GPS Trackers

AVT20

Protocol

AVT20 Tracker Protocol

Revision 3.03 — Jun 15, 2026 — IGN output limits, +DFI message, ABR100 BLE relay

AVT20 Tracker Protocol R3.03 defines the data stream format, configuration commands, and message structures used between the AVT20 GNSS tracker and backend server over LTE Cat-1 / EGPRS. Use the sections below for a structured overview, or open the full PDF for complete command parameters and field definitions.

Revision history

Revision	Date	Description
1.01	2024-11-03	Initial release
1.02	2025-03-11	GNSS Satellites Number bit in AT@GCS GNSS Info Mask
1.03	2025-03-18	AT@BSS BLE scan; PDP Enable in AT@SIS; BLE info in +RPT
1.04	2025-04-18	AT@ETS / AT@EHS external BLE sensors; event types 12 and 31 in +RPT
2.01	2025-05-23	AT@JAM jamming detection; AT@TAS tilt alarm; crash/tilt info masks; +TCF message
2.02	2025-06-16	iBeacon filter in AT@BSS; BLE iBeacon Info Mask in +RPT and AT@GCS
2.03	2025-08-21	AT@SSI second server; TLS (TCR/TCL); MQTT (MQT); Resend Time No SACK
2.04	2025-10-24	AT@UPC config OTA; AT@BCS/BRY/BOS BLE connection and relay; upgrade config event
3.01	2025-12-30	AT@GGF geo-fence GNSS filter; AT@BWS beacon whitelist; GNSS spoofing alarm (type 39)
3.02	2026-03-24	ECL Trigger Mask in +RPT; Motion Event Report in AT@MOV; JAM GSM signal params
3.03	2026-06-15	IGN output limits and debounce; +DFI message; ABR100 BLE relay in AT@BCS

Data stream format

Communication includes upstream (device → server) and downstream (server → device) data streams over the cellular network. Upstream carries responses to downlink commands, heartbeat packets, and unsolicited reports. Downstream carries configuration, query commands, and responses to uplink messages.

Frame types

Direction	Encoding	Frame	Usage
Downstream	Printable ASCII	Configuration Command	Configure terminal parameters (AT@…=)
Downstream	Printable ASCII	Query Command	Query current parameters (AT@…?)
Downstream	Printable ASCII	+SACK	Server acknowledgement for +RPT messages
Downstream	Printable ASCII	+SHBD	Server response to +HBD heartbeat
Upstream	Printable ASCII	+QRY	Terminal response to a query command
Upstream	Printable ASCII	+HBD	Periodic heartbeat to maintain TCP/UDP connectivity
Upstream	Printable ASCII	+ACK / +NACK	Acknowledgement or rejection of configuration commands
Upstream	Hexadecimal	+RPT / -RPT	Real-time and buffered report messages

All upstream and downstream frames end with the character "#" (0x23). In printable ASCII frames, "," separates adjacent parameters. Hexadecimal frames have no parameter separator.

Configuration commands

Configuration commands use the format AT@<KEY>=<password>,<parameters>,…,<serial># . Each command is protected by a password (default at) and ends with a 4-digit hexadecimal serial number and "#".

Example — main server settings:

AT@SIS=at,0,1,255.255.255.255,12345,,,0,0001#

Network commands

Code	Command	Description
SIS	AT@SIS=	Main server IP, port, report mode (0 Stop / 1 TCP / 2 UDP / 3 MQTT), buffer, SACK enable, heartbeat, PDP/TLS, Resend Time No SACK
SSI	AT@SSI=	Second server settings (same parameters as SIS)
NIS	AT@NIS=	APN, credentials, network scan mode (0 auto Cat1→GSM, 1 Cat1, 2 GSM), Search No Signal Cover
MQT	AT@MQT=	MQTT client ID, topics, QoS, keep-alive (main or second server)
TCR	AT@TCR=	TLS certificate remote download (HTTP)
TCL	AT@TCL=	TLS certificate local download

General commands

Code	Command	Description
GMT	AT@GMT=	Greenwich Mean Time / time zone setting
GCS	AT@GCS=	Global configuration: +RPT Data Mask, Event Data Mask, LED mode, GNSS/AGPS, odometer, hour meter, GNSS timeout, power saving
RRS	AT@RRS=	Regular GNSS report: mode, IGN/IGF intervals, corner angle, long standby wake-up schedule
RTO	AT@RTO=	Real-time operation: reboot, power off, factory reset, query network/version, realtime positioning, +DFI, satellite info
PCL	AT@PCL=	Preset command list (up to 32 commands)
ECL	AT@ECL=	Event-driven command list with ECL Trigger Report
GGF	AT@GGF=	Geo-fence GNSS filter and spoofing detection settings

Alarm commands

Code	Command	Description
MOV	AT@MOV=	Movement alarm with Motion Event Report
SPD	AT@SPD=	Speed alarm threshold and duration
GEO	AT@GEO=	Circular geo-fence settings (up to 32 zones)
HBS	AT@HBS=	Harsh behavior (driving style) with trigger interval
CRA	AT@CRA=	Crash detection with crash debounce
JAM	AT@JAM=	Jamming alarm (RSRP, RSRQ, RSSI, GSM MINCH/SINR)
TAS	AT@TAS=	Tilt alarm detection

I/O, BLE, OTA, and debug

Category	Code	Description
IO	IGN	Ignition and virtual ignition; Ignition On limit outputs mask, GNSS speed limit, debounce
BLE	BSS	BLE scan settings, iBeacon UUID filter, accessory whitelist check
BLE	BWS	BLE beacon whitelist (MAC groups)
BLE	BCS	BLE connection settings (ABK100, ABR100 relay encryption)
BLE	BRY	BLE relay output control
BLE	BOS	BLE alarm output wave shape
BLE	ETS	External temperature sensors (BLE)
BLE	EHS	External humidity sensors (BLE)
OTA	UPF	Firmware upgrade over the air (main MCU, network module, boot firmware)
OTA	UPC	Configuration upgrade over the air
OTA	BMS	Device management system: BMS server, report mode (Stop/TCP/UDP/MQTT), +BMR Data Mask
DEBUG	DBG	OTA debug log server and log mask

Report mode (SIS/SSI/BMS): 0 = Stop, 1 = TCP, 2 = UDP, 3 = MQTT. Buffer mode: 0 = disabled, 1 = low priority, 2 = high priority.

Query commands

Query commands retrieve the current working parameters of the terminal. They use printable ASCII with comma-separated fields:

AT@<KEY>?<password>,,<serial>#

AT@SIS?at,,# — query main server settings
AT@SSI?at,,# — query second server settings
AT@NIS?at,,# — query network (APN) settings
AT@GMT?at,,# — query time settings
AT@GCS?at,,# — query global configuration
AT@RRS?at,,# — query regular report settings
AT@GEO?at,,# — query geo-fence settings

When sent by the backend server, parameters are returned to the server. When sent by SMS, parameters are returned via SMS.

Message format

Report, buffer, large-data, and heartbeat messages share a common frame structure with header, data, and tail zones:

Zone	Fields	Encoding
Header	Head (5 B) + Length (2 B) + IMEI (8 B) + Device ID (1 B)	ASCII / HEX / HEX / HEX
Data	Variable payload + G-time (7 B)	HEX or ASCII
Tail	Serial number (2 B) + Tail "#" (1 B)	HEX / ASCII

+RPT / -RPT, +LDP / -LDP, +BMR / -BMR, +HBD — data zone encoded in hexadecimal (big-endian for multi-byte values)
+SACK / +SHBD — fully ASCII encoded
+ACK, +QRY, +ALL, +QNI, +VER, +GSV, +LSV, +BSV, +GAV, +SCF, +TCF, +DFI — data zone in ASCII with comma separators

Report messages (+RPT / -RPT)

+RPT frames are real-time reports generated and sent within 3 minutes. -RPT frames are historical reports stored in the device buffer and sent when connectivity is restored.

All GNSS-related messages and events share the same +RPT/-RPT hex-encoded format. The Data Mask and Event Data Mask in AT@GCS control which information zones are included.

Key +RPT Data Mask bits (AT@GCS)

Bit	Field	Content
0	Multi-packet	Auto-enabled when message exceeds 256 bytes
1	Network type	Cellular network type
2	Battery	Voltage (mV) and level (%)
3	GNSS information	Fix type, HDOP, speed, azimuth, altitude, lat/lon, UTC time, satellite counts
4	Cell information	MCC, MNC, LAC, Cell ID, CSQ
7	Upgrade information	Firmware upgrade status
8	Event data	Main power, ignition, motion, mileage, GEO, hour meter, crash, tilt, TLS
19	BLE information	BLE scan results and sensor data
20	BLE iBeacon	iBeacon scan results
22	Upgrade config	Configuration OTA status

Event types

Type	Event
0	Terminal power
1	Regular report
2	Moving
3	Battery alarm
7	Crash alarm
11	Upgrade firmware
12	External temperature alarm
13	Ignition
14	Main power alarm
16	Over speed alarm
19	Harsh behavior alarm
20	G-sensor self-calibration
21	Geo-fence alarm
27	Output alarm
29	PDP alarm
30	BLE common info
31	External humidity alarm
32	Jamming alarm
33	Tilt alarm
34	BLE iBeacon info
35	TLS certificate download
38	Upgrade configuration
39	GNSS spoofing alarm
43	ECL trigger alarm

The full PDF lists every event state, data mask field, and byte length with value ranges.

Large data messages (+LDP / -LDP)

+LDP frames carry large data packet reports such as crash sensor data. -LDP frames are buffered large-data reports sent when connectivity is restored.

Bit	Large Data Mask field	Content
0	Multi-packet	Total frame count and current frame ID
4	Crash data	Crash data type, length, and payload (e.g. gyroscope samples)

+LDP/-LDP use the same header/tail frame structure as +RPT/-RPT with a hexadecimal data zone.

Buffer messages (+BMR / -BMR)

+BMR frames are real-time BMS reports. -BMR frames are buffered BMS reports sent when connectivity is restored. Configure via AT@BMS.

Parameter	Description
Report Mode	0 = Stop, 1 = TCP, 2 = UDP, 3 = MQTT
Buffer Mode	0 = disabled, 1 = low priority, 2 = high priority
BMS Server IP / Port	Device management server address
Connection Life	0 or 5–300 seconds TCP keep-alive
Report Interval	1–2880 minutes
BMR Data Mask	Battery level, config version, IGN state, GNSS info, SIM info, module version, boot firmware

Heartbeat and acknowledgement

Frame	Direction	Description
+HBD	Device → server	Periodic heartbeat when report mode is TCP or UDP (interval set in AT@SIS)
+SHBD	Server → device	Server response to +HBD
+ACK	Device → server	Confirms a valid configuration command was received
+NACK	Device → server	Rejects an illegal configuration command
+SACK	Server → device	Server acknowledgement when SACK Enable is set

Command query responses

Frame	Description
+QRY	Response to a single query command
+ALL	Bulk response with all configured parameters
+QNI	Network information (APN, IMSI, ICCID, CSQ, cell ID)
+VER	Firmware and hardware version information
+GSV	GPS satellite visibility
+LSV	GLONASS satellite values
+BSV	BEIDOU satellite values
+GAV	GALILEO satellite values
+SCF	Server configuration fields
+TCF	Terminal configuration fields (including tilt calibration)
+DFI	Device file information (requested via AT@RTO sub-command 16)

Terms and abbreviations

Term	Meaning
ACK	Acknowledgement
AGPS	Assisted Global Positioning System
APN	Access Point Name
BLE	Bluetooth Low Energy
GNSS	Global Navigation Satellite System
IMEI	International Mobile Equipment Identity
IoT	Internet of Things
LDP	Large data packet message
MQTT	Message Queuing Telemetry Transport
RPT	Report message
SACK	Server acknowledgement
TCP / UDP	Transmission Control / User Datagram Protocol
TLS	Transport Layer Security
UTC	Coordinated Universal Time
VG	Virtual Ignition
VGN / VGF	Virtual Ignition On / Off

In this document, "terminal", "device", and "equipment" refer to the AVT20 GNSS tracker unless otherwise specified.

AVT20 — Protocol

Download PDF Open in new tab

v3.03 · 2026-06-15 · Release

Page 1 of 94

If the preview does not load, use Download or Open in new tab.