TR02 - GPS Tracker Communication Protocol - v3.1
TR02 - GPS Tracker Communication Protocol - v3.1
com
GPS Tracker
Communication Protocol
(TR02)
Copyright
This document is copyrighted by Shenzhen Concox Information Technology Co.,Ltd. All rights reserved.
Any unauthorized copy or transmission of the document partially or wholly shall be subject to prosecution.
www.iconcox.com
Content
1.COMMUNICATION PROTOCOL ........................................................................ 2
1.1 INTRODUCTION ........................................................................................................................ 2
1.2 NETWORK CONNECTION .......................................................................................................... 2
-1-
www.iconcox.com
1.Communication Protocol
1.1 Introduction
This document defines instructions about interface protocol on application layer of
vehicles GPS tracker and location-based service platform. Related interface protocol
only applies in the interaction between the platform and the position terminal.
2.Terms, definitions
Terms, Abbreviation
CMPP
GPS
GSM
GPRS
TCP
LBS
IMEI
MCC
MNC
LAC
CI
RSSI
UDP
SOS
CRC
NITZ
GIS
Definition in English
China Mobile Peer to Peer
Global Positioning System
Global System for Mobile Communication
General Packet Radio Service
Transport Control Protocol
Location Based Services
International Mobile Equipment Identity
Mobile Country Code
Mobile Network Code
Location Area Code
Cell ID
Received Signal Strength Indicator
User Datagram Protocol
Save Our Ship/Save Our Souls
Cyclic Redundancy Check
Network Identity and Time Zone
Geographic Information System
Definition in Chinese
3.Basic rules
1)
2)
If a GPRS connection is established successfully, the terminal will send a first login
message packet to the server and, within five seconds, if the terminal receives a data
packet responded by the server, the connection is considered to be a normal
connection. The terminal will begin to send location information (i.e., GPS, LBS
information package). A status information package will be sent by the terminal after
three minutes to regularly confirm the connection.
If the GPRS connection is established unsuccessfully, the terminal will not be able to
send the login message packet. The terminal will start schedule reboot in twenty
minutes if the GPRS connection is failed three times. Within twenty minutes, if the
terminal successfully connects to the server and receives the data packet from the
-2-
www.iconcox.com
3)
4)
5)
6)
7)
server as the servers response to the login message packet sent by the terminal, the
schedule reboot will be off and the terminal will not be rebooted; otherwise, the
terminal will be rebooted automatically in twenty minutes.
After receiving the login message packet, the server will return a response data packet.
If the terminal doesnt receive packet from the server within five seconds after
sending the login message packet or the status information package, the current
connection is regarded as an abnormal connection. The terminal will start a
retransmission function for GPS tracking data, which will cause the terminal to
disconnect the current GPRS connection and rebuild a new GPRS connection.
If the connection is regarded to be abnormal, and the data packet as a response from
the server is failed to be received three times after a connection is established and a
login message packet or status information package is sent, the terminal will start
schedule reboot and the scheduled time is ten minutes. Within ten minutes, if the
terminal successfully connects to the server and receives the data packet responded by
the server, the schedule reboot will be off and the terminal will not be rebooted;
otherwise, the terminal will be rebooted automatically in ten minutes.
In case of the normal connection, the terminal will send a combined information
package of GPS and LBS to the server after the GPS information is changed; and the
server may set a default protocol for transmission by using commands.
To ensure the effectiveness of the connection, the terminal will send status
information to the server at regular intervals, and the server will return response data
packets to confirm the connection.
For the terminal which doesnt register an IMEI number, the server will reply the
terminal with a login request response and heartbeat packet response, rather than
directly disconnect the connection. (If the connection is directly disconnected or the
server doesnt reply to the terminal, it will lead to a continuous reconnected by the
terminal and the GPRS traffic will be consumed heavily.
-3-
www.iconcox.com
Protocol number
Start bit
0x00
0x78 0x78
0x10
0x68 0x68
0x1A
0x54 0x68
Heartbeat packet
0x1A
0x68 0x68
0x17
0x78 0x78
0x97
0x78 0x78
0x1B
0x68 0x68
0x1C
0x88 0x88
0x1C
0x68 0x68
-4-
www.iconcox.com
GPS
Format
Length(Byte)
Start Bit
Packet Length
LAC
Terminal ID
Protocol Number
Date Time
Latitude
Longitude
Information
Speed
content
Course
MNC
Cell ID
Status bit
data packet
42
Byte
Stop Bit
1Start bit
2
2Packet length
The total byte from LAC to information content, and the default is 37 bytes.
3LAC
Location Area Code (LAC) included in LAI consists of two bytes and is encoded in
hexadecimal. The available range is 0x0001-0xFFFE, and the code group 0x0000 and 0xFFFF
cannot be used. (see GSM specification 03.03, 04.08 and 11.11).
4Terminal ID
The terminal ID applies IMEI number of 15 bits.
Example: if the IMEI is 123456789012345,
the terminal ID is 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45.
www.iconcox.com
6Protocol Number
The protocol number is 0x10.
7Date& time
Format
Length(Byte)
Example
Year
0x0A
Month
0x03
Day
0x17
Hour
0x0F
Minute
0x32
Second
0x17
8Latitude
Four bytes are consumed, defining the latitude value of location data. The range of the
value is 0-162000000, indicating a range of 0-90. The conversion method thereof is as follow:
Converting the value of latitude and longitude output by GPS module into a decimal based
on minute; multiplying the converted decimal by 30000; and converting the multiplied
result into hexadecimal
Example: 2232.7658=(22X60+32.7658)X3000=40582974, then converted into a
hexadecimal number
40582974(Decimal)= 26B3F3E(Hexadecimal)
at last the value is 0x02 0x6B 0x3F 0x3E.
9Longitude
Four bytes are consumed, defining the longitude value of location data. The range of the
value is 0-324000000, indicating a range of 0-180.
The conversion method herein is same to the method mentioned in Latitude (see section
5.2.1.6).
10Speed
One byte is consumed, defining the running Speed of GPS. The value ranges from 0x00 to
0xFF indicating a range from 0 to 225km/h.
-6-
www.iconcox.com
e.g.
11Course
Two bytes are consumed, defining the running direction of GPS. The value ranges from 0
to 360measured clockwise from north of 0.
Bit7
Bit6
Bit5
Bit4
Bit3
Bit2
BYTE_1
Bit1
Bit0
Bit7
Bit6
Bit5
Course
Bit4
BYTE_2
Bit3
Bit2
Bit1
Bit0
Note: The status information in the data packet is the status corresponding to the time bit
recorded in the data packet.
For example: the value is 0x15 0x4C, the corresponding binary is 00010101 01001100,
BYTE_1 Bit7
0
BYTE_1 Bit6
0
BYTE_1 Bit5
0
BYTE_1 Bit4
0
BYTE_1 Bit3
0
BYTE_1 Bit2
0
BYTE_1 Bit1
0
BYTE_1 Bit0
1
BYTE_2 Bit7
0
BYTE_2 Bit7
1
BYTE_2 Bit7
0
Course 332(0101001100 in Binary, or 332 in decimal)
BYTE_2 Bit7
0
BYTE_2 Bit7
1
BYTE_2 Bit7
1
-7-
www.iconcox.com
BYTE_2 Bit7
BYTE_2 Bit7
0
0
12MNC
Mobile Network Code(MNC)
Example: Chinese MNC is 0x00.
13Cell ID
Cell Tower ID(Cell ID)which value ranges from 0x000000 to 0xFFFFFF.
14Status
4 byte is consumed defining for various status information of the mobile phone.
Regards 4 bytes as 32 bits, the lowest bit is 0 while the highest is 31. In the process of data
transmission, the higher one will be transmitted first.
Currently only the lowest three bits are used, which indicates whether GPS is located,
south/ north latitude, and east/ west longitude
Byte
Bit
Code Meaning
Bit7
Bit6
Bit5
BYTE_1~BY
Bit4
TE3
Bit3
Bit2
Bit1
Bit0
Bit7
Bit6
Bit5
Bit4
Bit3
Bit2
Bit1
Bit0
BYTE_0
15Stop Bit
Fixed value: 0x0D 0x0A
Format
Length (Byte)
-8-
www.iconcox.com
packet from
Start Bit
terminal to the
Packet Length
server
Voltage Level
20+N
Byte
Terminal ID
Serial Number
Protocol Number
Positioning state
quantity of positioning
satellites
1
1
Information
content
SNR of
3
Satellite
N
2
Stop Bit
2Packet Length
The number of bytes from voltage level to SNR of satellite.
The total length is 15+N, in which N indicates the number of satellite.
3Voltage level
The range is 0~6 defining the voltage is from low to high.
0: No Power (shutdown)
1: Extremely Low Battery (not enough for calling or sending text messages, etc.)
2: Very Low Battery (Low Battery Alarm)
3: Low Battery (can be used normally)
4: Medium
5: High
6: Very High
www.iconcox.com
5Terminal ID
The terminal ID applies IMEI number of 15 bits.
Example: if the IMEI is 123456789012345,
the terminal ID is 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45.
6Serial Number
The serial number of the first GPRS data (including GPS data packet, heartbeat packet,
command packet) sent after booting is 1, and the serial number of data sent later at each
time will be automatically added 1.
7Protocol Number
0x1A
8Positioning state
0x00 not positioned
0x01real time GPS
0x02 differential GPS
10SNR of Satellite
Range: 0x00~0x630~99dBHZ
Each satellite occupies one byte.
11Stop bit
Fixed value: 0x0D 0x0A
content
Length (Byte)
Message header
0x54 0x68
Protocol Number
0x1A
Stop bit
0x0D 0x0A
Each time the terminal sends a heartbeat packet to the server, the server needs to respond.
- 10 -
www.iconcox.com
Length(Byte)
Start Bit
Packet Length
LAC
Terminal ID
Serial Number
Protocol Number
Address
Date Time
request
Latitude
packet64
Longitude
Information
Speed
Content
Course
MNC
Cell ID
Status
Byte
Phone number
21
Language
Stop Bit
1 Start bit
0x68 0x68
2 Packet length
- 11 -
www.iconcox.com
3LAC
Location Area Code (LAC) included in LAI consists of two bytes and is encoded in
hexadecimal. The available range is 0x0001-0xFFFE, and the code group 0x0000 and
0xFFFF cannot be used. (see GSM specification 03.03, 04.08 and 11.11).
4Terminal ID
The terminal ID applies IMEI number of 15 bits.
Example: if the IMEI is 123456789012345,
the terminal ID is 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45.
5Serial number
The serial number of the first GPRS data (including GPS data packet, heartbeat packet,
command packet) sent after booting is 1, and the serial number of data sent later at each
time will be automatically added 1.
6Protocol number
0X1B
8Latitude
For details see GPS Data Packet Format section 4.
9Longitude
For details see GPS Data Packet Format section 4.
10Speed
For details see GPS Data Packet Format section 4.
11Course
For details see GPS Data Packet Format section 4.
12MNC
For details see GPS Data Packet Format section 4.
13Cell ID
For details see GPS Data Packet Format section 4.
14Status
For details see GPS Data Packet Format section 4.
- 12 -
www.iconcox.com
15Phone number
Convert by ASCII, add 0 to the right side if less than 21 bits.
16Language
0x01: Chinese
0x02: English
17Stop bit
Fixed value: 0x0D 0x0A
Format
Start Bit
Protocol Number
Command Content
Check Bit
Stop Bit
1Start bit
The default: 0x78 0x78
3Length of command
Server Flag Bit + Length of Command Content
The length for Chinese command and English command is not the same, 2 bytes for
English, 1 byte for Chinese.
4 Protocol number
For English: 0x97;
For Chinese: 0x17
www.iconcox.com
6Command content
The server receives address request packet from the terminal, it will check the Chinese
address information according to the loaded GPS information and then reply the address
information and phone number to the terminal.
Command content: ADDRESS&&address content &&phone number ##(ADDRESS, &&
and ## are fixed string)
address content is in Unicode)
7Serial number
The serial number of the first GPRS data (including GPS data packet, heartbeat packet)
sent after booting is 1, and the serial number of data sent later at each time will be
automatically added 1.
8 Error check
A check code may be used by the terminal or the server to distinguish whether the received
information is error or not. To prevent errors occur during data transmission, error check is
added to against data disoperation, so as to increase the security and efficiency of the
system. The check code is generated by the CRC-ITU checking method.
The check codes of data in the structure of the protocol, from the Packet Length to the
Information Serial Number (including Packet Length and Information Serial
Number) , are values of CRC-ITU.
CRC error occur when the received information is calculated, the receiver will ignore and
discard the data packet.
9Stop bit
Fixed value in HEX 0x0D 0x0A
Format
Start Bit
Packet Length
Protocol Number
terminal15+M+N
Byte
Information Content
Length of Command
Command Content
- 14 -
www.iconcox.com
2
Stop Bit
1Start bit
The default: 0x88 0x88
2Packet length
The length of "protocol number" + the length of information content
3Length of command
Server Flag Bit + Length of Command Content
4Protocol number
0x1C
5Server flag bit
It is reserved to the identification of the server. The binary data received by the terminal is
returned without change.
6Command content
It is represented in ASC II of string, and the command content is compatible with text
message command.
e.g.: STATUS, 666666#
7Stop bit
Fixed value in HEX 0x0D 0x0A
Length(Byte)
Start Bit
Packet Length
Reserved bit
Terminal ID
Command response
Packet
Protocol Number
15+M+5 Byte
Command
Length of Command
Command Content
information
Stop bit
2
- 15 -
www.iconcox.com
1Start bit
The default: 0x68 0x68
2Packet length
The length from reserved bit to command information
3Reserved bit
0x00 0x00
4Terminal ID
The terminal ID applies IMEI number of 15 bits.
Example: if the IMEI is 123456789012345,
the terminal ID is 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45.
5Serial number
The serial number of the first GPRS data (including GPS data packet, heartbeat packet,
command packet) sent after booting is 1, and the serial number of data sent later at each
time will be automatically added 1.
6Protocol number
0x1C
7Length of command
Server Flag Bit + Length of Command Content
8Server flag bit
Server flag bit is returned without change.
9Command content
It is represented in ASC II of string; the status of command response (e.g. Success) is
stored.
10Stop bit
Fixed value in HEX 0x0D 0x0A
Format
Length(Byte)
Start Bit
Packet Length
LAC
abnormal state
upload
- 16 -
www.iconcox.com
Terminal ID
Protocol Number
Date Time
Latitude
Longitude
Information
Speed
Content
Course
MNC
Cell ID
Status bit
Stop Bit
1Start bit
2 bytes: 0x68 0x68
2Packet length
The number of bytes from LAC to information content, its default value is 37.
3LAC
Location Area Code (LAC) included in LAI consists of two bytes and is encoded in
hexadecimal. The available range is 0x0001-0xFFFE, and the code group 0x0000 and
0xFFFF cannot be used. (see GSM specification 03.03, 04.08 and 11.11).
4Terminal ID
The terminal ID applies IMEI number of 15 bits.
Example: if the IMEI is 123456789012345,
the terminal ID is 0x01 0x23 0x45 0x67 0x89 0x01 0x23 0x45.
5Serial number
The serial number of the first GPRS data (including GPS data packet, heartbeat packet,
command packet) sent after booting is 1, and the serial number of data sent later at each
time will be automatically added 1.
6Protocol number
0x10
7Date &time
For details see GPS Data Packet Format section 4.
8Latitude
- 17 -
www.iconcox.com
www.iconcox.com
Code fragment of the CRC-ITU lookup table algorithm implemented based on C language
is as follow:
Static const U16 crctab16 [] =
{
0X0000, 0X1189, 0X2312, 0X329B, 0X4624, 0X57AD, 0X6536, 0X74BF,
0X8C48, 0X9DC1, 0XAF5A, 0XBED3, 0XCA6C, 0XDBE5, 0XE97E, 0XF8F7,
0X1081, 0X0108, 0X3393, 0X221A, 0X56A5, 0X472C, 0X75B7, 0X643E,
0X9CC9, 0X8D40, 0XBFDB, 0XAE52, 0XDAED, 0XCB64, 0XF9FF, 0XE876,
0X2102, 0X308B, 0X0210, 0X1399, 0X6726, 0X76AF, 0X4434, 0X55BD,
0XAD4A, 0XBCC3, 0X8E58, 0X9FD1, 0XEB6E, 0XFAE7, 0XC87C, 0XD9F5,
0X3183, 0X200A, 0X1291, 0X0318, 0X77A7, 0X662E, 0X54B5, 0X453C,
0XBDCB, 0XAC42, 0X9ED9, 0X8F50, 0XFBEF, 0XEA66, 0XD8FD, 0XC974,
0X4204, 0X538D, 0X6116, 0X709F, 0X0420, 0X15A9, 0X2732, 0X36BB,
0XCE4C, 0XDFC5, 0XED5E, 0XFCD7, 0X8868, 0X99E1, 0XAB7A, 0XBAF3,
0X5285, 0X430C, 0X7197, 0X601E, 0X14A1, 0X0528, 0X37B3, 0X263A,
0XDECD, 0XCF44, 0XFDDF, 0XEC56, 0X98E9, 0X8960, 0XBBFB, 0XAA72,
0X6306, 0X728F, 0X4014, 0X519D, 0X2522, 0X34AB, 0X0630, 0X17B9,
0XEF4E, 0XFEC7, 0XCC5C, 0XDDD5, 0XA96A, 0XB8E3, 0X8A78, 0X9BF1,
0X7387, 0X620E, 0X5095, 0X411C, 0X35A3, 0X242A, 0X16B1, 0X0738,
0XFFCF, 0XEE46, 0XDCDD, 0XCD54, 0XB9EB, 0XA862, 0X9AF9, 0X8B70,
0X8408, 0X9581, 0XA71A, 0XB693, 0XC22C, 0XD3A5, 0XE13E, 0XF0B7,
0X0840, 0X19C9, 0X2B52, 0X3ADB, 0X4E64, 0X5FED, 0X6D76, 0X7CFF,
0X9489, 0X8500, 0XB79B, 0XA612, 0XD2AD, 0XC324, 0XF1BF, 0XE036,
0X18C1, 0X0948, 0X3BD3, 0X2A5A, 0X5EE5, 0X4F6C, 0X7DF7, 0X6C7E,
0XA50A, 0XB483, 0X8618, 0X9791, 0XE32E, 0XF2A7, 0XC03C, 0XD1B5,
0X2942, 0X38CB, 0X0A50, 0X1BD9, 0X6F66, 0X7EEF, 0X4C74, 0X5DFD,
0XB58B, 0XA402, 0X9699, 0X8710, 0XF3AF, 0XE226, 0XD0BD, 0XC134,
0X39C3, 0X284A, 0X1AD1, 0X0B58, 0X7FE7, 0X6E6E, 0X5CF5, 0X4D7C,
0XC60C, 0XD785, 0XE51E, 0XF497, 0X8028, 0X91A1, 0XA33A, 0XB2B3,
0X4A44, 0X5BCD, 0X6956, 0X78DF, 0X0C60, 0X1DE9, 0X2F72, 0X3EFB,
0XD68D, 0XC704, 0XF59F, 0XE416, 0X90A9, 0X8120, 0XB3BB, 0XA232,
0X5AC5, 0X4B4C, 0X79D7, 0X685E, 0X1CE1, 0X0D68, 0X3FF3, 0X2E7A,
0XE70E, 0XF687, 0XC41C, 0XD595, 0XA12A, 0XB0A3, 0X8238, 0X93B1,
0X6B46, 0X7ACF, 0X4854, 0X59DD, 0X2D62, 0X3CEB, 0X0E70, 0X1FF9,
0XF78F, 0XE606, 0XD49D, 0XC514, 0XB1AB, 0XA022, 0X92B9, 0X8330,
0X7BC7, 0X6A4E, 0X58D5, 0X495C, 0X3DE3, 0X2C6A, 0X1EF1, 0X0F78,
};
// calculate the 16-bit CRC of data with predetermined length
U16 GetCrc16(const U8* pData, int nLength)
{U16 fcs = 0xffff;
// initialization while(nLength>0){fcs = (fcs >> 8) ^
crctab16[(fcs ^ *pData) & 0xff];nLength--;pData++;}return ~fcs; // negated}
- 19 -
www.iconcox.com
- 20 -