AVT130 / AVT131

GPS Trackers

AVT130 / AVT131

RS232 Protocol

AVT130/AVT131 RS232 Tracker Protocol

Revision 2.02 — Jun 23, 2026 — BLE BBS/TRB transparent transmission, extended +DFI, tachograph DDD via +LDP

AVT130/AVT131 RS232 Tracker Protocol R2.02 defines the data stream format, configuration commands, and message structures used between the AVT130/AVT131 LTE Cat-1/EGPRS trackers and backend server. These trailer trackers support UART/RS232 transparent transmission, BLE accessories, and long standby battery operation. Use the sections below for a structured overview, or open the full PDF for complete command parameters and field definitions.

Revision history

RevisionDateDescription
1.012024-01-30Initial release
1.022024-12-25AT@PCL/ECL; UART transparent mode in AT@URT; AT@TRS; delta AIS in AT@DAM; output alarm and new +RPT event types
1.032025-03-09Driver ID whitelist up to 1024 entries in AT@DRV
1.042025-03-19AT@BSS BLE scan; AT@ETS/EHS external sensors; external humidity event; PDP Enable in AT@SIS
1.052025-06-10AT@JAM jamming detection; network module OTA in AT@UPF; jamming alarm event (32)
1.062025-07-08Module version in +BMR; Apache FMA1000 thermograph type in AT@URT
1.072025-08-07Second server SSI; TLS (TCR/TCL); MQTT (MQT); Resend Time No SACK in AT@SIS
1.082025-09-24AT@PEO polygon fence; GNSS timeout; BLE relay and iBeacon settings
2.012026-01-12AT@GGF geo-fence GNSS filter; GNSS spoofing alarm; extended BLE features
2.022026-06-23Latest release — PEO events, +LDP large data packets, +DFI device file info

Data stream format

Communication includes upstream (device → server) and downstream (server → device) data streams over the cellular network. Upstream carries responses to downlink commands, heartbeat packets, and unsolicited reports. Downstream carries configuration, query commands, and responses to uplink messages.

Frame types

DirectionEncodingFrameUsage
DownstreamPrintable ASCIIConfiguration CommandConfigure terminal parameters (AT@…=)
DownstreamPrintable ASCIIQuery CommandQuery current parameters (AT@…?)
DownstreamPrintable ASCII+SACKServer acknowledgement for +RPT messages
DownstreamPrintable ASCII+SHBDServer response to +HBD heartbeat
UpstreamPrintable ASCII+QRYTerminal response to a query command
UpstreamPrintable ASCII+HBDPeriodic heartbeat to maintain TCP/UDP connectivity
UpstreamPrintable ASCII+ACK / +NACKAcknowledgement or rejection of configuration commands
UpstreamHexadecimal+RPT / -RPTReal-time and buffered report messages
All upstream and downstream frames end with the character "#" (0x23). In printable ASCII frames, "," separates adjacent parameters. Hexadecimal frames have no parameter separator.

Configuration commands

Configuration commands use the format AT@<KEY>=<password>,<parameters>,…,<serial># . Each command is protected by a password (default at) and ends with a 4-digit hexadecimal serial number and "#".

Example — main server settings:

AT@SIS=at,0,1,255.255.255.255,12345,,,0,0001#

Network commands

CodeCommandDescription
SISAT@SIS=Main server IP, port, report mode (0 Stop / 1 TCP / 2 UDP / 3 MQTT), buffer, SACK enable, heartbeat, PDP/TLS, message filter, Resend Time No SACK
SSIAT@SSI=Second server settings (same parameters as SIS)
NISAT@NIS=APN, credentials, network scan mode, Search No Signal Cover
MQTAT@MQT=MQTT client ID, topics, QoS, keep-alive (main or second server)
TCRAT@TCR=TLS certificate remote download (HTTP)
TCLAT@TCL=TLS certificate local download
FTPAT@FTP=FTP server settings for tachograph DDD and diagnostic file upload

General commands

CodeCommandDescription
GMTAT@GMT=Greenwich Mean Time / time zone setting
GCSAT@GCS=Global configuration: Data Mask (incl. BLE, RS485/RS232 accessory masks), Event Data Mask (incl. PEO status bits 21/24, CAN sync bit 25), LED, GNSS/AGPS, odometer, hour meter, GNSS timeout
RRSAT@RRS=Regular GNSS report: mode, IGN/IGF intervals, corner angle, long standby wake-up
RTOAT@RTO=Real-time operation: reboot, power off, factory reset, realtime positioning, CAN module ops, +DFI, +CVS, +CMI, report mode
PCLAT@PCL=Preset command list (up to 32 commands)
ECLAT@ECL=Event-driven command list with ECL Trigger Report
GGFAT@GGF=Geo-fence GNSS filter and spoofing detection settings

Alarm commands

CodeCommandDescription
MOVAT@MOV=Movement alarm with Motion Event Report
TOWAT@TOW=Towing (TOW) alarm detection
SPDAT@SPD=Speed alarm threshold and duration
GEOAT@GEO=Circular geo-fence settings (up to 32 zones)
PEOAT@PEO=Polygon fence settings (up to 50 zones)
HBSAT@HBS=Harsh behavior (driving style) with trigger interval
CRAAT@CRA=Crash detection with crash debounce
JAMAT@JAM=Jamming alarm (LTE and GSM signal thresholds)
TASAT@TAS=Tilt alarm detection

I/O commands

CodeCommandDescription
IGNAT@IGN=Ignition and virtual ignition; Ignition On limit outputs mask, GNSS speed limit, debounce
DAMAT@DAM=Digital and analog input multiplexing (incl. delta AIS)
OUTAT@OUT=Digital output settings
AOSAT@AOS=Alarm output mapping and trigger masks (incl. jamming trigger)

1-Wire and UART commands

CodeCommandDescription
WASAT@WAS=1-Wire application settings
WOSAT@WOS=1-Wire alarm output settings
ETSAT@ETS=External temperature sensors (1-Wire and BLE)
EHSAT@EHS=External humidity sensors (BLE)
DRVAT@DRV=Driver ID settings (up to 1024 driver IDs)
URTAT@URT=Serial port settings: thermograph types, baud rate, mode (incl. UART transparent transfer)
TRSAT@TRS=Transparent transmission from server to RS232/UART serial port

BLE commands

CodeCommandDescription
BSSAT@BSS=BLE scan settings, iBeacon UUID filter, BLE Event Data Mask
BBSAT@BBS=BLE broadcast settings
BCSAT@BCS=BLE connection settings (ABK100, ABR100 relay encryption)
BRYAT@BRY=BLE relay output control
BOSAT@BOS=BLE alarm output wave shape
TRBAT@TRB=BLE transparent transmission to server via +LDP message

OTA and debug

CategoryCodeDescription
OTAUPFFirmware upgrade over the air (main MCU, network module, boot firmware)
OTAUPCConfiguration upgrade over the air
OTABMSDevice management system: BMS server, report mode (Stop/TCP/UDP/MQTT), +BMR Data Mask
DEBUGDBGOTA debug log server and log mask
Report mode (SIS/SSI/BMS): 0 = Stop, 1 = TCP, 2 = UDP, 3 = MQTT. Buffer mode: 0 = disabled, 1 = low priority, 2 = high priority.

Query commands

Query commands retrieve the current working parameters of the terminal. They use printable ASCII with comma-separated fields:

AT@<KEY>?<password>,,<serial>#

  • AT@SIS?at,,# — query main server settings
  • AT@SSI?at,,# — query second server settings
  • AT@NIS?at,,# — query network (APN) settings
  • AT@TAC?at,,# — query tachograph DDD file request settings
  • AT@URT?at,,# — query serial port / RS232 settings
  • AT@GCS?at,,# — query global configuration
  • AT@PEO?at,,# — query polygon fence settings
When sent by the backend server, parameters are returned to the server. When sent by SMS, parameters are returned via SMS.

Message format

Report, buffer, large-data, and heartbeat messages share a common frame structure with header, data, and tail zones:

ZoneFieldsEncoding
HeaderHead (5 B) + Length (2 B) + IMEI (8 B) + Device ID (1 B)ASCII / HEX / HEX / HEX
DataVariable payload + G-time (7 B)HEX or ASCII
TailSerial number (2 B) + Tail "#" (1 B)HEX / ASCII
  • +RPT / -RPT, +LDP / -LDP, +BMR / -BMR, +HBD — data zone encoded in hexadecimal (big-endian for multi-byte values)
  • +LDP / -LDP — large data packets for tachograph DDD files, BLE transparent data, and other oversized payloads
  • +SACK / +SHBD — fully ASCII encoded
  • +ACK, +QRY, +ALL, +QNI, +VER, +GSV, +LSV, +BSV, +GAV, +CVS, +CMI, +SCF, +TCF, +DFI — data zone in ASCII with comma separators

Report messages (+RPT / -RPT)

+RPT frames are real-time reports generated and sent within 3 minutes. -RPT frames are historical reports stored in the device buffer and sent when connectivity is restored.

All GNSS-related messages and events share the same +RPT/-RPT hex-encoded format. The Data Mask and Event Data Mask in AT@GCS control which information zones are included, including BLE, RS485/RS232 accessory, and event data.

Key +RPT Data Mask bits (AT@GCS)

BitFieldContent
0Multi-packetAuto-enabled when message exceeds 256 bytes
1Network typeCellular network type
2BatteryVoltage (mV) and level (%)
3GNSS informationFix type, HDOP, speed, azimuth, altitude, lat/lon, UTC time, satellite counts
4Cell informationMCC, MNC, LAC, Cell ID, CSQ
7Upgrade informationFirmware upgrade status
8Event dataMain power, ignition, motion, mileage, GEO/PEO status, hour meter, crash, tilt, TLS, digital I/O, CAN sync
17Special car informationVehicle-specific CAN data fields
19BLE informationBLE scan results and sensor data
20BLE iBeaconiBeacon scan results

Event types

TypeEvent
0Terminal power
1Regular report
2Moving
3Battery alarm
7Crash alarm
11Upgrade firmware
12External temperature alarm
13Ignition
14Main power alarm
15Tow alarm
16Over speed alarm
19Harsh behavior alarm
21Geo-fence alarm
24CANBUS info event
30BLE common info
31External humidity alarm
32Jamming alarm
35TLS certificate download
38Upgrade configuration
39GNSS spoofing alarm
40PEO fence alarm
41PEO fence over-speed alarm
44BLE slave connect event
The full PDF lists every event state, PEO status mask bit, tachograph data field, data mask field, and byte length with value ranges.

Buffer messages (+BMR / -BMR)

+BMR frames are real-time BMS reports. -BMR frames are buffered BMS reports sent when connectivity is restored. Configure via AT@BMS.

ParameterDescription
Report Mode0 = Stop, 1 = TCP, 2 = UDP, 3 = MQTT
Buffer Mode0 = disabled, 1 = low priority, 2 = high priority
BMS Server IP / PortDevice management server address
Connection Life0 or 5–300 seconds TCP keep-alive
Report Interval1–2880 minutes
BMR Data MaskBattery level, config version, IGN state, GNSS info, SIM info, module version, boot firmware

Heartbeat and acknowledgement

FrameDirectionDescription
+HBDDevice → serverPeriodic heartbeat when report mode is TCP or UDP (interval set in AT@SIS)
+SHBDServer → deviceServer response to +HBD
+ACKDevice → serverConfirms a valid configuration command was received
+NACKDevice → serverRejects an illegal configuration command
+SACKServer → deviceServer acknowledgement when SACK Enable is set

Command query responses

FrameDescription
+QRYResponse to a single query command
+ALLBulk response with all configured parameters
+QNINetwork information (APN, IMSI, ICCID, CSQ, cell ID)
+VERFirmware and hardware version information (incl. boot firmware)
+GSVGPS satellite visibility
+LSVGLONASS satellite values
+BSVBEIDOU satellite values
+GAVGALILEO satellite values
+CVSCAN module version and serial number (via AT@RTO sub-command 13)
+CMICAN module car model ID (via AT@RTO sub-command 14)
+SCFServer configuration fields
+TCFTerminal configuration fields
+DFIDevice file information (via AT@RTO sub-command 16): main power, battery, I/O state, BLE modes, analog input, total distance

Terms and abbreviations

TermMeaning
ACKAcknowledgement
APNAccess Point Name
BLEBluetooth Low Energy
GNSSGlobal Navigation Satellite System
IMEIInternational Mobile Equipment Identity
IoTInternet of Things
LDPLarge data packet message
MQTTMessage Queuing Telemetry Transport
PEOPolygon fence (geo zone)
RS232Recommended Standard 232 serial interface
RPTReport message
SACKServer acknowledgement
TCP / UDPTransmission Control / User Datagram Protocol
TLSTransport Layer Security
UARTUniversal Asynchronous Receiver-Transmitter
UTCCoordinated Universal Time
In this document, "terminal", "device", and "equipment" refer to the AVT130/AVT131 LTE tracker unless otherwise specified.

AVT130 / AVT131 — RS232 Protocol

Download PDFOpen in new tab

v2.02 · 2026-06-23 · Release

AVT130 / AVT131 — RS232 Protocol — Page 1 of 94

Page 1 of 94

If the preview does not load, use Download or Open in new tab.