AVT80

GPS Trackers

AVT80

Protocol

AVT80 Tracker Protocol

Revision 1.04 — Feb 25, 2026 — PEO zones, GCS mask, IGN outputs

AVT80 Tracker Protocol R1.04 defines the data stream format, configuration commands, and message structures used between the device and backend server. Use the sections below for a structured overview, or open the full PDF for complete command parameters and field definitions.

Revision history

RevisionDateDescription
1.012025-11-29Initial release
1.022025-11-29Added AT@PEO polygon fence command; PEO fence alarm events in +RPT
1.032026-01-30Added UDP mode in AT@BMS report mode; added SACK Enable in AT@BMS
1.042026-02-25PEO ID max extended to 50; PEO status mask in AT@GCS; Ignition On limit outputs mask in AT@IGN

Data stream format

Communication includes upstream (device → server) and downstream (server → device) data streams over the cellular network. Upstream carries responses to downlink commands and unsolicited reports. Downstream carries configuration, query commands, and responses to uplink messages.

Frame types

DirectionEncodingFrameUsage
DownstreamPrintable ASCIIConfiguration CommandConfigure terminal parameters (AT@…=)
DownstreamPrintable ASCIIQuery CommandQuery current parameters (AT@…?)
DownstreamPrintable ASCII+SACKServer acknowledgement for +RST messages
DownstreamPrintable ASCII+SHBDServer response to +HBD heartbeat
UpstreamPrintable ASCII+QRY responseTerminal response to query commands
UpstreamPrintable ASCII+HBDPeriodic heartbeat to maintain connectivity
UpstreamPrintable ASCII+ACK / +NACKAcknowledgement or rejection of configuration commands
UpstreamHexadecimal+RPT / -RPTReal-time and buffered report messages
All upstream and downstream frames end with the character "#" (0x23). In printable ASCII frames, "," separates adjacent parameters. Hexadecimal frames have no parameter separator.

Configuration commands

Configuration commands use the format AT@<KEY>=<password>,<parameters>,…,<serial># . Each command is protected by a password and ends with a 4-digit hexadecimal serial number and "#".

Example — main server settings:

AT@SIS=at,0,1,255.255.255.255,12345,,,0,0001#

Network commands

CodeCommandDescription
SISAT@SIS=Main server IP, port, report mode, buffer, TLS, heartbeat
SSIAT@SSI=Second server settings
NISAT@NIS=APN, credentials, network scan mode
MQTAT@MQT=MQTT client ID, topics, QoS, keep-alive
TCRAT@TCR=TLS certificate remote download (HTTP)
TCLAT@TCL=TLS certificate local download

General commands

CodeCommandDescription
GMTAT@GMT=Greenwich Mean Time setting
GCSAT@GCS=Global configuration (event masks, reporting)
RRSAT@RRS=Regular report interval settings
RTOAT@RTO=Real-time operation
PCLAT@PCL=Preset command list
ECLAT@ECL=Event-driven command list

Alarm commands

CodeCommandDescription
MOVAT@MOV=Movement alarm
TOWAT@TOW=TOW (towing) alarm
SPDAT@SPD=Speed alarm
GEOAT@GEO=Geo-fence settings
PEOAT@PEO=Polygon fence settings (up to 50 zones in v1.04)
HBSAT@HBS=Harsh behavior (driving style)
CRAAT@CRA=Crash detection
JAMAT@JAM=Jamming alarm
TASAT@TAS=Tilt alarm

I/O, 1-Wire, BLE, OTA, and debug

CategoryCodeDescription
IO & ADCIGNIgnition input settings
IO & ADCDAMDigital and analog input multiplexing
IO & ADCOUTDigital output settings
IO & ADCAOSAlarm output mapping
1-WireWAS1-Wire application settings
1-WireWOS1-Wire alarm output settings
1-WireDRVDriver ID (iButton) settings
BLEBSSBLE scan settings
BLEBWSBLE beacon whitelist
BLEETSExternal temperature sensor
BLEEHSExternal humidity sensor
OTAUPFFirmware upgrade over the air
OTAUPCConfiguration upgrade over the air
OTABMSDevice management system (report mode: Stop/TCP/UDP/MQTT)
DEBUGDBGOTA debug log server settings
Report mode (SIS/SSI/BMS): 0 = Stop, 1 = TCP, 2 = UDP, 3 = MQTT. Buffer mode: 0 = disabled, 1 = low priority, 2 = high priority.

Query commands

Query commands retrieve the current working parameters of the terminal. They use printable ASCII with comma-separated fields:

AT@<KEY>?<password>,,<serial>#

  • AT@SIS?at,,# — query main server settings
  • AT@NIS?at,,# — query network (APN) settings
  • AT@GMT?at,,# — query time settings
  • AT@GCS?at,,# — query global configuration
  • AT@RRS?at,,# — query regular report settings
When sent by the backend server, parameters are returned to the server. When sent by SMS, parameters are returned via SMS.

Message format

Report and heartbeat messages share a common frame structure with header, data, and tail zones:

ZoneFieldsEncoding
HeaderHead (5 B) + Length (2 B) + IMEI (8 B) + Device ID (1 B)ASCII / HEX / HEX / HEX
DataVariable payload + G-time (7 B)HEX or ASCII
TailSerial number (2 B) + Tail "#" (1 B)HEX / ASCII
  • +RPT / -RPT and +BMR / -BMR — data zone encoded in hexadecimal (big-endian for multi-byte values)
  • +HBD — heartbeat; data zone in hexadecimal
  • +SACK / +SHBD — fully ASCII encoded
  • +ACK, +QRY, +ALL, +QNI, +VER, +GSV, +LSV, +BSV, +GAV, +SCF, +TCF — data zone in ASCII with comma separators

Report messages (+RPT / -RPT)

+RPT frames are real-time reports generated and sent within 3 minutes. -RPT frames are historical reports stored in the device buffer and sent when connectivity is restored.

All GNSS-related messages and events share the same +RPT/-RPT format. Reports are hex-encoded to reduce frame size and data consumption.

Key +RPT data mask bits

BitFieldContent
0Multi-packetFrame count and frame ID
1Network type0 / 3 / 8
2BatteryVoltage (mV) and level (%)
3GNSS informationFix type, HDOP, speed, azimuth, altitude, lat/lon, UTC time, satellite counts
4Cell informationMCC, MNC, LAC, Cell ID, CSQ
5–7Event / I/O / mileageEvent data mask, power, analog inputs, ignition, digital I/O, mileage
8Geo / ID / 1-WireGEO status, driver ID, 1-Wire sensors
9–11SensorsHour meter, accelerometer, BLE beacons, external temp/humidity
The full PDF lists every event type, event state, and data mask field with byte lengths and value ranges.

Heartbeat and acknowledgement

FrameDirectionDescription
+HBDDevice → serverPeriodic heartbeat to maintain TCP/UDP connection
+SHBDServer → deviceServer response to +HBD
+ACKDevice → serverConfirms a valid configuration command was received
+NACKDevice → serverRejects an illegal configuration command
+SACKServer → deviceServer acknowledgement when SACK is enabled on the server side

Command query responses

FrameDescription
+QRYResponse to a single query command
+ALLBulk response with all configured parameters
+QNINetwork information query response
+VERFirmware and hardware version information
+GSVGNSS satellite visibility
+LSVLTE signal values
+BSVBLE scan results
+GAVGlobal attribute values
+SCFServer configuration fields
+TCFTerminal configuration fields

Terms and abbreviations

TermMeaning
ACKAcknowledgement
APNAccess Point Name
BLEBluetooth Low Energy
GNSSGlobal Navigation Satellite System
IMEIInternational Mobile Equipment Identity
MQTTMessage Queuing Telemetry Transport
PDPPacket Data Protocol
RPTReport message
SACKServer acknowledgement
TCP / UDPTransmission Control / User Datagram Protocol
TLSTransport Layer Security
UTCCoordinated Universal Time
In this document, "terminal", "device", and "equipment" refer to the AVT80 tracker unless otherwise specified.

AVT80 — Protocol

Download PDFOpen in new tab

v1.04 · 2026-02-25 · Release

AVT80 — Protocol — Page 1 of 92

Page 1 of 92

If the preview does not load, use Download or Open in new tab.