GPS Trackers

AVT130 / AVT131

RS485 Protocol

AVT130/AVT131 RS485 Tracker Protocol

Revision 1.03 — Jun 23, 2026 — JAM duration range, boot firmware OTA, RS485 AT@RCS/AT@RAS

AVT130/AVT131 RS485 Tracker Protocol R1.03 defines the data stream format, configuration commands, and message structures for the optional RS-485 interface for trailer trackers. Based on the RS232 protocol (V1.08) with RS485-specific accessory commands (AT@RCS, AT@RAS). Use the sections below for a structured overview, or open the full PDF for complete command parameters and field definitions.

Revision history

Revision	Date	Description
1.01	2025-09-15	Initial release (based on RS232 V1.08 protocol)
1.02	2025-10-26	Boot firmware OTA in AT@UPF Update Type 3; Bit 9 BOOT Firmware Mask in AT@BMS; BOOT Firmware Version in +BMR
1.03	2026-06-23	Enter Jamming Duration range 60–360 seconds in AT@JAM

Data stream format

Communication includes upstream (device → server) and downstream (server → device) data streams over the cellular network. Upstream carries responses to downlink commands, heartbeat packets, and unsolicited reports. Downstream carries configuration, query commands, and responses to uplink messages.

Frame types

Direction	Encoding	Frame	Usage
Downstream	Printable ASCII	Configuration Command	Configure terminal parameters (AT@…=)
Downstream	Printable ASCII	Query Command	Query current parameters (AT@…?)
Downstream	Printable ASCII	+SACK	Server acknowledgement for +RPT messages
Downstream	Printable ASCII	+SHBD	Server response to +HBD heartbeat
Upstream	Printable ASCII	+QRY	Terminal response to a query command
Upstream	Printable ASCII	+HBD	Periodic heartbeat to maintain TCP/UDP connectivity
Upstream	Printable ASCII	+ACK / +NACK	Acknowledgement or rejection of configuration commands
Upstream	Hexadecimal	+RPT / -RPT	Real-time and buffered report messages

All upstream and downstream frames end with the character "#" (0x23). In printable ASCII frames, "," separates adjacent parameters. Hexadecimal frames have no parameter separator.

Configuration commands

Configuration commands use the format AT@<KEY>=<password>,<parameters>,…,<serial># . Each command is protected by a password (default at) and ends with a 4-digit hexadecimal serial number and "#".

Example — main server settings:

AT@SIS=at,0,1,255.255.255.255,12345,,,0,0001#

Network commands

Code	Command	Description
SIS	AT@SIS=	Main server IP, port, report mode (0 Stop / 1 TCP / 2 UDP / 3 MQTT), buffer, SACK enable, heartbeat, PDP/TLS, Message Filter Mode/Mask, Resend Time No SACK
SSI	AT@SSI=	Second server settings (same parameters as SIS)
NIS	AT@NIS=	APN, credentials, network scan mode, Search No Signal Cover
MQT	AT@MQT=	MQTT client ID, topics, QoS, keep-alive (main or second server)
FTP	AT@FTP=	FTP server address, port, credentials
TCR	AT@TCR=	TLS certificate remote download (HTTP)
TCL	AT@TCL=	TLS certificate local download

General commands

Code	Command	Description
GMT	AT@GMT=	Greenwich Mean Time / time zone setting
GCS	AT@GCS=	Global configuration: Data Mask (incl. RS485 info mask), Event Data Mask, LED, GNSS/AGPS, odometer, hour meter, power saving
RRS	AT@RRS=	Regular GNSS report: mode, IGN/IGF intervals, corner angle, long standby wake-up
RTO	AT@RTO=	Real-time operation: reboot, power off, factory reset, +DFI, satellite info, satellite info
PCL	AT@PCL=	Preset command list (up to 32 commands)
ECL	AT@ECL=	Event-driven command list binding events to preset commands

Alarm commands

Code	Command	Description
MOV	AT@MOV=	Movement alarm detection
TOW	AT@TOW=	Towing (TOW) alarm detection
SPD	AT@SPD=	Speed alarm threshold and duration
GEO	AT@GEO=	Circular geo-fence settings (up to 32 zones)
HBS	AT@HBS=	Harsh behavior (driving style) with trigger interval
CRA	AT@CRA=	Crash detection with crash debounce
JAM	AT@JAM=	Jamming alarm detection

I/O and ADC

Code	Command	Description
IGN	AT@IGN=	Ignition and virtual ignition settings
DAM	AT@DAM=	Digital and analog input multiplexing (incl. delta AIS)
OUT	AT@OUT=	Digital output settings
AOS	AT@AOS=	Alarm output mapping and trigger masks (GEO, SPD, HBS, DRV, JAM)

1-Wire and RS485 (replaces RS232 URT/TRS)

Code	Command	Description
WAS	AT@WAS=	1-Wire application: iButton timer, temperature timer, 1-wire Data Mask
ETS	AT@ETS=	External temperature alarm (1-Wire or BLE sensors)
EHS	AT@EHS=	External humidity alarm (1-Wire or BLE sensors)
DRV	AT@DRV=	Driver ID authorization whitelist and report mode
RCS	AT@RCS=	RS485 communication: baud rate index (1200–115200), data bits (7/8), stop bits, parity
RAS	AT@RAS=	RS485 accessory: accessory type/model (e.g. DYP-U02 ultrasonic oil level sensor), address IDs (up to 5 per type)

BLE, OTA, and debug

Category	Code	Description
BLE	BSS	BLE scan settings: working mode, frequency, duration, filter groups, I/O match/save rules, report intervals
OTA	UPF	Firmware upgrade over the air (APP MCU, auxiliary MCU, network module, boot firmware type 3)
OTA	BMS	Device management system: BMS server, report mode (Stop/TCP), +BMR Data Mask (incl. BOOT firmware bit 9)
DEBUG	DBG	OTA debug log server and log mask (incl. UART, 1-Wire, CAN logs)

Report mode (SIS/SSI): 0 = Stop, 1 = TCP, 2 = UDP, 3 = MQTT. BMS report mode: 0 = Stop, 1 = TCP. Buffer mode: 0 = disabled, 1 = low priority, 2 = high priority. RS485 variant uses AT@RCS/AT@RAS instead of RS232 AT@URT/AT@TRS.

Query commands

Query commands retrieve the current working parameters of the terminal. They use printable ASCII with comma-separated fields:

AT@<KEY>?<password>,,<serial>#

AT@SIS?at,,# — query main server settings
AT@SSI?at,,# — query second server settings
AT@NIS?at,,# — query network (APN) settings
AT@GMT?at,,# — query time settings
AT@GCS?at,,# — query global configuration
AT@RRS?at,,# — query regular report settings
AT@RCS?at,,# — query RS485 communication settings
AT@RAS?at,,# — query RS485 accessory settings
AT@GEO?at,,# — query geo-fence settings

When sent by the backend server, parameters are returned to the server. When sent by SMS, parameters are returned via SMS.

Message format

Report, buffer, heartbeat, and large-data messages share a common frame structure with header, data, and tail zones:

Zone	Fields	Encoding
Header	Head (5 B) + Length (2 B) + IMEI (8 B) + Device ID (1 B)	ASCII / HEX / HEX / HEX
Data	Variable payload + G-time (7 B)	HEX or ASCII
Tail	Serial number (2 B) + Tail "#" (1 B)	HEX / ASCII

+RPT / -RPT, +BMR / -BMR, +LDP / -LDP, +HBD — data zone encoded in hexadecimal (big-endian for multi-byte values)
+SACK / +SHBD — fully ASCII encoded
+ACK, +QRY, +ALL, +QNI, +VER, +GSV, +LSV, +BSV, +GAV, +CVS, +CMI, +DFI — data zone in ASCII with comma separators

Report messages (+RPT / -RPT)

+RPT frames are real-time reports generated and sent within 3 minutes. -RPT frames are historical reports stored in the device buffer and sent when connectivity is restored.

All GNSS-related messages and events share the same +RPT/-RPT hex-encoded format. The Data Mask and Event Data Mask in AT@GCS control which information zones are included.

Key +RPT Data Mask bits (AT@GCS)

Bit	Field	Content
0	Multi-packet	Auto-enabled when message exceeds 256 bytes
1	Network type	Cellular network type
2	Battery	Voltage (mV) and level (%)
3	GNSS information	Fix type, HDOP, speed, azimuth, altitude, lat/lon, UTC time, satellite counts
4	Cell information	MCC, MNC, LAC, Cell ID, CSQ
7	Upgrade information	Firmware upgrade status
8	Event data	Main power, ignition, motion, mileage, GEO status, hour meter, crash, digital I/O, 1-Wire sensors
9–10	Motor CAN info	Motor CAN Information Mask 1 and 2
11	Electric CAN info	Electric CAN Information Mask
15	Tacho common event	Tachograph Common Event Information Mask
16	Tachograph info	Tachograph card and status data
19	BLE information	BLE scan results and sensor data
21	RS485 information	RS485 accessory data (volume, temperature) from AT@RAS accessories

Event types

Type	Event
0	Terminal power
1	Regular report
2	Moving
3	Battery alarm
11	Upgrade firmware (incl. CAN, BOOT MCU)
12	External temperature alarm
13	Ignition
14	Main power alarm
15	Tow alarm
16	Over speed alarm
17	Engine idle alarm
18	Start/stop alarm
19	Harsh behavior alarm
21	Geo-fence alarm
22	Digital input 1
23	ID authorized event
24	CANBUS info event
27	Output alarm
28	Delta AIS alarm
29	PDP alarm
30	BLE common info
31	External humidity alarm
32	Jamming alarm
35	TLS certificate download

The full PDF lists every event state, CAN info mask field, RS485 accessory field, tachograph data field, and byte length with value ranges.

Buffer messages (+BMR / -BMR)

+BMR frames are real-time BMS reports sent to the device management server. -BMR frames are buffered BMS reports sent when connectivity is restored. Configure via AT@BMS.

Parameter	Description
Report Mode	0 = Stop, 1 = TCP
Buffer Mode	0 = disabled, 1 = low priority, 2 = high priority
BMS Server IP / Port	Device management server address
Connection Life	5–300 seconds TCP keep-alive
Report Interval	1–2880 minutes
BMR Data Mask	Main power, battery level, auxiliary MCU, config version, CAN info, IGN state, GNSS info, SIM info, module version, BOOT firmware (bit 9)

Revision 1.03 added Update Type 3 (boot firmware) in AT@UPF and Bit 9 BOOT Firmware of Main MCU Mask in AT@BMS, with <BOOT Firmware Version> reported in +BMR.

Heartbeat and acknowledgement

Frame	Direction	Description
+HBD	Device → server	Periodic heartbeat when report mode is TCP or UDP (interval set in AT@SIS)
+SHBD	Server → device	Server response to +HBD
+ACK	Device → server	Confirms a valid configuration command was received (incl. CAN, TAC, TCO sub-commands)
+NACK	Device → server	Rejects an illegal configuration command
+SACK	Server → device	Server acknowledgement when SACK Enable is set

Command query responses

Frame	Description
+QRY	Response to a single query command
+ALL	Bulk response with all configured parameters
+QNI	Network information (APN, IMSI, ICCID, CSQ, cell ID)
+VER	Firmware and hardware version information
+GSV	GPS satellite visibility
+LSV	GLONASS satellite values
+BSV	BEIDOU satellite values
+GAV	GALILEO satellite values
+CVS	CAN module version and serial number (via AT@RTO sub-command 13)
+CMI	CAN module car model ID (via AT@RTO sub-command 14)
+DFI	Device file information (via AT@RTO sub-command 16)

+LDP/-LDP carries large data packets such as BLE transparent data or file transfers. Message Filter Mask in AT@SIS/SSI can filter +LDP, +DFI, and related +ACK responses.

Terms and abbreviations

Term	Meaning
ACK	Acknowledgement
AGPS	Assisted Global Positioning System
APN	Access Point Name
BLE	Bluetooth Low Energy
GNSS	Global Navigation Satellite System
IMEI	International Mobile Equipment Identity
IoT	Internet of Things
MQTT	Message Queuing Telemetry Transport
RS485	RS-485 serial bus for external accessories (replaces RS232 URT/TRS)
RPT	Report message
SACK	Server acknowledgement
TCP / UDP	Transmission Control / User Datagram Protocol
TLS	Transport Layer Security
TOW	Towing detection
UTC	Coordinated Universal Time
VG	Virtual Ignition
VGN / VGF	Virtual Ignition On / Off

In this document, "terminal", "device", and "equipment" refer to the AVT130/AVT131 GNSS tracker with RS485 interface unless otherwise specified.

AVT130 / AVT131 — RS485 Protocol

Download PDF Open in new tab

v1.03 · 2026-06-23 · Release

Page 1 of 90

If the preview does not load, use Download or Open in new tab.