EVENTOS Cellocator Wireless Communication Protocol

8/17/2019 EVENTOS Cellocator Wireless Communication Protocol

1/292

Copyright © 2015 by Pointer Telocation, Ltd.

Cellocator WirelessCommunication Protocol

Proprietary and Confidential

Version 4.1.8.0

Revised and Updated: February 7, 2016


2/292


Cellocator Wireless Communication Protocol Page 2 of 292


Legal Notices

IMPORTANT

1. All legal terms and safety and operating instructions should be read thoroughly beforethe product accompanying this document is installed and operated.

2. This document should be retained for future reference.

3. Attachments, accessories or peripheral devices not supplied or recommended inwriting by Pointer Telocation Ltd. May be hazardous and/or may cause damage to the

product and should not, in any circumstances, be used or combined with the product.

General

The product accompanying this document is not designated for and should not be used inlife support appliances, devices, machines or other systems of any sort where any

malfunction of the product can reasonably be expected to result in injury or death.

Customers of Pointer Telocation Ltd. Using, integrating, and/or selling the product for use

in such applications do so at their own risk and agree to fully indemnify Pointer TelocationLtd. For any resulting loss or damages.

Warranty Exceptions and Disclaimers

Pointer Telocation Ltd. Shall bear no responsibility and shall have no obligation under the

foregoing limited warranty for any damages resulting from normal wear and tear, the costof obtaining substitute products, or any defect that is (i) discovered by purchaser during

the warranty period but purchaser does not notify Pointer Telocation Ltd. Until after theend of the warranty period, (ii) caused by any accident, force majeure, misuse, abuse,

handling or testing, improper installation or unauthorized repair or modification of the

product, (iii) caused by use of any software not supplied by Pointer Telocation Ltd., or byuse of the product other than in accordance with its documentation, or (iv) the result of

electrostatic discharge, electrical surge, fire, flood or similar causes. Unless otherwiseprovided in a written agreement between the purchaser and Pointer Telocation Ltd., the

purchaser shall be solely responsible for the proper configuration, testing and verificationof the product prior to deployment in the field.

POINTER TELOCATION LTD.’S SOLE RESPONSIBILITY AND PURCHASER’S SOLE REMEDYUNDER THIS LIMITED WARRANTY SHALL BE TO REPAIR OR REPLACE THE PRODUCT

HARDWARE, SOFTWARE OR SOFTWARE MEDIA (OR IF REPAIR OR REPLACEMENT IS NOTPOSSIBLE, OBTAIN A REFUND OF THE PURCHASE PRICE) AS PROVIDED ABOVE.POINTER TELOCATION LTD. EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES OF ANY

KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIEDWARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, SATISFACTORYPERFORMANCE AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALLPOINTER TELOCATION LTD. BE LIABLE FOR ANY INDIRECT, SPECIAL, EXEMPLARY,

INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOSSOR INTERRUPTION OF USE, DATA, REVENUES OR PROFITS) RESULTING FROM A BREACHOF THIS WARRANTY OR BASED ON ANY OTHER LEGAL THEORY, EVEN IF POINTER

TELOCATION LTD. HAS BEEN ADVISED OF THE POSSIBILITY OR LIKELIHOOD OF SUCH

DAMAGES.


3/292




Intellectual Property

Copyright in and to this document is owned solely by Pointer Telocation Ltd. Nothing in

this document shall be construed as granting you any license to any intellectual property

rights subsisting in or related to the subject matter of this document including, withoutlimitation, patents, patent applications, trademarks, copyrights or other intellectual

property rights, all of which remain the sole property of Pointer Telocation Ltd. Subject toapplicable copyright law, no part of this document may be reproduced, stored in orintroduced into a retrieval system, or transmitted in any form or by any means

(electronic, mechanical, photocopying, recording or otherwise), or for any purpose,

without the express written permission of Pointer Telocation Ltd.

© Copyright 2016. All rights reserved.


4/292




Table of Contents

1 Introduction .............................................................................................................. 8

1.1 About this Document .................................................................................................... 8

1.2 FW Version Applicability Table ........................................................................................ 8

1.3 Abbreviations .............................................................................................................. 8

1.4 References .................................................................................................................. 9

2 Telemetry Channel (Outbound Messages) ............................................................... 10

2.1 Overview.................................................................................................................... 10

2.2 Outbound: Status/Location Message Definition = Message Type 0 ..................................... 10

2.2.1 Byte-Aligned Table ...................................................................................................... 10

2.2.2 General Details ........................................................................................................... 12

2.2.3 Detailed Per-Field Specifications .................................................................................... 13

2.3 Outbound: Configuration (Programming) Data Message Definition = Message Type 3 .......... 54

2.3.1 Message Ingredients .................................................................................................... 54


2.4 Outbound: Logged Fragment of Data Forwarded From Serial Port to Wireless Channel = Type7 55

2.5 The Container ............................................................................................................. 55

2.5.2 Data Path Chart .......................................................................................................... 57

2.5.3 Byte-Aligned Table ...................................................................................................... 58

2.6 Outbound: Real Time Data Forwarded From Serial Port to Wireless Channel = Message Type 860


2.6.2 Byte-Aligned Table ...................................................................................................... 60 2.6.3 Detailed Per-Field Specifications .................................................................................... 61

2.7 Outbound: Modular Message = Message Type 9 .............................................................. 63



2.7.3 Outbound Sub-Data Types List ...................................................................................... 65

2.7.4 Outbound: The Firmware Platform Manifest (Sub-Data Type 0x01) .................................... 66

2.7.5 Outbound: The Compact CAN Data (Sub-Data Type 0x02) ............................................... 68

2.7.6 Outbound: Compact CAN Trigger Module (Sub-Data Type 0x03) ....................................... 69

2.7.7 Outbound: Logged Compact CAN Trigger Module (Sub-Data Type 0x03) ............................ 70

2.7.8 Outbound: Time and Location Stamp Module (Sub-Data Type 0x04) .................................. 72

2.7.9 Accelerometer Response Module (Sub-Data Type 0x05) ................................................... 74

2.7.10 PSP – UL Messages from Alarm System (Sub-Data Type 0x06) ......................................... 74

2.7.11 Usage Counter Update Packet (Sub-Data Type 0x07) ....................................................... 75

2.7.12 Command Authentication Update (Sub-Data Type 0x08) .................................................. 77

2.7.13 Outbound: Neighbor list of the serving GSM cell (Cell-ID) (Sub-Data Type 0x09) ................ 78

2.7.14 Outbound: Maintenance Server Platform Manifest (Sub-Data Type 0x0A) ........................... 79

2.7.15 Outbound: Message Forwarded from Keyboard (Sub-Data Type 0x0B) ............................... 85

2.7.16 Outbound: 3G Cell ID Data (Sub-Data Type 0x0C) .......................................................... 87

2.7.17 Outbound: Compressed Vector Change Report (Sub-Data Type 0x0D) ............................... 88


5/292




2.7.18 Outbound: Modular Platform Manifest (Sub-Data 0x12) ................................................... 91

2.7.19 Outbound: Pulse Counter Measurement Response (Sub-Data 0x14) .................................. 97

2.7.20 Outbound: Cello-CANiQ (Sub-Data 0x15) (Infrastructure) .............................................. 101

2.7.21 Outbound: Cello-CANiQ Fleet End of Trip Report (Sub-Data 0x16) ................................... 101

2.7.22 Outbound: CFE Inputs Update message (Sub-Data Type 0x18) ....................................... 103

2.7.23 Outbound: oneWire Temperature Sensor Measurement – (Sub-Data 0x19) ...................... 107

2.7.24 Outbound: CDMA Cell ID Data (Sub-Data Type 0x1C) .................................................... 110

2.8 Outbound: Modular Message = Message Type 11 .......................................................... 111

2.8.1 Message Ingredients .................................................................................................. 111

2.8.2 Detailed Per-Field Specifications .................................................................................. 112

2.8.3 Outbound Type 11 Module Structure ............................................................................ 113

2.8.4 Outbound Type 11 Modules Table ................................................................................ 113

2.8.5 Outbound: DTC Event Module ..................................................................................... 115

2.8.6 Outbound: Variables Dump List Module ........................................................................ 116

2.8.7 Outbound: Calibration Data Snap Shot Module .............................................................. 117 2.8.8 Outbound: GPS Location Stamp Module ....................................................................... 117

2.8.9 Outbound: GPS Time Stamp Module ............................................................................ 118

2.8.10 Outbound: Firmware ID Module .................................................................................. 118

2.8.11 Outbound: ACK Module .............................................................................................. 118

2.8.12 Outbound: Configuration Memory Write Response Module .............................................. 119

2.8.13 Outbound: Configuration Memory Read Response Module .............................................. 119

2.8.14 Outbound: CAN-GPS Speed Calibration Status .............................................................. 120

2.8.15 Outbound: VIN Read Response Module ........................................................................ 121

2.8.16 Outbound: Trigger Event ID Module ............................................................................. 121

2.8.17 Outbound: General Status Event Module ...................................................................... 122

2.8.18 Outbound: CAN Variables Status Dump ........................................................................ 124

3 Command Channel (Inbound Messages) ............................................................... 126

3.1 Overview.................................................................................................................. 126

3.2 Generic Command Message Definition ......................................................................... 126

3.2.1 General Details ......................................................................................................... 126


3.2.3 Byte-Aligned Table .................................................................................................... 127


3.3 Inbound: Generic Command-Message type 0 ................................................................ 129

3.4 Inbound: Programming Command Definition = Message Type 1 ...................................... 134



3.5 Inbound: Generic Acknowledge Message Definition = Message Type 4 ............................. 135

3.5.1 General Details ......................................................................................................... 135



3.6 Inbound: Forward Data Command Definition = Message Type 5 ...................................... 137



6/292






3.7 Inbound: Modular Message Request Definition = Message Type 9 ................................... 139

3.7.1 Message Ingredients .................................................................................................. 139 3.7.2 Detailed Per-Field Specifications .................................................................................. 140

3.7.3 Inbound Sub-Data Types Table ................................................................................... 141

3.7.4 Inbound: Firmware Manifest Request (Sub-Data Type 0x01) .......................................... 141

3.7.5 Inbound: CAN Data Request (Sub-Data Type 0x02) ....................................................... 141

3.7.6 Inbound: Time and Location Stamp Module (Sub-Data Type 0x04) .................................. 142

3.7.7 Inbound: Accelerometer Data (Sub-Data Type 0x05) ..................................................... 142

3.7.8 Inbound: PSP – UL Messages from CCC to Alarm System (Sub- Data Type 0x06) .............. 142

3.7.9 Inbound: Usage Counter Write/Request Command (Sub-Data Type 0x07) ........................ 142

3.7.10 Inbound: Command Authentication Table Change (Sub-Data Type 0x08) ......................... 144

3.7.11 Inbound: Neighbor list of the serving GSM cell request (Sub-Data Type 0x09) .................. 146

3.7.12 Inbound: Forward Data To Keyboard (Sub-Data Type 0xB)............................................. 146 3.7.13 Inbound: Modular Platform Manifest request (Sub-Data Type 0x12) ................................ 147

3.7.14 Inbound: Modular Pulse Counter Measurement request (Sub-Data Type 0x14).................. 148

3.7.15 Inbound: CFE inputs Status Update Request (Sub-Data Type 0x18) ................................ 149

3.7.16 Inbound: oneWire Temperature Sensor Measurement Request – InBound (Sub-Data Type0x19) 150

3.8 Inbound: Modular Message = Message type 11 ............................................................. 152



3.8.3 Inbound Type 11 Module Structure .............................................................................. 154

3.8.4 Type 11 Modules Table .............................................................................................. 154

3.8.5 Inbound: Configuration Memory Write Module .............................................................. 156

3.8.6 Inbound: Configuration Memory Read Request Module ................................................... 157

3.8.7 Inbound: VIN String Write Module ............................................................................... 157

3.8.8 Inbound: VIN Read Request Module ............................................................................ 158

3.8.9 Inbound: General Module Query.................................................................................. 158

3.8.10 Inbound: General Command ....................................................................................... 158

3.8.11 Inbound: Forwarded CAN Query .................................................................................. 160

4 CSA OTA Protocol .................................................................................................. 161

4.1.2 CSA Protocol Frame ................................................................................................... 163

4.1.3 Message Types Table ................................................................................................. 164

4.1.4 CSA Protocol Version ................................................................................................. 164 4.1.5 CSA Event (Message type 0 from CSA to Server) .......................................................... 164

4.1.6 Table of CSA Event Reasons ....................................................................................... 164

4.1.7 The Acknowledge (to CSA Event, Message Type 1 from Server to CSA) ............................ 169

4.1.8 Program/Read Parameters to CSA (Message Type 2 from Server to CSA) ......................... 169

4.1.9 Reply to Program/Read Parameters Command (Message type 3 from CSA to Server) ........ 170

4.1.10 Command to CSA (Message Type 4 from Server to CSA) ................................................ 170

4.2 Modules Description .................................................................................................. 171

4.2.1 Modules Summary Table ............................................................................................ 171


7/292




4.2.2 Modules Detailed Table .............................................................................................. 173

4.3 FTP/TFTP Files Structure ............................................................................................ 212

4.3.1 Raw Data Files .......................................................................................................... 212

4.3.2 File Naming Convention ............................................................................................. 212 4.3.3 File Structure ............................................................................................................ 215

4.3.4 Maneuver files Payload Structure ................................................................................ 216

4.3.5 Trip files Payload Structure ......................................................................................... 217

4.3.6 Crash File Payload Structure ....................................................................................... 220

4.4 File Structure Examples ............................................................................................. 223

4.4.1 Trip File Detailed Structure Example ............................................................................ 223

5 CelloTrack Nano Protocol ...................................................................................... 233

5.1 Overview.................................................................................................................. 233

5.2 Nano-related Content of Multi-Purpose Bytes (33÷38) in Type-0 Messages ...................... 234

5.3 Changes in Emergency Queue ..................................................................................... 235 5.4 Type-11 Message Structures ....................................................................................... 236

5.5 Legacy (Type-0) Encapsulated in Type-11 New Module .................................................. 239

5.6 Nano Features Related Messages ................................................................................ 240

5.6.1 General Definitions and Data Structures ....................................................................... 240

5.6.2 Nano Extra Take Locations Messages ........................................................................... 241

5.6.3 Impact and Free-fall Recognition ................................................................................. 241

5.6.4 Orientation Change ................................................................................................... 243

5.6.5 Man Down ................................................................................................................ 243

5.6.6 Package Open/Close .................................................................................................. 244

5.6.7 Work-ID /Activation Event .......................................................................................... 245 5.6.8 Temperature/Humidity Reporting ................................................................................ 246

5.6.9 Request of the Entire Cyclic Buffer of a Channel ............................................................ 254

5.6.10 Check-in Feature ....................................................................................................... 254

5.7 MultiSense Features Related Messages ........................................................................ 255

5.7.1 MultiSense Provisioning Event ..................................................................................... 255

5.7.2 Guest MultiSense Reporting ........................................................................................ 258

5.7.3 MultiSense Open/Close Package Feature ...................................................................... 263

5.7.4 MultiSense Open/Close Door/Window Feature ............................................................... 264

5.7.5 MultiSense Added Event ............................................................................................. 265

5.7.6 MultiSense Removed Event......................................................................................... 266


8/292



1 Introduction

1.1 About this Document

This document explains the unit's wireless communication structure. It describes every

byte of the incoming / outgoing packets, which can be sent or received by the unit over-

the-air.

1.2 FW Version Applicability Table

This document describes the OTA protocol of the Legacy fleet system, the later CSA(Cellocator Safety Application) and CelloTrack Nano protocols.

Unit Applicable Sections

Cello-F 1-Introduction, 2 and 3-Telemetry channel outbound and

inbound

Cello-R1-Introduction, 2 and 3-Telemetry channel outbound and

inbound

CR2001-Introduction, 2 and 3-Telemetry channel outbound and

inbound,not including section 2.6

CR200B1-Introduction, 2 and 3-Telemetry channel outbound and

inbound,not including section 2.6

Cello-IQ40,

Cello-IQ50

1-Introduction, 2 and 3-Telemetry channel outbound and

inbound,4- CSA protocol

Cello-IQ40,Cello-IQ50 GNSS

1-Introduction, 2 and 3-Telemetry channel outbound and

inbound,4-CSA protocol

Cello-CANiQ1-Introduction, 2 and 3-Telemetry channel outbound and


CR3001-Introduction, 2 and 3-Telemetry channel outbound and


CelloTrack-T1-Introduction, 2 and 3-Telemetry channel outbound and

inbound

CelloTrack Nano1-Introduction, 2 and 3-Telemetry channel outbound and

inbound,5-CelloTrack Nano protocol

1.3 Abbreviations

Abbreviation Description

ACK Acknowledge

CAN Controller Area Network

CCC Command and Control Center

DB Database


9/292




Abbreviation Description

FMS Fleet Management System

OTA Over the Air

PDU Protocol Description Unit (Common name for data SMS)

PGN Parameter Group Number

SMS Short Message Service (GSM)

PTR Pointer Telocation Ltd.

PSP Pointer Serial Protocol, normally refers to a Car Alarm

System interfacing through this protocol

NVM Non Volatile Memory

FW Firmware

HW Hardware

CSA Cellocator Safety Application

1.4 References

All the reference documents listed in the following table can be downloaded from the

support section of the Pointer Website (www.pointer.com).

# Reference Description

1 Cello Programming Manual This document describes the featuressupported by the Cellocator unit andprovides details about theparameters of its configuration.

2 Cello Hardware InstallationGuide

This document provides all necessary

information for a technician who is

involved in the installation of a Cello-

F or Cello-R unit. It describes how toinstall and verify the properfunctioning of the Cello installation

kit elements.

3 Serial Interfaces Specification This document describes the serial

interface (RS232) protocol

4 Cello AR Interface Protocol This document describes 1-Wireinterface of Cello-AR unit

5 CR200 / CR200B Programming

Manual

This document describes the features

supported by the Cellocator CR200 /

CR200B unit and provides detailsabout the parameters of itsconfiguration.

http://www.pointer.com/http://www.pointer.com/


10/292




2 Telemetry Channel (Outbound Messages)

2.1 Overview

The telemetry channel comprises four kinds of messages, as described in the following:

Status/location Message – the “main” message, which is sent by default, as a replyto a command or as the message of choice when reporting emergency situations. Thismessage has a message type code of 0 (zero).

Programming Data – this message is sent as a reply to programming commands, orby request. It contains the new contents of the programmed block, which allows

verification of the programming. This message has a message type code of 3 (three).

Logged Fragment of Forwarded Data – (not supported by CR200/CR200B) thismessage is sent when the terminal, connected to the serial port of Cellocator unit is

forwarding data to the central control through unit's log. This message has a messagetype code of 7 (seven) and contains a fragment of delivered data.

Real Time Forwarded Data – (not supported by CR200/CR200B) this message issent when the terminal, connected to the serial port of Cellocator unit is forwardingdata to the central control without logging it. This message has a message type codeof 8 (eight).

Modular Message – this message is designed to contain different types of data, suchas CAN bus sensors, Cell ID, debug data, and more. This message has a message type

code of 9 (nine).

Self Re-flash Master ACK / NACK Message – a message serving as confirmation ofreception data chunk for self-re-flash. Self re-flash process description is outside the

scope of this document (See Self Re-flash Appendix for more details).

Type 11, New Modular Messages – Type 11 is a modular protocol currently usedfor configuration memory programming and uploading of Cello devices with 8 Kbytesof configuration memory.

2.2 Outbound: Status/Location Message Definition =Message Type 0

2.2.1 Byte-Aligned Table

1System code, byte 1 – ASCII “M”

2 System code, byte 2 – ASCII “C”

3 System code, byte 3 – ASCII “G”

4System code, byte 4 – ASCII “P”

5Message type - byte (a value of 0 for status/location message)

6 Unit’s ID (total 32 bits)

7

8

9


11/292




10 Communication control field (Two bytes)

11

12Message numerator (Anti-Tango™)

13 Unit’s hardware version

14Unit’s software version

15Protocol Version Identifier

16 Unit’s status + Current GSM Operator (1st nibble)

17 Current GSM Operator (2nd and 3rd nibble)

18Transmission Reason Specific Data

19 Transmission reason

20 Unit’s mode of operation

21Unit’s I/O status 1st byte

22Unit’s I/O status 2nd byte

23 Unit’s I/O status 3rd byte

24 Unit’s I/O status 4th byte

25Current GSM Operator (4th and 5th nibble)

26Analog input 1 value

27 Analog input 2 value

28 Analog input 3 value

29Analog input 4 value

30 Mileage counter (total 24 bits)

31

32

33Multi-purpose field: Driver /Passenger/ Group ID, PSP/Keyboard Specific Data,

Accelerometer Status or SIM IMSI34

35

36

37

38

39Last GPS Fix

40

41 Location status (from unit)

42 Mode 1 (from GPS)

43Mode 2 (from GPS)

44 Number of satellites used (from GPS)


12/292




45 Longitude

46

47

48

49Latitude

50

51

52

53Altitude

54

55

56

57Ground speed

58

59

60

61Speed direction (true course)

62

63 UTC time – seconds

64UTC time – minutes

65 UTC time – hours

66 UTC date – day

67UTC date – month

68GPS date – year

69

70 Error detection code – 8-bit additive checksum (excluding system code)

2.2.2 General Details

Rule of thumb: multiple byte fields are always sent Intel-style, meaning, least significant

bytes sent first.

The first 9 bytes / 3 fields (system code, message type and unit ID) are always sent inthe beginning of the message, in the specified order, regardless of the message kind.

What differentiates the message kinds is the value sent in the message type field. The

other fields maintain constant values (system code is a system-wide constant, unit ID is aunique constant value for each Cellocator unit).


13/292




2.2.3 Detailed Per-Field Specifications

2.2.3.1 System Code

System code is a 4-byte value, which identifies the Cellocator system. The field is sent asthe ASCII values of the letters “M”, “C”, “G”, “P” (for IP messages) or “M”, “C”, “G”, “S”(for SMS messages), in that order.

2.2.3.2 Message Type

Message type identifies the kind of message. It allows the receiver to differentiate

between status messages and programming data messages, according to the value sentin this field. Status/location messages contain a value of 0 (zero) in the message type

field.

2.2.3.3 Unit ID

This field contains a value that is uniquely assigned for every Cellocator unit during themanufacturing process. All messages sent by the same Cellocator unit contain the same

value in the Unit ID field.

2.2.3.4 Communication Control Field

This is a bitmapped field, which contains flags that provide information about the messageand the situation in which it was originated.

CR200/B and CR300/B highlighted in the tables below means that the corresponding bit issupported by CR200 and CR200B units.

First byte (10th):

CAN

originatedOdometer1

CAN

originatedSpeed 2

Bytes 33-38 assignment

(Dallas, Trailer, PSP, ACCdata or SIM IMSI)

CR200/B

andCR300/B

Message

source

Garmin

Connected

Garmin

Enabled

CR200/B

andCR300/B

Message

Initiative

Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

Second byte (11th):

CR200/B

andCR300/B

GSMHibernationindication bit

Speed in the

message:Momentary /Max Speed

"Business" /

"Private"Mode

CR200/B and CR300/B

Firmware Sub-version *


“Message initiative” flag states whether the message was “actively” sent (initiated bythe unit, based on its logic and decisions), or if the message is a response to a command

or a query message received by the unit earlier. The flag is low (contains logical “0”) onstandard “active” transmissions, and high (logical “1”) on “passive” replies/responses.

1 Only supported by Compact CAN unit, linked to J1939 (and, of course, FMS) CAN bus. 2 Only supported by Compact CAN unit, linked to J1939 (and, of course, FMS) CAN bus.


14/292




A Cellocator Unit informs the Central Control about the status of Garmin terminal via the"Garmin Enabled" and “Garmin Connected" flags.

The "Garmin Enabled" field monitors the status of the corresponding bit in the

configuration memory (1 when enabled).

The "Garmin Connected" bit monitors the status of the communication between

Garmin and Cellocator Unit. This bit is set with the first correct ACK or NACK receivedfrom the Garmin Unit and is reset upon three missing responses from the Garmin unit

(timeout expiration).

* Refer to “API Garmin Support by Cellocator unit” for more details about Garminintegration.

The “Message source” flag indicates that the message was sent through memory. Theunit tries to resend the message from the memory until the acknowledge, from theControl center, is received. The flag is low (contains logical “0”) on direct messages 3– notover memory, and high (logical “1”) on messages from memory.

The “Bytes 33-38 assignment (Dallas, PSP or other)” bits define the data type,provided in bytes 33-38 of this message according to the below table. Value of this fielddoes not affect CelloTrack/Power.

Type 0,

Byte 41,

Location

Status,

(CR200/B andCR300/B)

Type 0,

byte 10

Description 4-5 of byte 10

Bit 7 Bit 5 Bit 4

0 0 0 Backward compatibility mode (to FW 27c andbelow), Driver ID (Dallas field).

0 0 1 PSP mode is enabled, external Alarm device data is

transmitted in bytes 33-38

0 1 0 The Keyboard is used, keyboard related data is

transmitted in bytes 33-38

0 1 1 Trailer ID is transmitted in bytes 33-38

1 0 0 IMEI sent over bytes 33-38 and location status

(byte 6,5)

1 0 1 CelloTrack Nano use

3 The only exception is the "Transmission Reason 32 - IP changed / connection up" message, which

always requires acknowledge from central control, even if it was sent as a direct message and not

through memory.


15/292




Bytes 33-38 will also contain the data of SIM's IMSI (only in "Wake Up" message,transmission reason 0d202), and a debug data of accelerometer (in all the messages fromCelloTrack units).

Cello-AR

When the AR keypad is enabled in programming, the unit sets bits 4-5 of byte 10 of OTA

Message type 0 to '10' in all the messages except Driver Authentication Update (TR46)and Wake Up (TR202).

IMEI transmission

The IMEI will be sent on bytes 33-38 with its 2 MS-Bits sent in byte 41 bits 6,5

IMEI is defined as 15 decimal digits. Converting the maximal IMEI number

999999999999999 to hexadecimal we get: 38D7EA4C67FFF. The maximal number willoccupy 50 bits which will be sent as follows:

0x03 0xFf 0x7f 0xC6 0xA4 0x7e 0x8d

Two bits: 6,5

In Byte 41

Byte33

Byte34

Byte35

Byte36

Byte37

Byte38

“CAN originated Speed” and “CAN originated Odometer”: These bits are set whenthe unit is configured to report (in message Type 0) speed and the odometer data taken

from the CAN interface and not from the GPS. The flags are informative as the format ofSpeed and Odometer fields in message type zero remain the same, irrespective of the

source of the data.

* Only supported by Compact CAN unit, linked to J1939 (and, of course, FMS) CAN bus.

Firmware Sub-Version: This field (5 bits) defines the firmware sub-version of the

Cellocator Unit. The number of Cellocator firmware is built from two parts:

[Firmware version][Firmware sub-version], where firmware version defines the list ofsupported features and subversion defines the revision.

For instance: 30':

Firmware: 30

Revision: ' (0)

Firmware Sub-version field

(decimal value)

Identifier

0 No identifier

1 a

2 b

3 c

~ ~

26 z


16/292




GSM hibernation indication bit: The bit monitors hibernation status upon messagedelivery and not upon message generation. Consequently the bit is set to 1 only when themessage is sent during GSM peeking

Speed in the message: The bit indicates whether the speed reported in this message is

a Momentary speed (0) / or Maximal Speed recorded from the last event (1).

"Business" / "Privet" Mode: It is possible to enable usage of "Lock input"as a"Private"/"Business" mode toggle.

If enabled every time the Lock input is triggered the unit switches to the opposite mode

("Private"/"Business"/"Private").

The default mode is "Business".

The "Private" mode is finished upon:

1- The active ID is erased from RAM after journey end.

2- Lock Input trigger.

During "Private" mode the unit is continually set bit 5.

2.2.3.5 Message Numerator (Anti-Tango™)

The Message numerator field contains a value that is increased after every self-initiated

generation of a message (in cases where an acknowledge from Central control wasreceived).

-------------------------------------------------------------------------------------------------

NOTE: The unit assigns different message numerator sequences for the logged eventsand for real-time events. In passive transmission (reply to command), the value in this

field represents the number from the Command Numerator Field in an incoming

command. (See Command Channel - Inbound Messages, Section 2.7.15).

-------------------------------------------------------------------------------------------------

When the unit is reset/powered-up, this value is set to zero. This provides a way to

chronologically sort incoming messages from a certain unit, in case an anachronisticcommunication medium is used.

2.2.3.6 Unit’s Hardware, Firmware and Protocol Versions

Units HW version

This byte defines the unit's HW version and the ID of the modem embedded in it. Till nowthe addressing scheme defined 5 bits for HW ID (PCB ID) and 3 bits for Modem Code, thislimited the number of products to only 32 products.

As for new products, starting from CelloTrack Nano, an alternative backwards compatible

approach will be used, in which each unit's HW will be uniquely defined by a completebyte defined as Unit HW Version ID.


17/292




The table for legacy products, which will be identified by the Legacy HW ID is detailedbelow:

HW ID

(8 Bits)

Legacy

HW ID

(5 Bits)

Product Name Modem

Code

(3 Bits)

Modem Type

225 1 CR300 7 GE864-QUAD-V2

2 2 CFE 0 No Modem

194 2 PHSN RF Head 6 No Modem

35 3 Olympic 1

No Modem - Tetra/Astro

external modem

4 4 Compact Fleet 0 Sony/Erickson GR47

36 4 Compact Fleet 1 Enfora Enabler II-G

68 4 Compact Fleet 2Telit GE864, old retrofit boa(obsolete)

100 4 Compact Fleet 3 Telit GE864, mute support

5 5 Compact Security 0 Sony/Erickson GR47

37 5 Compact Security 1 Enfora Enabler II-G

69 5 Compact Security 2

Telit GE864, old retrofit boa

(obsolete)

101 5 Compact Security 3 Telit GE864, mute support

39 7 Compact CAN 8 Sensor 1 Enfora Enabler II-G

71 7 Compact CAN (obsolete) 2

Telit GE864, old retrofit boa

(obsolete)

103 7 Compact CAN TOB 3 Telit GE864, mute support

9 9 370-50 0 Sony/Erickson GR47

105 9 370-50 3 Telit GE864, mute support

170 10 CelloTrack 1 Output 5 Enfora 3235 11 CR300B 7 GE864-QUAD-V2

172 12 CelloTrack 5 Enfora III

78 14 Cello-IQ GNSS 2 GE910 QUAD V3

113 17 Compact CAN TOB 3 Telit GE864, mute support

18 18 CelloTrack T (2G) 0 Telit GE910 QUAD (v2) (V3)


18/292




HW ID

(8 Bits)

Legacy

HW ID

(5 Bits)

Product Name Modem

Code

(3 Bits)

Modem Type

82 18 CelloTrack T (3G) 2 Telit HE910 NAD

19 19 CelloTrackPower T (2G) 0 Telit GE910 QUAD (v2) (V3)

83 19 CelloTrackPower T (3G) 2 Telit HE910 NAD

20 20 Cello-CANiQ (NA) 0 UE910 NAR

52 20 Cello-CANiQ (EU) 1 UE910 EUR

84 20 Cello-CANiQ (2G) 2 GE910 QUAD V3

182 22 compact EOB 5 Enfora III

183 23 CelloTrack Power 5 Enfora III

216 24 Cello (Telit) 6 Telit GE864, automotive

249 25 Cello Cinterion 7 Cinterion BGS3

220 28 (Compact (TOB)) in use 6 Telit GE864, automotive

221 29 CR200 6 Telit GE864, automotive

222 30 CR200B 6 Telit GE864, automotive

223 31 Cello-IQ 6 Telit GE864, automotive

The table for new products (CelloTrack Nano, Cello-D, CR300B 3G, and on), which will

be identified by the HW ID is detailed below:

HW ID

(8 Bits)

Legacy

HW ID

(5 Bits)

Product Name Modem

Code

(3 Bits)

Modem Type

38 6 Cello-D 1 UE910 NAR

43 11 CR300B 3G NA GNSS 1 UE910 NAD

75 11 CR300B 3G EU GNSS 2 UE910 EUD

107 11 CR300B 2G 3 GE910 QUAD V3

116 20 Cello-CANiQ (2G) – Car Sharing 3 GE910 QUAD V3

53 21 PointerCept Base Station 1 No Modem

26 26 CelloTrack Nano 20 0 Cinterion BGS2-W

58 26 CelloTrack Nano 20 3G EU 1 Cinterion EHS5-E


19/292




HW ID

(8 Bits)

Legacy

HW ID

(5 Bits)

Product Name Modem

Code

(3 Bits)

Modem Type

90 26 CelloTrack Nano 20 3G NA 2 Cinterion EHS5-US

122 26 CelloTrack Nano 20 3G Worldwide 3 Cinterion EHS6A

136 8 CelloTrack Nano 10 GNSS 4 Cinterion BGS2-W

168 8 CelloTrack Nano 10 3G GNSS 5 Cinterion EHS6A

(Byte 15) Protocol Version Identifier and Unit's functional Mode

Feature package:

0 = Old/Legacy (not to be used innew units)

1 = "IQ30"

2 = "IQ40"

3 = "IQ50"

AR FunctionalityEnabled

0 - Fleet base

1 - ARfunctionalityadded to Fleet

Protocol Version


2.2.3.7 Unit’s Status and Current GSM Operator – 1st

This is a bitmapped field that provides information about current unit status and

functionality.

GPS comm.: describes the status of communication with the GPS module (0=available,

1=not available/error).

Home/Roam network: describes in what GSM network the unit is currently registered:(0 – Home network, 1 – Roam network)

Correct Time: confirms the validity of the timestamp in the message (correct – 0 orestimated/invalid -1)

Source of Speed: 0 – Estimated by GPS; 1 – Pulse frequency input.

GPSComm.

Home/RoamNetwork

CorrectTime

Sourceof Speed

Current GSM Operator (PLMN), 1st nibble


2.2.3.8 Current GSM Operator Report

The current GSM Operator (PLMN) is represented as a 5 character hexadecimal number.After conversion into decimal it represents the MCC-MNC of a cellular operator (country

code + network number). The 5 PLMN nibbles (nibble for each character) are provided in

the following places:

Byte 16 (4 LSbits, 1 nibble)

Byte 17 (2 nibbles)


20/292




Byte 25 (2 nibbles), 5th byte of IO

Byte 16 (4MSbits,1 nibble)

Byte 17 Byte 25, 5th byte of IO

Nibble 1 Nibble 2 Nibble 3 Nibble 4 Nibble 5

2.2.3.9 Byte 17 - Current GSM Operator report (2nd and 3rd)

Current GSM Operator (PLMN), 2nd nibble Current GSM Operator (PLMN), 3rd nibble


2.2.3.10 Byte 18 - Transmission Reason Specific Data

Additional information Related with the transmission reasons (From Byte 19)

Note that CR200/B and CR300/B in the table below means that the corresponding bit is

supported also by CR200 and CR200B units. CR200B and CR300B means that thecorresponding bit is supported by CR200B units.

TransmissionReason

Transmission Reason Specific Data Usage (As function of theTransmit reason)

8

Towing

0 Location change detected on Ignition is Off

1 Towed mode start

2 Towed mode stop

9Robbery mode

Robbery modeStationary

Robberysession

suspended

Immobilization

session

ended

Immobilization

sessionstarted

NearDriverDoor

RobberyEvent

DriverDoor

RobberyEvent

Stationary

RobberyEvent

Robberywhile

DrivingEvent


14Garage Mode

Direction:

entry to GarageMode ("0")exit from GarageMode ("1")

Exit from Garage reason:

0 - Manual mode change1 – Timeout expiration2-3 - Reserved

Reserved

Bit 7 Bit 6 Bit 5 Bits 0 – 4


21/292




Transmission

Reason

Transmission Reason Specific Data Usage (As function of the

Transmit reason)

15

Crash

detectionevent

Reserved Light crash event Heavy

crashevent

The peak RMS value of the

impact in 1g resolution minus1g

(16g=0xF, 1g=0x0)

Bits 7 – 6 Bit 5 Bit 4 Bits 0 – 3

21

Coastingdetection

(Speed andRPM)

0 – Stop

1 – Start

22violation of 1st

additional GPfrequencythreshold

0 Falling

1 Raising

23

violation of2nd additional

GP frequency

threshold

0 Failing

1 Raising

34Over-speed

start

0 – Plain1 – Threshold changed by input

42

Over-speedend

0 – Plain

1 – Threshold changed by input

46

DriverAuthenticationUpdate

For Cello-AR unit only:

0 – Driver ID

1- Code from SPC Keyboard

For other units:

User Type

"0" – Driver ID

"1" – Passenger ID

Unused Group ID status

"1" – authenticated,

"0" – not authenticated

Bit 0Bits 1-6Bit 7

NOTE: If “Enable Pre-defined driver ID's list" (Add 123, Bit 2) is enabled and

the ID is not authenticated, The 6 bytes Dallas field must be ignored.


22/292




Transmission

Reason


Transmit reason)

Door

48,64 : Door

7 6 5 4 3 2 1 0

Door STR Description

0 Normal

1 Robbery Event

2 CarSharing2: End Of Reservation

Shock

49, 65Shock STR Description

0 Normal

1 CarSharing2: Modem Off Ended

2 CarSharing2: Modem Off Started

3 CarSharing2: Business Mode started

4 CarSharing2: Private Mode started

69

Start Report

Transmission Reason Specific Data Usage (As functionof the Transmit reason)

0 Normal – Legacy support (accelerometerbased)

1 GPS based start event (CelloTrack family only)


23/292




Transmission

Reason


Transmit reason)

91

Message from

Keyboard (ForCello AR unit

only)

Description

STR Description

0 Keypad Undefined Failure

1 Immobilizer device wires disconnection

2 Keypad locked

3 Relay malfunction

4 Ignition wire disconnected

5 Starter signal detection

6 Starter malfunction

7 Hotwiring Detection*

8 Primary cut unit failure

9 Secondary cut unit failure

10 Wrong keyboard ID detected

11 Pairing Accomplished

12 Keypad flash failed

13 Alarm Cadence Activated by Keyb

14 Alarm Cadence Deactivated by Keyb

128 ECALL Initiated

129 BCALL Initiated

92

Satellite

communicationevents

Description

STR Description

0 Reserved

1 Health status report – Failure

2 Health status report – Restore

3 periodic distress event


24/292




Transmission

Reason


Transmit reason)

102 CelloTrack family: The CelloTrack changed its Activation mode

STR Description

0 CelloTrack about to move to Inactive mode

1 CelloTrack Activated

158

Tamper activeevent

STR Description

0 Nano: Removal from cradle

1 Reserved

2 Nano and PointerCept: Tilt tamper.

(Unit has been tilted more than the predefined thresholdangle).

3 Cello-D enclosure opened

159

Tamper

inactive event

STR Description

0 Nano: Back to cradle

1 Reserved

2 Spare

3 Cello-D enclosure closed

160

CFE Event

Description:

STR Description

0 CFE Disconnected Event

1 CFE Connected Event

2 CFE Reprogramming Succeeded

3 CFE Reprogramming Failed


25/292




Transmission

Reason


Transmit reason)

164

Nano eventSTR Description

0 Reserved

1 Impact event

2 Orientation change event

3 Man down event

4 Open package

5 Close package

6 Reserved

7 Reserved

8 Reserved

9 Work ID promoted event

10 MultiSense event (details about this event will be passed on the

Dallas bytes)

11 Temperature event

12 Humidity event

13 Check-in event

14 Open door/window

15 Close door/window

16 Free-fall event

167

CAN-GPS

SpeedCalibrationMode

STR Description

0 CAN-GPS Calibration Start

1 CAN-GPS Calibration Accomplished

2 CAN-GPS Calibration Failed

3 CAN-GPS Calibration Status Unknown

CR200/B


26/292




Transmission

Reason


Transmit reason)

170

SMS delivery4 STR Description

0 N/A

1 SMS message has been delivered

2 SMSC is still trying to deliver the message

3 SMSC is not making any more delivery attempts / Failed todelivered the SMS message

4 No Response from SMSC

5 Rejected due to SMS message pending

191Geo-Hotspot

violation

Direction: entryto hot spot ("1")exit from hot spot("0")The index of thegeo-zone

The index of the geo-zone.


Bits 0-6 make up the index of the geo-zone. Most significant bit (bit 7)

indicates direction: entry to hot spot ("1") or exit from hot spot ("0")

CR200/B and

CR300/B

192 -Frequency

MeasurementThresholdViolation

Violatinginputnumber

Door

Shock

Violationstatus

0 – Violationstart

1 – ViolationEnd

Violationtype

0 – Threshold

1 - Range

Violationdirection

In case ofThreshold0 – Lowthresh.1 –Highthresh.

Reserved

In case ofrange0 –Keep In1 – Keep Out


194 - Analog

MeasurementThreshold

Violation

Violatinginputnumber

Door

Shock

Violationstatus

0 – Violationstart

1 – Violation

Violationtype

0 – Threshold

1 - Range

Violationdirection

0 – Highthresh.

1 – Lowthresh.

Reserved

4 Applicable for FW release 32k only


27/292




Transmission

Reason


Transmit reason)

End


199 Trailer Connection Status

0 for trailer disconnected, 1 for trailer connected

CR200/B and

CR300/B

200

AHR (AutoHardwareReset)

The AHR reason:

0 – Modem non responsiveness

1 – Registration problem

2 – GPS AHR

The number of performed AHR attempts


205 Garmin

connection

status changed

0 – Garmin Disconnected

1 – Garmin Connected

CR200/B andCR300/B

206

Jamming

Detection

GSM Jamming Event specific reason.

Not used GSMJamming IgnitionState:0-Legacy (Notassociated withIgnition state)

(Advanced JammingMode)1 – Ignition Off2 - Ignition On

GSM JammingState:0-GSM JammingDetection StartDetected1-GSM JammingDetection EndDetected


CR200/B and

CR300/B

207 Radio OffMode

For CelloTrack and CelloTrack Nano:

GPSStatus

(Bit 0)

ModemStatus

(Bit 1)

Description

0 0 (For Cello variants only)

Detection of internal backup battery voltagedischarging to 3.25V or below for longer than 1second (100 samples). The unit will enter

EarlyRadioOffEvent

GPSStatus0 – Off1 - On

ModemStatus0 – Off1 - On



28/292




Transmission

Reason


Transmit reason)

shipment mode only after generating this event.

(For CelloTrack, CelloTrack Power)

CelloTrack battery voltage decreases below 3.4

Volts for 30 consecutive seconds will initiate the

following actions:

1. A Radio-Off event is generated and

logged.2. All log history is saved into nonvolatile

memory.

3. Cellular modem and GPS are turned off.4. The Firmware enters idle state

0 1 N.A

1 0 (For Cello variants only)

Detection of internal backup battery voltage

lower than 3.5V (on any temperature) for longerthan 1 second (100 samples) upon sole workfrom internal backup battery. The unit will switch

off the radio 2 seconds after event generation.

Once switched off, the modem will be switchedback on only upon main power reconnection.

1 1 (For CelloTrack, CelloTrack Power,CelloTrack Nano)

CelloTrack battery voltage decreases below 3.6

Volts for 30 consecutive seconds will initiate an

early Radio Off event designed to alert the serverthat the unit is about to enter Radio Off soon.

Early

RadioOff

Event

(Bit 2)

Description

0 Normal “Radio Off” Event

1 (For CelloTrack, CelloTrack Power,CelloTrack Nano)

Early “Radio Off” Event, this message shall besent when the battery voltage is 3.6V or


29/292




Transmission

Reason


Transmit reason)

below for 30 consecutive measurements.

212 The index of the geo-zone indicating Speed limiting Geo-Fence start event.

213 The index of the geo-zone indicating Speed limiting Geo-Fence End event.

222 PointerCept Event

0- Reserved

1- PointerCept Beacon mode started

2- PointerCept Beacon mode ended

223 CPIN error event

252

COM-LocationGlancing

(CelloTrackfamily + Cello-

D Units only)

0 - Plain COM-Location Glancing

1 - ST (Specific Time) COM-Location Glancing 2 - Nano improved glancing event

8 – Car Sharing only: No-Show-Up Glancing

CR200/B andCR300/B

253

Violation ofKeep In Fence

The index of the geo-zone.

CR200/B and

CR300/B

254

Violation ofKeep Out

Fence

CR200/B and

CR300/B

255Violation of

Way Point

2.2.3.11 Byte 19 - Transmission Reason

This field contains the reason why the unit is transmitting. Note that this value is valid

only for self-initiated active transmissions (i.e. transmissions that the unit generatedautomatically because of its logics, in contrast to reply transmissions). Reply

transmissions (i.e. transmissions where the message initiative flag is turned on) containthe last transmission reason that was used.


30/292




Value SupportedbyCR200/B

SupportedbyCR300/B

Supportedby Nano

Reason

4 √ Emergency (Distress) mode by command

5 √ Door Opened (Security Event)

6 Engine Activated (Security Event)

7 √ √ GPS Disconnected

8 Location change detected on Ignition is Off See TR specidata section2.2.3.10 for

more details

9 Robbery Mode

11 √ √ Communication Idle

12 Disarmed from emergency states

13 Keypad Locked (wrong codes punched in)

14 Garage Mode (see Transmission Reason Specific Data (secti2.2.3.10)).

15 Crash detection event

19 Alarm Triggered by "Lock" input

21 Coasting detection (Speed and RPM)

22 Violation of 1st additional GP frequency threshold

23 Violation of 2nd additional GP frequency threshold

25 Speed detected when Ignition is Off

27 √ √ GPS connected

31 √ √ √ Reply to Command

325 √ √ √ IP changed / connection up

33 √ √ √ GPS Navigation Start

34 √ √ √ Over-speed Start

35 √ √ √ Idle Speed Start

5 Always requires acknowledge from central control, even if it was sent as a direct message and notthrough memory.


31/292





SupportedbyCR300/B

Supportedby Nano

Reason

36

√ √ √ Distance

37 √ √ Engine Start; Ignition Input – active (high)

38 √ √ √ GPS Factory Reset (Automatic only)

40 IP Down

41 √ √ √ GPS Navigation End

42 √ √ √ End of Over-speed

43 √ √ √ End of Idle Speed

44 √ √ √ Timed Event6

45 √ √ Engine Stop; Ignition Input – inactive (low)

46 Driver Authentication Update / Code received for Cello-AR

47 Driving Without Authentication

48 √ Door Close Event

49 √ √ Unlock2 / Shock Inactive Event

CelloTrack: GP1 Inactive Event

50 CFE input 6 inactive Event

CelloTrack: GP2 Inactive Event

51 Volume Sensor Inactive Event

52 Hotwire Sensor Inactive Event

53 √ √ √ Driving Stop Event

54 Distress Button Inactive Event

55 Unlock Input Inactive event

56 Oil Pressure Sensor Inactive Event

57 CFE input 1 inactive

58 Lock input inactive event



6 In Cello-CANiQ (product tree), this event is used also for the 1 second GPS data reporting.


32/292





SupportedbyCR300/B

Supportedby Nano

Reason



63 Ignition Input as GP inactive Event

64 Door Open Event

65 √ √ Unlock2 / Shock Active Event

CelloTrack: GP1 Active Event

66 CFE input 6 inactive Event

CelloTrack: GP2 Active Event

67 Volume Sensor Active Event

68 Hotwire Sensor Active Event (370-50)

69 √ √ √ Driving Start Event

70 √ Distress Button Active Event

71 Unlock Input Active Event

72 Oil Pressure Sensor Active Event

73 CFE input 1 active Event

74 Lock input active event





79 Ignition Input active or CFE input 6 active

80 √ √ Main Power Disconnected

81 √ √ √ Main Power Low LevelIn CelloTrack Nano: Battery low level

82 √ √ √ Backup Battery DisconnectedIn CelloTrack3G Power: Charging Power Disconnected

In CelloTrack Nano: Charging Power Disconnected (USB)

83 √ √ Backup Battery Low Level

84 √ Halt (movement end) event


33/292





SupportedbyCR300/B

Supportedby Nano

Reason

85

√ Go (movement start) event

87 √ √ √ Main Power Connected (be unconditionally logged upon an ipower up)

88 √ √ √ Main Power High LevelIn CelloTrack family: Battery high level

89 √ √ √ Backup Battery ConnectedIn CelloTrack3G Power: Charging Power Connected

In CelloTrack Nano: Charging Power Connected (USB)

90 √ √ Backup Battery High Level

91 Message from SPC Keyboard Supported by

Cello-AR systeonly. See TR

specific data

section 2.2.3.1for more detai

92 Satellite communication events

99 √ Harsh Braking Sensor Triggered

100 √ Sudden Course Change Sensor Triggered

101 √ Harsh Acceleration Sensor Triggered

102 √ CelloTrack family, Activation mode change

104 Trigger on General Input

Applicable only

SecurityModifications

105 Arm Input triggered

106 Disarm Input triggered

107 Remote Controller input trigger

108 Odometer pulse received

109 Unlock Pulse trigger

110 Lock Pulse trigger

111 Triggers on Blinkers

112 One of the protected outputs failure

144 Reset while armed

145 Wireless Panic button (for RB modification

only)

150 Signal Learned


34/292





SupportedbyCR300/B

Supportedby Nano

Reason

151 Learning Failed

152 Received Signal A

153 Received Signal B

154 This TR will be sent when the unit detects

main power low or disconnect andhibernation mode “D” starts

158 √ Tamper switch Active Event (For CelloTrack family on

159 √ Tamper switch Inactive Event (For CelloTrack familyonly)

160 CFE Event

161 "Unlock" input triggered

162 MODECON gas leak start event

163 MODECON gas leak stop event

164 √ Nano event

165 √ Nano location report in POD mode

167 CAN-GPS Speed Calibration Mode

1707 √ SMS Delivery

190 √ No Modem Zone entry

191 √ √ √ Geo-HOT Spot violation SeeTransmissReason

Specific D

(section2.2.3.10)

more deta

192 Frequency Measurement Threshold Violation

193 √ √ Reserved for Type 9 internal use: CELL_ID

194 Analog Measurement Threshold Violation See

Transmiss

ReasonSpecific D

(section2.2.3.10)

7 Applicable for FW release 32k only


35/292





SupportedbyCR300/B

Supportedby Nano

Reason

more deta

195 √ √ Reserved for Type 9 internal use: CFE_INPUTS_REPORT

196 √ √ Reserved for Type 9 internal use: ONEWIRE_TEMPETURE

197 √ √ Reserved for Type 9 internal use: EOF_TRIP_TYPE

199 Trailer Connection Status See Transmission

Reason Specific D(section 2.2.3.10)

more details.

200 √ Modem's Auto Hardware Reset (AHR)

201 PSP – External Alarm is Triggered Only for Fleet editwhile PSP is enablRefer to bytes 33-

for specific reasonthe trigger.

202 √ Wake Up event If enabled in the Nit is sent after

Hardware Reset(including AHR) ev

when activetransmissions are

disabled. IncludesIMSI of SIM card i

bytes 33-38.

203 √ Pre-Hibernation event If enabled, genera15 seconds beforeexpiration of

Hibernation Mode

Delay timeout.

204 √ Vector (course) change Curve smoothingevent

205 Garmin connection status changed See Transmission

Reason Specific D(section 2.2.3.10)

more details.206 √ √ √ Jamming detection

207 √ √ √ Radio Off Mode

208 Header ErrorSelf Re-flashProcessing.209 Script Version Error

210 Unsupported Command


36/292





SupportedbyCR300/B

Supportedby Nano

Reason

211 Bad Parameters

212 Speed limiting Geo-Fence.

GeoFence over Speed Start Event. See Transmission Reaso

Specific Data for more details (Section 2.2.3.10 ).

213 Speed limiting Geo-Fence.

GeoFence over Speed End Event. See Transmission Reason

Specific Data for more details (Section 2.2.3.10 ).

214 √ √ Reserved for Type 9 internal use: PULSE_COUNTER

221 √ √ Reserved for Type 9 internal use: ERROR_EVENT

222 PHSN Event

223 CPIN Error Event

232 External NVM Error

239 Max Error

245 Upload Mode

246 Execute Mode

247 √ Finish Mode

248 Post Boot Mode

252 √ COM-Location Glancing (CelloTrack family + Cello-D Uonly)

253 √ √ √ Violation of Keep In Fence. See Transmission Reason SpecifData (section 2.2.3.10) for more details.

254 √ √ √ Violation of Keep Out Fence. See Transmission Reason SpecData (section 2.2.3.10) for more details.

255 √ √ √ Violation of Way Point. See Transmission Reason Specific Da(section 2.2.3.10) for more details.

2.2.3.12 Unit’s Mode of Operation

The functioning of the Cellocator unit can be generalized as a finite state machine model,with a few “stages” of operation. The “current stage” is referred to as “unit mode”, or “mode of operation”. Every possible stage is assigned a certain value, which istransmitted in this field:

Value Meaning


37/292




Value Meaning

0x00 Standby Engine On

0x01 Standby Engine Off

0x02 Passive Arming (For Security modifications)

0x03 Pre-Arming (For Security modifications)

0x04 Alarm Armed (For Security modifications)

0x05 Silent Delay (For Security modifications)

0x07 Alarm Triggered (For Security modifications)

0x0E Garage Mode

0x0F Transmissions Delay (for older versions FW25 and below)0x10 Towed mode (same as Standby Engine On, except the fact that the

ignition switch remains off)

2.2.3.13 Unit’s I/O Status

The Cellocator unit is provided with many I/Os (inputs/outputs). Each I/O may be “high”or “low” at a given moment. The I/O status field is a bitmapped representation of all ofthe I/O’ s physical levels. Note that the I/O lines that have been configured to be invertedwill affect the application but will not be shown in this field as it only represent the raw

physical signals read from the HW.

First byte of I/O status field (sensors inputs):

GP Input Panic

Driving Status(Ignition or

accelerometerbased)

Ignition /

MovementSensor

CFE In 1

Volume /

GP1 Input2

Hood /

GP1 Input1

Shock /Unlock 2(15/20)

Distressinput

Door /

TamperSwitch


Allocation per product:

Product Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

Compact Fleet

(4 inputs

variants)

- Panic Ignition - - - Shock Door

Compact Unlock Panic Ignition - - - Shock/ Door


38/292





Security (and 6

inputs fleet,

TOB and EOB)and Cello-R

(pin11/20)

Unlock2(pin15/20)

370-50 GP input Panic Ignition - Volume Hood Shock Door

Olympic - Panic Ignition - - - Shock -

CelloTrack/T

(Power version

or not)

- - Movement

sensor

CFE

In 1

GP

input2

(Shock)

GP

input1

(Door)

Distress

input

Tampe

Switch

Cello Unlock(pin11/20)

Panic Driving Status(Ignition oraccelerometer

based)

CFE

In 1

- - Shock Door

CR200/

CR200B

- - Driving Status(Ignition oraccelerometerbased)

- - - Shock -

CR300/

CR300B

- - Driving Status

(Ignition oraccelerometerbased)

- - - Shock Door

CelloTrack

Output

- - Movementsensor

- GP1input2

GP1input1

Distressinput

TampeSwitch

CelloTrackNano

Packageis open

USBpowerconnected

Movementsensor

Button _1

- GPinput1

(Powerharness)

Button_2

TampeSwitch

Second byte of I/O status field (sensors inputs):

Ignition port

status

Accelerometer

status

ExternalAlarm

Status/

CFE IN 6

ExternalAlarm

Trigger/

CFE IN 5

Odometer/CFE IN 4

RC data/

Lock(5/20)

Disarm

/

CFE IN 3

Arm

/

CFE IN 2


Allocation Per Product:


39/292




Product Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit

0

Compact Fleet (4

inputs variants)

- - - - - - - -

Compact Security

(and 6 inputs

fleet, TOB andEOB) and Cello-R

- - - - - Lock(pin5/20)

- -

370-50 - - - - Odometer RC data Disarm Arm

Olympic - - ExternalAlarmStatus

ExternalAlarmTrigger

- - - -

CelloTrack/T

(Power version or

not)

- - CFE

In 6

CFE

In 5

CFE

In 4

- CFE

In 3

CFE

In

Cello Ignitionportstatus

Accelerometerstatus

CFE

In 6

CFE

In 5

CFE

In 4

Lock(pin5/20)

CFE

In 3

CFE

In

CR200/CR200B Ignitionportstatus

Accelerometerstatus

- - - - Shock -

CelloTrack Output - - CFE

In 6

CFE

In 5

CFE

In 4

- CFE

In 3

CFE

In

CR300/CR300B Ignitionportstatus

Accelerometerstatus

- - - - - -

CelloTrack Nano - - - - - - - -

Third byte of I/O status field (Compact, Cello and CRx00)

CFE OUT 5 CFE OUT 4 CFE OUT 3 CFE OUT 2 GPS power Grad. Stop SirenControl

CFE OUT 1


Allocation per product:


Compact

Fleet (4

inputsvariants)

- - - - GPSPower

Grad.Stop

Siren

Control

-

Compact - - - - GPS Grad. Siren -


40/292





Security

(and 6

inputs fleet,TOB and

EOB) and

Cello-R

Power Stop Control

370-50 GSMWake

SensorsVoltage

GeneralOutput

HoodLock

GPSPower

PWMImmob.

Siren OutModem DTRout

Olympic - - - - GPSPower

Grad.Stop

Siren

Control

-

CelloTrack/T

(Power

version ornot)

CFEOUT 5

CFE OUT4

CFE OUT3

CFEOUT 2

GPSPower

CFE OUT 1

Cello CFEOUT 5

CFE OUT

4

CFE OUT

3

CFE

OUT 2

GPS

Power

Grad.

Stop

Siren

Control

CFE OUT 1

CR200/CR200B

- - - - GPSPower

- - -

CR300/CR300B

- - - - GPSPower

Grad.Stop

- -

CelloTrack

Output

- - - - - v Siren

Control

-

CelloTrackNano

- - - - GPSPower

- - -

Fourth byte of I/O status field (Compact and Cello)

Chargerstatus:

0 – notcharging

1- charging

CFE OUT6

StandardImmobilizer

Unused

Blinkers(Globaloutput) /CelloTrackOutput

Unused

LED out


Allocation per product


Compact Fleet

(4 inputs

variants)

Charger

status:

Standard

Immobilizer

Blinkers LED out


41/292





Compact

Security (and

6 inputs fleet,TOB and EOB)

and Cello-R

Chargerstatus:

StandardImmobilizer

Blinkers LED out

370-50 Hands-freeControl

UnlockOut

UnusedDoor LockOut

BlinkersOut

BuzzerOut

StopLightsOut

LED out

Olympic Chargerstatus:

StandardImmobilizer

Blinkers LED out

CelloTrack/T

(Power

version ornot)

Charger

status:

CFE

OUT 6

Standard

Immobilizer

External

PowerConnected

0 – notconnected

1 -connected

LED out

Cello Chargerstatus:

CFEOUT 6

StandardImmobilizer

Blinkers LED out

CR200/

CR200B

Chargerstatus:

Blinkers LED out

CR300/CR300B

Chargerstatus:

StandardImmobilizer

Blinkers LED out

CelloTrackOutput

Chargerstatus:

Blinkers

CelloTrack

Nano

Charger

status:

Byte 25: Current GSM Operator (4th and 5th)

Current GSM Operator (PLMN), 4th nibble Current GSM Operator (PLMN), 5th nibble


2.2.3.14 Analog Inputs

The Cellocator unit may handle up to 4 discrete analog inputs. These inputs are

multiplexed and sampled with a 10-bit deep analog/digital converter (in Cello 14 bits). 2

(or, in case of Cello - 6) bits of the conversion results are stripped, according to the input,and the result for each channel is sent in this field.

In all the Cellocator units except Cello and CR200/CR200B the allocation of themeasurements is fixed in the message as follows:


42/292




In all units except Cello and CR200/CR200B

The first byte in the field represents the main supply voltage. The main supply voltage iscontinuously monitored, and this field represents the current updated measured voltage.

This value should be multiplied by the following number to get a value in Volts:Compact: 0.1217320

CelloTrack: 0.019531258

370-50: 0.1212565

The second byte in the field represents backup battery voltage, when it was last tested.Unlike the main supply voltage, this input is not constantly monitored. It is tested only

when the backup battery is not being charged: in Standby Engine Off mode. If "Low

Backup battery" event was not previously detected the unit constantly charges Backupbattery during Standby Engine On.

This value should be multiplied by the following number to get a value in Volts:

Compact:0.0474599

370-50: 0.0472745

CelloTrack – not used

The third byte monitors either the Main Power regulated voltage (backward compatibility)or the 2nd Analog input (on pin 14), as per setting in NVM (byte 465, bit 2). This byte is

not used in CelloTrack and CelloTrack Power.

If set as Main Power regulated voltage, it monitors an internal voltage of the unit, usedmainly for debugging reasons. It should be multiplied by 0.01953125 to get the voltage in

Volts.

If set as a second analog input – it monitors a voltage measured on pin 14 of the

interface connector, if measurement is enabled in the NVM. (Refer to the ProgrammingManual document, Events masking section – Analog Input Measurement Mask, 2ndAnalog input). The measured signal is between 0 and 2.5 Volts, resolution of 9.8mV.

The source of the 3rd byte of analog inputs measurement (regulated voltage or second

analog input) is monitored in bit 0 of byte 41. Please refer to Section 2.2.3.19.

The fourth byte 9represents voltage on the first optional analog input (pin 15) in the event

that measuring is enabled in the NVM (Refer to the Programming Manual Document,Events masking section, Analog Input Measurement Mask, Optional Analog input). The

Measured signal is between 0 and 2.5 Volts, resolution of 9.8mV.

This byte is not used in CelloTrack,

Date post:	06-Jul-2018
Category:	Documents
Upload:	wilson-geovanny-cabezas-tapia
View:	444 times
Download:	34 times

EVENTOS Cellocator Wireless Communication Protocol

Documents