G500 OBD Protocol-01

PRODUCT PROTOCOL
V2.0
Confidential
All informed persons in this document, this document regarded as an obligation of confidentiality
shall not in any form all or part of this document dissemination to third parties, particularly those
engaged in the same business of the Company's competitors, otherwise, due to the leak of
information business caused by direct or indirect losses, the company shall be entitled in accordance
with the law of the location or the infringing party of its legal accountability.
3. Protocol details
3.1 introduce
The product made of binary form of expression, tentatively divided into general, GSM, GPS, OBD,
peripherals, remote upgrade command. Different products are a combination of these modules
instruction. All command words using two bytes, where the first digit indicates the type of command,
the second digit indicates that the command number, where 0x01 - 0x7F indicates a command
server to the device, the device corresponding response 0x81 - 0xFF, that is, each type command
only a maximum of 127 commands. When only the upstream or downstream of the command, the
corresponding command is null. Such as (Table 1) shown
(Table 1)
command type(1st byte of explaination
command)
General 0x00 This command is suitable for all types of products,
command including check product software version, manufacturer,
product ID, restart the self-test equipment, alarms and
other equipment etc.
GSM 0x10 The type command is used to set the GSM module
command related, including setting IP address, port, whether to
enable the base station location, etc.
GPS 0x20 This type of command is mainly used for GPS-related
command functions, including GPS data uploaded regularly, upload
interval, uploading method, etc.

OBD 0x30 This type of command is mainly used OBD-related
command functions, including uploading, travel reports OBD data
upload, upload interval, methods
Upgrade 0x40 The product is mainly used in Type Command equipment
command IOS upgrade, you must expand outside the flash only
supports this feature
Peripheral 0x50 The type command is used to load a variety of peripheral
command products after preparation, various peripherals, the
command type corresponding different and each is
0x50,0x51,0x52 ......
3.2 protocol format
Unified protocol format such as (Table II) shown
(Table II)
no. Name Length Explaination
1 Starting 1 Fixed to 0x28, ie the ASCII '(' character.
character
2 Device ID 6 Device ID number, a fixed 6-byte length (ie 12 ASCII
number characters, BCD code means 2 product code, 2 code
represent the year of production, 2013 that is expressed by
13, 4 represent month and date, the remaining 4 represent
the number of production date, from 0000-9999. of course,
the ID may be set according to customer requirements into
other forms, such as direct use of SIM card, but the length
must not be over 12, and must be all digital)
3 Command 2 A byte command type (Table I), a byte represent command
word number, further details see protocol
4 length 2 The length of command contents (before escaping)
5 contents undefi 1: Downstream’s first byte represents mode of operation
ne (set to 0x01, the query is 0x00), the second byte is undefined
byte Parameter , query command generally without
parameters.
2: the instruction includes only the uplink variable byte
Parameter
6 check 1 the bytes of XOR, and (former escape) from product ID
number to the command contents
7 Ending byte 1 Fixed 0x29,ie. ASCII”)”byte.
Remark：
1. If not specified, all speed units used in this Agreement are KM / H, All times are GMT adoption
2. All instruction content (apart from the start terminator), and all the will '(', ')', and these three
characters 0x3D escape, escape method including: plus character 0x3D front byte, then XOR 0x3D ,
0x3D itself needs to be escaped. Ie. '(' escaped as 0x3D 0x15.

4. protocol
4.1 general command
4.1.1 Get equipment manufacturers
command 0x00 0x01 –> 0x00 0x81(Wherein the previous command issued on behalf of the
word host computer to the device under, after a request under the command bit
command machine response, similar to all of the following will not be repeated)
Function check product manufacturer name
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x01 0x00 0x01 0x00 0x35 0x29
sample
command 0x28 is starting character ，0x30 0x14 0x04 0x14 0x00 0x01represent device ID
parameterex number，0x00 0x0 is command word， 0x00 0x01 is command length，0x00is
plain command contents，the 1st byte represent operate type is check ，have no other
parameters ，0x35 is checksum (Agreement in the presentation and maybe accurate
calibration)，0x29 is ending character (The following protocol describes only the
contents of the command, the other will not be repeated).
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x81 0x00 0x0E
expected 0x77,0x77,0x77,0x2E,0x62,
result 0x6A,0x7A,0x6A,0x78,0x64,0x2E,0x63,0x6F,0x6D 0xC8 0x29
return 0x28 is starting character，0x30 0x14 0x04 0x14 0x00 0x01represent device ID
parameter number ， 0x00 0x81 is command word，0x00 0x0E is command
explain length ,0x77,0x77,0x77,0x2E,0x62,0x6A,0x7A,0x6A,0x78,0x64,0x2E,0x63,

0x6F,0x6D is command contents，namely company website www.bjzjxd.com，0xC8
为校验和，0x29 is ending byte.
remark the commands only has check ，no setup 。
4.1.2 Get software version number
command 0x00 0x02 –> 0x00 0x82
word
Function check product firmware version
sample
command 0x00 is command contents represents operation type is Check
parameterex
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x82 0x00 0x10 0x5A 0x4A 0x38 0x30
expected 0x30 0x30 0x5F 0x32 0x30 0x31 0x34 0x30 0x34 0x30 0x34 0x41 0xDA 0x29
result
return 0x5A 0x4A 0x38 0x30 0x30 0x30 0x5F 0x32 0x30 0x31 0x34 0x30 0x34 0x30 0x34
parameter 0x41 is command contents ,ie version No. is ZJ8000_20140404A
explain
remark the command only have check without setup
4.1.3 set/check device ID number
command 0x00 0x03 –> 0x00 0x83
word
Function set/check device ID number
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x03 0x00 0x07 0x01 0x30 0x14 0x04
sample 0x14 0x00 0x01 0x05 0x29 //setup
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x03 0x00 0x01 0x00 0x37 0x29
//check
command setup：0x01 0x30 0x14 0x04 0x14 0x00 0x01is comammand contents1st byte
parameterex 0x01represent operate tye is setup, 0x30 0x14 0x04 0x04 0x00 0x01 the set ID
plain number(parameter), 6 bytes
Check：0x00 is command type,represents operate type is check without other
parameters, the following command almost are the same
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x83 0x00 0x06 0x30 0x14 0x04 0x14
expected 0x00 0x01 0x85 0x29
result
return 0x30 0x14 0x04 0x04 0x00 0x01 is command contents ,ie ID number is
parameter 301404140001
explain
remark Set and return the query result is the same, which is now the parameters have been
set in device
4.1.4 initialization factory setting
command 0x00 0x04 –> 0x00 0x84
word
Function initialization factory setting

sample
command 0x01is command contents
parameterex
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x84 0x00 0x00 0xB1 0x29
expected
result
return None
parameter
explain
remark All operation is 0x01，only read parameter is 0x00
4.1.5 Requesting device reboot
command 0x00 0x05 –> 0x00 0x85
word
Function Requesting device reboot
sample
command 0x01is command contents
parameterex
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x85 0x00 0x00 0xB0 0x29
expected
result
return none
parameter
explain
remark all operation is 0x01，Only read parameter is0x00
4.1.6 setup/check if turn on powering saving mode
command 0x00 0x06 –> 0x00 0x86
word
Function setup/check if turn on powering saving mode
sample //setup
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x06 0x00 0x01 0x00 0x32 0x29 //check
command setup ：0x01 0x02is command contents，the 1st byte 0x01represent setup ，the 2nd
parameterex byte 0x01 represent turn on power saving mode，0x00represent not turn on power
plain saving mode, after turn on power saving mode, device will enter sleep mode after
vehicle CAN entered sleep mode. After device sleep, GPS module will close off, GSM
enter sleep mode, but SMS and calling can wake up device, BUT GPRS disconnect,
device default turn on sleep mode.
check ：0x00 is command type ，represent operation type is check
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x86 0x00 0x01 0x01 0xB0 0x29
expected
result
return 0x01：represent device turn on power saving mode
parameter
explain
remark
4.1.7 setup /check time zone
command 0x00 0x07 –> 0x00 0x87
word
Function setup /check time zone
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x07 0x00 0x03 0x01 0x01 0xE0 0xD1
sample 0x29 //setup
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x07 0x00 0x01 0x00 0x33 0x29 //check
command setup ：0x01 0x01 0xE0is command contents，0x01represent setup ，0x01 0xE0 is the
parameterex setup timezone , unit:munite，0x01E0 = 480minutes，device default timezone is
plain 480munites，namely +8 time, and the highest of 1st byte represents simbol，when
highest byte is 1，represent minus number, namely parameter is 0x81 0xE0，
represent timezone is -480minutes
check ：0x00represent check
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x87 0x00 0x02 0x01 0xE0 0xC7 0x29
expected
result
return 0x01 0xE0represent device the set timezone

parameter
explain
remark
4.1.8 device alarm/response receive alarm
command 0x00 0x88 -> 0x00 0x08
word
Function Device alarms upload -> confirm alarm received
sample 0x09 0x00 0x04 0x00 0x5A 0x97 0x29 //without GPS location data, default with
time date info
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x88 0x00 0x12 0x01 0x28 0x04 0x14
0x09 0x00 0x04 0x22 0x43 0x88 0x16 0x11 0x34 0x91 0x23 0x97 0x00 0x5A 0xE6
0x29 //with GPS location data
command When length is 0x00 0x09 represent alarm data include time data but without
parameter location data, when length is 0x00 0x12 represent alarm data not only contain time
explain data but also location data , device defaults contain location data in alarm data if
device with gps module.
Parameters the 1st byte 0x01 represent alarm code (table 4)。
Without gps data alarm 0x28 0x04 0x14 0x09 0x00 0x04 represent time of alarm ，
such as the front 2 point in (table 5) 。0x00 0x5A meaning such as the example
meaning in alarm command (table 4)，the character default 2 bytes,if have no
parameter, then the 2 bytes are 0x00 0x00，if parameter only has 1 byte, then the
first default 0x00，the 2nd byte represent the meaning of parameter ，it example
represent current speed up to 90KM/H，generated over speed alarm；
with gps databank alarm message 0x28 0x04 0x14 0x09 0x00 0x04 0x22 0x43 0x88
0x16 0x11 0x34 0x91 0x23 0x97represent date time location data，meansing show as
(Table 5). 0x00 0x5A meaning same as data without GPS，represent alarm parameter.
expected
result
return 0x01 0x01represent command contents，the 1st byte fixed to 0x01，represent
parameter confirm，the 2nd byte represent alarm code.
explain
remark Send command by device, central confirm, if setup alarm no need central confirm，
center no need response.
(表四)
Code alarm name Alarm command Alarm setup 1st Alarm setup 2nd
parameters section parameter(2 bytes) parameter(2 bytes)
Meaning
0 overspeed the 1st byte ， 1 byte represent 1 byte represent
alarm namely high bit overspeed threshold unit continuous time， how
default 0)，represent KM/H，default 80KM/H， long time over than
current speed，unit setup is 0 means threshold value means
KM/H represent not detect overspeeding,unit S，
speed default 5S
1 fatigue driving Two bytes, driven 2 bytes represent ， 2 bytes represent ，

time unit S fatigue driving threshold fatigue driving cancel
value ，if the value less time, when stopping time
than 600，represent not less than it， means
detection fatigue fatigue driving cancelled，
driving ，Unit S，default 0， Unit S
namely not detection
fatigue driving
2 GPS module None none(if check return none
fault back2 parameters are
0x0000, same as below)
3 Low battery 1 byte ，current car 1 byte represent ，low none
battery voltage，is voltage threshold value ，
actual value *10 is actual value *10，default
setup 110( namely 11V)
4 Charging 1 byte ，current car 1 byte represent ，low 1 byte represent ，high
battery battery voltage，is abnormal threshold abnormal threshold
abnormal actual value *10 value ，actual value*10， value，actual value *10，
default setup 125( namely default setup 145(namely
12.5V) 14.5V)
5 ECM default 1 byte ，DTC none none
number
6 High Coolant 1 byte ，current none none
temperature Coolant
temperature，
Unit ℃
7 Low Coolant none none none
temperature
8 Maintenance none none none
reminder
9 Throttle none none none
cleaning
reminder
10 device removal none none none
11 illigal open none none none
door
12 illigal ignition none none none
on
13 Lack of Estimated driven none none
endurance mileage，Unit KM
50KM
14 Add fuel report How many fuel none none
added，Unit L，when
over than 5L will
send report
15 Fuel abnormal How many fuel none none
reduce reduced，Unit L，
reminder when over than 5L
will send report
16 Vehicle none none none
vibration alarm
17 Failed to read none none none
vehicle
protocol
18 Rapid none none none
acceleration
19 Rapid none none none
deceleration
20 Sharp turning none none none
(table 5)
No. structure name length Explaination
1 data 3 date month year represent . Year ignore”20”。Eg,
2014year 4 April 28th is 0x28 0x04 0x14，BCD code to
represent. All data will use BCD code to represent
2 time 3 Hour minute second represent ,is GMT time。Eg, 9:0:4, is
0x09 0x00 0x04
3 Latitude 4 Actual latitude x10000 value,DDMM.MMMM format，
Eg,2233.4567 will upload 0x22 0x33 0x45 0x67
4 Longitude 4.5 Actual longitude x10000 value,DDDMM.MMMM format，
Eg,11334.5678will upload 0x11 0x33 0x45 0x67 0x8X。

5 direction 0.5 GPS located or not, E W S N ( see table 9)
4.1.9 setup /check alarm sending mechanism
command 0x00 0x09 –> 0x00 0x89
word
Function setup /check alarm sending mechanism
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x09 0x00 0x03 0x01 0x01 0x01 0x3E 0x29
sample //setup
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x09 0x00 0x02 0x00 0x01 0x3F 0x29
//check
command setup ：0x01 0x01 0x01represent command contents，the 1st 0x01 represent setup ，
parameterex the 2nd 0x01 represent alarm code，details refer to (table 4)，the 3rd 0x01 represent
plain alarm code Delivery mechanism，details refer to (table 6)
check ：0x00 0x01 is command contents，0x00 represent check，0x01represent alarm
code
expected
result
return 0x01 0x01 the 1st is alarm code, 2nd is alarm code Delivery mechanism
parameter
explain
remark Default All alarm command without GPS do not contain GPS location information,
do not send text messages, no need confirmation

All products with GPS, the alarm command with the GPS location information, do
not send text messages, no need confirmation, customers can customize
(table 6)
Byte BIT4 – BIT7 BIT3 BIT2 BIT1 BIT0
mean reserve 1 represent the alarm 1 represent 1 represent 1 represent
ing need server confirm. 0 alarm send via alarm sending alarm
represent no need GPRS to server command (GPRS channel)，0
server confirm. If alarm and also send with represents not
need to confirm, if server SMS to inform location send alarm, th e
didn’t confirm, it will user. 0 represent data(GPS byte is 0，other
send 3 times data at every not send SMS or LBS)，0 byte have no
30s interval and stop it . represent sense
without
4.1.10 setup /check alarm parameters
command 0x00 0x0A –> 0x00 0x8A
word
Function setup /check alarm parameters
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x0A 0x00 0x06 0x01 0x01 0x00 0x50
sample 0x00 0x05 0x4F 0x29 //setup ，the command length fixed
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x0A 0x00 0x02 0x00 0x01 0x33 0x29
//check
command setup ：0x01 0x01 0x00 0x50 0x00 0x05 is command contents，the 1st 0x01represent
parameterex setup ，the 2nd 0x01 is alarm code ，0x00 0x50 0x00 0x05 is setup alarm
plain parameters ，detailed meaning refer to (table 4)，0x00 0x50 is the 1st parameter，
is over speeding threshold value ，if the parameter only 1 byte ，then the 1st byte
default is 0x00，the 2nd byte is actual parameter 。0x00 0x05 is the 2nd parameter，
is the alarm lasting time，if the alarm is only 1 byte ， then the 1st byte default is
0x00，the 2nd byte is actual parameter 。if only has 1 parameter，then the 2nd
parameters are 0x00
check： 0x00 0x01, the 0x00 represent check 0x01 represent need check the alarm
code
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x8A 0x00 0x05 0x01 0x00 0x50 0x00
expected 0x05 0xC7 0x29
result
return 0x01 0x00 0x50 0x00 0x05 is setup overs peeding alarm’s threshold value is
parameter 80KM/H，last for 5S regards over speeding.
explain
remark
4.1.11 setup /check Device aliases
command 0x00 0x0B –> 0x00 0x8B
word
Function setup /check device name
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x0B 0x00 0x09 0x01 0x74 0x65 0x73
sample 0x74 0x5F 0x30 0x30 0x31 0x4F 0x29 //setup

0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x0B 0x00 0x01 0x00 0x33 0x29 //check
command setup：0x01 0x74 0x65 0x73 0x74 0x5F 0x30 0x30 0x31 is command contents，
parameterex 0x01represent setup ，0x74 0x65 0x73 0x74 0x5F 0x30 0x30 0x31 is setup device
plain name，namely ASCII code test_001，device name only be letter、Underline、Letter
combination，most length no more than 16 bytes.
0x00 represent check
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x8B 0x00 0x08 0x74 0x65 0x73 0x74
expected 0x5F 0x30 0x30 0x31 0xC7 0x29
result
return 0x74 0x65 0x73 0x74 0x5F 0x30 0x30 0x31 is the set device name test_001
parameter
explain
remark device name only shown when the device number to send text messages to owners
number , after name setup successfully, device will automatically change ID to
device name when reply message to facilitate personnel management memory.
4.1.12 time service
command 0x00 0x0C –> 0x00 0x8C
word
Function 服务器给设备授时。当设备一直无法获取正确的时间的时候，服务器可以通过该指令对设备
进行授时，保证上传的数据时间准确 Server to the device timing. When the device has
been unable to get the correct time, the server can be granted by the instruction
device, ensuring accurate time data upload

command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x0C 0x00 0x07 0x01 0x14 0x04 0x14
sample 0x09 0x00 0x04 0x30 0x29
command 0x01 0x14 0x04 0x14 0x09 0x00 0x04is command contents，0x01represent setup ，
parameterex 0x14 0x04 0x14 0x09 0x00 0x04 为授时时间，BCD 码 represent ，日月年时分秒格式，
plain 即授时时间为 2014 年 4 月 15 日 9 点 0 分 4 秒。格林威治时间
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x8C 0x00 0x01 0x01 0xC7 0x29
expected
result
return 0x01is command contents，取值 0x00 和 0x01，其中 0x01represent 授时成功，
parameter 0x00represent 授时失败。当设备已经获取到正确的 GPS 时间 or 网络时间的时候，对设
explain 备授时是丌成功的
remark
4.1.13 demarcate /check mileage
command 0x00 0x0D –> 0x00 0x8D
word
Function 对设备标定原始里程，check 设备当前里程
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x0D 0x00 0x05 0x01 0x00 0x01 0x14
sample 0x09 0x30 0x29 //标定
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x0D 0x00 0x01 0x00 0x30 0x29 //check
command setup ：0x01 0x00 0x01 0x14 0x09is command contents，0x01represent setup ，0x00
parameterex 0x01 0x14 0x09 为标定的原始里程，即 0x00011409 = 70665M，里程固定为 4 个字节
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x8D 0x00 0x04 0x00 0x01 0x14 0x09
expected 0xC7 0x29
result
return 0x00 0x01 0x14 0x09is command contents，即现在汽车的里程值
parameter
explain
remark 该指令主要用于丌带 OBD 的产品， or 带 OBD 读丌到原车里程的情况下，if OBD 能够读
取原车里程，标定是丌成功的。返回的将是读取到的仦表盘里程
4.1.15 wake up /sleep report
command 0x00 0x8E
word
Function 设备发出，服务器丌需要回复
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x8E 0x00 0x08 0x01 0x00 0x28 0x04 0x14
sample 0x09 0x00 0x04 0x30 0x29
command 0x01 0x00 0x28 0x04 0x14 0x09 0x00 0x04:其中 the 1st byte represent 唤醒 or 休眠，
parameterex 当值为 0x01 时 represent 唤醒，0x00represent 休眠。the 2nd byte 0x00represent 唤
plain 醒方式，当为休眠命令时，该字节 default 为 0x00。当为唤醒命令的时候，0x00represent
上电，0x01represent 电压波劢唤醒，0x02represent 电话短信唤醒，0x03represent 震
劢唤醒，0x04represent RTC 唤醒。第三个字节到第八个字节 represent 唤醒和休眠的时
间，BCD 码 represent ，格式日月年时分秒
return
expected
result
return
parameter
explain
remark
4.1.15 hardware testing command
command 0x00 0x7F –> 0x00 0xFF
word
Function 上位机下发该指令，设备将通过软件的方法对各模块电路进行检查，并给出检查结果
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0x7F 0x00 0x01 0x00 0x30 0x29
sample
command none
parameterex
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x00 0xFF 0x00 0x04 0x12 0x06 0x00 0x01 0xC7
expected 0x29
result
return 0x12 0x06 0x00 0x01is command contents，the 1st byte 0x12represent GSM 信号
parameter (0-31)，the 2nd byte represent GPS 卫星个数，第三个字节 0x00represent 电压，第四
explain 个字节 0x01 含义如(表七)所示，当该位为 1 时，represent 该部分电路异常，当该位为 0
时，represent 该部分电路正常
remark 工厂测试指令
(表七)
位 BIT7 BIT6 BIT5 BIT4 BIT3 BIT2 BIT1 BIT0
含义保留 RTC(实时时钟) 存储芯片三轴加速度传感器 GSM 模块 GPS 模块 K线高速 CAN
4.2 GSM command
4.2.1 setup /check IP(domain),port, APN of data Balancing server
command 0x10 0x01 –> 0x10 0x81
word
Function setup /check 主服务器的 IP(域名)、端口和 APN
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x01 0x00 0x1B 0x01 0x31 0x30 0x30
sample 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2C 0x31 0x30 0x30
0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54 0x1B 0x29 //setup ip 地址、端口、APN
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x01 0x00 0x17 0x01 0x77 0x77 0x77 0x2E
0x61 0x61 0x61 0x2E 0x63 0x6F 0x6D 0x2C 0x31 0x30 0x30 0x30 0x2C 0x43 0x4D
0x4E 0x45 0x54 0x1B 0x29 //setup 域名、端口、APN
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x01 0x00 0x01 0x00 0x1B 0x29 //check
command 注意：该指令把所有的服务器信息都放到了一条指令，是考虑到更改完设备就自劢重新连接，
parameterex 减少更换地址 or 端口时的指令的交互和重新连接的逻辑。考虑到 IP 地址、域名兼容，所以
plain 所有的服务器信息以 ASCII 码的格式发送，IP 地址( or 域名)、端口、APN 之间用‘，’分
开。
setup IP： 0x01 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31
0x30 0x30 0x2C 0x31 0x30 0x30 0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54，the 1st byte
0x01represent setup ，后面字节转化为 ASCII 码为 100.100.100.100,1000,CMNET。用
‘，’隔开分别为 IP 地址、端口和 APN，即 setup 的 IP 地址为 100.100.100.100，setup

的端口为 1000，APN 为 CMNET。
setup 域名：0x01 0x77 0x77 0x77 0x2E 0x61 0x61 0x61 0x2E 0x63 0x6F 0x6D 0x2C
0x31 0x30 0x30 0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54，the 1st byte 0x01represent
setup ，后面字节转化为 ASCII 码为 www.aaa.com,1000,CMNET，用‘，’隔开分别为域
名、端口和 APN，即 setup 的域名为 www.aaa.com，setup 的端口为 1000，APN 为
CMNET。
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x81 0x00 0x1A 0x31 0x30 0x30 0x2E
expected 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2C 0x31 0x30 0x30
result 0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54 0x97 0x29
return 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2C
parameter 0x31 0x30 0x30 0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54，即
explain 100.100.100.100,1000,CMNET
remark 该地址只允许串口修改，远程丌能修改该地址。
设备连接该地址以后，会按照 setup 好的间隔给均衡服务器发送心跳包 0x10 0x08，均衡服
务器收到心跳包，就可以向设备 setup 数据采集服务器的地址
4.2.2 setup /check IP,port,APN of data collection server
command 0x10 0x02 –> 0x10 0x82
word
Function setup /check 备用服务器的 IP(域名)、端口和 APN
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x02 0x00 0x1B 0x01 0x31 0x30 0x30
sample 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2C 0x31 0x30 0x30
0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54 0x1B 0x29 //setup ip 地址、端口、APN
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x02 0x00 0x17 0x01 0x77 0x77 0x77 0x2E
0x61 0x61 0x61 0x2E 0x63 0x6F 0x6D 0x2C 0x31 0x30 0x30 0x30 0x2C 0x43 0x4D
0x4E 0x45 0x54 0x1B 0x29 //setup 域名、端口、APN
command setup IP： 0x01 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31
parameterex 0x30 0x30 0x2C 0x31 0x30 0x30 0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54，the 1st byte
plain 0x01represent setup ，后面字节转化为 ASCII 码为 100.100.100.100,1000,CMNET，用
‘，’隔开分别为 IP 地址、端口和 APN，即 setup 的 IP 地址为 100.100.100.100，setup
的端口为 1000，APN 为 CMNET。
setup 域名：0x01 0x77 0x77 0x77 0x2E 0x61 0x61 0x61 0x2E 0x63 0x6F 0x6D 0x2C
0x31 0x30 0x30 0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54，the 1st byte 0x01represent
setup ，后面字节转化为 ASCII 码为 www.aaa.com,1000,CMNET，用‘，’隔开分别为域
名、端口和 APN，即 setup 的域名为 www.aaa.com，setup 的端口为 1000，APN 为
CMNET。
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x82 0x00 0x1A 0x31 0x30 0x30 0x2E
expected 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2C 0x31 0x30 0x30
result 0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54 0x97 0x29
return 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2E 0x31 0x30 0x30 0x2C
parameter 0x31 0x30 0x30 0x30 0x2C 0x43 0x4D 0x4E 0x45 0x54，即
explain 100.100.100.100,1000,CMNET
remark 该地址只能由远程修改，而且只能是均衡服务器修改，数据采集服务器本身丌允许修改该地
址。
设备收到该指令以后，回复完指令将自劢断开不均衡服务器的连接，自劢连接数据采集服务
器。
4.2.3 setup /check start LBS position function
command 0x10 0x03 –> 0x10 0x83
word
Function setup /check 开启基站定位功能
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x03 0x00 0x02 0x01 0x01 0x1B 0x29
sample //setup
command setup ： 0x01 0x01the 1st 0x01represent setup ，the 2nd represent 开启基站定位功
parameterex 能，当 the value 为 0x00 时 represent 关闭基站定位功能，0x01represent 开启基站定
plain 位功能，设备 default 打开基站定位功能。
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x83 0x00 0x01 0x01 0x97 0x29
expected
result
return ·represent 开启基站定位功能
parameter
explain
remark
4.2.4 setup /check driver’s phone number
command 0x10 0x04 –> 0x10 0x84
word
Function setup /check 车主的手机号码
sample 0x00 0x00 0x00 0x00 0x1B 0x29 //setup
command setup ：0x01 0x08 0x61 0x38 0x00 0x00 0x00 0x00 为指令内容，the 1st byte
parameterex 0x01represent setup ，0x08 0x61 0x38 0x00 0x00 0x00 0x00represent setup 的手机
plain 号码，即 08613800000000，其中 the 1st 0 为凑齐偶数位增加的，固定增加 0，86 为国家
编码，13800000000 为 setup 的手机号码。
check ：0x00is command contents，0x00represent check
expected 0x00 0x00 0x00 0x97 0x29
result
return 0x08 0x61 0x38 0x00 0x00 0x00 0x00 表 is command contents， 0x08 0x61 0x38 0x00
parameter 0x00 0x00 0x00 为 setup 的车主号码
explain
remark
4.2.5 setup /check APN user name and password
command 0x10 0x05 –> 0x10 0x85
word
Function setup /check APN 用户名和密码
sample 0x2C 0x77 0x65 0x62 0x1B 0x29 //setup

command setup ：0x01 0x77 0x65 0x62 0x2C 0x77 0x65 0x62represent command contents ，
parameterex 0x01represent setup ，用户名和密码用 ASCII 码 represent ，用‘，’隔开，即 setup 用
plain 户名为 web，密码为 web
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x85 0x00 0x07 0x77 0x65 0x62 0x2C
expected 0x77 0x65 0x62 0x97 0x29
result
return 0x77 0x65 0x62 0x2C 0x77 0x65 0x62 表 is command contents，represent setup 的
parameter 用户名为 web，密码为 web
explain
remark
4.2.6 Read GSM module IMEI number
command 0x10 0x06 –> 0x10 0x86
word
Function check GSM 的 IMEI(国际移劢设备标识号)
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x06 0x00 0x01 0x00 0x1B 0x29 //check
sample
command 0x00 0x03is command contents，represent check
parameterex
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x86 0x00 0x0F 0x33 0x35 0x35 0x05 0x00
expected 0x00 0x54 0x92 0x97 0x29
result
return 0x03 0x50 0x05 0x05 0x00 0x00 0x54 0x92 表 is command contents，由于 IMEI 为 15
parameter 位的数字，所以最前面一位 0 为凑齐字节补上的，舍弃。 IMEI 号为 350050500005492
explain
remark 该指令只有 check
4.2.7 setup /check heartbeat interval
command 0x10 0x07 –> 0x10 0x87
word
Function setup /check 心跳包的间隔
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x07 0x00 0x03 0x01 0x00 0xB4 0x1B
sample 0x29 //setup
command setup ：0x01 0x00 0xB4 为指令内容，the 1st byte 0x01represent setup ，0x00
parameterex 0xB4represent setup 的心跳包上传间隔，取值 30 – 1000，Unit S，default 180S
plain check ：0x00is command contents，0x00represent check
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x87 0x00 0x02 0x00 0xB4 0x97 0x29
expected
result
return 0x00 0xB4 表 is command contents，represent setup 的间隔为 180S
parameter
explain
remark
4.2.8 heartbeat upload
command 0x10 0x88
word
Function 设备上传心跳包，服务器丌必回应
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x10 0x88 0x00 0x00 0x1B 0x29
sample
command none
parameterex
plain
return none
expected
result
return none
parameter
explain
remark if 向均衡服务器发送该数据，均衡服务器应该对设备进行数据采集服务器地址的 setup 。
4.3 GPS command
4.3.1 setup /check GPS location data upload channel and interval
command 0x20 0x01 –> 0x20 0x81
word
Function setup /check GPS location data upload channel and interval
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x20 0x01 0x00 0x06 0x01 0x00 0x00 0x1E 0x00
sample 0x00 0x1B 0x29 //setup
command setup ： 0x01 0x00 0x00 0x1E 0x00 0x00the 1st 0x01represent setup 。the 2nd byte
parameterex represent 上传通道，0x00represent GPRS 通道上传，0x01represent 短信通道上传，第
plain 三和第四个字节 represent 点火上传的间隔，Unit S，0x00 0x1E 上传间隔为 30S，取值 5
– 1000S。setup 为 0represent 丌上传，default 15S。第五和第六个字节 represent 熄
火上传的间隔，Unit S，0x00 0x00 上传间隔为 0S，取值 5 – 1000S。setup 为 0represent
丌上传，default 0S。
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x20 0x81 0x00 0x05 0x00 0x00 0x1E 0x00 0x00
expected 0x97 0x29
result
return Same as bove
parameter
explain
remark
4.3.2 Request/ Upload GPS location data
command 0x20 0x02 –> 0x20 0x82
word
Function setup /check GPS location data

command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x20 0x02 0x00 0x01 0x00 0x16 0x29 //请求
sample
command check ：0x00represent check
parameterex
plain
expected 0x04 0x14 0x09 0x00 0x04 0x22 0x43 0x88 0x16 0x11 0x34 0x91 0x23 0x97 0x00
result 0x60 0x09 0x17 0x94 0xD0 0x00 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0xA5 0xDF
0x29
parameter 0x97 0x00 0x60 0x09 0x17 0x94 0xD0 0x00 0x00 0x01 0x00 0x00 0x00 0x00 0x03
explain 0x00 0x000xA5 is command contents，33 个字节，detailed meaning refer to (表八)
remark 0x20 0x82 为主劢上传 GPS 信息指令，上传的间隔和通道由 4.3.1setup 。当然也可以通过
0x20 0x02 单次请求，当设备收到中心的单次请求以后，设备将主劢上传一次 0x20 0x82 的
GPS 位置信息，上传间隔也跟着顺延。
if 现在 setup 的混合信息上传，通过 0x20 0x02 单独请求一条位置信息将得丌到回复，而
应该通过 0x20 0x04 去请求位置信息
(表八)
No. Structure length explain
1 Data type 1 0x00 or 0x01,其中 0x00represent 盲区数据，0x01represent
实时数据
2 Journey ID 2 用来记录该数据是属于哪个行程
3 Date 3 日月年 represent .年省略”20”。Eg,2014 年 4 月 28 日为 0x28

0x04 0x14，BCD 码 represent
4 time 3 时分秒 represent ,为格林威治时间。Eg,9 点 0 分 4 秒为 0x09
0x00 0x04
5 Latitude 4 实际纬度乘以 10000 的值,DDMM.MMMM 格式，
Eg,2233.4567 则上传 0x22 0x33 0x45 0x67
6 longitude 4.5 实际经度乘以 10000 的值,DDDMM.MMMM 格式，
Eg,11334.5678 则上传 0x11 0x33 0x45 0x67 0x8X。
7 Direction 0.5 GPS 是否定位,东西经及南北纬等.请参见(表九)
8 Speed 1 当前 GPS 速度,以 km/h 为 Unit
9 heading 1 当前方向,以度为 Unit ,设备在上传对其进行了除 2 处理,所以,
系统需乘以 2,则还原为实际方向角度.
10 GPS satellite qty 1 当前 GPS 卫星的个数
11 GSM signal 1 表明当前 GSM 的信号强弱,GSM 信号强度最大为 31.
12 Mileage 4 当设备能读到原车里程的时候，该里程为仦表盘里程。否则为标
定的里程 + GPS 累加里程
13 Device status 4 4 个字节，其中 the 1st byte 暂时保留，the 2nd byte 的定义如
(表十)所示，第三个字节的定义如(表十一)所示，第四个字节(表十
二)所示
14 reserve 2
13 Serial number 1 从 0 -255 一直循环累加，可以用来检测是否有包丢失
(表九)
BITX explain
BIT0 represent GPS located or not,1

represent GPS located,0 represent
GPS blind.
BIT1 represent N or S,1represent
N,0represent S
BIT2 represent E or W,1represent
E,0represent W
BIT3 represent GPS located or LBS located
，0 represent GPS located，
1represent LBS located
(表十)
位序 explaination 1 0
BIT0 续航里程续航里程丌足 50KM 正常
BIT1 发劢机故障发劢机有故障正常
BIT2 冷却液温度低冷却液温度过低正常
BIT3 是否支持该车丌支持支持
BIT4-BIT6 如(表十八)
BIT7 保留
(表十一)
BIT0 ACC 状态 ACC 开 ACC 关(注意：根据产品丌同，有
些信号产品丌支持，default 为
0)
BIT1 左前门状态左前门开左前门关

BIT2 右前门状态右前门开右前门关
BIT3 左后门状态左后门开左后门关
BIT4 右后门状态右后门开右后门关
BIT5 尾箱状态尾箱门门尾箱门关
BIT6 中控锁状态上锁开锁
BIT7 欠压电瓶电压低电瓶电压正常
(表十二)
BIT0 GPS 模块异常正常
BIT1 超速超速正常
BIT2 fatigue fatigue 正常
driving driving
BIT3 充电电路异常正常
BIT4 冷却液温度高过高正常
BIT5 保养提醒需要保养正常
BIT6 节气门清理需要清理正常
BIT7 拔插状态被拔出正常
(表十八)
000(BIT6BIT5BIT4) 001 010 011 100 101 110
未读到汽车协议 KWP CAN(500BPS) CAN(250BPS) CAN_X(500BPS) CAN_X(250BPS) ISO91
41-2
4.3.3 setup /check GPS+OBD Mixed information upload interval
command 0x20 0x03 –> 0x20 0x83
word
Function setup /check GPS+OBD Mixed information upload interval
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x20 0x03 0x00 0x03 0x01 0x00 0x1E 0x1B
sample 0x29 //setup
command setup ： 0x01 0x00 0x1E the first 0x01represent setup 。the 2nd and 3rd byte
parameterex represent Mixed information upload interval，Unit:S，0x00 0x14 upload interval is
plain 30S，value range 5 – 1000S。setup 0 represent Not upload data，default 30S.
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x20 0x83 0x00 0x01 0x00 0x1E 0x97 0x29
expected
result
return Same as above
parameter
explain
remark Mixed data only upload when vehicle ignition on status, and transmit via GPRS
channel only, for device combined OBD and GPS , during vehicle ignition on period,
device default upload mixed data, and not upload separate GPS location data or
OBD data.
4.3.4 Request /upload GPS + OBD mixed data
command 0x20 0x04 –> 0x20 0x84
word
Function Request /upload GPS + OBD mixed data
sample //request
command check ：0x00 represent check
parameterex
plain
result 0x60 0x09 0x17 0x94 0xD0 0x00 0x00 0x01 0x00 0x00 0x00 0xA5 0x43 0x88 0x16
0x11 0x34 0x91 0x23 0x97 0x00 0x60 0x09 0x17 0x94 0xD0 0x00 0x00 0x01 0x00
0x00 0x00 0xA5 0xDF 0x29
return Further explain refer to (Table13)
parameter
explain
remark 0x20 0x84 represent uploading GPS data initiatively， upload interval and channel is
setup by 4.3.3. Also can upload via 0x20 0x04 single request，when device
receive single request from center, device will uploading initiatively one
mixed data of 0x20 0x84 (based on vehicle is ignition on status)，upload
interval also will be postpone. If device setup mixed data upload, when in
bland area, it also will save 60 mixed blind data, when signal recover back,
will upload to server.
If data upload mode is seperate upload, single request won’t get response.
(table 13)
No. Structure Length explain
1 Data type 1 0x00 or 0x01, among 0x00 represent blind data，0x01represent
real time data
2 Journey ID 2 The data belongs to which journey
3 Date 3 Date month year represent . year omit”20”. For example,
2014,April, 28th is 0x28 0x04 0x14，BCD code represent
4 Time 3 Hour minutes second represent is GMT time. For example,
9:0:4 is 0x09 0x00 0x04
5 latitude 4 Pratical latitude multiply by 10000 value,DDMM.MMMM
format，For example,2233.4567, then upload data 0x22 0x33
0x45 0x67
6 longitude 4.5 Pratical longitude multiply by 10000 value,DDDMM.MMMM
format，For example,11334.5678, then upload data 0x11
0x33 0x45 0x67 0x8X
7 course status 0.5 GPS is positioning or not, east and west, south and north etc.
further refer(table 9)
8 Speed 1 Current GPS speed , unit: km/h
9 direction 1 Current direction, Unit: degree, device will divide 2 for the
data, so system need multiply by 2 can get the actual
direction degree.
10 GPS satellite 1 Current GPS satellite quantity
qty
11 GSM signal 1 It indicates that the current GSM signal strength, GSM signal
strength up to 31
12 Mileage 4 When the device is able to read the original vehicle mileage
when the mileage of the dashboard mileage. Otherwise
calibrated mileage + OBD accumulate mileage, Unit KM
13 Device status 4 4 bytes, where the 1st byte escrow, the 2nd byte is defined as
(Table 10), the third byte as defined in (Table 11), the fourth
byte as (table 12)
14 The 1 BYTE*100/255，Unit %
calculated
value of load
15 coolant 1 BYTE – 40，Unit ℃
temperature
16 Engine speed 2 ((BYTE1*256)+BYTE2)/4，(如 0x30 0x08 则 0x30represent
BYTE1，0x08represent BYTE2，The following similar, not
repeat)，Unit RPM
17 OBD vehicle 1 Unit KM/H
speed
18 ignition 1 BYTE – 64，Unit °
advance
angle
19 manifold 1 BYTE，Unit kpa
absolute
pressure
20 control 1 BYTE/10，Unit V
module
voltage
21 Inlet 1 BYTE-40，Unit ℃
temperature
22 air mass flow 2 ((BYTE1*256)+BYTE2)/1000，Unit g/s
23 Throttle 1 BYTE*100/255，Unit %
position
24 Long-term 1 (BYTE1-128)*100/128，Unit %
fuel
correction
25 Air-fuel ratio 2 ((BYTE1*256)+BYTE2)*0.0000305
coefficient
26 Throttle 1 BYTE*100/255，Unit %
absolute
position
27 fuel pressure 1 BYTE*3,Unit kpa
28 Instent Fuel 2 ((BYTE1*256)+BYTE2)*0.1,Unit L/H
consumption
L/H
29 remaining 2 if((BYTE1&0X80)==0X80)
fuel ((BYTE1-0X80)*256)+BYTE2)*0.1 Unit %
Else (BYTE1*256+BYTE2)*0.1 Unit L
30 serial number 1 Cycle from 0-255 has been accumulated, it can be used to
detect whether there is packet loss
4.3.5 setup /check GPS and OBD data upload method
command 0x20 0x05 –> 0x20 0x85
word
Function setup /check GPS and OBD data upload method
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x20 0x05 0x00 0x02 0x01 0x00 0x1B 0x29
sample //setup
command setup ： 0x01 0x00 the first 0x01represent setup 。the 2nd byte is 0x00 represent
parameterex adopt mixed data upload method ( after ignition off, the upload location still
plain transmit as 0x20 0x02), when the 2nd byte is 0x01 represent location data and OBD
data upload its seperate interval to transmit. Default adopt mixed data upload.
expected
result
parameter
explain
remark Mixed messages only when the ignition upload, upload only through GPRS channel,
in product both have OBD and GPS, during ignition, as long as the interval setup is
not 0, then no matter 4.3.1 and 4.4.1setup interval is what value, are the
parameters to prevail
4.4 OBD command
4.4.1 setup /check OBD data flow upload interval
command 0x30 0x01 –> 0x30 0x81
word
Function setup /check OBD data flow upload interval
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x01 0x00 0x03 0x01 0x00 0x1E 0x1B
sample 0x29 //setup
command setup ： 0x01 0x00 0x1E first 0x01represent setup . the 2nd and 3rd byte represent
parameterex OBD data flow upload interval, Unit: S，0x00 0x14 upload interval is 30S，value range
plain 5 – 1000S。setup 0 represent Not upload，default 30S.
expected
result
parameter
explain
remark OBD only upload when ignition on via GPRS channel.
4.4.2 request/ upload OBD data flow
command 0x30 0x02–> 0x30 0x82
word
Function request/ upload OBD data flow
sample //request
command check ：0x00 represent check
parameterex
plain
result 0x01 0x28 0x04 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x00 0x23 0xDF 0x29
return Details refer to (table 14)
parameter
explain
remark 0x30 0x82 is initiative upload OBD data streams, uploaded interval and channel is
setup by b 4.4.1. Of course, it can also be 0x30 0x02 single request, When the device
receives a request for a single center, the device will take the initiative to upload a
mix of information 0x30 0x82 (ignition premise), upload interval followed
postponed.
if mixed mode data upload upload information, the request will not be a single reply
(table 14)
No. data name length Calculation Unit
1 data type 1 0x00 or 0x01,其中 0x00represent Blind
data，0x01represent real time data
2 Driving ID 2 represent The data belongs to which
stroke
3 Date 3 Month Year represent . year ignore 年”
20”. Eg,2014,April 28th is 0x28 0x04
0x14，BCD code represent
4 Time 3 Minutes and seconds represent , GMT
time, Eg,9:00:04 is 0x09 0x00 0x04
5 Calculated load 1 BYTE*100/255 %
℃
6 Engine coolant 1 BYTE-40
temperature
7 Engine RPM 2 ((BYTE1*256)+BYTE2)/4，(如 0x30 0x08 rpm
则 0x30represent BYTE1，
0x08represent BYTE2，The following
similar, not repeat)
8 Vehicle speed 1 BYTE Km/h
9 Ignition advance 1 BYTE - 64 °
angle
10 Intake manifold 1 BYTE kpa

absolute pressure
11 Voltage control 1 BYTE/10 V
module
℃
12 Intake air temperature 1 BYTE-40
13 air mass flow 2 ((BYTE1*256)+BYTE2)/1000 g/s
14 Throttle position 1 BYTE*100/255 %
15 Long-term fuel 1 (BYTE1-128)*100/128 %
correction
16 Air-fuel ratio 2 ((BYTE1*256)+BYTE2)*0.0000305
coefficient
17 Throttle absolute 1 BYTE*100/255 %
position
18 fuel pressure 1 BYTE*3 kpa
19 Mileage 4 BYTE1<<24 + BYTE2<<16 + m
BYTE3<<8 +BYTE4
20 device status 4 same as (table 8) device status
21 reserve 4
22 serial number 1 Cycle from 0-255 has been
accumulated, it can be used to detect
whether there is packet loss
4.4.3 setup /check vehicle type
command 0x30 0x03 –> 0x30 0x83

word
Function setup /check vehicle type
sample 0x1B 0x29 //setup
command setup ： 0x01 0x03 0x00 0x46 the 1st 0x01 represent setup 。The second and third
parameterex bytes representative of the vehicle, see (Table 15). The third byte represents the
plain volume of the tank, only GM and Honda models calibration needs.
check：0x00 represent check
expected 0x29
result
parameter
explain
remark Since the remaining fuel Honda and GM read is%, it is necessary to calibrate the
volume of mail to facilitate the calculation of residual fuel and mileage.
(table 15)
Code Vehicle type
00 00 standard vehicle
01 00 Volkswagen
02 00 Toyota
03 00 Honda
04 00 Nissan
05 00 Ford
06 00 GM
07 00 KIA
08 00 Hyundai
0E 00 Mark/Citroen
4.4.4 check vehicle VIN code
command 0x30 0x04 –> 0x30 0x84
word
Function check vehicle VIN code
sample
command check ：0x00represent check ，the command has only check
parameterex
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x84 0x00 0x11 0x4C 0x53 0x56 0x48
expected 0x4A 0x31 0x33 0x33 0x30 0x32 0x32 0x32 0x32 0x31 0x37 0x36 0x31 0x97 0x29
result
return 0x4C 0x53 0x56 0x48 0x4A 0x31 0x33 0x33 0x30 0x32 0x32 0x32 0x32 0x31 0x37
parameter 0x36 0x31 is instruction content, fixed at 17 bytes VIN code, which is converted to
explain ASCII code LSVHJ133022221761，if failed to read VIN code will return 17 bytes ASCII
0.
remark
4.4.5 Vehicle examination
command 0x30 0x05 –> 0x30 0x85
word
Function Vehicle examination

sample
command check ：0x00 represent check ，the command only for check
parameterex
plain
expected
result
return 0x00 0x01is command contents，the 1st byte 0x00 temperary reserve, 0x01
parameter meanings (Table 16) shown.
explain
remark
(table 16)
BIT7 BIT6 BIT5 BIT4 BIT3 BIT2 BIT1 BIT0
0 Lack of endurance Idle Idle Good Good Normal Normal Engine
50KM(vehicle that can speed speed coolin drainag throttle power trouble-f
read remaining fuel is too is too g e opening supply ree

support it ) low high system system circuit system
1 Normal Norma Norma Coolin Abnor Abnorm Power Engine
l l g mal al circuit system is
System dischar throttle error malfunct
Abnor ge opening ioning
mal system
4.4.6 Clear DTC engine system
command 0x30 0x06 –> 0x30 0x86
word
Function Clear DTC engine system
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x06 0x00 0x01 0x01 0x1B 0x29 //清除
sample
command 0x01represent Clear DTC engine system
parameterex
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x86 0x00 0x00 0x97 0x29
expected
result
return Reply to this instruction represents device has been executed to clear the engine
parameter fault code, because some fault code does not clear, it does not mean that fault light
explain will certainly go out. Also clear DTCs does not mean fault solved.
remark
4.4.7 check engine DTCs
command 0x30 0x07 –> 0x30 0x87
word
Function
check DTCs engine system
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x07 0x00 0x01 0x00 0x1B 0x29 //clear
sample
command 0x00represent check engine DTCs
parameterex
plain
expected 0x29
result
return 0x01 0x23 0x01is instruction content, each fault code consists of 3 bytes, so the
parameter content of the instruction length must be a multiple of three . The first byte is the
explain high fault code, the second byte is the lower fault code, the first 3 bytes 01 represent
has already decided, 02 represent pending, the bytes can be ignored. Please refer to
the specific interpretation (Fig. 1), so that the fault code according to the figure 0
into P0, the first three bytes removed, turned into P0123
remark
(Fig.1)
4.4.8 Upload driving report
command 0x30 0x88
word
Function Upload driving report
command none
sample
command none
parameterex
plain
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x88 0x00 0x4C 0x00 0x03 0x04 0x05
result 0x00 0x65 0x12 0x45 0x23 0x00 0x00 0x45 0x04 0x05 0x00 0x00 0x14 0x03 0x12
0xDF 0x29
return Details refer to (table 17)
parameter
explain
remark Upload automatically uploads every instruction after flameout Trip Report
(table 17)
No. Structure member name lengt explaination
1 Journey ID 2 represent the report is belongs to which
journey
2 Ignition on date 3 Month year represent . year ignore”20”，BCD
code represent
3 Ignition on time 3 Hour minutes represent is GMT time. BCD
coderepresent
4 Ignition off date 3 Same above (ignition on time and off time is the
GPS time, the following time is accumulated time

the timer device, Unit S, each time the ignition
flame subtract time and below the accumulated
time may be a few errors S)
5 ignition off time 3 Same above
6 The Journey time 2 Unit S，The time is accumulated time the timer
device, when GPS time is invalid when the time is
displayed with the available time
7 fuel consumption 4 Unit ML
8 mileage 4 Unit M
9 highest speed 1 KM/H
10 Engine highest RPM 2 ((BYTE1*256)+BYTE2)/4,Unit rpm
11 Coolant highest temp. 1 BYTE - 40
12 Rapid acceleration times 1 次
13 Rapid deceleration times 1 次
14 Speeding time (>120km/h) 2 Unit S
15 Mileage when Speeding 4 Unit M
16 Fuel consumption when speeding 4 Unit ML.
17 High Speeding driving time 2 S
(80km/h-120km/h)
18 mileage of high speed driven 4 M
19 fuel consumption of high speed 4 Unit ML.
driven
20 Middle speed driving time 2 S

(40km/h-80km/h)
21 Mileage of Middle speed driving 4 M
22 fuel consumption of Middle speed 4 Unit ML.
driving
23 time of low peed driving 2 S
(1km/h-40km/h)
24 mileage onsumption of low peed 4 M
driving
25 fuel consumption of low peed 4 Unit ML.
driving
26 idle speed time 2 S
27 idle speed fuel consumption 4 ML
28 Sharp turning times 1 次
4.4.9 Ignition on /off report
command 0x30 0x89
word
Function Ignition on /off report
command none
sample
command none
parameterex
plain
expected 0x04 0x14 0x09 0x00 0x04 0xDF 0x29 // ignition on report without GPS location
0x04 0x14 0x09 0x00 0x04 0xDF 0x29 // ignition off report without GPS location
0x04 0x14 0x09 0x00 0x04 0x22 0x43 0x88 0x16 0x11 0x34 0x91 0x23 0x97 0xDF
0x29 // ignition on report with GPS location
0x04 0x14 0x09 0x00 0x04 0x22 0x43 0x88 0x16 0x11 0x34 0x91 0x23 0x97 0xDF
0x29 // ignition off report with GPS location
return default product with GPS function: ignition off report with GPS location， product
parameter without GPS function: ignition off report without GPS location。Details refer to(table
explain 5).
the 1st byte represent ignition on off， where the 0x01 represent ignition on ，0x00
represent ignition off. the 2nd byte and 3rd byte 0x00 0x03 represent journey ID. The
latter 6 btes 0x28 0x04 0x14 0x09 0x00 0x04 represent date time, format is date
month year hour minute second, Details refer to (table 5). 0x22 0x43 0x88 0x16 0x11
0x34 0x91 0x23 0x97 represent location data，Details refer to (table 5).
remark Upload automatically uploads every instruction after flameout Trip Report
4.4.10 setup /check if read OBD data
command 0x30 0x0A –> 0x30 0x8A
word
Function setup /check if read OBD data

command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x0A 0x00 0x01 0x01 0x01 0x1B 0x29
sample //setup
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x0A 0x00 0x01 0x00 0x1B 0x29 //check
command setup ： 0x01 0x01the 1st 0x01represent setup . The 2nd represent read or not，
parameterex 0x01represent read OBD data，0x00represent failed to read OBD data.
plain check ：0x00represent check
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x8A 0x00 0x01 0x00 0x97 0x29
expected
result
parameter
explain
remark Device default not read
4.4.11 setup /check vehicle average fuel consumption
command 0x30 0x0B –> 0x30 0x8B
word
Function
setup /check vehicle average fuel consumption
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x0B 0x00 0x01 0x01 0x62 0x1B 0x29
sample //setup
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x0B 0x00 0x01 0x00 0x1B 0x29 //check
command setup ： 0x01 0x62the 1st 0x01represent setup . the 2nd represent vehicle average
parameterex fuel consumption (multiply 10)，0x62 = 98, namely average fuel consumption is
plain 9.8h/100km
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x30 0x8B 0x00 0x01 0x62 0x97 0x29
expected
result
return Same as bove
parameter
explain
remark setup Fuel settings apply only to car OBD data do not support, support for data read
OBD car, this setting is invalid, the device does not return.
4.5 Remote upgrade command
4.5.1 Notify device upgrades
command 0x40 0x01
word
Function Server Notify device upgrades
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x01 0x00 0x13 0x00 0x5A 0x4A 0x38
sample 0x30 0x30 0x30 0x5F 0x32 0x30 0x31 0x34 0x30 0x34 0x30 0x35 0x41 0x01 0x56
0xDF 0x29
command the 1st byte fixed 0x00,represent notify upgrade 0x5A 0x4A 0x38 0x30 0x30 0x30
parameterex 0x5F 0x32 0x30 0x31 0x34 0x30 0x34 0x30 0x35 0x41 0x01 0x56: the front 16 bytes
plain represent the software version is ZJ8000_20140405A，the dveice software hardware
fixed 16 bytes, the latter 2 bytes 0x01 0x56 represent the firmware data number,
342 data.
After the device receives the command, the first comparative product model ZJ8000
is the same, if different direct refusal upgrade. Then compare the version number
20140405A, if the version number of the device software version number is now the
same decline an upgrade, otherwise the upgrade instructions agreed reply
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x81 0x00 0x11 0x01 0x5A 0x4A 0x38
expected 0x30 0x30 0x30 0x5F 0x32 0x30 0x31 0x34 0x30 0x34 0x30 0x34 0x41 0xDF 0x29
result //agree upgrade
0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x81 0x00 0x11 0x00 0x5A 0x4A 0x38
0x30 0x30 0x30 0x5F 0x32 0x30 0x31 0x34 0x30 0x34 0x30 0x35 0x41 0xDF 0x29 //
version same refuse to upgrade
return Return parameters from the device and agree to upgrade the current version
parameter number，where the 1st byte represent agree upgrade or not，where 0x01represent
explain agree upgrade，0x00 represent refuse to upgrade。The after 16 bytes represent
current version
remark if a part of the upgrade, need to upgrade again, also by issuing this command to
start again. When the device agree upgrade, start by sending firmware 0x40 0x02
packets, No one. From 1
4.5.2 send firmware data packet
command 0x40 0x02
word
Function Server send firmware data packet to device

sample 0x14 0x00…… 0x08 0xDF 0x29
command 0x02 0x00: command length，the command length fixed at 0x02 0x00
parameterex 0x01 0x01 0x34 0x05 0x14 0x00…… 0x08: the 1st byte fixed at 0x01,represent
plain operate method， Write data to the device. Second three 2 bytes 0x01
0x34represent firmware package No. (No. 1 from the beginning ......), immediately
followed by 509 bytes of data, of which the first 508 bytes of the firmware (BIN file)
hexadecimal data, less than 508 make up the complement of 0xFF. The first 509
bytes of the previous 508 bytes of 8-bit CRC. CRC polynomial equivalent tentatively
CRC = X8 + X5 + X4 + 1. The center to upgrade BIN file as 508 bytes sequentially
intercepted sent to the device, the last data packet if less than 508 bytes, then make
up 0xFF.
expected 0x35 0xDF 0x29 //save correct, request send next data
0x34 0xDF 0x29 //save wrong, request send next data， Since flash is sub-sector
erase, it requests the next data transmission is not necessarily just sent that piece of
data
return Parameters returned consists of three parts，the 1st byte represent save successfully
parameter or not, where the 0x01 represent save successfully，0x00 represent failed to save. the
explain 2nd and the 3rd 0x01 0x34 represent the data packet received just now 4th and 5th
bytes represent No of server going to send the next data.
remark Escaped before the directive length fixed

4.5.3 cancel upgrade command
command 0x40 0x03
word
Function cancel upgrade command
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x03 0x00 0x01 0x01 0xDF 0x29
sample
command 0x01represent cancel upgrade command
parameterex Just before the entire packet firmware (BIN file) does not send complete, you can
plain cancel the upgrade by U03, the device receives the instruction, the upgrade will clear
all parameters, erasing upgrade file storage area
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x83 0x00 0x00 0xDF 0x29
expected
result
return none
parameter
explain
remark
4.5.4 The firmware upgrade packet transfer execution
command 0x40 0x04
word
Function Finish The firmware upgrade packet transfer execution
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x04 0x00 0x01 0x01 0xDF 0x29
sample
command 0x01represent Finish irmware upgrade packet transfer execution
parameterex After as long as the entire firmware package (BIN file) transmission is completed,
plain send the command to perform the upgrade equipment
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x84 0x00 0x01 0x01 0xDF 0x29 //
expected execution upgrade
result 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x84 0x00 0x01 0x00 0xDF 0x29 // refuse
upgrade
return 0x01represent device inspection data is correct, agreed to perform the upgrade.
parameter 0x00 represent the received data is incomplete, refused to upgrade
explain
remark
4.5.5 check No. of next data of firmware
command 0x40 0x05
word
Function finish upgrade packet transfer execution
command 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x05 0x00 0x11 0x00 0x5A 0x4A 0x38
sample 0x30 0x30 0x30 0x5F 0x32 0x30 0x31 0x34 0x30 0x34 0x30 0x35 0x41 0xDF 0x29
command 0x00 0x5A 0x4A 0x38 0x30 0x30 0x30 0x5F 0x32 0x30 0x31 0x34 0x30 0x34 0x30
parameterex 0x35 0x41the 1st byte 0x00represent check ，0x5A 0x4A 0x38 0x30 0x30 0x30 0x5F
plain 0x32 0x30 0x31 0x34 0x30 0x34 0x30 0x35 0x41represent the upgrading version is
ZJ8000_20140405A, the command represent check ZJ8000_20140405A the firmware

version need to send the next packet number
return 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x85 0x00 0x03 0x01 0x01 0x35 0xDF
expected 0x29
result 0x28 0x30 0x14 0x04 0x14 0x00 0x01 0x40 0x85 0x00 0x03 0x00 0x00 0x01 0xDF
0x29 // And now being upgraded version of the device has never downloaded or
different, from the 1st to start sending data packets
return Return parameter the 1st byte represent Download now and check the version
parameter number is the same as the version number, the same as the byte is 0x01, not the
explain same as the byte 0x00. Packet No. Under the 2nd byte and the third byte represent
one to be sent, when the 1st byte to 0x00, 0x00 0x01 packet was No.
remark
4.6 Peripheral extension commands
5. SMS command
SMS format Function explanation
AT+HOSTS? check IP port
AT+HOSTS=8.8.8.8,8888 setup IP port
AT+APN? check APN
AT+APN=CMNET setup APN
AT+VERSION? check version
AT+MAP check real time GPS location
AT+RESET reset device

G500 OBD Protocol-01

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

G500 OBD Protocol-01

Uploaded by

Copyright:

Available Formats

PRODUCT PROTOCOL

corresponding command is null. Such as (Table 1) shown

command type(1st byte of explaination

General 0x00 This command is suitable for all types of products,

command including check product software version, manufacturer,

product ID, restart the self-test equipment, alarms and

other equipment etc.

command related, including setting IP address, port, whether to

enable the base station location, etc.

GPS 0x20 This type of command is mainly used for GPS-related

command functions, including GPS data uploaded regularly, upload

interval, uploading method, etc.

command functions, including uploading, travel reports OBD data

upload, upload interval, methods

Upgrade 0x40 The product is mainly used in Type Command equipment

supports this feature

Peripheral 0x50 The type command is used to load a variety of peripheral

command products after preparation, various peripherals, the

command type corresponding different and each is

3.2 protocol format

Unified protocol format such as (Table II) shown

no. Name Length Explaination

1 Starting 1 Fixed to 0x28, ie the ASCII '(' character.

2 Device ID 6 Device ID number, a fixed 6-byte length (ie 12 ASCII

number characters, BCD code means 2 product code, 2 code

represent the year of production, 2013 that is expressed by

13, 4 represent month and date, the remaining 4 represent

the number of production date, from 0000-9999. of course,

the ID may be set according to customer requirements into

3 Command 2 A byte command type (Table I), a byte represent command

word number, further details see protocol

4 length 2 The length of command contents (before escaping)

5 contents undefi 1: Downstream’s first byte represents mode of operation

ne (set to 0x01, the query is 0x00), the second byte is undefined

byte Parameter , query command generally without

2: the instruction includes only the uplink variable byte

6 check 1 the bytes of XOR, and (former escape) from product ID

number to the command contents

7 Ending byte 1 Fixed 0x29,ie. ASCII”)”byte.

0x3D itself needs to be escaped. Ie. '(' escaped as 0x3D 0x15.

4.1 general command

4.1.1 Get equipment manufacturers

Function check product manufacturer name

parameterex number，0x00 0x0 is command word， 0x00 0x01 is command length，0x00is

parameters ，0x35 is checksum (Agreement in the presentation and maybe accurate

calibration)，0x29 is ending character (The following protocol describes only the

contents of the command, the other will not be repeated).

result 0x6A,0x7A,0x6A,0x78,0x64,0x2E,0x63,0x6F,0x6D 0xC8 0x29

parameter number ， 0x00 0x81 is command word，0x00 0x0E is command

explain length ,0x77,0x77,0x77,0x2E,0x62,0x6A,0x7A,0x6A,0x78,0x64,0x2E,0x63,

为校验和，0x29 is ending byte.

remark the commands only has check ，no setup 。

4.1.2 Get software version number

command 0x00 0x02 –> 0x00 0x82

Function check product firmware version

command 0x00 is command contents represents operation type is Check

parameter 0x41 is command contents ,ie version No. is ZJ8000_20140404A

remark the command only have check without setup

4.1.3 set/check device ID number

command 0x00 0x03 –> 0x00 0x83

sample 0x14 0x00 0x01 0x05 0x29 //setup

plain number(parameter), 6 bytes

actual value 10 is actual value 10，default