Dynamic Internet of Things SP protocol

V2.0
(SEEWORLD)
1. Communication Protocol ..........................................................................................................................1

2. Terms and definitions ............................................................................................................................... 1

3. Basic Rule ................................................................................................................................................. 3

4. Data packet format ...................................................................................................................................5

4.1. Starting bit ............................................................................................................................5

4.2. Packet length ..........................................................................................................................5

4.3. Agreement number ....................................................................................................................5

4.4. Information content .............................................................................................................. 6

4.5. Information sequence number .............................................................................................. 6

4.6. Error checking ........................................................................................................................6

4.7. Stop bit ....................................................................................................................................6

5. Detailed explanation of the terminal sending data packets to the server ................................................ 7

5.1. Login information package (0x01) .................................................................................... 7

5.1.1. The terminal sends data packet ........................................................................................ 7

5.1.2. Server response packet ..................................................................................................... 8

5.2. Positioning data packet (GPS, LBS combined information packet: 0x12) ............. 9

5.2.1. The terminal sends positioning data packet ..................................................................... 9

5.2.2. The terminal sends the mileage positioning data packet ............................................... 12
 5.2.3. Server reply ......................................................................................................................13

5.3. Positioning data packet ( add ACC, data reporting mode: 0x22 ) ................................. 14

5.3.1. The terminal sends positioning data packet ................................................................... 14

5.3.2. Server reply ......................................................................................................................16

5.4. Heartbeat packet ( 0x13 ) ...................................................................................................17

5.4.1. The terminal sends a heartbeat packet to the server .....................................................17

5.4.2. Server responds with heartbeat packet .......................................................................... 19

[Link] package (0 x16 ) ........................................................................................................ 21

5.5.1. The terminal sends alarm data packet ............................................................................ 21

5.5.2. The server sends alarm data packet reply .....................................................................25 l

5.7. LBS+WIFI information (0x2C) ............................................................................................ 28

5.8. The terminal sends the IMSI number to the server (0x90) .....................................31

5.9. The terminal sends the ICCID number to the server (0x94) ...................................32

5.10. Recording protocol package (0x8D) .............................................................................. 33

5.10.1. The terminal sends a data packet to the server: ...........................................................33

5.10.2. Server responds to terminal: .........................................................................................33

6. The server sends data packet ................................................................................................................. 34

6.1. Server sends command ( 0x80 ) ........................................................................................ 34

 6.1.1. Starting bit ....................................................................................................................... 34

6.1.2. Packet length ................................................................................................................... 34

6.1.3. Protocol number ..............................................................................................................34

6.1.4. Command length ............................................................................................................. 34

6.1.5. Server flag ........................................................................................................................ 34

6.1.6. Instruction content .......................................................................................................... 34

6.1.7. Message sequence number .............................................................................................35

6.1.8. Error checking .................................................................................................................. 35

6.1.9. Stop bit .............................................................................................................................35

6.2. Terminal returns data packet ( 0x15 ) ........................................................................ 35

6.2.1. Starting bit ....................................................................................................................... 35

6.2.2. Packet length ................................................................................................................... 35

6.2.3. Agreement number ......................................................................................................... 35

6.2.4. Command length ............................................................................................................. 35

6.2.5. Server flag ........................................................................................................................ 36

6.2.6. Instruction content .......................................................................................................... 36

6.2.7. Language ..........................................................................................................................36

6.2.8. Message serial number ................................................................................................... 36

 6.2.9. Error checking .................................................................................................................. 36

6.2.10. Stop bit ...........................................................................................................................36

6.2.11. Server command issuance example .............................................................................. 36

7. Attached is the AAU CRC-ITU table lookup algorithm CC language code snippet ...................................39
1. Communication Protocol
Introduction
This document defines the description of the application layer interface protocol
for the vehicle GPS locator and positioning service platform. This interface protocol
is only applicable to the interactive communication between the server platform and the
positioning terminal.

2. Terms and definitions

Terms,
English meaning Chinese meaning
abbreviations

China Mobile peer to peer

CMPP China Mobile Peer to Peer
protocol

GPS Global Positioning System Global Positioning System

Global System for Mobile Global System for Mobile

GSM
Communication Communication

GPRS General Packet Radio Service General Packet Radio Service

TCP Transport Control Protocol Transport Control Protocol

Assisted Location Based

LBS Location Based Services
Services

IMEI International Mobile Equipment International Mobile Equipment

1
 Identity Identity

Code of the country to which the

MCC Mobile Country Code
mobile user belongs

MNC Mobile Network Code Mobile Network Cod

LAC Location Area Code Location Area Code

Cell ID Cell Tower ID Cell Tower ID

UDP User Datagram Protocol User Datagram Protocol

SOS Save Our Ship/Save Our Souls Distress signal

CRC Cyclic Redundancy Check Cyclic redundancy check

NITZ Network Identity and Time Zone, Time zone

GIS Geographic Information System Geographic Information System

2
 三、Basic rules
1. GPRS connection is established successfully and send the first landing

information packet to the server, the server response packet is received within 5

seconds that the connection is normal, start to send positioning information (GPS, LBS

information packet), 3 minutes later will send status information packet, regular

confirmation of the normal communication;

2. When the GPRS connection is not established successfully, the terminal can not

send the landing information packet. When the GPRS connection fails for 3 times, the

terminal starts the timed restart function, and the time is 20 minutes. Within 20

minutes, if the terminal and the server successfully establish a connection, and

receive the server to the terminal sent by the landing information packet to respond to

the data packet, then the timing restart function is closed, the terminal does not

restart, otherwise the terminal automatically restarts after 20 minutes;

3. The server needs to return the response data packet to the terminal after

receiving the landing information packet sent by the terminal. If the terminal sends

the landing information packet or the status information packet, after more than 5

seconds, the server does not receive the return packet, it is considered that the

current connection is abnormal, start the GPS positioning data retransmission function,

disconnect the current GPRS connection, Re-establish a new GPRS connection and send the

login information packet;

4. The connection is judged to be abnormal, repeated 3 times after the

establishment of the connection to send the landing information packet or status

3
information packet can not receive the server response data packet, the terminal starts

the timing restart function, the timing time is 10 minutes, in 10 minutes if the

terminal and the server successfully establish a connection and receive the server

response data packet then the timing restart function is closed, The terminal does not

restart, otherwise the terminal will restart automatically after 10 minutes;

5. After the connection is established normally, after the GPS information is

changed, the terminal regularly sends the GPS and LBS combined information package to

the server, and the server can set the default sending protocol through the command;

6. In order to ensure the validity of the connection, the heartbeat packet is sent

to the server at a fixed time interval, and the server returns the response packet for

confirmation;

7. For terminals without registered IMEI number, please reply the login request and

heartbeat packet response, do not disconnect directly. (If you disconnect directly or

do not reply, it will lead to continuous reconnection of the terminal, and GPRS traffic

consumption is serious).

8. The 4G device positioning packet uses the 0x28 protocol packet

4
Data flow chart

5
 四、Data packet format

Communication transmission is asynchronous, and the unit is byte.

Total packet length: (10+N) Byte.

Format Length（Byte）
start bit 2
packet length 1
Agreement number 1
information content N
Information serial number 2
error check 2
stop bit 2

4.1. Start bit

Fixed value, uniform hexadecimal 0x78 0x78.

Note: Small number of protocol numbers, beginning with 0x79 0x79

4.2. Packet length

Length = protocol number + information content + information serial number + error

check, a total of (5+N) bytes, because the information content is a variable length

field.

4.3. Agreement number

Description SN
Login package 0x01
Location Data (GPS/LBS combined) 0x12
Location Packet (4G version) 0x22
Status message (heartbeat packet) 0x13
String information (in response to serverside 0x15

6
 instructions)
Alarm information 0x16
Query Address Information (GPS) 0x1A
LBS multi-base station information 0x18
With mileage location data (added ACC, data
0x28
escalation mode)
LBS+WIFI information 0x2C
The IMSI number reports platform information 0x90
ICCID number Reports platform information 0x94
Recording file reports platform information 0x8D
Issue instructions 0x80
4.4. Information content
According to different applications, corresponding to the corresponding "protocol
number", determine the specific content.
4.5. Information serial number
The serial number of the first GPRS data (including status packets and GPS, LBS and
other packets) sent after the boot is' 1 ', and the serial number of each sent data
(including status packets and GPS, LBS packets) is automatically added to 1.
4.6. Error check
The terminal or server can use the verification code to determine whether the
received information is wrong. In order to prevent data from making mistakes in the
transmission process, the error check is added to prevent data misoperation, which
increases the security and efficiency of the system. The error check code adopts
CRCITU check method.
The CRC-ITU value of the data from "packet length" to "Message serial number"
(including "packet length" and "message serial number") in the protocol body.
If there is a CRC error in the calculation of the received information, the
receiver ignores and abandons the packet.
4.7. Stop bit
Fixed value, uniform hexadecimal 0x0D 0x0A.
8
5. The terminal sends data packets to the server
Separately explain common packet sending and server return
5.1. Login Packet (0x01)
5.1.1. Terminal sends packet to server
The login packet is used to confirm to the server that the connection is
established, and submit the terminal ID to the server.

7
 Format Length（Byte） Example
Start bit 2 0x78 0x78
Packet
1 0x0D
Length
Protocol
Login 1 0x01
number
Information Terminal ID 8 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45
Pack
(18 Byte)) Message
serial 2 0x00 0x01
number
Error Check 2 0x8C 0xDD
Stop bit 2 0x0D 0x0A

8
 [Link]. Start bit

See Packet Format 4.1 for details

[Link]. Packet length

See Packet Format 4.2 for details

[Link]. Protocol Number

See Packet Format 4.3 for details

[Link]. Terminal ID

The terminal ID uses a 15-digit IMEI number.

For example: 123456789012345,

The terminal ID is 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45

[Link]. Message Serial number

See Packet Format 4.5 for details

[Link]. Error Checking

See Packet Format 4.6 for details

[Link]. Stop Bits

See Packet Format 4.7 for details

5.1.2. Server Response Packet

Format Length（Byte） Example

Start bit 2 0x78 0x78
Response Packet
Package 1 0x05
Length
(10 Byte)) Protocol
1 0x01
number

9
 Terminal
2 0x00 0x01
ID
Message
serial 2 0XD9 0xDC
number
Error
2 0x0D 0x0A
Check

[Link]. Start bit

See Packet Format 4.1 for details

[Link]. Packet length

See Packet Format 4.2 for details

[Link]. Protocol Number

The protocol number in the response packet is the same as the protocol number of

the packet sent by the terminal

[Link]. Message serial number

See Packet Format 4.5 for details

[Link]. Error Checking

See Packet Format 4.6 for details5.1.2.6. Stop bit

See Packet Format 4.7 for details

0x78 0x78 0x0B 0x01 0x00 0x01 0x14 0x01 0x08 0x09 0x1E 0x0A 0xD9 0xDC 0x0D 0x0A

DateTime

Where: 0x14 0x01 0x08 0x09 0x1E x0A = 20-01-08 [Link]

The time delivered by the platform uses: UTC+0 format

10
1011

5.2. Positioning packet (GPS, LBS merge packet: 0x12)

5.2.1. The terminal sends the location packet to the server

Format Length（Byte） Example

Start bit 2 0x78 0x78

Packet length 1 0x20 1 0x20
Protocol number 1 0x12
Date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
Number of GPS
information 1 0xCB
satellites
GPS Latitude 4 0x02 0x7A 0xCF 0xEB
Information longitude 4 0xCC 0x46 0x58 0x49
information Speed 1 0x10
content Heading, 2 0x15 0x4C
Status
MCC 2 0x01 0xCC
LBS MNC 1 0x00
Information LAC 2 0x28 0x7D
Cell ID 4 0x00 0x1F 0xB8 0x24
SN 2 0x00 0x03
Error Check 2 0x9D 0xDC
End bit 2 0x0D 0x0A

11
 [Link]. Start bit

See Packet Format 4.1 for details

[Link]. Packet Length

See Packet Format 4.2 for details

[Link]. Protocol Number

See Packet Format 4.3 for details

[Link]. Datetime

Format Length（Byte） Example

Year 1 0x16
Month 1 0x01
Day 1 0x1D
Hour 1 0x11
Minute 1 0x0C
Seconds 1 0x10

Such as: [Link] on January 29, 2022

To calculate: 22(base 10)=16 (base 16)
01(base 10)=01 (base 16)
29(base 10)=1D (base 16)
17(base 10)=11 (base 16)
12(base 10)=0C (base 16)
16(base 10)=10 (base 16)
Then the value is: 0x16 0x01 0x1D 0x11 0x0C 0x10
The datetime of the GPS location packet is the time zone set by the corresponding
device
[Link]. Number of satellites involved in positioning
The first 4 bits are the length of GPS information, and the last 4 bits are the
number of satellites on the device. The maximum number of satellites is 15. If the
number exceeds 15, 15 are reported.
Note: The length includes its own 1Byte.
Example: When the value is 0xCB, it means that the length of GPS information is 12,

12
 and the number of satellites involved in positioning is 11.
[Link]. Latitude
Takes 4 bytes and represents the latitude value of the positioning data. The value
ranges from 0 to 162000000, representing the range from 0 degrees to 90 degrees. The
conversion method is as follows:
Convert the longitude and latitude value output by GPS module into decimal units;
Then multiply the converted decimal by 30000, and convert the multiplication result
into a hexadecimal number.
For example, 22º 32.7658 '=(22X60+32.7658)X30000=40582974, and then convert to
hexadecimal number
40582974(base 10)= 26B3F3E (base 16)
The last value is 0x02 0x6B 0x3F 0x3E.
Note: The uploaded latitude and longitude are all positive numbers, take the
absolute value if it is negative
[Link]. Longitude
Takes 4 bytes and represents the longitude value of the positioning data. The value
ranges from 0 to 324000000, representing a range of 0 degrees to 180 degrees.
13
The conversion method is the same as the conversion method for latitude.
[Link]. Speed
Occupies 1 byte, indicating the operating speed of the GPS, the value range is 0x00
~ 0xFF, indicating the range 0 ~ 255 km/h.
For example:
0x00 stands for 0 km/h;
0x10 represents 16 km/h;
0xFF stands for 255 km/h.
[Link]. Status Heading
Take 2 bytes and convert to binary, the first six bits of the first byte represent
the device status, the last two bits and eight bits of the second byte represent the
GPS operating direction, representing the range 0 ~ 360, unit: degrees, with true
north
as 0 degrees, clockwise.
The first six bits of 8-bit binary in the first byte represent the state, and the
following two bits and 8 bits of the second byte, a total of 10 bits of binary,
represent the heading degree.

13
 Bit7 (ACC ON/OFF) Note: The status information in the
data packet is the status at the moment
Bit6 (ACC ON/OFF) recorded by the time bit in the data
GPS packet.
Bit5 Real-time/differential
positioning

BYTE_1 Bit4 GPS positioning or not

_ east longitude, west
Bit3
longitude
Southern latitude,
Bit2
northern latitude
Bit1
Bit0
Bit7
Bit6
Bit5
course
Bit4
B YTE_2
Bit3
Bit2
Bit1
Bit0

For example: the value is 0x15 0x4C, converted to binary is 00010101 01001100,
BYTE_1 Bit7 0 (no definition yet)
BYTE_1 Bit6 0 (ACC OFF)--0: ACC OFF, 1: ACC ON (some projects do not use this
bit)
BYTE_1 Bit5 0 (real-time GPS )——0: real-time GPS, 1: differential positioning
BYTE_1 Bit4 1 ( GPS has been positioned) - 0: GPS has not been positioned, 1:
GPS has been positioned
BYTE_1 Bit3 0 (East longitude)——0: East longitude, 1: West longitude
BYTE_1 Bit2 1 (Northern latitude)——0: South latitude, 1: North latitude
BYTE_1 Bit1 0
BYTE_1 Bit0 1
BYTE_2 Bit7 0
BYTE_2 Bit6 1
BYTE_2 Bit5 0 Heading 332° (0101001100 binary converted to decimal 332)
BYTE_2 Bit4 0
BYTE_2 Bit3 1
BYTE_2 Bit2 1
BYTE_2 Bit1 0
BYTE_2 Bit0 0

14
 It means that the GPS has been positioned, real-time GPS, north latitude, east
longitude, and heading 332°.

[Link]. MCC

The country code of the mobile user is Mobile Country Code(MCC).

For example: China’s mobile country number is 460 (decimal): 0x01 0xCC (convert
decimal 460 to hexadecimal, add 0 to the left if there are less than four digits in
hexadecimal).
The value range here is: 0x0000 ~ 0x03E7.

[Link].MNC

Mobile network numberMobile Network Code(MNC)

For example: China Mobile's is 0x00.

[Link].LAC

Location area code Location Area Code (LAC) included in LAI , consisting of two bytes,
using 16 Base encoding. The available range is 0x0001-0xFFFE, code group 0x0000 and
0xFFFF Not available (see GSM Specification 03.03, 04.08 and 11.11). A location area can
contain one or more cells.

[Link]. Cell ID

Mobile base stationCell Tower ID(Cell ID) , the value range is 0x000000 00 ~ 0xFFFFFFFF,
occupies 4 bytes

[Link]. Message serial number

For details, see Data Packet Format 4.5

[Link]. Error checking

For details, see Data Packet Format 4.6

[Link]. Stop bit

For details, see Data Packet Format 4.7

15
 5.2.2. The terminal sends the mileage positioning data packet to the

server

Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x24 _
Agreement number 1 0x12 _
date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
GPS
information 1 0xC B _
satellite
number
GPS latitude 4 0x02 0x7A 0xCF 0xEB
information
longitude 4 0xCC 0x46 0x58 0x49
speed 1 0x10 _
heading, 2 0x1 5 0x 4C _
information status
MCC 2 0x01 0xCC
LBS MNC 1 0x00 _
information LAC 2 0x28 0x7D
Cell ID 4 0x00 0x1F 0xB8 0x24
mileage 4 0x00 0x 0F 0x42 0x40 _ _ _ _

serial number 2 0x00 0x03

error checking 2 0x9D 0xDC _ _
end bit 2 0x0D 0x0A

Note: Protocol packet length increases by 4 bytes to 0x24

The mileage is 4 bytes in meters, 0x00 0x0F 0x42 0x40, 1,000,000 meters, or 1000

kilometers

5.2.3. Server reply

The server does not need to respond to this message

Note: 0x12 GPS/LBS packet will be saved first when the GSM signal is abnormal, and

16
then uploaded to the platform; The method of supplementary transmission is not real

time upload, but after the device is stationary, the reserved anchor point is uploaded.

The time in the positioning packet shall prevail when the track is played back. When

the positioning packet time is less than 5 minutes of the current time, it should not

be displayed.16

5.3. Location packet (Add ACC and data reporting mode:

0x22)

5.3.1. The terminal sends the location packet to the server

Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x27 _
Agreement number 1 0x22 _
date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
GPS
information
1 0xC B _
satellite
number
GPS latitude 4 0x02 0x7A 0xCF 0xEB
information
longitude 4 0xCC 0x46 0x58 0x49
speed 1 0x10 _
heading,
information 2 0x1 5 0x 4C _
status
MCC 2 0x01 0xCC
LBS MNC 1 0x00 _
information LAC 2 0x28 0x7D
Cell ID 4 0x00 0x1F 0xB8 0x24
A CC status 1 0x00 _
Data reporting mode 1 0x07
GPS real-time
supplementary 1 0x00 _
transmission
total mileage 4 0x00 0x0F 0x42 0x40
Total travel time 4 0x00 0x0F 0x42 0x40

17
 temperature 2 0x8BD1 _ _ _
humidity 2 0x1AF0 _ _
serial number 2 0x00 0x03
error checking 2 0x9D 0xDC _ _
end bit 2 0x0D 0x0A

[Link]. Start bit

See Packet Format 4.1 for details5.3.1.2. Packet Length

See Packet Format 4.2 for details

[Link]. Protocol Number

See Packet Format 4.3 for details

[Link]. Datetime

See Packet Format [Link] for details

[Link]. Number of satellites involved in positioning

See Packet Format [Link] for details

[Link]. Latitude

See Packet Format [Link] for details

[Link]. Longitude

See Packet Format [Link] for details

[Link]. Speed

See Packet Format [Link] for details

[Link]. Status Heading

18
 See Packet Format [Link] for details

[Link].MCC

See Packet Format [Link] for details

[Link].MNC

See Packet Format [Link] for details

[Link].LAC

See Packet Format [Link] for details

[Link].Cell ID

See Packet Format [Link] for details

1718

[Link].ACC

0x00 ACC closes 0x01 ACC opens

[Link]. Data Escalation Mode

0x00: Regular reporting

0x01: Fixed interval reporting
0x02: Inflection point upload
0x03: ACC status change upload

Data 0x04: After changing from motion to static state, the last
reporting type positioning point is transmitted.
0x05: After the network is disconnected and reconnected, the
last valid upload point before reporting
0x06: Reporting mode: Mandatory upload of GPS points for
ephemeris update
0x07: Reporting mode: press the button to upload the anchor
point

19
 0x08: Reporting mode: report location information after power
on
0x09: Reporting mode: not used
0x 0A : Reporting mode: the device reports the last longitude
and latitude after being stationary, but the time is updated
0x 0B : WIFI parsing longitude and latitude upload package
0x 0C : Reporting mode: LJDW (immediate positioning) command
reporting
0x 0D : Reporting mode: report the last longitude and latitude
after the device is stationary
0x 0E : Reporting mode: GPSDUP upload (scheduled upload in
static state)

[Link]. GPS real-time retransmission

0x00 Real-time Upload 0x01 Repass

[Link]. Total Mileage

Mileage data is 4 bytes in meters, e.g. 0x00 0x0F 0x42 0x40 (1,000,000 meters, i.e.

1000 km)

[Link]. Total travel time

Total travel time accounts for 4 bytes in seconds, e.g. 0x00 0x0F 0x42 0x40 (1,000,000

seconds)[Link]. Temperature

Temperature unit: Celsius

Conversion method: bit15 is the temperature symbol (0: + 1: -)

bit0-bit14 is the temperature value (100 times the true value,0x8BD1: -

30.25 degrees Celsius)

[Link]. Humidity

20
Humidity unit: percent relative humidity (%RH). The range is 0-100

Conversion Method: 100 times the true value, such as 0x1AF0:68.96%

[Link]. Information serial number

See Packet Format 4.7 for details

[Link]. Error Checking

See Packet Format 4.7 for details

[Link]. Stop Bits

See Packet Format 4.6 for details

5.3.2. Server reply

The server does not need to respond to this message

Note: 0x28 When the GSM signal is abnormal, the packet will be saved first and then

uploaded to the platform; The method of supplementary transmission is not real-time

upload, but after the device is stationary, the reserved anchor point is uploaded. The

time in the positioning packet shall prevail when the track is played back. When the

positioning packet time is less than 5 minutes of the current time, it should not be

displayed.

1920

5.4. Heartbeat Packet (0x13)

21
The heartbeat packet is the packet that maintains the connection between the

terminal and the server

5.4.1. The terminal sends heartbeat packets to the server

Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x0A _
Agreement number 1 0x13 _
Terminal
1 0x4E _
information
Voltage level 1 0x06 _
status
information GSM signal
information 1 0x64 _
strength
external voltage 1 0x0C _
language 1 0x02 _
serial number 2 0x00 0x03
error checking 2 0xFF 0x4F
end bit 2 0x0D 0x0A

[Link]. start bit

For details, see Data Packet Format 4.1

[Link]. Packet length

For details, see Data Packet Format 4.2

[Link]. Protocol number

For details, see Data Packet Format 4.3

[Link]. Terminal information

It occupies 1 byte and is converted into binary to represent the status information of
the terminal. One byte is regarded as 8 bits, the lowest bit is 0 bits, and the highest
bit is 7 bits. When transmitting, the high bit is transmitted first, and then the low
bit is transmitted. The specific meanings of each representative are as follows:

Bit Code meaning

22
 1: Oil and
electricity
disconnected
Bit 7
0: oil and
electricity
connected
1: GPS has
positioned
Bit 6
0: GPS not
positioned
111: Door open
alarm
110: Door closing
alarm
100: SOS alarm
Bit 5- 011: Low battery
BYTE Bit 3 alarm
010: Power failure
alarm
001: Vibration
alarm
000: normal
1: Connected to
external power
supply
Bit 2
0: No external
power supply
connected
1:ACC ON
Bit 1
0:ACC O F
1: Fortification
Bit0
0: Disarm

Example: 0x4E, the corresponding binary is 01001110

Indicates that it is in the disarmed state, ACC ON, external power supply connected,
vibration alarm, GPS positioned, and oil and electricity connected.

[Link]. Voltage level

There are a total of 7 voltage levels, ranging from 0-6, indicating the voltage from
low to high.
0: No power (power off);
1: The battery status is not enough to make calls, send text messages, etc.;
2: Low battery;
3-6: All can be used normally, but they are arranged according to the amount of
electricity.

[Link] . GSM signal strength

Range of GSM information: 0-100; converted to decimal, the larger the value, the

23
stronger the GSM signal
0: Indicates no signal
100: full signal

[Link]. External voltage + language

Example: The external power supply voltage is 30 volts (30V), and the current
language bit of the terminal is:
Chinese:0x1E 0x01;
English:0x1E 0x02;

Operating mode:
0x 00= smart sleep mode;
0x 01= normal mode;
0x 02= deep sleep mode;
0x 03= Timed return mode;
0x04 = Remote power on/off mode;
Device sleep state:
When the device is working normally, it is 0x 00 ;
When the device sleeps, the device sleep status bits are consistent with the working
mode bits. For example, in deep sleep mode, the reserved extension bits when the device
sleeps are 0x02 0x02 .

[Link] . Message serial number

For details, see Data Packet Format 4.5

5.4.1. 9. Error checking

For details, see Data Packet Format 4.6

[Link] 0. Stop bit

For details, see Data Packet Format 4.7

5.4. 2. The server responds with a heartbeat packet

Format Length(Byte) Example

24
 start bit 2 0x78 0x78

Packet
1 0x05
length

Agreement
1 0x13
number
information
information
2 0x00 0x01
sequence

error
2 0xE9 0xF1
checking

Stop bit 2 0x0D 0x0A

After receiving the data packet from the terminal, the server responds with an empty
data packet.
Note: The "information sequence number" in the data packet must be consistent with
the "information sequence number" sent by the responding terminal.

5.4.2.1Start bit

For details, see Data Packet Format 4.1

[Link] Packet length

For details, see Data Packet Format 4.2

[Link] Agreement number

25
For details, see Data Packet Format 4.3

[Link] Information serial number

For details, see Data Packet Format 4.5

[Link] Error checking

For details, see Data Packet Format 4.6

[Link] Stop bit

For details, see Data Packet Format 4.7

26
 [Link] package ( 0x16 )
5.5.1. The terminal sends an alarm data packet to the server
Format Length(Byte) Example

start bit 2 0x78 0x78

Packet length 1 0x26 _
Agreement number 1 0x1 6 _
date time 6 0x13 0x08 0x1D 0x11 0x0C 0x10
GPS
information
1 0xC B _
satellite
number
GPS latitude 4 0x02 0x7A 0xCF 0xEB
information
longitude 4 0xCC 0x46 0x58 0x49
speed 1 0x10 _
heading,
2 0x1 5 0x 4C _
status
LBS length 1 0x0A _
MCC 2 0x01 0xCC
information LBS
information MNC 1 0x00 _
LAC 2 0x28 0x7D
Cell ID 4 0x00 0x1F 0xB8 0x24
Terminal
1 0x4E _
information
Voltage level 1 0x04 _
status GSM signal
1 0x64 _
information strength
Call the police 1 0x00 _
language 1 0x 02
serial number 2 0x00 0x03
error checking 2 0x8C 0x59
end bit 2 0x0D 0x0A

[Link] Start bit

For details, see Data Packet Format 4.1

[Link] Packet length

For details, see Data Packet Format 4.2

27
 [Link] Protocol number

For details, see Data Packet Format 4.3

[Link] Date and time

For details, see Data Packet Format [Link]

[Link] Number of GPS satellites

For details, see Data Packet Format [Link]

[Link] Latitude

For details, see Data Packet Format [Link]

[Link] Longitude

For details, see Data Packet Format [Link]

[Link] Speed

For details, see Data Packet Format [Link]

[Link] Course and status

For details, see Data Packet Format [Link]

[Link] LBS length

The length of the LBS information content, the length is fixed: 0x 0A

[Link] MCC

For details, see Data Packet Format [Link]

28
 [Link] MNC

For details, see Data Packet Format [Link]

[Link] LAC

For details, see Data Packet Format [Link]

[Link] Cell ID

For details, see Data Packet Format [Link]

[Link] Terminal information

For details, see Data Packet Format [Link]

[Link] Battery voltage level

For details, see Data Packet Format [Link]

[Link] GSM signal strength

For details, see Data Packet Format [Link]

[Link] Alarm type

0x00: normal

0x01: SOS alarm

alarm type
0x02: Power failure alarm

0x03: Vibration alarm

29
0x04: Alarm when entering

the fence

0x05: Alarm when exiting the

fence

0x06: Speeding alarm

0x07: High temperature

alarm

0x08: Low temperature alarm

0x09: Displacement alarm

0x13: Anti-tamper alarm

(light sensor alarm)

0x26: Rapid acceleration

alarm

0x27: Rapid deceleration

alarm

0x28: Sharp turn alarm

0x29: Collision alarm

30
 0x0E: Low battery alarm

0xFA: Door closed alarm

0xFB: Alarm when the door is

opened

0xFC: AC off alarm

0xFD: AC turns on alarm

0xFE: ACC ignition alarm

0xFF: ACC flameout alarm

[Link] Language

Simplified Chinese: 0x01

English: 0x02

[Link] Information serial number

For details, see Data Packet Format 4.5

[Link] Error checking

For details, see Data Packet Format 4.6

[Link] Stop bit

31
For details, see Data Packet Format 4.7

5.5.2. The server sends an alarm packet reply to the terminal

Format Length(Byte) Example
information start bit 2 0x78 0x78

Packet length 1 0x 05

Agreement number 1 0x16 _

information
2 0x 00 0x 05
sequence
error checking 2 0x 96 0x 68

Stop bit 2 0x 0D 0x 0A

[Link] Start bit

For details, see Data Packet Format 4.1
[Link] Packet length
For details, see Data Packet Format 4.2
[Link] Protocol number
For details, see Data Packet Format 4.3
[Link] Information serial number
For details, see Data Packet Format 4.5
[Link] Error checking
For details, see Data Packet Format 4.6
[Link] Stop bit
For details, see Data Packet Format 4.7

5.6. Query address (0x1A )

5.6.1 The terminal sends a query address packet to the server

32
 Length(Byt
Format Example
e)
start bit 2 0x78 0x78
Packet length 1 0x2E _ _
Agreement number 1 0x1A
date time 6 0x13 0x01 0x08 0x09 0x1E 0x0A
GPS information
1 0xCD
GPS satellite number
informat longitude 4 0x02 0x6B 0x3F 0x3E
in ion latitude 4 0x0C 0x45 0x49 0x53
fo
rm speed 1 0x00
at heading, bearing 2 0x14 0x8F
io
n 0x31 0x33 0x38 0x30 0x30 0x31 0x39
telephon
telephone number twenty one 0x39 0x38 0x38 0x35 0x20 0x20 0x20
e number
0x20 0x20 0x20 0x20 0x20 0x20 0x20
language reserved 1 0x00
status language 1 0x02
information sequence 2 0x00 0x06
error checking 2 0x29 0xD1
Stop bit 2 0x0D 0x0A

[Link] Start bit

For details, see Data Packet Format 4.1

[Link] Packet length

For details, see Data Packet Format 4.2

[Link] Protocol number

For details, see Data Packet Format 4.3

[Link] Date and time

For details, see Data Packet Format [Link]

[Link] Number of GPS satellites

33
For details, see Data Packet Format [Link]

[Link] Latitude

For details, see Data Packet Format [Link]

[Link] Longitude

For details, see Data Packet Format [Link]

[Link] Speed

For details, see Data Packet Format [Link]

[Link] Course and status

For details, see Data Packet Format [Link]

[Link] Telephone number

The phone number is 21 digits, and any less than 21 digits must be filled with spaces,

that is: 0x20

For example: 13800138000, the device reports: 0x31 0x33 0x38 0x30 0x30 0x31 0x33 0x38

0x30 0x30 0x30 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20

[Link] Reserve + Language

Chinese: 0x00 0x01

English: 0x00 0x02

5.6. 1.12 Information serial number

For details, see Data Packet Format 4.5

5.6. 1.13 Error Checking

For details, see Data Packet Format 4.6

5.6. 1.14 stop bit

34
For details, see Data Packet Format 4.7

5.7. LBS+WIFI information ( 0x2C )

Format Length(Byte) illustrate

start bit 2 0x78 0x78

Length = protocol number + message content

Packet length 1 + message sequence number + error check

Agreement number 1 0x2C

Year, month, day, hour, minute and second

date time 6 (converted to decimal)

MCC 2 Mobile Country Code

information

MNC 1 Mobile Network Code (MNC)

LAC 2 Mobile Network Code (MNC)

4g mobile base station Cell Tower ID (Cell

CI 4 ID)

Cell signal strength, the value range is

RSSI 1 0x00~0xFF, 0x00 has the weakest signal, and
0xFF has the strongest signal.

NLAC1 2 Same as LAC

NCI1 3 Same as CI

NRSSI1 1 Same as above RSSI

NLAC2 2 Same as LAC

35
 NCI2 3 Same as CI

NRSSI2 1 Same as above RSSI

NLAC3 2 Same as LAC

NCI3 3 Same as CI

NRSSI3 1 Same as above RSSI

NLAC4 2 Same as LAC

NCI4 3 Same as CI

NRSSI4 1 Same as above RSSI

NLAC5 2 Same as LAC

NCI5 3 Same as CI

NRSSI5 1 Same as above RSSI

NLAC6 2 Same as LAC

NCI6 3 Same as CI

NRSSI6 1 Same as above RSSI

It refers to the difference between the

actual time when the mobile station signal
time advance 1 reaches the base station and the time when
the mobile station signal reaches the base
station assuming that the distance between

36
 the mobile station and the base station is
0.
Used to determine the number of WIFI
WiFi quantity 1 transmitted in the package, 0 means no WIFI
is detected
Received signal 1WIFI MAC (transmit
according to the actual number of searched
WIFIs, if one is found, one is transmitted,
WIFIMAC1 6 if many are found, multiple are
transmitted, if no transmission is found,
it is 0)

WIFI strength 1 1 Signal 1WIFI signal strength

WIFIMAC2 6 Same as above

WIFI strength 2 1 Same as above

… …

After powering on, the serial number is

information
2 automatically incremented by 1 each time
sequence
data is sent.

CRC-ITU value from "Packet Length" to

Check Digit 2 "Message Sequence Number".

Stop bit 2 Fixed value: 0x0D 0x0A

The base station information is fixed at 7, and 0x00 is added for any shortage. The WIFI

information is reported according to the actual number, with a maximum of 8.

For example, the device reports server-side WIFI positioning data:

78786b 2c

110b1709362501cc00287200101a3f28720010193f2872000df3282872000df419000000000000000000

00000000000000000000007e4a1e6

37
5384bf4af49eef65772b4c34967204ebbf53bc46996697f853f0fe6b5d752c5424050f247e205ab0d59d

0efdd15c000450f80d0a

The platform does not need to reply to this information

5.8. The terminal sends the IMSI number to the server

( 0x90 )
Format Length(Byte) describe

start bit 2 0x78 0x78

0 x 1A, length = protocol number +
Packet length 1
information content + error check
Agreement number 1 0x90 _
Character
5 Fixed characters (IMSI :)
IMSI
I MSI The device uses the IMSI number of
information 15
IMSI number the SIM card
information reserved
2 Fixed value: 0x 01 0x01
seat
Fixed
1 Fixed value: 0 x 9F
characters
CRC-ITU value from "Packet Length"
error checking 2
to "Message Sequence Number"
end bit 2 0x0D 0x0A

For example: The device sends IMSI to the server:

78781A90494D53493A34363030 343030333039303336303001019F6BF90D0A
Note: Every time the device is powered on or restarted, the IMSI information of the
device will be reported once after the first heartbeat packet. The server does not need
to respond to this packet.

5.9. The terminal sends the ICCID number to the server

(0x94 )
Length
Format describe
(Byte)
i start bit 2 Fixed value: 0x 7 9 0x7 9
n Packet 0 x2 0, length = protocol number + message content + message
f 2
length sequence number + error check
o Agreement
r 1 Fixed value: 0x9 4
number

38
m 00: External voltage
a D 01~03: (customized)
t a 04: Terminal status synchronization
i t Informat 1 05: Door status
o a ion type 08: Self-test parameters
n c 09: Positioning satellite information
o 0A: ICCID information
n ...to be added
t Data Depending on the type of information, the content is also
content N different. See the table below for details of 0A.
e
n Example: ICCID number is 12345123456789123456, then the
t ICCID 10 terminal ID is: 0x12 0x34 0x51 0x23 0x45 0x97 0x89 0x12 0x34
0x56
Information
After turning on the phone, every time you send data, it will
serial 2
automatically +1
number
error CRC-ITU value from "Packet Length" to "Message Sequence
2
checking Number"
end bit 2 0x0D 0x0A

When the type is 0A, ICCID information is also transmitted,

and the transmission is hexadecimal.
For example: IMEI number is 123456789123456, then the
IMEI 8 terminal ID is: 0x01 0x23 0x45 0x67 0x89 0x12 0x34 0x56

For example: IMSI number is 123456789123456, then the

IMSI 8 terminal ID is: 0x01 0x23 0x45 0x67 0x89 0x12 0x34 0x56

For example: ICCID number is 12345123456789123456, then the

ICCID 10 terminal ID is: 0x12 0x34 0x51 0x23 0x45 0x97 0x89 0x12 0x34
0x56

Example of device uploading ICCID number:

79790020940a03580910880015580460041990205313898607b91117301203130009a0720d0a
7979 0020 94 0a 0358091088001558 0460041990205313
Starting bit length Protocol number type IMEI number IMSI number
898607b9111730120313 0009 a072 0d0a
ICCID number information sequence error check stop bit

Note: In this protocol, the server does not need to reply

5.10. Recording protocol package ( 0x8D )

After the device records, it sends the recording package to the server. It is suitable
for S 709, S 11, S11C, and W15L devices.

39
 5.10.1. The terminal sends a data packet to the server:
Format Length(Byte) describe

start bit 2 Fixed value: 0x 7 9 0x7 9

Length = protocol number + message
Packet length 2 content + message sequence number +
error check
Agreement number 1 Fixed value: 0 x 8D
file type 1 Fixed value: 0x 00
Total file
4 Total length of transferred files
length
Total number How many packages are the total
1
of files number of files to be transferred?
Recording File current
content Transfer the current packet
information package 1
sequence of the file
sequence
Current The data length after the
content 2 transmission split from the
length beginning to the end
Data content M Split packet content
After turning on the phone, every
Information serial
2 time you send data, it will
number
automatically +1
CRC from "packet length" to
error checking 2 "message sequence number" - ITU
value
end bit 2 0x0D 0x0A

5.10.2. The server responds to the terminal:

Format Length(Byte) describe

start bit 2 Fixed value: 0x 7 9 0x7 9

Packet length 2 Length = protocol number + message content
+ message sequence number + error check
Agreement 1 Fixed value: 0 x 8D
number
information receive status 1 0x00: normal reception 0x01: reception
flag error
Information 2 After turning on the phone, every time you
serial number send data, it will automatically +1
error checking 2 CRC from "packet length" to "message
sequence number" - ITU value
end bit 2 0x0D 0x0A
Each time the device sends a recording file packet, it needs to receive a response
from the server before it can continue to send the next data packet. If it sends the same
packet three times in a row without receiving a response, it will give up sending the
recording file.

40
 6. The server sends data packets to the terminal

6. 1. Server sends command ( 0x80 )

Format Length(Byte)
start bit 2
Packet length 1
Agreement number 1
Instruction 1
length
information server flag 4
Command N
content
Information serial number 2
error checking 2
Stop bit 2

6.1.1. start bit

For details, see Data Packet Format 4.1

6.1.2. Packet length

For details, see Data Packet Format 4.2

6.1.3. Agreement number

Fixed value: 0x80

6.1.4. Instruction length

Instruction length = Server flag+ Command content length
For example: in byte length, 0x0A means that the instruction content occupies 10 bytes

6.1.5. Server flags

It is left for server identification, and the terminal returns the received data
binary in the return packet as it is.

41
 6.1.6. Instruction content
Represented by ASCⅡ of string, the command content is compatible with SMS commands

6.1.7. Message serial number

For details, see Data Packet Format 4.5

6.1.8. Error checking

For details, see Data Packet Format 4.6

6.1.9. Stop bit

For details, see Data Packet Format 4.7

6.2 . Terminal returns data packet ( 0x15 )

Format Length(Byte)
start bit 2
Packet length 1
Agreement number 1
Instruction
1
length
server flag 4
information
Command N
content
language 2
Information serial number 2
error checking 2
Stop bit 2

6.2.1. Start bit

For details, see Data Packet Format 4.1

6.2.2. Packet length

For details, see Data Packet Format 4.2

6.2.3. Agreement number

The terminal responds to the command sent by the server. The data packet format is
consistent with the "command sent by the server to the terminal" format, but the protocol
number is different, using 0x15.

42
 6.2.4. Instruction length
Instruction length = Server flag+ Command content length
For example: in byte length, 0x0A means that the instruction content occupies 10 bytes

6.2.5. Server flag bit

The terminal returns the binary data received as it is in the return packet.

6.2.6. Instruction content

ASCII representation of string

[Link] _ _
The language used by the terminal
Chinese: 0x00 0x01
English: 0x00 0x02

6.2.8 . Message serial number

For details, see Data Packet Format 4.5

6.2. 9. Error checking

For details, see Data Packet Format 4.6

6.2. 10. Stop bit

For details, see Data Packet Format 4.7

6.2.11 . Server command issuance example

[Link] Cut off oil and electricity

SMS command format:

RELAY,1#

DYD,000000#

Function description: Cut off the vehicle’s oil and electricity control circuit

returned messages:

43
1. Successful return: DYD=Success!

2. Return on failure: DYD=Unvalued Fix!

Or DYD=Speed Limit, Speed 40km/h

For example: issued by the platform: 78 78 15 80 0F 00 01 A9 58 44 59 44 2C 30 30 30 30

30 30 23 00 A0 DC F1 0D 0A

Bold part: DYD,000000#

Device response: 78 78 18 15 10 00 01 A9 58 44 59 44 3D 53 75 63 63 65 73 73 21 00 02

00 18 91 77 0D 0A

Bold part: DYS=Success!

[Link] Restoration of oil and electricity

SMS command format:

HFYD,000000#

Function description: Connect the vehicle’s oil and electricity control circuit

returned messages:

1. Successful return: HFYD=Success!

2. Return on failure: HFYD=Fail!

Platform delivery and device reply are similar to DYD

[Link] View location

Instruction format:

DWXX,000000#

44
Function description:

Get positioning information instructions. Both mobile phone users and SMS servers can

obtain positioning information through this command.

returned messages:

1、 Return successfully:

DWXX=Lat:< South / North Latitude > ,Lon:< East / West Longitude >,Course:<Angle> ,

Speed:<Speed> , DateTime: <Time>

2. Failure returns: DWXX=Command Error!

For example:

Lat:N23d5.1708m,Lon:E114d23.6212m,Course:120,Speed:53.02;DateTime:08-09-12 [Link]

The meaning is: 23 degrees 5.1708 minutes north latitude, 114 degrees 23.6212 minutes

east longitude, angle: 120 degrees, speed: 53.02 kilometers/hour, time and date: [Link]

on September 12, 2008.

Note: If the terminal is not positioned successfully, it will return: Lat:,Lon:,

Course:,Speed:,DateTime:-:

The platform delivery and device reply formats are similar to DYD

45
 7. Attached is the AAU CRC-ITU table lookup algorithm CC

language code snippet

// CRC-ITU table lookup algorithm C language code snippet
static const U16 crctab16[] =
{
0X0000, 0X1189, 0X2312, 0X329B, 0X4624, 0X57AD, 0X6536, 0X74BF,
0X8C48, 0X9DC1, 0XAF5A, 0XBED3, 0XCA6C, 0XDBE5, 0XE97E, 0XF8F7,
0X1081, 0X0108, 0X3393, 0X221A, 0X56A5, 0X472C, 0X75B7, 0X643E,
0X9CC9, 0X8D40, 0XBFDB, 0XAE52, 0XDAED, 0XCB64, 0XF9FF, 0XE876,
0X2102, 0X308B, 0X0210, 0X1399, 0X6726, 0X76AF, 0X4434, 0X55BD,
0XAD4A, 0XBCC3, 0X8E58, 0X9FD1, 0XEB6E, 0XFAE7, 0XC87C, 0XD9F5,
0X3183, 0X200A, 0X1291, 0X0318, 0X77A7, 0X662E, 0X54B5, 0X453C,
0XBDCB, 0XAC42, 0X9ED9, 0X8F50, 0XFBEF, 0XEA66, 0XD8FD, 0XC974,
0X4204, 0X538D, 0X6116, 0X709F, 0X0420, 0X15A9, 0X2732, 0X36BB,
0XCE4C, 0XDFC5, 0XED5E, 0XFCD7, 0X8868, 0X99E1, 0XAB7A, 0XBAF3,
0X5285, 0X430C, 0X7197, 0X601E, 0X14A1, 0X0528, 0X37B3, 0X263A,
0XDECD, 0XCF44, 0XFDDF, 0XEC56, 0X98E9, 0X8960, 0XBBFB, 0XAA72,
0X6306, 0X728F, 0X4014, 0X519D, 0X2522, 0X34AB, 0X0630, 0X17B9,
0XEF4E, 0XFEC7, 0XCC5C, 0XDDD5, 0XA96A, 0XB8E3, 0X8A78, 0X9BF1,
0X7387, 0X620E, 0X5095, 0X411C, 0X35A3, 0X242A, 0X16B1, 0X0738,
0XFFCF, 0XEE46, 0XDCDD, 0XCD54, 0XB9EB, 0XA862, 0X9AF9, 0X8B70,
0X8408, 0X9581, 0XA71A, 0XB693, 0XC22C, 0XD3A5, 0XE13E, 0XF0B7,
0X0840, 0X19C9, 0X2B52, 0X3ADB, 0X4E64, 0X5FED, 0X6D76, 0X7CFF,
0X9489, 0X8500, 0XB79B, 0XA612, 0XD2AD, 0XC324, 0XF1BF, 0XE036,
0X18C1, 0X0948, 0X3BD3, 0X2A5A, 0X5EE5, 0X4F6C, 0X7DF7, 0X6C7E,
0XA50A, 0XB483, 0X8618, 0X9791, 0XE32E, 0XF2A7, 0XC03C, 0XD1B5,
0X2942, 0X38CB, 0X0A50, 0X1BD9, 0X6F66, 0X7EEF, 0X4C74, 0X5DFD,
0XB58B, 0XA402, 0X9699, 0X8710, 0XF3AF, 0XE226, 0XD0BD, 0XC134,
0X39C3, 0X284A, 0X1AD1, 0X0B58, 0X7FE7, 0X6E6E, 0X5CF5, 0X4D7C,
0XC60C, 0XD785, 0XE51E, 0XF497, 0X8028, 0X91A1, 0XA33A, 0XB2B3,
0X4A44, 0X5BCD, 0X6956, 0X78DF, 0X0C60, 0X1DE9, 0X2F72, 0X3EFB,
0XD68D, 0XC704, 0XF59F, 0XE416, 0X90A9, 0X8120, 0XB3BB, 0XA232,
0X5AC5, 0X4B4C, 0X79D7, 0X685E, 0X1CE1, 0X0D68, 0X3FF3, 0X2E7A,
0XE70E, 0XF687, 0XC41C, 0XD595, 0XA12A, 0XB0A3, 0X8238, 0X93B1,
0X6B46, 0X7ACF, 0X4854, 0X59DD, 0X2D62, 0X3CEB, 0X0E70, 0X1FF9,
0XF78F, 0XE606, 0XD49D, 0XC514, 0XB1AB, 0XA022, 0X92B9, 0X8330,
0X7BC7, 0X6A4E, 0X58D5, 0X495C, 0X3DE3, 0X2C6A, 0X1EF1, 0X0F78,
};

46
// Calculate 16-bit CRC of data of given length
U16 GetCrc16(const U8* pData, int nLength)
{
U16 fcs = 0xffff; // initialization
while(nLength>0){
fcs = (fcs >> 8) ^ crctab16[(fcs ^ *pData) & 0xff];
nLength--;
pData++;
}
return ~fcs; // Negation
}

47