GPS Trackers

ABT110

Protocol

ABT110 Tracker Protocol

Revision 1.04 — Jun 15, 2026 — JAM LTE/GSM signal params, external distance alarm

ABT110 Tracker Protocol R1.04 defines the data stream format, configuration commands, and message structures used between the ABT110 asset tracker and backend server over LTE Cat-1 / EGPRS. The device supports light, temperature, humidity, distance, and RF433 sensing. Use the sections below for a structured overview, or open the full PDF for complete command parameters and field definitions.

Revision history

Revision	Date	Description
1.01	2025-07-04	Initial release
1.02	2026-01-13	RTO realtime positioning; SOS button mode in AT@GCS; SOS alarm in regular report event
1.03	2026-01-31	AT@SSI second server; Connection Life in AT@SIS; BLE distance in AT@BSS; AT@EDS external distance alarm (event 42)
1.04	2026-06-15	JAM duration range extended; LTE (RSRP/RSRQ/RSSI) and GSM (MINCH/SINR/RSSI) params in AT@JAM

Data stream format

Communication includes upstream (device → server) and downstream (server → device) data streams over the cellular network. Upstream carries responses to downlink commands, heartbeat packets, and unsolicited reports. Downstream carries configuration, query commands, and responses to uplink messages.

Frame types

Direction	Encoding	Frame	Usage
Downstream	Printable ASCII	Configuration Command	Configure terminal parameters (AT@…=)
Downstream	Printable ASCII	Query Command	Query current parameters (AT@…?)
Downstream	Printable ASCII	+SACK	Server acknowledgement for +RPT messages
Downstream	Printable ASCII	+SHBD	Server response to +HBD heartbeat
Upstream	Printable ASCII	+QRY	Terminal response to a query command
Upstream	Printable ASCII	+HBD	Periodic heartbeat to maintain TCP/UDP connectivity
Upstream	Printable ASCII	+ACK / +NACK	Acknowledgement or rejection of configuration commands
Upstream	Hexadecimal	+RPT / -RPT	Real-time and buffered report messages

All upstream and downstream frames end with the character "#" (0x23). In printable ASCII frames, "," separates adjacent parameters. Hexadecimal frames have no parameter separator.

Configuration commands

Configuration commands use the format AT@<KEY>=<password>,<parameters>,…,<serial># . Each command is protected by a password (default at) and ends with a 4-digit hexadecimal serial number and "#".

Example — main server settings:

AT@SIS=at,0,1,255.255.255.255,12345,,,0,0001#

Network commands

Code	Command	Description
SIS	AT@SIS=	Main server IP, port, report mode (0 Stop / 1 TCP / 2 UDP / 3 MQTT), buffer, SACK enable, heartbeat, PDP/TLS, Connection Life
SSI	AT@SSI=	Second server settings (same parameters as SIS)
NIS	AT@NIS=	APN, credentials, network scan mode, Search No Signal Cover
MQT	AT@MQT=	MQTT client ID, topics, QoS, keep-alive (main or second server)
TCR	AT@TCR=	TLS certificate remote download (HTTP)
TCL	AT@TCL=	TLS certificate local download

General commands

Code	Command	Description
GMT	AT@GMT=	Greenwich Mean Time / time zone setting
GCS	AT@GCS=	Global configuration: Data Mask, Event Data Mask, LED mode, GNSS/AGPS, odometer, hour meter, power saving, button working mode (incl. SOS-only mode)
RRS	AT@RRS=	Regular GNSS report: mode, IGN/IGF intervals, corner angle, long standby wake-up
RTO	AT@RTO=	Real-time operation: reboot, power off, factory reset, realtime positioning, battery charging data (+BCD), satellite info
PCL	AT@PCL=	Preset command list (up to 32 commands)
ECL	AT@ECL=	Event-driven command list binding events to preset commands

Alarm commands

Code	Command	Description
MOV	AT@MOV=	Movement alarm detection
SPD	AT@SPD=	Speed alarm threshold and duration
GEO	AT@GEO=	Circular geo-fence settings (up to 32 zones)
JAM	AT@JAM=	Jamming alarm (LTE RSRP/RSRQ/RSSI and GSM MINCH/SINR/RSSI)
RFS	AT@RFS=	RF433 alarm: PA power, channel (433 MHz band), transmission interval, trigger mask
LAS	AT@LAS=	Front and rear light detection alarms with sensitivity, duration, and report interval
BTA	AT@BTA=	Built-in temperature alarm thresholds and duration

I/O, BLE, OTA, and debug

Category	Code	Description
IO	IGN	Ignition and virtual ignition settings
BLE	BSS	BLE scan settings; distance I/O in scan data; temperature, humidity, door state
BLE	ETS	External temperature sensors (BLE)
BLE	EHS	External humidity sensors (BLE)
BLE	EDS	External distance sensors (BLE) alarm thresholds
OTA	UPF	Firmware upgrade over the air
OTA	BMS	Device management system: BMS server (TCP), report interval, +BMR Data Mask
DEBUG	DBG	OTA debug log server and log mask

Report mode (SIS/SSI): 0 = Stop, 1 = TCP, 2 = UDP, 3 = MQTT. BMS report mode: 0 = Stop, 1 = TCP. Buffer mode: 0 = disabled, 1 = low priority, 2 = high priority.

Query commands

Query commands retrieve the current working parameters of the terminal. They use printable ASCII with comma-separated fields:

AT@<KEY>?<password>,,<serial>#

AT@SIS?at,,# — query main server settings
AT@SSI?at,,# — query second server settings
AT@NIS?at,,# — query network (APN) settings
AT@GMT?at,,# — query time settings
AT@GCS?at,,# — query global configuration
AT@RRS?at,,# — query regular report settings
AT@GEO?at,,# — query geo-fence settings

When sent by the backend server, parameters are returned to the server. When sent by SMS, parameters are returned via SMS.

Message format

Report, buffer, and heartbeat messages share a common frame structure with header, data, and tail zones:

Zone	Fields	Encoding
Header	Head (5 B) + Length (2 B) + IMEI (8 B) + Device ID (1 B)	ASCII / HEX / HEX / HEX
Data	Variable payload + G-time (7 B)	HEX or ASCII
Tail	Serial number (2 B) + Tail "#" (1 B)	HEX / ASCII

+RPT / -RPT, +BMR / -BMR, +HBD — data zone encoded in hexadecimal (big-endian for multi-byte values)
+SACK / +SHBD — fully ASCII encoded
+ACK, +QRY, +ALL, +QNI, +VER, +GSV, +LSV, +BSV, +GAV, +BCD — data zone in ASCII with comma separators

Report messages (+RPT / -RPT)

+RPT frames are real-time reports generated and sent within 3 minutes. -RPT frames are historical reports stored in the device buffer and sent when connectivity is restored.

All event-driven and regular reports share the same +RPT/-RPT hex-encoded format. The Data Mask and Event Data Mask in AT@GCS control which sensor and status zones are included.

Key +RPT Data Mask bits (AT@GCS)

Bit	Field	Content
0	Multi-packet	Auto-enabled when message exceeds 256 bytes
1	Network type	Cellular network type
2	Battery	Voltage (mV) and level (%)
3	GNSS information	Fix type, HDOP, speed, azimuth, altitude, lat/lon, UTC time, satellite counts
4	Cell information	MCC, MNC, LAC, Cell ID, CSQ
5	Neighboring cell	Adjacent cell information
7	Upgrade information	Firmware upgrade status
8	Event data	Ignition, motion, mileage, GEO status, hour meter, front/rear light, built-in temp, RF433, TLS
19	BLE information	BLE scan results, distance, temp/humidity sensors

Event types

Type	Event
0	Terminal power
1	Regular report (incl. RTO position request, SOS button alarm)
2	Moving
3	Battery alarm
8	Light alarm
9	Built-in temperature alarm
11	Upgrade firmware
12	External temperature alarm
13	Ignition
16	Over speed alarm
21	Geo-fence alarm
29	PDP alarm
30	BLE common info
31	External humidity alarm
32	Jamming alarm
35	TLS certificate download
36	RF433 alarm
42	External distance alarm

The full PDF lists every event state, Event Data Mask bit, sensor field, and byte length with value ranges.

Buffer messages (+BMR / -BMR)

+BMR frames are real-time BMS reports. -BMR frames are buffered BMS reports sent when connectivity is restored. Configure via AT@BMS.

Parameter	Description
Report Mode	0 = Stop, 1 = TCP
Buffer Mode	0 = disabled, 1 = low priority, 2 = high priority
BMS Server IP / Port	Device management server address
Connection Life	5–300 seconds TCP keep-alive
Report Interval	1–2880 minutes
BMR Data Mask	Battery level, config version, IGN state, GNSS info, SIM info, module version

Heartbeat and acknowledgement

Frame	Direction	Description
+HBD	Device → server	Periodic heartbeat when report mode is TCP or UDP (interval set in AT@SIS)
+SHBD	Server → device	Server response to +HBD
+ACK	Device → server	Confirms a valid configuration command was received
+NACK	Device → server	Rejects an illegal configuration command
+SACK	Server → device	Server acknowledgement when SACK Enable is set

Command query responses

Frame	Description
+QRY	Response to a single query command
+ALL	Bulk response with all configured parameters
+QNI	Network information (APN, IMSI, ICCID, CSQ, cell ID)
+VER	Firmware and hardware version information
+GSV	GPS satellite visibility
+LSV	GLONASS satellite values
+BSV	BEIDOU satellite values
+GAV	GALILEO satellite values
+BCD	Battery charging data — current and voltage (requested via AT@RTO sub-command 18)

Terms and abbreviations

Term	Meaning
ACK	Acknowledgement
AGPS	Assisted Global Positioning System
APN	Access Point Name
BCD	Battery charging data message
BLE	Bluetooth Low Energy
EDS	External Distance Setting
GNSS	Global Navigation Satellite System
IMEI	International Mobile Equipment Identity
IoT	Internet of Things
MQTT	Message Queuing Telemetry Transport
RF433	433 MHz radio frequency module
RFS	RF433 alarm settings
RPT	Report message
SACK	Server acknowledgement
SOS	Emergency button alarm
TCP / UDP	Transmission Control / User Datagram Protocol
TLS	Transport Layer Security
UTC	Coordinated Universal Time

In this document, "terminal", "device", and "equipment" refer to the ABT110 asset tracker unless otherwise specified.

ABT110 — Protocol

Download PDF Open in new tab

v1.04 · 2026-06-15 · Release

Page 1 of 75

If the preview does not load, use Download or Open in new tab.