MCC Mobile Country Code The country code of the mobile user

MNC Mobile Network Code Mobile network number

2
LAC Location Area Code location area code

Cell ID Cell Tower ID mobile base station

UDP User Datagram Protocol User Datagram Protocol

SOS Save Our Ship/Save Our Souls distress signal

CRC Cyclic Redundancy Check cyclic redundancy check

NITZ Network Identity and Time Zone, Time zone

GIS Geographic Information System geographic information system

2
 3. Basic rules
1. The GPRS connection is successfully established and the first login information packet is sent to
the server. If the server response packet is received within 5 seconds, the connection is considered
normal and positioning information (GPS, LBS information packets) will be sent. Status information will
be sent after 3 minutes. package, regularly confirming the normality of communication;

2. When the GPRS connection is not successfully established, the terminal cannot send login
information packets. When the GPRS connection fails three times, the terminal starts the scheduled
restart function for 20 minutes. If the terminal successfully establishes a connection with the server
within 20 minutes and receives a data packet from the server in response to the login information packet
sent by the terminal, the scheduled restart function will be turned off and the terminal will not restart,
otherwise the terminal will automatically restart after 20 minutes ;

needs to return a response packet to the terminal after receiving the login information packet sent by
the terminal . If the terminal does not receive a response packet from the server for more than 5 seconds
after sending the login information packet or status information packet, it is considered that the current
connection is established abnormally. Start the GPS positioning data retransmission function, disconnect
the current GPRS connection, re-establish a new GPRS connection and send the login information
package ;

4. The connection is judged to be abnormal. The login information packet or status information
packet sent after the connection is established three times cannot receive the data packet responded by
the server. The terminal starts the scheduled restart function. The scheduled restart time is 10 minutes. If
within 10 minutes, If the terminal successfully establishes a connection with the server and receives a
data packet from the server, the scheduled restart function is turned off and the terminal will not restart.
Otherwise, the terminal will automatically restart after 10 minutes ;

5. After the connection is established normally, the terminal regularly sends GPS and LBS merged
information packets to the server after the GPS information changes. The server can set the default
sending protocol through instructions ;

heartbeat packets are sent to the server at fixed intervals , and the server returns a response packet
for confirmation ;

7. For terminals that do not have registered IMEI numbers, the server should reply with a login
request response and a heartbeat packet response, and do not disconnect directly. (If you directly
disconnect or do not reply, the terminal will continue to reconnect and the GPRS traffic consumption will
be serious) .

8. 4G device positioning package uses 0x AX protocol package

2
2
 4. Data packet format

Communication transmission is asynchronous and in bytes.

Total packet length: (10+N) Byte .

Format Length(Byte)
start bit 2
Packet length 1
Agreement 1
number
information N
Information 2
serial number
error checking 2
Stop bit 2

4.1.Start bit
Fixed value, unified to hexadecimal 0x78 0x78.
Note: A small number of protocol numbers start with 0x7 9 0x7 9

4.2 . Packet length

Length = protocol number + message content + message sequence number + error check, totaling
(5+N) Byte, because the message content is a variable-length field.

4.3 . Agreement number

describe serial number
Login package 0x01
Positioning data (GPS/LBS merge) 0x12
Positioning packet ( 4G version ) 0x22
Status information (heartbeat packet) 0x13
String information (response to server command) 0x15
Alarm information 0x16
Query address information (GPS) 0x1A
LBS multi-base station information 0x18
With mileage positioning data ( added ACC, data
0x28
reporting mode )
LBS+WIFI information 0x2C
IMSI number reporting platform information 0x90
ICCID number reporting platform information 0x94
Recording files are reported to the platform
0x8D
information
Issue instructions 0x80

2
 4G device positioning information package 0xA0
4G device WIFI information package 0xA2
4G device alarm package 0xA5

4.4 . Information content

According to different applications, correspond to the corresponding "protocol number" and
determine the specific content.

4.5 . Information serial number

The sequence number of the first GPRS data sent after power-on (including status packets, GPS,
LBS and other data packets) is '1' , and the sequence number of each subsequent data sent (including
status packets and GPS, LBS data packets) is automatically incremented by 1. .

4.6 . Error checking

The terminal or server can use the check code to determine whether there is an error in the received
information. In order to prevent data errors during transmission, error checking is added to prevent data
misoperation, which increases the safety and efficiency of the system. The error checking code adopts
CRC-ITU checking method.
The CRC-ITU value of the data in the protocol body from "packet length" to "information sequence
number" (including "packet length" and "information sequence number").
If the received information has a CRC error in its calculation, it will ignore it and discard the data
packet.

4.7. Stop bit

Fixed value, uniformly hexadecimal 0x0D 0x0A.

2
 5. Detailed explanation of the terminal sending data

packets to the server

Separate explanation of common information packet sending and server return

5.1. Login information package ( 0 x 01)

5.1.1. The terminal sends data packets to the server
The login information packet is used to confirm to the server that the connection is established
normally and to submit the terminal ID to the server.
Format Length(Byte) Example
start bit 2 0x78 0x78
Packet length 1 0x0D
Agreement 1 0x01
Login number
information
package Terminal ID 8 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45
(18 Byte) Information 2 0x00 0x01
serial number
error checking 2 0x8C 0xDD
Stop bit 2 0x0D 0x0A

5.1.1.1. start bit

For details, see Data Packet Format 4.1

5.1.1.2. Packet length

For details, see Data Packet Format 4.2

5.1.1.3. Protocol number

For details, see Data Packet Format 4.3

5.1.1.4. Terminal ID

The terminal ID uses a 15-digit IMEI number.

Such as: 123456789012345,
Then the terminal ID is: 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45

5.1.1.5. Message serial number

See data packet format for details 4.5

2
 5.1.1.6. Error checking

See data packet format for details 4.6

5.1.1.7. Stop bit

See data packet format for details 4.7

5.1.2. Server response packet

Format Length(Byte) Example
start bit 2 0x78 0x78
Packet 1 0x05
length
Agreement 1 0x01
response number
packet Information
(10 Byte) serial 2 0x00 0x01
number
error 2 0 XD9 0xDC
checking
Stop bit 2 0x0D 0x0A

5.1.2.1. Start bit

For details, see Data Packet Format 4.1

5.1.2.2. Packet length

See data packet format for details 4.2

5.1.2.3. Protocol number

The protocol number in the response packet is the same as the protocol number of the data packet
sent by the terminal.

5.1.2.4. Message serial number

For details, see Data Packet Format 4.5

5.1.2.5. Error checking

For details, see Data Packet Format 4.6

5.1.2.6. Stop bit

For details, see Data Packet Format 4.7

Note: Ultra-long standby devices such as S11/S11C/W15L require the platform to reply with the

2
time in the login packet to facilitate updating the device time. The format is as follows:
0x78 0x78 0x0B 0x01 0x00 0x01 0x14 0x01 0x08 0x09 0x1E 0x0A 0xD9 0xDC 0x0D 0x0A
date time
Among them: 0x14 0x01 0x08 0x09 0x1E x0A =20-01-08 9:30:10
The time issued by the platform uses: UTC+0 format

2
 5.2. Positioning data packet (GPS, LBS combined information
packet : 0x12 )
5.2.1. The terminal sends positioning data packet to the server
Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x1F
Agreement number 1 0x12
date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
GPS information 1 0xCB
satellite number
latitude 4 0x02 0x7A 0xCF 0xEB
GPS
information longitude 4 0xCC 0x46 0x58 0x49
information speed 1 0x10
heading, status 2 0x15 0x4C
MCC 2 0x01 0xCC
LBS MNC 1 0x00
information LAC 2 0x28 0x7D
Cell ID 3 0x00 0x1F 0xB8
serial number 2 0x00 0x03
error checking 2 0x9D 0xDC
end bit 2 0x0D 0x0A

5. 2 . 1 .1. Starting bit

See data packet format for details 4.1

5. 2 . 1 .2. Packet length

See data packet format for details 4.2

5. 2 . 1 .3. Agreement number

See data packet format for details 4.3

5.2.1.4. date time

Format Length( Byte) Example
Year 1 0x16
moon 1 0x01
day 1 0x1D
hour 1 0x11
point 1 0x0C
Second 1 0x10

2
 For example : January 29 , 2022 1 7:12:16
Calculation method: 22 (decimal) = 1 6 (hexadecimal)
01(decimal)=01(hexadecimal)
29 (decimal)=1 D (hexadecimal)
1 7 (decimal) = 11 (hexadecimal)
12 (decimal) = 0C (hexadecimal)
16 (decimal)=1 0 (hexadecimal)
The value is: 0x 1 6 0x 0 1 0x1 D 0x 11 0x 0C 0x1 0
The date and time of the GPS location package corresponds to the time zone set by the device.

5.2.1.5. Number of satellites participating in positioning

1Byte converted into binary is 8Bit, the first 4Bit is the GPS information length, the last 4Bit is the
current number of satellites of the device, the maximum number of satellites is 15 number, more than 15
Individual rules reported 15 indivual.
Note: The length includes its own 1Byte.
Example: When the value is 0xCB, it means that the GPS information length is 12 and the number
of satellites participating in positioning is 11.

5.2.1.6.Latitude

It occupies 4 bytes and represents the latitude value of positioning data. The numerical range is 0 to
162000000, which represents the range from 0 degrees to 90 degrees. The conversion method is as
follows:
Convert the longitude and latitude values output by the GPS module into decimals in units of
minutes; then multiply the converted decimals by 30000 and convert the multiplied results into
hexadecimal numbers.
For example, 22º 32.7658 '=(22X60+32.7658)X30000=40582974, and then convert it into
hexadecimal number
40582974 (decimal) = 26B3F3E (hexadecimal)
The final value is 0x02 0x6B 0x3F 0x3E.
Note: The uploaded longitude and latitude are all positive numbers. If they are negative values, take
the absolute value.

5.2.1.7.Longitude

It occupies 4 bytes and represents the longitude value of positioning data. The value range is 0 to
324000000, indicating the range from 0 degrees to 180 degrees.
The conversion method is the same as that of latitude .

5.2.1.8. speed

It occupies 1 byte and represents the operating speed of the GPS. The value range is 0x00~0xFF,

2
indicating the range is 0~255 km/h.
like:
0x00 represents 0 km/h;
0x10 represents 16 km/h;
0xFF represents 255 km/h.

5.2.1.9. status heading

It occupies 2 bytes and is converted into binary. The first six bits of the first byte represent the
device status. The last two bits and the eight bits of the second byte represent the running direction of the
GPS. The range is 0~360. Unit: degree. Taking true north as 0 degrees, clockwise.
The first six bits of the 8-bit binary in the first byte represent the status, and the following two bits
and the 8-bits of the second byte, a total of 10 binary bits, represent the heading degree.

Bit7 (ACC ON/OFF) Note: The status information in the data

packet is the status at the moment recorded by
Bit6 (ACC ON/OFF) the time bit in the data packet.
GPS
Bit5 Real-time/differential
positioning For example: the value is 0x15 0x4C,
converted to binary is 00010101 01001100,
Bit4 GPS positioning or not
BYTE 1 BYTE 1 Bit7 0 (no definition yet)
east longitude, west
Bit3 BYTE 1 Bit6 0 (ACC OFF)--0: ACC OFF, 1:
longitude
ACC ON (some projects do not use this bit)
Southern latitude,
Bit2 BYTE 1 Bit5 0 (real-time GPS )——0:
northern latitude
real-time GPS, 1: differential positioning
Bit1
BYTE 1 Bit4 1 ( GPS has been positioned) - 0:
Bit0 GPS has not been positioned, 1: GPS has been
Bit7 positioned
Bit6 BYTE 1 Bit3 0 (East longitude)——0: East
longitude, 1: West longitude
Bit5
course BYTE 1 Bit2 1 (Northern latitude)——0:
Bit4 South latitude, 1: North latitude
BYTE 2
Bit3 BYTE 1 Bit1 0
Bit2 BYTE 1 Bit0 1
Bit1 BYTE 2 Bit7 0
Bit0 BYTE 2 Bit6 1
BYTE 2 Bit5 0
Heading 332° (0101001100 binary converted to decimal 332)
BYTE 2 Bit4 0
BYTE 2 Bit3 1
BYTE 2 Bit2 1
BYTE 2 Bit1 0
BYTE 2 Bit0 0
It means that the GPS has been positioned, real-time GPS, north latitude, east longitude, and
heading 332°.

2
 5.2.1.10. MCC

The country code of the mobile user is Mobile Country Code(MCC).

For example: China’s mobile country number is 460 (decimal): 0x01 0xCC (convert decimal 460 to
hexadecimal, add 0 to the left if there are less than four digits in hexadecimal).
The value range here is: 0x0000 ~ 0x03E7.

5.2.1.11.MNC

Mobile network numberMobile Network Code(MNC)

For example: China Mobile's is 0x00.

5.2.1.12.LAC

Location area code Location Area Code (LAC) included in LAI , consisting of two bytes, using
16 Base encoding. The available range is 0x0001-0xFFFE, code group 0x0000 and 0xFFFF Not
available (see GSM Specification 03.03, 04.08 and 11.11). A location area can contain one or more cells.

5.2.1.13. Cell ID

Mobile base stationCell Tower ID(Cell ID), the value range is 0x000000 00 ~ 0xFFFFFFFF,
occupies 4 bytes

5.2.1.14. Message serial number

For details, see Data Packet Format 4.5

5.2.1.15. Error checking

For details, see Data Packet Format 4.6

5.2.1.16. Stop bit

For details, see Data Packet Format 4.7

5.2.2. The terminal sends the mileage positioning data packet to the

server
Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x23
information Agreement number 1 0x12
date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
GPS GPS information 1 0xC B

2
 information satellite number
latitude 4 0x02 0x7A 0xCF 0xEB
longitude 4 0xCC 0x46 0x58 0x49
speed 1 0x10
heading, status 2 0x1 5 0x 4C
MCC 2 0x01 0xCC
LBS MNC 1 0x00
information LAC 2 0x28 0x7D
Cell ID 3 0x00 0x1F 0xB8
mileage 4 0x00 0x 0F 0x42 0x40
serial number 2 0x00 0x03
error checking 2 0x9D 0xDC
end bit 2 0x0D 0x0A

Note: The protocol packet length increases by 4 bytes, which is 0x2 4

Mileage is 4 bytes, unit is meter, 0x00 0x0F 0x42 0x40 , 1,000,000 meters, or 1,000 kilometers

5.2.3. Server reply

This message server does not need to respond
Note: When the GSM signal is abnormal, the 0x12 GPS/LBS information package will be saved
first and then re-transmitted to the platform; the re-transmission method is not to upload in real time, but
to upload the retained positioning point after the device is stationary. The track playback should be based
on the time in the positioning package. When displayed in real time, the positioning package time that is
5 minutes lower than the current time should not be displayed.

2
 5.4. Heartbeat packet ( 0x13 )
Heartbeat packets are data packets that maintain the connection between the terminal and the server.

5.4.1. The terminal sends a heartbeat packet to the server

Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x0A
Agreement number 1 0x13
Terminal
1 0x4E
information
Voltage level 1 0x06
status
information information GSM signal 1 0x64
strength
external voltage 1 0x0C
language 1 0x02
serial number 2 0x00 0x03
error checking 2 0xFF 0x4F
end bit 2 0x0D 0x0A

5.4.1.1. start bit

For details, see Data Packet Format 4.1

5.4.1.2. Packet length

For details, see Data Packet Format 4.2

5.4.1.3. Protocol number

For details, see Data Packet Format 4.3

5.4.1.4. Terminal information

It occupies 1 byte and is converted into binary to represent the status information of the terminal. One
byte is regarded as 8 bits, the lowest bit is 0 bits, and the highest bit is 7 bits. When transmitting, the high
bit is transmitted first, and then the low bit is transmitted. The specific meanings of each representative
are as follows:

Bit Code meaning

1: Oil and electricity disconnected
Bit 7
BYTE 0: oil and electricity connected
Bit 6 1: GPS has positioned

2
 0: GPS not positioned
111: Door open alarm
110: Door closing alarm
100: SOS alarm
Bit 5- Bit
011: Low battery alarm
3
010: Power failure alarm
001: Vibration alarm
000: normal
1: Connected to external power supply (wired device), charging (wireless)
Bit 2 0: Not connected to external power supply (wired device), not charging
(wireless)
1:ACC ON
Bit 1
0:ACC O F
1: Fortification
Bit0
0: Disarm

Example: 0x4E, the corresponding binary is 01001110

Indicates that it is in the disarmed state, ACC ON, external power supply connected, vibration alarm,
GPS positioned, and oil and electricity connected.

5.4.1.5. Voltage level

Wireless device upload battery percentage

Wired devices follow the following rules:
There are a total of 7 voltage levels, ranging from 0-6, indicating the voltage from low to high.
0: No power (power off);
1: The battery status is not enough to make calls, send text messages, etc.;
2: Low battery;
3-6: All can be used normally, but they are arranged according to the amount of electricity.

5.4.1.6 . GSM signal strength

Range of GSM information: 0-100; converted to decimal, the larger the value, the stronger the GSM
signal
0: Indicates no signal
100: full signal

5.4.1.7. External voltage + language

Example: The external power supply voltage is 30 volts (30V), and the current language
bit of the terminal is:
Chinese:0x1E 0x01;
English:0x1E 0x02;

2
 Note: The reserved extension bit (that is, the external voltage bit) of the wireless product
S11/S11C/W15L is not used as a language bit, but is used to identify the working mode and sleep state of
the device.
Operating mode:
0x 00= smart sleep mode;
0x 01= normal mode;
0x 02= deep sleep mode;
0x 03= Timed return mode;
0x04 = Remote power on/off mode;
Device sleep state:
When the device is working normally, it is 0x 00 ;
When the device sleeps, the device sleep status bits are consistent with the working mode bits. For
example, in deep sleep mode, the reserved extension bits when the device sleeps are 0x02 0x02 .

5.4.1.8 . Message serial number

For details, see Data Packet Format 4.5

5.4.1. 9. Error checking

For details, see Data Packet Format 4.6

5.4.1.1 0. Stop bit

For details, see Data Packet Format 4.7

5.4. 2. The server responds with a heartbeat packet

Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x05

information

Agreement
1 0x13
number

2
 information
2 0x00 0x01
sequence

error checking 2 0xE9 0xF1

Stop bit 2 0x0D 0x0A

After receiving the data packet from the terminal, the server responds with an empty data packet.
Note: The "information sequence number" in the data packet must be consistent with the
"information sequence number" sent by the responding terminal.

5.4.2.1Start bit

For details, see Data Packet Format 4.1

5.4.2.2 Packet length

For details, see Data Packet Format 4.2

5.4.2.3 Agreement number

For details, see Data Packet Format 4.3

5.4.2.4 Information serial number

For details, see Data Packet Format 4.5

5.4.2.5 Error checking

For details, see Data Packet Format 4.6

5.4.2.6 Stop bit

For details, see Data Packet Format 4.7

2
 5.5. Alarm package ( 0x16 )
5.5.1. The terminal sends an alarm data packet to the server
Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x26
Agreement number 1 0x1 6
date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
GPS information
1 0xC B
satellite number
latitude 4 0x02 0x7A 0xCF 0xEB
GPS
information longitude 4 0xCC 0x46 0x58 0x49
speed 1 0x10
heading, status 2 0x1 5 0x 4C
LBS length 1 0x0A
MCC 2 0x01 0xCC
LBS
MNC 1 0x00
information information
LAC 2 0x28 0x7D
Cell ID 3 0x1F 0xB8 0x24
Terminal
1 0x4E
information
Voltage level 1 0x04
status GSM signal
1 0x64
information strength
Call the police 1 0x00
language 1 0x 02
serial number 2 0x00 0x03
error checking 2 0x8C 0x59
end bit 2 0x0D 0x0A

5.5.1.1 Start bit

For details, see Data Packet Format 4.1

5.5.1.2 Packet length

For details, see Data Packet Format 4.2

5.5.1.3 Protocol number

2
For details, see Data Packet Format 4.3

5.5.1.4 Date and time

For details, see Data Packet Format 5.2.1.4

5.5.1.5 Number of GPS satellites

For details, see Data Packet Format 5.2.1.5

5.5.1.6 Latitude

For details, see Data Packet Format 5.2.1.6

5.5.1.7 Longitude

For details, see Data Packet Format 5.2.1.7

5.5.1.8 Speed

For details, see Data Packet Format 5.2.1.8

5.5.1.9 Course and status

For details, see Data Packet Format 5.2.1.9

5.5.1.10 LBS length

The length of the LBS information content, the length is fixed: 0x 0A

5.5.1.11 MCC

For details, see Data Packet Format 5.2.1.10

5.5.1.12 MNC

2
For details, see Data Packet Format 5.2.1.11

5.5.1.13 LAC

For details, see Data Packet Format 5.2.1.12

5.5.1.14 Cell ID

For details, see Data Packet Format 5.2.1.13

5.5.1.15 Terminal information

For details, see Data Packet Format 5.4.1.4

5.5.1.16 Battery voltage level

For details, see Data Packet Format 5.4.1.5

5.5.1.17 GSM signal strength

For details, see Data Packet Format 5.4.1.6

5.5.1.18 Alarm type

0x00: normal

0x01: SOS alarm

alarm type 0x02: Power failure alarm

0x03: Vibration alarm

0x04: Alarm when entering the

2
fence

0x05: Alarm when exiting the

fence

0x06: Speeding alarm

0x07: High temperature alarm

0x08: Low temperature alarm

0x09: Displacement alarm

0x13: Anti-tamper alarm (light

sensor alarm)

0x26: Rapid acceleration alarm

0x27: Rapid deceleration alarm

0x28: Sharp turn alarm

0x29: Collision alarm

0x0E: Low battery alarm

0xFA: Door closed alarm

0xFB: Alarm when the door is

2
 opened

0xFC: AC off alarm

0xFD: AC turns on alarm

0xFE: ACC ignition alarm

0xFF: ACC flameout alarm

5.5.1.19 Language

Simplified Chinese: 0x01

English: 0x02

5.5.1.20 Information serial number

For details, see Data Packet Format 4.5

5.5.1.21 Error checking

For details, see Data Packet Format 4.6

5.5.1.22 Stop bit

For details, see Data Packet Format 4.7

5.5.2. The server sends an alarm packet reply to the terminal

Format Length(Byte) Example

2
information start bit 2 0x78 0x78

Packet length 1 0x 05

Agreement number 1 0x16

information sequence 2 0x 00 0x 05

error checking 2 0x 96 0x 68

Stop bit 2 0x 0D 0x 0A

5.5.2.1 Start bit

For details, see Data Packet Format 4.1
5.5.2.2 Packet length
For details, see Data Packet Format 4.2
5.5.2.3 Protocol number
For details, see Data Packet Format 4.3
5.5.2.4 Information serial number
For details, see Data Packet Format 4.5
5.5.2.5 Error checking
For details, see Data Packet Format 4.6
5.5.2.6 Stop bit
For details, see Data Packet Format 4.7

5.6. Query address (0x1A )

5.6.1 The terminal sends a query address packet to the server
Format Length(Byte Example
)
start bit 2 0x78 0x78
inf Packet length 1 0x2E
or
m Agreement number 1 0x1A
ati GPS date time 6 0x13 0x01 0x08 0x09 0x1E 0x0A
on informatio GPS information satellite
n 1 0xCD
number

2
 longitude 4 0x02 0x6B 0x3F 0x3E
latitude 4 0x0C 0x45 0x49 0x53
speed 1 0x00
heading, bearing 2 0x14 0x8F
0x31 0x33 0x38 0x30 0x30 0x31 0x39
telephone telephone number twenty one 0x39 0x38 0x38 0x35 0x20 0x20 0x20
number
0x20 0x20 0x20 0x20 0x20 0x20 0x20
language reserved 1 0x00
status language 1 0x02
information sequence 2 0x00 0x06
error checking 2 0x29 0xD1
Stop bit 2 0x0D 0x0A

5.6.1.1 Start bit

For details, see Data Packet Format 4.1

5.6.1.2 Packet length

For details, see Data Packet Format 4.2

5.6.1.3 Protocol number

For details, see Data Packet Format 4.3

5.6.1.4 Date and time

For details, see Data Packet Format 5.2.1.4

5.6.1.5 Number of GPS satellites

For details, see Data Packet Format 5.2.1.5

5.6.1.6 Latitude

For details, see Data Packet Format 5.2.1.6

5.6.1.7 Longitude

For details, see Data Packet Format 5.2.1.7

2
 5.6.1.8 Speed

For details, see Data Packet Format 5.2.1.8

5.6.1.9 Course and status

For details, see Data Packet Format 5.2.1.9

5.6.1.10 Telephone number

The phone number is 21 digits, and any less than 21 digits must be filled with spaces, that is: 0x20

For example: 13800138000, the device reports: 0x31 0x33 0x38 0x30 0x30 0x31 0x33 0x38

0x30 0x30 0x30 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20

5.6.1.11 Reserve + Language

Chinese: 0x00 0x01

English: 0x00 0x02

5.6. 1.12 Information serial number

For details, see Data Packet Format 4.5

5.6. 1.13 Error Checking

For details, see Data Packet Format 4.6

5.6. 1.14 stop bit

For details, see Data Packet Format 4.7

5.7. LBS+WIFI information ( 0x2C )

Format Length(Byte) illustrate

start bit 2 0x78 0x78

2
 Length = protocol number + message content +
Packet length 1 message sequence number + error check

Agreement number 1 0x2C

Year, month, day, hour, minute and second

date time 6 (converted to decimal)

MCC 2 Mobile Country Code

information

MNC 1 Mobile Network Code (MNC)

LAC 2 Mobile Network Code (MNC)

CI 3 Mobile base station Cell Tower ID (Cell ID)

Cell signal strength, the value range is 0x00~0xFF,

RSSI 1 0x00 has the weakest signal, and 0xFF has the
strongest signal.

NLAC1 2 Same as LAC

NCI1 3 Same as CI

NRSSI1 1 Same as above RSSI

NLAC2 2 Same as LAC

NCI2 3 Same as CI

NRSSI2 1 Same as above RSSI

NLAC3 2 Same as LAC

2
 NCI3 3 Same as CI

NRSSI3 1 Same as above RSSI

NLAC4 2 Same as LAC

NCI4 3 Same as CI

NRSSI4 1 Same as above RSSI

NLAC5 2 Same as LAC

NCI5 3 Same as CI

NRSSI5 1 Same as above RSSI

NLAC6 2 Same as LAC

NCI6 3 Same as CI

NRSSI6 1 Same as above RSSI

It refers to the difference between the actual time

when the mobile station signal reaches the base
time advance 1 station and the time when the mobile station signal
reaches the base station assuming that the distance
between the mobile station and the base station is 0.

Used to determine the number of WIFI transmitted

WiFi quantity 1 in the package, 0 means no WIFI is detected

Received signal 1WIFI MAC (transmit according

to the actual number of searched WIFIs, if one is
WIFIMAC1 6 found, one is transmitted, if many are found,
multiple are transmitted, if no transmission is
found, it is 0)

2
 WIFI strength 1 1 Signal 1WIFI signal strength

WIFIMAC2 6 Same as above

WIFI strength 2 1 Same as above

… …

After powering on, the serial number is

information
2 automatically incremented by 1 each time data is
sequence
sent.

CRC-ITU value from "Packet Length" to "Message

Check Digit 2 Sequence Number".

Stop bit 2 Fixed value: 0x0D 0x0A

The base station information is fixed at 7, and 0x00 is added for any shortage. The WIFI information is

reported according to the actual number, with a maximum of 8.

For example, the device reports server-side WIFI positioning data:

78786b 2c

110b1709362501cc00287200101a3f28720010193f2872000df3282872000df4190000000000000000000

0000000000000000000007e4a1e6

5384bf4af49eef65772b4c34967204ebbf53bc46996697f853f0fe6b5d752c5424050f247e205ab0d59d0efd

d15c000450f80d0a

The platform does not need to reply to this information

2
 5.8. The terminal sends the IMSI number to the server ( 0x90 )
Format Length(Byte) describe

start bit 2 0x78 0x78

0 x 1A, length = protocol number + information
Packet length 1
content + error check
Agreement number 1 0x90
Character
5 Fixed characters (IMSI :)
IMSI
I MSI The device uses the IMSI number of the SIM
information 15
IMSI number card
information reserved
2 Fixed value: 0x 01 0x01
seat
Fixed
1 Fixed value: 0 x 9F
characters
CRC-ITU value from "Packet Length" to
error checking 2
"Message Sequence Number"
end bit 2 0x0D 0x0A

For example: The device sends IMSI to the server:

78781A90494D53493A34363030 343030333039303336303001019F6BF90D0A
Note: Every time the device is powered on or restarted, the IMSI information of the device will be
reported once after the first heartbeat packet. The server does not need to respond to this packet.

5.9. The terminal sends information to the server (0x94 )

Format Length(Byte) describe

start bit 2 Fixed value: 0x 7 9 0x7 9

N , length = protocol number + message content + message
Packet length 2
sequence number + error check
Agreement
1 Fixed value: 0x9 4
number

in
fo
r 0x 00: external voltage
m D 0x 01~ 0x 03: (customized)
ati at 0x 04: Terminal status synchronization
o a 0x 05: Door status
Informati
n co 1 0x 08: Self-test parameters
on type
nt 0x 09: Positioning satellite information
en 0x 0A: ICCID information
t 0xAA: CANBUS data
...to be added

2
 Data Depending on the type of information, the content is also different.
N
content See the table below for details of 0A.
Information After turning on the phone, every time you send data, it will
2
serial number automatically +1
CRC-ITU value from "Packet Length" to "Message Sequence
error checking 2
Number"
end bit 2 0x0D 0x0A

When the information type is 0x0A: In addition, ICCID information is transmitted, and the transmission
is hexadecimal.

For example: IMEI number is 123456789123456, then the terminal

IMEI 8 ID is: 0x01 0x23 0x45 0x67 0x89 0x12 0x34 0x56

For example: IMSI number is 123456789123456, then the terminal

IMSI 8 ID is: 0x01 0x23 0x45 0x67 0x89 0x12 0x34 0x56

For example: ICCID number is 12345123456789123456, then the

ICCID 10 terminal ID is: 0x12 0x34 0x51 0x23 0x45 0x97 0x89 0x12 0x34
0x56

Example of device uploading ICCID number:

79790020940a03580910880015580460041990205313898607b91117301203130009a0720d0a
7979 0020 94 0a 0358091088001558 0460041990205313
Starting bit length Protocol number type IMEI number IMSI number
898607b9111730120313 0009 a072 0d0a
ICCID number information sequence error check stop bit
When the information type is 0x A A: In addition, OBD information is transmitted, the message format is
as follows
Data content format:

data item length Detailed explanation

Total number of OBD data 1 The number of data streams included
flow items
single data stream n Using TLV format, one data stream has one TAG. The TLV format is shown in
the table below.
single data stream n Using TLV format, one data stream has one TAG. The TLV format is shown in
the table below.
…..

The format of a single data stream TLV:

data flow item TAG length unit describe

OBD speed 0x01 2 rpm Precision: 1 Offset: 0 Range: 0 ~ 8000
OBD speed 0x02 1 Km/h Precision: 1 Offset: 0 Range: 0 ~ 240

2
OBD remaining oil 0x03 2 %L Remaining oil volume, unit L or %
volume Bit15 ==0 percentage% OBD are all percentages
==1 unit L
The displayed value is the uploaded value/10
OBD coolant temperature 0x04 1 ℃ Accuracy: 1℃ Offset: -40.0℃ Range: -40.0℃ ~ +210℃
OBD air inlet temperature 0x05 1 ℃ Accuracy: 1℃ Offset: -40.0℃ Range: -40.0℃ ~ +210℃
OBD intake pressure 0x06 1 kPa Accuracy: 1 Offset: 0 Range: 0 ~ 250kpa
OBD atmospheric 0x07 1 kPa Accuracy: 1 Offset: 0 Range: 0 ~ 125kpa
pressure
OBD ambient temperature 0x08 1 ℃ Accuracy: 1℃ Offset: -40.0℃ Range: -40.0℃ ~ +210℃
OBD accelerator pedal 0x09 1 % Accuracy: 1 Offset: 0 Range: 0% ~ 100%
position
OBD fuel pressure 0x0A 2 kPa Accuracy: 1 Offset: 0 Range: 0 ~ 500kpa

Number of OBD fault 0x0B 1 indivual Precision: 1 Offset: 0 Value range: 0~255
codes
OBD clutch switch 0x0C 1 0x00/0x01 off/on

OBD brake switch 0x0D 1 0x00/0x01 off/on

OBD parking brake 0x0E 1 0x00/0x01 off/on

switch
OBD throttle valve 0x0F 1 % Accuracy: 1 Offset: 0 Range: 0% ~ 100%
position
OBD oil usage rate 0x10 2 L/h Accuracy: 0.05L/h Offset: 0 Value range: 0 ~ 3212.75L/h

OBD fuel temperature 0x11 2 ℃ Accuracy: 0.03125℃ Offset: -273.0℃ Range: -273.0℃ ~
+1734.96875℃
OBD oil temperature 0x12 2 ℃ Accuracy: 0.03125℃ Offset: -273.0℃ Range: -273.0℃ ~
+1734.96875℃
OBD engine oil pressure 0x13 1 kPa Accuracy: 4 Offset: 0 Range: 0 ~ 1000kpa

OBD brake pedal position 0x14 1 % Accuracy: 1 Offset: 0 Range: 0% ~ 100%

OBD air flow 0x15 2 g/s Precision: 0.1 Offset: 0 Value range: 0~6553.5

Engine net output torque 0x16 1 % Precision: 1 Offset: -125 Value range: -125% ~+125%

friction torque 0x17 1 % Precision: 1 Offset: -125 Value range: -125% ~+125%

SCR upstream NOx 0x18 2 ppm Accuracy: 0.05 Offset: -200 Value range: -200~+3012.75ppm
sensor output value
SCR downstream NOx 0x19 2 ppm Accuracy: 0.05 Offset: -200 Value range: -200~+3012.75ppm
sensor output value
Reactant balance 0x1A 1 % Accuracy: 0.4 Offset: 0 Range: 0% ~ 100%

Air intake 0x1B 2 Kg/h Accuracy: 0.05 Offset: 0 Value range: 0 ~ 3212.75 Kg/h

SCR inlet temperature 0x1C 2 ℃ Accuracy: 0.03125℃ Offset: -273.0℃ Range: -273.0℃ ~
+1734.96875℃
SCR outlet temperature 0x1D 2 ℃ Accuracy: 0.03125℃ Offset: -273.0℃ Range: -273.0℃ ~
+1734.96875℃
DPF differential pressure 0x1E 2 kPa
Accuracy: 0.1 Offset: 0 Value range: 0 ~ 6425.5 kPa

2
Engine torque mode 0x1F 1 0: Overspeed failure
1: Speed control
2: Torque control
3: Speed/torque control
9: normal
Urea tank temperature 0x20 1 ℃ Accuracy: 1℃ Offset: -40.0℃ Range: -40.0℃ ~ +210℃

Actual urea injection 0x21 4 ml/h Accuracy: 0.01 Offset: 0 Value range: 0 ~ 42949672.95 ml/h
volume
Cumulative urea 0x22 4 g Precision: 1 Offset: 0 Value range: 0 ~ 4294967295g
consumption
DPF exhaust temperature 0x23 2 ℃ Accuracy: 0.03125℃ Offset: -273.0℃ Range: -273.0℃ ~
+1734.96875℃
OBD diagnostic protocol 0x24 1 The valid range is 0~2, "0" represents IOS15765, "1"
represents IOS27145, "2" represents SAEJ1939, and "0xFE"
represents invalid.
MIL status 0x25 1 The valid range is 0~1, "0" means not lit, and "1" means lit.
"0xFE" means invalid.
Diagnostic support status 0x26 2 Each bit is defined as follows:
1 Catalyst monitoring Status Catalytic converter monitoring
2 Heated catalyst monitoring Status Heated catalytic converter
monitoring
3 Evaporative system monitoring Status Evaporative system
monitoring
4 Secondary air system monitoring Status Secondary air
system monitoring
5 A/C system refrigerant monitoring Status A/C system
refrigerant monitoring
6 Exhaust Gas Sensor monitoring Status Exhaust gas sensor
monitoring
7 Exhaust Gas Sensor heater monitoring Status Exhaust gas
sensor heater monitoring
8 EGR/VVT system monitoring EGR system and VVT
monitoring
9 Cold start aid system monitoring Status Cold start aid system
monitoring
10 Boost pressure control system monitoring Status Boost
pressure control system
11 Diesel Particulate Filter (DPF) monitoring Status DPF
monitoring
12 NOx converting catalyst and/or NOx adsorber monitoring
Status Selective catalytic reduction system (SCR) or NOx
adsorber
13 NMHC converting catalyst monitoring Status NMHC
oxidation catalyst monitoring
14 Misfire monitoring support Misfire monitoring
15 Fuel system monitoring support Fuel system monitoring
16 Comprehensive component monitoring support
Comprehensive component monitoring
The meaning of each bit: 0=not supported; 1=supported;
Diagnostic readiness 0x27 2 Each bit is defined as follows
status 1 Catalyst monitoring Status Catalytic converter monitoring
2 Heated catalyst monitoring Status Heated catalytic converter
monitoring
3 Evaporative system monitoring Status Evaporative system
monitoring
4 Secondary air system monitoring Status Secondary air
system monitoring
5 A/C system refrigerant monitoring Status A/C system
refrigerant monitoring

2
 6 Exhaust Gas Sensor monitoring Status Exhaust gas sensor
monitoring
7 Exhaust Gas Sensor heater monitoring Status Exhaust gas
sensor heater monitoring
8 EGR/VVT system monitoring EGR system and VVT
monitoring
9 Cold start aid system monitoring Status Cold start aid system
monitoring
10 Boost pressure control system monitoring Status Boost
pressure control system
11 Diesel Particulate Filter (DPF) monitoring Status DPF
monitoring
12 NOx converting catalyst and/or NOx adsorber monitoring
Status Selective catalytic reduction system (SCR) or NOx
adsorber
13 NMHC converting catalyst monitoring Status NMHC
oxidation catalyst monitoring
14 Misfire monitoring support Misfire monitoring
15 Fuel system monitoring support Fuel system monitoring
16 Comprehensive component monitoring support
Comprehensive component monitoring
The meaning of each bit: 0=test completed or not supported;
1=test not completed
vehicle identification 0x28 17 ASCII The vehicle identification code is a unique identifier for
number identification and consists of a 17-digit character code. The
character code should comply with the provisions of 4.5 in
GB16735.
Software calibration 0x29 18 The software calibration identification number is customized
identification number by the manufacturer and consists of letters or numbers, with
the character "0" added at the end.
Calibration verification 0x3A 18 The calibration verification code is customized by the
code manufacturer and consists of letters or numbers, with the
missing character "0" at the end.
IUPR value 0x3B 36
For definition, refer to SAE J1979-DA Table G11.
light absorption 0x3C 2 0.01m-1
coefficient
Opacity 0x3D 2 0.1%

particulate matter 0x3E 2 Mg/m3

concentration
Engine real-time load 0x3F 1 % 0-100%

Coolant low level alarm 0x40 1 0: Normal 1: Alarm

Engine oil low alarm 0x41 1 0: Normal 1: Alarm

Air pressure alarm 0x42 1 0x00/0x01 off/on

indicator
Exhaust brake switch 0x43 1 0x00/0x01 off/on

Note: In this protocol, the server does not need to reply

2
 5.10. Recording protocol package ( 0x8D )
After the device records, it sends the recording package to the server. It is suitable for S 709, S 11,
S11C, and W15L devices.

5.10.1. The terminal sends a data packet to the server:

Format Length(Byte) describe

start bit 2 Fixed value: 0x79 0x79

Length = protocol number + message
Packet length 2 content + message sequence number + error
check
Agreement number 1 Fixed value: 0x8D
file type 1 Fixed value: 0x00
Total file length 4 Total length of transferred files
Total number of How many packages are the total number of
1
files files to be transferred?
information Recording File current
content Transfer the current packet sequence of the
package 1
file
sequence
Current content The data length after the transmission split
2
length from the beginning to the end
Data content M Split packet content
After turning on the phone, every time you
Information serial number 2
send data, it will automatically +1
CRC from "packet length" to "message
error checking 2
sequence number" - ITU value
end bit 2 0x0D 0x0A

5.10.2. The server responds to the terminal:

Format Length(Byte) describe

start bit 2 Fixed value: 0x 79 0x79

Length = protocol number + message content +
Packet length 2
message sequence number + error check
Agreement
1 Fixed value: 0x8D
number
information receive status flag 1 0x00: normal reception 0x01: reception error
Information serial After turning on the phone, every time you send data,
2
number it will automatically +1
CRC from "packet length" to "message sequence
error checking 2
number" - ITU value
end bit 2 0x0D 0x0A
Each time the device sends a recording file packet, it needs to receive a response from the server
before it can continue to send the next data packet. If it sends the same packet three times in a row
without receiving a response, it will give up sending the recording file.

2
 5.11. 4G device positioning data packet ( 0 xA0 )
5. 11 .1. The terminal sends positioning data packet to the server
Format Length(Byte) Example

start bit 2 0x78 0x78

0 x1C+N ( N is the additional data
Packet length 1
length )
Agreement number 1 0xA0
date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
GPS information
1 0xC B
satellite number
latitude 4 0x02 0x7A 0xCF 0xEB
GPS
information longitude 4 0xCC 0x46 0x58 0x49
speed 1 0x10
information heading, status 2 0x1 5 0x 4C
MCC 2 0x01 0xCC
LBS MNC 1 0x00
information LAC 2 0x28 0x7D
Cell ID 4 0x00 0x1F 0xB8 0x27
Determined by actual extension
Additional Information 1+N
length
serial number 2 0x00 0x03
error checking 2 0x9D 0xDC
end bit 2 0x0D 0x0A

Additional Information

type Length( Byte) describe

Number of
1 Number of additional data
additional data

Additional data N consists of one or more additional data

The additional data format is as follows:

Additional Data length

describe
data ID

0x01 1 ACC status, off - 0x 00 , on - 0x 01

2
0x02 1 Data reporting mode, as defined in the data reporting mode table

0x 03 G PS real-time supplementary transmission, 0x 00- normal data 0x01-

1
real-time supplementary transmission of data

0x 04 Total mileage in meters, for example: 0x00 0x0F 0x42 0x40 (1,000,000
4
meters, that is, 1,000 kilometers)

0x 05 Total travel time, unit is seconds, for example: 0x00 0x0F 0x42 0x40
4
(1000000 seconds)

0x 06 Temperature, unit: degrees Celsius ,

Conversion method: bit15 is the temperature symbol (0: + 1 : -)
2
bit0-bit14 are temperature values ( 0 x 800C : -12
degrees Celsius )

0x 07 Humidity, unit: percentage relative humidity (%RH). Range is 0 -100

2
100 times the real value , such as 0x1AF0: 68.96%

0x 08 fuel consumption percentage

Format: Percent ( 2 Byte), precision is 0.1 %
2
Example: 0x03E7=(999/10)*100%=99.9%

0x09 RFID :
Format: Operation mode ( 1 Byte) + driver number ( N Byte)
Operation mode value range:
1+N
0x 00: Sign-in begins
0x01 : Sign-in status
0x02 : Sign-in ends

0x0A J T Oil Rod:

2 Format: Percent (2 Byte ), precision is 0.01 %
Example: 0x 199B(65.55%)

0x0B i Button:
Format: Operation mode ( 1 Byte)+iButton ID ( 6 Byte , hex )
Operation mode value range:
7
0x 00: Sign-in begins
0x01 : Sign-in status
0x02 : Sign-in ends

2
 0x0C Xinde’s ultrasonic fuel consumption height
Format: smoothed fuel consumption height ( 2 Byte) + real-time fuel
consumption height ( 2 Byte) , unit 0.1 mm
4
Example: 0x01 , 0x 25 , 0x 01 , 0x 26
Smooth fuel consumption height=0x0125=29.3mm
Real-time fuel consumption height=0x012 6 =29.4mm

Data reporting mode table

0x00: Regular reporting

0x01: Fixed interval reporting
0x02: Inflection point upload
0x03: ACC status change upload
0x04: After changing from motion to static state, the last positioning point is
transmitted.
0x05: After the network is disconnected and reconnected, the last valid upload point
before reporting
0x06: Reporting mode: Mandatory upload of GPS points for ephemeris update
Data reporting 0x07: Reporting mode: press the button to upload the anchor point
type
0x08: Reporting mode: report location information after power on
0x09: Reporting mode: not used
0x 0A : Reporting mode: the device reports the last longitude and latitude after being
stationary, but the time is updated
0x 0B : WIFI parsing longitude and latitude upload package
0x 0C : Reporting mode: LJDW (immediate positioning) command reporting
0x 0D : Reporting mode: report the last longitude and latitude after the device is
stationary
0x 0E : Reporting mode: GPSDUP upload (scheduled upload in static state)

5. 11 .1.1. Start bit

See data packet format for details 4.1

5. 11 .1.2. Packet length

See data packet format for details 4.2

2
5. 11 .1.3. Agreement number

See data packet format for details 4.3

5. 11 . 1. 4. date time

For details, see Data Packet Format 5.2.1.4

5. 11 . 1 .5. Number of satellites participating in positioning

For details, see Data Packet Format 5.2.1.5

5. 11. 1.6 . Latitude

For details, see Data Packet Format 5.2.1.6

5. 11. 1.7 . Longitude

For details, see Data Packet Format 5.2.1.7

5. 11 . 1 .8. speed

For details, see Data Packet Format 5.2.1.8

5. 11 . 1 .9. status heading

For details, see Data Packet Format 5.2.1.9

5. 11 .1.10.MCC

For details, see Data Packet Format 5.2.1.10

5. 11 .1.11.MNC

For details, see Data Packet Format 5.2.1.11

5. 11 .1.12.LAC

For details, see Data Packet Format 5.2.1.12

5. 11 .1.13. Cell ID

For details, see Data Packet Format 5.2.1.13

5. 11 . 1 . 14 . Information serial number

For details, see Data Packet Format 4.7

2
 5. 11. 1. 15. Error checking

For details, see Data Packet Format 4.7

5. 11 . 1 . 16 . Stop bit

For details, see Data Packet Format 4.6

5. 11.2. Server reply

This message server does not need to respond
Note: When the GSM signal is abnormal, the 0x 28 information packet will be saved first and then
re-transmitted to the platform; the re-transmission method is not to upload in real time, but to upload the
reserved positioning point after the device is stationary. The track playback should be based on the time
in the positioning package. When displayed in real time, the positioning package time that is 5 minutes
lower than the current time should not be displayed.

5. 12. 4G device alarm package (0 x A5 )

5. 12.1 . The terminal sends an alarm data packet to the server
Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x26
Agreement number 1 0 x A5
date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
GPS information
1 0xC B
satellite number
latitude 4 0x02 0x7A 0xCF 0xEB
GPS
information longitude 4 0xCC 0x46 0x58 0x49
speed 1 0x10
heading, status 2 0x1 5 0x 4C
information LBS length 1 0x0A
MCC 2 0x01 0xCC
LBS
information MNC 1 0x00
LAC 2 0x28 0x7D
Cell ID 4 0x00 0x1F 0xB8 0x24
Terminal
1 0x4E
information
Voltage level 1 0x04
status
information GSM signal
1 0x64
strength
Call the police 1 0x00

2
 language 1 0x 02
serial number 2 0x00 0x03
error checking 2 0x8C 0x59
end bit 2 0x0D 0x0A

5. 12 .1.1 Start bit

For details, see Data Packet Format 4.1

5. 12 .1.2 Packet length

For details, see Data Packet Format 4.2

5. 12.1.3 Agreement number

For details, see Data Packet Format 4.3

5. 12 .1.4 Date and time

For details, see Data Packet Format 5.2.1.4

5. 12 .1.5 Number of GPS satellites

For details, see Data Packet Format 5.2.1.5

5. 12 .1.6 Latitude

For details, see Data Packet Format 5.2.1.6

5. 12 .1.7 Longitude

For details, see Data Packet Format 5.2.1.7

5. 12 .1.8 Speed

For details, see Data Packet Format 5.2.1.8

2
 5. 12 .1.9 Course and status

For details, see Data Packet Format 5.2.1.9

5. 12 .1.10 LBS length

The length of the LBS information content, the length is fixed: 0x 0A

5. 12 .1.11 MCC

For details, see Data Packet Format 5.2.1.10

5. 12 .1.12 MNC

For details, see Data Packet Format 5.2.1.11

5. 12 .1.13 LAC

For details, see Data Packet Format 5.2.1.12

5. 12 .1.14 Cell ID

For details, see Data Packet Format 5.2.1.13

5. 12 .1.15 Terminal information

For details, see Data Packet Format 5.4.1.4

5. 12 .1.16 Battery voltage level

For details, see Data Packet Format 5.4.1.5

5. 12 .1.17 GSM signal strength

For details, see Data Packet Format 5.4.1.6

2
 5. 12 .1.18 Alarm type

0x00: normal

0x01: SOS alarm

0x02: Power failure alarm

0x03: Vibration alarm

0x04: Alarm when entering the

fence

0x05: Alarm when exiting the

fence
alarm type

0x06: Speeding alarm

0x07: High temperature alarm

0x08: Low temperature alarm

0x09: Displacement alarm

0x13: Anti-tamper alarm (light

sensor alarm)

0x26: Rapid acceleration alarm

2
 0x27: Rapid deceleration alarm

0x28: Sharp turn alarm

0x29: Collision alarm

0x0E: Low battery alarm

0xFA: Door closed alarm

0xFB: Alarm when the door is

opened

0xFC: AC off alarm

0xFD: AC turns on alarm

0xFE: ACC ignition alarm

0xFF: ACC flameout alarm

5. 12 .1.19 Language

Simplified Chinese: 0x01

English: 0x02

5. 12 .1.20 Information serial number

2
For details, see Data Packet Format 4.5

5. 12 .1.21 Error checking

For details, see Data Packet Format 4.6

5. 12 .1.22 Stop bit

For details, see Data Packet Format 4.7

5. 12 .2. The server sends an alarm packet reply to the terminal

Format Length(Byte) Example
information start bit 2 0x78 0x78

Packet length 1 0x 05

Agreement number 1 0x16

information sequence 2 0x 00 0x 05

error checking 2 0x 96 0x 68

Stop bit 2 0x 0D 0x 0A

5. 12 .2.1 Start bit

For details, see Data Packet Format 4.1
5. 12 .2.2 Packet length
For details, see Data Packet Format 4.2
5. 12 .2.3 Agreement number
For details, see Data Packet Format 4.3
5. 12 .2.4 Information serial number
For details, see Data Packet Format 4.5
5. 12 .2.5 Error checking

2
 For details, see Data Packet Format 4.6
5. 12 .2.6 Stop bit
For details, see Data Packet Format 4.7

5. 13 . 4G device WIFI information packet (0xA2 )

Format Length(Byte) illustrate

start bit 2 0x78 0x78

Length = protocol number + message content +

Packet length 1 message sequence number + error check

Agreement number 1 0xA2

Year, month, day, hour, minute and second

date time 6 (converted to decimal)

MCC 2 Mobile Country Code

information

MNC 1 Mobile Network Code (MNC)

LAC 2 Mobile Network Code (MNC)

CI 4 4g mobile base station Cell Tower ID (Cell ID)

Cell signal strength, the value range is 0x00~0xFF,

RSSI 1 0x00 has the weakest signal, and 0xFF has the
strongest signal.

NLAC1 2 Same as LAC

NCI1 3 Same as CI

NRSSI1 1 Same as above RSSI

NLAC2 2 Same as LAC

2
 NCI2 3 Same as CI

NRSSI2 1 Same as above RSSI

NLAC3 2 Same as LAC

NCI3 3 Same as CI

NRSSI3 1 Same as above RSSI

NLAC4 2 Same as LAC

NCI4 3 Same as CI

NRSSI4 1 Same as above RSSI

NLAC5 2 Same as LAC

NCI5 3 Same as CI

NRSSI5 1 Same as above RSSI

NLAC6 2 Same as LAC

NCI6 3 Same as CI

NRSSI6 1 Same as above RSSI

It refers to the difference between the actual time

when the mobile station signal reaches the base
time advance 1 station and the time when the mobile station signal
reaches the base station assuming that the distance
between the mobile station and the base station is 0.

2
 Used to determine the number of WIFI transmitted
WiFi quantity 1 in the package, 0 means no WIFI is detected

Received signal 1WIFI MAC (transmit according

to the actual number of searched WIFIs, if one is
WIFIMAC1 6 found, one is transmitted, if many are found,
multiple are transmitted, if no transmission is
found, it is 0)

WIFI strength 1 1 Signal 1WIFI signal strength

WIFIMAC2 6 Same as above

WIFI strength 2 1 Same as above

… …

After powering on, the serial number is

information
2 automatically incremented by 1 each time data is
sequence
sent.

CRC-ITU value from "Packet Length" to "Message

Check Digit 2 Sequence Number".

Stop bit 2 Fixed value: 0x0D 0x0A

The base station information is fixed at 7, and 0x00 is added for any shortage. The WIFI information is

reported according to the actual number, with a maximum of 8.

5. 1 4. 4G device heartbeat packet (0xA3 )

Heartbeat packets are data packets that maintain the connection between the terminal and the server.

5. 1 4.1. The terminal sends a heartbeat packet to the server

Format Length(Byte) Example

start bit 2 0x78 0x78

information Packet length 1 0x0A
Agreement number 1 0 xA3

2
 Terminal
1 0x4E
information
IO status 2 0x02 0x01
status Voltage level 1 0x06
information GSM signal
1 0x64
strength
external voltage 1 0x0C
language 1 0x02
serial number 2 0x00 0x03
error checking 2 0xFF 0x4F
end bit 2 0x0D 0x0A

5. 1 4.1.1. start bit

For details, see Data Packet Format 4.1

5. 1 4.1.2. Packet length

For details, see Data Packet Format 4.2

5. 1 4.1.3. Agreement number

For details, see Data Packet Format 4.3

5. 1 4.1.4. Terminal information

It occupies 1 byte and is converted into binary to represent the status information of the terminal. One
byte is regarded as 8 bits, the lowest bit is 0 bits, and the highest bit is 7 bits. When transmitting, the high
bit is transmitted first, and then the low bit is transmitted. The specific meanings of each representative
are as follows:

Bit Code meaning

1: Oil and electricity disconnected
Bit 7
0: oil and electricity connected
1: GPS has positioned
Bit 6
0: GPS not positioned
111: Door open alarm
110: Door closing alarm
BYTE 100: SOS alarm
Bit 5-
011: Low battery alarm
Bit 3
010: Power failure alarm
001: Vibration alarm
000: normal
1: Connected to external power supply (wired
Bit 2 device), charging (wireless)
0: Not connected to external power supply (wired

2
 device), not charging (wireless)
1:ACC ON
Bit 1
0:ACC O F
1: Fortification
Bit0
0: Disarm

Example: 0x4E, the corresponding binary is 01001110

Indicates that it is in the disarmed state, ACC ON, external power supply connected, vibration alarm,
GPS positioned, and oil and electricity connected.

5. 1 4.1. 5 . IO status

Occupies 2 bytes

Bit Code meaning

B it 15 reserved
B it 14 reserved
B it 13 reserved
B it 12 reserved
B it 11 reserved
B it 10 DOUT3 channel status 1 - high level 0 - low level
B it 9 DOUT2 channel status 1 - high level 0 - low level
B it 8 DOUT1 channel status 1 - high level 0 - low level
B it 7 reserved
B it 6 reserved
B it 5 reserved
B it 4 reserved
B it 3 reserved
B it 2 DIN3 channel status 1 - high level 0 - low level
B it 1 DIN2 channel status 1 - high level 0 - low level
B it 0 DIN1 channel status 1 - high level 0 - low level

5. 1 4.1. 6 . Voltage level

Wireless device upload power percentage, 0-100

Wired devices follow the following rules:
There are a total of 7 voltage levels, ranging from 0-6, indicating the voltage from low to high.
0: No power (power off);
1: The battery status is not enough to make calls, send text messages, etc.;
2: Low battery;
3-6: All can be used normally, but they are arranged according to the amount of electricity.

2
 5.14.1.7. GSM signal strength

Range of GSM information: 0-100; converted to decimal, the larger the value, the stronger the GSM
signal
0: Indicates no signal
100: full signal

5. 1 4.1. 8 . External voltage + language

Example: The external power supply voltage is 30 volts (30V), and the current language
bit of the terminal is:
Chinese:0x1E 0x01;
English:0x1E 0x02;

5. 1 4.1. 9. Information serial number

For details, see Data Packet Format 4.5

5. 1 4.1. 10. Error checking

For details, see Data Packet Format 4.6

5. 1 4.1.1 1. Stop bit

For details, see Data Packet Format 4.7

5. 1 4. 2. The server responds with a heartbeat packet

Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x05

information

Agreement
1 0x13
number

2
 information
2 0x00 0x01
sequence

error checking 2 0xE9 0xF1

Stop bit 2 0x0D 0x0A

After receiving the data packet from the terminal, the server responds with an empty data packet.
Note: The "information sequence number" in the data packet must be consistent with the
"information sequence number" sent by the responding terminal.

5.14.2.1Start bit

For details, see Data Packet Format 4.1

5.14.2.2 Packet length

For details, see Data Packet Format 4.2

5.14.2.3 Agreement number

For details, see Data Packet Format 4.3

5.14.2.4 Information serial number

For details, see Data Packet Format 4.5

5.14.2.5 Error checking

For details, see Data Packet Format 4.6

5.14.2.6 Stop bit

For details, see Data Packet Format 4.7

2
 6. The server sends data packets to the terminal

6. 1. Server sends command ( 0x80 )

Format Length(Byte)
start bit 2
Packet length 1
Agreement number 1
Instruction
1
length
information server flag 4
Command
N
content
Information serial number 2
error checking 2
Stop bit 2

6.1.1. start bit

For details, see Data Packet Format 4.1

6.1.2. Packet length

For details, see Data Packet Format 4.2

6.1.3. Agreement number

Fixed value: 0x80

6.1.4. Instruction length

Instruction length = Server flag+ Command content length
For example: in byte length, 0x0A means that the instruction content occupies 10 bytes

2
 6.1.5. Server flags
It is left for server identification, and the terminal returns the received data binary in the return
packet as it is.

6.1.6. Instruction content

Represented by ASCⅡ of string, the command content is compatible with SMS commands

6.1.7. Message serial number

For details, see Data Packet Format 4.5

6.1.8. Error checking

For details, see Data Packet Format 4.6

6.1.9. Stop bit

For details, see Data Packet Format 4.7

6.2 . Terminal returns data packet ( 0x15 )

Format Length(Byte)
start bit 2
Packet length 1
Agreement number 1
Instruction 1
length
server flag 4
information
Command
N
content
language 2
Information serial number 2
error checking 2
Stop bit 2

6.2.1. Start bit

For details, see Data Packet Format 4.1

6.2.2. Packet length

For details, see Data Packet Format 4.2

2
 6.2.3. Agreement number
The terminal responds to the command sent by the server. The data packet format is consistent with
the "command sent by the server to the terminal" format, but the protocol number is different, using
0x15.

6.2.4. Instruction length

Instruction length = Server flag+ Command content length
For example: in byte length, 0x0A means that the instruction content occupies 10 bytes

6.2.5. Server flag bit

The terminal returns the binary data received as it is in the return packet.

6.2.6. Instruction content

ASCII representation of string

6.2.7.Language
The language used by the terminal
Chinese: 0x00 0x01
English: 0x00 0x02

6.2.8 . Message serial number

For details, see Data Packet Format 4.5

6.2. 9. Error checking

For details, see Data Packet Format 4.6

6.2. 10. Stop bit

For details, see Data Packet Format 4.7

6.2.11 . Server command issuance example

6.2.11.1 Cut off oil and electricity

SMS command format:

RELAY,1#

2
DYD,000000#

Function description: Cut off the vehicle’s oil and electricity control circuit

returned messages:

1. Successful return: DYD=Success!

2. Return on failure: DYD=Unvalued Fix!

Or DYD=Speed Limit, Speed 40km/h

For example: issued by the platform: 78 78 15 80 0F 00 01 A9 58 44 59 44 2C 30 30 30 30 30 30 23 00

A0 DC F1 0D 0A

Bold part: DYD,000000#

Device response: 78 78 18 15 10 00 01 A9 58 44 59 44 3D 53 75 63 63 65 73 73 21 00 02 00 18 91 77

0D 0A

Bold part: DYS=Success!

6.2.11.2 Restoration of oil and electricity

SMS command format:

HFYD,000000#

Function description: Connect the vehicle's oil and electricity control circuit

returned messages:

1. Successful return: HFYD=Success!

2. Return on failure: HFYD=Fail!

Platform delivery and device reply are similar to DYD

2
 6.2.11.3 View location

Instruction format:

DWXX,000000#

Function description:

Get positioning information instructions. Both mobile phone users and SMS servers can obtain

positioning information through this command.

returned messages:

1、 Return successfully:

DWXX=Lat:< South / North Latitude >,Lon:< East / West Longitude >,Course:<Angle> ,

Speed:<Speed> , DateTime : <Time>

2. Failure returns: DWXX=Command Error!

For example:

Lat:N23d5.1708m,Lon:E114d23.6212m,Course:120,Speed:53.02;DateTime:08-09-12 14:52:36

The meaning is: 23 degrees 5.1708 minutes north latitude, 114 degrees 23.6212 minutes east longitude,

angle: 120 degrees, speed: 53.02 kilometers/hour, time and date: 14:52:36 on September 12, 2008.

Note: If the terminal is not positioned successfully, it will return: Lat:,Lon:, Course:,Speed:,DateTime:-:

The platform delivery and device reply formats are similar to DYD

2
 7. Attached is the AAU CRC-ITU table lookup algorithm

CC language code snippet

// CRC-ITU table lookup algorithm C language code snippet
static const U16 crctab16[] =
{
0X0000, 0X1189, 0X2312, 0X329B, 0X4624, 0X57AD, 0X6536, 0X74BF,
0X8C48, 0X9DC1, 0XAF5A, 0XBED3, 0XCA6C, 0XDBE5, 0XE97E, 0XF8F7,
0X1081, 0X0108, 0X3393, 0X221A, 0X56A5, 0X472C, 0X75B7, 0X643E,
0X9CC9, 0X8D40, 0XBFDB, 0XAE52, 0XDAED, 0XCB64, 0XF9FF, 0XE876,
0X2102, 0X308B, 0X0210, 0X1399, 0X6726, 0X76AF, 0X4434, 0X55BD,
0XAD4A, 0XBCC3, 0X8E58, 0X9FD1, 0XEB6E, 0XFAE7, 0XC87C, 0XD9F5,
0X3183, 0X200A, 0X1291, 0X0318, 0X77A7, 0X662E, 0X54B5, 0X453C,
0XBDCB, 0XAC42, 0X9ED9, 0X8F50, 0XFBEF, 0XEA66, 0XD8FD, 0XC974,
0X4204, 0X538D, 0X6116, 0X709F, 0X0420, 0X15A9, 0X2732, 0X36BB,
0XCE4C, 0XDFC5, 0XED5E, 0XFCD7, 0X8868, 0X99E1, 0XAB7A, 0XBAF3,
0X5285, 0X430C, 0X7197, 0X601E, 0X14A1, 0X0528, 0X37B3, 0X263A,
0XDECD, 0XCF44, 0XFDDF, 0XEC56, 0X98E9, 0X8960, 0XBBFB, 0XAA72,
0X6306, 0X728F, 0X4014, 0X519D, 0X2522, 0X34AB, 0X0630, 0X17B9,
0XEF4E, 0XFEC7, 0XCC5C, 0XDDD5, 0XA96A, 0XB8E3, 0X8A78, 0X9BF1,
0X7387, 0X620E, 0X5095, 0X411C, 0X35A3, 0X242A, 0X16B1, 0X0738,
0XFFCF, 0XEE46, 0XDCDD, 0XCD54, 0XB9EB, 0XA862, 0X9AF9, 0X8B70,
0X8408, 0X9581, 0XA71A, 0XB693, 0XC22C, 0XD3A5, 0XE13E, 0XF0B7,
0X0840, 0X19C9, 0X2B52, 0X3ADB, 0X4E64, 0X5FED, 0X6D76, 0X7CFF,
0X9489, 0X8500, 0XB79B, 0XA612, 0XD2AD, 0XC324, 0XF1BF, 0XE036,
0X18C1, 0X0948, 0X3BD3, 0X2A5A, 0X5EE5, 0X4F6C, 0X7DF7, 0X6C7E,
0XA50A, 0XB483, 0X8618, 0X9791, 0XE32E, 0XF2A7, 0XC03C, 0XD1B5,
0X2942, 0X38CB, 0X0A50, 0X1BD9, 0X6F66, 0X7EEF, 0X4C74, 0X5DFD,
0XB58B, 0XA402, 0X9699, 0X8710, 0XF3AF, 0XE226, 0XD0BD, 0XC134,
0X39C3, 0X284A, 0X1AD1, 0X0B58, 0X7FE7, 0X6E6E, 0X5CF5, 0X4D7C,
0XC60C, 0XD785, 0XE51E, 0XF497, 0X8028, 0X91A1, 0XA33A, 0XB2B3,
0X4A44, 0X5BCD, 0X6956, 0X78DF, 0X0C60, 0X1DE9, 0X2F72, 0X3EFB,
0XD68D, 0XC704, 0XF59F, 0XE416, 0X90A9, 0X8120, 0XB3BB, 0XA232,
0X5AC5, 0X4B4C, 0X79D7, 0X685E, 0X1CE1, 0X0D68, 0X3FF3, 0X2E7A,
0XE70E, 0XF687, 0XC41C, 0XD595, 0XA12A, 0XB0A3, 0X8238, 0X93B1,
0X6B46, 0X7ACF, 0X4854, 0X59DD, 0X2D62, 0X3CEB, 0X0E70, 0X1FF9,
0XF78F, 0XE606, 0XD49D, 0XC514, 0XB1AB, 0XA022, 0X92B9, 0X8330,
0X7BC7, 0X6A4E, 0X58D5, 0X495C, 0X3DE3, 0X2C6A, 0X1EF1, 0X0F78,
};

2
// Calculate 16-bit CRC of data of given length
U16 GetCrc16(const U8* pData, int nLength)
{
U16 fcs = 0xffff; // initialization
while(nLength>0){
fcs = (fcs >> 8) ^ crctab16[(fcs ^ *pData) & 0xff];
nLength--;
pData++;
}
return ~fcs; // Negation
}