EVENTOS Cellocator Wireless Communication Protocol

Cellocator Wireless
Communication Protocol
Proprietary and Confidential

Version 4.1.8.0
Revised and Updated: February 7, 2016
Copyright 2015 by Pointer Telocation, Ltd.
Cellocator Wireless
Legal Notices
IMPORTANT
1. All legal terms and safety and operating instructions should be read thoroughly before
the product accompanying this document is installed and operated.
2. This document should be retained for future reference.
3. Attachments, accessories or peripheral devices not supplied or recommended in
writing by Pointer Telocation Ltd. May be hazardous and/or may cause damage to the
product and should not, in any circumstances, be used or combined with the product.
General
The product accompanying this document is not designated for and should not be used in
life support appliances, devices, machines or other systems of any sort where any
malfunction of the product can reasonably be expected to result in injury or death.
Customers of Pointer Telocation Ltd. Using, integrating, and/or selling the product for use
in such applications do so at their own risk and agree to fully indemnify Pointer Telocation
Ltd. For any resulting loss or damages.
Warranty Exceptions and Disclaimers

Pointer Telocation Ltd. Shall bear no responsibility and shall have no obligation under the
foregoing limited warranty for any damages resulting from normal wear and tear, the cost
of obtaining substitute products, or any defect that is (i) discovered by purchaser during
the warranty period but purchaser does not notify Pointer Telocation Ltd. Until after the
end of the warranty period, (ii) caused by any accident, force majeure, misuse, abuse,
handling or testing, improper installation or unauthorized repair or modification of the
product, (iii) caused by use of any software not supplied by Pointer Telocation Ltd., or by
use of the product other than in accordance with its documentation, or (iv) the result of
electrostatic discharge, electrical surge, fire, flood or similar causes. Unless otherwise
provided in a written agreement between the purchaser and Pointer Telocation Ltd., the
purchaser shall be solely responsible for the proper configuration, testing and verification
of the product prior to deployment in the field.
POINTER TELOCATION LTD.S SOLE RESPONSIBILITY AND PURCHASERS SOLE REMEDY
UNDER THIS LIMITED WARRANTY SHALL BE TO REPAIR OR REPLACE THE PRODUCT
HARDWARE, SOFTWARE OR SOFTWARE MEDIA (OR IF REPAIR OR REPLACEMENT IS NOT
POSSIBLE, OBTAIN A REFUND OF THE PURCHASE PRICE) AS PROVIDED ABOVE.
POINTER TELOCATION LTD. EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES OF ANY
KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, SATISFACTORY
PERFORMANCE AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL
POINTER TELOCATION LTD. BE LIABLE FOR ANY INDIRECT, SPECIAL, EXEMPLARY,
INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOSS
OR INTERRUPTION OF USE, DATA, REVENUES OR PROFITS) RESULTING FROM A BREACH
OF THIS WARRANTY OR BASED ON ANY OTHER LEGAL THEORY, EVEN IF POINTER
TELOCATION LTD. HAS BEEN ADVISED OF THE POSSIBILITY OR LIKELIHOOD OF SUCH
DAMAGES.
Cellocator Wireless Communication Protocol

Page 2 of 292
Cellocator Wireless
Intellectual Property
Copyright in and to this document is owned solely by Pointer Telocation Ltd. Nothing in
this document shall be construed as granting you any license to any intellectual property
rights subsisting in or related to the subject matter of this document including, without
limitation, patents, patent applications, trademarks, copyrights or other intellectual
property rights, all of which remain the sole property of Pointer Telocation Ltd. Subject to
applicable copyright law, no part of this document may be reproduced, stored in or
introduced into a retrieval system, or transmitted in any form or by any means
(electronic, mechanical, photocopying, recording or otherwise), or for any purpose,
without the express written permission of Pointer Telocation Ltd.
Copyright 2016. All rights reserved.

Page 3 of 292
Cellocator Wireless
Table of Contents
1
Introduction .............................................................................................................. 8
1.1
About this Document .................................................................................................... 8
1.2
FW Version Applicability Table ........................................................................................ 8
1.3
Abbreviations .............................................................................................................. 8
1.4
References .................................................................................................................. 9
Telemetry Channel (Outbound Messages) ............................................................... 10
2.1
Overview....................................................................................................................10
2.2
Outbound: Status/Location Message Definition = Message Type 0 .....................................10
2.2.1 Byte-Aligned Table ......................................................................................................10

2.2.2 General Details ...........................................................................................................12
2.2.3 Detailed Per-Field Specifications ....................................................................................13
2.3
Outbound: Configuration (Programming) Data Message Definition = Message Type 3 ..........54
2.3.1 Message Ingredients ....................................................................................................54

2.4
7
Outbound: Logged Fragment of Data Forwarded From Serial Port to Wireless Channel = Type
55
2.5
The Container .............................................................................................................55
2.5.2 Data Path Chart ..........................................................................................................57

2.6
Outbound: Real Time Data Forwarded From Serial Port to Wireless Channel = Message Type 860
2.6.1 Message Ingredients ....................................................................................................60

2.7
Outbound: Modular Message = Message Type 9 ..............................................................63
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.10
2.7.11
2.7.12
2.7.13
2.7.14
2.7.15
2.7.16
2.7.17
Message Ingredients ....................................................................................................63

Detailed Per-Field Specifications ....................................................................................64
Outbound Sub-Data Types List ......................................................................................65
Outbound: The Firmware Platform Manifest (Sub-Data Type 0x01) ....................................66
Outbound: The Compact CAN Data (Sub-Data Type 0x02) ...............................................68
Outbound: Compact CAN Trigger Module (Sub-Data Type 0x03) .......................................69
Outbound: Logged Compact CAN Trigger Module (Sub-Data Type 0x03) ............................70
Outbound: Time and Location Stamp Module (Sub-Data Type 0x04) ..................................72
Accelerometer Response Module (Sub-Data Type 0x05) ...................................................74
PSP UL Messages from Alarm System (Sub-Data Type 0x06) .........................................74
Usage Counter Update Packet (Sub-Data Type 0x07).......................................................75
Command Authentication Update (Sub-Data Type 0x08) ..................................................77
Outbound: Neighbor list of the serving GSM cell (Cell-ID) (Sub-Data Type 0x09) ................78
Outbound: Maintenance Server Platform Manifest (Sub-Data Type 0x0A) ...........................79
Outbound: Message Forwarded from Keyboard (Sub-Data Type 0x0B) ...............................85
Outbound: 3G Cell ID Data (Sub-Data Type 0x0C) ..........................................................87
Outbound: Compressed Vector Change Report (Sub-Data Type 0x0D) ...............................88

Page 4 of 292
Cellocator Wireless
2.7.18
2.7.19
2.7.20
2.7.21
2.7.22
2.7.23
2.7.24
Outbound:
Outbound:
Outbound:
Outbound:
Outbound:
Outbound:
Outbound:
Modular Platform Manifest (Sub-Data 0x12) ...................................................91

Pulse Counter Measurement Response (Sub-Data 0x14) ..................................97
Cello-CANiQ (Sub-Data 0x15) (Infrastructure) .............................................. 101
Cello-CANiQ Fleet End of Trip Report (Sub-Data 0x16) ................................... 101
CFE Inputs Update message (Sub-Data Type 0x18) ....................................... 103
oneWire Temperature Sensor Measurement (Sub-Data 0x19) ...................... 107
CDMA Cell ID Data (Sub-Data Type 0x1C) .................................................... 110
2.8
Outbound: Modular Message = Message Type 11 .......................................................... 111
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
2.8.10
2.8.11
2.8.12
2.8.13
2.8.14
2.8.15
2.8.16
2.8.17
2.8.18
Message Ingredients .................................................................................................. 111

Detailed Per-Field Specifications .................................................................................. 112
Outbound Type 11 Module Structure ............................................................................ 113
Outbound Type 11 Modules Table ................................................................................ 113
Outbound: DTC Event Module ..................................................................................... 115
Outbound: Variables Dump List Module ........................................................................ 116
Outbound: Calibration Data Snap Shot Module .............................................................. 117
Outbound: GPS Location Stamp Module ....................................................................... 117
Outbound: GPS Time Stamp Module ............................................................................ 118
Outbound: Firmware ID Module .................................................................................. 118
Outbound: ACK Module .............................................................................................. 118
Outbound: Configuration Memory Write Response Module .............................................. 119
Outbound: Configuration Memory Read Response Module .............................................. 119
Outbound: CAN-GPS Speed Calibration Status .............................................................. 120
Outbound: VIN Read Response Module ........................................................................ 121
Outbound: Trigger Event ID Module ............................................................................. 121
Outbound: General Status Event Module ...................................................................... 122
Outbound: CAN Variables Status Dump ........................................................................ 124
Command Channel (Inbound Messages) ............................................................... 126
3.1
Overview.................................................................................................................. 126
3.2
Generic Command Message Definition ......................................................................... 126
3.2.1
3.2.2
3.2.3
3.2.4
General Details ......................................................................................................... 126

Byte-Aligned Table .................................................................................................... 127
3.3
Inbound: Generic Command-Message type 0 ................................................................ 129
3.4
Inbound: Programming Command Definition = Message Type 1 ...................................... 134
3.4.1 Message Ingredients .................................................................................................. 134

3.4.2 Detailed Per-Field Specifications .................................................................................. 134
3.5
Inbound: Generic Acknowledge Message Definition = Message Type 4 ............................. 135
3.5.1 General Details ......................................................................................................... 135

3.5.2 Byte-Aligned Table .................................................................................................... 135
3.6
Inbound: Forward Data Command Definition = Message Type 5 ...................................... 137
3.6.1 Message Ingredients .................................................................................................. 137

Page 5 of 292
Cellocator Wireless
3.6.2 Byte-Aligned Table .................................................................................................... 137
3.7
Inbound: Modular Message Request Definition = Message Type 9 ................................... 139
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.7.6
3.7.7
3.7.8
3.7.9
3.7.10
3.7.11
3.7.12
3.7.13
3.7.14
3.7.15
3.7.16
0x19)

Inbound Sub-Data Types Table ................................................................................... 141
Inbound: Firmware Manifest Request (Sub-Data Type 0x01) .......................................... 141
Inbound: CAN Data Request (Sub-Data Type 0x02) ....................................................... 141
Inbound: Time and Location Stamp Module (Sub-Data Type 0x04) .................................. 142
Inbound: Accelerometer Data (Sub-Data Type 0x05) ..................................................... 142
Inbound: PSP UL Messages from CCC to Alarm System (Sub- Data Type 0x06) .............. 142
Inbound: Usage Counter Write/Request Command (Sub-Data Type 0x07) ........................ 142
Inbound: Command Authentication Table Change (Sub-Data Type 0x08) ......................... 144
Inbound: Neighbor list of the serving GSM cell request (Sub-Data Type 0x09) .................. 146
Inbound: Forward Data To Keyboard (Sub-Data Type 0xB)............................................. 146
Inbound: Modular Platform Manifest request (Sub-Data Type 0x12) ................................ 147
Inbound: Modular Pulse Counter Measurement request (Sub-Data Type 0x14).................. 148
Inbound: CFE inputs Status Update Request (Sub-Data Type 0x18) ................................ 149
Inbound: oneWire Temperature Sensor Measurement Request InBound (Sub-Data Type
150
3.8
Inbound: Modular Message = Message type 11 ............................................................. 152
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.8.8
3.8.9
3.8.10
3.8.11

Inbound Type 11 Module Structure .............................................................................. 154
Type 11 Modules Table .............................................................................................. 154
Inbound: Configuration Memory Write Module .............................................................. 156
Inbound: Configuration Memory Read Request Module ................................................... 157
Inbound: VIN String Write Module ............................................................................... 157
Inbound: VIN Read Request Module ............................................................................ 158
Inbound: General Module Query.................................................................................. 158
Inbound: General Command ....................................................................................... 158
Inbound: Forwarded CAN Query .................................................................................. 160
CSA OTA Protocol .................................................................................................. 161
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1.10
CSA Protocol Frame ................................................................................................... 163

Message Types Table ................................................................................................. 164
CSA Protocol Version ................................................................................................. 164
CSA Event (Message type 0 from CSA to Server) .......................................................... 164
Table of CSA Event Reasons ....................................................................................... 164
The Acknowledge (to CSA Event, Message Type 1 from Server to CSA) ............................ 169
Program/Read Parameters to CSA (Message Type 2 from Server to CSA) ......................... 169
Reply to Program/Read Parameters Command (Message type 3 from CSA to Server) ........ 170
Command to CSA (Message Type 4 from Server to CSA) ................................................ 170
4.2
Modules Description .................................................................................................. 171
4.2.1 Modules Summary Table ............................................................................................ 171

Page 6 of 292
Cellocator Wireless
4.2.2 Modules Detailed Table .............................................................................................. 173
4.3
FTP/TFTP Files Structure ............................................................................................ 212
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
Raw Data Files .......................................................................................................... 212

File Naming Convention ............................................................................................. 212
File Structure ............................................................................................................ 215
Maneuver files Payload Structure ................................................................................ 216
Trip files Payload Structure ......................................................................................... 217
Crash File Payload Structure ....................................................................................... 220
4.4
File Structure Examples ............................................................................................. 223
4.4.1 Trip File Detailed Structure Example ............................................................................ 223

5
CelloTrack Nano Protocol ...................................................................................... 233
5.1
Overview.................................................................................................................. 233
5.2
Nano-related Content of Multi-Purpose Bytes (3338) in Type-0 Messages ...................... 234
5.3
Changes in Emergency Queue ..................................................................................... 235
5.4
Type-11 Message Structures ....................................................................................... 236
5.5
Legacy (Type-0) Encapsulated in Type-11 New Module .................................................. 239
5.6
Nano Features Related Messages ................................................................................ 240
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.6.10
General Definitions and Data Structures ....................................................................... 240

Nano Extra Take Locations Messages ........................................................................... 241
Impact and Free-fall Recognition ................................................................................. 241
Orientation Change ................................................................................................... 243
Man Down ................................................................................................................ 243
Package Open/Close .................................................................................................. 244
Work-ID /Activation Event .......................................................................................... 245
Temperature/Humidity Reporting ................................................................................ 246
Request of the Entire Cyclic Buffer of a Channel ............................................................ 254
Check-in Feature ....................................................................................................... 254
5.7
MultiSense Features Related Messages ........................................................................ 255
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
MultiSense Provisioning Event ..................................................................................... 255

Guest MultiSense Reporting ........................................................................................ 258
MultiSense Open/Close Package Feature ...................................................................... 263
MultiSense Open/Close Door/Window Feature ............................................................... 264
MultiSense Added Event ............................................................................................. 265
MultiSense Removed Event......................................................................................... 266

Page 7 of 292
Introduction
1.1
About this Document

This document explains the unit's wireless communication structure. It describes every
byte of the incoming / outgoing packets, which can be sent or received by the unit overthe-air.
1.2
FW Version Applicability Table

This document describes the OTA protocol of the Legacy fleet system, the later CSA
(Cellocator Safety Application) and CelloTrack Nano protocols.
Unit
Applicable Sections
Cello-F
-Introduction, 2 and 3-Telemetry channel outbound and

1
inbound
Cello-R
CR200
CR200B
Cello-IQ40,
Cello-IQ50
Cello-IQ40,
Cello-IQ50 GNSS
Cello-CANiQ
CR300
CelloTrack-T
CelloTrack Nano
1.3
-Introduction, 2 and 3-Telemetry

1
inbound
1-Introduction, 2 and 3-Telemetry
inbound,
not including section 2.6
inbound,
not including section 2.6
inbound,
4- CSA protocol
inbound,
4-CSA protocol
inbound,
4-CSA protocol
inbound,
4-CSA protocol
inbound
inbound,
5-CelloTrack Nano protocol
channel outbound and


Abbreviations
Abbreviation
Description
ACK
Acknowledge
CAN
Controller Area Network
CCC
Command and Control Center
DB
Database

Page 8 of 292
Cellocator Wireless
1.4
Abbreviation
Description
FMS
Fleet Management System
OTA
Over the Air
PDU
Protocol Description Unit (Common name for data SMS)
PGN
Parameter Group Number
SMS
Short Message Service (GSM)
PTR
Pointer Telocation Ltd.
PSP
Pointer Serial Protocol, normally refers to a Car Alarm

System interfacing through this protocol
NVM
Non Volatile Memory
FW
Firmware
HW
Hardware
CSA
Cellocator Safety Application
References
All the reference documents listed in the following table can be downloaded from the
support section of the Pointer Website (www.pointer.com).
#
Reference
Description
Cello Programming Manual
This document describes the features

supported by the Cellocator unit and
provides details about the
parameters of its configuration.
Cello Hardware Installation

Guide
This document provides all necessary

information for a technician who is
involved in the installation of a CelloF or Cello-R unit. It describes how to
install and verify the proper
functioning of the Cello installation
kit elements.
Serial Interfaces Specification
This document describes the serial

interface (RS232) protocol
Cello AR Interface Protocol
This document describes 1-Wire

interface of Cello-AR unit
CR200 / CR200B Programming

Manual
This document describes the features

supported by the Cellocator CR200 /
CR200B unit and provides details
about the parameters of its
configuration.

Page 9 of 292
Cellocator Wireless
Telemetry Channel (Outbound Messages)
2.1
Overview
The telemetry channel comprises four kinds of messages, as described in the following:
Status/location Message the main message, which is sent by default, as a reply
to a command or as the message of choice when reporting emergency situations. This
message has a message type code of 0 (zero).
Programming Data this message is sent as a reply to programming commands, or
by request. It contains the new contents of the programmed block, which allows
verification of the programming. This message has a message type code of 3 (three).
Logged Fragment of Forwarded Data (not supported by CR200/CR200B) this
message is sent when the terminal, connected to the serial port of Cellocator unit is
forwarding data to the central control through unit's log. This message has a message
type code of 7 (seven) and contains a fragment of delivered data.
Real Time Forwarded Data (not supported by CR200/CR200B) this message is
sent when the terminal, connected to the serial port of Cellocator unit is forwarding
data to the central control without logging it. This message has a message type code
of 8 (eight).
Modular Message this message is designed to contain different types of data, such
as CAN bus sensors, Cell ID, debug data, and more. This message has a message type
code of 9 (nine).
Self Re-flash Master ACK / NACK Message a message serving as confirmation of
reception data chunk for self-re-flash. Self re-flash process description is outside the
scope of this document (See Self Re-flash Appendix for more details).
Type 11, New Modular Messages Type 11 is a modular protocol currently used
for configuration memory programming and uploading of Cello devices with 8 Kbytes
of configuration memory.
2.2
Outbound: Status/Location Message Definition =

Message Type 0
2.2.1
Byte-Aligned Table
1
System code, byte 1 ASCII M
System code, byte 2 ASCII C
System code, byte 3 ASCII G
System code, byte 4 ASCII P
Message type - byte (a value of 0 for status/location message)
Units ID (total 32 bits)
7
8
9
Page 10 of 292
Cellocator Wireless
10
Communication control field (Two bytes)
11
12
Message numerator (Anti-Tango)
13
Units hardware version
14
Units software version
15
Protocol Version Identifier
16
Units status + Current GSM Operator (1st nibble)
17
Current GSM Operator (2nd and 3rd nibble)
18
Transmission Reason Specific Data
19
Transmission reason
20
Units mode of operation
21
Units I/O status 1st byte
22
Units I/O status 2nd byte
23
Units I/O status 3rd byte
24
Units I/O status 4th byte
25
Current GSM Operator (4th and 5th nibble)
26
Analog input 1 value
27
28
29
30
Mileage counter (total 24 bits)
31
32
33
34
Multi-purpose field: Driver /Passenger/ Group ID, PSP/Keyboard Specific Data,

Accelerometer Status or SIM IMSI
35
36
37
38
39
Last GPS Fix
40
41
Location status (from unit)
42
Mode 1 (from GPS)
43
Mode 2 (from GPS)
44
Number of satellites used (from GPS)

Page 11 of 292
Cellocator Wireless
45
Longitude
46
47
48
49
Latitude
50
51
52
53
Altitude
54
55
56
57
Ground speed
58
59
60
61
Speed direction (true course)
62
63
UTC time seconds
64
UTC time minutes
65
UTC time hours
66
UTC date day
67
UTC date month
68
GPS date year
69
70
2.2.2
Error detection code 8-bit additive checksum (excluding system code)
General Details
Rule of thumb: multiple byte fields are always sent Intel-style, meaning, least significant
bytes sent first.
The first 9 bytes / 3 fields (system code, message type and unit ID) are always sent in
the beginning of the message, in the specified order, regardless of the message kind.
What differentiates the message kinds is the value sent in the message type field. The
other fields maintain constant values (system code is a system-wide constant, unit ID is a
unique constant value for each Cellocator unit).

Page 12 of 292
Cellocator Wireless
2.2.3
Detailed Per-Field Specifications
2.2.3.1 System Code

System code is a 4-byte value, which identifies the Cellocator system. The field is sent as
the ASCII values of the letters M, C, G, P (for IP messages) or M, C, G, S
(for SMS messages), in that order.
2.2.3.2 Message Type

Message type identifies the kind of message. It allows the receiver to differentiate
between status messages and programming data messages, according to the value sent
in this field. Status/location messages contain a value of 0 (zero) in the message type
field.
2.2.3.3 Unit ID
This field contains a value that is uniquely assigned for every Cellocator unit during the
manufacturing process. All messages sent by the same Cellocator unit contain the same
value in the Unit ID field.
2.2.3.4 Communication Control Field

This is a bitmapped field, which contains flags that provide information about the message
and the situation in which it was originated.
CR200/B and CR300/B highlighted in the tables below means that the corresponding bit is
supported by CR200 and CR200B units.
First byte (10th):
CAN
originated
Odometer1
CAN
originated
Speed 2
Bytes 33-38 assignment

(Dallas, Trailer, PSP, ACC
data or SIM IMSI)
CR200/B
and
CR300/B
Garmin
Connected
Garmin
Enabled
Message
source
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
CR200/B
and
CR300/B
Message
Initiative
Bit 2
Bit 1
Bit 0
Bit 1
Bit 0
Second byte (11th):

CR200/B
and
CR300/B
GSM
Hibernation
indication bit
Bit 7
Speed in the
message:
Momentary /
Max Speed
"Business" /
"Private"
Mode
CR200/B and CR300/B
Bit 6
Bit 5
Bit 4
Firmware Sub-version *
Bit 3
Bit 2
Message initiative flag states whether the message was actively sent (initiated by
the unit, based on its logic and decisions), or if the message is a response to a command
or a query message received by the unit earlier. The flag is low (contains logical 0) on
standard active transmissions, and high (logical 1) on passive replies/responses.
Only supported by Compact CAN unit, linked to J1939 (and, of course, FMS) CAN bus.
Only supported by Compact CAN unit, linked to J1939 (and, of course, FMS) CAN bus.

Page 13 of 292
Cellocator Wireless
A Cellocator Unit informs the Central Control about the status of Garmin terminal via the
"Garmin Enabled" and Garmin Connected" flags.
The "Garmin Enabled" field monitors the status of the corresponding bit in the
configuration memory (1 when enabled).
The "Garmin Connected" bit monitors the status of the communication between
Garmin and Cellocator Unit. This bit is set with the first correct ACK or NACK received
from the Garmin Unit and is reset upon three missing responses from the Garmin unit
(timeout expiration).
* Refer to API Garmin Support by Cellocator unit for more details about Garmin
integration.
The Message source flag indicates that the message was sent through memory. The
unit tries to resend the message from the memory until the acknowledge, from the
Control center, is received. The flag is low (contains logical 0) on direct messages 3 not
over memory, and high (logical 1) on messages from memory.
The Bytes 33-38 assignment (Dallas, PSP or other) bits define the data type,
provided in bytes 33-38 of this message according to the below table. Value of this field
does not affect CelloTrack/Power.

Type 0,
Type 0,
Byte 41,
byte 10
Description 4-5 of byte 10
Location
Status,
(CR200/B and
CR300/B)
Bit 7
Bit 5
Bit 4
Backward compatibility mode (to FW 27c and

below), Driver ID (Dallas field).
PSP mode is enabled, external Alarm device data is

transmitted in bytes 33-38
The Keyboard is used, keyboard related data is

transmitted in bytes 33-38
Trailer ID is transmitted in bytes 33-38
IMEI sent over bytes 33-38 and location status

(byte 6,5)
CelloTrack Nano use
The only exception is the "Transmission Reason 32 - IP changed / connection up" message, which
always requires acknowledge from central control, even if it was sent as a direct message and not
through memory.
Page 14 of 292
Cellocator Wireless
Bytes 33-38 will also contain the data of SIM's IMSI (only in "Wake Up" message,
transmission reason 0d202), and a debug data of accelerometer (in all the messages from
CelloTrack units).
Cello-AR
When the AR keypad is enabled in programming, the unit sets bits 4-5 of byte 10 of OTA
Message type 0 to '10' in all the messages except Driver Authentication Update (TR46)
and Wake Up (TR202).
IMEI transmission
The IMEI will be sent on bytes 33-38 with its 2 MS-Bits sent in byte 41 bits 6,5
IMEI is defined as 15 decimal digits. Converting the maximal IMEI number
999999999999999 to hexadecimal we get: 38D7EA4C67FFF. The maximal number will
occupy 50 bits which will be sent as follows:
Two bits: 6,5

In Byte 41
0x03 0xFf
0x7f
0xC6
0xA4
0x7e
0x8d
Byte
33
Byte
34
Byte
35
Byte
36
Byte
37
Byte
38
CAN originated Speed and CAN originated Odometer: These bits are set when
the unit is configured to report (in message Type 0) speed and the odometer data taken
from the CAN interface and not from the GPS. The flags are informative as the format of
Speed and Odometer fields in message type zero remain the same, irrespective of the
source of the data.
* Only supported by Compact CAN unit, linked to J1939 (and, of course, FMS) CAN bus.
Firmware Sub-Version: This field (5 bits) defines the firmware sub-version of the
Cellocator Unit. The number of Cellocator firmware is built from two parts:
[Firmware version][Firmware sub-version], where firmware version defines the list of
supported features and subversion defines the revision.
For instance: 30':
Firmware: 30
Revision: ' (0)
Firmware Sub-version field
(decimal value)
Identifier
No identifier
26

Page 15 of 292
Cellocator Wireless
GSM hibernation indication bit: The bit monitors hibernation status upon message
delivery and not upon message generation. Consequently the bit is set to 1 only when the
message is sent during GSM peeking
Speed in the message: The bit indicates whether the speed reported in this message is
a Momentary speed (0) / or Maximal Speed recorded from the last event (1).
"Business" / "Privet" Mode: It is possible to enable usage of "Lock input"as a
"Private"/"Business" mode toggle.

If enabled every time the Lock input is triggered the unit switches to the opposite mode
("Private"/"Business"/"Private").
The default mode is "Business".
The "Private" mode is finished upon:
1- The active ID is erased from RAM after journey end.
2- Lock Input trigger.
During "Private" mode the unit is continually set bit 5.
2.2.3.5 Message Numerator (Anti-Tango)

The Message numerator field contains a value that is increased after every self-initiated
generation of a message (in cases where an acknowledge from Central control was
received).
------------------------------------------------------------------------------------------------NOTE: The unit assigns different message numerator sequences for the logged events
and for real-time events. In passive transmission (reply to command), the value in this
field represents the number from the Command Numerator Field in an incoming
command. (See Command Channel - Inbound Messages, Section 2.7.15).
------------------------------------------------------------------------------------------------When the unit is reset/powered-up, this value is set to zero. This provides a way to
chronologically sort incoming messages from a certain unit, in case an anachronistic
communication medium is used.
2.2.3.6 Units Hardware, Firmware and Protocol Versions

Units HW version
This byte defines the unit's HW version and the ID of the modem embedded in it. Till now
the addressing scheme defined 5 bits for HW ID (PCB ID) and 3 bits for Modem Code, this
limited the number of products to only 32 products.
As for new products, starting from CelloTrack Nano, an alternative backwards compatible
approach will be used, in which each unit's HW will be uniquely defined by a complete
byte defined as Unit HW Version ID.

Page 16 of 292
Cellocator Wireless
The table for legacy products, which will be identified by the Legacy HW ID is detailed
below:
HW ID
Legacy
Product Name
Modem
(8 Bits)
HW ID
Code
(5 Bits)
(3 Bits)
Modem Type
225
CR300
GE864-QUAD-V2
CFE
No Modem
194
PHSN RF Head
No Modem
35
Olympic
No Modem - Tetra/Astro
external modem
Compact Fleet
Sony/Erickson GR47
36
Compact Fleet
Enfora Enabler II-G
68
Compact Fleet
Telit GE864, old retrofit board

(obsolete)
100
Compact Fleet
Telit GE864, mute support
Compact Security
Sony/Erickson GR47
37
Compact Security
Enfora Enabler II-G
69
Compact Security

(obsolete)
101
Compact Security
39
Compact CAN 8 Sensor
Enfora Enabler II-G
71
Compact CAN (obsolete)

(obsolete)
103
Compact CAN TOB
370-50
Sony/Erickson GR47
105
370-50
170
10
CelloTrack 1 Output
Enfora 3
235
11
CR300B
GE864-QUAD-V2
172
12
CelloTrack
Enfora III
78
14
Cello-IQ GNSS
GE910 QUAD V3
113
17
Compact CAN TOB
18
18
CelloTrack T (2G)
Telit GE910 QUAD (v2) (V3)

Page 17 of 292
Cellocator Wireless
HW ID
Legacy
Product Name
Modem
(8 Bits)
HW ID
Code
(5 Bits)
(3 Bits)
Modem Type
82
18
CelloTrack T (3G)
Telit HE910 NAD
19
19
CelloTrackPower T (2G)
Telit GE910 QUAD (v2) (V3)
83
19
CelloTrackPower T (3G)
Telit HE910 NAD
20
20
Cello-CANiQ (NA)
UE910 NAR
52
20
Cello-CANiQ (EU)
UE910 EUR
84
20
Cello-CANiQ (2G)
GE910 QUAD V3
182
22
compact EOB
Enfora III
183
23
CelloTrack Power
Enfora III
216
24
Cello (Telit)
Telit GE864, automotive
249
25
Cello Cinterion
Cinterion BGS3
220
28
(Compact (TOB)) in use
221
29
CR200
222
30
CR200B
223
31
Cello-IQ
The table for new products (CelloTrack Nano, Cello-D, CR300B 3G, and on), which will
be identified by the HW ID is detailed below:
HW ID
Legacy
Product Name
Modem
(8 Bits)
HW ID
Code
(5 Bits)
(3 Bits)
Modem Type
38
Cello-D
UE910 NAR
43
11
CR300B 3G NA GNSS
UE910 NAD
75
11
CR300B 3G EU GNSS
UE910 EUD
107
11
CR300B 2G
GE910 QUAD V3
116
20
Cello-CANiQ (2G) Car Sharing
GE910 QUAD V3
53
21
PointerCept Base Station
No Modem
26
26
CelloTrack Nano 20
Cinterion BGS2-W
58
26
CelloTrack Nano 20 3G EU
Cinterion EHS5-E

Page 18 of 292
Cellocator Wireless
HW ID
Legacy
Product Name
Modem
(8 Bits)
HW ID
Code
(5 Bits)
(3 Bits)
Modem Type
90
26
CelloTrack Nano 20 3G NA
Cinterion EHS5-US
122
26
CelloTrack Nano 20 3G Worldwide
Cinterion EHS6A
136
CelloTrack Nano 10 GNSS
Cinterion BGS2-W
168
CelloTrack Nano 10 3G GNSS
Cinterion EHS6A
(Byte 15) Protocol Version Identifier and Unit's functional Mode

Feature package:
0 = Old/Legacy (not to be used in
new units)
1 = "IQ30"
Protocol Version
0 - Fleet base
1 - AR
functionality
added to Fleet
2 = "IQ40"
3 = "IQ50"
Bit 7
AR Functionality
Enabled
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
2.2.3.7 Units Status and Current GSM Operator 1st

This is a bitmapped field that provides information about current unit status and
functionality.
GPS comm.: describes the status of communication with the GPS module (0=available,
1=not available/error).
Home/Roam network: describes in what GSM network the unit is currently registered:
(0 Home network, 1 Roam network)
Correct Time: confirms the validity of the timestamp in the message (correct 0 or
estimated/invalid -1)
Source of Speed: 0 Estimated by GPS; 1 Pulse frequency input.
GPS
Comm.
Home/
Roam
Network
Correct
Time
Source
of Speed
Current GSM Operator (PLMN), 1st nibble
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
2.2.3.8 Current GSM Operator Report

The current GSM Operator (PLMN) is represented as a 5 character hexadecimal number.
After conversion into decimal it represents the MCC-MNC of a cellular operator (country
code + network number). The 5 PLMN nibbles (nibble for each character) are provided in
the following places:
Byte 16 (4 LSbits, 1 nibble)
Byte 17 (2 nibbles)
Page 19 of 292
Cellocator Wireless
Byte 25 (2 nibbles), 5th byte of IO
Byte 16 (4MSbits,
1 nibble)
Byte 17
Nibble 1
Nibble 2
Byte 25, 5th byte of IO
Nibble 3
Nibble 4
Nibble 5
2.2.3.9 Byte 17 - Current GSM Operator report (2nd and 3rd)

Current GSM Operator (PLMN), 2nd nibble
Current GSM Operator (PLMN), 3rd nibble
Bit 7
Bit 3
2.2.3.10
Bit 6
Bit 5
Bit 4
Bit 2
Bit 1
Bit 0
Byte 18 - Transmission Reason Specific Data
Additional information Related with the transmission reasons (From Byte 19)
Note that CR200/B and CR300/B in the table below means that the corresponding bit is
supported also by CR200 and CR200B units. CR200B and CR300B means that the
corresponding bit is supported by CR200B units.
Transmission
Reason
Transmission Reason Specific Data Usage (As function of the

Transmit reason)
Location change detected on Ignition is Off
Towing
Towed mode start
Towed mode stop
Robbery mode
Exit from Garage reason:

0 - Manual mode change
1 Timeout expiration
2-3 - Reserved
Bit 7
Bit 6

Bit 2
Bit 1
Robbery while
Driving Event
Direction:
entry to Garage
Mode ("0")
exit from Garage
Mode ("1")
Bit 3
Stationary
Robbery Event
Bit 4
Driver Door
Robbery Event
Bit 5
Near Driver Door

Robbery Event
Bit 6
Immobilization
session started
Immobilization
session
14
Garage Mode
ended
Bit 7
Stationary
Robbery session
suspended
Robbery mode
Bit 0
Reserved
Bit 5
Bits 0 4
Page 20 of 292
Cellocator Wireless
Transmission
Reason

Transmit reason)
15
Reserved
Light crash event
Crash
detection
event
Bit 5
21
0 Stop
Coasting
detection
(Speed and
RPM)
1 Start
22
Falling
Raising
Failing
Raising
23
violation of
2nd additional
GP frequency
threshold
34
0 Plain
Over-speed
start
1 Threshold changed by input
42
0 Plain
Over-speed
end
1 Threshold changed by input
46
For Cello-AR unit only:
Driver
Authentication
Update
The peak RMS value of the

impact in 1g resolution minus
1g
(16g=0xF, 1g=0x0)
Bits 7 6
violation of 1st
additional GP
frequency
threshold
Heavy
crash
event
Bit 4
Bits 0 3
0 Driver ID
1- Code from SPC Keyboard
For other units:
Group ID status
Unused
User Type
"1" authenticated,
"0" Driver ID
"0" not authenticated
"1" Passenger ID
Bit 7
Bits 1-6
Bit 0
NOTE: If Enable Pre-defined driver ID's list" (Add 123, Bit 2) is enabled and
the ID is not authenticated, The 6 bytes Dallas field must be ignored.
Page 21 of 292
Cellocator Wireless
Transmission
Reason

Transmit reason)
Door
48,64 : Door
7
Shock
49, 65
69
Start Report
Door STR
Description
Normal
Robbery Event
CarSharing2: End Of Reservation
Shock STR
Description
Normal
CarSharing2: Modem Off Ended
CarSharing2: Modem Off Started
CarSharing2: Business Mode started
CarSharing2: Private Mode started
Transmission Reason Specific Data Usage (As function

of the Transmit reason)
0
Normal Legacy support (accelerometer

based)
GPS based start event (CelloTrack family only)

Page 22 of 292
Cellocator Wireless
Transmission
Reason

Transmit reason)
91
Description
Message from
Keyboard (For
Cello AR unit
only)
92
Satellite
communication
events
STR
Description
Keypad Undefined Failure
Immobilizer device wires disconnection
Keypad locked
Relay malfunction
Ignition wire disconnected
Starter signal detection
Starter malfunction
Hotwiring Detection*
Primary cut unit failure
Secondary cut unit failure
10
Wrong keyboard ID detected
11
Pairing Accomplished
12
Keypad flash failed
13
Alarm Cadence Activated by Keyb
14
Alarm Cadence Deactivated by Keyb
128
ECALL Initiated
129
BCALL Initiated
Description
STR
Description
Reserved
Health status report Failure
Health status report Restore
periodic distress event

Page 23 of 292
Cellocator Wireless
Transmission
Reason

Transmit reason)
102
CelloTrack family: The CelloTrack changed its Activation mode

STR
Description
0
CelloTrack about to move to Inactive mode
CelloTrack Activated
158
STR
Description
Tamper active
event
Nano: Removal from cradle
Reserved
Nano and PointerCept: Tilt tamper.

(Unit has been tilted more than the predefined threshold
angle).
Cello-D enclosure opened
159
STR
Description
Tamper
inactive event
Nano: Back to cradle
Reserved
Spare
Cello-D enclosure closed
160
CFE Event
Description:
STR
Description
CFE Disconnected Event
CFE Connected Event
CFE Reprogramming Succeeded
CFE Reprogramming Failed

Page 24 of 292
Cellocator Wireless
Transmission
Reason

Transmit reason)
164
Nano event
STR
Description
Reserved
Impact event
Orientation change event
Man down event
Open package
Close package
Reserved
Reserved
Reserved
Work ID promoted event
10
MultiSense event (details about this event will be passed on the

Dallas bytes)
11
Temperature event
12
Humidity event
13
Check-in event
14
Open door/window
15
Close door/window
16
Free-fall event
167
CAN-GPS
Speed
Calibration
Mode
STR
Description
CAN-GPS Calibration Start
CAN-GPS Calibration Accomplished
CAN-GPS Calibration Failed
CAN-GPS Calibration Status Unknown
CR200/B

Page 25 of 292
Cellocator Wireless
Transmission
Reason
170
SMS delivery4

Transmit reason)
STR
Description
N/A
SMS message has been delivered
SMSC is still trying to deliver the message
SMSC is not making any more delivery attempts / Failed to

delivered the SMS message
No Response from SMSC
5
191
Geo-Hotspot
violation
Rejected due to SMS message pending
Direction: entry
to hot spot ("1")
exit from hot spot
("0")
The index of the
geo-zone
The index of the geo-zone.
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Bits 0-6 make up the index of the geo-zone. Most significant bit (bit 7)
indicates direction: entry to hot spot ("1") or exit from hot spot ("0")
CR200/B and
CR300/B
192 Frequency
Measurement
Threshold
Violation
194 - Analog
Measurement
Threshold
Violation
Violating
input
number
Violation
type
0
Violation
start
0
Threshold
1
Violation
End
1 - Range
Bit 7
Bit 6
Bit 5
Violating
input
number
Violation
status
Violation
type
Violation
direction
0
Violation
start
0
Threshold
0 High
thresh.
1
Violation
1 - Range
1 Low
thresh.
Door
Shock
Door
Shock
Violation
direction
Violation
status
Reserved
In case of
Threshold
0 Low
thresh.
1 High
thresh.
In case of
range
0 Keep In
1 Keep Out
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Reserved
Applicable for FW release 32k only

Page 26 of 292
Cellocator Wireless
Transmission
Reason

Transmit reason)
End
Bit 7
199
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Trailer Connection Status

0 for trailer disconnected, 1 for trailer connected
CR200/B and
CR300/B
200
AHR (Auto
Hardware
Reset)
The AHR reason:
The number of performed AHR attempts
0 Modem non responsiveness

1 Registration problem
2 GPS AHR
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
205 Garmin
connection
status changed
0 Garmin Disconnected
CR200/B and
CR300/B
GSM Jamming Event specific reason.
206
Bit 2
Bit 1
1 Garmin Connected
Not used
GSM
Jamming Ignition
State:
0-Legacy (Not
associated with
Ignition state)
Jamming
Detection
GSM Jamming
State:
0-GSM Jamming
Detection Start
Detected
1-GSM Jamming
Detection End
Detected
(Advanced Jamming
Mode)
1 Ignition Off
2 - Ignition On
Bit 7
CR200/B and
CR300/B
Bit 0
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
For CelloTrack and CelloTrack Nano:

Early
RadioOff
Event
207 Radio Off

Mode
Bit 7
Bit 6
Bit 5
GPS
Status
Modem
Status
(Bit 0)
(Bit 1)
Bit 4
Bit 3
Bit 2
GPS
Status
0 Off
1 - On
Bit 1
Modem
Status
0 Off
1 - On
Bit 0
Description
(For Cello variants only)

Detection of internal backup battery voltage
discharging to 3.25V or below for longer than 1
second (100 samples). The unit will enter

Page 27 of 292
Cellocator Wireless
Transmission
Reason

Transmit reason)
shipment mode only after generating this event.
(For CelloTrack, CelloTrack Power)
CelloTrack battery voltage decreases below 3.4
Volts for 30 consecutive seconds will initiate the
following actions:
1. A Radio-Off event is generated and
logged.
2. All log history is saved into nonvolatile
memory.
3. Cellular modem and GPS are turned off.
4. The Firmware enters idle state
N.A
(For Cello variants only)

Detection of internal backup battery voltage
lower than 3.5V (on any temperature) for longer
than 1 second (100 samples) upon sole work
from internal backup battery. The unit will switch
off the radio 2 seconds after event generation.
Once switched off, the modem will be switched
back on only upon main power reconnection.
(For CelloTrack, CelloTrack Power,

CelloTrack Nano)
CelloTrack battery voltage decreases below 3.6
Volts for 30 consecutive seconds will initiate an
early Radio Off event designed to alert the server
that the unit is about to enter Radio Off soon.
Early
Description
RadioOff
Event
(Bit 2)
0
Normal Radio Off Event
(For CelloTrack, CelloTrack Power,

CelloTrack Nano)
Early Radio Off Event, this message shall be
sent when the battery voltage is 3.6V or

Page 28 of 292
Cellocator Wireless
Transmission
Reason

Transmit reason)
below for 30 consecutive measurements.
212
The index of the geo-zone indicating Speed limiting Geo-Fence start event.
213
The index of the geo-zone indicating Speed limiting Geo-Fence End event.
222
PointerCept Event
0- Reserved
1- PointerCept Beacon mode started
2- PointerCept Beacon mode ended
223
CPIN error event
252
0 - Plain COM-Location Glancing
COM-Location1- 1 - ST (Specific Time) COM-Location Glancing

Glancing
2- 2 - Nano improved glancing event
(CelloTrack
3- 8 Car Sharing only: No-Show-Up Glancing
family + CelloD Units only)
CR200/B and
CR300/B
The index of the geo-zone.
253
Violation of
Keep In Fence
CR200/B and
CR300/B
254
Violation of
Keep Out
Fence
CR200/B and
CR300/B
255
Violation of
Way Point
2.2.3.11
Byte 19 - Transmission Reason
This field contains the reason why the unit is transmitting. Note that this value is valid
only for self-initiated active transmissions (i.e. transmissions that the unit generated
automatically because of its logics, in contrast to reply transmissions). Reply
transmissions (i.e. transmissions where the message initiative flag is turned on) contain
the last transmission reason that was used.

Page 29 of 292
Cellocator Wireless
Value
Supported
by
CR200/B
Supported
by
CR300/B
Supported
by Nano
Emergency (Distress) mode by command

Door Opened (Security Event)
6
7
Reason
Engine Activated (Security Event)
GPS Disconnected
Location change detected on Ignition is Off
Robbery Mode
11
See TR specific
data section
2.2.3.10 for
more details
Communication Idle
12
Disarmed from emergency states
13
Keypad Locked (wrong codes punched in)
14
Garage Mode (see Transmission Reason Specific Data (section

2.2.3.10)).
15
Crash detection event
19
Alarm Triggered by "Lock" input
21
Coasting detection (Speed and RPM)
22
Violation of 1st additional GP frequency threshold
23
Violation of 2nd additional GP frequency threshold
25
Speed detected when Ignition is Off
27
31
Reply to Command
325
IP changed / connection up
33
GPS Navigation Start
34
Over-speed Start
35
Idle Speed Start
GPS connected
Always requires acknowledge from central control, even if it was sent as a direct message and not
through memory.

Page 30 of 292
Cellocator Wireless
Value
Supported
by
CR200/B
Supported
by
CR300/B
Supported
by Nano
36
37
38
Reason
Distance
Engine Start; Ignition Input active (high)
40
GPS Factory Reset (Automatic only)

IP Down
41
GPS Navigation End
42
End of Over-speed
43
End of Idle Speed
44
Timed Event6
45
Engine Stop; Ignition Input inactive (low)
46
Driver Authentication Update / Code received for Cello-AR
47
Driving Without Authentication
48
49
Door Close Event
Unlock2 / Shock Inactive Event

CelloTrack: GP1 Inactive Event
50
CFE input 6 inactive Event

CelloTrack: GP2 Inactive Event
51
Volume Sensor Inactive Event
52
Hotwire Sensor Inactive Event
53
Driving Stop Event
54
Distress Button Inactive Event
55
Unlock Input Inactive event
56
Oil Pressure Sensor Inactive Event
57
CFE input 1 inactive
58
Lock input inactive event
59
60
In Cello-CANiQ (product tree), this event is used also for the 1 second GPS data reporting.

Page 31 of 292
Cellocator Wireless
Value
Supported
by
CR200/B
Supported
by
CR300/B
Supported
by Nano
Reason
61
62
63
Ignition Input as GP inactive Event
64
Door Open Event
65
Unlock2 / Shock Active Event

CelloTrack: GP1 Active Event
66
CFE input 6 inactive Event

CelloTrack: GP2 Active Event
67
Volume Sensor Active Event
68
Hotwire Sensor Active Event (370-50)
69
70
Driving Start Event
Distress Button Active Event
71
Unlock Input Active Event
72
Oil Pressure Sensor Active Event
73
CFE input 1 active Event
74
Lock input active event
75
76
77
78
79
Ignition Input active or CFE input 6 active
80
81
Main Power Disconnected
Main Power Low Level

In CelloTrack Nano: Battery low level
82
Backup Battery Disconnected

In CelloTrack3G Power: Charging Power Disconnected
In CelloTrack Nano: Charging Power Disconnected (USB)
83
Backup Battery Low Level
84
Halt (movement end) event

Page 32 of 292
Cellocator Wireless
Value
Supported
by
CR200/B
Supported
by
CR300/B
Supported
by Nano
85
Reason
Go (movement start) event
87
Main Power Connected (be unconditionally logged upon an initial

power up)
88
Main Power High Level

In CelloTrack family: Battery high level
89
Backup Battery Connected

In CelloTrack3G Power: Charging Power Connected
In CelloTrack Nano: Charging Power Connected (USB)
90
Backup Battery High Level
91
Message from SPC Keyboard
92
Satellite communication events
99
Harsh Braking Sensor Triggered
100
Sudden Course Change Sensor Triggered
101
Harsh Acceleration Sensor Triggered
102
CelloTrack family, Activation mode change
104
Trigger on General Input
105
Arm Input triggered
106
Disarm Input triggered
107
Remote Controller input trigger
108
Odometer pulse received
109
Unlock Pulse trigger
110
Lock Pulse trigger
111
Triggers on Blinkers
112
One of the protected outputs failure
144
Reset while armed
145
Wireless Panic button (for RB modification

only)
150
Signal Learned

Supported by
Cello-AR system
only. See TR
specific data
section 2.2.3.10
for more details
Applicable only for

Security
Modifications
Page 33 of 292
Cellocator Wireless
Value
Supported
by
CR200/B
Supported
by
CR300/B
Supported
by Nano
Reason
151
Learning Failed
152
Received Signal A
153
Received Signal B
154
This TR will be sent when the unit detects

main power low or disconnect and
hibernation mode D starts
158
Tamper switch Active Event (For CelloTrack family only)
159
Tamper switch Inactive Event (For CelloTrack family

only)
160
CFE Event
161
"Unlock" input triggered
162
MODECON gas leak start event
163
MODECON gas leak stop event
164
Nano event
165
Nano location report in POD mode
167
1707
CAN-GPS Speed Calibration Mode
SMS Delivery
190
191
192
193
No Modem Zone entry
Geo-HOT Spot violation

Frequency Measurement Threshold Violation
See
Transmission
Reason
Specific Data
(section
2.2.3.10) for
more details.
Reserved for Type 9 internal use: CELL_ID
194
Analog Measurement Threshold Violation
See
Transmission
Reason
Specific Data
(section
2.2.3.10) for

Page 34 of 292
Cellocator Wireless
Value
Supported
by
CR200/B
Supported
by
CR300/B
Supported
by Nano
Reason
more details.
195
Reserved for Type 9 internal use: CFE_INPUTS_REPORT
196
Reserved for Type 9 internal use: ONEWIRE_TEMPETURE
197
Reserved for Type 9 internal use: EOF_TRIP_TYPE
199
Trailer Connection Status
200
201
See Transmission
Reason Specific Data
(section 2.2.3.10) for
more details.
Modem's Auto Hardware Reset (AHR)

PSP External Alarm is Triggered
Only for Fleet edition

while PSP is enabled.
Refer to bytes 33-38
for specific reason of
the trigger.
202
Wake Up event
If enabled in the NVM,

it is sent after
Hardware Reset
(including AHR) even
when active
transmissions are
disabled. Includes
IMSI of SIM card in
bytes 33-38.
203
Pre-Hibernation event
If enabled, generated
15 seconds before an
expiration of
Hibernation Mode
Delay timeout.
204
Vector (course) change
Curve smoothing
event
Garmin connection status changed
See Transmission
Reason Specific Data
(section 2.2.3.10) for
more details.
205
206
Jamming detection
207
Radio Off Mode
208
Header Error
209
Script Version Error
210
Unsupported Command

Self Re-flash
Processing.
Page 35 of 292
Cellocator Wireless
Value
Supported
by
CR200/B
Supported
by
CR300/B
Supported
by Nano
Reason
211
Bad Parameters
212
Speed limiting Geo-Fence.

GeoFence over Speed Start Event. See Transmission Reason
Specific Data for more details (Section 2.2.3.10 ).
213
Speed limiting Geo-Fence.

GeoFence over Speed End Event. See Transmission Reason
Specific Data for more details (Section 2.2.3.10 ).
214
Reserved for Type 9 internal use: PULSE_COUNTER
221
Reserved for Type 9 internal use: ERROR_EVENT
222
PHSN Event
223
CPIN Error Event
232
External NVM Error
239
Max Error
245
Upload Mode
246
Execute Mode
247
248
Finish Mode
Post Boot Mode
252
COM-Location Glancing (CelloTrack family + Cello-D Units

only)
253
Violation of Keep In Fence. See Transmission Reason Specific

Data (section 2.2.3.10) for more details.
254
Violation of Keep Out Fence. See Transmission Reason Specific

Data (section 2.2.3.10) for more details.
255
Violation of Way Point. See Transmission Reason Specific Data

(section 2.2.3.10) for more details.
2.2.3.12
Units Mode of Operation
The functioning of the Cellocator unit can be generalized as a finite state machine model,
with a few stages of operation. The current stage is referred to as unit mode, or
mode of operation. Every possible stage is assigned a certain value, which is
transmitted in this field:
Value
Meaning

Page 36 of 292
Cellocator Wireless
Value
Meaning
0x00
Standby Engine On
0x01
Standby Engine Off
0x02
Passive Arming (For Security modifications)
0x03
Pre-Arming (For Security modifications)
0x04
Alarm Armed (For Security modifications)
0x05
Silent Delay (For Security modifications)
0x07
Alarm Triggered (For Security modifications)
0x0E
Garage Mode
0x0F
Transmissions Delay (for older versions FW25 and below)
0x10
Towed mode (same as Standby Engine On, except the fact that the
ignition switch remains off)
2.2.3.13
Units I/O Status
The Cellocator unit is provided with many I/Os (inputs/outputs). Each I/O may be high
or low at a given moment. The I/O status field is a bitmapped representation of all of
the I/Os physical levels. Note that the I/O lines that have been configured to be inverted
will affect the application but will not be shown in this field as it only represent the raw
physical signals read from the HW.
First byte of I/O status field (sensors inputs):
GP Input
Panic
Driving Status
(Ignition or
accelerometer
based)
Ignition /
CFE In 1
Volume /
Hood /
GP1 Input2
GP1 Input1
Distress
input
Movement
Sensor
Bit 7
Bit 6
Bit 5
Shock /
Unlock 2
(15/20)
Bit 4
Bit 3
Bit 2
Bit 1
Door /
Tamper
Switch
Bit 0
Allocation per product:

Product
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Compact Fleet
(4 inputs
variants)
Panic
Ignition
Shock
Door
Compact
Unlock
Panic
Ignition
Shock/
Door

Page 37 of 292
Cellocator Wireless
Product
Bit 7
Bit 6
Security (and 6
inputs fleet,
TOB and EOB)
and Cello-R
(pin
11/20)
370-50
GP input
Panic
Ignition
Volume
Hood
Shock
Door
Olympic
Panic
Ignition
Shock
CelloTrack/T
Movement
sensor
CFE
GP
input2
GP
input1
Distress
input
Tamper
Switch
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
(Shock)
(Door)
Shock
Door
Unlock2
(pin
15/20)
(Power version
or not)
Cello
Bit 5
Driving Status
(Ignition or
accelerometer
based)
CFE
Driving Status
(Ignition or
accelerometer
based)
Shock
Driving Status
(Ignition or
accelerometer
based)
Shock
Door
CelloTrack
Output
Movement
sensor
GP1
input2
GP1
input1
Distress
input
Tamper
Switch
CelloTrack
Nano
Package
is open
USB
power
connected
Movement
sensor
Button
_1
GP
input1
Button_
2
Tamper
Switch
CR200/
CR200B
Unlock
(pin
11/20)
Panic
In 1
CR300/
CR300B
In 1
(Power
harness
)
Second byte of I/O status field (sensors inputs):
Ignition port
status
Bit 7
Accelerometer
status
Bit 6
External
Alarm
Status
External
Alarm
Trigger
Odometer/
CFE IN 4
Lock
(5/20)
CFE IN 6
CFE IN 5
Bit 5
Bit 4
Bit 3
Bit 2
RC data/
Disarm
Arm
CFE IN 3
CFE IN 2
Bit 1
Bit 0
Allocation Per Product:

Page 38 of 292
Cellocator Wireless
Product
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit
0
Compact Fleet (4
inputs variants)
Compact Security
(and 6 inputs
fleet, TOB and
EOB) and Cello-R
Lock
(pin
5/20)
370-50
Odometer
RC data
Disarm
Arm
Olympic
External
Alarm
Status
External
Alarm
Trigger
CelloTrack/T
CFE
CFE
CFE
CFE
CFE
In 6
In 5
In 4
In 3
In 2
CFE
CFE
In 3
In 2
(Power version or
not)
Cello
Ignition
port
status
Accelerometer
status
CFE
CFE
CFE
In 6
In 5
In 4
Lock
(pin
5/20)
CR200/CR200B
Ignition
port
status
Accelerometer
status
Shock
CelloTrack Output
CFE
CFE
CFE
CFE
CFE
In 6
In 5
In 4
In 3
In 2
CR300/CR300B
Ignition
port
status
Accelerometer
status
CelloTrack Nano
Third byte of I/O status field (Compact, Cello and CRx00)

CFE OUT 5
CFE OUT 4
CFE OUT 3
CFE OUT 2
GPS power
Grad. Stop
Siren
Control
CFE OUT 1
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Allocation per product:

Product
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Compact
Fleet (4
inputs
variants)
GPS
Power
Grad.
Stop
Siren
Compact
GPS
Grad.
Siren

Control
Page 39 of 292
Cellocator Wireless
Product
Bit 7
Bit 6
Bit 5
Bit 4
Security
(and 6
inputs fleet,
TOB and
EOB) and
Cello-R
Bit 3
Bit 2
Bit 1
Power
Stop
Control
Siren Out
Modem DTR
out
Siren
370-50
GSM
Wake
Sensors
Voltage
General
Output
Hood
Lock
GPS
Power
PWM
Immob.
Olympic
GPS
Power
Grad.
Stop
CelloTrack/T
Bit 0
Control
CFE
OUT 5
CFE OUT
4
CFE OUT
3
CFE
OUT 2
GPS
Power
CFE
OUT 5
CFE OUT
4
CFE OUT
3
CFE
OUT 2
GPS
Power
Grad.
Stop
Siren
GPS
Power
GPS
Power
Grad.
Stop
CelloTrack
Output
Siren
CelloTrack
Nano
(Power
version or
not)
Cello
CR200/
CR200B
CR300/
CR300B
CFE OUT 1
CFE OUT 1
Control
Control
-
GPS
Power
Fourth byte of I/O status field (Compact and Cello)

Charger
status:
CFE OUT
6
Standard
Immobilizer
Bit 6
Bit 5
0 not
charging
Unused
1- charging
Bit 7
Bit 4
Blinkers
(Global
output) /
CelloTrack
Output
Bit 3
LED out
Unused
Bit 2
Bit 1
Bit 0
Allocation per product

Product
Bit 7
Compact Fleet
(4 inputs
variants)
Charger
status:
Bit 6
Bit 5
Standard
Immobilizer
Bit 4
Bit 3
Blinkers

Bit 2
Bit 1
Bit 0
LED out
Page 40 of 292
Cellocator Wireless
Product
Bit 7
Compact
Security (and
6 inputs fleet,
TOB and EOB)
and Cello-R
Charger
status:
370-50
Handsfree
Control
Olympic
Charger
status:
CelloTrack/T
Charger
status:
(Power
version or
not)
Bit 6
Bit 5
Bit 4
Standard
Immobilizer
Unlock
Out
Unused
Standard
Immobilizer
Bit 2
Bit 1
Blinkers
Door Lock
Out
Standard
Immobilizer
CFE
OUT 6
Bit 3
Blinkers
Out
Bit 0
LED out
Buzzer
Out
Stop
Lights
Out
Blinkers
LED out
LED out
External
Power
Connected
LED out
0 not
connected
1connected
Cello
Charger
status:
CR200/
CR200B
Charger
status:
CFE
OUT 6
Charger
status:
CR300/
CR300B
CelloTrack
Output
Charger
status:
CelloTrack
Nano
Charger
status:
Standard
Immobilizer
Standard
Immobilizer
Blinkers
LED out
Blinkers
LED out
Blinkers
LED out
Blinkers
Byte 25: Current GSM Operator (4th and 5th)

Current GSM Operator (PLMN), 4th nibble
Current GSM Operator (PLMN), 5th nibble
Bit 7
Bit 3
2.2.3.14
Bit 6
Bit 5
Bit 4
Bit 2
Bit 1
Bit 0
Analog Inputs
The Cellocator unit may handle up to 4 discrete analog inputs. These inputs are
multiplexed and sampled with a 10-bit deep analog/digital converter (in Cello 14 bits). 2
(or, in case of Cello - 6) bits of the conversion results are stripped, according to the input,
and the result for each channel is sent in this field.
In all the Cellocator units except Cello and CR200/CR200B the allocation of the
measurements is fixed in the message as follows:
Page 41 of 292
Cellocator Wireless
In all units except Cello and CR200/CR200B
The first byte in the field represents the main supply voltage. The main supply voltage is
continuously monitored, and this field represents the current updated measured voltage.
This value should be multiplied by the following number to get a value in Volts:
Compact: 0.1217320
CelloTrack: 0.019531258
370-50: 0.1212565
The second byte in the field represents backup battery voltage, when it was last tested.
Unlike the main supply voltage, this input is not constantly monitored. It is tested only
when the backup battery is not being charged: in Standby Engine Off mode. If "Low
Backup battery" event was not previously detected the unit constantly charges Backup
battery during Standby Engine On.
This value should be multiplied by the following number to get a value in Volts:
Compact:0.0474599
370-50: 0.0472745
CelloTrack not used
The third byte monitors either the Main Power regulated voltage (backward compatibility)
or the 2nd Analog input (on pin 14), as per setting in NVM (byte 465, bit 2). This byte is
not used in CelloTrack and CelloTrack Power.
If set as Main Power regulated voltage, it monitors an internal voltage of the unit, used
mainly for debugging reasons. It should be multiplied by 0.01953125 to get the voltage in
Volts.
If set as a second analog input it monitors a voltage measured on pin 14 of the
interface connector, if measurement is enabled in the NVM. (Refer to the Programming
Manual document, Events masking section Analog Input Measurement Mask, 2nd
Analog input). The measured signal is between 0 and 2.5 Volts, resolution of 9.8mV.
The source of the 3rd byte of analog inputs measurement (regulated voltage or second
analog input) is monitored in bit 0 of byte 41. Please refer to Section 2.2.3.19.
The fourth byte 9represents voltage on the first optional analog input (pin 15) in the event
that measuring is enabled in the NVM (Refer to the Programming Manual Document,
Events masking section, Analog Input Measurement Mask, Optional Analog input). The
Measured signal is between 0 and 2.5 Volts, resolution of 9.8mV.
This byte is not used in CelloTrack, but in CelloTrack Power it is monitoring the
temperature of the battery as 2's compliment hexadecimal value. Effective measurement
range from -20C to 55C, measurement error 1.5C
In Cello units
In Cello and CR200/CR200B the allocation of the measurements in the message is NOT
fixed and controlled in programming:
8
For CelloTrack the Main Power field contains a Li-Polymer internal battery measurement.
For CelloTrack Power it is monitoring the temperature of the battery as 2's compliment
hexadecimal value. Effective measurement range from -20C to 55C, measurement error 1.5C

Page 42 of 292
Cellocator Wireless
Field Name
Default value
Byte number in OTA

Message type 0
Measurement 1
9 (Vin)
26
Measurement 2
6 (Vbat)
27
Measurement 3
7 (Bat. NTC)
28
Measurement 4
2 (Shock)
29
Available inputs for mapping

Note that CR200/B and CR300/B in the table below means that the corresponding option
are supported also by CR200/CR300 and CR200B/CR300B units.
Measurement
source number
Input source
Name
Coefficient
No source
The application
shall ignore the
value of the
corresponding byte
in the message as
it might include
random data.
Door10
1.0
Shock
1.0
Can report either

analog (either in
9.8mA or 117.6mA
resolution, as per
programming) or
frequency
measurement as
per corresponding
input's type
Panic
Unlock
Infrastructure
only, not currently
supported
Lock
CR200/B and
CR300/B V bat
0.01647058823
Battery voltage
CR200/B and
CR300/B Bat.
Temperature
conversion
formula:
tC=0.4314x-40;
The NTC received

value
NTC
Remark
(for discrete
and analog
inputs only)
Note that the
10
The analog inputs measurement resolution is variable (either in 9.8mA or 117.6mA resolution),
and controlled by programmable parameter.
Page 43 of 292
Cellocator Wireless
Measurement
source number
Input source
Name
Coefficient
Remark
(for discrete
and analog
inputs only)
0 x255
(-40C t 70C)
(where x is the
measurement
accuracy of the
measurement is
3C
CR200/B and
CR300/B V main
0.0176470588235
Regulated voltage
CR200/B and
CR300/B V in
0.1176470588235
Input voltage
In CelloTrack-T
In CelloTrack-T, as per the Cello, the analog measurements sources are programmable.
The default sources are described in the following table:
Field Name
Default value
Byte number in OTA

Message type 0
Measurement 1
6 (Battery Voltage)
26
Measurement 2
8 (Vmain Voltage)
27
Measurement 3
1 (GPIO1)
28
Measurement 4
7 (NTC)
29
Measurement
source number
Input source
Name
Coefficient
No source
The application
shall ignore the
value of the
corresponding byte
in the message as
it might include
random data.
GPIO1
0-2.5V: 0.0078125
Can report either

analog (either in
9.8mA or 117.6mA
resolution, as per
programming) or
frequency
(for discrete and

analog inputs
only)
0-30:
0.117647058
2
GPIO2
Remark
0-2.5V: 0.0078125
0-30:

Page 44 of 292
Cellocator Wireless
0.117647058
measurement as
per corresponding
input's type
Infrastructure
only, not currently
supported
No source
No source
No source
Battery Voltage
0.01647058823
Battery voltage
Bat. NTC
The NTC received

value
The received value
(in signed 8
format) is already
converted to
temperature at FW
side
Vmain Voltage
0.0176470588235
Regulated voltage
No source
Reserved
Note: For non-power variants, only Battery Voltage, GPIO1 and GPIO2 are available.
In CelloTrack Nano
In CelloTrack Nano, as per the Cello and CelloTrack-T, the analog measurements sources
are programmable. The default sources are described in the following table:
Field Name
Default value
Byte number in OTA

Message type 0
Measurement 1
1 (Battery Voltage)
26
Measurement 2
0 (USB input Voltage)
27
Measurement 3
2 (NTC)
28
Measurement 4
8 (Nano_source)
29

Page 45 of 292
Cellocator Wireless
Measurement
source number
Input source
Name
Coefficient
[Units], format
and offset
Remark
(for discrete and

analog inputs
only)
0
USB input
Voltage
0-6V: 0.02353
Battery Voltage
0-4.2V:
0.01640625
NTC
0.4301 with offset

of -40
Rechargeable
battery internal
NTC
Audio in
(Infrastructure)
No source
Reserved
No source
Reserved
No source
Reserved
No source
Reserved
Nano source
after mux
Context
dependent:
The value is the

mux output after
selecting the
source in PL
addresses 20642065.
Temperatures:
1[C] Singed
(SINT8) format
Humidity: 1[%]
Pressure: 32 [m]
and with -400m
offset
Light: 4 [lux]
2.2.3.15
Mileage Counter
The Cellocator unit is provided with a distance accumulator feature. The unit counts
distance base units programmed in the NVM.
By synchronizing the accumulator value with the vehicles odometer reading and setting
the distance base units to one kilometer/mile, this counter provides the ability to
remotely read the vehicles odometer. The programming and synchronizing is only
needed once during the installation.
The mileage counter field contains the current 24-bit value of this accumulator.
2.2.3.16
Multi-Purpose Field on Bytes 33-38
(Not supported by CR200/CR300 and CR200B/CR300B)

Page 46 of 292
Cellocator Wireless
The bytes 33-38 may carry different information as per bits 4 and 5 in Communication
Control byte (10): Driver ID/Code update/PSP Data/Acc. Status/IMSI/Trailer ID
Driver ID / Passenger ID/ Group ID Code Update
If bits 4 and 5 of the Communication Control LSByte are both 0.
Every Cellocator unit (except CR200, CR200B, CelloTrack and Cello-AR) can provide 6
bytes of last received Dallas button in every message if that feature is enabled in NVM
(Mask of Authentication Events).
If no Dallas code is received since the initiation of the last Start Event, this field includes
0.
The code can carry Driver ID or Passenger ID and Group ID, depends on the type of the
attached button and the configuration.
Group ID
The Group ID is an additional driver authentication method, used when there are too
many drivers to be programmed into units memory.
The length of Group ID varies from 1 to 9 bytes length but shorter than 10 digits. The unit
supports multiple groups, while all Group IDs are from the same length.
NOTE: Group ID number shall never begin from zero.
The first number in Dallas codes array, shorter than 10 digits is considered as group ID
and his length is considered length of group ID. Any additional number, shorter than 10
digits but with length different from the first Group ID length, is considered a driver id.
Example: Dallas code 1234567890, when group ID is 4 digits:
Driver/Passenger ID 567890
Group ID 1234
90
78
56
34
12
00
Byte 33
Byte 34
Byte 35
Byte 36
Byte 37
Byte 38
The Keyboard
In case of Cello-AR this field is used to report the code received by the keyboard (when
bits 4 and 5 of the Communication Control LSByte are both 0).
The message from Cello-AR contains the received code and recognition status as it
received from the keyboard.
Code
Recognition
Status
Spare
Received Code (32 bits)
Byte 38
Byte 37
Byte 36
Byte 35
Byte 34
Byte 33
Code Recognition Status (Byte 38)

Reserved
Immobiliz Ignition
er Status Status
Authenticati Code status Code type

on (multicode) Code

Page 47 of 292
Cellocator Wireless
status
0 off
0 off
1- on
1- on
OK
Standard
Wrong
Authentication
OK
C&L
Wrong
Bit 7
Bit 6
Bit 5
Bit 4
7 - reserved
Bit 3
Bit 2
Bit 1
Bit 0
Received Code (Bytes 33-36)

Master code, only in case of reply to access code
request, otherwise sent as zeros
LSB char
of Master
code
3rd char of
the Master
code
2nd char of
the Master
code
MSB char
of Master
code
Nibble 8
Nibble 7
Nibble 6
Nibble 5
7th byte of response
LSB char
of the code
3rd char of
the code
2nd char of
the code
MSB char
of the code
Nibble 4
Nibble 3
Nibble 2
Nibble 1
PSP External Alarm status (If bits 4 and 5 of Communication Control LSByte = 01)
Reserved
Latest Valid External Alarm Status

(Refer to an external alarm protocol for
statuses list)
Com. Status
Nibbles 6-11
Nibbles 1-5
Nibble 0
Byte 38
Byte 37
Byte 36
Byte 35
Byte 34
Byte 33
Com. Status Table

Value
Description
External Alarm status in following 5 nibbles
No communication with External Alarm
2-15
Reserved
Keyboard status (If bits 4 and 5 of Communication Control LSByte = 10)

Reserved
Latest Valid Keyboard Status

(Refer to an external alarm protocol for
statuses list)
Com. Status
Nibbles 6-11
Nibbles 1-5
Nibble 0
Byte 38
Byte 37
Byte 36
Byte 35
Byte 34

Byte 33
Page 48 of 292
Cellocator Wireless
Com. Status Table
Value
Description
The Keyboard status in following 5 nibbles
If Pairing is enabled (Address 1710 bit 5)

The unit will send OTA event/distress message type 0 with TR
201, STR 0. The Com. Status in byte 33 of OTA Msg type 0 will
contain 1 (Communication Loss or pairing Failed).
If pairing is disabled (Address 1710 bit 5):
The unit will send OTA event/distress message type 0 with TR
201, STR
0. The Com. Status in byte 33 of OTA Msg type 0 will contain 1
(Communication Loss only).
2-15
Reserved
Latest Valid Keyboard Status

The value of the following bits is updated every time when:
1) The code is received.
2) Operational mode changed.
3) Ignition Change detected.
D0
D1
Byte 34
D2
Low Nibble
D3
D4
D5
Byte 35
D6
High Nibble
D7
D8
D9
D10
D11
Low Nibble
D12
D13
D14
D15
D16
D17
D18
D19
High Nibble
High Nibble
Byte 33 (high
nibble)
Bit
Name
Description
D0
Door (from Cello

unit)
Contains Logical Door Input (of Cello unit) status

(inverted and filtered)
D1
Volume Meter
D2
D3
Ignition
SPC Keyboard Ignition input status
D4
Alarm Armed ON
Represents Immobilizer bit received from Keyboard.

Same as D8.

Page 49 of 292
Cellocator Wireless
Bit
Name
Description
D5
Not available, sent as zero
D6
D7
D8
Immobilizer Armed
ON
Represents Immobilizer bit received from Keyboard.

Same as D4.
D9
Not available, sent as zero
D10
Hot Wiring
Set Hotwiring detected by SPC Keyboard, reset upon

entrance of Operational State 0 or 1.
D11
Service
Set when Operational State = 4

Reset in any other Operational State
D12
Keypad Wrong
Code
Updated upon reception of the corresponding message

from keyboard.
Set when: bit 3 or bit 4 of code recognition status byte
is 1
Reset when both bit 3 and bit 4 of code recognition
status byte are 0
D13D19
Zeros
In case of CelloTrack
The 6 bytes of Dallas are used to monitor debug information, used by Cellocator for
troubleshooting:
Last Rcon
Resets
Last Stack
Checksum
GPRS Failures
Debug Reset
Counter
pointer
Error Counter
counter
Reason
Byte 38
Byte 37
Byte 36
Byte 35
Byte 34
Byte 33
IMSI: In case of a "Wake Up" Message (Transmission reason 0d202), the unit reports 6
bytes (12 first characters) of the SIM's IMSI converted to hex (Little Endian).
The IMSI number consists of up to 15 numerical characters (0-9). An IMSI consists of a
three digit mobile country code (MCC, which is not reported by Cellocator Protocol) and a
variable length national mobile station identity (NMSI).
The NMSI consists of two variable length parts: the mobile network code (MNC) and the
mobile station identification number (MSIN). A Class 0 IMSI is 15 digits in length. A Class
1 IMSI is less than 15 digits in length.
Example:
IMSI: 425020315229000 (Cellcom IL)
Page 50 of 292
Cellocator Wireless
MCC
425
Israel
MNC
02
Cellcom IL
MSIN
0315229000
The Hex value received in bytes 33-38:

Value (hex)
00
5A
16
0F
03
02
Location in message type 0
Byte 33
Byte 34
Byte 35
Byte 36
Byte 37
Byte 38
Conversion table:
2.2.3.17
In wireless protocol (little-endian)
00
5A
16
0F
03
02
Big-endian (HEX values)
02
03
0F
16
5A
00
DEC values
02
03
15
22
90
00
NMSI (MNS + MSIN)
020315229000
Trailer ID
The 6 bytes of Dallas are used to monitor the Dallas ID of the connected or disconnected
Trailer.
2.2.3.18
Last GPS Fix
This field monitors a timestamp, when the GPS was last in navigation mode.
Structure:
Byte 40
Byte 39
Day of Month
Bit 4
Bit 3
Bit 2
Hours
Bit 1
Bit 0
Bit 4
Bit 3
Minutes
Bit 2
Bit 1
Bit 0
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
------------------------------------------------------------------------------------------------NOTE: The easiest way to define if the GPS data in the message is valid and updated, or
historical, is to compare between the time of the timestamps and UTC time (see below).
-------------------------------------------------------------------------------------------------
2.2.3.19
Service and Location Status Byte (byte 41)
Functions as the upper bit

selecting the role of bytes
33 to 38
IMEI
IMEI
Bit 49
Bit 48
CFE Type (see CFE type

table below)
Trailer status indication:

0-Trailer Disconnected
(CR200/CR300 and
CR200B/CE300B)
1-Trailer Connected

Actual GNSS
antenna selected
(Int.=0, Ext.=1).
Relevant only for
Cello GNSS
variants.
Page 51 of 292
Cellocator Wireless
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
CFE Type table (connected to Cello)
2.2.3.20
CFE Type
Bit 4
Bit 3
Bit 2
Not Applicable (Legacy

state)
CFE is not connected
CFE BT is connected
CFE Basic is connected
CFE I/O is connected
CFE premium is connected
Undefined CFE Type
MODE 1 from GPS
This field is generated by the GPS and transparently monitored in the outgoing message
from the unit. The field defines the validity of GPS data in the message.
It is a bitmapped field of flags, defined in the following manner:
The unit considers the valid fix according to the GPS Filter settings in the NVM. If the
Enable Tight GPS PMODE filter flag in NVM is enabled, the unit considers the GPS data
as valid only if:
Mode 1 = 3 or 4
AND
Mode 2 = 2
otherwise, if Enable Tide GPS filter flag in NVM is disabled, a fix, with the value of Mode
1 =2, 3, 4, 5 and 6, is considered as valid.
2.2.3.21
MODE 2 from GPS
This field is generated by the GPS. It is a hexadecimal value, defined in the following
manner:
The unit considers the valid fix according to the GPS Filter settings in the NVM. If the
Enable Tight GPS PMODE filter flag in NVM is enabled, the unit considers the GPS data
as valid only if:
Mode 1 = 3 or 4
AND
Mode 2 = 2
otherwise, if Enable Tide GPS filter flag in NVM is disabled, a fix with the value of Mode
1 =2, 3, 4, 5 and 6 is considered as valid.

Page 52 of 292
Cellocator Wireless
2.2.3.22
Number of Satellites Used
Number of satellite measurements used for current position fix. Possible values are 0 to
12.
2.2.3.23
Longitude, Latitude
Longitude and latitude coordinates of current position fix. Both coordinates are sent as
32-bit signed integers, representing the coordinates in 10 -8 radian resolution. Possible
values are to for longitude, or 2 to 2 for latitude. The coordinates refer to

WGS-84 map datum and ellipsoid.
2.2.3.24
Altitude
Altitude of current position fix. Represented as a 32-bit signed integer, in 10-2 meter
resolution (altitude is represented in centimeters).
2.2.3.25
Ground Speed
Current speed (absolute value of the vector). Represented as a 32-bit unsigned integer, in
10-2 meter/sec resolution (speed is represented in centimeters/sec).
2.2.3.26
Heading/Speed Direction (True Course)
Direction (angle) of the speed vector. Represented as 16-bit unsigned integer, in 10-3
radian resolution. Possible values are 0 to 2.
2.2.3.27
System Time
Universal coordinated time of the position fix, represented in seconds (0-59), minutes (059) and hours (0-23).
Note that the system time and date fields are monitoring system time, based on the
internal timer of the unit. The internal timer synchronizes with GPS time when the GPS fix
is considered as valid (or always as per configuration flag).
2.2.3.28
System Date
Universal coordinated date of the position fix, represented in days (1-31), months (1-12)
and years (1980-2079).
Note that the system time and date fields are monitoring system time, based on the
internal timer of the unit. The internal timer synchronizes with GPS time when the GPS fix
is considered as valid (or always as per configuration flag).
2.2.3.29
Checksum
The checksum is a last byte of sum of all bytes in a message, excluding the 4 bytes of
System Code and the Checksum itself.
Example:
The message:
4D4347500006000000081A02021204000000210062300000006B00E1000000000000000
00000E5A100040206614EA303181A57034E1200000000000000001525071403D607CS
Calculation of the CS=>

Page 53 of 292
Cellocator Wireless
00+06+00+00+00+08+1A+02+02+12+04+00+00+00+21+00+62+30+00+00+00+6B
+00+E1+00+00+00+00+00+00+00+00+00+00+E5+A1+00+04+02+06+61+4E+A3+0
3+18+1A+57+03+4E+12+00+00+00+00+00+00+00+00+15+25+07+14+03+D6+07=
0x749
=>CS=0x49
2.3
Outbound: Configuration (Programming) Data Message

Definition = Message Type 3
2.3.1
Message Ingredients
------------------------------------------------------------------------------------------------NOTE: For configuration spaces larger than 4K (Typically in Cello-IQ and Cello-CANiQ
units) it is mandatory to use Type 11 programming command, see: Configuration Memory
Write Response Module, Configuration Memory Read Response Module.
------------------------------------------------------------------------------------------------The programming status message has a predefined length of 31 bytes. It contains the
following data (listed in the actual transmitted order):
Message header
System code 4 bytes

Message type 1 byte ("3")
Unit ID 4 bytes
Communication Control Field 2 bytes
Message numerator 1 byte
Spare byte 1 byte
Memory data
Block code 1 byte

Block data 16 bytes
2.3.2
2.3.2.1 Message Header

The message header is identical to the message header of message type 0, except the
message type field set as "3" in programming messages.
2.3.2.2 Block Code

OTA (over the air) parameter programming is done in blocks. The entire parameter
memory is partitioned to 16-bytes long blocks. Each of those blocks is identified with a
block code. The block code field contains the code of the block whose data is sent in this
message (in the block data field).
2.3.2.3 Block Data

Contains the actual data programmed in the specified block of the parameter memory.
Page 54 of 292
Cellocator Wireless
2.4
Outbound: Logged Fragment of Data Forwarded From

Serial Port to Wireless Channel = Type 7
The message contains fragments of payload forwarded from the units serial port,
optionally escorted by fleet management data (as per unit's configuration).
The forwarded payload is divided to 54 bytes long (last one is zero-padded) chunks; each
chunk includes enumeration and fragmentation control fields. The data chunks are stored
into the units log memory and are then uploaded as message type 7.
Same as message type 0 and 9, message type 7:
Continues the Message Numerator used by other logged messages.
Requires acknowledge from the server (Message type 4) in order to erase the specific
message from the log.
The message 7 utilizes the same retransmission algorithms as other logged message
types.
2.5
The Container
The container is a data structure, created by the unit in its RAM buffer upon reception of
the data for forwarding from the units serial port (if enabled in a configuration).
The forwarded payload is escorted by 48 bytes of FM data (attached after the last byte of
payload) and total length of payload + FM data (first 2 bytes of the container, before the
first byte of payload).
Every container is assigned by 6 bits numerator (increased every data packet received
from the serial port), used in fragmentation process and reported with the container.
Forwarded
Message
Code
A sequential
7 bits ID of
the container
+ indication
bit (Single
byte)
The Container
Length of container
(2 bytes)
The payload of forwarded data X
Byte 1
Byte 3
Byte 2
48 bytes of fleet management

data
Byte 3 + X
Byte 3+
X+48
2.5.1.1 The Byte Structure of a Container

The data structure to be fragmented and forwarded:
Forwarded Message Code
Container
(1) /
Simple
payload
In case of container: sequential 7 bits ID of the container, otherwise - sequential 7

bits ID of the forwarded packet.

Page 55 of 292
Cellocator Wireless
Bit 7
Bit 6
Bit 6
Bit 4
Bit 2
Bit 1
Bit 0
Payload length (X)
2 bytes containing the length of the

container starting from byte 3.
The payload, X bytes (up to 512 bytes)
Data as it is received from 3rd party or

Garmin Packet
2
3
Bit 3
3+X
4+X
Units status + Current GSM Operator (1st nibble) (same as byte 16 of Msg type 0)
5+X
Current GSM Operator (2nd and 3rd nibble) (same as byte 17 of Msg type 0)
6+X
Current GSM Operator (4th and 5th nibble) (same as byte 25 of Msg type 0)
7+X
Units mode of operation (same as byte 20 of Msg type 0)
8+X
Units I/O status 1st byte (same as byte 21 of Msg type 0)
9+X
Units I/O status 2nd byte (same as byte 22 of Msg type 0)
10+X
Units I/O status 3rd byte (same as byte 23 of Msg type 0)
11+X
Units I/O status 4th byte (same as byte 24 of Msg type 0)
12+X
Analog input 1 value (same as byte 26 of Msg type 0)
13+X
14+X
15+X
16+X
Mileage counter (total 24 bits) (same as bytes 30-32 of Msg type 0)
17+X
18+X
19+X
Driver ID, PSP/SPC Specific Data, Accelerometer Status or SIM IMSI
20+X
(same as bytes 33-38 of Msg type 0)
21+X
22+X
23+X
24+X
25+X
Time of last GPS Fix (same as bytes 39-40 of Msg type 0)
26+X
Page 56 of 292
Cellocator Wireless
27+X
Location status (flags) (same as Sub-Type 4 of Msg type 9)
28+X
Mode 1 (from GPS)
29+X
Mode 2 (from GPS)

30+X
Longitude
31+X
32+X
33+X
34+X
Latitude
35+X
36+X
37+X
38+X
Altitude
39+X
40+X
41+X
Ground speed
42+X
43+X
44+X
45+X
UTC time seconds
46+X
UTC time minutes
47+X
UTC time hours
48+X
UTC date day
49+X
UTC date - month
50+X
UTC date - year minus 2000 1 byte (e.g. value of 7 = year 2007)
51+X
2.5.2
Data Path Chart
Forwarded
Message Code
The Container
A sequential 7
bits ID of the
container +
indication bit
(Single byte)
Length of container
(2 bytes)
Byte 1
Byte 2
The payload of forwarded data X
Byte 3
48 bytes of fleet management data
Byte 3 + X
Byte 3+ X+48
Fragmented Container
Fragment 1
Fragment 2
Fragment n

Last fragment
Page 57 of 292
Cellocator Wireless
54 first bytes
of container,
starting from
length
4 bytes of
fragment
management
54 bytes of
container
4 bytes of
fragment
management
54 bytes of
container
4 bytes of
fragment
management
54 bytes of
container
(zero
padded)
4 bytes of
fragment
management
Received on server side

Header of
OTA Msg
type 7 (12
bytes)
Header of
OTA Msg
type 7
Static byte
containing
0x07
Static byte
containing
0x07
Message
numerator
(Y)
Message
numerator
Forwarded
Message
Code
Fragment
control byte
54 first bytes of container (starting from length filed) in

Fragment 1
CS
Forwarded
Message
Code
Fragment
control byte
54 bytes of container in Fragment 2
CS
Forwarded
Message
Code
Fragment
control byte
54 bytes of container (zero padded) in last Fragment
CS
(Y+1)
Header of
OTA Msg
type 7
Static byte
containing
0x07
Message
numerator
(Y+2)
2.5.3
Byte-Aligned Table
Byte
no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
Units ID
(total 32 bits)
8
9
10
Communication Control field (same as in MSG Type 0)
11
12
Message Numerator
Sequential numerator of
messages, used by ACK

Page 58 of 292
Cellocator Wireless
Byte
no.
Description
Containing
13
CFE source serial port:

Source of payload
0. N/A
1. N/A
CFE
connected
Static byte containing value 0x07

(0b0111)
Bit 4
Bit 3
2. COM2 (BT)
3. COM3
4. COM4
5. COM5
6. CFE Micro
7. N/A
Bit 7
14
15
Bit 6
Bit 5
Bit 2
Bit 1
Bit 0

Sequential 7 bits ID of the Container+ container indication bit (MSB)
Assigned for each container
Container
(1) /
Simple
payload0
sequential 7 bits ID of the container
Bit 7
Bit 6
Bit 6
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Fragment Control Byte

First
Frame
Last
Frame
Fragment No (starting from 1)
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
16
54 bytes of container in fragment
69
(first one begins with two bytes of length of container starting from byte 3;
70
Check Sum
last one is zero padded)
2.5.3.1 Fragment Control Byte

First Frame: This bit contains "1" if the packet carries the first frame of the
container, otherwise zero.
Last Frame: This bit contains "1" if the packet carries the last frame of the container,
otherwise zero.
Fragment number: Contains sequential number of the fragment, carried in the
packet (starting from 1)
Page 59 of 292
Cellocator Wireless
2.6
Outbound: Real Time Data Forwarded From Serial Port to

Wireless Channel = Message Type 8
(See Applicability Table in section 1
.2 above)
The message contains a payload forwarded from the COM port of the unit, optionally
escorted by fleet management data (as per unit's configuration, refer to a Container
definition above in this document).
The message contains container data of variable length up to 562 bytes (512 bytes
forwarded payload + 2 bytes of payload length + 48 bytes of FM data).
2.6.1
Message Ingredients
Message header
System Code 4 bytes

Message Type 1 byte
Destination Unit ID 4 bytes
Command Numerator 1 byte
Spare 4 bytes
Message payload
2.6.2
Message Code 1 byte

Fragment Control Byte 1 byte
Payload Length 2 bytes
Payload - variable length
Error Detection Code 8 bit additive checksum
Byte-Aligned Table
Message type-byte (a value of 8 for a forwarded data)
Target Units ID (total 32 bits)
7
8
9
10
Command Numerator Field
11
Spare (sent as zeros)
12

Page 60 of 292
Cellocator Wireless
13
CFE source serial port:

Source of payload
0.
N/A
1.
N/A
2.
COM2 (BT)
3.
COM3
4.
COM4
5.
COM5
6.
CFE Micro
7.
N/A
Bit 7
Bit 6
Bit 5
14
Spare (sent as zeros)
15
CFE
connected
Unused
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Container
(1) /
Simple
payload
0
In case of container: sequential 7 bits ID of the container, otherwise sequential 7 bits ID of the forwarded packet.
Bit 7
Bit 6
Bit 6
Bit 4
Bit 3
16
Fragment Control Byte Constant value of 0XC0
17
Length of Payload (or container)
Bit 2
Bit 1
Bit 0
18
19
Payload First Byte
First Byte of payload of forwarded data in a

container
Payload Last Byte
Last byte of the container (of 48 bytes of

escorting fleet management data)
Checksum
2.6.3
2.6.3.1 Message header

The message header is identical to the message header of message type 0, except the
message type field set as "8" in data forwarding messages.

Page 61 of 292
Cellocator Wireless
2.6.3.2 Forwarded Message Code
A counter of forwarded messages, changes every time message is forwarded from the
terminal.
Container
(1) /
Simple
payload 0
In case of container: sequential 7 bits ID of the container, otherwise - sequential 7 bits

ID of the forwarded packet.
Bit 7
Bit 6
Bit 6
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
2.6.3.3 Fragment Control Byte

That field defines, to the control center application, how many fragments are transferred
for the same data block.
Bit 7
Bit 6
Bit 5
Bit 4
Unit
Originated
Bit
Last
Fragment
Bit
Fragment Index
Bit 3
Bit 2
Bit 1
Bit 0
Last Fragment Bit set to 1 if the fragment is the last one.

Unit Originated Bit set to 1 if the message origin is a unit and 0 if the message
origin is an application.]
Fragment Index fragment number.
In case of MSG type 8 will always contain 0xC0

Page 62 of 292
Cellocator Wireless
2.7
Outbound: Modular Message = Message Type 9

The modular data packet is designed to provide different data types in the same packet.
The modular data packet contains the following bytes (listed in the actual transmitted
order):
2.7.1
Message Ingredients
Message Header
System Code 4 bytes

Message Type 1 byte
Unit ID 4 bytes
Message Numerator (Anti-TangoTM) 1 byte
Packet Control Field 1 byte

Total Length 1 byte
First Sub-Data Type 1 byte
First Sub-Data
Length 1 byte
First Sub-Data variable length, depends on Data Type
Nth Sub-Data Type 1 byte (option)

Nth Sub-Data Length 1 byte
Nth Sub-Data variable length, depends on Data Type N
Byte-Aligned Table
1
Message type byte (a value of 9 for a modular packet)
7
8
9
10
Communication Control field
11

Page 63 of 292
Cellocator Wireless
12
Message Numerator
13
Packet Control Field
14
Total Data length
15
First Sub-data Type
16
First Sub-data Length
17
First Sub-data The Data

Nth Sub-data Type
Nth Sub-data Length
Nth Sub-data The Data
Checksum
2.7.2
2.7.2.1 System Code

System code is a 4-bytes value, which identifies the Cellocator GSM-SMS system. The
field is sent as the ASCII values of the letters M, C, G, P, in that order.

Message type identifies the type of message. It allows the receiver to distinguish between
status messages, programming and other data messages, according to the value sent in
this field. Modular messages contain a value of 9 (nine) in the message type field.
2.7.2.3 Unit ID
Refer to Section 2
.2.3.3.

Refer to Section 2
.2.3.4.
2.7.2.5 Message Numerator (Anti-Tango)

Refer to Section 2
.2.3.5.
2.7.2.6 Packet Control Field

Bit 7
Bit 6
Bits 5-0
Direction
Out of space indication
unused
Direction
0 Data from the unit
1 Request (unit-bound)

Page 64 of 292
Cellocator Wireless
Out of Space Indication
0 All the requested data present in the message
1 Some Sub-Data was not returned due to data size
2.7.2.7 Total Length

That field includes the number of data bytes with their types and lengths. It includes the
number of bytes from byte 15 to the byte of the checksum, which is not included.
2.7.3
Code
(Hex)
Outbound Sub-Data Types List

Supported
by CR200/
CR200B
Supported
by CR300/
CR300B
Cello
Nano
CelloTrack
Unused
0
1
CAN Trigger data
Time & Location Stamp data
Accelerometer Data11
PSP UL messages from

Alarm system
Usage Counter update
6
7
8
9
B
C
Modular Platform Manifest

Reserved
13
Pulse Counter OTA request

command and response
Cello-CANiQ : CAN statistics
Request and Response
(Infrastructure)
14
15
11
Command Authentication
table update
Neighbor list of the serving
GSM cell
Maintenance Server Platform
Manifest
Data forwarded from the
Keyboard
3G Cell ID data
Compressed vector change
report
Reserved: TPA Status
12
Firmware Platform Manifest

CAN data
Function
Obsolete

Page 65 of 292
Cellocator Wireless
Code
(Hex)
Supported
by CR200/
CR200B
Supported
by CR300/
CR300B
Cello
Nano
CelloTrack
Function
Cello-CANiQ : Fleet End of

trip report
Reserved
16
17
CFE Inputs Update message

(sub-data type 0x18) Outbound
oneWire Temperature
measurements Request
(InBound)
oneWire Temperature
measurements (OutBound)
18
19
CarSharing2: Reservation
control
commands
Reserved
1A
1B
1C
CDMA Cell ID data
F0
Reserved Infrastructure
F1
F2
F3
F4
F5-FF
Empty
2.7.4
Outbound: The Firmware Platform Manifest (Sub-Data Type 0x01)

This type is generated as a reply to a Firmware Platform Manifest request (see Command
Channel (Section 2.7.15).
Byte
Description
number
1-14
15
16
17
Value
Standard header (as described above)

Sub-data type
0x01
Sub-data length
0x12
Processor family identifier
0x01 PIC18Fx520/620/720
0x02 PIC18Fx621/525
0x03 PIC18Fx527/622/627/722
(x=6/8)

Page 66 of 292
Cellocator Wireless
Byte
Description
number
Value
0x04 ARM Cortex M3 F10x
0x05 ARM Cortex M3 L15x
0x07 STM32F101RDT6
0x08 STM32F103RFT6
0x09 STM32F429IGH6
0xA STM32F103VET7
18
Hardware interface and peripherals

identifier
0x01 40/44 pin micro, peripherals

as per family
0x02 64 pin micro, peripherals as
per family
per family
0x04 64 pin STM32F101RCT6
0x05 64 pin STM32F103RDT6
0x06 64 pin STM32L151RDT6
per family
19-20
Size of program memory (in 1024 bytes In blocks of 1024 bytes

units) (LSB)
Size of program memory (in 1024 bytes
units) (MSB)
21-22
23-24
Size of volatile memory (LSB)

Size of volatile memory (MSB)
Size of internal non-volatile memory
(LSB)
Divided by 128 bytes and rounded

up/down to the closest integer
up/down to closest integer

(MSB)
25-26
Size of external non-volatile memory

(LSB)
In blocks of 1024 bytes

(MSB)
27
28
29-30
External non-volatile memory type
0x01 I2C generic NVM (most

EEPROMs).
0x02 SPI generic NVM.
0x03 Adesto Rev. E
0x04 SPI N25Q NVM
Hardware Version
See: Units Hardware and Firmware

Versions
Reprogramming facility identifier (LSB)
Depends on HW/FW variant
Reprogramming facility identifier (MSB) Depends on HW/FW variant

Page 67 of 292
Cellocator Wireless
Byte
Description
number
31-32
33-34
35
2.7.5
Value
Script language version (LSB)
0x01
Script language version (MSB)
0x00
Current Firmware ID (LSB)
Note that this is in fact not a

descriptor of the firmware platform
per se, but rather a descriptor of the
actual firmware running on the
platform. However, it is a valuable
field when a re-flash is considered.
Current Firmware ID (MSB)
Checksum
Outbound: The Compact CAN Data (Sub-Data Type 0x02)

The CAN data module includes data from all the CAN sensors, defined in the units NVM.
Each CAN sensor is represented by 6 (six) bytes of data as defined below:
Options 1 byte
Spare 1 byte
CAN sensor value 4 bytes (little Endian)
Can Sensor 0
Options byte
Spare
CAN Sensor Value
3
4
5
Can Sensor N
6n
Options byte
6n+1
Spare
6n+2
CAN Sensor Value
6n+3
6n+4
6n+5
Options byte definition

Data receiving flag
Spare
Sensor data effective bit length
Bit 7
Bit 6
Bit 5 - 0

Page 68 of 292
Cellocator Wireless
2.7.5.1 Outbound: Compact CAN Sensor Value
The CAN sensor value contains the actual data, as it is reported from the defined sensors
reported in Little Endian style (LSB first).
2.7.6
Outbound: Compact CAN Trigger Module (Sub-Data Type 0x03)

The packet is sent as a result of a trigger caused by one of the CAN sensors or by a
Complex Trigger. The length of the sub-data type is variable.
2.7.6.1 Module Data

CAN trigger index/ First CAN Trigger Index 1 byte
This value contains the index of the CAN trigger record (or the first trigger from the
Complex Trigger) that caused the transmission. The index of every CAN sensor is set in
the NVM of the unit during programming.
Complex trigger
CAN trigger index / First CAN trigger index (if Complex Trigger bit
=1)
Bit 7
Bits 6-0
Second CAN Trigger Index of Complex Trigger 1 byte

This value contains the index of the second CAN trigger (from the Complex Trigger) that
caused the transmission.
2nd sensor in complex trigger
Second CAN trigger index (if 2 sensors in Complex trigger bit

=1), otherwise spare
Bit 7
Bits 6-0
Included CAN Sensors Count 1 byte

This value is the number of CAN sensors included in the module.
CAN Sensors Data 7n bytes
n is number of included CAN sensors, in accordance with the information in the previous
paragraph.
The list is composed of the following fields, repeated for each included sensor:
Sensor index 1 byte
Options byte 1 byte (see description in sub-type 2)
Spare 1 byte
CAN sensor value 4 bytes
------------------------------------------------------------------------------------------------NOTE: Complex triggers will always be generated as a message, containing values of
both sensors of the complex trigger, and, optionally, the third sensor (additional one,
configurable) and the GPS (see below).
-------------------------------------------------------------------------------------------------

Page 69 of 292
Cellocator Wireless
2.7.7
Outbound: Logged Compact CAN Trigger Module (Sub-Data Type

0x03)
Up to codebase 27e, the logging infrastructure of the Cellocator unit was only applicable
to position messages (type 0). Each event was inserted into an external NVM as a 58bytes record, and 12 more bytes were added at delivery time (synchronization string,
units ID, communication control field and checksum).
From fw28, the same logging mechanism was applied to messages type 9, specifically to
actively generated messages, triggered by CAN bus management routines.
In order to simplify the development it has been decided to use the same logging
procedure, which means that the length of a CAN logged message will always be 58
bytes, similarly to position message.
The message numerator of such a type 9 logged event will maintain the same sequence
as other logged position events (type 0).
The message will require an acknowledgement identical to the acknowledge sent for
message type 0 (and message type 8).
Due to the above-mentioned logging size limitation the Specific data logged CAN
event will include (up to) 3 CAN sensors and a GPS sub-data packet (sub-data 4).
2.7.7.1 Packet Specification

The 58 bytes, which are actually logged are marked by the icon, the rest are added at
delivery time.
Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
As explained above
7
8
9
10
11

Page 70 of 292
Cellocator Wireless
Byte no.
Description
12
Message Numerator
13
0x00
14
Total Data length
0d55
15
Sub-Data Type
16
Sub-Data Length
0d24
17
Index of triggered CAN sensor
Complex
Trigger
CAN trigger index / First

CAN trigger index (if
Complex Trigger bit =1)
Bit 7
Bits 6-0
2nd sensor
in
Complex
trigger
Second CAN trigger

index (if 2 sensors in
Complex trigger bit
=1), otherwise spare
Bit 7
Bits 6-0
18
Spare (or Second CAN trigger index )
Containing
19
Number of included sensors
Between 1 and 3
20-26
First included sensor
Sensor index
Options byte
Spare
4 bytes of CAN sensor value
27-33
Second included sensor
Same as first included sensor
34-40
3rd included sensor
Same as first included sensor
41
Sub-data Type
42
Sub-data Length
0d25
43
Location status (flags)
See the following description of subdata type 4 in this document.
44
Mode 1 (from GPS)
45
Mode 2 (from GPS)

Page 71 of 292
Cellocator Wireless
Byte no.
Description
46
47-50
Longitude
51-54
Latitude
55-57
Altitude
58-59
Ground speed
60-61
62
UTC time seconds
63
UTC time minutes
64
UTC time hours
65
UTC date day
66
UTC date - month
67
UTC date - year minus 2000 1 byte

(e.g. value of 7 = year 2007)
68-69
Spare
70
Check Sum
Containing
zeros
If there are less than 3 sensors defined for the specific trigger, the unit sends the
associated fields as zeros. The message length will remain constant.
------------------------------------------------------------------------------------------------NOTE: A logging frequency limitation exists: the unit will not log more than 1 message
per 4 seconds.
-------------------------------------------------------------------------------------------------
2.7.8
Outbound: Time and Location Stamp Module (Sub-Data Type 0x04)

The module is designed to provide the time and location information as a part of modular
message. The module can be requested with the modular request command. It is also
automatically added to the self-initiated modular messages generated by the unit.
0
Sub-data type=4
Length = 25

Page 72 of 292
Cellocator Wireless
3
Mode 1 (from GPS)
Mode 2 (from GPS)
Longitude
7
8
9
10
Latitude
11
12
13
14
Altitude
15
16
17
Ground speed
18
19
20
21
UTC time seconds
22
UTC time minutes
23
UTC time hours
24
UTC date day
25
UTC date - month
26
UTC date - year minus 2000 1 byte (e.g. value of 7 = year 2007)
2.7.8.1 Location Status

Most significant bit (bit 7) time inaccuracy flag.
"1" indicates time is inaccurate, either because time was never acquired, or because
accuracy is doubtful due to hibernation.
Bit 6 GPS disconnected indication (0=connected, 1=not connected/error).
2.7.8.2 MODE 1 from GPS

Refer to Section 0
.
Page 73 of 292
Cellocator Wireless
2.7.8.3 MODE 2 from GPS
Refer to Section 2
.2.3.21.
2.7.8.4 Number of Satellites Used

Refer to Section 2
.2.3.22.
2.7.8.5 Longitude, Latitude

Refer to Section 2
.2.3.23.
2.7.8.6 Altitude
Refer to Section 2
.2.3.24.
2.7.8.7 Ground Speed

This indicates the current speed (absolute value of the vector). It is represented as a 16bit unsigned integer, in 10-2 meter/sec resolution (speed is represented in
centimeters/second).
The source of speed data is either the GPS, the vehicle's CAN bus or frequency metering
input as per unit's type, installation and configuration.
The reported value may monitor the immediate value of speed recorded upon generation
of the message or the maximum value of speed from last report (as per the
configuration). Byte 10, bit 6 of the message is monitoring the actual reported type.
2.7.8.8 Heading/Speed Direction (True Course)

Refer to Section 2
.2.3.26
2.7.8.9 UTC Time

Refer to Section 2
.2.3.27.
2.7.8.10
UTC Date
Refer to Section 2
.2.3.28.
2.7.9
Accelerometer Response Module (Sub-Data Type 0x05)

Obsolete
2.7.10
PSP UL Messages from Alarm System (Sub-Data Type 0x06)

This message contains encapsulated data forwarded from a CE8 (or CE8 compatible) Car
Alarm System. Refer to the Corresponding Car Alarm protocol for more details.
2.7.10.1
Message Structure
Byte Number
Data
Sub-data type
N
6
Page 74 of 292
Cellocator Wireless
N+1
N+2..... N+X
2.7.11
Sub-data length
Variable
Payload: data forwarded

from car alarm system
Spare
Usage Counter Update Packet (Sub-Data Type 0x07)

The message is generated per request (Sub-Data type 7, as described in the Command
Chanel definition of this document) or as a periodical update. In the latter case, it is
merged with the GPS time/location stamp (Sub-Data type 4).
2.7.11.1
Message Structure
Byte Number
Data
N
N+1
N+2
(N+3)-(N+6)
Sub-Data type
Sub-Data Length
Spare
Spare
Counter 1 value
See the following

description.
Counter 2 value
(N+7)-(N+10)
Counters Data Field Definition

Counter 2 value, minutes (00xFFFFFF)
Counter 2 Counter 1 value, minutes (0input's

0xFFFFFF)
number
Counter 1
input's
number
Byte N+10 Byte N+9 Byte N+8 Byte N+7 Byte N+6 Byte N+5 Byte N+4 Byte N+3
Inputs Numbers Definition
Hardware: Olympic
Inputs name
Inputs number (dec)
Shock
Ignition
Panic
Ext. Alarm Triggered
12
Ext. Alarm Armed
13

Page 75 of 292
Cellocator Wireless
Hardware: Compact CAN

Inputs name
Inputs number (dec)
Door
Shock
Ignition
Panic
Hardware: Compact Security/6 inp. fleet

Inputs name
Inputs number (dec)
Door
Unlock2 Input
Ignition
Panic
Unlock Input
Lock Input
10
Hardware: Compact Fleet/LC

Inputs name
Inputs number (dec)
Door
Shock
Ignition
Panic
COM RTS (pin 11)
Hardware: 370-50
Inputs name
Inputs number (dec)
Door

Page 76 of 292
Cellocator Wireless
Shock
Hood
Volume
Ignition
Panic
GP1
Arm
Disarm
Odometer
11
Unlock
12
Lock
13
Unlock2
14
Hardware: CelloTrack
2.7.12
Inputs name
Inputs number (dec)
Tamper Switch
Push Button
GP input 1
GP input 2
Movement Sensor (Ignition)
Command Authentication Update (Sub-Data Type 0x08)

This packet is sent as a response to an Authentication Table Update command. Refer to
the description of Command Channel
Description
Value
Sub-data type
0x08
Sub-data length
0x09

Page 77 of 292
Cellocator Wireless
2.7.13
Description
Value
Spare
0x00
8 bytes of authentication
table
Auth. Table Index 0
Auth. Table Index 1
Auth. Table Index 14
Auth. Table Index 15
Outbound: Neighbor list of the serving GSM cell (Cell-ID) (SubData Type 0x09)12
This packet will be sent:
Passively, as a response to a Neighbor list of the serving GSM cell request. In this case
the packet will be sent using the same communication transport as the request.
Actively, if enabled in unit's configuration, separately for home and roam GSM
networks, on address dec 201 and 203 respectively, bits 0, 1, 3 and 4.
Description
Value
0x09
Sub-data type
0x35
Sub-data length
0x00
Serving Cell
Timestamp - UTC
time
Spare
seconds
0-59
The UTC time is logged upon Cell

ID (AT#MONI) query (not the
transmission time)
minutes
0-59
hours
0-23
day
1-31
month
1-12
year
Actual year minus 2000

1 byte (e.g. value of
7 = year 2007)
BSIC
Base station identification code. The data can be request

from the Telit modem using #MONI=7, Enfora using an
engineering mode AT commands.
LAC (LSB)
Localization area code
LAC (MSB)
CellID (LSB)
Cell Id
CellID (MSB)
Power
12
Received signal strength in dBm (hex); the sign is not
Supported for 2G variants only

Page 78 of 292
Cellocator Wireless
Description
Value
Zero
Padding
Neighbor cell 6
Neighbor cell 2
Neighbor cell 1
saved, this value is always representing a negative

number
2.7.14
bsic
Base station identification code
LAC (LSB)
LAC (MSB)
CellID (LSB)
Cell Id
CellID (MSB)
Power
Received signal strength in dBm (hex)
bsic
LAC (LSB)
LAC (MSB)
CellID (LSB)
Cell Id
CellID (MSB)
Power
bsic
LAC (LSB)
LAC (MSB)
CellID (LSB)
Cell Id
CellID (MSB)
Power
00
Zero Padding to complete the 55 bytes assigned for single

event (if it's a logged event, i.e. sent actively)
Outbound: Maintenance Server Platform Manifest (Sub-Data Type

0x0A)
Periodically (or upon command from the CCC) the unit connects to a maintenance server
in order to check for the latest firmware and /or programming update. Auto connection to
the maintenance server can be enabled upon power up and upon firmware upgrade.
Upon connection the unit generates a packet which is described below. An acknowledge
(OTA message type 4) is received with a timeout defined in the NVM. If this is not the
case, the platform manifest should be resent.
If the unit cannot establish a connection to the maintenance server while the GPRS is
available, it uses the dial up retry algorithm defined in the NVM Allocation (refer to the
Anti-Flooding section).

Page 79 of 292
Cellocator Wireless
If all the retries fail, the unit ceases to try and reconnects to an operational server
(instead of entering Anti-Flooding, as it would do while connected to an operational
server).
Byte
Description
number
Value
1-14
Standard header (as described above)
15
Sub-data type
0x0A
16
Sub-data length
0x22
17
0x01 PIC18Fx520/620/720
0x02 PIC18Fx621/525
0x03 PIC18Fx527/622/627/722
(x=6/8)
0x04 ARM Cortex M3 F10x
0x07 STM32F101RDT6
0x08 STM32F103RFT6
0x09 STM32F429IGH6
0xA STM32F103VET7
18
Hardware interface and peripherals

identifier
0x01 40/44 pin micro, peripherals

as per family
0x02 64 pins micro, peripherals as
per family
0x03 80 pins micro, peripherals as
per family
0x04 64 pins STM32F101RCT6
0x05 64 pins STM32F103RDT6
per family
19-20
Size of program memory (in 1024

words units) (LSB)
Size of program memory (in 1024

words units) (MSB)
21-22
Size of volatile memory (LSB)

Size of volatile memory (MSB)

23-24

Page 80 of 292
Cellocator Wireless
Byte
Description
number
(LSB)
Value

(MSB)
25-26

(LSB)

(MSB)
27
External non-volatile memory type
0x01 I2C generic NVM (most

EEPROMs).
0x02 SPI generic NVM.
0x03 Adesto Rev. E
0x04 SPI N25Q NVM
28
Hardware Version
See: Units Hardware and Firmware

Versions
29-30
Reprogramming facility identifier

(LSB)
Reprogramming facility identifier

(MSB)
Script language version (LSB)
0x01
Script language version (MSB)
0x00
Current Firmware ID (LSB)
Note that this is not a descriptor of

the firmware platform per se, but
rather a descriptor of the actual
firmware running on the platform.
However, it is a valuable field when a
re-flash is considered.
31-32
33-34
Current Firmware ID (MSB)
35-36
Current PL ID (LSB)
Infrastructure only, currently not

supported
Current PL ID (MSB)
37-44
International mobile subscriber

identity of the SIM (IMSI)
Reference to GSM 07.07, 15 chars

maximum
45-47
Modem's firmware revision
0, From FW version 33x and later

For FW versions older than 33x, see

Page 81 of 292
Cellocator Wireless
Byte
Description
number
Value
the description below
48
Maintenance Configuration
Spare
Firmware
upgrade
enabled
Disabled 0
Enabled - 1
Bits 2-7 Bit 1

49
50
Programming
enabled
Disabled 0
Enabled - 1
Bit 0
Release Candidate Revision ID:

Little Endian 16 bit representing the Release Candidate SVN revision:
Value
Description
Formal Release
165535
The version is a Release Candidate. The 2 bytes shall

represent the SVN revision number:
Example: If the hex file name is
F000_...._RC540.hex the resulted
The binary value representing the decimal RC540 is
0x21c in little Endian.
Checksum
Modem's Revision Stamp in the "Maintenance Platform Manifest" Packet
Bytes 45-47 of the Maintenance Platform Manifest contain the value of the modem's
revision. The modem type is recorded in a hardware byte. This field provides an additional
definition.
Modem's type extension (Extra
byte, addition to the 3MSBits in
the hardware byte of message
type 0)
Modem revision ID, as

Reserved (sent as zero)
presented in the following table
Byte 47
Byte 46
Byte 45
ID (Dec)
Revision
Modem
Unknown
All
Modem revision ID
(Used also in Nano from FW

version 34d and on).

Page 82 of 292
Cellocator Wireless
ID (Dec)
Revision
Modem
0.7.6
Enfora II
0.7.8
3,4
reserved
1.0.5
6.1.1 (Beta)
1.1.1PKG30
1.1.1PKG41
D3-1.1.2PKG47
10
D4-1.1.2PKG47
11
D10.1.1.2
12-20
reserved
21
7.02.002
22
7.02.100
23
7.02.002
24
7.02.003
25
7.02.004
26
7.03.000
27
7.03.030 (Automotive)
28
7.03.002
29
7.03.032
30
10.00.033 (Obsolete)
31
10.00.036

Enfora III
Telit II
Telit III
Telit V2
Page 83 of 292
Cellocator Wireless
ID (Dec)
Revision
Modem
32
10.00.035 (Obsolete)
33
10.00.016
34-40
reserved
41
GLM-4-0610-000
42-50
Reserved for Motorola
51
01.000
Cinterion BGS3
52
02.000
Nano:
Motorola 24L
Cinterion BGS2-W.Rel2
(Used only up to FW version
34c).
53
03.001_arn00.000.14
Nano:
Cinterion EHS5-E
34c).
54
03.001_arn00.000.14
Nano:
Cinterion EHS5-US
34c).
55
03.001_arn00.000.14
Nano:
Cinterion EHS6A
34c).
56
03.001_arn01.000.08
Nano:
Cinterion BGS2-W.Rel3
34c).
57-70
Reserved for Cinterion
71
12.00.002
Telit HE910-G (Reserved)
72
12.00.323
Telit HE910-NAD
73
13.00.003
Telit GE910 QUAD (V2)

Page 84 of 292
Cellocator Wireless
2.7.15
ID (Dec)
Revision
Modem
74
12.00.504
Telit UE910-NAR
75
12.00.404
Telit UE910-EUR
76
10.00.023
Telit GE864 QUAD-V2
77
16.00.303
Telit GE910 QUAD-V3
78
10.00.027
Telit GE864 QUAD-V2
79
12.00.516
Telit UE910-NAD
80
12.00.416
Telit UE910-EUD
81
10.01.522
Telit GE864 QUAD-V2
82
12.00.506
Telit UE910-NAR (SSL)
83-255
Reserved
Outbound: Message Forwarded from Keyboard (Sub-Data Type

0x0B)
This message is forwarded from SPC Keyboard. Refer to 1-Wire Interface Protocol.
58 bytes, which are actually logged are marked by the icon (58 bytes), the rest are
added at delivery time.
Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
Same as in Msg type 0
7
8
9
10
11
Page 85 of 292
Cellocator Wireless
Byte no.
Description
12
Message Numerator
13
0x00
14
Total Data length
0d55
15
Sub-Data Type
16
Sub-Data Length
0d26
17
Length of actual data

forwarded from 1-Wire
channel
Length of Message code +

Specific message code data
18
Spare
19-42
Message code + Specific

message code data + Zero
padding
Containing
In case of response to
Keyboard ID request - 6
Refer to 1-Wire Interface

Protocol
The data length is normally
shorter than 24 bytes; the
extra bytes are zero
padded.
In case of response to
Keyboard ID request the
bytes 19-24 contains the
Keyboard ID, the rest is
zero padding
43
Sub-data Type
44
Sub-data Length
0d25
45
46
Mode 1 (from GPS)
See the following

description of sub-data type
4 in Wireless protocol.
47
Mode 2 (from GPS)
48
Number of satellites used

(from GPS)
49-52
Longitude
53-56
Latitude

Page 86 of 292
Cellocator Wireless
2.7.16
Byte no.
Description
Containing
57-59
Altitude
60-61
Ground speed
62-63
64
UTC time seconds
65
UTC time minutes
66
UTC time hours
67
UTC date day
68
UTC date - month
69
UTC date - year minus 2000

1 byte (e.g. value of 7 =
year 2007)
70
Check Sum
Outbound: 3G Cell ID Data (Sub-Data Type 0x0C)13

Passively, as a response to a 3G Cell ID data request. In this case the packet will be
sent using the same communication transport as the request.
networks, on address dec 201 and 203 respectively, bits 0, 1, 3 and 4.
Description
Value
0x0C
Sub-data type
0x35
Sub-data length
0x00
Timestamp UTC time
Spare
13
seconds
0-59
minutes
0-59
hours
0-23
day
1-31
month
1-12
The UTC time is logged upon

Cell ID (AT#MONI) query (not
the transmission time)
Supported for 3G variants only

Page 87 of 292
Cellocator Wireless
Description
Value
year

year 2007)
MCC (LSB)
Mobile Country Code
MCC (MSB)
Decimal, 200-901
MNC (LSB)
Mobile Network Code
MNC (MSB)
Decimal, 0-999
LAC (LSB)
LAC (MSB)
Serving Cell
RSCP [dBm]
Received Signal Code Power - Energy after processing

with gain from coding, which is equivalent to RSSI
[RSCP=RSSI+EC/No]
(-120 <= RSCP <= -25)
ID (LSB)
Expanded 3G Cell ID (RNC + Cell ID + possible sector)
ID
ID
Zero
Padding
ID (MSB)
2.7.17
Power [dBm]
Received signal strength (hex);

the sign is not saved, this value is always representing a
negative number
00
Zero Padding to fulfill the 55 bytes assigned for single

Outbound: Compressed Vector Change Report (Sub-Data Type

0x0D)
Note that this is supported by Cello only, and will NEVER be generated as realtime or distress events, only as a logged event.
If a corresponding functionality is enabled in programming the compressed vector change
data will be sent by the unit in the following cases:
Upon detection of 6th vector change detection occurrence - in this case the system will
generate a Msg type 9 containing all 6 vector change detection occurrences.
Timeout - if at least one vector change event is stored in unit's memory and no other
vector changes were generated by the unit during the pre-programmed period, the
system will generate Msg type 9 containing all previous vector change detection
occurrences.
Upon Stop - Msg type 9 containing all previous vector change detection occurrences (if
any) will be generated immediately upon stop report.

Page 88 of 292
Cellocator Wireless
Upon reset command - the Msg type 9 containing all previous vector change detection
occurrences (if any) will be generated.
Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
As usual
7
8
9
10
11
12
Message Numerator
13
0x00
14
Total Data length
0d55
15
Sub-Data Type
0x0D
16
Sub-Data Length
17
Number of included vector change detections
18-21
vector change detection 1

Longitude
22-25
Latitude
26-28
Odometer
29
Spare

Page 89 of 292
Cellocator Wireless
Byte no.
Description
Containing
30
Course
31
Speed
32-34
Time
35-41
42-48
49-55
56-62
63-69
70
Check Sum
Each message will contain up to 6 vector change occurrences, while the first one is
reported in its full format, the rest are reported as a delta relative to the last point (see
full message format on the next page).
Each vector change detection occurrence (except the first one) consumes 8 bytes
containing a data of location change from the last vector change (or from the start event),
time from the last event and speed.
Vector change detection 2-6
Delta Longitude (from
last vector change)
Delta latitude (from

last vector change)
Time from vector

change (seconds)
Speed
Byte 6
Byte 4
Byte 2
Byte 0
Byte 5
Byte 3
Byte 1
The latitude, longitude and time of the first vector detection will be stored in its full
format.
True course of the first location is reported as 8-bit unsigned integer. The conversion to
degrees is according the equation below:
Possible values are 0 to 2.

Timestamp of the first Vector change
Minutes (LSB)
Seconds
Bit 7
Bit 5
Bit 6
Bit 4
Bit 3
Bit 2

Bit 1
Bit 0
Page 90 of 292
Cellocator Wireless
Hours (LSB)
Bit 7
Bit 6
Spare
Bit 7
Minutes (MSB)
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Days
Bit 6
Bit 5
Bit 0
Hours
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Delta Longitude and latitude (from last vector change) both are stored as signed integers,
2 to
2
in 10-8 radian resolution. Possible values are to for longitude, or
for latitude.
Time from last vector change is recorded in seconds.

Speed is represented in KM/H.
The reported value of speed may monitor the immediate value of speed recorded upon
generation of the message or the maximum value of speed from the last report (as per
the configuration). Byte 10, bit 6 of the message is monitoring the actual reported type.
The 58 bytes which are actually logged are marked by the icon, the rest are added at
delivery time.
If there is less than 6 vector change detections in this message, the unit fulfills unused
bytes of missing occurrences by zeros. The message length will remain constant.
Number of included vector change detection
Number of included vector
change detections
Bit 7
2.7.18
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Outbound: Modular Platform Manifest (Sub-Data 0x12)

Note that this is supported by Cello/CR200/CR200B/CR300/CR300B/CelloTrack
family.
Generated as a reply to a Modular Platform Manifest request (see Command channel)
Byte
Description
Sub Data Type
0x12
Sub Data Length
Variable, depends on the content
Field 1 - Identifier
Field 1 Length of payload
Field 1 - Payload
Field X - Identifier
Field 1 - Identifier

Page 91 of 292
Cellocator Wireless
Byte
Description
Field X Length of payload (bytes)
Field 1 Length of payload
Field X - Payload
Field 1 - Payload
Fields Definition
Field ID 0x0
0x00 PIC18F6722
0x01 STM32F101RCT6
0x02 STM32F103RDT6
0x03 STM32L151RDT6
0x04 STM32F101RDT6
0x05 STM32F103RFT6
0x06 STM32F429IGH6
0x07 STM32F103VET7
Accelerometer identifier
Field ID 0x1
0x00 MMA7260QT
0x01 LIS331DL
0x02 LIS331DLH (12 bit)
0x03 LIS3DH (16 bit)
Size of Program memory

Field ID 0x2
Number in KBytes
Cello, CelloTrack-T: 256 (dec)
Cello-IQ, Cello-CANiQ, CelloTrack Nano: 384 (dec)
Amount of non-volatile memory used by application (f.ex. configuration)

Field ID 0x3
Number in Bytes
Default 0 (N.A)
Size of internal RAM

Field ID 0x4
Number in KBytes
Cello, CelloTrack-T: 32 (dec)
Cello-IQ, Cello-CANiQ: 64 (dec)
CelloTrack Nano: 48 (dec)

Field ID 0x5
Number in KBytes

Page 92 of 292
Cellocator Wireless
Cello, CelloTrack-T: 512(dec)
Cello-IQ, Cello-CANiQ: 8192(dec)
CelloTrack Nano: 1024 (dec)
Amount of ext. non-volatile memory used by application (f.ex. configuration)
Field ID 0x6
Number in KBytes
Cello, CelloTrack-T, CelloTrack Nano: 4
Cello-IQ, Cello-CANiQ: 8
Size of external RAM

Field ID 0x7
Number in Bytes
Default - 0 (N.A)
Current Firmware ID number

Field ID 0x8
Same as in wireless protocol
Current Hardware ID number

Field ID 0x9
Same as in wireless protocol MSG type 0. See new table here
Modem type
Field ID 0xA
See new table here (only the 3 modem ID bits, for backwards
compatibility)
Modem firmware
Field ID 0xB
Byte 2: Reserved (sent as zero)

Byte 1:
0, from FW version 33x and later
Per table below, for FW versions older than 33x
Byte 0: Reserved (sent as zero)

from FW version 33x and later:
Modem firmware string returned from the Modem (Byte 1)
Modem firmware string returned from the Modem (Byte n)

Bytes 45-47 of Maintenance Platform Manifest contain the value of modem's revision. The
modem type is declared in a hardware byte; this field provides an additional definition.
Reserved (sent as
zero)
Byte 2
Modem revision ID, as per table

below
Reserved (sent as zero)
Byte 1
Byte 0

Page 93 of 292
Cellocator Wireless
Modem revision ID
Please refer to: ModemVersionID
The new Modem firmware reporting mechanism is supported by the following products and
FW versions:
Cello-CAN(IQ) from FW version 33x and later
CR300/B from FW version 43c and later
CelloTrack Nano from FW 34d and later
GPS Type
Field ID 0xC
00 CEL3535
01 CEL1500
02 CEL1500L
03 CEG-1000 (Internal)
04 SIRF4 chip (internal)
05 Glonass (internal)
06 SIRF4 ROM NMEA
07 Telit JF2
08 Telit SE868-V2
09 Telit Modified JF2 (CelloTrack T)
16 NMEA (CelloTrack T)
GPS Firmware
Field ID 0xD
String as returned by GPS to revision request command
First Activation Date/Time

Field ID 0xE
Byte 5
Byte 4
Byte 3
Byte 2
Byte 1
Byte 0
Data length 6 bytes
hour
min
sec
day
month
year
Note that byte 0 is transmitted first, then byte 1 etc.

On the display it's shown as d/m/y h:m:s
FW. Upgrade Date/Time
Field ID 0xF
Byte 5
Byte 4
Byte 3
Byte 2
Byte 1
Byte 0
Data length 6 bytes
hour
min
sec
day
month
year

Last Configuration Change Date/Time

Page 94 of 292
Cellocator Wireless
Field ID 0x10
Byte 5
Byte 4
Byte 3
Byte 2
Byte 1
Byte 0
Data length 6 bytes
hour
min
sec
day
month
year

Firmware file name (string)
Field ID 0x11
Length
Length of the versions file name string up to 120 bytes
Firmware file name string
System ID (STM ID in case of STM controller)

Field ID 0x12
12 bytes hexadecimal
Boot Loader ID
Field ID 0x13
Contains 1 byte indicating Boot Loader's version number
DFD/ SD card version

Field ID 0x14
DFD Version Byte 0
Data Length: 8 bytes
DFD Version Byte 1
DFD Version Byte 2
DFD Version Byte 3
SD Card Version Byte 0
The SD card version is extracted from a file called ver.txt in

the DFDs SD card root directory.
Cello-CANiQ VIN
Field ID 0x15
VIN Vehicle Identification Number

Null terminated string, Up to 17 Bytes
IMSI / IMEI
Field ID 0x16
IMSI (8 Bytes, decimal)

0
1

Page 95 of 292
Cellocator Wireless
2
7
IMEI (8 Bytes, decimal)
0
1
2
7
Originating FW ID
Field ID
0x17
This module shall hold the originating Fw version or the last version the
code tree was merged with.
0
Originating Version ID:

Example: 33
Originating Sub Version ID:

The version of the trunk (Before
Branching or after merging)
Example: 33b
33 Version ID
b Sub Version: = subversion
Letter a = b-a=1
Nano sensors types

Field ID 0x18
Byte#0 0x00 = Compass: ST LIS3MDL

0x01 = Not installed
Byte#1 0x00 = Barometer: Freescale MPL3115A2R1
Byte#2 0x00 = Accurate temperature sensor: Atmel
AT30TS750A
Byte#3 0x00 = Touch sense controller: Freescale MPR031EPR2
Byte#4 - 0x00 = BLE chip: CSR1010
Byte#5 - BLE stack version
Byte#6 - CBLE application major-version
Byte#7 - CBLE application minor-version

Page 96 of 292
Cellocator Wireless
Byte#8#13 = CBLE MAC address (MSB first)
Version Information (Infrastructure)
Field
ID 0x19
Byte
Description
Version Identification (Feature package)

Code
Description
Legacy/Old units only
IQ30
IQ40
IQ50
CAN-IQ30
CAN-IQ40
CAN-IQ50
Spare
Spare
Spare
Spare
Size of Internal non-volatile memory

Field ID 0x1A
Divided by 128 bytes and rounded up/down to closest integer:

Cello, CelloTrack-T, Cello-IQ, Cello-CANiQ: 0 (Dec)
CelloTrack Nano: 96 (Dec) = 12KB
2.7.19
Outbound: Pulse Counter Measurement Response (Sub-Data 0x14)

Will be sent by the unit as a result of Modular Pulse Counter Measurement request (Sub.
Data 0x14)
Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G

Page 97 of 292
Cellocator Wireless
Byte no.
Description
Containing
System code, byte 4
ASCII P
Message type
7
8
9
10
11
12
Message Numerator
13
0x00
14
Total Data length
0x37
15
Sub-Data Type
0x14
16
Sub-Data Length
0d26
17
Spare
18
19
Liter counter 1
LSByte
20
21
22
23
MSByte
Liter Counter 2
LSByte
24
25
26
MSByte

Page 98 of 292
Cellocator Wireless
Byte no.
Description
27
Spare
Containing
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
Sub-data Type
44
Sub-data Length
0d25
45
46
Mode 1 (from GPS)
See the following description of

sub-data type 4 in Wireless
protocol.
47
Mode 2 (from GPS)
48
49-52
Longitude

Page 99 of 292
Cellocator Wireless
Byte no.
Description
53-56
Latitude
57-59
Altitude
60-61
Ground speed
62-63
64
UTC time seconds
65
UTC time minutes
66
UTC time hours
67
UTC date day
68
UTC date - month
69

70
Check Sum
Containing
Fields Definition
Litter Counter 1, Litter Counter 2
The following description is common for both Litter Counter 1 and litter Counter 2:
4 bytes forming unsigned 32 bits value representing the amount of litters consumed from
the last pulse counter reset. The value is a multiplication of the Pulse counter value by the
scaling factor value (PL address 2442-2443 for Door input and 2444-2445 for shock input).
------------------------------------------------------------------------------------------------NOTE: Litters are only one example for volume measurement units. Actually the real
measurement units are defined by the measuring device and its Fuel volume vs. pulses
relation.
-------------------------------------------------------------------------------------------------

Page 100 of 292
Cellocator Wireless
2.7.20
Outbound: Cello-CANiQ (Sub-Data 0x15) (Infrastructure)

Currently not supported.
2.7.21
Outbound: Cello-CANiQ Fleet End of Trip Report (Sub-Data 0x16)

Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
7
8
9
10
11
12
Message Numerator
13
00
14
Total Data length
0d55
15
Sub-data Type
16
Sub-data Length
0d25
17
18
Mode 1 (from GPS)

protocol.
19
Mode 2 (from GPS)
20

Page 101 of 292
Cellocator Wireless
Byte no.
Description
Containing
21-24
Longitude
25-28
Latitude
29-31
Altitude
32-33
Ground speed
34-35
36
UTC time seconds
37
UTC time minutes
38
UTC time hours
39
UTC date day
40
UTC date - month
41

42
Sub Data Type
0x16
43
Sub-data Length
0d26
44
Spare
45
Spare
46
Current Odometer Count (little Endian)
47
48
49
50
Current Trip Fuel Consumption (little

Endian)
51
(100 ml resolution)
52
53
Page 102 of 292
Cellocator Wireless
Byte no.
Description
54
Fuel Tank Level
55
Containing
(100 ml resolution)
56
Fuel Tank Level in %
57
Delta engine hours in this trip (Minutes)
58
59
Spare
60
61
62
63
64
65
66
67
68
69
70
2.7.22
Check sum
Outbound: CFE Inputs Update message (Sub-Data Type 0x18)

This message holds the CFEs inputs status and measurements. This message can be
autonomously generated by the unit (With CFE) or sent as a response to servers request,
See: CFE inputs Status Update Request (sub-data type 0x18) Server to Cello
Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C

Page 103 of 292
Cellocator Wireless
Byte no.
Description
Containing
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
7
8
9
10
11
12
Message Numerator
13
0x00
14
Total Data length
0d55
15
Sub-Data Type
0x18
16
Sub-Data Length
0d26
17
Spare
18
19
Pin 14 / Door Type / Assigned

function
(same as in a configuration)
Since Legacy Cello doesnt support
8/12 bit ADC resolution this message
will always send 8 bit resolution.
20
Measurement LSB Door (In case of

discrete 0 for 0, 255 for 1)
21
Measurement MSB Door
22
Pin 15 / Shock Type / Assigned

function

Page 104 of 292
Cellocator Wireless
Byte no.
Description
Containing
Since Legacy Cello doesnt support
8/12 bit ADC resolution this message
will always send 8 bit resolution.
23
Measurement LSB Shock (In case of

24
Measurement MSB Shock
25
Input1 Type / Assigned function

26
Measurement LSB In1 (In case of

27
Measurement MSB In1
28
Input2 Type / Assigned function In2

29

30
Measurement MSB In2
31

32

33
Measurement MSB In3
34

35

36
Measurement MSB In4
37


Page 105 of 292
Cellocator Wireless
Byte no.
Description
38

39
Measurement MSB In5
40
Containing
41

42
Measurement MSB In6
43
Sub-data Type
44
Sub-data Length
0d25
45
46
Mode 1 (from GPS)

protocol.
47
Mode 2 (from GPS)
48
49-52
Longitude
53-56
Latitude
57-59
Altitude
60-61
Ground speed
62-63
64
UTC time seconds
65
UTC time minutes
66
UTC time hours
67
UTC date day
68
UTC date - month
69

Page 106 of 292
Cellocator Wireless
Byte no.
Description
Containing

70
2.7.23
Check Sum
Outbound: oneWire Temperature Sensor Measurement (Sub-Data

0x19)
Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
7
8
9
10
11
12
Message Numerator
13
0x00
14
Total Data length
0d
15
Sub-Data Type
0d25 (0x19)
16
Sub-Data Length
0d26
17
First oneWire ID (Byte 0)
18

Page 107 of 292
Cellocator Wireless
Byte no.
Description
19
20
21
First oneWire measurement LSB
22
First oneWire measurement MSB
23
Second oneWire ID (Byte 0)
24
25
26
27
Second oneWire measurement LSB
28
Second oneWire measurement MSB
29
Third oneWire ID (Byte 0)
30
31
32
33
Third oneWire measurement LSB
34
Third oneWire measurement MSB
35
Forth oneWire ID (Byte 0)
36
37
38
39
Forth oneWire measurement LSB
40
Forth oneWire measurement MSB
41
Spare
Containing
Coefficient 0.0625
Coefficient 0.0625
Coefficient 0.0625
Coefficient 0.0625

Page 108 of 292
Cellocator Wireless
Byte no.
Description
Containing
42
Spare
43
Sub-data Type
44
Sub-data Length
0d25
45
46
Mode 1 (from GPS)

protocol.
47
Mode 2 (from GPS)
48
49-52
Longitude ( 4 bytes)
53-56
Latitude ( 4 bytes)
57-59
Altitude (3 bytes)
60-61
Ground speed (2 bytes)
62-63
Speed direction (true course) (2

bytes)
64
UTC time seconds
65
UTC time minutes
66
UTC time hours
67
UTC date day
68
UTC date - month
69

70
Check Sum

Page 109 of 292
Cellocator Wireless
2.7.24
Outbound: CDMA Cell ID Data (Sub-Data Type 0x1C)14

Passively, as a response to a CDMA Cell ID data request. In this case the packet will
be sent using the same communication transport as the request.
networks, on address dec 201 and 203 respectively, bits 3 and 4.
Description
Value
0x1C
Sub-data type
0x35
Sub-data length
0x00
Serving Cell
Timestamp - UTC
time
Spare
seconds
0-59
minutes
0-59
hours
0-23
day
1-31
month
1-12
year

year 2007)
SID (LSB)
System ID
SID (MSB)
Decimal, 0-999
NID (LSB)
Network ID
The UTC time is logged upon

Cell ID (AT#MONI) query (not
the transmission time)
NID (MSB)
RSSI [dBm]
Received Signal Strength Index [RSSI=Rx Power + EC/Io]
BSID (LSB)
Base Station ID (Cell ID + possible sector)
BSID
BSID
Zero
Padding
BSID (MSB)
14
00
Zero Padding to fulfill the 55 bytes assigned for single

Supported for CDMA variants only

Page 110 of 292
Cellocator Wireless
2.8
Outbound: Modular Message = Message Type 11

Type 11 was introduced for supporting true modular protocol. The basic structure of the
protocol is designed to carry records with predefined structure called modules. The
protocol will be used as an extension for Cello fleet protocol. Type 11 supports theoretical
message length of up to 65536 bytes, tough the actual rate will be constrained by the HW
limitations. It contains the following data (listed in the actual transmitted order):
2.8.1
Message Ingredients
Message header
System code 4 bytes
Message type 1 byte
Target Unit's ID 4 bytes
Command numerator 1 byte
Packet Control Field Legacy fleet field
Message length - 2 bytes
spare 4 bytes
Payload modules User Configuration Depended
Byte-Aligned Table:
1
System Code, byte 1 ASCII M
System Code, byte 2 ASCII C
System Code, byte 3 ASCII G
System Code, byte 4 ASCII P
Message Type byte (11)
Destination Units ID (total 32 bits)
7
8
9
10
Communication Control Field (2 bytes)
11
12
Command Numerator
13

Page 111 of 292
Cellocator Wireless
14
Length (of the modules section - not including the checksum)
15
16
= 0x0000
17
Symbolizes outbound message (while in inbound these 2 bytes are

allocated to length which is 0)
18
Spare (sent as 0)
19
20
FW_HW ID Module: Mandatory
Other modules
Checksum
2.8.2
2.8.2.1 System Code

Refer to Section 2
.2.3.1

Message type identifies the type of the message. It allows the receiver to distinguish
between status messages, programming and other data messages, according to the value
sent in this field. Modular messages contain a value of 11 (eleven) in the message type
field.
2.8.2.3 Unit ID
Refer to Section 2
.2.3.3

Refer to Section 2
.2.3.4.
2.8.2.5 Command Numerator (Anti-Tango)

Refer to Section 2
.2.3.5

Page 112 of 292
Cellocator Wireless
Bit 7
Bit 6
Bits 5-0
Direction
unused
Direction
0 All the requested data is present in the message.
1 Some Sub-data was not returned due to data size.
2.8.2.7 Length
That field includes the number of data bytes of the modules (with their codes and
lengths). It is the number of bytes from byte 16 to the byte of the checksum, which is not
included.
2.8.3
Outbound Type 11 Module Structure

The general structure of a type 11 module is as follows:
0
Module Code
Length of module (16 bits) Number of payload bytes
2
3
Modules Payload bytes
.
.
n
2.8.4
Outbound Type 11 Modules Table

Type
Description
Spare
DTC Event Module
Variables Dump List Module (Programmable Message Structure)
Spare
Calibration Data Snap Shot Module
Spare
GPS Location Stamp Module

Page 113 of 292
Cellocator Wireless
Type
Description
GPS Time Stamp Module
FW ID Module
ACK Module
10
Configuration Memory Write Response Module

(8 Kbytes)
11
Configuration Memory Read Response Module
12
CAN-GPS Speed Calibration Status
13
Spare
15
Spare
16
Spare
17
Spare
18
Spare
19
Spare
20
Spare
21
Occupied for Inbound module
22
VIN Read Response Module
23
Infrastructure Calibration Command Module
24
Spare
25
Trigger Event ID Module
26
(Infrastructure)
27
Spare
28
General Status Event
29
30
Reserved for PHSN General Status Event
31
CAN Variables Status Dump
32
33
Spare
34
Spare
35
36
Spare

Page 114 of 292
Cellocator Wireless
Type
2.8.5
Description
37
Spare
38
Spare
39
Spare
40
Measurement readings (Nano)
41
Legacy encapsulated message (Nano)
42
Nano inherent sensors (Nano)
Outbound: DTC Event Module

0
Module Name 1 - DTC Event
Length of module (16 bits) depends on the number of DTC

Entries events detected
2
3
Number of DTCs received by Mode 3
Number of DTCs received by Mode 7
DTC Entry (2 Bytes)
6
7
DTC Entry (2 Bytes)
8
DTC Entry
15
14
Error
Type
13
12
11
10
DTC Code
Error Type table:

Code
Error Type
P Power train
C - Chassis
B - Body
U Network

Page 115 of 292
Cellocator Wireless
2.8.6
Outbound: Variables Dump List Module

This Message will be sent as part of the Cello-CANiQ Trigger event message. This is a
mandatory module designed to identify the trigger Event ID and the Cello-CANiQ variables
list attached to the event. The variable dump list is a programmable list of CAN variables
selected when the user builds the CAN triggering. Please refer to Cello-CANiQ Integration
Manual for more details.
Trigger Event module will be sent with the following modules to create trigger Event
message:
Type 11
header
Module 8
(Fw Id)
Module 6
(Location)
Module 7
(Time)
Module 25
Trigger ID
Module 2
(Event)
Variables Dump List Module Structure:

0
Module Name 2 Variable Dump List
Length of module (16 bits)
2
3
Operator ID : 16 bits
4
5
Pl Signature as taken from : PL signature Descriptor
6
7
8
9
Number Of Variables
Variable ID (2 Bytes)
Variable Length
Variable payload
.
.
.
.
Variable ID (2 Bytes)
Variable Length
Variable payload

Page 116 of 292
Cellocator Wireless
2.8.7
Outbound: Calibration Data Snap Shot Module

0
Module Name 4 - Calibration Data Snap Shot
Length of module (16 bits) - 6
2.8.8
Spare
Spare
5-8
Current Odometer count (little Endean) 4 bytes
Outbound: GPS Location Stamp Module

0
Module Name 6 - GPS Location Stamp
2
3
HDOP
Mode 1 (from GPS)
Mode 2 (from GPS)
Longitude
8
9
10
11
Latitude
12
13
14
15
Altitude
16
17
18
19
Ground speed (km/h)
20

Page 117 of 292
Cellocator Wireless
21
2.8.9
Outbound: GPS Time Stamp Module

0
Module Name 7 GPS Time Stamp
2.8.10
Validity of time (valid - 1 /invalid - 0 )
System time seconds
System time minutes
System time hours
System date day
System date month
System date year (-2000)
Outbound: Firmware ID Module

0
Module Name 8 - FW ID
2.8.11
Spare (=0)
Type 11 Protocol ID (=1)
FW ID Major: Example 33
FW ID Minor: Example 1 for a
HW Type: Example 20
Spare (=0)
Outbound: ACK Module

0
Module Name 9 - ACK
Length of module (16 bits) 3
2
3
0 - ACK
1 - NACK
Spare

Page 118 of 292
Cellocator Wireless
5
2.8.12
Spare
Outbound: Configuration Memory Write Response Module

0
Module Name 10 Configuration Memory Write Response
2
3
Numerator (16 bits)
4
5
Number of instances ACK.

Instance action status
0-O.K
1-Write Error
..
..
2.8.13
Outbound: Configuration Memory Read Response Module

Module Name 11 Configuration Memory Read Response
Numerator (16 bits)
Number of Instances
Memory space: 0
Memory entry type : 0-Bit, 1-Byte, 2-Word (16bits), 3-Long(32
bite)
Address in the memory space selected. The 32 bits number is
function of the memory entry defined by Memory entry type
16 bits defining the number of Memory Entries.

Payload
.
Page 119 of 292
Cellocator Wireless
Instance 2 (If defined by the number of instances)
2.8.14
Outbound: CAN-GPS Speed Calibration Status

0
1
2
Module Name 12 CAN-GPS Speed Calibration Status

Spare (0)
Spare (0)
CAN-GPS Calibration Status:

0 CAN-GPS calibration started
1 CAN-GPS calibration accomplished
2 CAN-GPS calibration error
3 CAN-GPS calibration status unknown
6-7
0-10km/h CAN-GPS Conversion (1/1000)
8-9
11-20 km/h CAN-GPS Conversion (1/1000)
10-11
12-13
14-15
16-17
18-19
20-21
22-23
24-25
26-27
28-29
30-31
32-33
34-35
36-37

Page 120 of 292
Cellocator Wireless
2.8.15
38-39
40-41
Outbound: VIN Read Response Module

0
Module Name 22 VIN Read Response
2
3
VIN Byte 0
19
2.8.16
VIN Byte 16
Outbound: Trigger Event ID Module

0
Module Name 25 - Trigger Event ID
2
3
Operator Id
4
5
Spare
Spare
Spare

Page 121 of 292
Cellocator Wireless
2.8.17
Outbound: General Status Event Module

The module includes system events and notifications. The Module structure has dedicated
event fields which will identify the event type and the attached information fields. The
module can support multiple concatenated events structures.
General Event module is sent with HW ID, GPS time and location modules (modules 6 and
7). The General Event Message is a Type 11 message designed to reflect system events
and notifications towards the server. The message is built as follows:
Type 11
Header
Fw Hw ID
Module 8
Event Category
GPS Stamp
Module 6
Event
Code
Time Stamp
Module 7
Length
General Event
Module 28
Event Information
Bytes
Event Category
Event
Code
Event Entry
Length
Event Information
Bytes
Event Entry
Module 28 below describes the general format of a General Event. The module can carry
multiple entries of General Event structures. Each General Event Entry includes Event
Category, Event code, Event data length in bytes and event related data bytes.
Module Name 28 - General Status Event
Number of entries
Event Category (2 Bytes)
Event Entry
Event Code (2 Bytes)

Event related data length (in
bytes)
Event Related info bytes .
Second Entry
Event Entry:
Third Entry
Event Entry S:
General Event Entry Detailed Structure

OBD2 Query Event
0
Event Category (2 Bytes): Cello-CANiQ = 0

Page 122 of 292
Cellocator Wireless
1
2
Event Code (2 Bytes): OBD2 CAN query status change = 1
3
4
Length of data = 5 Bytes

Event Data 1 and 2 will change their meaning according to the
setting of the Event Code. Normal conditions are reflected as 0
for Standard variables and 16 for NonStandard variables.
Event code
Description
0 or 16
Back to Normal
Standard SID/PID Non Responsive
Standard SID/PID Unsupported
17
Non Standard Query NonResponsive Event.

When this event is pending, Event-Data-1
filed will contain the Non Standard index.
Event Data 1 (2 Bytes)

The content of this field depends on the event Code. This field is
relevant when event happens and when it goes back to normal
Event
code
Event Data 1 as function of the

Event Code
(2 Bytes)
Initial state
0 or 1
Standard/Manufacturing SID
number not responding to query
0 or 2
Standard/Manufacturing SID
declared Unsupported
16 or 17
Non Standard query index not

responding/responding to query.

Page 123 of 292
Cellocator Wireless
8
Event Data 2 (2 Bytes)

The content of this field depends on the event Code. This field is
relevant when event happens and when it goes back to normal
Event
code
Event Data 2 as function of the

Event Code
(2 Bytes)
Initial State
0 or 1
Standard/Manufacturing PID number

not responding to query or 0 when
the SID without PID.
0 or 2
Standard/Manufacturing PID
declared Unsupported or 0 when the
SID without PID.
16 or 17
NA
CAN BUS Event

0
Event Category: Cello-CANiQ (2 Bytes) = 0
1
2
Event Code (2 Bytes): CAN BUS Event = 2
3
4
Length of message (1 Byte) = 2 Bytes
( 1 Byte)
2.8.18
BUS State
Event code
Description
Connected
Disconnected
Spare
Outbound: CAN Variables Status Dump

This module will be sent by the unit towards the server upon receiving General Module
Query with requested module Id set to 31. The module will include the content of all the
defined CAN variables. Each variable is represented by a Variable Dump Entry structure.
The variable IDs are allocated by the programmer tool during the CAN variables definition
and allocation.
0
Module Name 31 Variable Status Dump

Page 124 of 292
Cellocator Wireless
1
2
3
Number of variable entry sent by this module (16 bits)
4
Variable dump Entry 1
Variable dump Entry 2
.
Variable Dump Entry:

Variable ID
Variable parsing format:

0
UNKNOWN
BOOL
UINT8
SINT8
UINT16
SINT16
UINT32
SINT32
FLOAT
STRING
Number of data bytes (1 byte)

Variable data bytes .

Page 125 of 292
Cellocator Wireless
Command Channel (Inbound Messages)
3.1
Overview
The telemetry channel comprises several kinds of messages, as described below:
Generic Command Message (message code 0) most commands are sent using
this message. This message is always replied to with a status/location message from
the target unit (if the command is received successfully). A status/location message,
which is sent as a response to a command, has one of its flags (the message initiative
flag) raised to indicate a reply.
Programming Command (message code 1) this message provides OTA
programming capabilities, and is always replied to with a programming status
message from the target unit, when received correctly.
Acknowledge Message (Message Code 4) - sent by central control to verify
reception of outbound status, telemetry or transparent data messages.
Forward Data Command (message code 5) this message allows the sending of
data to the terminal attached to the unit.
Modular message request (Message code 9) this message is designed to
request the unit to send types of data, defined in Modular Message packet like CAN
bus sensors, Cell ID, debug data, and more. The description of the message is outside
the scope of this document.
Self Re-flash Chunks (Message code 10) a message that forwards firmware file
data chunks for the self-re-flash process of the unit. The Self re-flash process
description is outside of the scope of the current document (see Self Re-flash
Appendix for more details).
3.2
Generic Command Message Definition
3.2.1
General Details
The generic command message is the main command interface to the Cellocator unit. The
message is defined to have a constant length (25 bytes), regardless of the actual
command that is being sent. All fields are defined and when not being used by a certain
command, they still must be sent (containing a zero value).
3.2.2
Message Ingredients
Message header
System code 4 bytes
Message type 1 byte
Authentication code 4 bytes
Command data
Command code field 1 byte repeats twice

Page 126 of 292
Cellocator Wireless
1st Command data field 1 byte repeats twice
2nd Command data field 1 byte repeats twice
4 bytes reserved for future use
3.2.3
Byte-Aligned Table
1
Message type byte (a value of 0 for a generic command message)
7
8
9
10
11
Authentication Code
12
13
14
15
Command code field
16
Command code field (repetition)
17
1st Command data field
18
1st Command data field (repetition)
19
2nd Command data field
20
2nd Command data field (repetition)
21
Command Specific Data field
22
23
24
25
Error detection code 8-bit additive checksum (excluding system

code)

Page 127 of 292
Cellocator Wireless
3.2.4
3.2.4.1 System Code

The same system code constant that is sent on every message ASCII M, C, G, P
or M, C, G, S, in this order.

Message type field for generic command messages contains a zero value.
3.2.4.3 Target Units ID

This field should contain the unique unit ID of the target Cellocator unit. The unit ignores
all received commands that do not contain the appropriate unit ID number.
3.2.4.4 Command Numerator Field

This field should contain the number of the command. This number appears in the
Message numerator field in the units reply message, enabling the user to easily
distinguish between acknowledged commands and un-acknowledged ones.
3.2.4.5 Authentication Code

This field contains a 4-byte unique authentication code, which is verified by the unit, in
order to provide protection against unapproved command attempts (from fw27p). For
example: an attempt to change the traffic destination IP by unauthorized personnel.
If the code is not verified as authentic the unit will not perform / acknowledge the
command.
The feature should be switched on in the unit's configuration (refer to Programming
Manual for more details).The feature is switched off by default.
The 4 bytes authentication code is generated as a function of two variables:
Units ID
8 bytes Auth Table, stored in the NVM of the unit and concurrently in the
Communication Center application (refer to Modular Message Definition for
modification instructions to this table).
The OTA Auth. table modification will be only be accepted by the unit if the Command
Authentication feature is DISABLED.
The following are default values of the Auth. table.
Index
10
11
12
13
14
15
Value
15
12
11
14
10
13
3.2.4.6 Command Code

As the generic command message mold is relevant for all kinds of commands, it is
necessary to specify the actual command that is desired. Each different command is
therefore assigned a unique command code, which is used in the command code field, to
specify the command to be executed.
See the Commands table for command codes.
Page 128 of 292
Cellocator Wireless
3.2.4.7 Command Data Fields (1st and 2nd)
The command data fields contain further information, which is needed by some of the
commands.
3.2.4.8 Command Specific Data Field

The command data field (4 bytes) contains additional information, specified separately for
each Command Code.
See the Commands table for more information.
3.3
Inbound: Generic Command-Message type 0
Command
Code
Meaning, Data Fields assignments
0x00
Immediate status request

Data field: don't care
0x02
Unit state change.

Data field value: meaning
0x00: Go to Standby
0x01: Go to Emergency mode
This command sets the unit to start transmitting emergency messages according to
the command configuration.
The command is sent with two parameters, the interval between each emergency
transmission and how many transmissions to send to the operator.
If the number of transmissions chosen is 0, the unit sends the emergency
transmission constantly.
If the time between transmissions is set to 0, the unit sends the emergency
transmission according to the pre-programmed definition of the Distress Mode in the
NVM.
The emergency command is meant to emulate the action of a driver pressing on the
emergency button. It uses the same mechanism. If an emergency command is sent
and the driver simultaneously presses on the emergency button, the emergency
function that the driver initiated stops the command sent by the operator and starts
its own emergency session.
Here is an example of the emergency command sent to a unit:
Number of distress trans.=2
Time between distress trans. events=5sec
4D 43 47 50 00 4B 01 00 00 1C 6E DF DD DD 02 02 01 01 00 00 02 05 00 00 7C
0x02: Reset
The following fields will be reset: The "Garmin Enabled", Garmin Connected" and
GSM hibernation indication bit flags, Message numerator, Units status, Current
GSM operator report, Units mode of operation, I/O, Analog inputs, Driver ID
/PSP Specific Data/Accelerometer Status, Last GPS Fix, Number of satellites,
Longitude, Latitude, Altitude, Speed, Course, System time, System date.

Page 129 of 292
Cellocator Wireless
Command
Code
The modem will be re-initialized, the GPRS connection restored.

The RAM buffer used for data forwarding will be reset.
Configuration parameters will be reloaded from Configuration memory.
0x03: Enter Garage Mode (Security unit only)

0x04: Arm Alarm (Security unit only)
0x05: Release from Emergency mode (does not stop the Siren, only stops emergency
transmissions)
Command Specific Data field: don't care
0x03
Output state change. Data field should contain output change information, according
to this table:
Data field 1 value: function
00h / 10h: Siren (off / on)
01h / 11h: Hood lock (off / on), in 370-x0 only
02h / 12h: SP1W (off / on,) in 370-x0 only
03h / 13h: Ext Immobilizer (Same output as Gradual Stop) (off / on)
04h / 14h: Blinkers (off / on)
05h / 15h: Standard immobilizer 1 (off / on)
06h / 16h: Speaker phone voltage (off / on), in 370-x0 only
07h / 17h: Internal lights (off / on), in 370-x0 only
08h / 18h: LED (off / on), in 370-x0 only
09h / 19h: General Output (off / on), in 370-x0 only
0Ah / 1Ah: Windows (off / on), in 370-x0 only
0Bh / 1Bh: Stop Light (off / on), in 370-x0 only
0Ch / 1Ch: Buzzer (off / on), in 370-x0 only
0Eh: Lock (performs pulse), in 370-x0 and Olympic modifications only
0Fh: Unlock (performs pulse), ), in 370-x0 and Olympic modifications only
Data field 2 and 2 bytes of Command Specific Data field:
Contain time of the output activation with one second resolution. Value of 0 cause
permanent output change.
Example: Activate Siren for 5 minutes (300 seconds).
MCGP 00 ID ID ID ID 00 00 00 00 00 03 03 10 10 2C 2C 01 01 00 00 CS
Nested output activation: If the MSBit of the 3rd byte of command specific data field
is set, the command will be executed only after the vehicle stops, e.g. after Ignition
off or after 10 (by default) valid GPS packets showing speed lower than 1 km/h).
Example:
Activate Siren Nested for 5 minutes (300 seconds).
MCGP 00 ID ID ID ID 00 00 00 00 00 03 03 10 10 2C 2C 01 01 80 00 CS

Page 130 of 292
Cellocator Wireless
Command
Code
0x04
Disable Active Transmissions. This command will control the corresponding bit in the
unit's configuration (address 6, bit 1) and immediately stop or restore active
transmissions generated by the end unit. The existing GPRS session will be
disconnected upon "disable command" or restored upon "Enable command".
Data field:
0 Disable active transmissions
1 Enable active transmissions
0x05
Tracking control command (Based on Time Events). Data field: zero to stop tracking,
non zero sets the resolution of time events and immediately implements it. Refer to
Programming Manual for values.
0x06
Alarm Cadence Control command (supported only by CelloAR unit)

Data field 1 '1' to activate, '0' to deactivate.
Data field 2 don't care.
0x07
Commence gradual engine stop (PWM Immobilizer - from 100% to 0% duty cycle).
Data field must contain zero (a non-zero value stops Immobilizer).
0x0C
Initiate CSD session

0x0D
Erase tracking Log from NVM memory

0x0E
Reset GPS receiver

Data field:
a) zero for standard reset (by On/Off pin)
b) 1st = 0x5A
2nd =0xA5
For Factory GPS reset command. Note, that the unit can (configurable) perform GPS
reset automatically in the following cases:
1. Standard reset (by On/Off pin) on ignition off.
2. If the GPS is communicating, but not navigating and MODE1=0, MODE2=16 for 10
minutes the unit performs a factory GPS reset.
3. If the GPS is not communicating, or communicating but not navigating and
MODE10, MODE216 for 15 minutes the unit performs standard GPS reset.
4. If same condition as in item 3 remains true for the next 15 minutes the unit
performs a factory GPS reset.

Page 131 of 292
Cellocator Wireless
Command
Code
0x0F
Lock /Unlock sequence detection learn (for Security units only)

Data field value: Function
00h: Learn Lock sequence
01h: Learn Unlock sequence
02h: Learn additional unlock sequence
FFh: Erase learned sequences from memory
0x10
Force GPS energizing (Not supported by Cello family)

The command allows maintaining GPS activated, regardless of hibernation logic.
Warning: Note that only GPS is affected by this command! If GPS is forced active,
there is no way to send a command to revert the GPS back to automatic behavior
while communication is down (due to the hibernation mask or due to shutdown of the
modem as a result of the full hibernation).
1st + 2nd command data fields:
0x12
A value of 1 (one) to force energizing of GPS.
A value of 0 (zero) for automatic GPS behavior (according to normal logic).
Connect to server (from FW28)

0 Main server
1 Secondary server (provisioning)
2 Maintenance Server
0x13
Reserved for manufacturer use
0x14
Calibrate frequency counters

Data field 1 contains description of the calibration type:
Reserved
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Source type
Calibrated input
0 GP Freq. (RPM)
0 pin 14
1 Speed
1 pin 15
Bit 1
Bit 0
Data field 2:
In case of GP Frequency contains percent of maximum engine load (i.e 10 for

10%)
In case of speed required distance in hundred's meters (recommended value

5km).
Command Specific Data field

N/A

Page 132 of 292
Cellocator Wireless
Command
Code
0x15
Control of transparent mode over COM (independent from control by Door input (pin
14)).
Command ID 0x15
Data field 1 contains action code: 0 - deactivate, 1- activate
Data field 2 contains activation time (in seconds); 1 to 255 seconds, 0 - permanent
activation
If activation by Door input (pin 14) is enabled: The OTA command overwrites input
setting.
0x16
Query connected trailer ID

Data field dont care.
0x17
Reserved
0x18
Camera Support (Infrastructure)
0x19
Nano wakeup and status request (Infrastructure)

0x1A
Enable modem "FOTA" Session (Infrastructure)
0x1B
PHSN Control Command (Infrastructure)

Data field 1 contains action code: 0 - deactivate, 1- activate
Data field 2 contains activation time (in 10 seconds units): 1 to 255 seconds, 0
illegal value
0x1C
CarSharing2: Call Central Control Command

This field will include index of the preprogrammed phone number, which will be used
upon dial up.
1 - Will cause the unit to dial to number programmed in addresses 273
2 - Will cause the unit to dial to number programmed in addresses 167
0x1D
17
Data Field 1 Call Center Phone number index (1 or 2)
18
Data Field 1 (repetition) Call Center Phone number

index (1 or 2)
CelloTrack T: force the CelloTrack T to Not Active mode.

No parameters
0x1F
CAN-GPS Speed Calibration Command

Page 133 of 292
Cellocator Wireless
3.4
Inbound: Programming Command Definition = Message

Type 1
3.4.1
Message Ingredients
------------------------------------------------------------------------------------------------NOTE: For configuration spaces larger than 4K (Typically in Cello-IQ and Cello-CANiQ
units) it is mandatory to use Type 11 programming command, See: Configuration Memory
Write Module, Configuration Memory Read Request Module.
------------------------------------------------------------------------------------------------The programming command has a predefined length of 34 bytes. It contains the following
data (listed in the actual transmitted order):
Message header
System code 4 bytes
Message type 1 byte
Memory data
Block code 1 byte
Programming "masking" bitmap 2 bytes
Block data 16 bytes
3.4.2
3.4.2.1 Message Header

Identical to Message header of Command type 0, except the Message type field sent as 1
(one).
3.4.2.2 Block Code

OTA (over the air) parameter programming is done in blocks. The entire NVM parameter
memory is partitioned to 16-bytes long blocks. Each of those blocks is uniquely identified
with a block code. The block code field contains the code of the block whose data is sent
in this message (in the block data field).
3.4.2.3 Programming "Masking" Bitmap

The bitmap allows programming of only part of the parameters in a block, while leaving
the other parameters with their previous values.
Each bit in the 16-bit wide value represents a byte in the parameters memory block. The
LSbit of the bitmap represents the byte with the lowest offset in the program block. A
value of "1" in a certain bit enables programming to the corresponding byte in the
parameters memory, whereas a value of "0" prohibits programming of that byte.
Page 134 of 292
Cellocator Wireless
3.4.2.4 Block Data
Contains the actual data programmed in the specified block of the parameter memory.
Bitmask bytes (Each bit is an index of a
corresponding byte in a block)
7
Byte 0 of Bitmask
1
5
1
4
1
3
1
2
1
1
1
0
Block of NVM
Byte 1 of Bitmask
Byte 0
Byte 1
Byte 14
3.5
Inbound: Generic Acknowledge Message Definition =

Message Type 4
3.5.1
General Details
Byte 15
The generic acknowledge message is an inbound message sent by central control to verify
reception of outbound status (type 0) and data forward (type 8) messages. The message
is defined to have a constant length (28 bytes), all fields are defined and when not being
used, they still must be sent (containing a zero value).
3.5.2
Byte-Aligned Table
1
Message type byte (a value of 4 for acknowledge message)
7
8
9
10
11
Authentication Code Field
12
13
14
15
Action code

Page 135 of 292
Cellocator Wireless
16
Main Acknowledge number LSB (this field shall include the value
received in Message Numerator field of the acknowledged
transmission)
17
Reserved for Main Acknowledge number MSB (sent as zeros)
18
Reserved for Secondary acknowledge number LSB (sent as zeros)
19
Reserved for Secondary acknowledge number MSB (sent as zeros)
20
Reserved for future use (sent as zeros)
21
Compressed Date (Starting from LSB: 7 bits of year -2000, 4 bits of

month, 5 bits of day)
22
23
24
25
26
27
28
3.5.3
Compressed Time (Starting from LSB: 5 bits of hours, 6 bits of

minutes, 6 bits of seconds, 7 spare bits that always equals
128='1000000')
Reserved for future use (sent as zeros)

Error detection code 8-bit additive checksum (excluding system
code)

(four)
3.5.3.2 Action Code

Set to zero.
3.5.3.3 Main Acknowledge Number

The Message Numerator filed of the acknowledged outbound message.
3.5.3.4 Secondary Acknowledge Number

Currently not used and sent as zero.

Page 136 of 292
Cellocator Wireless
3.6
Inbound: Forward Data Command Definition = Message

Type 5
3.6.1
Message Ingredients
The forward data command has a varying length of up to 271 bytes (in regular forwarding
mode) or 534 bytes (in transparent mode). It contains the following data (listed in the
actual transmitted order):
Message header
System code 4 bytes
Message type 1 byte
Settings Byte 1 byte
Data length 1 byte + 2 bits of Settings Byte (the 2 bits extension is applicable only
for transparent mode)
Data to Forward variable up to 255 bytes (in regular forwarding mode) or 518 bytes
(in transparent mode)
3.6.2
Byte-Aligned Table
1
Message type byte (a value of 5 for acknowledge message)
7
8
9
10
11
Authentication Code Field
12
13
14
Page 137 of 292
Cellocator Wireless
3.6.3
15
Setting Byte
16
Data Length (bits 0-7)
17
Data to Forward: up to 255 bytes (in regular forwarding mode) or 518 bytes (in
transparent mode)

(five)
3.6.3.2 Settings Byte

This byte is used for different system indications.
Destination of payload
Reserved, should
be sent as zero
0. N/A
1. N/A
2. COM2 (BT)
3. COM3
Data Length
Bit 9 (MSB)
Data Length
Bit 8
Packet to
Garmin
(compatible to
Garmin's serial
(Extension
is
(Extension is
protocol)
applicable for applicable for
transparent
transparent
mode only)
mode only)
4. COM4
5. COM5
Forward SMS
Message15
6. CFE Micro
7. CFE Micro N/A)
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Packet to Garmin set to1 if the packet should be forwarded to Garmin terminal.
In case CFE configuration is used bits 5-7 will define the target CFE serial port
3.6.3.3 Data Length

This field should contain a number of bytes to forward (up to 255 bytes (in regular
forwarding mode) or 518 bytes (in transparent mode)).
3.6.3.4 Data to Forward

This is the data that is forwarded to the terminal attached to the unit. This field must be
an exact number of bytes long, as listed in the Data Length field.
15

Page 138 of 292
Cellocator Wireless
3.7
Inbound: Modular Message Request Definition = Message

Type 9
The modular data packet request is designed to provide different data types in the same
packet. The modular data request contains the following bytes (listed in the actual
transmitted order):
3.7.1
Message Ingredients
Message header
System Code 4 bytes
Message Type 1 byte
Command Numerator 1 byte
Spare 4 bytes
Packet Control Field 1 byte
Total Length 1 byte
First Sub-Data Type 1 byte
First Sub-Data
Length 1 byte
First Sub-Data variable length, depends on Data Type
Nth Sub-Data Type 1 byte (option)

Nth Sub-Data Length 1 byte
Nth Sub-Data variable length, depends on Data Type N
Byte-Aligned Table:
1
Message Type byte (a value of 9 for Modular Data Packet)
7
8
9

Page 139 of 292
Cellocator Wireless
10
Command Numerator
11
Spare (sent as 0)
12
13
14
15
16
Length (of the modules section - not including the checksum)
17
First Sub-data Type
18
First Sub-data Length

First Sub-data Data
Nth Sub-data Type
Nth Sub-data Length
Nth Sub-data Data
Checksum
3.7.2
3.7.2.1 System Code

Refer to Section 3
.2.4.1

sent in this field. Modular messages contain a value of 9 (nine) in the message type field.
3.7.2.3 Unit ID
Refer to Section 3
.2.4.3

Refer to Section 3
.2.4.4

Bit 7
Bit 6
Bits 5-0
Direction
unused
Direction
Page 140 of 292
Cellocator Wireless
3.7.2.6 Length
That field includes the number of data bytes of the modules (with their types and
included.
3.7.3
Inbound Sub-Data Types Table

Subdata
Type
Description
0x00
Unused
0x01
Firmware Platform Manifest
0x02
CAN data
0x05
Obsolete (Used to be Compact EDR request message)
0x06
PSP DL messages to Car Alarm
0x07
Usage Counter Request / Command
0x08
Command Authentication Table Modification command
0x09
Neighbor list of the serving GSM cell request
0x0B
Forward Data To Keyboard
0x12
Modular Platform Manifest
0x14
0x18
0x19
3.7.4
Modular Pulse Counter Measurement request (Sub. Data 0x14)

CFE Inputs Update message (Msg type 9, sub-data type 0x18)
Cello to Server / Server to Cello
SingleWire Temperature Sensors (Infrastructure)
Inbound: Firmware Manifest Request (Sub-Data Type 0x01)

This message serves as a Firmware manifest request.
3.7.5
Inbound: CAN Data Request (Sub-Data Type 0x02)

This message serves as a CAN data request, therefore a Sub-data N Length is sent as 0,
and, as a result, the Sub-data N field is not sent at all.

Page 141 of 292
Cellocator Wireless
3.7.6
Inbound: Time and Location Stamp Module (Sub-Data Type 0x04)

This message serves as a Time and Location Stamp Module request, therefore a Sub-data
N Length is sent as 0, and, as a result, the Sub-data N field is not sent at all.
3.7.7
Inbound: Accelerometer Data (Sub-Data Type 0x05)

Obsolete.
3.7.8
Inbound: PSP UL Messages from CCC to Alarm System (Sub- Data

Type 0x06)
This message contains encapsulated data forwarded from the CCC to the CE8 (or CE8
compatible) Car Alarm System. Refer to Corresponding Car Alarm protocol for more
details.
The Cellocator unit acknowledges, by a regular status message (Outbound message type
0, refer to Cellocator OTA protocol) with bit0 = '1' (Reply to command) in the
communication control filed (Byte 10).
The message numerator of the Ack message is identical to the numerator of the command
reaching from the CCC.
3.7.8.1 Message Structure

Byte number
Data
N
N+1
N+2..... N+X
3.7.9
Sub-data type
Sub-data Length
Variable
Payload: Data forwarded

from Car Alarm system
Spare
Inbound: Usage Counter Write/Request Command (Sub-Data Type

0x07)
The purpose of this feature is to count the "high state" time of a pair of inputs, for
example, to report the total engine hours of a machine.
The inputs whose "high state" time is counted are selectable by programming.
Two timers can be assigned to a specific input, including the option to assign both timers
to the same input. Each input, including ignition, supports this "high state" time
calculation.
The value of the measured time from each input is stored in RAM (protected, not erased
on software reset, 24 bits for each parameter, not part of configuration memory), with a
resolution of minutes.
The unit rounds off partial minutes: (1:29 is regarded as 1 minute and 1:30 and above as
2 minutes).
Once a day, the content of both usage counters is backed up on the dedicated address in
non-volatile memory.

Page 142 of 292
Cellocator Wireless
The timer proceeds with time counting (from the value stored in RAM) each time the
logical level of the appropriate input changes from "low to high".
The timer stops counting each time the logical level of the input changes from "high" to
"low".
The RAM values of usage counter is automatically updated on each RS232 and OTA
Counters Set command.
3.7.9.1 Command Structure

Byte Number
Byte Data
Sub-data type
N+1
Sub-data length
N+2
Control byte
Bitmap
N+3
Update period
Time
N+4
Spare
Spare
(N+5)-(N+7)
Usage counter 1
Refer to bitmap
(N+8)-(N+10)
Usage counter 1
Minutes
Control Byte Definition Structure

Unused
Enable periodical
update
Action bits
Bits 3-7
Bit 2
Bit 1
Bit 0
Action Bits Definition

Bit 1
Bit 0
Read counters data
Write counter 1
Write counter 1
Write counter 1 and 2
Enable Periodic Update flag Definition

If this bit is set (1) the unit starts generating packets 9 (with Sub-data field 7, refer to
Inbound Channel in this document) periodically. Each packet includes a module of GPS
Page 143 of 292
Cellocator Wireless
(Sub-data 4). The period of the packet generation is defined in byte N+3 of this
command.
A value of zero cancels periodic message generation.
3.7.9.2 Update Period Definition

The value defines the rate of the periodic update of usage counters. The value of the
counter is stored in the corresponding address on the NVM and implemented immediately.
The byte is only used when the Enable Periodic Update flag in the Control byte of this
command is set.
Data format: 1 byte, 1 minute resolution, from 1 minute to 255 minutes. Zero value
cancels timers reporting.
Counters Data Field Definition
Counter 2 value
Byte N+10
Counter 1 value
Byte N+9
Byte N+8
Byte N+7
Byte N+6
Byte N+5
------------------------------------------------------------------------------------------------NOTE: If both Action bits are zero (request command) the Counters data field is "dont
care" and is sent as zeros.
-------------------------------------------------------------------------------------------------
3.7.10
Inbound: Command Authentication Table Change (Sub-Data Type

0x08)
The system provides protection against unapproved command attempts. For example, it
provides protection against an attempt to change traffic destination IP by an unauthorized
person. Every incoming message to the unit (such as command, acknowledge and so on)
is provided a unique code, which is verified by the unit. If the code is not verified as
authentic, the unit does not perform / acknowledge the command.
If Command Authentication is enabled in the unit's programming, the unit checks a valid
4-byte authentication code in bytes 11-14 of every inbound message. An inbound
message with an invalid authentication code is declined by the unit. The unit does not
respond to such a command and does not perform it. The 4 bytes authentication code in
bytes 11-14 is generated as a function of two variables:
Units ID.
8 bytes Authentication Table, stored in the NVM of the unit and concurrently in the
Communication Center application.
------------------------------------------------------------------------------------------------NOTE: The OTA Authentication table modification will be accepted by the unit only if the
Command Authentication feature is DISABLED in the unit's programming.
------------------------------------------------------------------------------------------------Default values of the Authentication Table are as follows:
Authentication Table (8 bytes, 16 nibbles):

Page 144 of 292
Cellocator Wireless
Index
10
11
12
13
14
15
Value
15
12
11
14
10
13
3.7.10.1
Authentication Table write/read command
This packet is sent to the unit in order to access an Authentication Table values OTA
(read, write or modify):
Description
Value
Sub-data type
0x08
Sub-data length
0x0A
Action byte
Bitmap, see the following description.
Spare
0x00
8 bytes of
Authentication table
Authentication table Index 0
3.7.10.2
Action Byte
Value
Description
Remarks
Read Authentication table

from NVM
Bytes 11-18 of the

command are don't care
Write Authentication table to Bytes 11-18 contain the new

NVM (supported only when
values to be programmed.
the Authentication command
is disabled).
2-7
Reserved
------------------------------------------------------------------------------------------------NOTE: Reset is required in order to apply OTA Authentication table modification.

-------------------------------------------------------------------------------------------------

Page 145 of 292
Cellocator Wireless
3.7.11
Inbound: Neighbor list of the serving GSM cell request (Sub-Data

Type 0x09)
This packet will cause the unit to generate a packet, containing last knows GSM related
information (updated every 60 seconds) from the whole set of seven cells in the neighbor
list of the serving cell.
Field
Description
Length
Neighbor list of the serving

GSM cell
0 - Spare
The unit responds with neighbor list of the serving GSM cell (Sub-Data Type 9)
3.7.12
Inbound: Forward Data To Keyboard (Sub-Data Type 0xB)

The unit responds with neighbor list of the serving GSM cell (Sub-Data Type 9)
Byte Number
Byte Data
Sub-data type
N+1
Sub-data length
Variable (Refer to table below).

If this field is 0, the unit will
respond by Keyboard ID
N+2
Length of data to be forwarded to

1-Wire port
N+3
Length of expected reply from the Refer to 1-Wire Interface Protocol

Keyboard to be forwarded back
from 1-Wire port
N+4
Command Type
N+5 N+x
Command Data (optional, variable Refer to 1-Wire Interface Protocol

length, in some cases missing)
3.7.12.1
Actually (Sub-data length-2)
Refer to table below
Command Type (Refer to Cello AR 1-Wire Interface Protocol)
Command name
Command Type
Data
Reset keyboard
[80H]
1 byte
Keyboard id request (read

rom)
[33H]
No Data

Page 146 of 292
Cellocator Wireless
3.7.13
Feedback to driver
[81H]
3 bytes
Set operational state
[82H]
2 bytes
Time Update
[83H]
4 bytes
Access Code Programming
[85H]
3 bytes
System Code (Multicode)

Programming
[87H]
3 bytes
Status request
[89H]
1 byte
Code request
[8AH]
2 bytes
Driver Code Control

Command
[8CH]
4 bytes
Inbound: Modular Platform Manifest request (Sub-Data Type 0x12)

This command causes the unit to generate an OTA Modular Platform Manifest message.
The message will contain the data fields as per the specification in a command
Data part: The data part of this packet has a size of 6 bytes. Each byte contains a bitmask
as described below. Setting bit to "1" causes the unit to add a corresponding field to the
Modular Platform Manifest.
Byte
Description
Sub Data Type
0x12
Sub Data Length
0x06
Byte 0
Bitmap
Byte 1
Bitmap
Byte 2
Bitmap
Byte 3
Bitmap
Byte 4
Bitmap
Byte 5
Bitmap
Byte 0
Size of
external
RAM
Amount of
ext. nonvolatile
memory used
by application
(f.ex.
configuration)
Size of
external
nonvolatile
memory
Size of
internal
RAM
Amount of
non-volatile
memory used
by application
(f.ex.
configuration)
Size of
Program
memory
Accelerometer
identifier
Processor
identifier
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0

Page 147 of 292
Cellocator Wireless
Byte1
FW
Upgrade
Date/Time
Initial
Power up
Date/Time
GPS
firmware
GPS Type
Modem
firmware
Modem
type
Current
Hardware
ID number
Current
Firmware
ID number
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
IMSI/IMEI
Request
CelloCANiQ
DFD / SD
card
version
Request
Boot loader
ID
System ID
(STM ID in
case of
STM
controller)
Firmware
name
(string)
Last
Configuration
Change
Date/Time
Bit 2
Bit 1
Bit 0
Byte 2
Head
Version
Base
VIN
(Vehicle
ID)
Request
Request
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Reserved
Reserved
Reserved
Reserved
Reserved
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Byte 3
Size of
internal
non-volatile
memory
request
Version
Information
Request
Nano
sensors
Bit 2
Bit 1
Bit 0
Byte 4
Byte 5
Reserved bits will be transmitted as Zero.
3.7.14
Inbound: Modular Pulse Counter Measurement request (Sub-Data

Type 0x14)
Fuel consumption measurement Request (as from the last time the counter was reset)
Byte
Description
Sub Data Type
0x14
Sub Data Length

Page 148 of 292
Cellocator Wireless
Byte
Description
Spare
Spare
Pulse Counter Measurement Response
3.7.15
Inbound: CFE inputs Status Update Request (Sub-Data Type 0x18)

This message will be sent by the server towards the unit for requesting CFE analog inputs
measurements results. The returned CFE inputs measurements will be sent from the unit
towards the server as a Type 9 message. Please refer to: CFE Inputs Update message
(Msg type 9, sub-data type 0x18) Cello to Server for more details.
Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
7
8
9
10
11
12
Message Numerator
13
0x00
14
Total Data length
0d55
15
Sub-Data Type
0x18
16
Sub-Data Length
0d2
17
Spare

Page 149 of 292
Cellocator Wireless
Byte no.
Description
Containing
18
19
3.7.16
Check Sum
Inbound: oneWire Temperature Sensor Measurement Request

InBound (Sub-Data Type 0x19)
Byte no.
Description
Containing
System code, byte 1
ASCII M
System code, byte 2
ASCII C
System code, byte 3
ASCII G
System code, byte 4
ASCII P
Message type
7
8
9
10
11
12
Message Numerator
13
0x00
14
Total Data length
0d04
15
Sub-Data Type
0d25 ( 0x19)
16
Sub-Data Length
17
Spare
18
Spare

Page 150 of 292
Cellocator Wireless
Byte no.
Description
19
Check Sum
Containing

Page 151 of 292
Cellocator Wireless
3.8
Inbound: Modular Message = Message type 11

Type 11 was introduced for supporting true modular protocol. The basic structure of the
protocol is designed to carry records with predefined structure called modules. The
protocol will be used as an extension for Cello fleet protocol. Type 11 supports theoretical
message length of up to 65536 bytes, tough the actual rate will be constrained by the HW
limitations. It contains the following data (listed in the actual transmitted order):
3.8.1
Message Ingredients
Message header
System code 4 bytes
Message type 1 byte
Message length - 2 bytes
spare 4 bytes
Payload modules User Configuration Depended
Byte-Aligned Table:
1
Message Type byte (11)
7
8
9
10
Command Numerator
(When transmitting ACK packet, it carries the numerator of the
original message)
11
Authentication

Page 152 of 292
Cellocator Wireless
12
13
14
15
16
Length (of the modules section - not including the checksum).

Must be 0 (to symbolize inbound message), meaning that there
should not be a message without any modules.
17
18
Spare (sent as 0)
19
20
21
22
Modules
Checksum
3.8.2
3.8.2.1 System Code

Refer to Section 3
.2.4.1

sent in this field. Modular messages contain a value of 11 (eleven) in the message type
field.
3.8.2.3 Unit ID
Refer to Section 3
.2.4.3

Refer to Section 3
.2.4.4
Page 153 of 292
Cellocator Wireless
Bit 7
Bit 6
Bits 5-0
Direction
unused
Direction
3.8.2.6 Length
That field includes the number of data bytes of the modules (with their codes and
included.
3.8.3
Inbound Type 11 Module Structure

The general structure of a type 11 module is as follows:
0
Module Code
Length of module (16 bits) Number of payload bytes
2
3
Modules Payload bytes
.
.
n
3.8.4
Type 11 Modules Table

Type
Description
Spare
Occupied for Outbound module
Spare
Spare

Page 154 of 292
Cellocator Wireless
Type
Description
10
Configuration Memory Write Module
11
Configuration Memory Block Request Module
12
13
Spare
15
Spare
16
Spare
17
Spare
18
Spare
19
Spare
20
Spare
21
VIN String Write Module
22
VIN String Request Module
23
Infrastructure Calibration Command Module
24
Spare
25
26
(Infrastructure)
27
Spare
28
29
General Module Query
30
Reserved for PHSN General Status Event
31
32
General Command
33
Spare
34
Spare
35
Forwarded CAN Query
36
Spare
37
Spare

Page 155 of 292
Cellocator Wireless
Type
3.8.5
Description
38
Spare
39
Spare
40
41
42
Inbound: Configuration Memory Write Module

0
Module Name 10 Configuration Memory Write
2
3
Numerator (16 bits)
4
5
Number of instances
Memory type: 0
Memory entry unit type: 0-Bit, 1-Byte, 2-Word 16 bits, 3-Dword
32 bits: Must be set to 1
Address in the configuration memory space (32 bits). The address
shall represent the entry units above.
For example: if the entry type is 0 (bit), then address 7 shall
represent the 8th bit in the first byte.
Number of Entries: number of entries sent in this message. (16

bits)
Data payload according to the entry size and the number of
entries defined above.
..
Instance number 2, etc.

Page 156 of 292
Cellocator Wireless
3.8.6
Inbound: Configuration Memory Read Request Module

0
Module Name 11 Configuration Memory Read Request
2
3
Numerator (16 bits)
4
5
Number of Instances
Memory space: 0
Memory entry type : 0-Bit, 1-Byte, 2-Word (16 bits), 3-Long (32
bits)
Address in the memory space selected. The 32 bits number is
function of the memory entry defined by Memory entry type
16 bits defining the number of Memory Entries.
Instance 2 (If defined by the number of instances)
3.8.7
Inbound: VIN String Write Module

0
Module Name 21 - Vin String Write
Length of module (16 bits) 17 Bytes
2
3
VIN Byte 0
19
VIN Byte 16

Page 157 of 292
Cellocator Wireless
3.8.8
Inbound: VIN Read Request Module

0
Module Name 22 - VIN Read Request
Length of module (16 bits) 4 Bytes
3.8.9
Spare
Spare
Spare
Spare
Inbound: General Module Query

This command will be sent by the server to request a set of modules to be returned to
the server. The module describes a list of module Ids. The addressed unit will respond
with a type 11 message carrying the requested modules content arranged in the same
order of the request.
0
Module Name 29 General Module Query
2
3
Number of requested Modules

First requested module ID
Second requested module ID
..
3.8.10
Inbound: General Command

This module is a general command module. The module enables the server to command
the unit to perform multiple actions while specifying the action code and optional data
bytes attached to the command. The general format of the module is shown below. The
unit will send Acknowledge upon receiving the module.
0
Module Name 32 General Command
2
3
Number of Command entries sent by this module (8 bits)

Command Entry 1

Page 158 of 292
Cellocator Wireless
Command Entry 2
.
Command Entry:
0
Command ID: See Commands types description
1
2
Commands data bytes (1 byte)

Commands data bytes
Commands Type Description:

Command ID
Description
Number of
Attached data
bytes
Expected units response
Reset CAN OTA

events Queue
pointers
One ACK for all the command

request
Reset Unit
One ACK for all the command

request
10
Hoze
Set Odometer
257
Nano: send cyclic

buffer of the
designated source
1+n*5
Cyclic buffer
258
Nano: send current

value of Work ID
Work ID
259
Nano: send status of

the designated
source
Status of the designated source
(n=1 in case of
single or all)

Page 159 of 292
Cellocator Wireless
3.8.11
Inbound: Forwarded CAN Query

This module enables the server to command the unit to forward CAN query to CAN bus (in
both J1939 and OBD modes). The unit will send Acknowledge upon receiving the module
0
1
2
Module Name 35 Forward CAN Query

Spare (0)
Number of repetitions (0 - means that the query will only be

forwarded once, 1- means it will be repeated after 100ms, 2
means it will be repeated 2 times with 100ms between each
repetition and so on.)
Control Byte (LSB - Header Format)

0 Automatic
1 11bit,
2 29 bit.
The rest not used
Arbitration ID
Arbitration ID
Arbitration ID
Arbitration ID
10
Number of additional data bytes
11
MODE (SID)
12
PID Byte 1
13
PID Byte 2
14
User define
15
User define
16
User define
17
User define

Page 160 of 292
Cellocator Wireless
CSA OTA Protocol

The protocol defines 3 types of interactions. Each interaction is a process, containing at
least two packets (the message itself and its acknowledge).
Event from CSA This short message, which is sent by CSA to notify the Safety
Server about certain events such as speeding, idling, dangerous maneuvers or
accident buffer overflow.
Programming to CSA This interaction enables the Safety Server to access (read
and write) the programming memory of CSA as well as setting advanced maneuver
analysis parameters, not accessible through the plain programming API.
Command to CSA This interaction is initiated by the Safety Server when immediate
action is required (interaction with LED monitor, raw upload initiation, eco and score
request, etc). Command to CSA will always cause the CSA to reply by Response to
command, which will vary from command to command.
FTP/TFTP files structure The Cello-IQ can generate safety related data files that
are sent via FTP/TFTP to the server. The safety information includes trip and
maneuver raw data and statistics and EDR crash files. Raw data files are compressed
for cost effective transmission and server side storage optimizations.
Cello-IQ Applicability- Cello-IQ has a reduced features variant called Cello-IQ40.
The following table describes the differences between Cello-IQ40 and Cello-IQ50.
Messages associated with EDR, Combo Maneuvers, Slalom will not be supported in
Cello-IQ40 variants.
Cello-IQ
Feature
Sub feature
Cello-IQ 40
(reduced)
Cello-IQ50
(Full)
Speeding
Harsh Accel
Harsh Brake
No Raw data.
Harsh Turn
Maneuvers
Turn&Accel
Turn&Brake
Off road
Excessive RPM
Slalom
Crash
- GPS
profile only as
raw data.
E-Call
Page 161 of 292
Cellocator Wireless
EDR

Page 162 of 292
Cellocator Wireless
4.1.2
CSA Protocol Frame

Any CSA message is a structure, containing at least one module out of a predefined list of
modules, encapsulated into a protocol frame. The frame includes a prefix and 8 bits
addictive check sum at the end.
Any active CSA message to the server (generated by the unit's logic and not as a
response to a request or command) requires an ACK.
Any command or request sent from the server to CSA will be replied by a message
containing a different set of modules, depending on the command. Such a CSA response
does not require an ACK from the server.
1
Prefix of
message's frame
System code, byte 2 ASCII S
System code, byte 3 ASCII A
Length of message from byte 6 to CS
5
6
7
Message ID (Sequential numerator used by ACK

mechanism. In replies contains the numerator of the
command.)
Message Type / Initiator / Direction (0 for CSA event)

Initiator
Direction
Protocol Version
0
reply or
ACK
0
inbound
1active
Bit 7
Message Type
1outbound
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Cello Units ID (total 32 bits)
10
11
12
13
First Module
Payload of the
message
Optionally second module
Error detection code 8-bit additive checksum

Suffix of
message's frame
Page 163 of 292
Cellocator Wireless
4.1.3
4.1.4
Message Types Table

Number
Description
Inbound
CSA Event / Reply to command
ACK (The acknowledge to message types 0)
Programming inbound
Programming outbound
Command to CSA
Outbound
CSA Protocol Version

CSA protocol version ID.
4.1.5
CSA Event (Message type 0 from CSA to Server)

CSA Event is a message initiated by CSA upon violation of the pre-programmed condition
and delivered to Safety Server (through a dedicated socket).
CSA Event requires ACK from the server in order to be deleted from the buffer. If the ACK
is not received, the event is resent after the configured timeout (30 seconds by default).
Self-initiated CSA event contains at least the "CSA Full Event" module (ID 30), but other
modules (such as PLMN) may also be auto-attached to it according to configuration.
CSA Event generated as a reply to a command contains at least the "Event Info" module
(ID 0), but can contain as many modules as requested in a command. Obviously in such a
case no ACK is required.
4.1.6
Table of CSA Event Reasons

(Reported in Event Info and CSA Full Event modules)
CSA
Event
number
Description
Reserved
IP UP
CSA Event Sub

Reason
Description
Crash occurred
EDR Light
(CSA event with this Reason

will be accompanied by
module 35: Crash attributes
and module 36: VIN in
Cello-CANiQ)
EDR Heavy
Maneuver Light
Maneuver Heavy
Or in case of crash maneuver

support: Module 63 (Crash
maneuver) and module
36:VIN in Cello-CANiQ
128
EDR Light: While parking
129
EDR Heavy: While parking

Page 164 of 292
Cellocator Wireless
CSA
Event
number
Description
CSA Event Sub

Reason
Crash data ready to upload
Maneuver memory overflow
Calibration
Description
Only applicable for value of 3 in bits 0-2

Calibration phase
0 - Phase 1
1 - Phase 2
Calibration Step
number
(0 9)
0 Calibration
Started
1 Calibration OK
Will always be
escorted by
Calibration Matrix
(module 43)
2 Calibrate Bad
Install
3 Calibrate In
Progress (after HW
reset)
4 Calibration Error
Bit 7
Harsh Acceleration
**
Harsh braking
**
Harsh turn
**
Bits 3-6
Bits 0-2
Reserved
Green severity
Yellow severity
Red severity
Reserved
Green severity
Yellow severity
Red severity
Reserved
Green severity
Yellow severity
Red severity

Page 165 of 292
Cellocator Wireless
CSA
Event
number
Description
Speeding16
CSA Event Sub

Reason
End of maneuver
Description
Spare
0-Speeding End
1-Speeding Green
(Normal)
0-During
maneuver
2-Speeding Yellow
(Moderate)
1-End of
maneuver
Bit 7
10
Lane crossing
**
11
Off road
**
12
Excessive RPM
Idling
13
14
Reply to command
15
Turn & Brake
**
3peeding Red
(Dangerous)
Bits 3-6
Bits 0-2
Reserved
Green severity
Yellow severity
Red severity
Off road start
1-2
Reserved
Off road end
Low RPM
High RPM
Excessive RPM
Back to Normal
Short idling start
Long idling start
Idling end
Reserved
Green severity
Yellow severity
Red severity
16
Speeding maneuvers are sent when certain thresholds are crossed. On every speeding the Green is sent upon speeding
detection (when getting inside speeding maneuver), then maybe yellow and red (one for each, at most). At the end of the
maneuver the "speeding end" event is sent. Note the events are sent without any statistics.
Page 166 of 292
Cellocator Wireless
CSA
Event
number
Description
CSA Event Sub

Reason
Description
16
Turn & Accelerate
Reserved
Green severity
Yellow severity
Red severity
**
17
File upload completed

7
Uploaded File
Type
Upload Status
Successfully
uploaded &
erased
Maneuver file
Successfully
uploaded & kept
in memory
Trip File
Upload failure
Crash File
Failure: No file
to upload
Recorder File
Infrastructure
7
18
Ignition On/Off
Ignition status
The source of signal

used
for detection
1= Ignition ON,
0 = Ignition input
0= Ignition OFF
1 = ACC ignition sensor

2 = ACC movement
sensor
3 = ACC sensor +
Voltage
High Nibble

Low Nibble
Page 167 of 292
Cellocator Wireless
CSA
Event
number
Description
19
Go/Halt event
CSA Event Sub

Reason
Description
Go or Halt
The source of signal

used
for detection
0= Halt
0 GPS
1= Go
1 Speed from Vss

2 Movement by Acc
3 Speed from CAN
(provision)
4-15 Reserved
High Nibble
20
Driver ID update
24
Trip Start /End update
7 6
Low Nibble
Trip start/Stop stimuli source

TRIP_SOURCE_IGNITION,
TRIP_SOURCE_ACCEL
TRIP_SOURCE_ACCEL_MOV
TRIP_SOURCE_ACCEL_AND_V
OLT
TRIP_SOURCE_DALLAS
TRIP_SOURCE_GPIO_DOOR
TRIP_SOURCE_GPIO_IGNITION
TRIP_SOURCE_GPIO_DISTRES
S
TRIP_SOURCE_GPIO_LINE_A
TRIP_SOURCE_GPIO_LINE_B
TRIP_SOURCE_GPIO_LINE_C
TRIP_SOURCE_RESET
25
Speeding: GPS Recording

0
1
2
3
0-TripEnd
4
5
6
7
1-TripStart
8
9
10
11
This maneuver type will

never be transmitted as
a CSA event; Used as a
Maneuver Type in raw
GPS record (only if
corresponding bit in the
NVM is enabled).
Page 168 of 292
Cellocator Wireless
CSA
Event
number
Description
CSA Event Sub

Reason
26
Off-road setup process
Off-road
setup
process
level
Description
Infrastructure
(not supported in
current version)
0 Off-road setup
process Started
Off-road setup
process speed range
1 Off-road setup
process OK
0 - 16 km to 25 km
2 Off-road setup
process failed
(infrastructure)
0 100
GPS
1 - 26 km to 35 km
1 1000
GPS
3 - 46 km to 55 km
2 - 36 km to 45 km
4 - 56 km to 65 km
3 Off-road setup in
process (after
Calibration OK)
5 - 66 km to 75 km
(infrastructure)
6 - 76 km to 85 km
Bit 7
27
DFD Communication Status

change
Bits 2-6
Bits 0-1
0- DFD Communication lost.

1- DFD Communication Established
Requires Calibration, will not be generated prior to accomplishment of calibration

procedure.
**
4.1.7
The Acknowledge (to CSA Event, Message Type 1 from Server to

CSA)
This message is sent as a response to a message type 0 with any event reason except 13
(reply to command). The message contains only the module 9 the ACK.
The command numerator of the protocol frame contains the repetition of the message ID
from the event's protocol frame.
Initiative bit in byte 8 of the frame contains 0, direction inbound.
4.1.8
Program/Read Parameters to CSA (Message Type 2 from Server to

CSA)
This interaction is initiated from the server side in order to read or modify the
programmable parameters in CSA memory.
The CSA programming parameters memory is part of a Cello unit's programming
parameters memory and practically hosted on certain addresses assigned for CSA.
Some set of parameters are not available through standard read/write programming
memory commands and assigned with dedicated APIs.
The CSA manages an address conversion (offset) and the server treats the first address of
the CSA programming parameters memory as zero.
Normally this command will contain single module 10 (programming Frame), 37 or 38,
although it can also contain status request module (ID 12).

Page 169 of 292
Cellocator Wireless
4.1.9
Reply to Program/Read Parameters Command (Message type 3

from CSA to Server)
This message is sent as a response to a message type 2. Normally it will contain only the
module 11 (Reply to Programming Frame). In case programming frame module (ID 10) in
a request was accompanied by Status Request module (ID 12), this reply will also contain
modules requested in Status Request module.
4.1.10
Command to CSA (Message Type 4 from Server to CSA)

This interaction is initiated by the server when immediate action, like interaction with
Driver's Feedback device, raw upload initiation, trip statistics request etc., is required.
Command to CSA will contain the module of one command.
Command to CSA will always cause the CSA to reply by Message Type 0; this reply will
contain at least the Module (ID 30), but can also be accompanied by other modules. For
example if the Status Request Module (ID 12) is attached to the command.
Some modules support concatenation, others do not. This means that in most cases only
one command can be sent in a single message, although there are a few exceptions
allowing requesting few modules in a single reply. Refer to the following modules
summary table for details.
Module ID
Command Name
12
Status Request
13
Driver's feedback device control
15
Request trip / maneuver statistics
16
Request maneuver raw upload
17
Request accident raw upload
18
Erase unsent CSA events
19
Erase accident data
20
Calibration Mode
21
Raw logger
54
Real Time Raw Acc Data control command
62
General CSA Control Command
64
The unit can provide 2 levels of reply to the command (as per configuration):
Upon reception, before performance: The unit will deliver Event Info module,
containing zero in the event numerator field and repeating 16 bits message numerator
of the command in the corresponding frame's field.
Upon execution: The unit will deliver Event Info module, repeating the command
numerator in the event numerator field and repeating 16 bits message numerator of
the command in the corresponding frame's field.
Page 170 of 292
Cellocator Wireless
4.2
Modules Description
4.2.1
Modules Summary Table

Number
Description
Inbound
Outbound
Support of
concatenation
in reply
Can appear
in message
types
Event ID
Driver ID
Trip ID
Maneuver ID
PLMN
0, 3
Memory Usage
Status
GPS Stamp
Time Stamp
0, 3
CSA FW ID
ACK
10
Programming Frame
11
Reply Programming
Frame
12
Status Request
13
Driver's feedback
device control
15
Request maneuver
raw statistics
16
Request maneuver
raw+stat upload
17
Request accident raw

upload
18
Erase unsent CSA

events
19
Erase accident data
20
Calibration Mode
21
Raw logger Mode

Page 171 of 292
Cellocator Wireless
Number
Description
Inbound
Outbound
Support of
concatenation
in reply
22
Response to Raw
Data Control
Command
30
CSA Full Event
31
ABC Maneuver
statistics
32
Trip statistics
33
RPM
34
Trip log
35
EDR Crash Attributes

(from CSA to Server)
36
VIN
37
Calibration Status
42
Calibration Matrix Set

command
43
Response to
Calibration Matrix Set
command
48
Module reserved for

manufacturer use
51
Speed ECO Scoring

detailed result
52
Off-road Setup Data

Set Command
53
Response to Off-road
Setup Data Set/Read
Command
54
Real Time Raw Acc

Data control
command
55
Real Time Raw Acc

Data
56
Restore Vehicle
Preset Default
Can appear
in message
types
2, 3

Page 172 of 292
Cellocator Wireless
4.2.2
Number
Description
Inbound
Outbound
Support of
concatenation
in reply
57
Vehicle Preset
Configuration
download
2, 3
58
Over Speed
Maneuver Statistics
59
RPM Continuous
maneuver Statistics
60
Idling Continuous
maneuver Statistics
61
OffRoad Continuous
maneuver Statistics
62
General CSA Control

Command
63
Crash maneuver
Statistics
Can appear
in message
types
Modules Detailed Table
4.2.2.1 CSA Full Event

0
Module Name 30 (CSA Full Event)
Length of module - 46
CSA Event Reason
CSA Event Sub Reason
CSA Event Numerator (or zero in case of reply)
5
6
Operational Mode
Engine
On
Raw
logging
Calibrating
Driving
0 ready
0 idling
1 - calibrating
1 - driving
Bit 5
Bit 4
Unused
0 off
1 - on
0 off
1 - on
Bit 7
Bit 6
Bit 3

Bit
2
DFD
Communication
status:
Standby
Engine
On/Off
0-DFD
Connected
0 off
1-DFD
Disconnected
1 - on
Bit 1
Bit 0
Page 173 of 292
Cellocator Wireless
7
Spare
Driver ID
9
10
11
12
13
14
Trip ID
15
16
17
Maneuver ID
18
19
20
Maneuvers data usage - %

contains the percentage of occupied maneuvers memory
21
Accident buffer status bitmask

2st crash
1st crash
Reserved
Empty 0
Reserved
Empty 0
Occupied - 1
Bit 7
Bit 6
Bit 5
Bit 4
22
Spare
23
HDOP
24
Mode 1 (from GPS)
25
Mode 2 (from GPS)
26
27
Longitude
Occupied - 1
Bit 3
Bit 2
Bit 1
Bit 0
28
29
30
31
Latitude
32
Page 174 of 292
Cellocator Wireless
33
34
35
Altitude
36
37
38
39
Ground speed (km/h)
40
41
42
System time seconds
43
System time minutes
44
System time hours
45
System date day
46
System date month
47
4.2.2.2 Event ID
0
Module Name (0 - Event Info)
CSA Event Reason
CSA Event Sub Reason
CSA Event Numerator (or zero in case of reply)
5
6
Operational Mode
Spare for Event ID
4.2.2.3 Driver ID
0
Module ID 1 Driver ID
Driver ID
3
Page 175 of 292
Cellocator Wireless
4
5
6
7
4.2.2.4 Trip ID
0
Module ID - 2 Trip ID
Trip ID
Note: This field will be set to 0 on Ignition On and IPUP events.
4.2.2.5 Maneuver ID
0
Module Name -3 Maneuver ID
Maneuver ID
Note: This field will be set to 0 on Ignition On and IPUP events.
4.2.2.6 PLMN
0
Module ID 4 -PLMN
Operational PLMN upon delivery
3
4
4.2.2.7 Memory Usage Status

0
Module Name 5 - Memory Usage Status
Maneuvers data usage - %
Accident buffer status bitmask
Memory Status spare

Page 176 of 292
Cellocator Wireless
4.2.2.8 GPS Stamp
0
Module Name 6 - GPS Stamp
HDOP
Mode 1 (from GPS)
Mode 2 (from GPS)
Longitude
7
8
9
10
Latitude
11
13
14
15
Altitude
16
17
18
19
Ground speed (km/h)
20
21
4.2.2.9 Time Stamp

0
Module Name 7- Time Stamp
Validity of time (valid - 1 /invalid - 0 )
System time seconds
System time minutes
System time hours
System date day

Page 177 of 292
Cellocator Wireless
7
System date month
4.2.2.10
CSA FW ID
0
Module Name 8- FW ID
Length of module = 11
0- Cello-IQ50
1- Cello-IQ40 ( Lite Version)
CSA Protocol ID
Production ID ( LS Byte)
Production ID (MS Byte)
Fw Version : Represents the Fw Version number
Fw Sub Version: Represents the Fw sub version letter as follows: letter a,
8
9
10
11
12
4.2.2.11
ACK (The Acknowledge)
This module is the only one sent in message type 1 (ACK). The initiator bit of the protocol
frame is set to 0 (ACK), direction bit 0 (inbound).
0
Module's ID 9-ACK
ACK to message type (currently only zero)
Spare
4.2.2.12
Programming Frame
0
Module's ID (10 - Programming Frame)
Length of module
Programming command numerator

Page 178 of 292
Cellocator Wireless
3
Action byte (Read/Write/Lock/Unlock)

0 for Read command
1 for Write command
2 for Lock command (an infrastructure - currently not used)
3 for Unlock command (an infrastructure - currently not used)
The first address
6
7
8
Length of data
The data (in case of Read programming - single byte of Zero)
10
4.2.2.13
Reply Programming Frame

0
Module's ID 11-Reply Programming Frame
Length of module
Reply to Programming command numerator
3
4
Status
Status
Failure ID
(Success 0,
Failure 1)
Bit 7
Bit 6
Spare
The first address
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
7
8
9
Length of data (Zero - In all cases except Reply to Read Programming)
10
The data (only in case of Reply to Read)
11
4.2.2.14
Status Request
This command will cause the unit to generate a message containing the modules
requested in the command.
Byte number
Description

Page 179 of 292
Cellocator Wireless
0
Module ID - 12 Status Request
Module length
Number of requested modules

(Up to 10 modules at a time)
Requested module 1
Requested module 2
..
4.2.2.15
Driver's Feedback Device Control
Infrastructure only, currently not supported.

This command enables the sending of signaling to the driver from Central control.
4.2.2.16
Byte number
Description
Module ID - 13 Driver's feedback device control
Module length
LED Activation strength (1-6, 0 - deactivate)
LED Activation pattern (0-255)
Buzzer activation pattern (0-255)
Option Byte (0 automatic management, 1 - manual management,

2-255 reserved)
Request Maneuver / Trip Statistics

Byte number
Description
Content
Module ID -15 Request maneuver

statistics
Module length
Spare
Trip ID (LSB)
Trip ID
Trip ID (MSB)
If this field contains a

non-existing ID of trip
the unit will send a
NACK (TR 17, sub
reason 3).
Maneuver ID (LSB)
Maneuver ID

If this number contains

0xFFFFFF the unit will
generate a statistic of
the entire trip.
Page 180 of 292
Cellocator Wireless
Byte number
8
4.2.2.17
Description
Content
Maneuver ID (MSB)
Request Maneuver Raw+Stat Upload
This command initiates the raw data upload of a specific maneuver or all accumulated
maneuvers.
Byte number
Description
Module ID -16 Request maneuver

raw+stat upload
Module length
Spare
Trip ID (LSB)
Trip ID
Trip ID (MSB)
If this field contains

non-existing ID of trip
the unit will send a
NACK (TR 17, sub
reason 3).
Maneuver ID (LSB)
Maneuver ID
Maneuver ID (MSB)
4.2.2.18
Content
If this number contains

0xFFFFFF the unit will
initiate full raw upload
of the specific trip
Request Accident Raw Upload
This command initiates accident(s) raw data upload.

Byte number
Description
Content
Module ID-17
Module length
Spare
3
4
4.2.2.19
Erase Unsent CSA Events

Byte number
Description
Module ID-18
Module length
Content

Page 181 of 292
Cellocator Wireless
2
Operation
0: Delete unsent CSA events.

1: Delete all files other then EDR files.
Upon reception (or after performing, as per configuration) of this command the unit
should send full event (module 30) with TR Reply to command.
4.2.2.20
Erase Accident Data
This command enables accident raw data erasing.

Byte number
Description
Content
Module ID-19
Module length
Spare
Upon reception (or after performing, as per configuration) of this command the unit
should send full event (module 30) with TR Reply to command.
4.2.2.21
Calibration/ Off-road Ready Mode
This command initiates and finishes accelerometer Calibrating Mode as well as requesting
the Calibration Status. The reply to this command mandatorily includes Module 37
(Calibration Status).
Byte number
Description
Content
Module ID-20
Module length
Option byte
0 - Request Calibration Status

1 - Leave calibrated mode (forget
calibration and off-road setup)
2 - Enter calibrated mode (use existing
calibration matrix)
3 - Enter off-road ready mode (use
existing off-road setup data)
4.2.2.22
Spare
Raw Logger Mode
This command initiates Raw Logger Mode, optionally for a limited time. The unit in Raw
Logger Mode is continually logging acceleration/GPS data, packing it into files of 100kB
size and uploading them to a server through an FTP/TFTP connection as per CSA
configuration (including compression settings). During Raw Logger Mode the CSA keeps
working as usual, serial and OTA communication with CSA remaining available.
While in Raw Logger Mode, one minute after Ignition off the unit pauses the log. It
restarts the log upon switching to Ignition On.
Page 182 of 292
Cellocator Wireless
After pausing the log, the unit also pauses the timer of raw mode duration and restarts it
after switching to Ignition On.
Byte number
Description
Content
Module ID-21
Module length
Control byte
0 Start
(with duration listed
below)
1 - Stop
Raw Logger Mode duration
In resolution of 2
second/bit.
0 Unlimited,
1-FFFF maximum
value 36 hours.
Provision:
Shall be sent as: 1
GPS recording resolution
Resolution of seconds
Provision:
Shall be sent as: 5
Accelerometer recording resolution
Resolution of 10msec
Response to this command mandatorily includes module 22.
4.2.2.23
Response to Raw Data Control Command

Byte number
Description
Module ID-22
Module length
Operational Mode
Same as in module 30
Raw logger Mode duration (only relevant

for Raw Data mode)
In resolution of 2
second/bit.
Content
0 Unlimited,
1-FFFF maximum
value 36 hours.
Provision:
Shall be sent as: 1
GPS recording resolution
Resolution of seconds
Provision:
Shall be sent as: 5
Accelerometer recording resolution
Resolution of 10msec

Page 183 of 292
Cellocator Wireless
4.2.2.24
ABC Maneuver Statistics

Byte number
Description
Module ID - 31
N+1
Module length
N+2
Trip ID (3 bytes)
N+5
Maneuver ID (3 bytes)
N+8
Maneuver Type (1 byte)
N+9
Start Location (8 bytes)
Content
55 dec
Harsh
Acceleration
Harsh Brake
Harsh Turn
16
Turn & Accel
15
Turn &Brake
10
Sharp Lane
crossing
GPS location of the

maneuver start moment
(longitude, latitude)
N+17
End location (8 bytes)
GPS location of the

maneuver end time.
N+25
Start Time (7 bytes)
Maneuver start time
N+32
Maneuver duration (seconds) (2

bytes)
Maneuver duration
(resolution is 0.2
seconds/bit)
N+34
X average (2 bytes)
Accelerometer X axes
average
N+36
Y Average (2 bytes)
Accelerometer Y axes
average
N+38
X Max (2 bytes)
Max G value
N+40
Y Max (2 bytes)
Max G value
N+42
Z Max (2 bytes)
Accelerometer Z axes
Max G value

Page 184 of 292
Cellocator Wireless
Byte number
Description
Content
N+44
Speed Average (1 byte)
Maneuver average speed

Km/Hr, 0-255
N+45
Speed Max (1 byte)
Maneuver Max speed

Km/Hr, 0-255
N+46
Speed delta
N+47
Max RPM (2 bytes)
Infrastructure, sent as
zeroes
Maximum RPM value
recorded during
acceleration events
(including cornering)
N+49
Max Fuel Flow (2 bytes)
zeroes
Maximum fuel flow
during acceleration
events (including
cornering)
N+51
Fuel consumed (2 bytes)
zeros
Integral of Fuel flow
N+53
ABS state (1 byte)
zeros
ABS sensor reading for
braking event only
N+54
Risk score (1 byte)
Maneuver risk value 0100
N+55
Num of init frames (1 byte)
Indicates the sample ID

correlated with GPS
reading - relevant for
raw data files only
4.2.2.25
Trip Statistics
Byte number
Description
Module ID - 32
N+1
Module length
N+2
Trip ID (3 bytes)
N+5
Driver ID (6 bytes)
Content
73

Page 185 of 292
Cellocator Wireless
Byte number
Description
Content
N+11
Start date & time (7 bytes)
Start date & time for trip

(taken from first valid GPS
reading)
N+18
Trip duration seconds (3 bytes)
Trip duration
N+21
Distance Traveled (4 bytes)
The base units are selected by

configuration parameter: CSA
Base unit for odometer".
Address 6779.
N+25
Movement Time (4 bytes)
In seconds, time the vehicle

has moved from Ignition on to
Ignition off event or until
driver was replaced
N+29
Idle time short (4 bytes)

was idle based on GPS +
accelerometer information,
according to 1st level
threshold (ref to Idling levels
in the configuration part)
N+33
Idle time Long (4 bytes)

was idle based on GPS +
accelerometer information,
according to 2nd level
threshold(ref to Idling levels in
the configuration part)
N+37
Max X (2 bytes)
Maximum accel input on X axis
N+39
Max Y (2 bytes)
Maximum accel input on Y axis
N+41
Max Z (2 bytes)
Maximum accel input on Z axis
N+43
Max RMS (4 bytes)
MAX RMS unit value (unsigned

32 Bits, LSB First): The unit
sends
The server
side needs to complete the
calculation by taking the
square root of the value sent
by the unit and divide it by the
square root of 3:
MAX RMS
N+47
Max Speed 1 (byte)
Maximum Speed
N+48
AVG Speed (byte)
Trip average Speed
N+49
Start fuel level (%)(1 byte)
Fuel level upon trip start

Page 186 of 292
Cellocator Wireless
Byte number
Description
Content
N+50
End fuel level (%)(1 byte)
Fuel level upon trip end
N+51
Weighted Safety Score (1 byte)
A value in the range of 0-100

representing the safety score
of the trip
N+52
Weighted Eco Score (1 byte)

representing the Eco score of
the trip
N+53
Eco scoring: Idle Score (1 byte)
N+54
Eco scoring: Urban driving Score

(1 byte)
N+55
Eco scoring: Highway driving

Score (1 byte)
N+56
Eco scoring: Idle Score Time

(seconds) (3 byte)
N+59
Eco scoring: Urban Score Time

(seconds) (3 byte)
N+62
Eco scoring: Highway Score Time

(seconds) (3 byte)
N+65
Trip End Odometer (4 Bytes)
N+69
Delta engine hours in this trip

(Minutes) (2 bytes)
N+71
Spare (4 bytes)
4.2.2.26
RPM
Byte number
Description
Content
Module ID - RPM
33
N+1
N+2
Measured RPM
N+3
4.2.2.27
Trip Log
Byte number
Description
Module ID - 34

Content
Page 187 of 292
Cellocator Wireless
Byte number
Description
Content
N+1
Module length
Variable, up to 165
N+2
Trip ID
N+3
N+4
N+5
Number of maneuvers
10
N+6
Table of 3 X 10 (Number from byte N+5)

X 2 bytes
Matrix with event

types in rows, severity
in columns (3 types)
while data is the
number of events from
each type in each
severity
3 for severity, 10 (variable) for number

of maneuvers, 2 is bytes in each cell
4.2.2.28
EDR Crash Attributes (from CSA to Server)
This module will be unconditionally attached to any CSA Event with Reason 2 (Crash
Occurred). These modules will only be sent if the EDR is enabled. If the EDR is disabled
and the user requires only Crash maneuvers, the unit will send module 63.
N
Module ID 35 crash attributes
N+1
Module Length 14
N+2
Crash ID
N+3
Spare
N+4
Spare
N+5
Vehicle Type (PRVT / LCV, MCV, HCV etc) (provisioning)
N+6
crashType- Number representing the type of crash; 1=light crash, 2 =

heavy crash;
N+7
MaxG LS Byte - Max RMS acceleration measured during the crash (16
bits)
N+8
MaxG - MS Byte

Page 188 of 292
Cellocator Wireless
N+9
crashInfo- Crash information:

Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Spare
Spare
Parking
Roll
Crash Orientation
Crash Orientation
Bit 2
Bit 1
Bit 0
Description
(Bits 3-0)
0
INFO_INIT
FRONT
FRONT_LEFT
FRONT_RIGHT
SIDE_LEFT
SIDE_RIGHT
REAR
REAR_LEFT
REAR_RIGHT
DOWN
10
Role (Bit 4)
UP
Description
Role Event
No Role Event
Parking
(Bit5)
Description
Crash while Driving
Crash While Parking
N+10
durationInSeconds -Crash Duration LSByte byte: seconds
N+11
durationInSeconds - Crash Duration MS Byte: seconds
N+12
numOfInitAccel -Number of accelerations counter before the first GPS in the

crash lists (0-20)

Page 189 of 292
Cellocator Wireless
N+13
amoutOfPostSamples -Number of accelerations receive after the crash

before the next GPS
N+14
preDataLenInSec -Number of complete GPS seconds records before the

crash
N+15
postDataLenInSec -Number of complete GPS seconds records after the

crash
4.2.2.29
VIN (from CSA to Server)
This module will be attached to a CSA Event with Reason 1 (Crash Occurred) if enabled in
the configuration and supported by the unit (CAN version only).
0
Module ID 36 VIN
Module Length -17
Vehicle identification (VIN, 17 ASCII chars)
4.2.2.30
Calibration / Offroad Status (from CSA to Server)
This module will be issued as a response to corresponding OTA command (module 20).
0
Module ID 37 Calibration status
Module Length -3
Calibration
Not calibrated
Calibrated (Done)
Bad installations
255 - reserved
Calibration stage/step
Phase number
Bit 7
Step number
Bit 6
Bit 5
Bit 4
Bit 3
Bit2
Bit 1
Bit 0
Off-road stage
0 Not calibrated
1 calibrated: 100 samples done
2- calibrated: 1000 samples done

Page 190 of 292
Cellocator Wireless
4.2.2.31
Calibration Matrix Set Command (from Server to CSA)
This module is issued in Programming command in order to read or change the

Calibration Matrix. The calibration data consists of 30 signed 2-byte parameters. For
example the matrix below:
9:9:-250
16384:0:0
0:16372:592
0:-592:16372
16372:0:592
0:16384:0
-592:0:16372
16165:2671:0
-2671:16165:0
0:0:16384
Note that the diagonal of the matrix is always the same (16384:0:0, 0:16384:0,
0:0:16384), so we to keep only 21 parameters as shown in the following matrix.
Index
Data
-250
Index
16372
592
-592
16372
13
14
15
-592
16372
16384
Data
16384
Index
10
11
12
Data
16372
592
16384
Index
16
17
18
19
20
21
Data
16165
2671
-2671
16165
Module ID 42 Calibration Matrix Set /Read command

Module Length -3 (2 in case of read, 44 in case of write)
Action byte 0 read, 1 write
Spare
Index 1 (16 bits)
Index 2 (16 bits)
Index 21 (16 bits)

Page 191 of 292
Cellocator Wireless
4.2.2.32
Response to Calibration Matrix Set Command (from CSA to Server)
This module is issued in Programming reply as a response to Calibration Matrix Set

command (described above) or as an escorting module to Calibration OK report.
Module ID 43 Calibration Matrix Set /Read command
Module Length -43
Spare
Index 1 (16 bits)
Index 2 (16 bits)
Index 21 (16 bits)
4.2.2.33
Reserved for Manufacturer Use
For debug versions only, this module sends every hour (not configurable) and includes
memory usage details.
0
Module ID 48
Module Length (variable)

Data (for manufacturer use only)
4.2.2.34
Spare (Intentionally left blank)
4.2.2.35
Off-road Setup Data Set Command (from Server to CSA)
This module is issued in Programming command in order to read or change the Offroad
Setup data. The calibration data consists of 90 1-byte parameters. For example the
matrix below:
N
Module ID 52 Off-road setup data set
N+1
Module Length -3 (2 in case of read, 91 in case of write)
N+2
Action byte 0 read, 1 write
N+3
Index 1 (4 Bytes)
N+7
Index 2 (4 Bytes)

Page 192 of 292
Cellocator Wireless
N+11
Index 3 (4 Bytes)
N+15
Index 4 (4 Bytes)
Index 21 (4 Bytes)
Spare (6 Bytes)
4.2.2.36
Response to Off-road Setup Data Set/Read Command (from CSA to

Server)
This module is issued in Programming reply as a response to Off-road setup data set/read
command (described above).
N
Module ID 53 Off-road setup data set/read command
N+1
Module Length -90
N+2
Index 1 (4 Bytes)
N+6
Index 2 (4 Bytes)
N+10
Index 3 (4 Bytes)
N+14
Index 4 (4 Bytes)
Index 21 (4 Bytes)
Spare (6 Bytes)
4.2.2.37
Real Time Raw Acc Data Control Command
This module is sent in message type 4 in order to initiate (or finish) the RT Acc Data
streaming mode. During this mode the unit delivers raw accelerometer data (8/10or 12
bits to axis) to the CSA socket in real time.
0
Module Name 54- Real Time Raw Acc Data Control command
Length of module

Page 193 of 292
Cellocator Wireless
2
Control byte
Accelerometer
resolution
Required Sampling
frequency 17
Value
8 bits
100Hz
10 bits
(options 1 and 2 will
require samples of 2
bytes per axis)
Every update message will

contain module 54 (or a few
module 54s if there are many
frames or seconds reported
per update) and GPS Stamp
(module 6) aligned with the
latest System Time in the
message.
(currently not
supported)
12 bits
Bit 7
Update rate (seconds, 0 to

exit the RT Acc Data
streaming mode).
Bit 6
50Hz
25 Hz
20Hz
10Hz
5Hz
Bit 5
Bit 4
Module GPS will always be

attached as last module of the
message.
Bit 3
Bit 2
Bit 1
Bit 0
RT Acc Data streaming Mode duration , 2 bytes (seconds, 0 for infinity)
4
5
Spare
Spare
4.2.2.38
Real Time Raw Acc Data
This module is sent in message type 0 during RT Acc Data streaming mode, which is
initiated by a command containing module 54.
The module contains accelerations recorded during the 1 second BEFORE the system time
appears in the System Time of the module.
This message is not logged and does not require ACK from the server side.
0
Module Name 55- Real Time Raw Acc Data
Length of module varies, depends on sampling rate and included number of

samples.
Control byte 1
Number of included samples (each sample is 3 or 6 bytes; byte for each axis)
Sample size:
01
byte/Axis
12
bytes/Axis
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
17
Sampling rate in this command is independent, but cant be higher than the sampling frequency programmed on address
50 of CSA configuration. If it is higher, the value is saturated to the programmed sampling frequency.
Page 194 of 292
Cellocator Wireless
3
Control byte 2
Last frame
for the
specified
second
Frame number (in case of a high

sampling rate all the samples of a single
second cannot be compressed into a
single module and split into a few
frames)
0 Not last
frame
1- Last
frame
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Value
Sampling frequency
100Hz
50Hz
25 Hz
20Hz
10Hz
5Hz
Bit 2
Bit 1
Bit 0
Control byte 3
Spare
Accelerometer
resolution
Calibration
status
8 bits
0 Not
calibrated
10 bits
1- calibrated
12 bits
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
System time seconds
System time minutes
System time hours
System date day
System date month
10
11
Sample 1 X Axis (Signed integer, 0.062992125984252G/bit)
12
Sample 1 Y Axis (same resolution)
13
Sample 1 Z Axis (same resolution)
Accurate time
0 Estimated
time
1- Accurate
Bit 0
Last Sample (up to 82) X Axis (Signed integer, 0.062992125984252G/bit)

Last Sample (up to 82) Y Axis (same resolution)
Last Sample (up to 82) Z Axis (same resolution)

Page 195 of 292
Cellocator Wireless
4.2.2.39
Restore Default Vehicle Preset
This module is sent in messages of type 2 whenever a preset restore to defaults for a
certain vehicle type is required. The unit responds after the restore is completed with a
message type 3 containing the same module.
Byte
Description
Default
Module Name 56 Restore vehicle preset
56
Length of module 2
Preset number
4.2.2.40
Number
Vehicle type
Private
Large Van
Light Truck/bus
Heavy Truck
Spare
Vehicle Preset Configuration Download
This module is sent in messages of type 2 whenever a change in the preset for a certain
vehicle type is required. The unit responds with a message type 3 containing the same
module.
Byte
Description
Default
Module Name 57 - Vehicle Preset Configuration

Command
57
Length of module (2 in case of read Control byte
225
+ Preset number, 238 in case of set)

2
Control byte
0 - Read command (sent inbound inside message type 2)
1 - Set command (sent inbound inside message type 2)
2 - Response (sent outbound inside message type 3)
Preset number
Number
Vehicle type
Private
Large Van
Light Truck/bus
Heavy Truck

Page 196 of 292
Cellocator Wireless
Byte
Description
Default
4-13
Reserved for system configuration data
zeros
14
Frame Size, resolution of 0.01s
20 (0.2s)
15
Xmax - Absolute maximum of acceleration on X Axis
102
16
Spare
17
Filter (IIR)
18
Amount of violating samples to consider crash
19
Acceleration on X axis to consider maneuver start
51 (0.2g)
20
Acceleration on Y axis to consider maneuver start
51 (0.2g)
21
Acceleration on X axis (second axis) to consider combo

maneuver start
25 (0.1g)
22
Acceleration on Y axis (second axis) to consider combo

maneuver start
25 (0.1g)
23
Time threshold for considering lane crossing
30 (0.3s)
24
Time threshold for considering maneuver
60 (0.6s)
25
Break X Threshold
51 (0.2g)
26
Brake Second X Threshold
25 (0.1g)
27
Maximum maneuver length
30 (s)
28-32
Spare
10, 90, 140,

5, 15
33
Acceleration: Xavg
76
34
Acceleration: Xmax
102
35
Acceleration: Delta Speed
50
36-38
Acceleration: spare
Zeros
39
ACCEL2TURN: Accel - Xavg
76
40
ACCEL2TURN: Accel - Xmax
102
41
ACCEL2TURN: Accel - Delta Speed
50
42
ACCEL2TURN: Turn - Yavg
115
43
ACCEL2TURN: Turn - Ymax
153
44
ACCEL2TURN: Turn - Avg Speed
100
45
TURN_AFTER_ACCEL: Accel - Xavg
76

Page 197 of 292
Cellocator Wireless
Byte
Description
Default
46
TURN_AFTER_ACCEL: Accel - Xmax
102
47
TURN_AFTER_ACCEL: Accel - Delta Speed
50
48
TURN_AFTER_ACCEL: Turn - Yavg
115
49
TURN_AFTER_ACCEL: Turn - Ymax
153
50
TURN_AFTER_ACCEL: Turn - Avg Speed
100
51
SLALOM_AFTER_ACCEL: Accel - Xavg
76
52
SLALOM_AFTER_ACCEL: Accel - Xmax
102
53
SLALOM_AFTER_ACCEL: Accel - Delta Speed
50
54
SLALOM_AFTER_ACCEL: SLALOM - Yavg
140
55
SLALOM_AFTER_ACCEL: SLALOM - Ymax
56
SLALOM_AFTER_ACCEL: SLALOM Speed Max
90
57
ACCEL2SLALOM_A: Accel - Xavg
76
58
ACCEL2SLALOM_A: Accel - Xmax
102
59
ACCEL2SLALOM_A: Accel - Delta Speed
50
60
ACCEL2SLALOM_A: SLALOM - Yavg
140
61
ACCEL2SLALOM_A: SLALOM - Ymax
62
ACCEL2SLALOM_A: SLALOM Speed Max
90
63
ACCEL2SLALOM_T: Accel - Xavg
76
64
ACCEL2SLALOM_T: Accel - Xmax
102
65
ACCEL2SLALOM_T: Accel - Delta Speed
50
66
ACCEL2SLALOM_T: SLALOM - Yavg
140
67
ACCEL2SLALOM_T: SLALOM - Ymax
68
ACCEL2SLALOM_T: SLALOM Speed Max
90
69
BRAKE: - Xavg
102
70
BRAKE: - Xmax
138
71
BRAKE: - Delta Speed
60
72-74
BRAKE: Spare
Zeros
75
BRAKE2TURN: Brake - Xavg
102
76
BRAKE2TURN: Brake- Xmax
138

Page 198 of 292
Cellocator Wireless
Byte
Description
Default
77
BRAKE2TURN: Brake - Delta Speed
60
78
BRAKE2TURN: TURN - Yavg
115
79
BRAKE2TURN: TURN - Ymax
153
80
BRAKE2TURN: TURN Speed Avg
100
81
TURN_AFTER_BRAKE: Brake - Xavg
102
82
TURN_AFTER_BRAKE: Brake- Xmax
138
83
TURN_AFTER_BRAKE: Brake - Delta Speed
60
84
TURN_AFTER_BRAKE: TURN - Yavg
115
85
TURN_AFTER_BRAKE: TURN - Ymax
153
86
TURN_AFTER_BRAKE: TURN Speed Avg
100
87
SLALOM_AFTER_BRAKE: Brake - Xavg
102
88
SLALOM_AFTER_BRAKE: Brake- Xmax
138
89
SLALOM_AFTER_BRAKE: Brake - Delta Speed
60
90
SLALOM_AFTER_BRAKE: SLALOM - Yavg
140
91
SLALOM_AFTER_BRAKE: SLALOM - Ymax
92
SLALOM_AFTER_BRAKE: SLALOM Speed Max
90
93
BRAKE2SLALOM B: Brake - Xavg
102
94
BRAKE2SLALOM B: Brake- Xmax
138
95
BRAKE2SLALOM B: Brake - Delta Speed
60
96
BRAKE2SLALOM B: SLALOM - Yavg
140
97
BRAKE2SLALOM B: SLALOM - Ymax
98
BRAKE2SLALOM B: SLALOM Speed Max
90
99
BRAKE2SLALOM T: Brake - Xavg
102
100
BRAKE2SLALOM T: Brake- Xmax
138
101
BRAKE2SLALOM T: Brake - Delta Speed
60
102
BRAKE2SLALOM T: SLALOM - Yavg
140
103
BRAKE2SLALOM T: SLALOM - Ymax
104
BRAKE2SLALOM T: SLALOM Speed Max
90
105
TURN: - Yavg
115

Page 199 of 292
Cellocator Wireless
Byte
Description
Default
106
TURN: - Ymax
153
107
TURN: Speed Avg
100
108-110
TURN: Spare
Zeros
111
TURN2BRAKE: Turn - Yavg
115
112
TURN2BRAKE: Turn - Ymax
153
113
TURN2BRAKE: Turn - Speed Avg
100
114
TURN2BRAKE: Brake - Xavg
102
115
TURN2BRAKE: Brake- Xmax
138
116
TURN2BRAKE: Brake - Delta Speed
60
117
BRAKE_AFTER_TURN: Turn - Yavg
115
118
BRAKE_AFTER_TURN: Turn - Ymax
153
119
BRAKE_AFTER_TURN: Turn - Speed Avg
100
120
BRAKE_AFTER_TURN: Brake - Xavg
102
121
BRAKE_AFTER_TURN: Brake- Xmax
138
122
BRAKE_AFTER_TURN: Brake - Delta Speed
60
123
TURN2ACCEL: Turn - Yavg
115
124
TURN2ACCEL: Turn - Ymax
153
125
TURN2ACCEL: Turn - Speed Avg
100
126
TURN2ACCEL: Accel - Xavg
76
127
TURN2ACCEL: Accel - Xmax
102
128
TURN2ACCEL: Accel - Delta Speed
50
129
ACCEL_AFTER_TURN: Turn - Yavg
115
130
ACCEL_AFTER_TURN: Turn - Ymax
153
131
ACCEL_AFTER_TURN: Turn - Speed Avg
100
132
ACCEL_AFTER_TURN: Accel - Xavg
76
133
ACCEL_AFTER_TURN: Accel - Xmax
102
134
ACCEL_AFTER_TURN: Accel - Delta Speed
50
135
SLALOM: Yavg
140
136
SLALOM: Ymax

Page 200 of 292
Cellocator Wireless
Byte
Description
Default
137
SLALOM: Speed Max
90
138-140
SLALOM: Spare
Zeros
141
SLALOM2BRAKE_B: Slalom - Ymax
140
142
SLALOM2BRAKE_B: Slalom - Yavg
143
SLALOM2BRAKE_B: Slalom - Speed Max
90
144
SLALOM2BRAKE_B: Brake - Xavg
102
145
SLALOM2BRAKE_B: Brake - Xmax
138
146
SLALOM2BRAKE_B: Brake - Delta Speed
60
147
SLALOM2BRAKE_T: Slalom - Ymax
140
148
SLALOM2BRAKE_T: Slalom - Yavg
149
SLALOM2BRAKE_T: Slalom - Speed Max
90
150
SLALOM2BRAKE_T: Brake - Xavg
102
151
SLALOM2BRAKE_T: Brake - Xmax
138
152
SLALOM2BRAKE_T: Brake - Delta Speed
60
153
SLALOM2ACCEL_A: Slalom - Ymax
140
154
SLALOM2ACCEL_A: Slalom - Yavg
155
SLALOM2ACCEL_A: Slalom - Speed Max
90
156
SLALOM2ACCEL_A: Accel - Xavg
76
157
SLALOM2ACCEL_A: Accel - Xmax
102
158
SLALOM2ACCEL_A: Accel - Delta Speed
50
159
SLALOM2ACCEL_T: Slalom - Ymax
140
160
SLALOM2ACCEL_T: Slalom - Yavg
161
SLALOM2ACCEL_T: Slalom - Speed Max
90
162
SLALOM2ACCEL_T: Accel - Xavg
76
163
SLALOM2ACCEL_T: Accel - Xmax
102
164
SLALOM2ACCEL_T: Accel - Delta Speed
50
165-170
BUMPERS: Spare
Zeros
171-176
SPEEDING: Spare
Zeros
177-182
OFF_ROAD: Spare
Zeros

Page 201 of 292
Cellocator Wireless
Byte
Description
Default
183-188
IDLE EVENT: Spare
Zeros
189-194
STATES_RPM: Spare
Zeros
195-200
CRASH: Spare
Zeros
201
Weight ACCEL: Xavg
25
202
Weight ACCEL: Xmax
55
203
Weight ACCEL: Delta speed
20
204
Weight BRAKE: Xavg
20
205
Weight BRAKE: Xmax
50
206
Weight BRAKE: Delta speed
30
207
Weight TURN: Yavg
35
208
Weight TURN: Ymax
45
209
Weight TURN: Avg speed
20
210
Weight SLALOM: Yavg
50
211
Weight SLALOM: Ymax
212
Weight SLALOM: Speed max
50
213-214
Status Bar Treshold 1
800
215-216
2800
217-218
8400
219-220
17000
221
Trip Eco Total RPM Score Green
100
222
Trip Eco Total RPM Score Yellow
50
223
Trip Eco Total RPM Score Red
224
Trip Eco Score Highway Speed Score 1
225
35
226
70
227
80
228
90
229
100
230
Trip Eco Score Highway Speed Treshold 1
140 (Km/h)

Page 202 of 292
Cellocator Wireless
Byte
Description
Default
231
120 (Km/h)
232
110 (Km/h)
233
100 (Km/h)
234
90 (Km/h)
235
80 (Km/h)
236
Trip Eco Score Highway Speed RPM Weight
20 (%)
237
Trip Eco Score Highway Speed Weight
80 (%)
238-239
Spare
Zeros
4.2.2.41
Over Speed Maneuver Statistics

Byte
number
Description
Content
Module ID - 58
Module length
Trip ID (3 bytes)
Maneuver type (1 byte)
GPS location of the

69
17
GPS location of the

maneuver end time.
25
Maneuver start time
32
Maneuver duration (seconds) (2 bytes)
Maneuver duration
(resolution is 1
seconds/bit)
35

Km/Hr, 0-255
36
Speed Max (1 byte)
Maneuver Max speed

Km/Hr, 0-255
37
Delta Speed (1 byte)
Km/h

Page 203 of 292
Cellocator Wireless
Byte
number
Description
Content
38
Total Maneuver Severity (1 byte)
1 Green Severity
2 Yellow severity
3 Red severity
39
Average speed in zone Green(1 byte)
speed Km/Hr, 0-255
40
Time in over-speeding zone Green (2 Bytes)
Seconds
42
Total events in Over-Speeding zone Green (1

byte)
43
Average speed in zone Yellow (1 byte)
speed Km/Hr, 0-255
44
Time in over-speeding zone Yellow (2 Bytes)
Seconds
46
Total events in Over-Speeding zone Yellow

(1 byte)
47
Average speed in zone Red (1 byte)
speed Km/Hr, 0-255
48
Time in over-speeding zone Red (2 Bytes)
Seconds
50
Total events in Over-Speeding zone Red (1

byte)
51
X Max (2 bytes)
Max G value
53
Y Max (2 bytes)
Max G value
55
Z Max (2 bytes)
Max G value
57
Max RPM (2 bytes)
59
Average RPM (2 bytes)
61
Risk score (1 byte)
62
Spare (10 Bytes)
4.2.2.42
Maneuver risk value 0100
RPM Continuous Maneuver Statistics

Byte
number
Description
Module ID - 59
Module length

Content
71
Page 204 of 292
Cellocator Wireless
Byte
number
Description
Trip ID (3 bytes)
Content
12
GPS location of the
17
GPS location of the

maneuver end time.
25
Maneuver start time
32
Maneuver duration
(resolution is 1
seconds/bit)
34
Max RPM (2 bytes)
36
Average RPM during the whole session(2

bytes)
38
Spare (2 Bytes)
40
Average Speed during RPM event (1 byte)

Km/Hr, 0-255
41
Max Speed during RPM event (1 byte)
Maneuver MAX speed

Km/Hr, 0-255
42
Time In Low RPM (Coasting) (2 Bytes)
44
Average speed in Low RPM (Coasting) zone (1

byte)
45
Number of Low RPM (Coasting) events (2

Bytes)
47
Time in high RPM zone (2 Bytes)
49
Average speed in high RPM zone(1 byte)
50
Number of high RPM events (2 Bytes)
52
Time in excessive RPM zone (2 Bytes)
54
Average speed in excessive RPM zone (1 byte)
55
Number of excessive RPM events (2 Bytes)

Page 205 of 292
Cellocator Wireless
Byte
number
Description
Content
57
X Max (2 bytes)
Max G value during RPM
event
59
Y Max (2 bytes)
event
61
Z Max (2 bytes)
event
63
Spare (10 Bytes)
4.2.2.43
Idling Continuous Maneuver Statistics

Byte
number
Description
Content
Module ID - 60
Module length
Trip ID (3 bytes)
13
GPS location of Idling

from first Halt detection
56
17
GPS location of the

maneuver end time.
25
Maneuver start time
32
Maneuver duration (seconds) (2 bytes) from

Halt
Maneuver duration
(resolution is second)
34
Short Idling duration (from Short idling TO to

end of Idling session or until Long Idling TO)
(2 Bytes)
Seconds
36
Spare (1 byte)
37
Long Idling duration (From Long idling TO to

end of idling session) (2 Bytes)

Seconds
Page 206 of 292
Cellocator Wireless
Byte
number
Description
39
Spare (1 byte)
40
Number of seconds Idling detection is based on

Valid GPS. (2 Bytes)
Seconds
42
Number of seconds Idling detection is based on

Accelerometer (2 Bytes)
Seconds
44
Number of seconds Engine is on during idling

session (engine running) (2 Bytes)
Seconds
46
Number of seconds Ignition is on during idling

session (ignition switch is on, Motor is off) (2
Bytes)
Seconds
48
4.2.2.44
Content
Spare (10 Bytes)
OffRoad Continuous Maneuver Statistics

Byte
number
Description
Content
Module ID - 61
Module length
Trip ID (3 bytes)
11
GPS location of the

50
17
GPS location of the

maneuver end time.
25
Maneuver start time
27
Maneuver duration
(resolution is 1
seconds/bit)
29
Average Speed during OffRoad event (1 byte)

Km/Hr, 0-255
30
Max Speed during OffRoad event (1 byte)
Maneuver MAX speed

Km/Hr, 0-255

Page 207 of 292
Cellocator Wireless
Byte
number
Description
Content
31
X Max (2 bytes)
event
33
Y Max (2 bytes)
event
35
Z Max (2 bytes)
event
37
Spare (10 Bytes)
4.2.2.45
General CSA Control Command
This module is sent in message type 4 in order to implement common unit control
commands.
0
Module ID - 62- General CSA Control Command
Length of module
Control Command byte

Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Control Command Code
Control
Command Code
4.2.2.46
Spare
Spare
Description
Unit Reset command: This command

will initiate the fleets reset procedure.
The unit will be restarted after delay of
10 Seconds.
TBD
TBD
Crash Maneuver Statistics
Crash Maneuver Statistics will be sent by the unit when the EDR is disabled and the crash
events are detected by the normal maneuver detection mechanism. Crash maneuver
doesnt record crash logs and only supports crash maneuver statistics.

Page 208 of 292
Cellocator Wireless
Byte
number
Description
Content
Module ID - 63
Module length
Trip ID (3 bytes)
2 CRASH Maneuver
GPS location of Idling

from first Halt detection
46
17
GPS location of the

maneuver end time.
25
Maneuver start time
32
Maneuver duration
(resolution is 1
seconds/bit)
34
Crash ID
35
Spare
36
Spare
37
Vehicle Type: As defined in the PL.

Vehicle Type
Description
(Bits 7-0)
0
Private vehicle
Large van
Light Track
Heavy Track

Page 209 of 292
Cellocator Wireless
Byte
number
Description
38
crashType - Number representing the crash

severity:
Crash Type
Content
Description
(Bits 7-0)
39
40
Spare
Light Crash
Heavy Crash
MaxG LS Byte: Max RMS acceleration measured during the crash (16
bits)
MaxG - MS Byte

Page 210 of 292
Cellocator Wireless
Byte
number
Description
41
crashInfo - Crash information:

Bit 7
Bit 6
Spare
Spare
Content
Bit 5
Bit 4
Parking
Crash Orientation
Bit 3
Roll
Bit 2
Bit 1
Bit 0
Crash Orientation
Description
(Bits 3-0)
0
INFO_INIT
FRONT
FRONT_LEFT
FRONT_RIGHT
SIDE_LEFT
SIDE_RIGHT
REAR
REAR_LEFT
REAR_RIGHT
DOWN
10
Role (Bit 4)
UP
Description
Role Event
No Role Event
Parking
(Bit5)
Description
Crash while Driving
Crash While Parking

Page 211 of 292
Cellocator Wireless
Byte
number
Description
Content
42
durationInSeconds -Crash Duration LSByte

byte
Seconds
43
durationInSeconds - Crash Duration MS Byte
44
Spare
45
Spare
46
Spare
47
Spare
4.3
FTP/TFTP Files Structure
4.3.1
Raw Data Files

The CSA unit can generate raw data files of different types. File types contain the
following optional data parts: accelerometer data on programmatically selected sampling
rate, time/location GPS stamps, and statistics of Manoeuvres and Trip with list of
manoeuvres.
Files are uploaded to the server through FTP or TFTP automatically, as per the units
configuration or by command.
Files containing RAW data (i.e. GPS and acceleration samples) will be compressed to
optimize both transmission time and server file system storage size.
4.3.2
File Naming Convention

The file name is built according to the following convention:
The name is constructed from a variable number of fields, each of variable length.
The file extension indicates it is compressed (.cpr or uncompressed .raw).
Each field begins with a dedicated Latin letter (case sensitive, see the table below).
Each field, except the last one, ends with a minus sign "-".
The file name structure: U*-R*-I*-D*-T*
The file name form is shown in the following example:
U9999-R1-I0004D1-0000F2-5-D110728-T115843001.cpr
U: Unit ID (variable size) - contains Cello unit ID in decimal format.
R: File type, as shown in the table below.
MANU
Maneuver (3 characters) file containing single maneuver

Page 212 of 292
Cellocator Wireless
TRIP
Trip file with list of maneuvers or single maneuver
CRASH
Accident record (crash file)
RAW
Raw accel/gps/rpm records generated during Raw Logger Mode
I: Trip/maneuver/raw or crash ID.

The field contains the ID of trip or crash. For maneuvers the number of the trip is
followed by the maneuver ID, each one 3 hexadecimal bytes: for example I0004D10000F2 means trip 0x4D1, maneuver 0xF2
D (Date): YearMonthDay
Day: 2chars
Month: 2chars
Year: 2chars
T (Timestamp): HourMinuteSecondmSeconds
Hour: 2chars
Minute: 2chars
Second: 2chars
mSeconds: 3chars
Example: U9999-R1- I0004D1-0000F2-5-D110728-T115843001.raw
Unit ID: 9999
File type: 1 (maneuver)
Trip ID: trip 0x4D1, maneuver 0xF2
Date: 11/07/28
Time: 11:58:43:001
4.3.2.1 File Name Convention Examples

File Type
Uploaded
Upon
File Format
Example
Crash file
Accident
Compressed
U9999-R3- I0004D1-0000F2-5D110728-T115843001.cpr
Trip
Statistics
End of Trip
Raw data
U9999-R2- I0004D1-0000F2-5D110728-T115843001.raw
Trip
Statistics +
End of Trip
Compressed
U9999-R2- I0004D1-0000F2-5D110728-T115843001.cpr

Page 213 of 292
Cellocator Wireless
RAW
Maneuver
Statistics +
RAW
Host request
Compressed
U9999-R1- I0004D1-0000F2-5D110728-T115843001.cpr
Raw
Logger
Mode
Raw Logger
Mode
enabled and
ignition is on
Compressed
U9999-R4- I0004D1-0000F2-5D110728-T115843001.cpr

Page 214 of 292
Cellocator Wireless
4.3.3
File Structure
The following figure describes the structure of file created by the CelloIQ Unit. The file is a
binary file starting with length represented as 32 bits and with a CRC32 FCS implementing
Ethernet 32 bit polynomial.
TotalFileLength - MSByte
TotalFileLength TotalFileLength TotalFileLength - LSByte
FileVersion
File type
FileCreationDate
7 Bytes
Spare
Spare
Payload
CRC32 - MSByte
CRC32 CRC32 CRC32 - LSByte
File Field
Description
TotalFileLength
The total number of bytes starting from the next byte till the
end of the message

Page 215 of 292
Cellocator Wireless
File Field
Description
FileCreationDate
7 bytes representing the file creation date and time
File Version
Byte
Number
Representation
Limits
Year (2000+x)
0-99
Month
1-12
Day
1-31
Hour
00-24
Minute
00-59
Second
00-59
10 Millisecond
00-99
Always 1
File Type
Code
File Type
Maneuver file
Trip File
FCS
Crash File
Recorder File Infrastructure
Spare
Uses CRC-32 (Ethernet) polynomial: 0x4C11DB7

X32 + X26 + X23 + X22 + X16 + X12 + X11 + X10 +X8 + X7
+ X5 + X4 + X2+ X +1
4.3.4
Maneuver files Payload Structure

Maneuver file payload contains single maneuver record. Maneuver record is composed of
Maneuver header, Optional Maneuver statistics record (same structure as the CSA
statistics module excluding first 2 bytes) and optional maneuvers compressed raw data.
Compressed Raw data records are located at the end of the maneuver record and are
maneuver type depended: ABC maneuvers will be followed by compressed GPS and
Accelerations frames while Speeding, speeding logging and OffRoad maneuvers will be
followed by compressed GPS records only. The maneuver raw data accelerations are
called frames and they represent the average accelerations of 4 consecutive 20Hz
samples in each dimension.
Frames and GPS are compressed according to the reordering rule described in Crash File
compressed format

Page 216 of 292
Cellocator Wireless
Example 1: ABC Maneuver record example
Maneuver
Statistics
Compressed Raw Data (GPS and Accelerations)

Or GPS only for speeding and offoRoad
GPS
Initial frames
1-4
Maneuver
Statistics
GPS
5 frame
Per Sec
GPS
5 frame
Per Sec
GPS
5 frame
Per Sec
Compressed Raw Data (GPS and Accelerations)

Or GPS only for speeding and offoRoad
GPS
Initial frames
1-4
GPS
5 frame
Per Sec
GPS
5 frame
Per Sec
GPS
5 frame
Per Sec
For a more detailed maneuver records description please refer to the following links:
ManeuverRecordsStructure
compressedAccel
compressedGps
4.3.5
Trip files Payload Structure

Trip files contain multiple maneuvers records organized as list of records. Maneuver
records data structure may include optional compressed raw data.
The three examples below describe how Trip file is organized: The file starts with a Trip
header block defining the Trips type, version and length (6 Bytes total). The Trip file
header is followed by a trip statistics record which is similar to the CSA module trip
statistics record excluding the first 2 bytes. After the trip statistics the file is organized as
list of maneuver records. Each maneuver record is composed of Maneuver header,
Optional Maneuver statistics record (same structure as the CSA statistics module
excluding first 2 bytes) and optional maneuvers compressed raw data. Compressed Raw
data records are located at the end of the maneuver record and are maneuver type
depended: ABC maneuvers will be followed by compressed GPS and Accelerations frames
while Speeding, speeding logging and OffRoad maneuvers will be followed by compressed
GPS records only. The maneuver raw data accelerations are called frames and they
represent the average accelerations of 4 consecutive 20Hz samples in each dimension.
Frames and GPS records are compressed according to the reordering rule described in:
compressedAccel and compressedGps records description.
Please read the description below for detailed files structure. For file parsing examples
please go to section 4.2: File structure examples.

Page 217 of 292
Cellocator Wireless
Example 1: Trip payload: maneuvers without raw data:
Trip
Header
Trip
Statistics
Maneuver
Maneuver
Maneuver
Header
Trip
Header
Trip
Statistics
Maneuver
Maneuver
Maneuver
Maneuver
Maneuver
Maneuver
Maneuver
Statistics
Maneuver
Maneuver
Header
Maneuver
Maneuver
Statistics
Example 2: Trip payload for Red maneuvers with raw data

Example 3: Trip payload speeding logging (Please note Maneuver statistics not
included)
Trip
Header
Maneuver
Speed Logging
Maneuver
Speed Logging
Maneuver
Header
Maneuver
Speed Logging
Compressed Raw Data (GPS Only)
GPS
GPS
GPS
GPS
GPS
GPS
4.3.5.1 Trip Header

Field Name
Description
Spare
Holds 0x00 or 0x03 in older files
File Version

Page 218 of 292
Cellocator Wireless
Field Name
Description
Trip Record Length 0
Holds the trip complete length (All the maneuvers

records)
4.3.5.2 Maneuver Header

Field Name
Description
Maneuver Type
According to the maneuver type ID in the

ManeuverRecordsStructure table.
Maneuver Sample Rate
Usually 20 Hz.
Maneuver Length 0
Maneuver Length 1
Holds the maneuver length. Maneuver records with

raw data are identified by maneuver length which
is larger than the maneuvers statistics record.
4.3.5.3 Trip Statistics Record

Statistics record type
Link
Trip Statistics
Trip Statistics
(Excluding the first 2 bytes)

The Maneuver statistics records are the same records used by the CSA protocols
excluding the first 2 bytes.
4.3.5.4 Maneuvers Records Structure

Maneuver
Name
Maneuver
Type ID
Statistics record structure
Raw Data
ABC maneuver
Statistics
ABC Maneuver Statistics

Accelerations
and GPS
records
Speeding
continuous
maneuver
Statistics
Over Speed Maneuver Statistics
GPS records
OffRoad
Continuous
maneuver
OffRoad Continuous maneuver

Statistics
GPS records

Page 219 of 292
Cellocator Wireless
Maneuver
Name
Maneuver
Type ID
Statistics record structure
Raw Data
Idling
Continuous
maneuver
Idling Continuous maneuver

Statistics
No Raw data
RPM Continuous
maneuver

RPM Continuous maneuver
Statistics
No Raw data

Speeding logging
No
GPS records
Crash maneuver
Crash Maneuver Statistics
No Raw data
4.3.6
Crash File Payload Structure

Crash files are generated when accident is detected. The crash file represents the
vehicles behavior before and after the accident in 2 sampling resolutions. Before the
accident event the data is recorded in 20Hz sampling rate while from the accident and
after the resolution is raised to 100Hz. The files structure includes: Header, crash
Attributes, Crash data-structure control block and dual resolution compressed binary
crash data.
4.3.6.1 Crash File Detailed Structure

Field Name
Description
crashID
Spare1
Spare2
VehicleType
(provisioning)
0-Private, 1-MCV, 2-HCV,
crashType
Number representing the type of crash;

1=light crash, 2 = heavy crash;
maxG
maximum G force during crash (MSB)
maxG
maximum G force during crash (LSB)
crashInfo
Crash orientation:
0-init , 1-front, 2-rear, 3-side, 4-roll
durationInSeconds
crash duration in seconds (LSB)
durationInSeconds
crash duration in seconds (MSB)

Page 220 of 292
Cellocator Wireless
Field Name
Description
20
numOfInitAccel
number of accelerations before the first GPS

in the lists (0-20)
11
amoutOfPostSamples
Number of accelerations received between

the crash the first GPS record after the crash
(100Hz resolution)
12
preDataLenInSec
number of second before crash
13
postDataLenInSec
number of second after crash
Crash Data
Compressed crash data: dual resolution

accelerations and GPS records.
Crash
Header
Crash
data-structure
control block
Crash
Attributes
Compressed dual resolution crash data
100 Hz sampling rate
20 Hz sampling rate
Last bit
set
Crash Event
GPS
Accelerations
preDataLenInSec
numOfInitAccel
(20 Hz Resolution)
postDataLenInSec
amoutOfPostSamples

Page 221 of 292
Cellocator Wireless
4.3.6.2 Crash File Compressed Format
Crash data is compressed by reordering the accelerations and the GPS records to
minimize unallocated bits. Compressed GPS record length is 16 bytes and compressed 3D
acceleration length is 5 byte. The resolution before and after the crash changes from 20
Hz to 100Hz
The raw data is ordered in the memory as follows:
Compressed GPS
GPS
Compressed GPS
GPS
Compressed GPS
Compressed Accelerations (3 Bytes each) 20 Hz

4
10
11
12
13
14
15
16
17
18
19
20
GPS
Compressed GPS
Compressed Accelerations (3 Bytes each) 100 Hz

1
99
0
89
0
12345678
GPS
9
9
Compressed GPS Entry:

0
Longitude(7-0)
Longitude(15-8)
Longitude(23-16)
Longitude(31-24)
Latitude(7-0)
Latitude(15-8)
Latitude(23-16)
Latitude(31-24)
Altitude(7-0)
Altitude(15-8)
10
Minutes(2-0)
11
Sec(4-0)
12
Speed(6-0)
13
Available
14
Course(7-0)
15
Spare
7
Hours(4-0)
Minutes(5-3)
Sec(5)
Mode2
Dop (4-0)
Speed(7)
Mode1(2-0)
Course(8)

Page 222 of 292
Cellocator Wireless
Compressed 3 dimensional accelerations (12 bit resolution)
The data structure below describes 3 dimensional 12 bits samples mapped into 5 bytes.
The Compressed data structure is used for safety records raw data storage. These
entries are sent as files to the FTP server when trips end.
Bit 4 of byte number 4 represents the Last Bit. The Last Bit Indicates it is the last
acceleration before GPS record. The Last Bit is only relevant for Crash Files.
0
X(7-0)
Y(7-0)
X(11-8)
Y(11-8)
Z(7-0)
Z(11-8)
Last
7
For example, the following set of 5 bytes compressed accelerations will be decompressed
as follows:
Compressed Acceleration 5 Bytes): F3 5F FD F3 00
Decompressed Acceleration and conversion to units of g
X = 0xff3 = -13 * 8 / 4096 = - 0.025390625 g
Y = 0xfd5 = -43 * 8 / 4096 = - 0.083984375 g
Z = 0x0f3 = 243 * 8 / 4096 = 0.474609375 g
4.4
File Structure Examples
4.4.1
Trip File Detailed Structure Example

This example shows the bytes allocation for a trip file with the following properties:
The example trip has one maneuver
The ABC maneuver has Raw data
The Raw data has one acceleration before the first GPS
Field Name
Description
Trip Type
File Version
Trip ID (3 bytes)
Block Type
Trip Header

Page 223 of 292
Cellocator Wireless
Field Name
Description
Block Type
Trip
Driver ID (6 bytes)
Start date & time (7

bytes)
Start date & time for trip (taken from

first valid GPS reading)
Trip duration seconds (3

bytes)
Trip duration
10
Distance Traveled (4
bytes)
In meters, calculated based on GPS

data
11
Movement Time (4
bytes)
In seconds, time the vehicle has moved

from Ignition on to Ignition off event or
until driver was replaced
12
Idle time short (4

bytes)
In seconds, time the vehicle was idle

based on GPS + accelerometer
information, according to 1st level
threshold (ref to Idling levels in the
configuration part)
13
Idle time Long (4

bytes)
In seconds, time the vehicle was idle

based on GPS + accelerometer
information, according to 2nd level
threshold(ref to Idling levels in the
configuration part)
14
Max X (2 bytes)
Maximum accel input on X axis
15
Max Y (2 bytes)
Maximum accel input on Y axis
16
Max Z (2 bytes)
Maximum accel input on Z axis
17
Max "RMS" (4 bytes)
The Cello-IQ sands

. The
server side needs to perform square
root and divide the result by
and
then multiply by 8/4096 to get the
value in G
18
Max Speed 1 (byte)
Maximum Speed
19
AVG Speed (byte)
Trip average Speed
20
Start fuel level (%)(1

byte)
Fuel level upon trip start
21
End fuel level (%)(1

byte)
Fuel level upon trip end
22
Weighted Safety Score

(1 byte)

representing the safety score of the trip
23
Weighted Eco Score (1

byte)

representing the Eco score of the trip

Statistics
Page 224 of 292
Cellocator Wireless
Field Name
Description
Block Type
24
Eco scoring: Idle Score

(1 byte)
25
Eco scoring: Urban

driving Score (1 byte)
26
Eco scoring: Highway

driving Score (1 byte)
27
Eco scoring: Idle Score

Time (seconds) (3
byte)
28
Eco scoring: Urban

Score Time (seconds)
(3 byte)
29
Eco scoring: Highway

Score Time (seconds)
(3 byte)
30
Spare (10 Bytes)
31
Maneuver Type
Maneuver
32
Header
33
Maneuver Length 0
34
Maneuver Length 1
35
Trip ID (3 bytes)
Trip ID (3 bytes)
ABC
36
Maneuver
37
38
39
40
41
Maneuver duration
(seconds) (2 bytes)
42
X average (2 bytes)
X average (2 bytes)
43
Y Average (2 bytes)
Y Average (2 bytes)
44
X Max (2 bytes)
X Max (2 bytes)
45
Y Max (2 bytes)
Y Max (2 bytes)
If the maneuver length is higher than

the maneuver statistics record length
than the maneuver record includes raw
data.

Statistics
Page 225 of 292
Cellocator Wireless
Field Name
Description
46
Z Max (2 bytes)
Z Max (2 bytes)
47
49
Speed Max (1 byte)
Speed Max (1 byte)
50
Speed delta
Speed delta
51
Max RPM (2 bytes)
Max RPM (2 bytes)
52
53
54
ABS state (1 byte)
ABS state (1 byte)
55
Risk score (1 byte)
Risk score (1 byte)
56
Num of init frames (1

byte)
Num of init frames (1 byte)
Acceleration record
5 acceleration Frames, each frame is

represented by htree 12 bits values for
x, y, z. The f
57
58
Block Type
(Should be 1 for this example as the

following raw data record has 1
acceleration record before first GPS
record
Maneuver
Raw Data
Example
59
60
61
62
GPS record
16 bytes compressed GPS record
(1
acceleration
before first
GPS record)
63
64
65
66
67
68
69
70
71
72
73

Page 226 of 292
Cellocator Wireless
Field Name
Description
..
Block Type
74
75
76
77
..
4.4.1.1 Real Trip Files Parsing Example

Example file: U0000001142-R002-I00002d_000000-D121218-T122717096.cpr
Binary Data
Field Name
Structure
Name
00 00 08 18
File Length
File
01
File Version
Header
02
File Type
0C 0C 12 0C 1B 11 60
Date/Time: Dec 18 2012,

12:27:17:96
00
Spare
00
Spare
03
Trip Type
Trip
01
File Version
Header
03
08
00
00
00 2D 00
Trip ID (3 bytes)
00 00 00 00 00 00
Driver ID (6 bytes)
00 01 18 19 0C 12 0C
Start date & time (7 bytes)
0C 70 00
Trip duration seconds (3 bytes)
00 00 00 00
Distance Traveled (4 bytes)
00 5B 00 00
Movement Time (4 bytes)
00 00 00 00
Idle time short (4 bytes)
00 00 00 00 00
Idle time Long (4 bytes)

Page 227 of 292
Cellocator Wireless
Binary Data
Field Name
Structure
Name
46 00
Max X (2 bytes)
4E 00
Max Y (2 bytes)
C0 00
Max Z (2 bytes)
25 94 00 00
MAX RMS unit value (unsigned

32 Bits): The unit sends
The server side needs to
complete the calculation taking
the square root of the value send
by the unit and divide it by the
square root of 3:
MAX RMS
0B
Max Speed 1 (byte)
09
AVG Speed (byte)
00
Start fuel level (%)(1 byte)
00
End fuel level (%)(1 byte)
37
Weighted Safety Score (1 byte)
3A
Weighted Eco Score (1 byte)
64
Eco scoring: Idle Score (1 byte)
32
Eco scoring: Urban driving Score

(1 byte)
00
Eco scoring: Highway driving

Score (1 byte)
08 00 00
Eco scoring: Idle Score Time

(seconds) (3 byte)
63 00 00
Eco scoring: Urban Score Time

(seconds) (3 byte)
00 00 00
Eco scoring: Highway Score Time

(seconds) (3 byte)
00 00 00 00 00 00 00 00 00 00
Spare (10 Bytes)
00
Maneuver Type
Maneuver
14
Header
22
Maneuver Length 0
02
Maneuver Length 1

Page 228 of 292
Cellocator Wireless
Binary Data
Field Name
Structure
Name
2D 00 00
Trip ID (3 bytes)
03 00 00
08
DA 4D A3 03 E8 8E A4 03
DA 4D A3 03 49 8F A4 03
01 31 19 0C 12 0C 0C
1C 00
Maneuver duration (seconds) (2

bytes)
00 00
X average (2 bytes)
44 00
Y Average (2 bytes)
00 00
X Max (2 bytes)
B2 FF
Y Max (2 bytes)
BB 00
Z Max (2 bytes)
0B
0B
Speed Max (1 byte)
00
Speed delta
00 00
Max RPM (2 bytes)
00 00
00 00
00
ABS state (1 byte)
4A
Risk score (1 byte)
04
Num of init frames (1 byte)- 4

frames
06 60 00 BE 00
4 frames
ABC
Maneuver
Statistics
Raw data
06 80 00 BE 00
06 70 00 BE 00
06 70 00 BE 00
DA 4D A3 03 A0 8E A4 03 E8 03 2C
7B 17 C0 00 F8
GPS

Page 229 of 292
Cellocator Wireless
Binary Data
Field Name
Structure
Name
06 80 00 BE 00
5 frames
06 80 00 BE 00
06 90 00 BE 00
06 90 00 BE 00
06 A0 00 BE 00
DA 4D A3 03 B8 8E A4 03 E8 03 2C
83 17 C0 00 F8
GPS
06 A0 00 BE 00
5 frames
06 A0 00 BE 00
06 90 00 BE 00
06 60 00 BF 00
04 20 00 C0 00
DA 4D A3 03 D0 8E A4 03 E8 03 2C
8B 17 C0 00 F8
GPS
02 50 FF BF 00
5 frames
FF 1F FE BB 00
FD 1F FD B7 00
FC 7F FC B6 00
FC 1F FC B5 00
DA 4D A3 03 E8 8E A4 03 E8 03 2C
93 17 C0 00 E8
4.4.1.2 Crash File Detailed Structure Example

Example file: U0000009999-R003-I000003_000000-D121223-T185546008.cpr
00 00 08 18
File Length
File
01
File Version
Header
02
File Type
0C 0C 12 0C 1B 11 60

12:27:17:96
00
Spare
00
Spare

Page 230 of 292
Cellocator Wireless
Binary data
Field name
Structure
Name
00 00 1B 93
File Length
01
File Version
03
File Type
0C 0C 17 12 37 2E 08

18:55:46:08
00
Spare
00
Spare
05
crashID
00
Spare1
00
Spare2
00
VehicleType (provisioning)
02
crashType
31
maxG
04
maxG
04
File
Header
Crash
Attributes
crashInfo
19
durationInSeconds
00
durationInSeconds
0x13
numOfInitAccel
0x0A
amoutOfPostSamples
0x0F
preDataLenInSec
0x0A
postDataLenInSec
DA 4D A3 03 67 19 57 03 E8 03
D2 1E B9 C0 00 E8
GPS Record
F3 5F FD F3 00, F3 6F FD F4
00, F2 5F FD F3 00, F2 5F FD
F3 00, F3 5F FD F2 00, F3 6F
FD F2 00, F3 5F FD F3 00, F4 6F
FD F4 00, F3 5F FD F4 00, F3
6F FD F3 00, F3 6F FD F4 00, F3
6F FD F4 00, F3 5F FD F4 00, F3
6F FD F5 00, F3 5F FD F5 00, F3
5F FD F5 00, F2 6F FD F4 00, F3
6F FD F3 00, F3 6F FD F3 00, F3
6F FD F3 10
20 accelerometer samples between

2 GPS records. The last
accelerometer sample before the
next GPS is marked as last (see
yellow highlighted byte value 0x10)

Raw crash Data
Page 231 of 292
Cellocator Wireless
DA 4D A3 03 67 19 57 03 E8 03
D2 26 B9 C0 00 F8
....
DA 4D A3 03 67 19 57 03 E8 03
D2 8E B9 C0 00 F8
GPS before crash event
F4 6F FD F4 00, F3 6F FD F4 00,
F3 6F FD F4 00, F3 6F FD F3 00,
F3 6F FD F3 00, F3 5F FD F3 00,
F4 6F FD F3 00, F3 6F FD F3 00,
F3 5F FD F2 00, F3 6F FD F3 00,
F4 6F FD F2 00, F3 6F FD F4 00,
F3 6F FD F4 00, F3 6F FD F4 00,
F3 5F FD F4 00, F3 6F FD 1B
00, F4 5F FD F4 00, F3 6F FD
F3 00, F3 5F FD F3 00, F8 4F 00
15 01 ED 8F FE 14 01 E7 3F FD
2A 01 FA 6F FD 36 01 EE 7F FC
3A 01 F3 0F FC 2D 01 F3 7F FC
2D 01 F7 DF FC 26 01 03 D0 FC
34 01 08 C0 FC 32 11
There are 19 (0x13) (See

numOfInitAcce above) 20 Hz
accelerations before the accident
impact. There are 10 (0x0A) (See
amountOfPostSamples above) 100
Hz acceleration samples after the
accident impact.
DA 4D A3 03 67 19 57 03 E8 03
F2 1E B9 C0 00
GPS record following the impact
100 Hz accelerations and GPS

records
The last acceleration before the

coming GPS has the Last Bit set (In
Yellow)
The accident impact sample is
highlighted in RED

Page 232 of 292
Cellocator Wireless
CelloTrack Nano Protocol
5.1
Overview
The goal is to support 3 different kinds of customers:
Legacy customers, who already have older CelloTrack devices and want the same functionality.
New customers that want to build everything from scratch.
Customers that want to combine the legacy devices with the new functionality, or who
are in transition between the old and the new worlds.
To achieve this goal, the messages in CelloTrack Nano are divided into 2 types:
Legacy functionality messages (as in the CelloTrack-T): These messages can be
passed by the Nano either by the legacy type-0 and/or "encapsulated type-0 over
type-11" as explained below.
CelloTrack Nano new functionality messages: These can be passed fully and natively
over the type-11 modular messages, and/or (if configured) over the legacy type-0
system but with only the possible data (sometimes thin or partial data).
All functionality of the CelloTrack Nano events uses Type-0 legacy events and/or the
advanced Type-11 messages, all according to the configuration bits per feature.
Each Nano specialized feature has the following 4 bits of configuration:
Bit 3
Bit 2
Bit 1
Type-11
Logged
Bit 0
Type-0
"Active log
event"
Logged
Distress
Type-0 could also be "Active log event" or not, depending on the global (one per system)
bit of "Enable Active Events" (in address 0000.0 of the PL).
This enables the user to select between the following options:
Type-11 options:
0= Disable
1= "Active Log Event"
2= Logged
Type-0 options:
0= Disable (the global "Active log event" bit will be ignored)
1= Distress (the global "Active log event" bit will be ignored)
2= Logged
3= Logged & Distress (not a recommended setting if the "Active log event" bit is set,
as it will cause the sending of 2 messages per event).
The log memory supports both types simultaneously, as a continuous and united space.
------------------------------------------------------------------------------------------------NOTE: When "Active log event" is used, the unit turns on the GNSS and waits for a fix
(up to 90 seconds). If a fix is achieved, both the GPS stamp and time stamps of the event
Page 233 of 292
Cellocator Wireless
are overridden.
-------------------------------------------------------------------------------------------------
5.2
Nano-related Content of Multi-Purpose Bytes (3338) in

Type-0 Messages
This section describes Map bytes 33-38 ("Multi-purpose field" previously contained the 6
Dallas bytes) of Type-0 message.
IMPORTANT: In messages from the Nano, this is the default content of the Multipurpose bytes for Type-0 transmissions unless otherwise stated.
Byte
no.
Description
Bit7
Bit6
Containing
Bit5
Bit4
Bit3
Bit2
Bit1
Bit0
Multi-purpose bytes area management byte in

Nano:
33
0x00 = Nano readings

0x01 = Nano event
0x00= Nano
readings
0x02 = MultiSense event
34
Bits [74]:
Bits [30]:
Slow filtered X
Acceleration, limited to
+1.75g-2g and shrunk
to "SINT4 format".
Slow filtered Y
+1.75g-2g and
shrunk to "SINT4
format".
(LSB= 0.25g, so 0111 =

+1.75g,
1111 = -0.25g etc.)
(LSB= 0.25g, so 0111

= +1.75g,
1111 = -0.25g etc.)
Bits [74]:
Slow filtered Z
+1.75g-2g and shrunk
to "SINT4 format".
35
(LSB= 0.25g, so 0111 =

+1.75g,
1111 = -0.25g etc.)
Bit [3]: This bit

represent "Upright
position"=0 or "Lying
position"=1
Bit [2]: Not "Upright
position" and not
"Lying position"
Bit [1]: Nano
temperature readings
are "Invalid"=0 or
"Valid"=1. (Due to the
fact that it is actively
charging or during 30

Page 234 of 292
Cellocator Wireless
minutes period after
that, the temperature
is shifted upwards).
Bit [0]: Reserved = 0
36
37
ADC raw reading of Ambient Light in 12-bit (LSB),

in 0.25 lux units
(Infrastructure)
Bits [30]:
Reserved = 0000
ADC raw reading of

Ambient Light in
12-bit (MSB),
in 0.25 lux units
In Nano 10 = 0
In Nano 10 = 0
38
Average of 2 last Pressure samples, translated to

meters above sea-level, UINT8 format, where
400m below sea-level is =0 and the value is
divided by 32, i.e. 2006000m.
In Nano 10 = 0
"Bytes 33-38 assignment bits" are: 101 = CelloTrack Nano use (see Section 2
.2.3.4).
This is used at all times except for the MultiSense event mentioned here.
5.3
Changes in Emergency Queue

In the legacy system queue (which has a queue size of 5 events), if new emergency
events with the same TR which exist in the queue occur, the older event is replaced by
the new one. For legacy events with the Nano (which have TR 164), this decision is
made by considering both the TR and STR and if to replace or not.
For Nano events (non-legacy, TR =164), these substitutions are not applied at all. Every
Nano emergency event is inserted into the queue and nothing is removed from it.
The Nano emergency events contain the authentic Multi-purpose bytes of the event, so
the reported event and sensor data should be relevant to the event.

Page 235 of 292
Cellocator Wireless
5.4
Type-11 Message Structures

The General Event Message is a Type 11 message designed to reflect system events and
notifications towards the server. The message is built as follows:
Type 11
Header
Fw Hw ID
Module 8
Event Category
GPS Stamp
Module 6
Event
Code
Time Stamp
Module 7
Length
nano inherent sensors

Module 42
Event Information
Bytes
General Event
Module 28
Event Category
Event
Code
Event Entry
Length
Event Information
Bytes
Event Entry
Modules 8, 6, 7 and 42 are mandatory fields, and always come first in this exact order,
everything else (module 28 is just an example here) comes after these.
General structure of Type-11 messages:
Byte
no.
Description
Containing
System Code, byte 1
ASCII M
System Code, byte 2
ASCII C
System Code, byte 3
ASCII G
System Code, byte 4
ASCII P
Message Type byte
11
6
7
8
9
10
11
Communication Control Field (2 bytes)
12
Command Numerator
13
14
15
Length (of the modules section - not including the

checksum)
16
Spare (sent as 0)
17
Page 236 of 292
Cellocator Wireless
Byte
no.
Description
Containing
18
19
20-28
Module Name 8- FW_HW ID (Mandatory)
29-50
Module Name 6- GPS Location Stamp

(Mandatory)
51-60
Module Name 7- Time stamp (Mandatory)
61-78
Module Name 42- Nano inherent sensors

(Mandatory)
79
Other modules
...
...
...
Last
byte
Checksum
"FW_HW ID Module" number 8 structure as shown in section Firmware ID Module.

"GPS Location Stamp" number 6 structure as shown in section GPS Location Stamp
Module.
"GPS Time Stamp" number 7 structure as shown in section GPS Time Stamp Module.
"Nano inherent sensors" number 42 structure:
Byte
no.
Description
Containing
Module Name 42 - Nano inherent sensors
42
15
X acceleration (in 250g units)
SINT16 format
Y acceleration (in 250g units)
SINT16 format
1
2
3
4
5

Page 237 of 292
Cellocator Wireless
Byte
no.
Description
Containing
Z acceleration (in 250g units)
SINT16 format
ADC raw reading of Ambient Light in 12-bit (LSB),

in 0.25 lux units
In Nano 10 = 0
(Infrastructure)
Bits [3..0]:
In Nano 10 = 0
10
Reserved = 0000
ADC raw reading of Ambient

Light in 12-bit (MSB),
in 0.25 lux units
11
Average of 2 last Air pressure samples, translated to

0.1m units above sea-level, UINT16 format, where
400m below sea-level is = 0.
6
7
8
9
12
13
14
Current temperature from the most accurate

available source (MCU internal in Nano 10, and the
accurate temperature sensor in Nano 20)
In Nano 10 = 0
Resolution of
0.1C in signed
(SINT16
format)
Bit [7]: This bit represent "Upright position"=0 or

"Lying position"=1
Bit [6]: Not "Upright position" and not "Lying
position"
15
Bit [5]: Nano temperature readings are "Invalid"=0

or "Valid"=1. (Due to the fact that it is actively
charging or during 30 minutes period after that, the
temperature is shifted upwards).
Bits [4..0]: Reserved = 00000
16
17
Nano battery level in %

RSSI (of cellular modem)

SINT8 format in
dBm units
Page 238 of 292
Cellocator Wireless
IMPORTANT: X,Y and Z acceleration values are according to the following axis system:
X
5.5
Legacy (Type-0) Encapsulated in Type-11 New Module

This packet is used whenever a legacy message is configured in the configuration bytes at
addresses 540603 (also configurable via the Nano editor in the 3rd tab) to send a type11 message (and it does not have a native type-11 message, i.e. TR=164).
Outbound message:
Byte
no.
Description
Containing
Module Name 41- Legacy message
41
26
Message type - (a value of 0 for status/location

message)
Inbound/outbound
1= outbound
Spare
Spare
Spare
Protocol Version Identifier
Unit status + Current GSM Operator (1st nibble)
10
Current GSM Operator (2nd and 3rd nibble)
1
2

Page 239 of 292
Cellocator Wireless
Byte
no.
Description
11
Transmission Reason Specific Data
12
Transmission reason
13
Units mode of operation
14
Units I/O status 1st byte
15
Units I/O status 2nd byte
16
Units I/O status 3rd byte
17
Units I/O status 4th byte
18
Current GSM Operator (4th and 5th nibble)
19
20
21
22
23
Mileage counter (total 24 bits)
Containing
24
25
26
Last GPS Fix
27
28
Location status (from unit)
5.6
Nano Features Related Messages
5.6.1
General Definitions and Data Structures

The Nano design is based on the following data structures:
Bit
Description
Source of measurement
0x000x0F MultiSense unit (according to place in the PL,

whether occupied/enabled or not)
0xFC Guest MultiSense (not in the list)
0xFD High accuracy or specialized sensors of the CelloTrack
Nano 20 (for example: Accurate temperature sensor, pressure
sensor, etc)
0xFE MCU internal (temperature only)
0xFF Reserved
Page 240 of 292
Cellocator Wireless
Bit
Description
Temperature measured [0..7]
Units, valid
range
0.1C in signed (in SINT16 format),
-5001000 = -50100 C
(The measurement is accurate in the -4080 C range)
Bit
Description
Temperature
measured
[12]=sign bit
only
Units, valid
range
5.6.2
Reserved
Temperature measured [8..11]
0.1C in signed (in SINT16

format)
Nano Extra Take Locations Messages

The Nano takes GNSS locations an extra configurable times a day and logs them
internally as Type-0 with a specific reason, as shown here, and/or type-11 with the same
message but encapsulated as mentioned here, all depending on the configuration bits in
PL address 603, bits 0-1.
5.6.3
Impact and Free-fall Recognition

Type-0 with Transmission-reason =164 (Nano) and Specific-reason = 1 (impact event) or
Specific-reason = 16 (Free-fall event) is used.
For this combination of Transmission-reason and Specific-reason, the Multi-purpose bytes
mentioned here will be replaced by this structure, with "Bytes 33-38 assignment bits" set
as 101 = CelloTrack Nano use (see section 2.2.3.4).
Byte
no.
Description
Containing

Nano:
33

0x01 = Nano event
0x01= Nano
event or
0x02 =
MultiSense
event

Page 241 of 292
Cellocator Wireless
Byte
no.
Description
Containing
34
Source of measurement (single only)
Sources
enumeration
according to
this definition
35
Reserved
36
Battery level in %
37
Last RSSI value (Cellular if Nano, and SR-RF if

MultiSense)
SINT8 format in
dBm units
Sqrt (RMS value)
Shrunk to
UINT8:
38
LSB resolution
= 32mg
And/or this outbound Type-11 message is used:

Byte
no.
Description
Containing
Module Name 28 - General

Status Event
28
11
Number of entries
1 = Nano
1
2
3
4
5
6
7
1 = Impact or
16 = Free-fall
Length of data
5 Bytes
Source of event
Sources enumeration according to

this definition
Impact/ Free-fall acceleration

RMS value
32-bit value in 250g units.
10
11
12
13

Page 242 of 292
Cellocator Wireless
5.6.4
Orientation Change
Type-0 with Transmission-reason =164 (Nano) and Specific-reason = 2 (Orientation
change event) is used.
Byte
no.
Description
Containing
28
Number of entries
1 = Nano
2= Orientation
change
Length of data
1 Byte
Reserved
1
2
3
4
5
6
7
5.6.5
Man Down
Type-0 with Transmission-reason =164 (Nano) and Specific-reason = 3 (Man down event)
is used.
Byte
no.
Description
Containing
28
Number of entries
1 = Nano
3= Man down
Length of data
1 Byte
Reserved
1
2
3
4
5
6
7

Page 243 of 292
Cellocator Wireless
5.6.6
Package Open/Close
The reading is passed over the following outbound type-0 message, with Transmissionreason =164 (Nano) and Specific-reason = 4 (Open package), or Specific-reason = 5
(Close package).
Byte
no.
Description
Containing

Nano:
33

0x01 = Nano event
0x01= Nano
event
34
Sources
enumeration
according to
this definition
35
Reserved
36
Battery level in %
37
Last RSSI value (Cellular if Nano, and SR-RF if

MultiSense)
38
Light Value
SINT8 format in
dBm units
Shrunk to
UINT8:
LSB resolution
= 4 lux

Byte
no.
Description
Containing
28
10
Number of entries
1 = Nano
4 = Light
sensor
1
2
3
4
5
6

Page 244 of 292
Cellocator Wireless
Byte
no.
Description
Containing
Length of data
4 Bytes
Source of event
Sources
enumeration
according to
this definition
10
Open/Close package event
7
8
11
12
5.6.7
Filtered current light value (in 0.25 lux units)
0 = Close
1 = Open
Resolution =
0.25 lux units
Work-ID /Activation Event

The unit promotes a "Work ID" counter on every power turn-ON operation by the user.
This 32-bit counter is initialized as 0 on the production line.
The promoting of this counter is also a logged event and it is sent to the server.
In this way, the user can relate a specific ID to a certain shipment/task/operation/period.
Type-0 with Transmission-reason =164 (Nano) and Specific-reason = 9 (Work ID
promoted event) is used. Note that the counter itself is not passed over type-0 at all.
Byte
no.
Description
Containing
28
10
Number of entries
1 = Nano
10 = Work-ID /
Activation
Length of data
4 Bytes
1
2
3
4
5
6
7
8
9
10
Work-ID (32 bit)

Page 245 of 292
Cellocator Wireless
Byte
no.
Description
Containing
11
12
This command to ask for the current value of Work ID is used:
Byte
no.
Description
Containing
Module Name 32 = General Command
32
Number of Command entries sent by this module

(8 bits)
Command ID
258 = Nano:
send current
value of Work
ID
Reserved
1
2
3
4
5
6
5.6.8
Temperature/Humidity Reporting
For alert situations in type-0, Transmission-reason =164 (Nano) and Specific-reason = 11
for temperature events, or Specific-reason = 12 for humidity events are used.
mentioned here, will be replaced by this structure, with "Bytes 33-38 assignment bits" set
Byte
no.
Description
Containing
Multi-purpose bytes area

management byte in Nano:
33

0x01 = Nano event
0x01= Nano event
34
Source of measurement (single

only)
Sources enumeration according to

this definition

Page 246 of 292
Cellocator Wireless
Byte
no.
Description
Containing
Bits [2..0] Violation/Alert
status:
000 - Within the limits
010 - Violating (not in alert) a lower
TH but alert is not yet declared
011 - Violating (not in alert) a upper
TH but alert is not yet declared
100 Alert for lower TH violation
101 Alert for upper TH violation
110 Violating while in alert the
lower TH
111 - Violating while in alert the
upper TH
Bits [3] Retransmission
indication bit
35
Event code
This bit indicates (when '0') if the

current report is a retransmission or
not.
0 Retransmission
1 Not retransmission
Bits [5..4] Charging status
00 Not charging
01 Charging slow
10 Charging fast
11 Charger fault / charger thermal
shutdown
Bits [6] 30 min after charging
bit
0 Not during 30 minutes after
charging.
1 During 30 minutes after charging.
Bits [7] Reserved = 0
36
Battery level in %

Page 247 of 292
Cellocator Wireless
Byte
no.
Description
Containing
37
Last RSSI value (of Cellular

modem)
SINT8 format in dBm units
38
Reserved
Alternatively, the following is used:

Byte
no.
Description
Containing

33
0x01 = Nano event

34
Source of measurement (single

only)
Sources enumeration according to this

definition
0= All OK
1= Lost communication
2= Communication restored
35
Problem code
3= Low bat
4= Low bat restored
7= MultiSense Power-up
36
Battery level in %
37
Last RSSI value (SR-RF)

Page 248 of 292
Cellocator Wireless
Byte
no.
Description
Containing
Bits [2..0] Violation/Alert status:
010 - Violating (not in alert) a lower TH
but alert is not yet declared
011 - Violating (not in alert) a upper TH
110 Violating while in alert the lower
TH
38
Event code
111 - Violating while in alert the upper

TH
Bits [3] Retransmission indication
bit
This bit indicates (when '0') if the
current report is a retransmission or
not.
0 Retransmission
Bits [4..7] Reserved = 0000

Byte
no.
Description
Containing
Module Name 40
40 - Measurement readings
20 + n*3
1 = Nano
1= Temperature measurements
Metadata size (in bytes)
13
1
2
3
4
5
6
7

Page 249 of 292
Cellocator Wireless
Byte
no.
Description
Containing
Bits [2..0] - Reason for Tx:
000 Normal
Metadata: Nano Tx reason
001 Start Charging

010 Requested by command
000 Within the limits
010 Violating (not in alert) a lower TH
011 Violating (not in alert) a upper TH
110 Violating while in alert the lower
TH
111 Violating while in alert the upper
TH
bit
Metadata: Status
This bit indicates (when '0') if the current

report is a retransmission or not.
0 Retransmission
00 Not charging *
01 Charging slow
10 Charging fast
11 Charger Fault / charger thermal
shutdown
Bits [6] 30 min after charging bit
0 Not during 30 minutes after charging
*
1 During 30 minutes after charging
* This will be the sent value if the source
is a MultiSense.

Page 250 of 292
Cellocator Wireless
Byte
no.
Description
Containing
10
Metadata: Source

definition
11
First sample timestamp

seconds
12

minutes
13
First sample timestamp hours
14
First sample timestamp day
15

month
16
First sample timestamp year

(-2000)
17
18
Metadata: Sampling rate (in

Seconds)
19
Metadata: Upper threshold
20
Metadata: Lower threshold
21
Sample (payload entry) size
22
Number of samples in the

payload
23
24
25
26
27
28
Temperature reading
0.1C units, SINT16 format, according to

this definition
Delay from previous sample
In Sampling rate units (mentioned above

in this table)
Temperature reading
0.1C units, SINT16 format, according to

this definition
In Sampling rate units (mentioned above

in this table)
For humidity, this is the Type-11 message structure:

Byte
no.
Description
Containing

Page 251 of 292
Cellocator Wireless
Byte
no.
Description
Containing
Module Name 40
40 - Measurement readings
20 + n*3
Event Category (2 bytes)
1 = Nano
Event Code (2 bytes)
2 = Humidity measurements
Metadata size (in bytes)
13
1
2
3
4
5
6
7
Bits [2..0] - Reason for Tx:

8
Metadata: Nano Tx reason
000 Normal
001 Start Charging
010 Requested by command
010 Violating (not in alert) a lower TH
011 Violating (not in alert) a upper TH
110 Violating while in alert the lower TH
111 Violating while in alert the upper TH
Metadata: Status

bit
This bit indicates (when '0') if the current
report is a retransmission or not.
0 Retransmission
00 Not charging *
01 Charging slow
10 Charging fast
11 Charger Fault / charger thermal
shutdown
Bits [6] 30 min after charging bit

Page 252 of 292
Cellocator Wireless
Byte
no.
Description
Containing
0 Not during 30 minutes after charging. *
1 During 30 minutes after charging.
* This will be the sent value if the source is
a MultiSense.
10
Metadata: Source
11

seconds
12

minutes
13

hours
14
First sample timestamp day
15

month
16

year (-2000)
17
18
Metadata: Sampling rate (in

Seconds)
19
Metadata: Upper threshold
20
Metadata: Lower threshold
21
Sample (payload entry) size
22
Number of samples in the

payload
23

definition
Humidity reading
0.1% units in UINT16 format
In Sampling rate units (mentioned above in

this table)
Humidity reading
0.1% units in UINT16 format
28
In Sampling rate units (mentioned above in

this table)
24
25
26
27

Page 253 of 292
Cellocator Wireless
Byte
no.
Description
Containing
5.6.9
Request of the Entire Cyclic Buffer of a Channel

This is the command definition for a user request of the entire cyclic buffer of a sensor(s),
inbound type-11 message:
Byte
no.
Description
Containing
Module Name 32 = General

Command
32
1+n*5
Number of Command entries

sent by this module (8 bits)
n (=1 in case of single or all)
Command ID
257 = Nano: send cyclic buffer of the

designated source
Length of entry data
1
2
3
4
5
6
0 = Reserved
7
Sensor type
1 = Temperature
2 = Humidity
5.6.10
Source of measurement (single,

all, or multiple)

definition
Check-in Feature
Type-0 with Transmission-reason =164 (Nano) and Specific-reason = 13 (Check-in event)
is used.
Byte
no.
Description
Containing
28
10
Number of entries
1
2
3

Page 254 of 292
Cellocator Wireless
Byte
no.
4
5
6
7
8
Description
Containing
1 = Nano
11 = Check-in
Length of data
4 Bytes
9
10
11
reserved
12
5.7
MultiSense Features Related Messages
5.7.1
MultiSense Provisioning Event

Type-0 with Transmission-reason =164 (Nano) and Specific-reason = 10 (MultiSense
event) is used.
Only for this combination of Transmission-reason and Specific-reason, the Multi-purpose
bytes mentioned here will be replaced by this structure:
Byte
no.
Description
Containing

33
0x01 = Nano event

34
Sources enumeration
according to this definition
0 = All OK
1 = Lost communication
35
Problem code
2 = Communication restored
3 = Low bat
4 = Low bat restored
5 = Reserved

Page 255 of 292
Cellocator Wireless
Byte
no.
Description
Containing
6 = Reserved
7 = MultiSense Power-up
36
Battery level in %
37
38
Reserved
00

Byte
no.
Description
Containing
Module Name 28 - General Status

Event
28
33
Number of entries
1 = Nano
7 = MultiSense provisioning
message
Length of data
27 bytes
Sources enumeration
1
2
3
4
5
6
7
0 = All OK
3 = Low bat
10
Problem code

5 = Reserved
6 = Reserved
11
Battery level in %

Page 256 of 292
Cellocator Wireless
Byte
no.
Description
Containing
12
13
System time seconds
14
System time minutes
15
System time hours
16
System date day
17
System date month
18
19
20
MultiSense FW version
21
BOM mask
22
Enabled sensors mask
23
24
25
26
27
28
29
30
31
32
33
34
Minor version
Major version
From those 2 bytes, it will
indicate which fields below
are relevant.
Last measured temperature
(in 0.1C units in SINT16

format)
Last measured humidity
(in 0.1% units in UINT16

format)
Last measured light level
(in UINT16 format, in 0.5 lux

resolution)
Last measured X acceleration
(in SINT16 format, in 250g

resolution)
Last measured Y acceleration

resolution)
Last measured Z acceleration

resolution)
The whole raw byte containing:

35
Time of last communication

from the specific MultiSense
Hall-effect state (LSB out of 8 bits),

Accelerometer Self-test result in the
MSB of this byte (the rest are
reserved).
Hall-effect = 1 means magnet

is present.
Acc. Self test bit = 1 means
pass.

Page 257 of 292
Cellocator Wireless
To request the status of a certain MultiSense (or the Nano itself), the following command
should be used:
Byte
no.
Description
Containing
Module Name 32 = General

Command
32
Number of Command entries sent

by this module (8 bits)
Command ID
259 = Nano: send status of

the designated source
Length of entry data
Sources enumeration
according to this definition .
Reserved
1
2
3
4
5
If the source is one of the MultiSense units, the answer to this command is the
"MultiSense provisioning message" as shown above it.
If the source is the Nano (0xFD), the answer shall be a type-11 message with module
name 42 as payload, as described here.
5.7.2
Guest MultiSense Reporting

For reporting a guest MultiSense transmission (if this mode is enabled), the following
type-11 message is used:
Byte
no.
Description
Containing
Module Name 28- General Status

Event
28
40
Number of entries
1 = Nano
13 = Guest MultiSense raw

data
1
2
3
4
5
6
7

Page 258 of 292
Cellocator Wireless
Byte
no.
Description
Containing
Length of data
34 Bytes
0xFC,
10
11
12
13
14
15
16
17
18
19
Raw advertisement ("0x81")

message
Note: Battery level and RSSI fields
will be the values received in packet
0x83.
16 bytes
20
21
22
23
24
25
26
27
28
29
30
Raw sensors reading stream

("0x83") message
31
(unscrambled)
17 bytes
32
33
34
35

Page 259 of 292
Cellocator Wireless
Byte
no.
Description
Containing
36
37
38
39
40
41
42
For reporting a guest MultiSense transmission in Tag mode (if this mode is enabled), the
following type-11 message is used:
Byte
no.
Description
Containing
Module Name 28- General Status

Event
28
23
Number of entries
1 = Nano
17 = Tag mode MultiSense

raw data
Length of data
17 Bytes
1
2
3
4
5
6
7
0xFC,
10
11
12
13
Raw advertisement ("0x81")

message
16 bytes
14
15

Page 260 of 292
Cellocator Wireless
Byte
no.
Description
Containing
16
17
18
19
20
21
22
23
24
25
5.7.2.1 Packet 0x81 parsing

RSSI
1 byte:
RSSI
SNIT8
in
dBm
units
MAC
6
bytes:
MAC
address
OTA
Bat
Version Level
1 byte:
OTA
protocol
version
Sensor BOM
Mask
Mask
2
bytes:
Battery
level
In mV
1
byte:
BOM
mask
1 byte:
sensor
mask
TX
Major FW Minor FW Scrambling
Reason Version
Version status
1 byte:
Reason
for Tx
1 byte:
MultiSense
major FW
version
1 byte:
Bit0 =
Connection
password
scrambled
1 byte:
MultiSense
Bit1 =
minor FW
Sensor data
version
stream
scrambled
Bit27 =
Reserved
5.7.2.2 Packets 0x81 tables

BOM / sensor mask bits:
Bit
7
Description
Reserved
Tempera
ture
Humidity
sensor
Magnetic
sensor
Light
sensor
Accelero
meter

Reserved
Page 261 of 292
Cellocator Wireless
sensor
enable
enable
enable
enable
sensor
enable
TX reasons:
0x00 - Reserved
0x01 - Relaxed timer
0x02 - Violation timer
0x03 - Power up
0x04 - Power down
0x05 - Proximity
0x06 - Push button
0x07 - Hall-effect changed state
0x08 - ACC Impact
0x09 - ACC Free-fall
0x0A - Package state changed
0x0B 0xFF - Reserved
5.7.2.3 Packet 0x83 parsing

Temp
Humidity
Light
Measureme
nt
Hall Effect +
Acc. Self-test
Bat Level TH States
1 byte:
Bit0 is the
state of the
hall effect.
1= magnet is
present
2 byte:
Temperature
signed
value.
resolution is
0.1C
2 byte:
Humidity
unsigned
value.
resolution
is 0.1%
2 byte:
A2D unsigned
raw ADC
value of Light
sensor.
0.5 lux units
Bit1 is
package state
per the
MultiSense
decision (light
sensor based).
0=Close
1=Open
2
byte:
X
signed
Value
in
250g
units
2
byte:
Y
signed
Value
in
250g
units
2 byte:
Z
signed
Value in
250g
units
Bit7
represents
result of SelfTest result of
the Acc.
0=Fail
1= Pass
2 byte:
16 bit
battery
level in
unsigned
mV units
1 byte:
Bit0 is TempTH:
0=Lower
1=Upper
Bit1 is
TempViolation:
0=Not violating
1=Violating
Bit2 is
TempAlert:
0=No alert
1=Alert
Bit3 is Reserved
Bit4 is
HumidityTH:
0=Lower
1=Upper
Bit5 is
HumidityViolatio
n:
0=Not violating
1=Violating
Bit6 is
HumidityAlert:
0=No alert
1=Alert
Bit7 is Reserved
RSSI
from
CBLE
1 byte:
RSSI
SNIT8
in
dBm
units
Note that regardless of the mask all the data is passed. But, if a sensor disabled, its data
value has no meaning.
If from some reason any unsigned field (such as Humidity or light) value cannot be reported,
the value that will symbolize a non-reading will be 0xFFFF.

Page 262 of 292
Cellocator Wireless
5.7.3
If from some reason any signed field (such as Temperature or XYZ) value cannot be reported,
the value that will symbolize a non-reading will be 0x8000.
MultiSense Open/Close Package Feature

The message itself can be type-0, with Transmission-reason =164 (Nano) and Specificreason = 4 (Open package), or Specific-reason = 5 (Close package).
The Multi-purpose bytes contain the following:
Byte
no.
Description
Containing

33
0x01 = Nano event

34
Sources enumeration
0 = All OK
3 = Low bat
35
Problem code

5 = Reserved
6 = Reserved
36
Battery level in %
37
38
Light level

Shrunk to UINT8:
LSB resolution = 2 lux
And/or a type-11 event identical to the packet here is used.

Page 263 of 292
Cellocator Wireless
5.7.4
MultiSense Open/Close Door/Window Feature

Type-0 with Transmission-reason =164 (Nano) and Specific-reason = 14 (Open
door/window) or Specific-reason = 15 (Close door/window) are used.
mentioned here, will be replaced by this structure, with "Bytes 33-38 assignment bits" set
Byte
no.
Description
Containing

33

0x01 = Nano event
34
Sources enumeration
0 = All OK
3 = Low bat
35
Problem code

5 = Reserved
6 = Reserved
36
Battery level in %
37
38
Reserved
00

Byte
no.
Description
Containing

Event
28
10

Page 264 of 292
Cellocator Wireless
2
3
Number of entries
1 = Nano
15 = Door/window
Length of data
4 bytes
Source of event
Sources enumeration
10
Open/Close state
11
Reserved
12
Reserved
4
5
6
7
5.7.5
0 = Close
1 = Open
MultiSense Added Event

After MultiSense unit(s) are being paired with the Nano, this event is created.
This outbound Type-11 message is used:
Byte
no.
Description
Containing

Event
28
16
Number of entries
1 = Nano
8 = MultiSense added
Length of data
10 bytes
Sources enumeration
MAC address of added MultiSense
48 bit MAC address (MSB

first)
1
2
3
4
5
6
7
10
11

Page 265 of 292
Cellocator Wireless
Byte
no.
Description
Containing
12
13
14
15
5.7.6
16
HW-TYPE of added MultiSense (BOM

mask)
17
Battery level in %
18
MultiSense Removed Event

After MultiSense unit(s) are being unpaired with the Nano, this event is created.
This outbound Type-11 message is used:
Byte
no.
Description
Containing

Event
28
16
Number of entries
1 = Nano
9 = MultiSense removed
Length of data
10 bytes
Sources enumeration
1
2
3
4
5
6
7
8
9
0xFF = All
10
11
12
MAC address of removed MultiSense
48 bit MAC address (MSB

first)
13

Page 266 of 292
Cellocator Wireless
Byte
no.
Description
Containing
14
15
16
HW-TYPE of removed MultiSense

(BOM mask)
17
Battery level in %
18

Page 267 of 292
Cellocator Wireless
Appendix A
Version
Revision History
Date
Description
31.6
June 13, 2011
Fixed conversion equation for course field of

Compressed Tracking message (Msg type 9
sub-type D)
31c.1
July 28, 2011
Added message type 7, container and

updated message type 8.
31c.2
Sept 15, 2011
Added description of programming bitmask

Added transmission reasons of coasting (21),
input dependent over-speed and additional
thresholds of GP frequency input.
31c.31
Oct 18, 2011
STR added for TR46 (Driver ID received):

a) Driver / Passenger ID
b) Group ID authenticated / not
authenticated
Driver/Passenger/Group ID description
added (bytes 33-38)
Added "Business" / "Privet" Mode monitoring
bit (byte 11, bit 5)
Added TR and STR for "Trailer Connection
Status"
Added OTA command to query trailer ID
Renamed Transmissions reasons: Input A to
Lock, Input B to Unlock, Input C to Unlock2
31.d
Jan 25,2012
Consolidation with Compact/CelloTrack

version
31e
Apr , 2012
Aligned with released 31e Cello-AR
31e 2
May 22, 2012
Added CelloTrack Output info
31e 3
June 17, 2012
Added modem Telit V2 version
31h 1
July 17, 2012
Added STR of Towed Mode (start and stop)

Added Operational mode 0x10 (Towed mode)
31j 1
Sept 5, 2012
Speed Limiting GeoFence Events (TR,STR)

Pulse Counter Modular Req and Response
31G 1
Nov. 7, 2012
Added support for CelloTrack3G
31i.1
Nov. 18, 2012
Added infrastructure for CelloTrack GPS

based ignition state.
CFE support OTA

Page 268 of 292
Cellocator Wireless
Version
Date
31n.1
31n.2
Description
CFE GA
Dec 27 2012
CelloTrack3G: Charging Power Connect /

Disconnected
SingleWire Temperature Sensors
(Infrastructure)
2.6.16, 2.6.13 : Telit version 10.00.033
corresponds with version code 30. Version
code 31 is defined as reserved
31p.1
Dec 27 2012
Not release in 31p:

2.2.3.6 Units Hardware and Firmware
Versions:
14 Cello-CAN+
2.2.3.19 Service and Location Status Byte:
Added Bit1: Trailer status indication: 0Trailer Disconnected, 1-Trailer Connected
2.6.2.8 Sub-Data Types List: Added new
infrastructure for Cello-CANiQ
15 Cello-CANiQ : statistics Request and
Response (Infrastructure)
CFE input 6 TR was replaced from 79/63 to
66/50 as there was a conflict with Ignition as
GP input.
31u
Mar. 7 2013
Added CFE destination and source serial port

in Forwarding OTA messages
Sections 2.4.3, 2.5.2, 3.5.2.2:
OTA downstream forwarding serial
broadcasting canceled. {Call Aux (backward
compatible mode COM3,4,5)}
31s
Mar. 20 2013
Section 2.6.2 added a table of byte 15 Forwarded Message Code
Cello-IQ
4.0.0.1
Oct. 23, 2012
Updated CSA protocol and FTP files format

Page 269 of 292
Cellocator Wireless
Version
Cello-IQ
4.0.0.2
Date
Nov 27, 2012
Description
1) Section 4.2.1: Module 31 name changed
to ABC Maneuver Statistics, Added
modules 58,59.60.61
2) Section 4.1.4: byte 9: End of maneuver
indication
3) Section4.2.2.19:N+2 was spare, now
operation byte to delete files.
4) Section 4.2.2.14: Focus on ABC
maneuver
5) Modules 49, 50 removed, contents moved
to Preset commands
6) Section 4.2.2.35: New entry size: 4 bytes
for each entry. 6 bytes spare
7) Section 4.2.2.40: Vehicle Preset
Configuration: N+25, N+26 are now
spare (severity thresholds) moved to PL.
N+201 N+208: Now status bar
thresholds
N+208-n+219: Eco score thresholds
8) 4.2.2.41 4.2.2.44: new continuous
maneuver modules.
9) Section 4.3.4.8 Maneuver Type 3 Idle
Maneuver : New File type
10) Section 4.3.4.9 Maneuver Type 4 RPM
Maneuver : New File type
11) 4.3.4.8, 4.3.49: Add two more file types
for Idle and RPM maneuver end.
Cello-IQ
4.0.0.3
Nov 27, 2012
1. 4.2.2.25: Module 51 contents appended

to the end of module 32 to support ECO
scoring at maneuver end.
2. 4.2.2.34: spare
3. Module 51 removed and appended to
module 32
4. Numbering removed from continuous
maneuvers messages
5. Each continuous maneuver message
entry contains byte count

Page 270 of 292
Cellocator Wireless
Version
Cello-IQ
4.0.0.4
Date
Nov 28, 2012
Description
1. 4.2.2.40: Preset table: N+212 N+217,
Replace the field name
N+218-N+223: Insert Eco scoring 6
speed ranges- Per Dudys request
N+224, N+225 moved
Only 2 spare bytes left at the end.
2. 4.2.2.41: Move Average speed green to
its legacy location (was parted from his
group when we added Delta speed and
Total maneuver severity.
Cello-IQ
4.0.0.5
Dec. 20 , 2012
1. Section 4.1.1 : Added CSA protocol ID

2. Replace echo with eco in several places
3. Section 4.3: FTP files description
rewritten with examples.
4. New Manifest request and returned
module for DFD and DFD SD card
versions.
5. Section 2.6.1.6: Added new module to
platform manifest to reflect the DFD and
DFD SD card versions
6. Section 3.6.12: byte 2. Bit 4: DFD
manifest request.
7. Section 4.2.2.40: Remove the detailed
Preset description.
8. Section 4.3.3: Updated files types
+hyperlinks
9. Section 4.3.4, 4.3.5, 3.3.6 Re-order the
detailed description
10. Section 4.4: Detailed Trip file parsing
example

Page 271 of 292
Cellocator Wireless
Version
Cello-IQ
4.0.0.6
Date
Dec. 25 , 2012
Description
1. Section 4.2.2.28: Updated crash
attributes with names similar to the crash
file record.
2. Section 4.3.6.1: Add duration MSB,
Add PostDataLenInSec, Update the
drawing with last bit indication and
remove prefixed samples before first
GPS.
3. Section 4.3.6.2: New description for
compressed accelerations data structure.
Add yellow circle to the compressed
accelerations to highlight the last bit.
4. Section 4.4.1.1: Add the example file
name. Reorder the trip example table
and add colors to reflect different records
5. Section 4.4.1.2: Add crash example file
name and reorder the crash data parsing.
Correct the Crash file header.
6. Section 4.1.5: Added elaborated sub
reason to File Upload Completed.
31w
April 9, 2013
Add support for IMEI (50 bits) transmission

over bytes 33-38 of type 0 and 2 upper bits
in byte 41 bits 5,6.
Section 2.2.3.19: Type 0, byte 41, bits 5 and
6 represents the upper bits of the outgoing
IMEI as described in : IMEI Transmission
Section 2.2.3.19: Type 0, byte 41, bit 7:
extends bytes 33-38 assignments (now we
have 8 allowed combinations).
31x
April 30, 2013
Section 2.2.3.10: Added support for Crash

detection (EDR) feature in Cello and Cello-AR

Page 272 of 292
Cellocator Wireless
Version
Date
Cello-IQ
4.0.0.7
Jan. 23, 2013,

May. 21, 2013
(32b)
Jun. 2, 2013
June 19, 2013
June 27, 2013
Description
1. Section 4: Add applicability table to
differentiate between Cello-IQ40 and
Cello-IQ50
2. Section 2.2.3.19: Type 0, byte 41, bit 0:
now reflect the actual state of the GNSS
antenna (In GLONASS).
3. Section 2.6.13: Add Processor family
identifier option 4 for ARM. Add Hardware
interface and peripherals identifier option
4 and 5 for STM32F101RCT6 and
STMF103RDT6
4. Section 2.6.16: Field ID 00: Add 0x02
STM32F103RDT6
5. Section 4.3.2.25: corrected the length of
the trip statistics packet from 55 to 73.
Cello-IQ
4.0.0.8
Jan. 23, 2013,

May. 21, 2013
(32f)
Jun. 2, 2013
June 19, 2013
June 27, 2013
Section 4: Add applicability table to

differentiate between Cello-IQ40 and CelloIQ50
1. Section 2.2.3.19: Type 0, byte 41, bit 0:
now reflect the actual state of the GNSS
antenna (In GLONASS).
2. Section 2.6.13: Add Processor family
identifier option 4 for ARM. Add Hardware
interface and peripherals identifier option
4 and 5 for STM32F101RCT6 and
STMF103RDT6.
3. Section 2.6.16: Field ID 00: Add 0x02
STM32F103RDT6
4. Section 4.3.2.25: corrected the length of
the trip statistics packet from 55 to 73.
4.0.0.9
Sept. 10. 2013
1. Add support for message type 11. For

programming 8 Kbyte configuration.
2. Added CSA modules: 62 for CSA control
commands and 63 for Crash maneuver

Page 273 of 292
Cellocator Wireless
Version
4.0.0.10
Date
Oct. 16, 2013
Description
1. Section 2.6.13: Updated fields 49,50
2. Section 2.6.16: added new module for
VIN, IMSI/IMEI, Originating FW ID
3. Section 4.2.5: Updated values for Crash
Occurred Event while parking
4. Section 4.2.4: CSA Event number 24:
Added source of Trip Start/Stop event by
GPIO, CSA Event number 7: DFD
Communication loss/regained event,
Added module 63: General CSA
Command for OTA reset via CSA protocol
5. Section 4.3.2.1: Operational Mode bit
number 1 reflects the DFD
Communication Status
6. Section 4.3.2.10: More detailed FW ID
module
7. Section 4.3.2.45: Added: General CSA
Control Command details.
4.0.0.12
Oct. 29, 2013
Section 2.6.13: Modem Revision ID: Updated

new Telit modems firmware version IDs
Added CR200 relevant information.
4.0.0.13
Nov. 19, 2013
Section 3.7.4.3: Correct the module length

from 3 to 6.
4.0.0.14
Dec. 1, 2013
Change modem version IDs for GE910 QUAD

V2 and V3.
4.0.0.16
January 20,
2014
Section 2.6.13: Modem version ID: Add FW

version string for Telit UE910 QUAD (V2), ID
number 73.
IMEI transmission will be supported by all
variants and not only by CR200.
Section 2.2.3.10: Added Nano events.
Section 2.2.3.11: Added Nano relevant
transmission reasons column.
4.0.0.17
January 21,
2014
Section 2.6.13: Added support for new

Modem revision ID.
Section 2.2.3.13: changed the style of the
I/O bits table.
4.0.0.18
February 6,
2014
Added support for CR300.

New Hw ID scheme : Units Hardware and
Firmware Versions

Page 274 of 292
Cellocator Wireless
Version
4.0.0.19
Date
March 24, 2014
Description
Section 3.2.4.9: added the "Satellite payload
counter management" command.
Section 3.6.12: Added a new bit for Nano
sensors field-ID of the modular platform
manifest.
Section 2.6.16: updated modular platform
manifest with Nano values. And fixed some
links.
Section 2.6.13: updated the Cinterion BGS2W modem of the Nano.
Section 2.2.3.10: Added to the STR list of
the Nano, the check-in event, open and close
door/window.
Section 2.2.3.11: Fixed the shifts in the table
of TR supported by Nano.
Added.
Added new TR=165 for "Nano location report
in POD mode".
Section 3.2.49: Added new command of
0x19 = "Nano wakeup and status request".
Section 4.4.6.2: The compressed
acceleration representation was corrected.
Section 2.2.3.10: Added TR 160 (CFE Event)
Specific reasons code
Section 2.2.3.11: Added TR 160: CFE Event
Section 2.2.3.6 : New Hw ID scheme : Units
Hardware and Firmware Versions
4.0.0.20
April 2, 2014
Section 1.1.1: 1.1.1 FW Version Applicability

Table: Update new FW Version IDs
General: Add prefixes "Inbound" and
"Outbound" to all the message headers.
Section 3.3: Added infrastructure for "FOTA"
command.
4.0.0.21
April 10, 2014
Section 1.1.1: 1.1.1 Fw Version Applicability

Table: Update new FW Version IDs
General: Add prefixes "Inbound" and
"Outbound" to all the message headers.
Section 3.3: Added infrastructure for "FOTA"
command.

Page 275 of 292
Cellocator Wireless
Version
4.0.0.22
Date
May 13, 2014
Description
Section 3.3: Added new command code for
PHSN. The command is infrastructure for the
PHSN end unit OTA control.
Section 2.2.3.6: Add CR300 Unit HW
Version. (was Missing)
Section 2.2.3.10: Updated Jamming
Detection Transmission Reason Specific
Reason ( STR 207)
4.0.0.23
June 10, 2014
Section 1.1.1: Add CelloTrack 41o to the FW

Version Applicability Table
Section 2.2.3.6: Update Hw Id table
4.0.0.24
August 6, 2014
Section 2.2.3.10: TR 46, Added note about

Dallas bytes state when Dallas key is not
authenticated.
Fixed some typos in the MCU part- number
and family name.
Section 2.6.16: Renamed the "Size of
Internal non-volatile memory" section in
modular platform manifest to "Size of
Program memory" and added new item of
"Size of Internal non-volatile memory" at ID
0x1A.
4.0.0.25
September 9,
2014
Section 2.2.3.10: Added free-fall event Multi

Sense.
Section 2.6.12: Added STM32L151 properties
to manifest.
Section 2.6.16: Field ID 0x18, delete the
value of the versions,
Section 3.3: Added new Inbound command
for force the CelloTrack T to Not Active
mode
Section 2.2.3.10: Added STR for TR 102.
Section 2.2.3.11: Added new TR (102) for
CelloTrack activation mode change
Section 4.2.2.25: Fix the message bytes
numbering.
Section 3.8.5.2: Module number 2 name is
Variable Dump List
Section 4.2.2.4:, 4.2.2.5: Add note: Note:
This filed will be set to 0 on Ignition On and
IPUP events.
Section 2.2.3.10: STR 207, Add description
for CelloTrack Radio Off early event.

Page 276 of 292
Cellocator Wireless
Date
Version
4.0.0.26
September 30,
2014
Description
Section 3.7.12: Update the platform manifest
request bit map with 2 new bits in byte 3: bit
1: Version Information Request, bit 2: Size
of internal non-volatile memory request.
Section 2.2.3.10: STR 207: Remove ref. to
CelloTrack Nano. Change the Early Radio
Off bit from 3 to 2 in the second table.
4.0.0.27
October 6,
2014
Section 3.6.3.2: Add comment about using

bits 1, 2 as inbound message length most
significant bits. (Only for Customer Project)
4.0.0.28
November 18,
Section 2.6.16: Updated the accurate

temperature sensor of the Nano to Atmel.
2014
Added the CBLE MAC address.

Section 2.6.14: Change 8 to 15 bytes in IMSI
4.1.0.0
November 30,
2014
Added new sections for CelloTrack-Nano and

MultiSense.
Moved the version history to an appendix at
the end of the document.
Corrected general formatting of the entire
doc.
4.1.0.1
December 17,
2014
Section 2.2.3.6: Omitted the REL number

from the Cinterion BGS2-W model.
Section 2.7.13: Added to modem's revision
table the Cinterion BGS2-W.REL3 (03.001).
Section 3.8.2: Updated that in type-11
outbound message, bytes 16-17 must be set
to 0x0000 in order to symbolizes Outgoing
message (while in incoming this bytes are
length thus 0).
Section 3.8.2: Updated that in type-11
inbound message, bytes 16-17 must be 0
(to symbolize inbound massage), the
meaning is that there should not be a
message without any modules.
4.1.1.0
December 24,
2014
After technical writer review and corrections.

Updated the word "nano" to be "Nano" all
over the doc.
Section 5.2: Added details about bit numbers
and nibbles. Added details about the lux
resolution.
Section 5.4: Added details about the lux
resolution.

Page 277 of 292
Cellocator Wireless
Version
Date
Description
4.1.1.1
December 30,
2014
Section 3.8.3: Added to general type-11

packet that when ACK packet is sent, the
numerator field carries the numerator of the
original message.
4.1.2.0
January 15,
2015
Technical Writer cleanup.
4.1.2.1
January 19,
2015
Changes for "Product tree - CANiQ variants

1st drop":
Section 2.7.16: Updated Field ID 0x19
according with "Product tree" definitions.
Section 2.2.3.6: Added the "Feature
package" instead of the 3 spare MSB bits.
Section 2.2.3.11: Added a footnote that In
Cello-CANiQ (product tree), this event is
used also for the 1 second GPS data
reporting.
Section 2.7.19: Updated the End of trip
report to include engine hours from engine
RPM.
Section 4.2.2.24: Updated the ABC
maneuver statistics to include the Delta
engine hours in this trip.
4.1.2.2
January 21,
2015
Changes for FW 32k release:

Section 3.6.3.2: Bit 1 in settings byte (15)
was changed to Forward SMS Message.
Section 2.2.3.10: Added TR 170 specific data
Section 2.2.3.11: Added TR 170 SMS
Delivery
4.1.2.3
January 27,
2015
Section 2.2.3.6: Unit HW IDs table was split

to 2 different tables, to match new HW ID
identification:
A table for legacy products (identified by

legacy HW ID)
A table for new products (identified by

Unit HW Version ID)
4.1.2.4
January 28,
2015
Section 2.2.3.6: Added CR300 (3G) variants

to the new products table
4.1.2.5
February 1,
2015
Section 2.2.3.6: Added CR300 new future

variant, with GE910 Quad V3 modem

Page 278 of 292
Cellocator Wireless
Version
Date
Description
4.1.2.6
February 1,
2015
Section 2.2.3.10: TR Specific Data table

borders were re-arranged (overflowed out of
the page right borders before)
4.1.2.7
February 1,
2015
Section 2.3: Type 3 was added to the title
4.1.2.8
February 2,
2015
Section 2.7.13: Updated modem revisions of

the Nano.
4.1.2.9
February 9,
2015
Section 2.2.3.6:
4.1.2.10
February 10,
2015
Section 3.4: Type 3 was corrected to Type

1 in the title
Changed Compact CAN TOB HW ID 199

(modem type 6 TELIT GE864,
automotive) to HW ID 103 (modem type
3 TELIT GE864, mute support)
Changed Compact CAN TOB HW ID 209

(modem type 6 TELIT GE864,
automotive) to HW ID 113 (modem type
3 TELIT GE864, mute support)
Section 2.2.3.6: changed CR300B (3G)

modem type names from UE910 NAR/EUR to
UE910 NAD/EUD
Section 3.2.4.1: corrected typo: M C G
S M C G P
4.1.2.11
February 16,
2015
Section 2.7.13: Added Modem Rev IDs for

Telit UE910-NAD/EUD with version 12.00.xx6
4.1.2.12
February 17,
2015
Section 2.2.3.6:
Changed Nano 20 variants product

names
Changed New CR300B variants product

names
Section 4.2.2.40:
Changed le of module (Byte 1) from 225

to 238
Added value indications (0,1,2) to Read,

Set and Response in control byte (Byte 2)
Added preset data (Byte 14 and on)
Section 2.7.13: Ellaborated exact modem

versions for Telit UE910-NAD/EUD
(12.00.516/416 respectively)

Page 279 of 292
Cellocator Wireless
Version
4.1.2.13
Date
February 18,
2015
Description
Section 4.2.2.40: Elaborated Trip Eco Score
Highway Speed data (Bytes 224-235)
Section 2.7.12: Added note for Cell-ID (not
supported for 3G variants)
Section 2.2.3.6:
4.1.2.14
March 5, 2015
Changed table title: Unit HW Version

ID HW ID
Deleted future products/variants

(Nano 10, Nano 20) from the new
products table
Fixed styles all over the doc.

Section 3.8.5: Added modules 40,41,42 of
the Nano to the type-11 general table.
Section 5.4: Removed the duplication of
modules 6, 7 and 8 and replaced them with
links.
4.1.2.15
4.1.2.16
March 8, 2015
March 15, 2015
Section 2.2.3.6: Changed names for new

CR300B 3G variants: "CR300B 3G NA/EU
GNSS" "CR300B 3G NA/EU" (omitted
GNSS).
Section 2.7.16: Added enumeration

(0x04) for CR300B 3G processor
(STM32F101RDT6), in the Processor
family identifier.
Section 3.8.5.18: Added the Nano related

commands (257-259) to the general
commands table.
Section 3.3: Added the word

"(Infrastructure)" to the command 0x19
for waking-up the Nano (in POD future
mode).
Section 5.6.7: Corrected the name of the

last byte of command 258 to "Reserved".
4.1.2.17
March 18, 2015
Section 2.2.3.11: Added TR 223 (CPIN Error

Event)
4.1.2.18
March 18, 2015
Section 2.7.13: Added in Modem revision ID

value of 81 for Telit GE864 QUAD-V2 , FW
version 10.01.521
4.1.2.19
March 24, 2015
Section 2.7.3: Added new processor (0x06 STM32F101RDT6)
4.1.2.20
March 24, 2015
Section 2.2.3.6: Added new product HW ID

(116 Cello-CaniQ (2G) Car Sharing)

Page 280 of 292
Cellocator Wireless
Version
4.1.2.21
Date
March 25, 2015
Description
Section 2.7.3:
Added processor family identifier:


0x07 STM32F101RDT6
Added Hardware interface and

peripherals identifier:
Section 2.7.13:

0x07 STM32F101RDT6
4.1.2.22
March 26, 2015
Section 2.7.3:

0x08 STM32F103RFT6
Section 2.7.13:

0x08 STM32F103RFT6
Changed Modems revisions:

ID 53 (Cinterion EHS5-E):
03.001_arn00.000.07
03.001_arn00.000.14
ID 54 (Cinterion EHS5-US):
03.001_arn00.000.07
03.001_arn00.000.14
Section 2.7.16:

0x05 STM32F103RFT6

Page 281 of 292
Cellocator Wireless
Version
4.1.2.23
Date
March 31, 2015
Description
Section 2.2.3.7:
Changed "Current GSM Operator (PLMN),

1st nibble" location in Byte 16: bits 4-7
bits 0-3
Changed "GPS Comm." location in Byte

16: bit 0 bit 7
Changed "Home/Roam Network" location

in Byte 16: bit 1 bit 6
Changed "Correct Time" location in Byte

16: bit 2 bit 5
Changed "Source of Speed" location in

Byte 16: bit 3 bit 4
Section 2.2.3.8: Changed Current GSM

Operator 1st nibble location: Byte 16 (4
MSbits, 1 nibble) Byte 16 (4 LSbits, 1
nibble)
4.1.2.24
April 1, 2015
Section 2.7.3:
Added Processor family identifier:

0x09 STM32F429VGT6

0x07 100 pin micro, peripherals as per
family
Section 2.7.13:

0x09 STM32F429VGT6

0x07 100 pin micro, peripherals as per
family
Section 2.7.16:

0x05 STM32F103RFT6
4.1.3.0
April 8, 2015
Section 3.2.2: Updated that bytes 21-25

contains a compressed date and time.

Page 282 of 292
Cellocator Wireless
Version
4.1.3.1
Date
April 15, 2015
Description
Section 2.7.3:
Changed Processor family identifier 0x09

(STM32F429VGT6 -> STM32F429IGH6)
Changed Hardware interface and

peripherals identifier 0x07 (100 pin ->
176 pin)
Section 2.7.13:
Changed Processor family identifier 0x09

Changed Hardware interface and

peripherals identifier 0x07 (100 pin ->
176 pin)
Section 2.7.16:
Changed processor family identifier 0x06
4.1.3.2
April 16, 2015
Section 2.7.13: Added Modem FW version ID

(82) for Telit UE910-NAR (SSL)
4.1.4.0
April 28, 2015
Split Type 11 message to Outbound (added

section 2.8) and Inbound.
Added elaboration for type 11 modules.
Section 2.2.3.11: Changed TR 252 to be
relevant for entire CelloTrack family and
added Cello-D.
Section 2.2.3.10: Changed TR 252 to be
relevant for entire CelloTrack family and
added Cello-D.
4.1.4.1
April 29, 2015
Section 2.2.3.10: Changed enumeration for

TR 222 STRs (1, 2, 3 0, 1, 2)
4.1.4.2
May 3, 2015
Section 2.7.14: Added Modem revision ID

(83) for Telit GE864 QUAD-V2 new version
(10.01.522)
4.1.4.3
May 28, 2015
Section 2.7.14: Reverted Shay's last change:

Modem revision ID 81 is for Telit GE864
QUAD-V2 "PointerCept" version (10.01.522).
Version 10.01.521 is unofficial and unused
therefore shouldnt allocate an ID for it.
Section 2.2.3.10: Updated Tx reason 222 to
the name "PointerCept". Added Tx reason
223 for "CPIN error event". Added
PointerCept to the Tilt-tamper STR.

Page 283 of 292
Cellocator Wireless
Version
4.1.4.4
Date
June 2, 2015
Description
Section 2.7.17: Added GPS type: 09 Telit
Modified JF2 (CelloTrack T)
Section 2.2.3.10:
Added STR to TR 158 (Tamper active

event): 3 - Cello-D enclosure opened
Added STR to TR 159 (Tamper inactive

event): 3 - Cello-D enclosure closed
4.1.4.5
June 23, 2015
Section 2.7.17: Added GPS type: 10 NMEA

(CelloTrack T)
4.1.4.6
June 28, 2015
Section 4: Fixed Excessive RPM applicability

for Cello-IQ40 from "Events only" to "" (not
supported)
4.1.4.7
June 30, 2015
Section 2.7.17: Deleted the "ST" from "0x01

ST LIS331DL" in the Accelerometer
identifier table
4.1.4.8
July 8, 2015
Section 2.2.3.6: Added the new variant of

Nano 3G worldwide (HW ID = 122).
Section 2.2.3.10: Some minor corrections in
TR=102. Canceled the STR=1 of
TR=158/159 due to removal of compass
from Nano. Canceled the STR=8 of TR=164
due to removal of compass from Nano.
Section 2.2.3.11: Added details in case of
Nano in TR 81,82,88,89. Added
TR=102,158,159 to be valid for the Nano as
well.
Section 2.7.14: Updated Nano modem EHS6
to be EHS6A and added its current FW
version.
Section 2.7.17: Added enumerator of
compass not installed on the board of Nano.
Updated the PN of the Temperature sensor.
Sections 5.2 and 5.4: Removed all compass
related data due to removal of compass from
Nano board.
4.1.4.9
July 12, 2015
Section 2.2.3.20/21: Fixed "Enable Tide GPS

filter" parameter name to "Enable Tight GPS
PMODE filter"

Page 284 of 292
Cellocator Wireless
Version
4.1.5.0
Date
July 16, 2015
Description
Section 5: Changed all over that section that
all Nano related Type-11 modules will be now
0-based instead of 1-based, to keep
uniformity with the rest of the document.
Section 2.7.14: Added that at Byte 46 in the
Nano, from FW 34d and on, the value is
always 0.
Section 2.7.17: Added that " In CR300/B
from FW version 43c and later, and in
CelloTrack Nano from FW 34d and later, in
order to prevent the need of upgrading FW
with each modem version upgrade, the
following mechanism is implemented: In this
filed ID, the unit sends the FW version string
received from the modem. (The
corresponding length byte is set
accordingly)."
Sections 5.2 & 5.4: Added to the protocol 2
position bits (classical installations of Nano).
Section 5.7.2: Added the message for tag
mode.
4.1.5.1
July 21, 2015
Section 2.7.17: Added to the 3 timestamps

that "Note that byte 0 is transmitted first,
then byte 1 etc.
On the display it's shown as d/m/y h:m:s".
4.1.5.2
July 28, 2015
Section 5.6.3: Corrected that the "Impact/

Free-fall acceleration RMS value" in type-11
module 28 is just in 250g units (removed the
sqrt operation).
4.1.5.3
August 2, 2015
Section 5.6: Corrected some typos (lengths)

and minor wording.

Page 285 of 292
Cellocator Wireless
Version
4.1.5.4
Date
August 3, 2015
Description
Section 3.6.1:
Fixed type 5 message length from 217 to

528 bytes
Fixed Data Length to 1 byte + 2 bits of

Settings Byte
Fixed data to forward size from 199 to

512 bytes
Section 3.6.2:
Fixed data to forward size from 199 to

512 bytes
Added "(bits 0-7)" to Data Length
Section 3.6.3.2: Re-allocated bits 1, 2 of

Settings Byte to Data Length extension (bits
8, 9)
Section 3.6.3.3: Fixed data to forward size
from 199 to 512 bytes
Section 2.6: Added detailing for the message
length (562 = 512 + 2 + 48 bytes)
4.1.5.5
August 4, 2015
Section 2.7.4:
Fixed "Reprogramming facility identifier"

field (bytes 29-30) value from 0x01 to
variant dependent
Fixed "Size of program memory" (bytes

19-20) to 1024 bytes units instead of
1024 words units
Section 2.7.14:
4.1.5.6
August 6, 2015
Fixed "Reprogramming facility identifier"

field (bytes 29-30) value from 0x01 to
variant dependent
Fixed "Size of program memory" (bytes

19-20) to 1024 bytes units instead of
1024 words units
Section 2.2.3.13: Added the input signal of

the Nano "GP input1 (Pigtail)"

Page 286 of 292
Cellocator Wireless
Version
4.1.5.7
Date
August 10,
2015
Description
Section 3.6.1:
Fixed type 5 message length from 528 to

271 bytes (in regular forwarding mode)
or 534 bytes (in transparent mode)
Added elaboration for Data Length: the 2

bits extension is applicable for
transparent mode only
Fixed data to forward size from up to 512

to up to 255 bytes (in regular forwarding
mode) or 518 bytes (in transparent
mode)
Section 3.6.2:
Fixed data to forward size from up to 512

to up to 255 bytes (in regular forwarding
mode) or 518 bytes (in transparent
mode)
Added "(bits 0-7)" to Data Length
Section 3.6.3.2: Added elaboration for bits 1,

2 of Settings Byte (Extension is applicable for
transparent mode only)
Section 3.6.3.3: Fixed data to forward size
from up to 512 to up to up to 255 bytes (in
regular forwarding mode) or 518 bytes (in
transparent mode)

Page 287 of 292
Cellocator Wireless
Version
4.1.5.8
Date
August 13,
2015
Description
Section 2.8.5: Added Number of DTCs
received by Mode 3/7 to bytes 3/4 in type 11
module 1 (DTC Event)
Section 2.8.4: Marked type 11 module 35 as
occupied for Inbound module
Forwarded CAN Query
Section 3.8.11: Added type 11 module 35 Forwarded CAN Query
Outbound module
Section 2.8.14: Added type 11 module 12
Section 3.3: Added type 0 command 0x1F
CAN-GPS Speed Calibration Command
Section 2.2.3.11: Added TR 167 CAN-GPS
Speed Calibration Mode
Section 2.2.3.10: Added TR 167 (CAN-GPS
Speed Calibration Mode) STRs
4.1.6.0
August 16,
2015
Section 2.7.14: Split Modem's firmware

revision field (bytes 45-47) behavior to FW
33x and later/older
Section 2.7.17: Split Modem firmware field
behavior to FW 33x and later/older
4.1.6.1
August 24,
2015
Section 2.7.4: Added "0xA

STM32F103VET7" (PointerCept BS MCU) to
Processor family identifier field (byte 17)
Section 2.7.14: Added "0xA
Processor family identifier field (byte 17)
Section 2.7.17: Added "0x07
Processor family identifier field (field 00)
4.1.6.2
August 27,
2015
Section 2.2.3.6: Added PointerCept Base

Station HW ID to new HW IDs table
4.1.6.3
September 8,
2015
Section 2.2.3.10: At TR=69 corrected the

wording of the STRs. (changed "movement"
"GPS").

Page 288 of 292
Cellocator Wireless
Version
4.1.6.4
Date
September 17,
2015
Description
Section 5.2: Fixed some minor wording and
added the new bit 1 in byte 35 for "Nano
temperature readings are Invalid/Valid".
Section 5.4: Fixed some minor wording and
added the new bit 5 in byte 15 for "Nano
temperature readings are Invalid/Valid".
4.1.6.5
September 24,
2015
Section 2.7.17: In GPS Type field (0xC),

changed NMEA (CelloTrack T) enumeration
from 10 (dec) to 16 (dec)
4.1.6.6
September 24,
2015
Sections 5.7.2.1-5.7.2.3: Added details

about parsing packets "0x81" and "0x83"
related to guest and tag modes of CelloTrack
Nano.
4.1.6.7
October 7,
2015
Section 2.7.4: Fixed "Size of external nonvolatile memory" (bytes 25-26) to 1024
bytes units instead of 1024 words units
Section 2.7.14: Fixed "Size of external nonvolatile memory" (bytes 25-26) to 1024
bytes units instead of 1024 words units
4.1.6.8
October 11,
2015
Section 2.2.3.10: Canceled from STR table of

the Nano (TR=164) the numbers 6 & 7 which
were related to the removed compass chip.
Section 2.7.14: Added comments about Nano
FW versions 34c and 34d.
4.1.6.9
October 13,
2015
Section 2.2.3.14:
For CelloTrack T, removed coefficient for

Bat. NTC, and added remark regarding
conversion on FW side
For CelloTrack T, added a note regarding

available parameters for non-power
variants
4.1.6.10
October 20,
2015
Section 2.2.3.10: Added STR 2 (GPS AHR) to

TR 200 (AHR)
4.1.7.0
October 25,
2015
Section 2.7.4: Added SPI N25Q NVM (0x04)

to External non-volatile memory type (byte
27) in FW platform manifest
Section 2.7.14: Added SPI N25Q NVM (0x04)
to External non-volatile memory type (byte
27) in maintenance platform manifest

Page 289 of 292
Cellocator Wireless
Version
4.1.7.1
Date
November 1,
2015
Description
Section 2.7.3: Added sub data type 0xC (3G
Cell ID data)
Section 2.7.13:
Fixed cell ID parameters addresses from

202/204, bits 6 and 7 to 201/203, bits 3
and 4
Changed footnote (11) from "Not

supported for 3G variants" to "Supported
for 2G variants only"
Added section 2.7.16 for 3G Cell ID Data

4.1.7.2
November 5,
2015
Section 5.3: mentioned that the legacy

emergency queue has a size of 5 events.
4.1.7.3
November 15,
2015
Section 2.7.18: Changed IMSI/IMEI (field

0x16) size from 15 bytes to 8 bytes.
4.1.7.4
November 16,
2015
Section 2.7.23: Added coefficient (0.0625)

indication to 1-Wire temperature sensors
measurements.
4.1.7.5
November 24,
2015
Section 2.2.3.14: In CelloTrack Nano

changed the default analog inputs order.
Crossed between the battery and USB input
power in order to be consistent with
CelloTrack.
4.1.7.6
December 2,
2015
Section 2.2.3.10: Added STR 8 (Car Sharing

only: No-Show-Up Glancing) to TR 252
(COM-Location Glancing)
4.1.7.7
December 7,
2015
Section 2.2.3.13: Added "External Power

Connected" flag to type 0, Fourth I/O Status
byte, bit 4 (for CelloTrack T Power)
4.1.7.8
December 10,
2015
Section 2.2.3.4: Updated in Nano analog

inputs the resolutions, format and offsets of
each nano_source.
Sections 5.6.8: Renamed start/end bit to be
"Retransmission indication bit".
4.1.7.9
December 20,
2015
Section 4.2.2.28: Fixed module length from

35 to 14
Section 4.2.2.46:
Added "Down", "Up" enumerations (9,

10) to crash orientation (bits 0-3) in
crash information byte (41)
Added "Parking" (bit 5) to crash

information byte (41)

Page 290 of 292
Cellocator Wireless
Version
4.1.7.10
Date
27/12/2015
Description
Section 2.7.16:
Fixed sub-data length to 0x35
Added zero padding section (in case of

logged event)
Section 2.7.13: Revised the remark for the

zero padding section:
4.1.7.11
28/12/2015
Added "(in case of logged event)"
Fixed zero padding completion from 56 to

55 bytes
Section 2.7.3:
Changed sub-data type 0x1B function to

"Reserved"
Allocated sub-data type 0x1C CDMA Cell

ID data
Added section 2.7.24 for CDMA Cell ID Data

4.1.7.12
29/12/2015
Section 2.7.3:
Added "Obsolete" footnote for

Accelerometer Data module (0x05)
Added F0 as "Reserved - Infrastructure"
4.1.7.13
4/1/2016
Section 2.7.23: Fixed Sub-Data length from

0d16 to 0d26
4.1.7.14
4/1/2016
Section 2.2.3.6: Added Nano 10 and Nano 10

3G to the table of HW ID.
4.1.7.15
11/1/2016
Section 2.7.21:
4.1.7.16
2/2/2016
Fixed wrong byte numbers, starting from

Longitude field
Fixed total length to 55
Fixed module 0x16 length to 26
Moved "(100 ml resolution)" from Current

Odometer Count to Current Trip Fuel
Consumption field
Added 5 spare bytes
Section 4.2.2.41: Fixed maneuver duration

resolution (byte 32) from 0.2 to 1 sec/bit

Page 291 of 292
Cellocator Wireless
Version
4.1.8.0
Date
7/2/2016
Description
Section 2.7.13: For active transmission of
type 9 sub-data 0x09, added parameters on
addresses 201/203, bits 0, 1
Section 2.7.16: For active transmission of
type 9 sub-data 0x0C, added parameters on
addresses 201/203, bits 0, 1

Page 292 of 292

EVENTOS Cellocator Wireless Communication Protocol

Diunggah oleh

Informasi Dokumen

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

EVENTOS Cellocator Wireless Communication Protocol

Diunggah oleh

Hak Cipta:

Format Tersedia

Cellocator Wireless

Proprietary and Confidential

Copyright 2015 by Pointer Telocation, Ltd.

Warranty Exceptions and Disclaimers

Cellocator Wireless Communication Protocol

Cellocator Wireless Communication Protocol

About this Document .................................................................................................... 8

FW Version Applicability Table ........................................................................................ 8

Telemetry Channel (Outbound Messages) ............................................................... 10

Outbound: Status/Location Message Definition = Message Type 0 .....................................10

2.2.1 Byte-Aligned Table ......................................................................................................10

Outbound: Configuration (Programming) Data Message Definition = Message Type 3 ..........54

2.3.1 Message Ingredients ....................................................................................................54

The Container .............................................................................................................55

2.5.2 Data Path Chart ..........................................................................................................57

2.6.1 Message Ingredients ....................................................................................................60

Outbound: Modular Message = Message Type 9 ..............................................................63

Message Ingredients ....................................................................................................63

Cellocator Wireless Communication Protocol

Modular Platform Manifest (Sub-Data 0x12) ...................................................91

Outbound: Modular Message = Message Type 11 .......................................................... 111

Message Ingredients .................................................................................................. 111

Command Channel (Inbound Messages) ............................................................... 126

Generic Command Message Definition ......................................................................... 126

General Details ......................................................................................................... 126

Inbound: Generic Command-Message type 0 ................................................................ 129

Inbound: Programming Command Definition = Message Type 1 ...................................... 134

3.4.1 Message Ingredients .................................................................................................. 134

Inbound: Generic Acknowledge Message Definition = Message Type 4 ............................. 135

3.5.1 General Details ......................................................................................................... 135

Inbound: Forward Data Command Definition = Message Type 5 ...................................... 137

3.6.1 Message Ingredients .................................................................................................. 137

Inbound: Modular Message Request Definition = Message Type 9 ................................... 139

Message Ingredients .................................................................................................. 139

Inbound: Modular Message = Message type 11 ............................................................. 152

Message Ingredients .................................................................................................. 152

CSA OTA Protocol .................................................................................................. 161

CSA Protocol Frame ................................................................................................... 163

Modules Description .................................................................................................. 171

4.2.1 Modules Summary Table ............................................................................................ 171

FTP/TFTP Files Structure ............................................................................................ 212

Raw Data Files .......................................................................................................... 212

File Structure Examples ............................................................................................. 223

4.4.1 Trip File Detailed Structure Example ............................................................................ 223

CelloTrack Nano Protocol ...................................................................................... 233

Nano-related Content of Multi-Purpose Bytes (3338) in Type-0 Messages ...................... 234

Changes in Emergency Queue ..................................................................................... 235

Type-11 Message Structures ....................................................................................... 236

Legacy (Type-0) Encapsulated in Type-11 New Module .................................................. 239

Nano Features Related Messages ................................................................................ 240

General Definitions and Data Structures ....................................................................... 240

MultiSense Features Related Messages ........................................................................ 255

MultiSense Provisioning Event ..................................................................................... 255

Cellocator Wireless Communication Protocol

About this Document

FW Version Applicability Table

-Introduction, 2 and 3-Telemetry channel outbound and

-Introduction, 2 and 3-Telemetry

channel outbound and

channel outbound and

channel outbound and

channel outbound and

channel outbound and

channel outbound and