TT18-4G-M TCP data protocol

1 Data communication

1. Set TT8 4G RTC time ：

After a connection is established between the device and the server, the device sends a data
message to the server. The server sends the following information to the device to change the RTC
time. It is recommended that the server set the RTC time each time when the device connects to
the server.
Set the RTC time Format：@UTC,yyyy-MM-dd HH:mm:ss#
For example：@UTC,2021-11-24 02:56:43#
*please note the time setting should be UTC +0 time,the RTC time is set first, and then the ACK
reply is set.

C# code：

byte[] utcBytes = System.Text.Encoding.Default.GetBytes(string.Format("@UTC,{0}#",

System.DateTime.UtcNow.ToString("yyyy-MM-dd HH:mm:ss")));

_NetStream.Write(utcBytes, 0, utcBytes.Length);

2. Set ACK reply：

After a connection is established between the device and the server,each time the machine sends a
piece of data to the server, the server must reply with an ACK message to the machine, otherwise
the machine will continue to send duplicate data。
Reply ACK Format：@ACK,Packet index (Hex converted into decimal)#
For example：@ACK,0035#

C# code：

byte[] ackBytes = System.Text.Encoding.Default.GetBytes(string.Format("@ACK,{0}#",

serial));

_NetStream.Write(ackBytes, 0, ackBytes.Length);
 2 Data parsing

TT18-4G-M data is in hex format.

The format of hex code:

Start bits(2byte) + Packet length(2byte) + Protocol number(2byte) + Hardware

type(2byte) + Firmware version(4byte) + IMEI(8byte) + RTC date time(6byte) +
+ GPS data length （ 2byte ） +Status （ 1byte ） +UTC date time （ 6byte ） +
longitude(4byte) + latitude(4byte) + angle(2byte) + speed(2byte) + LBS data
length(2byte) + The number of LBS(1byte) + signal LBS information(1byte) +
MCC(2byte) + MNC(2byte) + LAC(2byte) + CELLID(4byte) + RxLev(1byte)+
PCI(2byte)+earfcn(3byte)+RSRP(1byte)+RSRQ(1byte)+RSSI(1byte)+ Extension
bits(A) + State data length(2byte) + Alarm type(1byte) + Terminal
information(1byte) + Network signal strength(1byte) +Network state(1byte)
+Battery voltage(2byte) + Temperature(2byte) + humidity(2byte) + Light
Sensor(1byte) + Extension bits(B) + Extension bits(C) + packet index(2byte) +
CRC(2byte) + Stop bits(2byte)

The data of the device send to the server:

54 5A 00 52 24 24 04 07 03 08 00 00 01 80 32 30 00 00 50 98 17 05 04 16 34 1E

00 13 01 17 05 04 16 34 32 01 57 BF 08 06 CC AE B8 00 00 00 00 00 14 01 52 04

60 00 00 1D 2F 0D 63 5F 52 00 16 00 0E 66 53 0C 46 00 0B AA 00 16 3F 01 76 4

0 CE 03 2B 01 00 2B 12 AE 0D 0A

Here below is a table which informs more detailed information about the protocol.

Number Data
Data block Meaning
of bytes Content
Tzone company identifier. This is the header of every
Start bits 2 ‘T’ ‘Z’
packet
The bytes length from the start at protocol number to the
Packet length 2 Variable
end at the CRC.
Protocol number 2 ‘$$’ Normal data
Hardware type 2 0x04 0x07 The hardware is TT18
Each byte represents a first-level version
Firmware version 4 Variable For example, 03H 08H 00H 00H indicates that the
version is 3.8.0.0
 The high four bits of the first byte are ignored, and every
other 4 bits represent a character, such as 01H 80H 32H
IMEI 8 Variable
30H 00H 00H 50H 98H
Indicates that the IMEI is 180323000005098.
The time when the piece of data is packaged and ready to
be sent is in the order of year, month, day, hour, minute,
RCT time date 6 Variable and second, and 2000 is added to the year.
For example, 17H 05H 04H 16H 34H 1EH indicates that
the time is: 2023/05/04 22:52:30
Indicates the length of GPS information (unit: byte), if it
GPS data length 2 Variable
is 0000H, it means that there is no such data
bit0: latitude mark, 1=N north latitude, 0=S south
Status 1 Variable latitude; bit1: longitude mark, 1=W west longitude, 0=E
east longitude, other bits are reserved
UTC date time 6 Variable The format is the same as the RTC date time
Unit: degree, HEX format, this value/1000000 is the
longitude 4 Variable
latitude, such as 0157BF08H means 22.527752
Unit: degree, HEX format, this value/1000000 is the
latitude 4 Variable
longitude, such as 06CCAEB8H means 114.077368
angle 2 Variable Unit: degree, reserved
speed 2 Variable Unit: 0.1Knots, reserved
GSM LBS’s data length excludes LBS data length part. If
LBS data length 2 Variable
the value is 0, there is no LBS data.
The number of The number of LSB base stations included in this
1 Variable
LBS package data
Single LBS base station information length and base
station information indication, bit7-5 indicates the base
Signal LBS station type, where 000H-2G base station, 010H-NB base
1 Variable
information station, 100H-CATM1 base station, 110H-LTE base
station; bit4-0 indicates the base station information
length;
Mobile Country Code, ignore the first digital, only 3
MCC 2 Variable
digital, 04 60 means that MCC is 460.
Mobile Network Code, 2 or 3 digital, if the first digital is
MNC 2 Variable 8 , MNC is 3 digital. If the first digital is 0, MNC is 2
digital. 87 56 means that MNC is 756. 00 56 means 56.
location area code, hex code
LAC 2 Variable
0x27 0x56 means LAC is 10070
 Cell identification code, 4 byte, hex code,
i.e. 01H23H45H67H means CELL ID is 19088743;

In the data example:

LBS length:00H 22H, means 34byte;

The number of LBS：03H, means 3;

The first LBS information:

Signal LBS information :0AH，2G base station，Contains
10 bytes of data;
MCC :04H 60H,460;
MNC:00H 00H,00；;
LAC:27H 93H,10131;
CELL ID:00H 00H 0FH A1H,4001;
CELL ID 4 Variable
The second LBS information:
Signal LBS information:0AH,2G base station,Contains
10 bytes of data;
MCC:04H 60H,460;
MNC:00H 00H,00;
LAC:27H B6H,10166;
CELL ID:00H 00H 15H BBH,5563;

The Third LBS information:

Signal LBS information:0AH，2G base station，Contains
10 bytes of data;
MCC:04H 60H,460;
MNC:00H 00H,00;
LAC:27H B6H,10166;
CELL ID:00H 00H 12H A3H,4771;
Received Signal power, 1 byte, hex format, unit: -dbm,
supported by 2G base stations, this data does not appear
RxLev 1 Variable
for unsupported base stations; for example, 52H means
-82dbm
Physical Cell Identity, 2 bytes, hex format, supported by
PCI 2 Variable LTE base stations, this data does not appear for
unsupported base stations
Evolved Absolute Radio Frequency Channel, 3 bytes, hex
earfcn 3 Variable format, supported by LTE base stations, this data will not
appear for unsupported base stations
 Reference Signal Received Power (RSRP) in dBm.1 byte,
hex format, unit: -dbm, supported by LTE base stations,
RSRP 1 Variable
this data does not appear for unsupported base stations,
such as 52H means -82dbm
Reference Signal Received Quality (RSRQ) in dB.1 byte,
hex format, unit: -db, supported by LTE base stations,
RSRQ 1 Variable
this data does not appear for unsupported base stations,
such as 12H means -18db
Received signal strength indicator value, 1 byte, hex
format, unit: -dbm, supported by LTE base stations, this
RSSI 1 Variable
data does not appear for unsupported base stations, such
as 52H means -82dbm
For future extending the protocol use, currently, has
Extension bits A=0
nothing, does not possess any byte
The status data length excluding “Status data length”
Status data length 2 Variable
itself. If this part is 0, there is no status data.
The value of this part has four possibilities,
Temperature/humidity included in all the data.
0xAA Interval GPRS data
Alarm type 1 Variable 0x10 Low battery Alarm
0xA0 Temperature/Humidity over threshold alarm
0xA1 Temperature/Humidity sensor abnormal alarm
0xA1 Light sensor bright and dark changes
Bit 7-6 work mode
00= Normal work mode,
01= Flight mode,
bit 5 are reserved for future use.
Bit4: 1 press the button
0 Have not press the button
Bit3: 1 The temperature/Humidity sensor is
Terminal
1 Variable abnormal
information
0 The temperature/Humidity sensor is normal
Bit2: 1 The temperature/Humidity is over threshold
0 The temperature/Humidity is normal
Bit1: 1 The battery low voltage
0 The battery is normal
Bit0: 1 The machine is charging
0 The machine is not charging
GMS signal CSQ value , Hex code
1 Variable
strength
 Bit 7 to bit 6 are reserved for future use.
Bit 5: 1 Internet connection is established
0 Internet connection is not established
Bit4: 1 GPRS is registered successfully
0 GPRS is not registered
Bit3: 1 The GSM is in roaming mode
GSM status 1 Variable 0 The GSM is in home network mode
Bit2: 1 GSM is registered successfully
0 GSM is not registered yet
Bit1: 1 Detected SIM card
0 Not detected SIM card
Bit0: 1 The GSM module is started
0 The GSM module is not started yet
Unit:10mv,
Battery voltage 2 Variable
for example: 0175H=373(DEC), 375*10mV=3.73V.
Unit:0.1℃，hex code,convert to binary first,
Bit15: 0 the temperature/humidity sensor is normal
1 the temperature/humidity sensor is abnormal
Bit14：0 the temperature is positive.
Temperature 2 Variable 1 the temperature is negative.
Bit0-13:the temperature value, convert to HEX first , and
multiply 0.1℃.
for example:01 23=29.1℃ , 41 23= - 29.1℃
80 00= not connect temperature/humidity sensor
Unit:0.1%, Hex code,convert to binary first,
Bit15: 0 the temperature/humidity sensor is normal
1 the temperature/humidity sensor is abnormal
humidity 2 Variable Bit0-14:the humidity value, convert to HEX first ,
for example: 02 4D=58.9%,
FF = not connect temperature /humidity sensor or no
humidity
Light Sensor 1 Variable Bit0 means bright or dark，0-bright,1-dark;
For future use, currently, this part has nothing, does not
Extension bits B=0
have any byte
For future use, currently, this part has nothing, does not
Extension bits C=0
have any byte
Packet index 2 Variable The value range of this part is between 1 and 9999
The checked content is from the “protocol number” to
CRC 2 Variable the end at “CRC”, including “protocol number”,
excluding “CRC”.
Stop bits 2 0x0D 0x0A Indicate that this packet is finished