Cellocator Manual GPS

Cellocator Cello
Programming Manual
Proprietary and Confidential
Version 5.2.0.0
Revised and Updated: January 20, 2015
Copyright © 2015 by Pointer Telocation, Ltd.

Cellocator Cello Programming
Manual
Legal Notices
IMPORTANT
1. All legal terms and safety and operating instructions should be read thoroughly before
the product accompanying this document is installed and operated.
2. This document should be retained for future reference.
3. Attachments, accessories or peripheral devices not supplied or recommended in
writing by Pointer Telocation Ltd. May be hazardous and/or may cause damage to the
product and should not, in any circumstances, be used or combined with the product.
General
The product accompanying this document is not designated for and should not be used in
life support appliances, devices, machines or other systems of any sort where any
malfunction of the product can reasonably be expected to result in injury or death.
Customers of Pointer Telocation Ltd. Using, integrating, and/or selling the product for use
in such applications do so at their own risk and agree to fully indemnify Pointer Telocation
Ltd. For any resulting loss or damages.
Warranty Exceptions and Disclaimers

Pointer Telocation Ltd. Shall bear no responsibility and shall have no obligation under the
foregoing limited warranty for any damages resulting from normal wear and tear, the cost
of obtaining substitute products, or any defect that is (i) discovered by purchaser during
the warranty period but purchaser does not notify Pointer Telocation Ltd. Until after the
end of the warranty period, (ii) caused by any accident, force majeure, misuse, abuse,
handling or testing, improper installation or unauthorized repair or modification of the
product, (iii) caused by use of any software not supplied by Pointer Telocation Ltd., or by
use of the product other than in accordance with its documentation, or (iv) the result of
electrostatic discharge, electrical surge, fire, flood or similar causes. Unless otherwise
provided in a written agreement between the purchaser and Pointer Telocation Ltd., the
purchaser shall be solely responsible for the proper configuration, testing and verification
of the product prior to deployment in the field.
POINTER TELOCATION LTD.’S SOLE RESPONSIBILITY AND PURCHASER’S SOLE REMEDY
UNDER THIS LIMITED WARRANTY SHALL BE TO REPAIR OR REPLACE THE PRODUCT
HARDWARE, SOFTWARE OR SOFTWARE MEDIA (OR IF REPAIR OR REPLACEMENT IS NOT
POSSIBLE, OBTAIN A REFUND OF THE PURCHASE PRICE) AS PROVIDED ABOVE.
POINTER TELOCATION LTD. EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES OF ANY
KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, SATISFACTORY
PERFORMANCE AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL
POINTER TELOCATION LTD. BE LIABLE FOR ANY INDIRECT, SPECIAL, EXEMPLARY,
INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOSS
OR INTERRUPTION OF USE, DATA, REVENUES OR PROFITS) RESULTING FROM A BREACH
OF THIS WARRANTY OR BASED ON ANY OTHER LEGAL THEORY, EVEN IF POINTER
TELOCATION LTD. HAS BEEN ADVISED OF THE POSSIBILITY OR LIKELIHOOD OF SUCH
DAMAGES.
Cellocator Cello Programming Manual Page 2 of 365

Manual
Intellectual Property
Copyright in and to this document is owned solely by Pointer Telocation Ltd. Nothing in
this document shall be construed as granting you any license to any intellectual property
rights subsisting in or related to the subject matter of this document including, without
limitation, patents, patent applications, trademarks, copyrights or other intellectual
property rights, all of which remain the sole property of Pointer Telocation Ltd. Subject to
applicable copyright law, no part of this document may be reproduced, stored in or
introduced into a retrieval system, or transmitted in any form or by any means
(electronic, mechanical, photocopying, recording or otherwise), or for any purpose,
without the express written permission of Pointer Telocation Ltd.
© Copyright 2015. All rights reserved.

Manual
Table of Contents
1 Introduction ............................................................................................................ 17
1.1 About this Document ...................................................................................................17
1.2 Applicability Table .......................................................................................................17
1.3 References .................................................................................................................18
1.4 Document Conventions ................................................................................................18
2 Accessing the Configuration Memory via Wireless Channel (OTA) .......................... 19
3 Accessing the Configuration Memory via Direct Wire Interface ............................... 20
4 Event Types generated by Cellocator devices .......................................................... 20
4.1 Logged (Plain) Event ...................................................................................................20
4.2 HRLS Event ................................................................................................................20
4.3 Distress Event ............................................................................................................20
4.4 Security Event ............................................................................................................21
4.5 Active Logged (Plain) Event (CelloTrack-T/Nano only) ......................................................21
5 Address and Bitmask Field Allocation Tables ........................................................... 23
5.1 Address Allocation Table ..............................................................................................23
5.2 Bitmask Field Allocations ..............................................................................................42
5.2.1 Application Configuration .............................................................................................43
5.2.2 Communication Settings in Home/Roam GSM Network Mode ............................................46
5.2.3 WAKE UP Message Configuration ...................................................................................46
5.2.4 GPS Management Bitmap .............................................................................................46
5.2.5 Maintenance Server Configuration Bitmap ......................................................................47
5.2.6 GSM Band / GPRS Auth Type Programming ....................................................................47
5.2.7 UART Configuration .....................................................................................................47
5.2.8 Alternative Inputs Usage Bitmap ...................................................................................47
5.2.9 Inputs Triggering Distress Voice Call ..............................................................................48
5.2.10 Speaker of Hands Free - Mute settings, CR300 Outputs Control ........................................48
5.2.11 CR300B 3G I/O control ................................................................................................49
5.2.12 Volume and Gain Control Byte ......................................................................................49
5.2.13 Time Based Mask Bitmap .............................................................................................49
5.2.14 Over (and Idle) Speed Session Control Bitmap ................................................................50
5.2.15 Go/Halt Session Control Bitmap ....................................................................................50
5.2.16 GPS Alerts Mask Bitmap ...............................................................................................50
5.2.17 Time Report Period Value (Home, Roam, High Speed) .....................................................51
5.2.18 Time/Distance Alert Multipliers for High Speed Mode .......................................................51
5.2.19 Mask of Authentication Alerts ........................................................................................51
5.2.20 Discrete Inputs Masks ..................................................................................................52
5.2.21 Mask of Analog Inputs Alerts ........................................................................................52
5.2.22 GP Frequency Input Configuration Byte ..........................................................................53
5.2.23 Violation of Additional GP Frequency Thresholds ..............................................................53
5.2.24 Outputs Inversion Mask ...............................................................................................53

Manual
5.2.25 Geo-Fence Alert Mask ..................................................................................................54

5.2.26 Silent Delay Configuration ............................................................................................54
5.2.27 Offline Tracking - Auto Upload Configuration ...................................................................54
5.2.28 Security Settings Bitmask 1 ..........................................................................................54
5.2.29 Security Settings Bitmask 2 ..........................................................................................54
5.2.30 Security Logic Configuration .........................................................................................55
5.2.31 Feedbacks / Alarm Triggered / Alarm Cadence Outputs ....................................................55
5.2.32 Active Correlation Lines................................................................................................55
5.2.33 Vector Change Detection Bitmask ..................................................................................55
5.2.34 Garmin Configuration ...................................................................................................56
5.2.35 Feedback for Driver Behavior Violations Bitmask .............................................................56
5.2.36 Driver Behavior Continuous Violation - Feedback Bitmask.................................................56
5.2.37 Driver Behavior Continuous Violation - Output Activation Template ...................................57
5.2.38 Driver Behavior Continuous Violation - Feedback Logic .....................................................57
5.2.39 Driver Behavior Momentary Violation - Output Activation Template ...................................58
5.2.40 Outputs, Auto-Activated upon Jamming Detection ...........................................................58
5.2.41 Accelerometer Configuration .........................................................................................60
5.2.42 Towed Mode Configuration ...........................................................................................60
5.2.43 Cello AR Keyboard Configuration Bitmask .......................................................................61
5.2.44 Cello AR: Alarm Cadence duration and cycles .................................................................61
6 Communication and Configuration .......................................................................... 62
6.1 Communication Settings ..............................................................................................62
6.1.1 GPRS Settings ............................................................................................................62
6.1.2 SMS Settings ..............................................................................................................73
6.1.3 Comm. Permissions in Home/Roam Network ...................................................................74
6.1.4 COM port settings .......................................................................................................76
6.1.5 1-Wire port settings ....................................................................................................78
6.1.6 Data Forwarding from COM Port ....................................................................................80
6.1.7 PSP Configuration........................................................................................................83
6.1.8 Garmin: Integration of CU with Garmin Terminals ...........................................................85
6.1.9 Cellocator MDT100 ......................................................................................................87
6.1.10 Transparent Data Mode over COM Port...........................................................................88
6.1.11 Distress Session Configuration ......................................................................................91
6.1.12 Wake Up Messages ......................................................................................................92
6.1.13 Offline Tracking ...........................................................................................................93
6.1.14 Cell ID Based Location (Neighborhood list of the serving GSM cell) ....................................95
6.1.15 Internal Accelerometer Configuration .............................................................................99
6.1.16 Roaming List, GSM Operator Management .................................................................... 101
6.1.17 GSM Jamming Detection & Reaction (Not Supported by 3G units) ................................... 104
6.1.18 Other Configuration Parameters related to Communication Settings ................................ 111
6.1.19 Business/Private Mode Toggling Flow Chart .................................................................. 114
6.2 GPS Calibration ......................................................................................................... 115
6.2.1 Base Unit (Measurement Factor of GPS Odometer) ........................................................ 115
6.2.2 GPS Odometer Current Value ...................................................................................... 116

Manual
6.2.3 Report Max. Speed instead of Real Time Speed ............................................................. 116
6.2.4 Enable Voice Call Unsolicited Serial Status Messages ..................................................... 116
6.2.5 Enable IMEI Transmission via Type 0 Message .............................................................. 117
6.2.6 Enable GPS Navigation Start-Stop updates ................................................................... 117
6.2.7 GPS Navigation Start/Stop filter .................................................................................. 117
6.2.8 Enable Tight GPS PMODE Filter ................................................................................... 117
6.2.9 GPS DOP Threshold ................................................................................................... 118
6.2.10 Synchronize Unit’s Time with GPS Time only when GPS is Navigating .............................. 118
6.2.11 Velocity Threshold for HIGH SPEED Mode ..................................................................... 118
6.2.12 GPS Maintenance Updates .......................................................................................... 119
6.2.13 GPS Odometer Management ....................................................................................... 120
6.2.14 GPS Reset Settings .................................................................................................... 121
6.2.15 Vehicle’s Driver speed delta relative to GPS speed ......................................................... 122
6.3 Inputs & Outputs....................................................................................................... 123
6.3.1 Discrete Inputs Triggering Time Filters ......................................................................... 123
6.3.2 Analog Measurement Averaging Time .......................................................................... 126
6.3.3 Inputs in OTA Message .............................................................................................. 127
6.3.4 Enable Monitoring Logical Status of Ignition in OTA Packets ............................................ 127
6.3.5 Enable Warning Output Activation during Gradual Immobilization .................................... 127
6.3.6 Outputs Pulse Width Period ........................................................................................ 127
6.3.7 LED Management ...................................................................................................... 128
6.3.8 Analog (& Frequency) Inputs in OTA Message ............................................................... 131
6.3.9 Feedback Outputs ..................................................................................................... 132
6.3.10 Outputs Inversion Mask ............................................................................................. 133
6.3.11 Usage Counter Configuration ...................................................................................... 133
6.3.12 Frequency Metering ................................................................................................... 135
6.3.13 Modem & SIM ........................................................................................................... 145
6.3.14 Modem Reset Settings ............................................................................................... 147
6.3.15 GSM Band & GPRS Auth Type ..................................................................................... 148
6.3.16 SIM PIN ................................................................................................................... 150
6.4 Power Management ................................................................................................... 152
6.4.1 Power Management Mode ........................................................................................... 152
6.4.2 Enable Automatic Hibernation on Low Power ................................................................. 153
6.4.3 Hibernation Mode Delay ............................................................................................. 153
6.4.4 Enable Pre-Hibernation Update ................................................................................... 153
6.4.5 Enable Data Forwarding from Serial Port by SMS (in Hibernation) ................................... 154
6.4.6 GPS Peeking ............................................................................................................. 154
6.4.7 GSM Peeking ............................................................................................................ 155
6.4.8 Battery Charging ....................................................................................................... 156
6.5 Voice Call Settings (not supported by CelloTrack) .......................................................... 157
6.5.1 Voice Call Destination Number .................................................................................... 157
6.5.2 GSM Related Preferences ........................................................................................... 158
6.5.3 Inputs Triggering Voice Call ........................................................................................ 159
6.5.4 Speaker of Hands Free - Mute Settings ........................................................................ 160

Manual
6.5.5 Volume and Gain Control Byte .................................................................................... 161

6.6 Informative Parameters ............................................................................................. 163
6.6.1 Last Distance Event ................................................................................................... 163
6.6.2 Field for Customer Use ............................................................................................... 163
7 Distance and Speed Events ................................................................................... 164
7.1 Distance Events ........................................................................................................ 164
7.1.1 Enable Distance Updates ............................................................................................ 164
7.1.2 Trip for a Distance Event ............................................................................................ 164
7.1.3 Distance Event Multiplier for HIGH SPEED Mode ............................................................ 164
7.2 Over (and Idle) Speed ............................................................................................... 165
7.2.1 Velocity Threshold for Over Speed Start Event .............................................................. 165
7.2.2 Velocity Threshold for Over Speed End Event ................................................................ 165
7.2.3 Filter of Over Speed Duration...................................................................................... 165
7.2.4 Do not use Time Filter to Close Over Speed Session ...................................................... 166
7.2.5 Alternative Over Speed Threshold for Input Dependent Mode .......................................... 166
7.2.6 Events and Distress Control ........................................................................................ 168
7.3 Sudden Course Changed and Sudden Speed Change Sensors ......................................... 169
7.3.1 Speed Thresholds V0, V1 and V2 ................................................................................. 169
7.3.2 Delta Speed and Delta Course for Speed Range X ......................................................... 170
7.3.3 Events, Distress and HRLS Updates Control .................................................................. 171
7.3.4 Speed Limiting Geo-Fence .......................................................................................... 171
7.3.5 Speed Limiting Geo-Fence Enable ................................................................................ 172
7.3.6 Speed Limiting Geo-Fence Threshold Select .................................................................. 172
7.3.7 Speed Limiting Geo-Fence Threshold ........................................................................... 172
7.3.8 Speed Limiting Geo-Fence Alerts Enable ....................................................................... 172
7.3.9 Speed Limiting Geo-Fence Output Activations ............................................................... 173
7.4 Go (Start Movement) and Halt (Stop Movement) Events ................................................ 173
7.4.1 Go/Halt Speed Detection Threshold ............................................................................. 173
7.4.2 Go/Halt Time Threshold Filter ..................................................................................... 174
7.4.3 Go/Halt Session Control ............................................................................................. 174
8 Time and Trip Events ............................................................................................. 175
8.1 Start and Stop Alerts ................................................................................................. 175
8.1.1 Start Alert Generation Time Filter ................................................................................ 175
8.1.2 Stop Alert Generation Time Filter ................................................................................ 175
8.2 Time-based Alert ....................................................................................................... 175
8.2.1 Time Alerts Resolution Definer .................................................................................... 176
8.2.2 Time Alerts Period Value ............................................................................................ 176
8.2.3 Force one second resolution Roaming Mode .................................................................. 176
8.2.4 Time Alert Period Multiplier for HIGH SPEED Mode ......................................................... 177
8.2.5 Time Report Period Multiplier for NOIP Mode ................................................................. 177
8.2.6 Table of Time-based Alert Period Calculation................................................................. 177
8.2.7 V-Trek: Dynamic Time-based Alerts Period Control as a Function of Speed ....................... 178
8.3 Curve Smoothing ...................................................................................................... 180
Manual
8.3.1 Enable Vector Change Detection Events /Distress .......................................................... 181

8.3.2 Prevent Curve Smoothing Message Generation during "Halt" Mode .................................. 182
8.3.3 Enable Compressed Vector Change Report ................................................................... 182
8.3.4 Compressed Vector Change Report Timeout ................................................................. 182
8.3.5 Vector Change Detection Angle ................................................................................... 183
8.4 Communication Idle Alerts ......................................................................................... 183
8.4.1 Time between Communication Idle Alerts ..................................................................... 183
8.4.2 Event and Distress Controls for Communication Idle Alert .............................................. 183
8.4.3 Do not Wake Up from Hibernation upon Comm. Idle Distress .......................................... 184
8.5 Driver Authentication ................................................................................................. 184
8.5.1 Enable Driving Without Authentication Alert .................................................................. 186
8.5.2 Enable Authentication Updated Alert ............................................................................ 186
8.5.3 Maximum Time without Authentication......................................................................... 186
8.5.4 Enable Authentication Reminder Feedback Output Activation .......................................... 186
8.5.5 Ignition Filter Source for Starting Driver Authentication Time Calculations ........................ 187
8.5.6 Time to Authentication Loss ........................................................................................ 187
8.5.7 Activate Immobilizer while no active Dallas .................................................................. 187
8.5.8 Enable Conditional Activation of Immobilizer ................................................................. 188
8.5.9 Enable Pre-defined Driver ID’s List .............................................................................. 188
8.5.10 Enable “Dallas ID Updated” Event even if it is not in the List ........................................... 189
8.5.11 iButton Codes (30 Buttons) ........................................................................................ 189
8.5.12 Enable Feedback upon Authentication .......................................................................... 189
8.5.13 Enable Resending "Driver Authentication" Alert upon each Detection ............................... 190
8.5.14 Enable Dallas Bus Mode (1-Wire) Bus .......................................................................... 190
8.5.15 Enable Infinite Driver Notifications when Driver is not Identified ...................................... 190
8.6 Extended Driver Authentication ................................................................................... 191
8.6.1 Enable Differentiation between Driver and Passenger ..................................................... 191
8.7 Trailer Connection Monitoring ..................................................................................... 193
8.7.1 Dallas Family of Trailer Identifier ................................................................................. 193
8.7.2 Enable Trailer Connection Event .................................................................................. 194
8.7.3 Trailer Connection Distress ......................................................................................... 194
8.7.4 Timeout for Trailer Connection Status Change .............................................................. 194
8.7.5 Trailer Connected: Over Speed Start Velocity threshold ................................................. 195
8.7.6 Trailer Connected: Over Speed End Velocity Threshold................................................... 195
8.8 Controlling of Work Time on Static Objects ................................................................... 195
8.9 Driver Behaviour ....................................................................................................... 196
8.9.1 Coasting .................................................................................................................. 196
8.9.2 Behavior Violation Indications to Driver ........................................................................ 198
8.9.3 Additional Thresholds for GP Frequency Meter ............................................................... 204
9 Inputs Events ........................................................................................................ 206
9.1 4 – Ignition (Not Supported by CelloTrack) ................................................................... 207
9.1.1 Reporting Journey Start ............................................................................................. 208
9.1.2 Reporting Journey Stop .............................................................................................. 208

Manual
9.1.3 Inverting Journey Start/Stop ...................................................................................... 208

9.1.4 Reporting Signal Falling on Ignition ............................................................................. 209
9.1.5 Reporting Signal Rising on Ignition .............................................................................. 209
9.1.6 Inverting Ignition Input .............................................................................................. 209
9.2 5 – Lock ................................................................................................................... 209
9.2.1 Function Assigned to Lock Input .................................................................................. 210
9.2.2 Inverting Lock Input .................................................................................................. 210
9.2.3 Threshold for Lock Input ............................................................................................ 210
9.2.4 Averaging Factor for Lock Input .................................................................................. 211
9.2.5 Reporting Signal Falling on Lock .................................................................................. 211
9.2.6 Reporting Signal Rising on Lock .................................................................................. 211
9.3 11- Unlock ............................................................................................................... 212
9.3.1 Function Assigned to Unlock Input ............................................................................... 212
9.3.2 Inverting Unlock Input ............................................................................................... 212
9.3.3 Threshold for Unlock Input ......................................................................................... 213
9.3.4 Averaging Factor for Unlock Input ............................................................................... 213
9.3.5 Reporting Signal Falling on Unlock ............................................................................... 213
9.3.6 Reporting Signal Rising on Unlock ............................................................................... 214
9.4 14 – Door ................................................................................................................. 214
9.4.1 Door Input Type ........................................................................................................ 214
9.4.2 Function Assigned to Door input .................................................................................. 214
9.4.3 Scaling Factor for Frequency Report on Door Input ........................................................ 215
9.4.4 Thresholds on Door as a General Purpose Frequency Counter ......................................... 217
9.4.5 Time Filter for Frequency/Analog Door Input................................................................. 217
9.4.6 Door Freq. Input Violation Type .................................................................................. 217
9.4.7 Threshold for Door Input ............................................................................................ 218
9.4.8 Averaging Factor for Door Input .................................................................................. 219
9.4.9 Inverting Door Input .................................................................................................. 219
9.4.10 Reporting Signal Falling On Door ................................................................................. 219
9.4.11 Reporting Signal Rising on Door .................................................................................. 220
9.5 15 – Shock ............................................................................................................... 220
9.5.1 Shock Input Type ...................................................................................................... 220
9.5.2 Function Assigned to Shock Input ................................................................................ 221
9.5.3 Scaling Factor for Frequency Report on Shock Input ...................................................... 221
9.5.4 Threshold on Shock as a General Purpose Frequency Counter ......................................... 223
9.5.5 Time Filter for Violation of Frequency / Analog Shock Input ............................................ 223
9.5.6 Shock Freq. Input Violation Type ................................................................................. 223
9.5.7 Threshold for Shock Input .......................................................................................... 224
9.5.8 Averaging Factor for Shock Input ................................................................................ 225
9.5.9 Inverting Shock Input ................................................................................................ 225
9.5.10 Reporting Signal Falling on Shock Input ....................................................................... 225
9.5.11 Reporting Signal Rising on Shock Input ........................................................................ 226
9.6 16 – Panic ................................................................................................................ 226
9.6.1 Function Assigned to Panic Input ................................................................................. 226

Manual
9.6.2 Inverting Panic Input ................................................................................................. 227

9.6.3 Threshold for Panic Input ........................................................................................... 227
9.6.4 Averaging Factor for Panic Input ................................................................................. 227
9.6.5 Reporting Signal Falling on Panic ................................................................................. 227
9.6.6 Reporting Signal Rising On Panic ................................................................................. 228
10 Power Events ........................................................................................................ 229
10.1 Power Threshold Settings ........................................................................................... 229
10.1.1 Main Power Low Threshold – High/Low levels ................................................................ 229
10.1.2 Main Power Disconnection Threshold – High/Low Levels ................................................. 230
10.1.3 Backup Battery Low Threshold – High/Low Levels.......................................................... 230
10.2 Power Events/Distress Control .................................................................................... 231
10.2.1 Enabled Main Power Disconnected in Ignition Off Mode alert ........................................... 231
10.2.2 Enabled Main Power Low in Ignition Off Mode Alert ........................................................ 231
10.2.3 Enabled Backup Battery Disconnected in Ignition Off Mode Alert ..................................... 231
10.2.4 Enabled Backup Battery Low in Ignition Off Mode Alert .................................................. 231
10.2.5 Enabled Main Power Disconnected in Ignition On Mode Alert ........................................... 232
10.2.6 Enabled Main Power Low in Ignition On Mode Alert ........................................................ 232
10.2.7 Enabled Backup Battery Disconnected in Ignition On Mode Alert...................................... 232
10.2.8 Enabled Backup Battery Low in Ignition On Mode Alert................................................... 232
10.2.9 Period between the Alerts, Triggered by Detection of Power Disconnection ....................... 233
10.3 Radio-Off Mode (Hardcoded - Always Enabled, Non CelloTrack Variants only) ................... 233
11 Geo-Fences and Towing ........................................................................................ 235
11.1 Geo-Fence ................................................................................................................ 235
11.1.1 Format of Geographical Perimeter ............................................................................... 236
11.1.2 Four Configuration Bytes of the Fence .......................................................................... 236
11.1.3 TOE - Type of Entry ................................................................................................... 237
11.1.4 Waypoint ................................................................................................................. 237
11.1.5 Geo Hot Spot ............................................................................................................ 237
11.1.6 No Modem Zone ........................................................................................................ 238
11.1.7 Output Control .......................................................................................................... 238
11.1.8 Output Activation Pattern ........................................................................................... 239
11.2 Fences Configuration ................................................................................................. 239
11.2.1 Geo Fence Logic ........................................................................................................ 239
11.2.2 Geo-Fence Violation Filter ........................................................................................... 240
11.2.3 Ignore Geo Fence Violation on Boot (after Reset) .......................................................... 240
11.2.4 Control of Geo-Fence Alters (Events and Distress) ......................................................... 241
11.2.5 Geo-Fence Heading Angle .......................................................................................... 242
11.3 Towing Detection (Not supported by CelloTrack) ........................................................... 243
11.3.1 Speed Threshold ....................................................................................................... 243
11.3.2 Geo-Fence Perimeter ................................................................................................. 243
11.3.3 Towing Detection Filter .............................................................................................. 244
11.3.4 Enable GPS Wake Up upon Movement for Towing Detection ............................................ 244
11.3.5 Towing Alerts (Distress and Event) Control ................................................................... 244

Manual
11.3.6 Towed Mode ............................................................................................................. 245

12 Security (Car Alarm System) ................................................................................. 247
12.1 Logical Modes of Alarm System ................................................................................... 247
12.2 Interactions between Operational Modes of Security Unit ............................................... 249
12.3 Arm/Disarm Detection ............................................................................................... 250
12.3.1 Active Correlation Lines.............................................................................................. 250
12.3.2 Max. Amount of Failure Samples ................................................................................. 250
12.4 Security Modes Timeouts ........................................................................................... 251
12.4.1 Time to Passive Arming .............................................................................................. 251
12.4.2 Time to Pre-Arming ................................................................................................... 251
12.4.3 Pre-Arming Time ....................................................................................................... 252
12.4.4 Silent Delay Time ...................................................................................................... 252
12.5 Silent Delay Configuration .......................................................................................... 252
12.5.1 Trigger Silent Delay upon Ignition On Detection ............................................................ 252
12.5.2 Trigger Silent Delay upon Door Open Detection ............................................................. 253
12.5.3 Trigger Silent Delay upon Correlation Unlock or Unlock2 Detection .................................. 253
12.5.4 Number of Silent Delay Expiration Beeps ...................................................................... 253
12.5.5 Time between Silent Delay Expiration Beeps ................................................................. 253
12.5.6 Maximum Time in Garage Mode .................................................................................. 253
12.6 Inputs Armed by the Alarm ........................................................................................ 254
12.6.1 4 – Ignition .............................................................................................................. 254
12.6.2 5 – Lock ................................................................................................................... 254
12.6.3 11 - Unlock .............................................................................................................. 254
12.6.4 14 – Door ................................................................................................................. 254
12.6.5 15 – Shock ............................................................................................................... 255
12.6.6 16 – Panic ................................................................................................................ 255
12.7 Security Transmissions .............................................................................................. 255
12.7.1 Number of Security Transmissions ............................................................................... 255
12.7.2 Time Between Security Transmissions.......................................................................... 255
12.8 Security Configuration ............................................................................................... 256
12.8.1 Disable Auto Arming (Passive Arming) ......................................................................... 256
12.8.2 Auto Arming Independent from Door ........................................................................... 256
12.8.3 Auto-Gradual Stop Enable .......................................................................................... 256
12.8.4 Trigger an Alarm Upon Main Power Disconnection Detection ........................................... 257
12.8.5 Spare ...................................................................................................................... 257
12.8.6 Trigger an Alarm upon Towing Detection during Alarm Armed ......................................... 257
12.9 Alarm Triggered Signals ............................................................................................. 257
12.9.1 Use Siren Output for Alarm Triggered Activation ........................................................... 257
12.9.2 Use Blinkers Output for Alarm Triggered Activation ........................................................ 257
13 External Keyboard (Cello-AR Advance Recovery) .................................................. 258
13.1 Pairing Procedure ...................................................................................................... 259
13.2 Keyboard Configuration.............................................................................................. 259

Manual
13.2.1 Enable Keyboard ....................................................................................................... 259

13.2.2 Keyboard Msg Type 9 Data Source .............................................................................. 259
13.2.3 Wrong Keyboard ID Detection ..................................................................................... 260
13.2.4 Keyboard Disconnection Detection ............................................................................... 260
13.2.5 Enable Forwarding Data from Keyboard to Serial Port .................................................... 261
13.2.6 Enable Malfunction Report .......................................................................................... 261
13.2.7 Activate Alarm Cadence upon Hotwiring Detection ......................................................... 262
13.2.8 Generate Msg. Type 0 Reply for Commands Addressed to Keyboard ................................ 262
13.2.9 Disable Pairing .......................................................................................................... 262
13.3 Alarm Cadence ......................................................................................................... 262
13.3.1 Alarm Cadence outputs selection ................................................................................. 263
13.3.2 Alarm Cadence Template: Number of Cycles ................................................................. 263
13.3.3 Alarm Cadence Template: On Time .............................................................................. 263
13.3.4 Alarm Cadence Template: Off Time ............................................................................. 263
13.4 BCALL (Brake down) Destination Number ..................................................................... 263
14 Reserved ............................................................................................................... 265
15 CelloTrack ............................................................................................................. 266
15.1 CelloTrack Configuration 1 .......................................................................................... 266
15.2 CelloTrack Configuration 2 .......................................................................................... 268
15.2.1 Disable Cell ID Packets on Peeking .............................................................................. 268
15.2.2 Enable FixTime Algorithm (Non CelloTrack T Variants only) ............................................ 268
15.2.3 Enable Extended Charging Temperature Range ............................................................. 268
15.2.4 GPIO Control 0/1 (CelloTrack only) .............................................................................. 269
15.2.5 Cradle Mount Power Save (CelloTrack only) .................................................................. 269
15.3 GPS Peeking On Time during Live Tracking ................................................................... 270
15.4 Activation/Deactivation Procedure Options ................................................................... 270
15.4.1 Activation/Deactivation Procedure ............................................................................... 271
15.4.2 GPS-based Start Event Enable .................................................................................... 272
15.5 CelloTrack: GPS-based Movement Timeout ................................................................... 272
15.6 Max Extra GPS On Time for Distress Mode .................................................................... 272
15.6.1 Distress Mode during COM-Location Glancing State ....................................................... 273
15.7 Glancing at Specific Time (ST Glancing) ....................................................................... 273
15.8 Radio-Off (CelloTrack and CelloTrack Power) ................................................................ 276
15.9 Advanced Glancing (peeking): CelloTrack and CelloTrack Power ...................................... 276
16 CelloTrack Power .................................................................................................. 279
16.1 CelloTrack Power Configuration Settings ...................................................................... 279
16.2 Time Event Resolution Multiplier for “External Power” Mode ............................................ 280
16.3 Distance Event Resolution Multiplier for “External Power” Mode ....................................... 280
17 CFE ........................................................................................................................ 281
17.1 General .................................................................................................................... 281
17.2 Block Diagram .......................................................................................................... 282

Manual
17.3 Programmable CFE Parameters ................................................................................... 283

17.3.1 CFE COM 1 (Cello Port) Configuration .......................................................................... 283
17.3.5 CFE VOUT Control ..................................................................................................... 285
17.3.6 CFE Hibernation Setting Bitmask ................................................................................. 285
17.3.7 CFE Bluetooth Page Mode (Infrastructure) .................................................................... 285
17.3.8 CFE Page Scan Mode (Infrastructure)........................................................................... 285
17.3.9 CFE Bluetooth Pin Code (Infrastructure) ....................................................................... 286
17.3.10 CFE COM2 (Infrastructure) .................................................................................... 286
17.3.11 CFE Bluetooth Configuration (Infrastructure) ........................................................... 286
17.3.12 CFE Local Bluetooth Device’s Friendly Name (Infrastructure) ..................................... 286
17.3.13 CFE Input Type / Assigned Function ........................................................................ 286
17.3.14 Function assigned to CFE input .............................................................................. 287
17.3.15 Scaling Factor for Frequency Report on CFE Input .................................................... 288
17.3.16 Threshold for CFE Input (Discrete Wet/Dry) ............................................................. 289
17.3.17 Averaging Factor for CFE Input .............................................................................. 290
17.3.18 CFE Inputs State Update Configuration ................................................................... 290
17.3.19 Cello: Analog Measurements Update Period ............................................................. 291
17.4 CFE: CFE Status Update Configuration ......................................................................... 291
17.5 CFE Serial MUX Protocol Selection ............................................................................... 292
18 Crash Detection Feature ........................................................................................ 293
18.1 General .................................................................................................................... 293
18.2 Crash Detection Configurable Parameters ..................................................................... 293
18.2.1 Light Crash Detection Threshold .................................................................................. 293
18.2.2 Heavy Crash Detection Threshold ................................................................................ 293
18.2.3 Enable Crash Detection Events for Light/Heavy Crash .................................................... 294
18.2.4 Enable Distress for Light/Heavy Crash ......................................................................... 294
19 CAN Bus Support (Cello-CANiQ) ............................................................................ 295
19.1.1 Cello-CANiQ: CAN Operational Mode Select ................................................................. 295
19.1.2 Cello-CANiQ: CAN Operational Mode Select .................................................................. 295
19.1.3 Enable DTC .............................................................................................................. 296
19.2 Cello-CANiQ: OBD2 CAN Physical Layer Configuration ................................................... 297
19.2.1 CAN Bus Rate ........................................................................................................... 297
19.2.2 OBD2 CAN Bus Format ............................................................................................... 297
19.3 Cello-CANiQ: CAN Application Control 1 ...................................................................... 298
19.3.1 Enable CAN as Fuel Level Source AN Bus Rate .............................................................. 298
19.3.2 Speed Source Selection .............................................................................................. 298
19.3.3 Enable CAN as RPM Source ......................................................................................... 299
19.3.4 Enable CAN as VIN Source ......................................................................................... 299
19.3.5 Enable CAN as Trip Fuel Consumption Source ............................................................... 299
19.3.6 Enable CAN as Odometer Source ................................................................................. 300

Manual
19.4 Cello-CANiQ: Fuel Tank Capacity ................................................................................. 300

19.5 Cello-CANiQ: Speed Correction Delta ........................................................................... 300
19.6.1 Enable Fleet End-Of-Trip Logged Event ........................................................................ 301
19.6.2 Enable Fleet End-Of-Trip Distress Event ....................................................................... 301
19.7.1 Enable OBD2 CAN Queries Status Events ..................................................................... 302
19.7.2 Enable CAN Bus Events .............................................................................................. 302
19.8 Cello-CANiQ: Standard OBD2 Queries Configuration ..................................................... 302
19.9 Cello-CANiQ: Non Standard OBD2 Queries Configuration ............................................... 305
19.10 Cello-CANiQ: CAN Bus Filters Configuration ............................................................... 306
19.11 Cello-CANiQ: CAN Trigger Configuration Space .......................................................... 307
20 oneWire Temperature Sensors .............................................................................. 308
20.1 oneWire Temperature Measurement Update Configuration .............................................. 309
21 GNSS External/Internal Antenna (Only GNSS) ...................................................... 311
21.1 GNSS Internal Antenna No-Fix-Time Timeout (GNSS Variants only) ................................. 311
21.2 GNSS External Antenna No-Fix-Time Timeout (GNSS Variants only) ................................ 312
22 Auxiliary Satellite Unit .......................................................................................... 313
22.1 Auxiliary Satellite: Cellular network connect-reconnect criteria ........................................ 313
22.2 Falling Back to Satellite .............................................................................................. 314
22.2.1 Auxiliary Satellite: No GSM-GPRS Timeout (Basic, Advanced) ......................................... 314
22.2.2 Auxiliary Satellite: Timeout Resolution for No GSM-GPRS ............................................... 314
22.3 Restore Cellular ........................................................................................................ 314
22.3.1 Auxiliary Satellite: GSM-GPRS Reconnect Timeout (Basic, Advanced) ............................... 314
22.3.2 Auxiliary Satellite: Timeout Resolution of GSM-GPRS Reconnect ...................................... 315
22.4 Satellite Control Bitmask ............................................................................................ 315
22.4.1 Auxiliary Satellite Unit- Enable Periodic Distress Events .................................................. 315
22.4.2 Auxiliary Satellite Unit - Satellite Operational Mode ....................................................... 316
22.4.3 Auxiliary Satellite Unit - Periodic Distress Report Period ................................................. 316
23 Driver Behaviour ................................................................................................... 317
23.1.1 Driver Behavior (CSA) Disable .................................................................................... 317
24 CelloTrack Nano .................................................................................................... 318
24.1 Overview.................................................................................................................. 318
24.2 User Interface – Buttons, LEDs and Buzzer ................................................................... 319
24.2.1 Buttons .................................................................................................................... 319
24.2.2 LEDs ........................................................................................................................ 320
24.2.3 Buzzer ..................................................................................................................... 323
24.2.4 Indications after Power Up (Built-In Self-Test) .............................................................. 324
24.3 System Modes .......................................................................................................... 325
24.3.1 Improved Tracking Mode ............................................................................................ 325

Manual
24.3.2 Improved Tracking with POD Mode (Infrastructure) ....................................................... 326

24.4 The Layers Concept ................................................................................................... 326
24.5 USB ......................................................................................................................... 327
24.5.1 Usage ...................................................................................................................... 327
24.5.2 Charging Speed ........................................................................................................ 327
24.5.3 Charging Modes ........................................................................................................ 327
24.6 Sensors ................................................................................................................... 328
24.6.1 Use of IIR Filters ....................................................................................................... 328
24.6.2 Accelerometer .......................................................................................................... 328
24.6.3 Ambient Light Sensor (ALS) ........................................................................................ 329
24.6.4 Pressure Sensor (Altimeter) ........................................................................................ 329
24.6.5 Accurate Temperature Sensor ..................................................................................... 329
24.7 SR-RF functionality .................................................................................................... 329
24.8 Communication Protocols ........................................................................................... 329
24.9 Parameters Descriptions and Notes ............................................................................. 329
24.9.1 Nano Take Location Interval ....................................................................................... 329
24.9.2 System Mode ............................................................................................................ 330
24.9.3 Legacy Events Type-11 Configuration .......................................................................... 330
24.9.4 Tilt Tamper............................................................................................................... 331
24.9.5 Accelerometer Based Impact / Free-fall Detection ......................................................... 332
24.9.6 Orientation Change ................................................................................................... 333
24.9.7 Man-down ................................................................................................................ 334
24.9.8 Package Open/Close Events ........................................................................................ 335
24.9.9 Analog Source Selection ............................................................................................. 337
24.9.10 Temperature and Humidity Measurements............................................................... 337
24.9.11 Indications Time Window ...................................................................................... 343
24.9.12 Buzzer Configuration ............................................................................................ 344
24.9.13 LEDs Configuration ............................................................................................... 344
24.9.14 Check-in Messaging .............................................................................................. 345
24.9.15 Work-ID Messaging .............................................................................................. 345
24.9.16 Exception Handling ............................................................................................... 346
24.9.17 SR-RF Block ........................................................................................................ 347
24.10 Installations ........................................................................................................... 348
25 MultiSense and MultiSense-TH .............................................................................. 349
25.1 Introduction ............................................................................................................. 349
25.2 Operation ................................................................................................................. 349
25.2.1 Marking ................................................................................................................... 349
25.2.2 Battery .................................................................................................................... 350
25.2.3 Button and Blue LED .................................................................................................. 350
25.2.4 Pairing Process ......................................................................................................... 350
25.2.5 Unpairing Process ...................................................................................................... 351
25.3 Sensors ................................................................................................................... 351
25.3.1 Accelerometer .......................................................................................................... 351

Manual
25.3.2 Ambient Light Sensor (ALS) ........................................................................................ 351

25.3.3 Accurate Temperature Sensor ..................................................................................... 352
25.3.4 Humidity Sensor ....................................................................................................... 352
25.3.5 Magnetic Sensor ....................................................................................................... 352
25.4 Parameter Descriptions and Notes ............................................................................... 352
25.4.1 MultiSense Units Provisioning ..................................................................................... 352
25.4.2 MultiSense Open/Close Door/Window Feature ............................................................... 353
25.4.3 SR-RF Pairing Time Window ........................................................................................ 353
25.4.4 Specific MultiSense parameters ................................................................................... 353

Manual
1 Introduction
1.1 About this Document

This document defines the contents of the Cellocator Unit’s Configuration Memory (CM).
The CM is a non-volatile memory, which is used to store different parameters that affect
the behavior of the unit, as well as communication parameters, which are necessary for
the Cellocator unit’s correct operation.
The CM can be read and written both from the wireless channel as well as from the direct
wire interface. Refer to the Wire and Wireless Protocols in order to learn how to read and
write to the CM. Note that if the stored communication parameters are not correct, the
wireless channel might not work, so the only way to program the CM might be via the
direct wire interface.
1.2 Applicability Table

Device Comments
Cello Family Fw: 33o Cello-IQ30, Cello-CANiQ, Cello CANiQ 3G

+ CFE + AR (External Key Board support)
CelloTrack All information related to CelloTrack in this document

refers to CelloTrack-T units based on the Cello platform.
CelloTrack-T family includes the standard CelloTrack and
CelloTrack Power. The CelloTrack Power has built-in
charger and charging control logic. CelloTrack-T
members are distributed with 2G or 3G modems
according to the specific hardware part number.
Unsupported features include the following: Towing
detection, Driver Authentication, Audio call, CFE, Pulse
Counter, APS mode in 2G variant, and GSM Jamming in
3G variant.
Cello-IQ FW Version 33e: Full CFE support with 8KBytes memory

space
Cello-CANiQ FW Version 33e: Full CFE support with 8KBytes memory

space

Manual
Device Comments
CR300 FW Version 41q.

The following features are not supported by default in
CR300/CR300B and require a license. Please contact
Cellocator's sales representatives for more information:
P/N Item MFG Description
FR0001 Cell-ID
FR0002 Curve Smoothing
FR0003 In Cabin Speed alert
FR0004 Offline Tracking
FR0005 Transparent Mode (Forwarding from serial is not
supported)
FR0006 Advanced Roaming
FR0007 Up to 100 Geo Fences
FR0008 Usage Counter
FR0009 Privacy mode
FR0010 Analogue Input
FR0011 Gradual immobilize: See Note1 bellow

FR0012 Roam msg rate
FR0013 Driver ID
NOTE: This feature requires additional CR300 output

configurations, as defined in parameter 506.
1.3 References
All the reference documents listed in the following table can be downloaded from the
support section of the Pointer Website (www.pointer.com).
# Reference Description
1.4 Document Conventions

Unless otherwise specified:
All multiple bytes values are stored and treated Intel-style (meaning, “little endian”,
least significant bytes first).
All the parameters are loaded from CM upon reset. In other words, changing the
programming parameters will take effect only after unit reset.
This document defines the common programmable features, supported by all the
modifications of Cellocator units, as well as the specific programmable options, supported
by specific modifications only. The non-common options are highlighted.

Manual
2 Accessing the Configuration Memory via Wireless

Channel (OTA)
When done over the air (OTA), CM access is performed in blocks. The 4096 bytes are
partitioned to aligned, non-overlapping blocks of 16 bytes. This means the whole CM
space contains 256 different blocks, assigned with block codes of 0 (zero) to 255
(decimal).
The first block (which represents CM locations 0 to 15 decimal) is assigned with block
code 0 (zero). The following blocks are assigned with successive numbers (block 1 for
locations 16 to 31 and so on).
Refer to the Wireless Channel Protocol for more information about accessing the CM via
the wireless channel.

Manual
3 Accessing the Configuration Memory via Direct

Wire Interface
The CM cells are accessed via the direct wire interface in a linear manner. This means that
cells are identified by their actual addresses – there are no blocks or pages.
Refer to the Direct Wire Interface Protocol for more information about accessing the CM
via the direct wire interface.
4 Event Types generated by Cellocator devices

Every event (like trigger on input, violation of speed any other), generated by the
Cellocator unit can be threaded in 4 ways, as per the descriptions below. Every enabled
event causes the unit to generate a location message type 0 (see description in Cellocator
Wireless Protocol) with the appropriate transmission reason. The various event types are
described in the following sections.
4.1 Logged (Plain) Event

If the condition for the specific event is met, the unit will create an event and store it into
its non-volatile memory. The event will be uploaded to the Control Center only during the
GPRS session and will be deleted from the memory of the unit only after reception of an
Acknowledge. Note: Plain events will never be delivered by SMS.
4.2 HRLS Event

This is a private case of Plain Event. If the condition for the specific event is met, the unit
will create a pre-defined number of plain events (one a second) and store them into its
non-volatile memory. Upon the end of storing the unit will upload them to the Control
Center, similarly to any other plain events.
4.3 Distress Event

If the condition for the specific event is met, the unit will create a series of messages
(session) with the same transmission reason. The messages will be uploaded to the
Control Center immediately with the first available communication transport (during IP
session – over IP, otherwise by SMS). The messages are not stored in the memory and if
there is no cellular coverage at the moment of sending the message will be lost. Distress
events do not require ACK from the control center.
The number and time between messages in a Distress transmission session is defined in a
Time between Transmissions section of that document.
Distress sessions caused by the same trigger, which occurred while the first session is not
over, restarts the session from the beginning.
Distress sessions caused by a different trigger, which occurred while the first session is
not over, causes a new distress session (up to 5 distress sessions can be maintained
concurrently).
A 6th distress session, while the previous 5 are still active, will be lost.

Manual
It is also possible to initiate an endless (or specified duration) distress session by

command from the CCC. Upon starting, this session cancels all active distress sessions.
The session will be stopped by any other distress session or by a command from the OTA.
Distress sessions may be prolonged by up to 20 seconds after the transmission of the last
distress message.
4.4 Security Event

As per the Distress Event, but in this instance the condition for event generation is only
checked when the alarm of the unit is armed (only applicable for security modification of
the Cellocator unit). If the condition for the specific event is met, the unit will create a
series of messages with the same transmission reason.
The number and time between messages in a Security transmission session is defined in a
Security Section of that document.
IMPORTANT: Any event can be created in multiple ways simultaneously.
4.5 Active Logged (Plain) Event (CelloTrack-T/Nano only)

The “Active Logged Event” is a new configurable feature designed to enhance the
functionality of legacy logged events. The feature affects all events configured as logged
(or plain). Enabling the “Active Logged Event” feature changes the behavior of the system
in the following way:
During Hibernation
When a new event is generated, the unit will turn its modem and GPS on, wait for a
GPS fix and then queue the event into the event queue. The event will be transmitted
to the server, acknowledged by the server and removed from the queue. “Active
Logged Event” turns the unit on from hibernation for up to 2 minutes. If a GPS fix is
not detected within 1.5 minutes from the beginning of the session, the event will be
queued into the events queue and sent towards the server while giving an extra 30
seconds for the server to acknowledge the event. If a Cellular link is not available the
unit will be turned off and the message will wait in the queue for later delivery.
Event
1.5 Minutes 30 Sec
Wait for GPS Fix
Queue Event
Transmit Event
Ack. From Server
During Live Tracking

When a new event is generated, and the GPS is off (in CelloTrack units), the unit will
turn the GPS on, wait for a fix and then insert the event into the event queue.

Manual
The “Active Logged Event” feature is important for units, such as CelloTrack, which are
battery operated and mostly hibernating while periodically communicating with the
server. Prior to this feature, users had to configure both “Event” and “Distress” bits to
achieve this functionality.

Manual
5 Address and Bitmask Field Allocation Tables

This section describes the addresses and bit mask field allocations. Where relevant, there
are references to corresponding sections, where you can find further information.
Address allocation table, see below
Bitmask Field allocation tables, page 42
5.1 Address Allocation Table

Address Purpose
0 Application Configuration byte 1
2 CelloTrack: Configuration
3-4 Hibernation mode communication settings
5 Unused
8 - 31 Operational Sever - PPP Username
32-34 Trip for a Distance event in Roaming mode
35 Time/Distance alert multipliers for High Speed in Roaming GSM
36 - 65 Operational Sever - APN
66 - 69 Default Target IP Address (for GPRS)
70 - 71 Time between Idle Transmissions
72 - 73 Time between Distress Transmissions
74 Operational Server - Modem type code
75 Number of Distress transmissions
76 - 78 GPS odometer's current value
79 Unused
80 - 83 Base unit (measurement factor of GPS odometer)
84 Max Time between GPS readings for SxT calculation
85 - 88 - GPS odometer - Last Distance Event (in base units)

Manual
Address Purpose
89 - 91 Trip for a Distance event (in base units)
92 Time/Distance alert multipliers for High Speed in Home GSM
93 Over Speed velocity threshold for GPS Over Speed Start event
94 Over Speed velocity threshold for GPS Over Speed End event
95 Over Speed time event filter
96 Idle Speed Velocity threshold for GPS Idle End event
97 Idle Speed Velocity threshold for GPS Idle Speed Start event
98 Idle Speed event time filter
99 GPS Events Mask Bitmap
100 - 101 Inputs Logic Invert Mask
102 GPS Distress Triggers Bitmapped mask
103 HRLS Trigger Mask of GPS Events
104 Journey Start Event time filter
105 Journey Stop Event time filter
106 Time Report Period Value
107 - 108 Listening UDP Port (while connected to both operational server or
maintenance server)
109 - 110 Operational server TCP/UDP Target Port
111 Maximum time without authentication
112 Time to Authentication loss
113 Main Power Disconnection threshold - high level
114 Main Power Disconnection threshold - low level
115 Main Power Low threshold - high level
116 Main Power Low threshold - low level
117 Backup Battery Disconnection threshold - high level
118 Backup Battery Disconnection threshold - low level
119 Backup Battery Low threshold - high level

Manual
Address Purpose
120 Backup Battery Low threshold - low level
121 Mask of Analog Inputs Events
122 Mask of Analog Inputs Distress
123 Mask of Authentication events
124 - 125 Inputs Events mask – on Failing
126 - 127 Inputs Events mask – on Raising
128 - 129 Inputs Distress mode mask - on Falling
130 - 131 Inputs Distress mode mask - on Raising
132 - 133 Towing detection – Speed threshold
134 - 135 Towing detection – Geo-Fence perimeter
136 Common Discrete Inputs change Time filter
137 Towing detection filter
138 Maximum Backup Battery extra charge time
139 Message Transit Acknowledge timeout
140 Outputs pulse width period
141 - 164 Operational Sever - PPP Password
165 - 166 Modem Reset Period
167 - 176 BCALL (Brake down) Destination number
177 - 186 SMS Center Address
187 - 196 SMS Default Destination Address
197 - 200 SIM PIN code
201 - 202 Communication settings in Home GSM Network Mode
203 - 204 Communication settings in Roam GSM Network Mode

Manual
Address Purpose
205 Advanced GSM Jamming Detection – Ignition Off - 1st activated output
(Infrastructure)
206 Advanced GSM Jamming Detection – Ignition Off - Template of 1st

activated output (1st byte) (Infrastructure)
207 Advanced GSM Jamming Detection – Ignition Off - Template of 1st

activated output (2nd byte) (Infrastructure)
208 Advanced GSM Jamming Detection – Ignition Off – 2nd activated output
209 Advanced GSM Jamming Detection – Ignition Off - Template of 2nd

activated output (1st byte) (Infrastructure)
210 Advanced GSM Jamming Detection – Ignition Off - Template of 2nd

activated output (2nd byte)
211 Advanced GSM Jamming Detection – Ignition Off - Delay for output
activation for the 1st output (Infrastructure)
212 Advanced GSM Jamming Detection – Ignition Off - Delay for output
activation for the 2nd output (Infrastructure)
213 Advanced GSM Jamming Detection – Jamming Detection Time Filter:

Jamming detection time in resolution of 3 Seconds. Ranges between 3
Seconds to 765 Seconds. Default 10 Seconds (Infrastructure)
214 Advanced GSM Jamming detection – Ignition On and Ignition Off

Jamming End Time Filter (15 Sec resolution)
(Infrastructure)
215 - 254 Reserved (ex. CSD username/CSD retry timeout)
255 Offline Tracking - Auto Upload configuration
256-259 Reserved (ex. CSD username/CSD retry timeout)
259-260 Offline Tracking - Time to Auto-uploading
261 Trailer Connected mode: Over-speed Start Velocity threshold
262 Trailer Connected mode: Over-speed End Velocity threshold
263 GPS Peeking – Max. On Time
264 - 265 GPS Peeking – Off Time
266 Power Management mode
267 GSM Peeking – Maximum Modem On Time
268 - 269 GSM Peeking – Off Time

Manual
Address Purpose
270 GSM Peeking – Maximum Network Registration Time
271 - 272 Hibernation Mode Delay
273 - 282 Voice Call Destination number
283 Number of retries to forward data over UDP
284 Anti-Flooding timer
285 Garmin Configuration

CelloTrack Configuration 1
286 Internal Variable: Learned Signals Mask
287 Security - Active Correlation Lines
288-300 Internal variable: Security - Correlation Arm – from Lock 5
301-313 Internal variable: Security - Correlation Arm – from Unlock Input 11
314-326 Internal variable: Security - Correlation Arm - from Unlock Input 15
327-339 Internal variable: Security - Correlation Disarm – from Lock 5
340-352 Internal variable: Security - Correlation Disarm – from Unlock Input 11
353-365 Security - Correlation Disarm- from Unlock Input 15
366-378 Internal variable: Security - Correlation Disarm 2 – from Lock 5
379-391 Internal variable: Security - Correlation Disarm 2 – from Unlock Input

11
392-404 Internal variable: Security - Correlation Disarm 2 - from Unlock Input

15
405-407 Internal variable: Correlation Length
408-410 Internal variable: Signal Detected Mask
411 Internal Variable: Relaxation Signals
412 Security - Max. Amount of failure samples
413 Security – Pre-arming Time
414 Security - Time to Passive Arming
415 Security - Time to Pre-Arming
416 Security - Silent delay time

Manual
Address Purpose
417 Security - Maximum time in Garage mode
418 - 420 Reserved, ex. Security - Security inputs invert bitmap
421 Security - Trigger an Alarm upon Towing Detection during Alarm Armed
422 - 425 Security - Security inputs mask bitmap
426 Security - Number of Security transmissions
427 Security - Time between Security transmissions
428 Security - Logic configuration
429 - 434 Dallas 01 code
447 - 448 Internal Variable: Security Saved State
449 Feedback bitmap
450 CelloR: Alarm Triggered outputs

CelloAR: Alarm Cadence outputs bitmask
451 Time zone (for Cellocator MDT synchronization)
452 Car Sharing 2: Car Sharing Configuration
453 Car Sharing 2: TIME BEFORE ENTRANCE INTO A RESERVED MODE
454 CelloTrack: Max Extra GPS On Time for Distress Mode
455 Velocity threshold for HIGH SPEED mode
456 - 459 Reserved (ex. default IP CSD)
460- 463 Reserved (ex. target port CSD)
464 Reserved (ex. Analog inputs measurement control bitmask)
465 Additional inputs functionality control bitmask
466 Analog Measurement Averaging Time
467 Accelerometer Configuration
468 Voltage Level Threshold IgnitionOn Detection
469 Internal variable: AHR counter

Manual
Address Purpose
470 Towed Mode
471-472 UART configuration
473 Speed Range Threshold V0
476 Harsh Braking Threshold for Speed range 0
480 Course Delta Threshold for Speed range 0
484 Mask of Authentication Distress
485 Time Based Alert Period Multiplier for NOIP mode
486 - 487 HRLS Trigger Mask Inputs Failing Events
488 - 489 HRLS Trigger Mask Inputs Raising Events
490 HRLS Trigger Mask Analog Inputs Events
491 Number of Events during HRLS
492 Idle Speed Alerts Control Bitmask
493 Time Based Events Mask Bitmap
494 Time Based Distress Mask Bitmap
495 HRLS Trigger Mask Time Based Events (not supported, Infrastructure
only)
496 GPS Events Mask (second byte, the first is on 99)
497 Active GPS Distress Triggers Bitmapped mask (second byte, the first is
on 102)

Manual
Address Purpose
498 HRLS Trigger Mask of GPS Events (second byte, the first is on 103)
499 Time event period in Roaming
500 GPS Navigation Start/Stop Filter
501 Unused (Ex. CSD redial attempts upon IGN OFF)
502 - 503 Outputs Inversion Mask
504 Maximum number of AHR retries
505 Inputs triggering Distress voice call (bitmap)
506 Speaker of Hands Free - Mute Settings and CR300 Outputs Control
507 Speaker Mute Time during Auto-answered Incoming Calls
508 Speaker Mute time during Distress Calls
509 Vehicle’s Driver speed delta relative to GPS speed
510 Vehicle’s speed delta relative to GPS speed
511 Acceleration Threshold for Speed range 0
515 Registration Lack Timeout (for Modem’s AHR)
516 Local RPM Calibration Input/output selection
517 Spare
518 GNSS Internal Antenna No-Fix-Time Timeout (Only Cello-IQ GNSS)

only)
519 GNSS External Antenna No-Fix-Time Timeout (Only Cello-IQ GNSS)
520 CFE - Analog measurements update period – Home Network
521 CFE - Analog measurements update period – Roam Network
522 GSM Jamming Detection – Activated outputs release configuration
523 Momentary Driver Behavior events: First output
524 Momentary Driver Behavior events: Second output

Manual
Address Purpose
526 Application Configuration byte 10 (Infrastructure)
529-539 Reserved for Application configuration
540 -603 Nano: Extended Events Control Bits array: 256 entries of 2 Bits
representing the extended configurable option for each of the fleet
events.
604-609 Spare
610-619 PHSN Configuration (Infrastructure)
620 Reserved
621 – 998 Car Sharing 2: Dallas codes 31-94 Customer Project
999 Spare
650 Auxiliary Satellite Unit- Enable Periodic Advanced Auxiliary

Distress Events Satellite Unit
Auxiliary Satellite Unit- Satellite Operational
Mode
651 Reserved
652 Reserved
653 Reserved
654 Reserved
655 Reserved
656 Auxiliary Satellite Unit- Periodic Distress

Report Period
657 Reserved
658 Reserved
1000 CR300 3G I/O Control
1001 - 1003 Reserved
1004 Geo-Fence Alert Mask for events

Manual
Address Purpose
1004 Geo-Fence Alert Mask for events
1005 Geo-Fence Alert Mask for distress
1006 GeoFence filter threshold
1007 GeoFence Active high resolution logging mask
1008 Roaming Operator’s Management - Timer of Auto-Search
1009 Roaming Operator’s Management - Number of PLMNs programmed
1010-1012 Roaming Operator’s Management - PLMN 1
…. ….
1310 V-Trek - V1
1311 V-Trek - T1
1312 V-Trek - V2
1313 V-Trek - T2
1314 - 1317 Reserved for Customer’s Use

designed to store customer’s proprietary data (like specific EEPROM
content identifier)
1318 CelloTrack: Configuration 1 (legacy 285)
1319 CelloTrack: GPS based movement timeOut
1320 PSP - Polling Interval
1321 PSP - Allowed number of communication failures
1322-1325 Geofence Outputs activation 0-3
1326-1329 New SIM PIN
1330 First Usage Counter input
1331 Second Usage Counter input
1332 Usage Counter Reporting interval
1333-1334 CelloTrack: GPS battery charging time. Fixed to 0x00e1.

(Infrastructure, not part of PL).

Manual
Address Purpose
1335-1336 CelloTrack: GPS battery interval time. Fixed to 0x0384

(Infrastructure, Not part of PL)
1337-1338 CelloTrack: Advanced Glancing (peeking): Glancing time for movement

and not charging state.
1339-1340 CelloTrack: Advanced Glancing (peeking): Glancing time for No

movement and charging state.
1341-1342 CelloTrack: Advanced Glancing (peeking): Glancing time for movement

and charging state.
1343 PSP – Echo Timeout
1344 Wake Up message configuration
1345 Auxiliary Satellite Unit (Only Cello-IQ GNSS)
1346 Period between the alerts, triggered by detection of power

disconnection
1351 Violation of additional GP Frequency thresholds
1352 Periodical Modem Reset Randomization threshold
1353 Anti-flooding randomization threshold
1354 GSM band and authentication type
1355 Periodic transparent mode peek time
1356 Periodic transparent mode cycle time
1357 Door Event Begin Additional Time Filter
1358 Door Event End Additional Time Filter
1359 Shock Event Begin Additional Time Filter
1360 Shock Event End Additional Time Filter
1361 Distress Event Begin Additional Time Filter
1362 Distress Event End Additional Time Filter

Manual
Address Purpose
1363 Unlock Event Begin Additional Time Filter
1364 Unlock Event End Additional Time Filter
1365 Lock Event Begin Additional Time Filter
1366 Lock Event End Additional Time Filter
1367 Ignition (as GP) Event Begin Additional Time Filter
1368 Ignition (as GP) Event End Additional Time Filter
1369 CFE In 1 Event Begin Additional Time Filter
1370 CFE In 1 Event End Additional Time Filter
1387-1388 Go / Halt Speed Detection threshold
1389 Go / Halt Time threshold filter
1390 Go / Halt – Session Control Bitmask
1391 Modem type code for Maintenance Server
1392-1395 Maintenance Server IP address
1396-1397 Maintenance Server Target Port
1398 Maintenance Server configuration bitmask
1399 Maintenance Server connection period

Manual
Address Purpose
1400 Maintenance Server MAX session time
1401 Security - Silent Delay Configuration byte
1402 Volume and Gain Control Byte
1403-1432 Maintenance Server APN
1433 Vector Change Detection Bitmask
1434 Compressed Vector Change Report Timeout
1435 Vector Change Detection angle
1436 Jamming fine tuning, third byte of #JDR=4,60,50.
1437 CFE multiplexer protocol assignment for serial interface 2

(Infrastructure for Bluetooth)
1440-1445 Unused
1446 CelloTrack: Power configuration settings
1447 CelloTrack: Activation/Deactivation Procedure options
1448-1609 Dallas codes 04 to 30 (6*27 bytes)
1610 Car Sharing: RFID Peeking Intervals (Reserved, Network Available)
1611 Car Sharing: RFID Peeking Intervals (Reserved, Network Not Available)
1612 Car Sharing: RFID Peeking Intervals (Not reserved, Network Available)
1613 Car Sharing: RFID Peeking Intervals (Not reserved, No Network

Available)
1614-1615 CelloTrack: Glancing at Specific Time
1616 CelloTrack: GPS peeking On time during Live Tracking
1617 Unused (ex. v30 inputs configuration addresses)
1618 Internal use
1619 CelloTrack: Time event resolution multiplier for “external power” mode

Manual
Address Purpose
1620 Select Measurement source reported in Byte 26 of OTA Msg type 0
1624 CelloTrack: Distance event resolution multiplier for “external power”

mode
1625 GPS DOP Threshold
1626-1649 Maintenance Server APN Username
1650-1673 Maintenance Server APN Password
1674 Input Type / Assigned function

Door ( pin 14)
1675-1676 Scaling Factor for Frequency report on Door input
1677 Freq./ Analog Input Configuration Byte
Frequency / Analog Low Threshold / Discrete

1678-1679 Wet/Dry Threshold (1678)
1680-1681 Frequency / Analog High Threshold
1682 Violation Time Filter (Frequency / Analog)
1683 Spare
1684 Spare
1685 Spare
1686 Averaging factor for Door Input
1687 Input Type / Assigned function Shock (pin 15)
1688-1689 Scaling Factor for Frequency report on Shock input
1690 Freq./ Analog Input Configuration Byte
Frequency / Analog Low Threshold / Discrete

1691-1692
Wet/Dry Threshold (1691)
1693-1694 Frequency / Analog High Threshold
1695 Violation Time Filter (Frequency / Analog)

Manual
Address Purpose
1696 Spare
1697 Spare
1698 Spare
1699 Averaging factor for Shock Input
1700 Assigned function Panic (Distress)

(pin 16)
1701 Threshold for Panic Input
1702 Averaging factor for Panic Input
1703 Assigned function

Unlock (pin 11)
1704 Threshold for Lock Input
1705 Averaging factor for Lock Input
1706 Assigned function

Lock (pin 5)
1707 Threshold for Unlock Input
1708 Averaging factor for Unlock Input
1709-1710 CelloAR: Keyboard Configuration Bitmask
1711 Reserved for manufacturer usage (Timer of retry of SIM operation

upon failure)
1712-1713 CelloAR: Alarm Cadence duration and cycles
1714-1715 CFE COM 1 (Cello Port) configuration
1716-1717 CFE COM 3 configuration
1722-1725 CFE Spare
1726 CFE Control
1727 CFE Hibernation setting bitmask
1728-1753 CFE Reserved
1754 CFE Bluetooth Page Mode
1755-1756 CFE Reserved

Manual
Address Purpose
1757 CFE Page scan mode
1758-1766 CFE Bluetooth Pin Code
1767-1768 CFE Infrastructure for

COM 2 (Bluetooth) configuration
1769-1777 CFE Bluetooth Configuration (Infrastructure)
1778-1809 CFE Local Bluetooth device’s friendly name.
1810 CFE Input1 Type / Assigned function

1811 CFE Averaging factor for Input1
1812-1813 CFE Scaling Factor for Frequency report 1
1814 CFE Discrete Wet/Dry Threshold
1815 CFE Spare
1817-1818 CFE Averaging factor for Input2
1819 CFE Scaling Factor for Frequency report 2
1821 CFE Spare
1827 CFE Spare

1833 CFE Spare

Manual
Address Purpose
1839 CFE Spare
1845 CFE Spare
1846 CFE Inputs state update configuration
1847-1913 CFE Reserved for future use
1914 Lock to Certain IMSI (Note: Not Supported in Cello-IQ variants)
1917-1920 Speed Limiting Geo-Fence Thresholds: Each Geo-Fence can select 1 of 4

Speed Limit thresholds by setting bits 30-31 in the fence configuration
1900-1920 PHSN BS
1921-2020 Geo Fence heading angle (Infrastructure)
2021-2022
2023-2038 CR300E (Reserved)
2039-2367 CelloTrack Nano area
2368-2369 Maximum Possible Scaled Frequency
2370 Violation Timer for 1st additional GP Frequency threshold
2371 Violation Timer for 2nd additional GP Frequency threshold

Manual
Address Purpose
2372-2373 1st additional GP Frequency threshold
2374-2375 2nd additional GP Frequency threshold
2376 Feedback for driver behavior violations bitmask
2377-2379 Configuration of 1st output for continuous driver behavior violation
2380-2382 Configuration of 2nd output for continuous driver behavior violation
2383 Driver behavior- continuous violation feedback Logic
2384 Light crash detection threshold
2385 Heavy crash detection threshold
2386 Coasting detection - Coasting Violation period
2387 Coasting detection - Speed threshold
2388-2389 Coasting detection - Engine Speed threshold
2390 Enable crash detection feature, Enable EDR event for Light/Heavy
crash, Enable EDR distress for Light/Heavy crash
2391 Alternative Over-Speed threshold for Input Dependent mode
2390-2393 Unused
2392 Timeout for Trailer Connection status change
2393 Dallas Family of Trailer Identifier
2394 -2425 Default target DNS Address (for Maintenance Server)
2426 GSM Jamming Detection - 1st activated output
2427 GSM Jamming Detection - Template of 1st activated output (1st byte)
2428 GSM Jamming Detection - Template of 1st activated output (2nd byte)
2429 GSM Jamming Detection – 2nd activated output
2430 GSM Jamming Detection - Template of 2nd activated output (1st byte)
2431 GSM Jamming Detection - Template of 2nd activated output (2nd byte)
2432 GSM Jamming Detection - Delay for output activation for the 1st output
2433 GSM Jamming Detection - Delay for output activation for the 2nd output
2434-2437 Pulse Counter: Shock Input: Current Pulse Count (32 bits, Little Endian-

Manual
Address Purpose
LSByte on 2438)
Pulse Counter: Door Input: Current Pulse Count (32 Bits, Little Endian-LSByte on 2442)
2438-2441
2442-2443 Pulse Counter: Door Input: Scaling Factor: Multiplying this 16 bit Little
Endian value with the current Door pulse count will translate the pulse
count into Volume units (For example a scaling factor of 1 indicates 1
pulse represents 1 litter)
2444-2445 Pulse Counter: Shock Input: Scaling Factor: Multiplying this 16 bit Little
Endian value with the current Shock pulse count will translate the pulse
count into Volume units (For example a scaling factor of 1 indicates 1
pulse represents 1 litter)
2446-2447 Pulse Counter: Defines the Pulse Counter periodic Transmission Period
This 16 Bits Little Endian value has a time resolution of 15 Minutes.
2448 Excessive RPM events Config
2449-2451 Feedback for Excessive RPM event 1
2452-2454 Feedback for Excessive RPM event 2
2455-2456 Excessive RPM (Engine Speed) threshold 1
2457-2458 Excessive RPM (Engine Speed) threshold 2
2459 OneWire Temperature msg 9 update rate. Home Network
2460 OneWire Temperature msg 9 update rate. Roam Network
2461-2463 Unused
2464-2495 Operational Server DNS Address
2496-2516 Geo Fence 1 Configuration
…. ….
4080-4095 Geo Fence 100 Configuration

Cello-CANiQ: CAN operational mode select
4100
4101 Cello-CANiQ: OBD2 CAN Physical layer Configuration
4102 Cello-CANiQ: CAN Application Control 1

Cello-CANiQ : Vehicle’s Fuel tank capacity
4103-4104
4105 Cello-CANiQ: Speed Correction Delta

Manual
Address Purpose
4108,4109 (Infrastructure)
4118-4123 Spare
4118-4123 (Infrastructure)
4130-4204 Cello-CANiQ Standard OBD2 Queries configuration
4205-4399 Cello-CANiQ NonStandard OBD2 Queries Definition
4400-4525 Cello-CANiQ: CAN Bus Filters Configuration
4530-6500 Cello-CANiQ: CAN Trigger Configuration Space
Car Sharing 2: Dallas keys 95 till 100

6500 – 6541
PHSN BS Bluetooth page mode

6542
PHSN BS Bluetooth scan mode

6543
PHSN BS Bluetooth pin code 8 bytes

6544
PHSN BS Bluetooth baud rate

6545
Spare
6546 – 6655
6656-8191 Cello-IQ GNSS, Cello-CANiQ New GNSS programming parameters:

(See CSA Programming Manual.docx for details)
5.2 Bitmask Field Allocations

This field describes the allocation of configuration bits in the bitmap configuration bytes.
The description of each bit is provided in other sections in this document.

Manual
5.2.1 Application Configuration

Address: 0, Application Configuration byte 1
Enable
Presentation Enable Active
infinite
Ignition filter of inputs in conditional Logged
driver
Enable warning source for wireless activation (Plain)
Enable Long notification
output activation starting Driver Cellocator of Events
Transparent Transmission when
during Gradual Authentication protocol immobilizer
Mode Ack. Timeout Driver is Enable
immobilization time not
calculations identified (CelloTrack
t)
Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Wake up Enable Enable Enable Generate an Ignore Geo- Shorten Enable

from Command Immobilizer modem’s event per Violations on cellular automatic
hibernation Authentication activation power AHR Boot registration hibernation
upon while there is control by timeout on low power
periodical no Door
Usage Authentication input
counter code
update timer
expiration
Bits 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Address: 3, Hibernation mode communication settings
Reserved Enable Reserved Renew GPRS

Outgoing Voice upon drop in
Call in (in semi-
hibernation hibernation)
Bits 7 Bits 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Address: 4, Hibernation mode communication settings
Enable Pre- Enable Pre- Enable Data Reserved Enable Reserved Enable Enable Auto
Hibernation Hibernation Forwarding Incoming Intermediat Answering
distress event From Serial Voice Call in e state of Incoming
Port By SMS semi- Anti-flooding call in semi-
in semi- hibernation in semi- hibernation
hibernation hibernation
Automatic CFE Enable CFE Overlapping Enable GPS Reset GPS Reset Disable Active Enable
Power mode Geo-Fence Privacy on ignition on ignition Transmissions CFE as I/O
control logic: Mode off off Extender
(Infrastructure) Global/ When not When in
Discrete in Navigation
navigation

Manual
Reserved for CAN Bus Forward LED Synchronize Enable PSP Enable LED output
related parameters data, Management unit’s time Usage state after
received disable with GPS time Counters Power Recycle
from COM only when GPS 0-LED inactive
port as a is navigating
text SMS 1-Disable 1-LED Active
0-Enable (Infrastructure)
Bit 7 Bit 6 Bit 5 Bit 4 Bit3 Bit 2 Bit 1 Bit 0
Enable Enable CFE Enable Enable IMEI Enable CFE Enable CFE Enable Voice Enable Max
RemoteCamera data updates Auto- transmission connected& connected& call status Speed
during programming via type 0 disconnected disconnected (Type 35h) Report
Ignition Off of CFE due to bytes 33-38 events distress message
CRC32 error and bits 5,6 over serial
of type 0 interface
byte 41
Enable Enable Consider CelloTrack Disable GSM Enable Enable Auto Enable OTA Ack
software Offline Unknown Jamming Event Garmin SIM PIN to Forward from
Telit APS
flow control tracking Operators Support locking OTA to Serial
mode (Legacy + Ignition
(XON/XOFF) As Data Packet
On)
Forbidden
Enable Enable Enable Enable Enabling Backward Spare (was: Enable

controlling of Trailer Trailer differentiation reading a compatible Enable Monitoring
employees Connection Connection between the 256-bit OTA msg Radio- Off. logical status
work time Distress Event driver and EEPROM of type 8 The link of Ignition in
the DS1971 below is for OTA packets
passenger explanation
on that
feature )
Driver Enable Enable Coasting detection configuration Charge

Manual
Behavior event for Distress Enable Enable RPM Speed battery

(CSA) additional for Distress event for threshold threshold irrespectiv
Disable freq. additional for Coasting type type ely to an
0-Enable threshold freq. Coasting operationa
violation threshold l mode
1-Disable violation 0 – lower 0 – lower
0– than than
0– (default) 0–
disable 0– 0– disable 1- higher disable
disable disable 1- Enable 1- higher than
1- Enable than (default) 1- Enable
1- Enable 1- Enable

Modem
Disable Advanced Firmware functional Universal Homologation USIM Infrastructu
GSM GSM modes: Radio initialization applicatio re
Jamming Jamming Communicat mode n Robbery
Event Detection ion Tester 0- Disabled 0- USIM Mode while
0- Legacy Fleet application
(Ignition (Ignition 0-Disable 1- Enable driving
mode Disabled
Off) On/Off 1-Enable 0-Disable
behavior) 1 – Legacy Fleet
and Advanced 1- USIM 1-Enable
0-Do not Recovery Mode Production applicatio
Disable (External KeyPad) tester only n
1-Disable Enabled,
SIM
Applicatio
n Toolkit
disabled

Local RPM
Spare Enable Calibration Force one Force one
Report on Enable second second
engine resolution resolution
hours 0-Disable for Roam. for Home.
1-Enable
from 0-Legacy 0-Legacy
engine resolution resolution
RPM
enable 1- one 1- one
Second Second
(supporte resolution resolution
d by
40,50
variants
only)
0-Disable

Manual
1-Enable
5.2.2 Communication Settings in Home/Roam GSM Network Mode

Address: Home GSM: 201; Roam GSM: 203; Hibernation: 3
Enable SMS Enable Unused Generate Generate GPRS Enable Unused

outgoing Cell ID Cell ID
Voice Call packet (RT) packet
with any (logged) with
distress any event
while there is while there is
no valid GPS no valid GPS
Address: Home GSM: 202; Roam GSM: 204; Hibernation: 4
Unused Disable Disable Enable Enable IP up Enable Auto Answer

forward from active incoming event Intermediate Voice call (if
serial port to transmissions Voice Call state of Anti- incoming
SMS via SMS flooding voice
enabled)
5.2.3 WAKE UP Message Configuration

Address: 1344
Enable GPRS Enable SMS Number of repetitions,

Wake up message Wake up Value of zero set number of retries to 64
message
5.2.4 GPS Management Bitmap

Address: 509
Enable Tight GPS Not used CR200/CR300 Reset last known Enable Pythagoras Enable Speed x Time
PMODE Filter GPS location on Ignition Calculation Calculation (SxT)
management off
Enable
0-Normal
1-Managed
Bit 7 Bits Bit 3 Bit 2 Bit 1 Bit 0

6,5,4

Manual
5.2.5 Maintenance Server Configuration Bitmap

Address: 1398
Reserved Enable auto Reconnect to the Enable connection Enable firmware Enable
connection to maintenance to the upgrade from the programming
maintenance server after maintenance maintenance updates from the
server firmware upgrade server on each server maintenance
power up. server
Bit 5-7 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
5.2.6 GSM Band / GPRS Auth Type Programming

Address: 1354
GSM Band PPP GPRS GSM band (only for Manual GSM Band Selection PPP GPRS Connection
Selection Mode Connection mode) Authentication type
Authentication (only for Manual
Selection Mode Authentication type
Selection mode)
5.2.7 UART Configuration

Address: 471
Reserved Baud rate
Address: 472
Reserved Flow Control Stop Bits Parity
5.2.8 Alternative Inputs Usage Bitmap

Address: 465
Not used "Private"/"Business" Enable modem’s Enable Initialization &

mode toggling power control by Answering Voice Call
shock input by Shock input
Bits 3-7 Bit 2 Bit 1 Bit 0

Manual
5.2.9 Inputs Triggering Distress Voice Call

Address: 505
Unused Door input Panic button
5.2.10 Speaker of Hands Free - Mute settings, CR300 Outputs Control

Address: 506
Spare CR300 LIGHTS output options: CR300 LED output options: Spare Temporary Temporary
Mute Speaker Mute Speaker
During during auto-
Distress Calls answered
V Description V Description
incoming
al al calls
ue ue 0-Don’t Mute
0-Don’t Mute
1-Mute
0 Legacy LIGHTS 0 Legacy LED 1-Mute
output behavior output
behavior
1 LIGHTS output
Acts as STD 1 LED Output
Immobilizer Acts as STD
Immobilizer
2 LIGHTS output
Acts as PWM 2 LED output
(GRADUAL) Acts as PWM
Immobilizer (GRADUAL)
Immobilizer
3 N.A: Same as
option 0 3 N.A: Same as
option 0
Default value:
Bit 0: Do not mute
Bit 1: Do not mute
Bits 3, 4 set to 0: CR300 LED output act as legacy LED signal
Bits 5, 6 set to 0: CR300 LIGHTS output acts as legacy LIGHT signal.
NOTES:
1. When the CR300 STD immobilizer output is switched to "Blinkers" or "LED" Output,
the output will be automatically activated immediately after SW/HW reset or Power
Recycle.
2. When the CR300 output acts as LED or SIREN it will preserve its state after
SW/HW reset but not after power recycle.

Manual
5.2.11 CR300B 3G I/O control

Address: 1000
These configuration bits controls the direction of the CR300B 3G I/Os. Each bit can be
configured to function as Input or output. Please note that when LED and LIGHT are
configured as output, their output source can be selected by parameter: “CR300 Outputs
control” in address 506.
CR300B 3G LIGHT Pin CR300B 3G LED Pin CR300B 3G Shock Pin CR300B 3G Door Pin:
Description Description Description Description

0 GPIO disabled 0 GPIO disabled 0 GPIO disabled 0 GPIO disabled
1 Input (unlock) 1 Input (Lock) 1 Input (Shock) 1 Input (Door)
2 Output (See “ CR300 2 Output (See “ CR300 2 Output (PWM 2 Output (STD
Outputs control”) Outputs control”) Immobilizer) Immobilizer)
3 Input and Output 3 Input and Output 3 Shock and PWM 3 Door and STD
Immobilizer Immobilizer
Bits 6,7 Bits 4,5

Bits 2,3 Bits: 0, 1
Default value:
Bit 0: Door – Input - 1
Bit 1: Shock – Input - 1
Bit 2: LED – Output - 2
Bit 3: LIGHT – Output - 2
5.2.12 Volume and Gain Control Byte

Address: 1402
Ringer (Side tone) volume Speaker's Volume Mic. Gain
5.2.13 Time Based Mask Bitmap

Address: 493 for events
494 for distress
Only in 494 Unused Enable Time events Enable event for

Communication Idle
Do not wake up from hibernation

upon comm.idle distress

Manual
5.2.14 Over (and Idle) Speed Session Control Bitmap

Address: 492
Create Idle/Over Start Idle speed Don’t use time Don’t use time Multiplier for filter of Idle Speed Start
Speed End event timer with ignition filter to close Idle filter to close Over Session
for open session On speed session speed session
per ignition Off
5.2.15 Go/Halt Session Control Bitmap

Address: 1390
Spare Spare Don’t use time Multiplier for Go/Halt Time Threshold filter
threshold filter for
For "Halt" detection
"Go" detection
Bit 7 Bits 5,6 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
5.2.16 GPS Alerts Mask Bitmap

Address: 99 For events
102 For distress
103 For HRLS
Enable event Enable event Enable Enable Enable Idle Enable Over Enable Enable GPS
upon location upon speed Sudden Sudden Speed Speed Distance Navigation
change detection Course Speed Events Events Events Start/Stop
detection when Change Change Events
when Ignition Off Sensor sensor
Ignition Off
Address: 496 For events

497 For Distress
498 For HRLS
Not used Enable Go/Halt Enable Event per Enable GPS

Events GPS Auto Factory Disconnection
0 – Disable reset
1 - Enable

Manual
5.2.17 Time Report Period Value (Home, Roam, High Speed)

Address: For Home GSM: 106
For Roam GSM: 499
Resolution Basic Period Value (BPV)

Definer
5.2.18 Time/Distance Alert Multipliers for High Speed Mode

Address: For Home GSM: 92
For Roam GSM: 35
Time Event Multiplier for HIGH SPEED mode Distance Event Multiplier for HIGH SPEED mode
5.2.19 Mask of Authentication Alerts

Address: 123 for events
Enables Enable Enable Enable Enable Enable Pre- Authenticatio Driving

Dallas Bus resending Authenticatio Authenticatio “Dallas ID defined n updated without
"Driver n n reminder updated” driver ID’s event Authenticatio
Authenticatio confirmation output event even if list n
0 –Bus mode n" upon each output activation it is not in
1 –Point to detection activation the list
point (Bus
mode
disabled) Not used
Address: 484 for distress
Not used Authentication Driving

updated event without
Authentication

Manual
5.2.20 Discrete Inputs Masks

Address: For Inversion 100-101
Inputs Events on Failing 124-125
Inputs Events on Raising 126-127
Inputs Distress on Failing 128-129
Inputs Distress on Raising 130-131
HRLS Trigger Mask of Inputs Falling 486-487
HRLS Trigger Mask of Inputs Raising 488-489
Security inputs mask bitmap 422-425
Lower byte
Driving
Status
Unlock Panic (Ignition or CFE In 1 Shock Door
accelerometer
based)
Upper Byte
Ignition Accelerometer
Input as GP status CFE In 6 CFE In 5 CFE In 4 Lock CFE In3 CFE In2
input
5.2.21 Mask of Analog Inputs Alerts

Address: 121 for events, 122 for distress, 490 for HRLS
Ignition Switch On Ignition Switch Off
Backup Backup battery Main Main Power Backup Backup battery Main Main Power
battery disconnected Power Disconnected battery disconnected Power Disconnected
Low level Low Low level Low
Level Level

Manual
5.2.22 GP Frequency Input Configuration Byte

Address: 1677 for Door input
1690 for Shock input
Ignore Don't use time Enable voltage Enable voltage Enable voltage Enable voltage Input violation type
violation on filter for / frequency / frequency / frequency / frequency
Ignition On voltage / violation end violation end violation start violation start
frequency distress event distress event
violation end
0– 0 – Low
Thresh. 1 - High
0-Ignore
0-Use
1 – Start 0-Disable 0-Disable 0-Disable 0-Disable 1– 0 – Keep
violation on 1 – Don't use 1 - Enable 1 - Enable 1-Enable 1-Enable Range In
Ignition On 1 - Keep
Out
5.2.23 Violation of Additional GP Frequency Thresholds

Address: 1351
2nd additional GP frequency threshold 1st additional GP frequency threshold
Enable distress Enable Event Enable distress Enable Event Enable Enable Event Enable Enable Event
for failing for failing for raising for raising distress for for failing distress for for raising
violation violation violation violation failing violation violation raising violation
violation
5.2.24 Outputs Inversion Mask

Address: 502
CFE Out 5 CFE Out 4 CFE Out 3 CFE Out 2 Gradual Stop Unused CFE Out1
Address: 503
Stand.
Unused CFE Out 6 Unused Blinkers Unused Unused Unused
Immobilizer

Manual
5.2.25 Geo-Fence Alert Mask

Address: 1004 - For events
1005 - For distress
Unused Speed No Modem Geo Hot Spot Way Point Keep Out Keep In
Limiting Geo- Zone Entry Traversal violation Fence Fence
Fence Event violation violation
5.2.26 Silent Delay Configuration

Address: 1401
Trigger Silent Trigger Silent

delay upon delay upon
Time between Silent Delay expiration beeps Number of Silent Delay expiration beeps
Door open Ignition On
detection detection
5.2.27 Offline Tracking - Auto Upload Configuration

Address: 255
Unused Memory Ignition Off

Full Event
5.2.28 Security Settings Bitmask 1

Address: 421
Unused Trigger an Alarm Upon

Towing Detection During
Alarm Armed
5.2.29 Security Settings Bitmask 2

Address: 424
`Unused Trigger an Alarm Upon

Main Power Disconnection
Detection

Manual
5.2.30 Security Logic Configuration

Address: 428
Unused Auto-gradual Unused Auto Arming Disable Auto Does Not Unused
stop Enable Independent Arming Trigger
from door Silent delay
upon
Unlock
detection
5.2.31 Feedbacks / Alarm Triggered / Alarm Cadence Outputs

Address: 449 For Feedbacks
450 For Alarm Triggered outputs (CelloR) / Alarm Cadence outputs (CelloAR)
Siren
Note: this
Unused Blinkers Unused output is
unavailable for
CAN variants
5.2.32 Active Correlation Lines

Address: 287
Unused Shock (pin 15) Unlock (pin 11) Lock (pin 5)
5.2.33 Vector Change Detection Bitmask

Address: 1433
Reserved Prevent Enable Enable Vector Enable Vector

Curve Compress change change
Smoothing Vector Detection Detection
Message change Distress Events
generation Detection
during "Halt"
mode

Manual
5.2.34 Garmin Configuration

Address: 285
Enable Data Forward data Discard Enable Backward Disable Ping Enable Enable
forwarding as a Garmin Cellocator MDT compatible Garmin Garmin Garmin
through log Container packets Time/Zone Mode (for protocol connected / connected /
during NoIP/ synchronization terminals upon disconnected disconnected
NoGSM not reporting connection Distress Events
A604 as part
of their
protocol
support data
0 – Normal 0 – Disable 0 – Disable 0 – Disable

Mode (Ping (default)
to Garmin, 1 – Enable 1 – Enable
default) 1 – Do not (default) (default)
disable
1–
backward
Compatible
(FM Enable
to Garmin)
5.2.35 Feedback for Driver Behavior Violations Bitmask

Address: 2376
Reserved Excessive Idle Sudden Harsh Harsh Coasting Over Speed

RPM Speed course Acceleration Breaking (irrespective
change of the source
of threshold)
5.2.36 Driver Behavior Continuous Violation - Feedback Bitmask

Address: 2377 for first output
2380 for second output
reserved Output Activation Pattern (Upon Driver Output, auto-activated upon Driver behavior
behavior violation) violation detection

Manual
5.2.37 Driver Behavior Continuous Violation - Output Activation Template

Number of activations in a session Activation length

Time between the activation sessions Number of activation sessions
5.2.38 Driver Behavior Continuous Violation - Feedback Logic

Address: 2383
Sustain Sustain Sustain

Excessive Coasting Speeding
Feedback Violation Deactivation time threshold
RPM violation violation
In seconds
violation feedback till feedback till
feedback till violation violation
violation ends ends
ends
Bits 0, 1, 2:
Name in Programmer:
 Sustain Speeding violation feedback till violation ends
 Sustain Coasting violation feedback till violation ends
 Sustain Excessive RPM violation feedback till violation ends
Description: This bit enables the user to sustain continuous violation feedbacks
(according to template) till violation ends. If the bit is cleared then the feedback
template will be generated once.
Type: Flag
Default value: 10
Range:
Bits 3 to 7:
Name in Programmer: Feedback Violation Deactivation time threshold

Description: if Output Activation Pattern (Upon Driver behavior violation) is set to
option number 5 (Warning of delayed violation registration) Continuous violations will
be deactivated when the violation time will be longer than the time defined in this
field. Please refer to Feedback Violation Deactivation time threshold

Manual
Type: Decimal
Default value: 10
Range: 0 – 255
Units: 1 Second
5.2.39 Driver Behavior Momentary Violation - Output Activation Template

Number of repetitions (Duty Activation length (in resolution of 0.5

Output number
cycle 50% ) seconds).
5.2.40 Outputs, Auto-Activated upon Jamming Detection

GSM jamming detection can activate outputs for Driver feedback. The configurable
options enable the selection of one of the unit’s outputs, and define the patterns sent over
the selected output. It is possible to activate up to two outputs for a jamming event.
When the advanced jamming mode is enabled (see Advanced GSM Jamming Detection
Mode), the unit differentiates between GSM jamming detection during Ignition-ON and
Ignition-Off. Each jamming condition can activate up to two outputs. The advanced mode
reuses the same outputs activation configuration used in the non Advanced mode for
jamming Outputs activation during Ignition-On.
5.2.40.1 Outputs, Auto-Activated upon Jamming Detection (while in Ignition-On state)
Output Activation Pattern upon jamming detection

Addresses: 2426 (and 2429 for second output)
Activation Pattern Output number
Template of Output Activation upon Jamming Detection byte 1

Address: 2427 (and 2430 for second output)
Number of Activation pattern cycles in a session Output Activation length
Template of Output Activation upon Jamming Detection byte 2

Time between the activation sessions Number of sessions

Manual
Delay for output activation upon jamming detection

Delay for output activation
5.2.40.2 Outputs, Auto-Activated upon Jamming Detection while in Ignition-Off
Output Activation Pattern upon jamming detection – Ignition-Off

Addresses: 205 (and 208 for second output)
Activation Pattern Output number
Template of Output Activation upon Jamming Detection byte 1 – Ignition-Off

Number of Activation pattern cycles in a session Output Activation length
Template of Output Activation upon Jamming Detection byte 2 – Ignition-Off

Time between the activation sessions Number of sessions
Delay for output activation upon jamming detection – Ignition-Off

Delay for output activation
5.2.40.3 Release Options of Jamming Detection
Address: 522
Advanced Advanced
Jamming Jamming
Enable release by Enable release by detection: detection:
Authorized Dallas Ignition Activity
Enable release Enable release
by Jamming by Jamming
End in End in

Manual
Ignition-On Ignition-Off
5.2.41 Accelerometer Configuration

Address: 467
Spare Enable Towed Detection Movement Enable GPS Use

mode Sensitivity Detection type: wake up upon "movement
0 Disable 0 - Very (movement / movement for detection" by
insensitive engine status) towing accelerometer
Enable detection for Start/Stop
1 - Normal
(don't care if 0 – Start/Stop
2 - Very 0 – movement
bit 0 is set) alerts by status
sensitive 1 – engine of Ignition
status 0 – Don't use
3 - spare switch
1 – Use. (legacy),
1 – Start/Stop
alerts by
movement
detection using
accelerometer.
If this bit is
enabled, all the
logic normally
dependent on
status of
Ignition Switch
will be re-
linked to the
status of
Movement
detection.
Bits 7 Bit 6 Bit 5 Bits 3-4 Bit 2 Bit 1 Bit 0
5.2.42 Towed Mode Configuration

Address: 470
Reserved Enable Towed Enable Towed

Start/Stop Start/Stop
distress events
Bits 7 Bit 6 Bit 5 Bits 3-4 Bit 2 Bit 1 Bit 0

Manual
5.2.43 Cello AR Keyboard Configuration Bitmask

Address: 1709
Keyboard disconnection Wrong keyboard detection Keyboard Enable

Disable (0) Disable (0) message Keyboard
type 9 data
Enable (1) Enable (1) source (Log
or Direct)
Distress
Log Alarm Log Distress Alarm
Cadence Cadence
Log (0)
Real time Disable (0)
(1) Enable (1)
Address: 1710
Unused Disable pairing Generate Msg. Activate Alarm Malfunction report Enable
When paring is Type 0 reply Cadence upon (Cello-AR Messages) Forwarding
disabled an for a Hot Wiring data from
commands detection Disable (0) keyboard to
Keyboard
communication addressed to Enable (1) Serial Port
lost detected Keyboard
Disable (0) Log Distress
the same
paring event Enable (1)
Disable (0) Disable (0)
will
Enable (1) Enable (1)
Enable (0)
Disable (1)
5.2.44 Cello AR: Alarm Cadence duration and cycles

Address: 1712
Reserved Number of cycles
Address: 1713
On Time of Alarm Cadence activation (3 Seconds/bit) Off time (between activations, 3 seconds/bit)

Manual
6 Communication and Configuration
6.1 Communication Settings
6.1.1 GPRS Settings
6.1.1.1 Acknowledge OTA
6.1.1.1.1 Message Transit Acknowledge Timeout
Address: 139
This parameter defines the maximum time the unit will wait for server to acknowledge a
plain event (plain events are one of the four available event generation patterns proposed
by Cellocator unit; refer to the Event Types section in this document). If no ACK is
received by this time, the event will be retransmitted.
Event Delivery Algorithm
Once generated, a plain event is stored in the unit’s Log memory.
This Log memory can store up to 8946 plain events.
When the Log memory is full, newer events will push out the
older ones (FIFO). Events will be uploaded to the Control
Center only when GPRS is available and will be deleted from
the unit’s Log memory only when acknowledgment is received Log memory queue Pending event
Up to 8946 events waiting for Ack
from Central Control. NOTE: Plain events will never be
delivered by SMS!
The unit supports one pending event waiting for server acknowledgment. When server
acknowledgment is received, the pending event is deleted from the Log memory head,
and the next event is moved to the pending event data structure in order to be sent to
the server.
NOTE: Legacy units used to have 16 concurrent pending events.
If the Acknowledge is not received during the time defined in Message Transit
Acknowledge Timeout, the event is resent.
Data format: 8-bit unsigned. Resolution is 20msec or 160mseconds, according to the
value of Acknowledge Timeout Extension Multiplier bit, see below.
Note that there is a separate control of ACK to forward data message from server to 3rd
party device connected to the serial port of the unit (application configuration byte 5).
Value span: 00h to FFh (=5.1sec or ~40 seconds)
Default value: 200 (4sec)

Manual
6.1.1.1.2 Acknowledge Timeout Extension Multiplier
Address: 0 bit 6
If this bit is enabled (1) the resolution of Message Transit Acknowledge Timeout
parameter will be 160mseconds/bit, otherwise 20msec/bit
Default value: 1 (160mseconds/bit)
6.1.1.2 Anti-flooding
The Anti-Flooding mechanism is designed to minimize the unit’s message Retransmissions
in situations where GPRS connection is available but the server is unreachable.
The Anti-flooding will randomize the idle communication time between message
retransmission sessions to avoid server overloading in situations where the server
becomes available after period of server unavailability and to avoid network overloading.
Configuration
Received Messages Anti-Flooding

Ack. Mechanism
Modem Reset
5 sessions 5 sessions
Pending 5 sessions
Message
Logged Events Events
Send Random
Queue Buffer
Process Communication
(up to 16) Idling
6 message
retransmissios
The block diagram above describes the Anti-Flooding mechanism. The Anti-Flooding
mechanism’s most important input is the received server acknowledgment; in case there
are no ack. messages returned from the server, the Anti-Flooding mechanism will
implement the following retry patterns:
1. Send each pending message 6 times while waiting for ack. between each
transmission.
2. Repeat the above sessions 5 times.
3. Stop transmissions for a random time based on “Anti-Flooding timer” and “Anti-
Flooding randomization threshold” configurable parameters (see Anti-Flooding timer,
Anti-Flooding randomization threshold). This random period is defined in the diagram
as “Random Communication Idling”.
4. Reset the modem.
5. Go to step 1.

Manual
The Anti-Flooding has another sub operational mode called “Intermediate state of Anti-
Flooding” which when enabled blocks message transmission till only after IPUP is
acknowledged by the server. This operational mode will start logged events transmission
only after the server is guaranteed to be responsive. Enabling this mode will implement
the above Anti Flooding behavior only for IPUP messages while not saving IPUP events
into the log memory. Refer to Intermediate state of Anti-Flooding Activation Control. The
Intermediate Anti Flooding mode can be selected to work in Home network, Roam
network and in hibernation.
6.1.1.2.1 Anti-Flooding Timer
Address: 284
Description: This parameter defines a "communication idling" timeout, used by the unit
to decrease a communication costs during the server (CCC) failure.
Data format: 1 byte with a resolution of 1 minute
Value span: 0-255minutes, a value of zero means no delay between the sets
Default value: 0
6.1.1.2.2 Anti-Flooding Randomization Threshold
Address: 1353
Description: In case of server failure all the units are entering Anti-Flooding
simultaneously and, as a result, reconnecting to CC simultaneously after the Anti-Flooding
delay expires. This causes a heavy load of communication on the CC server and might
cause a new crash. In order to prevent this issue it is possible to randomize the Anti-
Flooding timer.
The timer is restarted every time with a different value, limited by a programmable
threshold.
(A – Ta)≤ Anti-flooding interval≤(A+ Ta)
A - Anti-flooding timer parameter
Ta - Anti-flooding threshold, programmed in EEPROM
Wrong programming protection:
if A≤Ta the unit will NOT use the low limit of randomization.
Data format: Resolution of programmable threshold is 30 seconds, 1 byte

Value span: 0-127 minutes, a value of zero means no randomization
Default value: 0
6.1.1.2.3 Enable IP Up Alert (Event)
Address: 202, bit 2 for home network

204, bit 2 for roam network

Manual
Description: The "IP up" alert is generated with every dial-up to GPRS in order to
update the Central Control with the resent IP address of the unit. In cases when SIM card
is associated with static IP, it is possible to cancel IP up events.
Note that “IP Up event” CANNOT be disabled if Intermediate state of Anti-flooding is
enabled.
Default value: 1 – both enabled
6.1.1.2.4 Intermediate state of Anti-Flooding Activation Control
Address: 202, bit 1 for home network

204, bit 1 for roam network
4, bit 1 for hibernation, if enabled for active GSM network
Description: If Intermediate state is enabled, the unit will not store IP Up events into log
memory. When dialing to GPRS, only IP Up messages will be sent to the server. The unit
will not try to download accumulated event before reception ACK to the IP Up message
(see Anti-flooding description above).
Default value: all three enabled (1)
6.1.1.2.5 Enable Active Logged (Plain) Events (CelloTrack T)
Address: 0, Bit 0
Description: “Active Logged Events” is a new configurable feature designed to enhance
the functionality of legacy logged events. The feature affects all events configured as
logged (or plain). For more details refer to Active Logged (plain) Event.
Default value: Disable
6.1.1.3 Operational Server Support

The operational communication server is used for uploading positions and other events
from the end unit. Normally this will be a communication gateway of the Central Control
application.
6.1.1.3.1 Operational Server APN
Address: 36-65
Name in Programmer: APN
Description: This parameter contains an APN used upon dialing to an operational
communication server.
Data format: 30 bytes string, first byte is length
Value span: First byte 0 to 0x1D, second to 30th - ASCII characters
Default value: ASCII "internet"

Manual
6.1.1.3.2 Operational Server APN Username
Address: 8-31
Name in Programmer: GPRS PPP Username
Description: This parameter contains a PPP username used upon dialing to an APN
defined for operational server.
Value span: First byte 0 to 0x17, second to 24th - ASCII characters
Default value: ASCII "test"
6.1.1.3.3 Operational Server APN Password
Address: 141-164
Name in Programmer: GPRS PPP Password
Description: This parameter contains a PPP password, used upon dialing to an APN
defined for operational server.
Value span: First byte 0 to 0x17, second to 24th ASCII characters
Default value: zeroes
6.1.1.3.4 Operational Server IP Address
Address: 66 to 69
Name in Programmer: Default Target IP Address (for GPRS)
Description: Stores an IP address of the operational server. All the messages (both
active and passive, irrespectively to the source of the incoming command) during normal
operation will be sent to this IP address.
If this parameter contains zeros, the unit will use an operational DNS instead.
Data format: 4 bytes IP address, Intel order (low significant bytes first)
Default value: varies (change to the IP address of central command)
6.1.1.3.5 Operational Server DNS Address
Address: 2464-2495
Name in Programmer: Default target DNS Address (operational server)
Description: The Domain Name System (DNS) is a hierarchical naming system for
computers, services, or any resource connected to the Internet or a private network. It
translates domain names meaningful to humans into the numerical (binary) identifiers
associated with networking equipment for the purpose of locating and addressing these
devices worldwide.
In our case the DNS support is required in order to prevent a necessity to assign a static
IP to each of the servers (operational and maintenance).

Manual
A domain name usually consists of two or more parts (technically labels), which are
conventionally written separated by dots, such as example.com.
Cello supports down to 2 levels subdomains (e.g. XXX.XXX.XXX.XXX), maximum
length is 32 chars.
Labels are restricted to a small subset of the ASCII character set known as LDH,
the Letters A–Z in upper and lower case, Digits 0–9, Hyphen, and the dot to separate
LDH-labels; see RFC 3696 section 2 for details.
The DNS will be used for dial up only if the IP address field of the corresponding server (in
programming memory) is set to zero (e.g., 0.0.0.0).
If the IP address field of the corresponding server is not set to zero – the unit shall use
this IP address for dial up.
Data format: 32 bytes string, first byte is length.
6.1.1.3.6 Listening UDP Port (while connected to both Operational Server or

Maintenance Server)
Address: 107-108
Name in Programmer: GPRS Self Port
Description: This parameter stores the listening UDP port. This should be the
"destination port" of incoming UDP messages, it will also be sent as a "source port" of an
outgoing transmissions.
Value resolution & span: 0- 65535’
Default value: 231
6.1.1.3.7 Operational Server Target Port
Address: 109 -110

Description: This parameter stores the "destination port" of outgoing UDP or TCP
(depends on Modem Type code) messages while connected to the operational server. This
will be the also listening UDP or TCP port of target host.
Value resolution & span: 0- 65535’
Default value: 231
6.1.1.3.8 Modem Type Code for Operational Server
Address: 74
Description: This parameter defines dial up type, which is differs according to the
communication platform and modem connected.

Manual
Valid values: According to the table below:
Value Network
0 UDP/IP over GPRS
1-3 Not supported
4 TCP/IP over GPRS
Default value: 0
6.1.1.4 Maintenance Server Support

The Cellocator unit supports a periodic connection to the maintenance server, which is
used as a Service & Support Server.
It is possible to set an additional APN, IP address, ports and dial up type for the
Maintenance Server; this server will be used for a periodical service communication
sessions.
It is also possible to force the unit to connect to the specific server manually, using the
OTA command (SMS or GPRS). If the command to connect to maintenance server is
received during the communication peak of full hibernation – the unit will connect to
maintenance server upon the end of the peeking.
The unit periodically connects (completely drop an existing connection and redial using
the dedicated APN) to this server in order to check for the latest firmware and /or
programming update. It is possible to enable auto connection to the maintenance server
upon power up and upon firmware upgrade.
The connection to the maintenance server:
In TCP mode - TCP socket establishment and a Maintenance Platform Manifest* packet
paste into this socket.
In UDP mode - it will be just a Maintenance Platform Manifest* UDP packet delivery to
the Maintenance server and use listening port according to the configuration of the
maintenance server.
An acknowledge (OTA message type 4) should be received in with a defined timeout;
otherwise the platform manifest will be resent.
In case the unit cannot establish a connection to the maintenance server while the GPRS
is available, it will use a dial up retry algorithm defined in Anti-Flooding section of this
document.
If all the retries fail, the unit will stop trying and connect back to an operational server
(instead of entering Anti-Flooding, as it would do while connected to an operational
server).
If the timeout of periodical connection to the maintenance server expires while the unit is
hibernating, it will not wake up; instead it will dial the maintenance server immediately
after the next COM glancing.
It is possible to disable firmware upgrades or programming from the maintenance server.

Manual
The unit automatically disconnects from the maintenance server and connects back to its
operational communication server after 3 minutes after the last communication
transaction.
The unit does NOT send logged or distress events to the maintenance server. It keeps
logging events as usual during the maintenance session (except during firmware
upgrades) but does not upload them. The unit will reply to commands sent from a
maintenance server.
Distress alerts and real time based alerts that occurred during the maintenance session
will be lost.
The unit will ignore the incoming voice calls and the incoming SMS notification during the
maintenance session (the SMS will be processed after the maintenance session end).
Outgoing voice call initiation attempts (both plain and emergency) are ignored during the
maintenance session.
After any reset occurred during the maintenance session (except the final reset of
firmware upgrade procedure, see bitmap below) the unit will connect back to the primary
server.
6.1.1.4.1 Enable Programming Updates from the Maintenance Server
Address: 1398’, Bit 0

Description: If this bit is enabled the unit will accept updates of programming
parameters from maintenance server.
Default value: 0 - Disable
6.1.1.4.2 Enable Firmware Upgrade from the Maintenance Server

Description: If this bit is enabled the unit will perform firmware upgrade if the process
will be initiated from maintenance server.
6.1.1.4.3 Enable Connection to the Maintenance Server on each Power-Up.

Description: If this bit is enabled the unit will automatically connect to the maintenance
server upon each power up.
6.1.1.4.4 Reconnect to the Maintenance Server after Firmware Upgrade
Address: 1398, Bit 3

Description: If this bit is enabled the unit will automatically reconnect to the
maintenance server after firmware upgrade (irrespectively from what server, main or
backup, the upgrade was performed).

Manual
If this bit is disabled the unit will connect back to an operational server immediately upon
the end of the upgrade, without even validation of the upgrade process success.
Reconnection to the maintenance server after firmware upgrade is normally required in
order to validate successful firmware upgrade and to set up new added configuration
parameters.
6.1.1.4.5 Enable Auto Connection to Maintenance Server

Description: If this bit is disabled the unit will never try connecting to the maintenance
server automatically (even if enabled in previous bits), but it will still be possible to force
the unit to connect to the maintenance server by a command from OTA.
6.1.1.4.6 Maintenance Server Connection Period
Address: 1399
Description: This parameter defines a time between automatic maintenance sessions.
Maintenance server connection period will automatically randomize, in order to prevent a
load on the maintenance server, caused by simultaneous connection of multiple units.
The randomization is affected by a unit's ID in the following way:
Real period = Programmed Period + {last 2 digits of decimal repr. of unit's ID} [min]
Data format: 1 byte with a resolution of 90 minutes (1.5 hours).
Zero – to disable automatic maintenance sessions
Value span: 0-15.9 days
Make sure to set a value different from zero while enabling this feature.
Default value: 16 dec (1 day)
6.1.1.4.7 Maintenance Server APN
Address: 1403-1432
Description: These parameters define a dedicated APN, used by the unit during GPRS
dial up only during a connection to the maintenance server.
Value span: First byte 0 to 0x1D, second to 30th - ASCII characters
Default value (Hex): 08 69 6E 74 65 72 65 61 6C 00 …

Manual
6.1.1.4.8 Maintenance Server APN Username
Address: 1626-1649
Description: This parameter contains a PPP username used upon dialing to an APN
defined for the maintenance server.
Value span: First byte 0 to 0x17, second to 24th - ASCII characters
Default value (Hex): 04 74 65 73 74 00 00 00 00 00 00 00 …. 00
6.1.1.4.9 Maintenance Server APN Password
Address: 1650-1673
Description: This parameter contains a PPP password, used upon dialing to an APN
defined for the maintenance server.
Value span: First byte 0 to 0x17, second to 24th ASCII characters
Default value (Hex): 00 00 00 00 00 00 00 00 00 00 00 00
6.1.1.4.10 IP Address (for GPRS) for Maintenance Server
Address: 1392 to 1395

Description: Stores the target IP address used by the unit during a maintenance session.
Data format: 4 bytes IP address, Intel order (low significant bytes first)
Default value: zeros (change to the IP address of the maintenance server)
6.1.1.4.11 Default Target DNS Address (Maintenance Server)
Address: 2394-2425
Description: As per the DNS for the operational server, described earlier in this
document.
The DNS will be used for dial up only if the Maintenance Server IP Address field is set to
zero (e.g., 0.0.0.0). If the IP address field is not set to zero, the unit will use this IP
address for dial up.
6.1.1.4.12 GPRS Target Port for Maintenance Server
Address: 1396-1397
Description: Those EEPROM cells store the "destination port" of outgoing UDP or TCP
messages (during the maintenance session). This will also be the listening UDP or TCP
port of target host.
Value resolution & span: 0 - 65535

Manual
Default value: 231
6.1.1.4.13 Listening UDP Port for Maintenance Server
Address: 107 -108

Name in Programmer: Listening UDP Port
Description: As per for the operational server.
6.1.1.4.14 Modem Type Code for Maintenance Server
Address: 1391
Description: This parameter defines the connection type of the maintenance server.
Valid values: According to the table below:
Value Network
0 UDP/IP over GPRS
1-3 Not supported
4 TCP/IP over GPRS
Default value: 0
6.1.1.4.15 Maintenance Server Session Time Update
Address: 1400
Description: The maintenance server will use default 3 Min session timeout when first
connecting to the C+ server. After the first message arrives from the maintenance server
to the unit, the FW will cancel the 3 Min time out, or what is left of it, and replace it with a
new session timeout value defined by this parameter.
Valid values: Min time 30 Sec: 3
Resolution: 10 Sec
Default value: 30 Seconds

Manual
6.1.2 SMS Settings
6.1.2.1 SMS Destination Address
Addresses: 187-196
Description: Stores the default target address used by the unit. Under normal
circumstances, this will be the SMS number of the SMS server of central control.
Note that this parameter defines only the default target address, which will be used only
for active transmissions (i.e. transmissions that are automatically generated by the unit).
Passive transmissions (i.e. replies for commands and queries) will be sent to the address
that generated the command/query.
Data format (GSM-SMS): First byte should contain the total amount of digits that make
up the actual address (not including address type byte). Second byte is the address type
byte, which should be 91h for international address (recommended type to use, to allow
roaming) or 81h for local address. The rest of the bytes contain the actual address,
encoded in BCD. The order of the transmission is bytes with lower address first, lower
nibbles (nibble = 4 bit) first. If only the lower nibble of a byte is used (this is legal only in
the last byte – in case this is the last digit of the address), the higher nibble should have
all of its bits set (the nibble should contain 15 dec). The rest of the bytes that are not
used should contain FFh.
Default value: NULL.
6.1.2.2 SMS Center Address
Addresses: 177 – 186

Name in Programmer: SMSC Address
Description: This parameter stores the address of the cellular operator’s SMS center.
This parameter is applicable only for units that make use of SMS.
Data format (GSM-SMS): First byte should contain the total amount of bytes that
actually contain the address (including address type byte). Second byte is the address
type byte, which should be 91h for international address (recommended type to use, to
allow roaming) or 81h for local address. The rest of the bytes contain the actual address,
encoded in BCD. The order of the transmission is bytes with lower address first, lower
nibbles (nibble = 4 bit) first. If only the lower nibble of a byte is used (this is legal only in
the last byte – in case this is the last digit of the address), the higher nibble should have
all of its bits set (the nibble should contain dec 15). The rest of the bytes that are not
used should contain FFh.
This number has to be either left blank or set to the correct value; otherwise the unit will
not be able to send any SMS message.
Example: If the parameter contains 07h 91h 79h 52h 14h 32h 54h F6h FFh, the address
that will be used is the international address +972-54-123456, from left to right.
Default value: NULL (blank).

Manual
6.1.2.3 Forward Data Received from COM Port as a Text SMS
Address: 7 bit 5
Description: This parameter is designed to enable usage of MDT 850/860 through SMS
brokers, normally allowing plain text SMS only.
If this bit is enabled (set to 1), the payload of every Forward Data packet received from
COM port will be immediately sent as a plain text SMS (ASCII) to the SMS Destination
Address.
Every text SMS received by the unit will be forwarded to the COM port in a “Forwarded
Data” format as a payload.
Default value: disabled (0)
6.1.2.4 Enable Active SMS in Hibernation
Address: 4, bit 4
Description: This bit enables preventing of an Active SMS generation in one of available
hibernation modes (during parking).
This bit can also be disabled when it is required to prevent SMS during GSM peeks (in full
hibernation only).
Default: 1 (Enable)
6.1.3 Comm. Permissions in Home/Roam Network
6.1.3.1 Enable GPRS
Address: In home network 201 bit 2, in Roam network 203 bit 2, in hibernation 3, bit 2
(see the follwoing parameter).
Description: If this parameter is enabled the unit will utilize GPRS whenever possible as
a default communication channel.
Default value: Enabled (1) In Home network, Disabled (0) in Roaming
6.1.3.2 Renew GPRS upon Drop (in Hibernation, GPS Peeking)
Address: 3, bit 2
Description: If GPRS is enabled, the unit will try maintaining GPRS session active all the
time, even if there is no data to transfer (for example on parking, during one of the
hibernation modes).
Due to resource reasons the GPRS network is searching for an idling connections and
actively shutting them down. Once the connection is down - the unit will try redialing the
network and generate an additional useless traffic and charge.
If this bit is disabled, the unit will not renew the GPRS session during hibernation upon
drop. The session will be restored only in case the unit is leaving hibernation due to an
Ignition On or Distress Session.

Manual
This bit can also be disabled when it is required to prevent GPRS dial up during GSM
peeks (in full hibernation only).
Default: 1 (renew session)
6.1.3.3 Enable SMS
Address: In home network 201 bit 7, in Roam network 203 bit 7

Description: If this parameter is enabled the unit will respond to a valid incoming SMS
commands and generate an active distress and real-time messages (if enabled in the next
parameter) when GPRS is not available.
Default value: Enabled in both Home and Roaming (1)
6.1.3.4 Enable Active Transmissions via SMS
Address: In home network 202 bit 4, in Roam network 204’bit 4

Description: If this parameter is disabled, the unit will not generate any active SMS
traffic (distress or real-time, except the "Wake Up" SMS messages, see description
below), even if SMS communication is enabled in previous parameter.
Default value: Disabled (1)
6.1.3.5 Enable Data Forwarding from Serial Port to SMS
Address: In home network 202 bit 5, in Roam network 204 bit 5

Description: If this parameter is disabled, the unit will not try forwarding data from a 3rd
party device connected to unit's COM port (over CSP or Transparent Data protocols)
through SMS, even if both of the two previous parameters are enabled.
It is also possible to disable forwarding data through separately for Hibernation only (on
address 4, bit 5).
If this bit is enabled the data will be forwarded through SMS only if:
1. GPRS is unavailable or disabled
2. The length of payload is not bigger than 82 bytes.
Note that OTA ACK is not required for data forwarded by SMS. The "SMS Sent"
indication from the GSM network is considered as a convenient confirmation.

Manual
6.1.4 COM port settings

Note that not all the available options are currently supported.
6.1.4.1 Baud rate
Address: 471, bits 0-3

Description: Defines the baud rate of unit's COM, as per the table below:
Note: If CFE device is enabled on this port, the unit will fixate on 460800 baud rate,
ignoring the configured value.
Value (dec) Baud rate (bps) Currently

supported
0 110
1 300
2 600
3 1200
4 2400
5 4800
6 9600 √
7 14400
8 19200 √
9 38400
10 56000
11 57600
12 115200 √ (default)
13 128000
14 256000
15 460800 √
Default: 12

Manual
6.1.4.2 Parity

Description: Defines the parity of unit's COM as per the table below:
Value (dec) Parity Currently supported
0 No Parity √ (default)
1 Odd Parity
2 Even Parity
3 Mark Parity
4 Space Parity
5-7 Unused
Default: 0
6.1.4.3 Stop Bits

Description: Defines the stop bits of unit's COM, as per the table below:
Value (dec) Stop Bits Currently supported
0 One Stop Bit √ (default)
1 1.5 Stop Bits
2 Two stop bits
3 Unused
Default values: 0
6.1.4.4 Flow Control
Address: d472, bits 5-6

Description: Defines the flow control of unit's COM, as per the table below:
Value (dec) Flow Control Currently supported
0 No Flow Control √ (default)
1 Software flow
control

Manual
Value (dec) Flow Control Currently supported
2 Hardware flow
control
3 Unused
Default values: 0
6.1.5 1-Wire port settings
6.1.5.1 Enabling Reading 256-bit EEPROM of DS1971 and Authentication by Group ID
Address: 0d1349, bit 3

Description: By default the unit is supporting reading unique iButton identifier from any
family of iButtons and using it as a driver authentication. In most cases DS1990A Dallas
keys (family ID 01) are used for this purpose.
The DS1971 (the family code of DS1990A is 01h; the family code of DS1971 is 14h)
provides, in addition to the unique iButton identifier, a 256-bit EEPROM, containing 10
decimal digits.
In our unit we use this storage in order to store group ID and User ID (refer to Extended
Driver Authentication section below in this document).
If this bit is enabled (1), and DS1971 is attached, the unit will:
1) Ignore the unique iButton identifier of the attached DS1971
2) Read 10 decimal digits from the 256-bit EEPROM of the attached DS1971
3) Treat them as User ID and Group ID: high digits represent a Group ID and lower digits
a User ID.
The Group ID length is variable and set up during unit’s initialization (refer to the
Extended Driver Authentication section).
Assuming that the number programmed in the EEPROM of DS1971 is 1234567890, and
Group ID length is considered upon initialization as 4 digits, the Group ID of the same
iButton will be 1234 and User ID will be 567890.
Otherwise, if the corresponding bit is enabled but other type of iButton is attached
(different from DS1971), the unit will use the 48 bits of the unique ID of the attached
iButton as a driver or passenger ID and 9999 as a group number.
Upon recognition of the new iButton, the unit generates an OTA message type 0, with
Transmission reason (Byte 19) = d46 - Driver Authentication Update.

Manual
Byte 18 (STR) of the same message includes notifications of Group recondition and user
type.
Group ID status Unused User Type
"1" – authenticated, "0" – Driver ID
"0" – not authenticated "1" – Passenger ID
Bit 7 Bits 1-6 Bit 0
The entire 10 bytes number (Group and User) received from the EEPROM of DS1971 will
be transmitted by the unit in any outgoing message type 0 in a six bytes Dallas field as
follows (after applying Little Endian):
90 78 56 34 12 00
Byte 33 Byte 34 Byte 35 Byte 36 Byte 37 Byte 38
If the “Reading EEPROM of DS1971" Programming bit is disabled (0), and DS1971 (or any
other type of iButton) is attached, the unit will work according to the legacy Driver ID
algorithms.
6.1.5.2 Driver Authentication by Group ID

If the “Reading EEPROM of DS1971" Programming bit is enabled (1), the Group ID is used
to enable cancellation of vehicle's immobilization by any company driver without
programming code of each one to unit's memory.
The Group ID is programmed as one of the Dallas codes (in the array of 30), its length
varies from 1 to 9 bytes length but shorter than 10 digits. The unit supports multiple
groups, while all Group IDs are from the same length. Any additional number, shorter
than 10 digits but with length different from the first Group ID length, is considered a
driver id.
Initialization
Is extended
support of DS1971
enabled?
No
Yes
Search the IDs array
for the first number
shorter than 10 chars
Set detected length as

lengh of group ID
End (proceed with

initialization)

Manual
NOTE: Group ID numbers never begin from zero.

If Reading EEPROM of DS1971 is enabled in the programming, upon reception of data
from DS1971 first bytes will be considered the "Group ID".
If Reading EEPROM of DS1971 is enabled in the programming and other type of iButton is
attached (not DS1971), upon reception of data from iButton the 9999 is recorded as a
Group ID.
The received "Group ID" is compared with programmed Dallas codes and if it matches:
The status of Group ID recognition in the last bit of TR Specific byte of "Driver
Authentication Update" event changes to "1" – authenticated
The unit releases immobilizer (only if the immobilizer was activated automatically),
even if the Driver/Passenger ID is not in the list.
If Reading EEPROM of DS1971 is NOT enabled in the programming – the unit will not use
Group ID at all
6.1.6 Data Forwarding from COM Port

In previous versions (prior to FW 31c) the only OTA transport of forwarded data was OTA
msg type 8.
The length of payload in this message was limited to 82 bytes in all the cases except
transparent data forwarding, where this limit was extended to 235 bytes.
It was not possible to link between the packet forwarded from COM port and location update.
From version 31c the data forwarding capabilities extended in the following way:
Capability to escort messages, forwarded from 3rd party terminal (or Garmin) with
plain fleet management (FM) data (like Dallas, status of inputs, location and time),
normally supplied in OTA message type 0. The new structure, containing forwarded
data with FM packet and unique ID is called "container"
Capability to forward up to 512 bytes of forwarded from 3rd party terminal data or the
entire container encapsulated into a single message over Cellocator Wireless Protocol
(without logging).
Capability to log forwarded from 3rd party terminal data (or the entire container) as a
set of fragments (OTA message type 7). In this case the forwarded from 3rd party
terminal data (or the entire container) will be delivered similarly to a delivery of the
plain events.
It is possible to introduce features 2 to 4 as a 2x2 selection table, where only one cell can
be selected at any time:
Forward as pure data Forward as container including the
pure data, FM data and unique ID
Forward in single packet OTA w/o
logging
Forward as set of logged fragments

Manual
6.1.6.1 Forward Data as a Container
Address: 285, bit 6

Description: If this bit is enabled (1), once the forwarded data packet is received in a
RAM buffer, the payload it is escorted by additional fields and converted in a structure
called "the container".
The container is a data structure, created by the unit in its RAM buffer upon reception of
the data for forwarding from COM port (in enabled in this bit).
The forwarded payload in escorted by 48 bytes of FM (fleet management) data (attached
after the last byte of payload) and total length of payload + FM data (first 2 bytes of the
container, before the first byte of the container).
Every container is assigned by 6 bits numerator (increased every packet reception from
COM port), used in fragmentation process and reported with the container. The indication
bit of report Forwarded Message Code byte in this case will contain '1' - Container.
Forwarded The Container

Message
Code
A sequential Length of container The payload of forwarded data X 48 bytes of fleet management
7 bits ID of data
(2 bytes)
the container
+ indication
bit (Single Byte 1 Byte 2 Byte 3 Byte 3 + X Byte 3+
byte) X+48
If this bit is disabled (0), the payload is forwarded as is received from COM port, without
any additional conversion. The indication bit of report Forwarded Message Code byte in
this case will contain zero.
Default: zero
6.1.6.2 Enable Data Forwarding Through Log
Address: 285 bit 7

Description: If this bit is Disabled (0), the system will forward data (the pure payload or
the container) using OTA message type 8 directly from the RAM buffer.
Single OTA type 8 messages can contain the following:
Pure forwarded payload up to 512 bytes
The container, where 512 bytes of forwarded data payload are escorted by 48 bytes of
fleet management data and 2 more bytes of container length (total 562 bytes); if it is
set (1), the received data will be fragmented.
The container (or the payload to forward, as per the programming) is fragmented by
chunks of 54 bytes long (last one is zero-padded); chunks are enumerated and equipped
by new fragmentation control fields, stored in an events log memory and then uploaded
using an existing infrastructure as message type 7.

Manual
As per existing message types which are utilizing log memory (0 and 9), message type 7:
Continues the Message Numerator used by other logged messages.
Requires acknowledge from the server (Message type 4) in order to erase the specific
message from the log.
Utilizes the same retransmission algorithms as other logged message types.
6.1.6.2.1 Data Path Chart
Forwarded The Container

Message
Code
A sequential Length of container The payload of forwarded data X 48 bytes of fleet management
7 bits ID of (2 bytes) data
the container
+ indication
bit (Single Byte 1 Byte 2 Byte 3 Byte 3 + X Byte 3+
byte) X+48
Fragmented Container
Fragment 1 Fragment 2 Fragment n Last fragment
54 first 4 bytes of 54 bytes of 4 bytes of 54 bytes of 4 bytes of 54 bytes 4 bytes of
bytes of fragment container fragment container fragment of fragment
container, manageme management management container management
starting nt (zero
from length padded)
6.1.6.3 Enable Backward Compatible OTA Msg 8
Address 1349, bit 2

The legacy data forwarding mechanism was utilizing a data fragmentation due to a small
buffer size (Garmin mode only).
In current implementation legacy fragment control byte of OTA message type 8 is not
used, since the unit is able to forward "the container" in a single message.
The Fragment Control byte of OTA message type 8 will therefore always contain value of
0xC0.
If this bit is disabled (0) the unit will restore legacy structure of OTA Msg type 8 by
1. Fragmenting Garmin traffic to fragments of max 82 bytes of payload and using
Fragment Control byte for fragmentation control.
2. Limiting size of forwarded payload in Transparent Mode to 235 bytes.
Default value: 0 - Backward compatible
6.1.6.4 Enable OTA Ack to Forward from OTA to Serial Data Packet
Address 1348 bit 0

Description: If this bit is enabled (1) the ACK (Msg type 0, TR31) will be sent from
Cellocator unit to the CCC upon reception of Data forwarding frame.
Default: Enabled (1)

Manual
6.1.7 PSP Configuration

The integration of Pointer Serial Protocol (PSP, refer to the appropriate documentation)
into Cellocator units which are not security oriented is carried over the Cellocator protocol
via SMS or/and GPRS link layers.
PSP is not implemented on the Security edition in order to avoid dual alarm system state
machines.
PSP support is provided on top of the existing serial protocols on Cellocator units such as
Cellocator Serial protocol (CSP) and the transparent protocol.
6.1.7.1 PSP Enable
Address: 7, bit 1
Description: The PSP support is activated when this bit is enabled. Status of Parameter
"PSP Enable" can be changed without reset
Default value: 0 (Disabled)
6.1.7.2 PSP ”# Polling” Interval
Address: 1320
Name in Programmer: Polling interval
Description: This parameter is only implemented if PSP support is enabled.
Cellocator unit periodically polls the updated status of the alarm system via the serial port
(in all its modes including the hibernation mode).
The unit polls the information by sending the ASCII character ‘# to the serial port every
configurable time period, programmed in this parameter.
NOTE: If the reply to polling indicates an ‘Alarm’, the unit will enter Distress Mode with
transmission reason "PSP triggered". The unit will restart Distress Mode every time a reply
to polling indicates ‘Alarm’ (irrespective of the Distress Mode setting).
Resolution: Seconds
Default value: 15
Range: 0-255; “0” will cause the unit to stop polling the data, values between 1 and 5
will set this interval to 5 seconds
6.1.7.3 PSP Echo Timeout
Address: 1343
Name in Programmer: Echo timeout
Every character sent by the alarm system is echoed by the Cellocator unit, so the alarm
system waits for it before it sends the next one. The interval between every two
characters should not exceed time out, programmed in this parameter. If a problem

Manual
occurred, the Compact returns a “?” character and the alarm system should retransmit
the last string from its beginning.
NOTE: All DL commands transmitted from the CCC to the alarm system are forwarded by
the Cellocator unit to the Alarm system in Burst fashion and not in Echo mode as the rest
of the communication protocol parts. Current time indication is also transmitted from the
unit to the alarm system upon request in a burst fashion without echo.
If the Cellocator unit fails to receive successful acknowledgment (proper Echo) from the
alarm system during a timeout, defined in this parameter, this attempt will be considered
as a communication failure.
Number of allowed communication failure is limited and defined in the next parameter.
Resolution: Seconds
Default value: 3
Range: 0-255; “0” will cause the unit to stop polling the data
6.1.7.4 PSP Allowed Number of Communication Failures
Address: 1321
Name in Programmer: Allowed number of communication failures
If communication failures (see the parameter above) occur more than programmed in this
parameter, the Cellocator unit will notify CCC about the loss of communication.
Default value: 10
Range: 0-255; “0” will cause the unit to ignore all communication failures
6.1.7.5 Spare

Manual
6.1.8 Garmin: Integration of CU with Garmin Terminals

The Garmin PNDs double as navigators and mobile data terminals in the vehicle, while the
Cellocator unit provides seamless connectivity to the monitoring center via a wireless
mobile data network.
Garmin's protocol has evolved since Revision A (initial integration with Cellocator
devices); Revision D of Garmin's API proposes better management of Canned packets,
Unicode support, better messaging protocols and more.
The CU will inform the CCC about the status of the Garmin terminal (Enabled and
Connected) in every message of type 0 (in the first byte of Communication Control field).
Every message sent between the Garmin and the CU is acknowledged by the receiving
side. The CCC is not exposed to this internal communication and should not take any
active part in it.
Command forwarding to Gaming is based on the Forward Data OTA command (type 5 of
outbound channel of Cellocator Wireless protocol).
A messages received from Garmin will be forwarded to the wireless channel as a payload
of standard packet type 7 or 8 (inbound channel of Cellocator Wireless protocol, refer to
Data Forwarding section of this document).
The packet includes a notification bit stating that the message was delivered from the
attached Garmin device.
In firmware versions before 31c long messages (longer than 74 chars) from Garmin were
split into a number of packets. From 31c even the longest packet can be delivered
encapsulated into a single OTA message or as a bulk of logged fragments, 54 bytes each.
The unit will deliver the Garmin data through SMS when the GPRS is not available
(optional).
Packets coming from Garmin require a Cellocator protocol ACK (only if the packet was
received through GPRS) and some of the messages delivered from Garmin require an
application ACK, which should be generated by the CCC application.
Refer to the latest API Garmin Support by Cellocator unit for further details about
integration with Garmin terminals.
6.1.8.1 Enable Garmin Support
Address 1348 bit 2

Abbreviators:
CU – Cellocator Unit
CCC – Control and Command Center
STBIOn/ STBIOff – Standby Ignition On/Off
Description: Once Garmin Support is enabled:
1. In standby mode (On/Off) the unit sends “0x0000 Enable fleet management protocol”
every 15 seconds to the Garmin until it is responding for the first time.
2. Upon reception of the response from Garmin, the CU will:

Manual
a) Generate a "Garmin Connected" OTA generate event (or distress, as per

programming), TR 0d205, STR 1 to CCC, as well as update OTA "Garmin
Connected" flag byte 10, bit 2.
b) Initiate a 0x0001 – Product ID Request to Garmin messages over COM port.
c) Forward all received response packets from Garmin to CCC : (0x0002 – Product
ID product_id_data_typ, 0x0003 – Protocol Support Data and any other packets
generated by Garmin)
3. Ping the device using 0x0260 – Ping Packet ID every 15 seconds. The response to this
command (0x261) is not forwarded to OTA.
4. Once the unit detects 3 missing responses from the Garmin, it generates a "Garmin
Disconnected" OTA event (or distress, as per programming), TR 0d205, STR 0 to CCC,
as well as update OTA "Garmin Connected" flag.
5. From the moment of Garmin disconnection the CU keeps sending to Garmin “0x0000
Enable fleet management" protocol every 15 seconds until the Garmin is responding
or until the entrance to hibernation.
Default value: 0 - Disabled
6.1.8.2 Discard Garmin Packets during NoIP/NoGSM
Address: 285, bit5

Description: In order to prevent duplication of Garmin messages in unit's COM buffer
(and as result duplication in server's DB) during lack of IP connection, it is possible to
discard (without storing in buffer) any Garmin packet received:
When no IP connection to the operational server is available
When no GSM registration is available (including modem off periods)
(If this bit is "0" AND "Data forwarding by SMS" on addresses 202/204 bit 5 is enabled
(1))
During maintenance session
Default value: "0" – discard
6.1.8.3 Enable Garmin Connected/Disconnected Messages
Address 285 bit 0 for Event

285 bit 1 for Distress
Description: Once this bit is enabled the unit will generate an appropriate message to
the CCC upon Garmin terminal connection and disconnection.

Manual
6.1.8.4 Disable Garmin's Ping (0x260) upon Detection of the Terminal
Address 285 bit 2

Description: If this bit is enabled, the CU will immediately disable Ping from Garmin to
CCC upon detection of terminal's connection (by sending to Garmin Message Throttling
Command Packet 0x0250. The Garmin's response to this command 0x0251 will NOT be
forwarded to the server).
Note that this protocol is disabled by default in the terminals, reporting A605 as part of
their protocol support data.
This protocol is not supported at all by the terminals, not reporting A604 as part of their
protocol support data.
Default value: 0 – Disable Ping
6.1.8.5 Backward Compatible Mode
Address 285 bit 3

Description: If enabled, the unit will ping the Garmin using “0x0000 Enable fleet
management protocol” instead of 0x0260 – Ping Packet ID. This is for older Garmin
terminals, not reporting A604 as part of their protocol support data.
6.1.9 Cellocator MDT100

The Cellocator MDT utilizes the Garmin protocol and enables bi-directional text messaging
with the driver.
6.1.9.1 Enable Cellocator MDT Time/Zone Synchronization
Address: 285 bit 4

Description: Due to a lack of an internal GPS in MDT100 it is possible to auto-
synchronize Date, Time and Time Zone of MDT with Cellocator unit.
Value of "1" in his address enables "Cellocator MDT" time synchronization, value of 0 –
disables time synchronization).
If enabled the time/date synchronization packets will be initiated by the unit in the
following cases:
Upon terminal connection detection (just after OTA "Garmin Connected" event
generation) (irrespectively to the GPS validity status).
Upon GPS Navigation start detection (just after OTA "GPS Navigation Start" event
generation).

Manual
Periodically during Standby Mode (Engine On or Off), every 15 minutes from wake up
to hibernation entrance. Periodical synchronization will only occur if the GPS is valid
upon synchronization timer expiration.
Default value: 0 - time synchronization disabled
6.1.9.2 Time Zone (for Cellocator MDT Synchronization)
Address: 451
Description: The time zone sent to the Cellocator MDT upon synchronization is the
difference in hours between GMT (Greenwich) and the local time.
Data format: Signed integer, resolution of 1hour, valid span: ±24
Examples:
Value Time zone
2 UTC+2
244 UTC-12
255 UTC-1
24 UTC
Default value: 0 (GMT)
6.1.10 Transparent Data Mode over COM Port
6.1.10.1 Enable Transparent Mode (of COM port)
Address: 0 bit 7
Description: Once transparent mode is enabled (this bit is set to 1), it may be
activated/deactivated using the trigger on "door" input. When this input is in its "active"
state, transparent mode is activated, when "door" is deactivated – the COM port is back
into CSP (Cellocator Serial Protocol) mode.
Note that the "active" state may be controlled using the programmable inputs inversion
masks. In addition, any programmed events for the "door" input will be generated as
usual. To avoid this, disable events associated with this input in the programming.
Transparent mode can be activated by OTA command (from FW31c).
a) Upon reception of the command, the unit immediately enters transparent mode
irrespectively to the status of the corresponding bit in the EEPROM (from FW31c).
b) If transparent mode started as a result of OTA command, Door input is NOT used
by the unit for transparent mode control.
Note: The door input is controlling start and stop of transparent mode only if a
corresponding bit in EEPROM is enabled. If the same bit is disabled, the
transparent mode can still be started / stopped, but only by OTA command.

Manual
c) If transparent mode started as a result of OTA command the unit will leave
transparent mode only upon reception of a corresponding OTA command.
When transparent wire mode is active:
All Cellocator wire protocol processing is ceased. This means wire commands, such as
programming, mode change, etc, are ignored.
Any data received in the port is accumulated and forwarded to the wireless channel in
Cellocator protocol data forwarding packets (type 7 or 8, refer to Data Forwarding
section in this document), containing the data as it was received, without further
processing or filtering.
When inbound data forwarding (type 8) packets are received in the wireless channel,
the data contained in these packets is extracted and forwarded as is to the wire
interface, without any enveloping headers or trailers.
Technical information
In transparent wire mode, the received serial data is packetized, so it may be sent in
packets. Following is an explanation how the data is being packetized:
As data is received, it is accumulated in packets.
The accumulating packet is "closed" and queued for transmission once one of the
following occurs:
512 bytes were accumulated in the packet (this is therefore the maximal payload per
transmitted packet).
Note: In firmware versions before 31c and in Backward Compatible mode of OTA Msg
8 it is 83 bytes.
500msec have passed since the reception of the first byte in the packet.
300msec have passed since the last received byte.
Once a packet is queued for transmission, the unit will attempt to reliably forward it via
the wireless channel (if available, and enabled in programming for the existing network
conditions) or parse and log depends on a configuration (refer to data Forwarding section
in this document); an acknowledge must be received for the forwarded data.
The unit provides a queue of 1K bytes.
When the data is forwarded from RAM buffer directly, w/o logging, the unit forwards
only one packet at a time (and requires acknowledge to be received). The forwarding
capability of high-throughput continuous data will therefore be affected by the wireless
round-trip time, from the transmission of a packet to the reception of acknowledge.
6.1.10.2 Software Flow Control XON/XOFF during Transparent Mode
Address: 1348, bit 7

Description: XON/XOFF flow control is a method of flow control used in computer data
links, especially RS-232 serial. It uses special codes, transmitted in-band, over the
primary communications channel. These codes are generally called XOFF and XON (from
"transmit off" and "transmit on", respectively).

Manual
When one end of a data link is unable to accept any more data (or approaching that
point), it sends XOFF to the other end. The other end receives the XOFF code (0x13), and
suspends transmission. Once the first end is ready to accept data again, it sends XON
(0x11), and the other end resumes transmission.
In ASCII oriented systems (like old printers) XOFF/XON can be employed in both
directions - but in our case the flow control will be applicable for transparent mode only
and for single direction: from the Cellocator unit (CU) to the 3rd party device (3PD), i.e.
for data transmitted from the 3PD to the server thru the CU.
The legacy transparent mode thus will become a one-way transparent mode: from 3PD to
CU.
Example:
The 3PD starts sending data to the COM port of CU. The unit is limited by GPRS path
width and availability, as well as forward data buffer size, and might fall behind the 3PD,
and starts to be overwhelmed by the data.
The unit thus sends XOFF to the 3PD. The software on the 3PD "sees" the XOFF, and
temporarily stops sending data. Once the unit has "caught up", it sends XON to the 3PD.
The 3PD sees XON, and starts sending data again.
When enabled (1), the transparent mode begins to work in single direction – from 3PD to
the server thru the CU. The data, forwarded from server shall be forwarded to 3PD in
Cellocator Serial protocol format.
Default: 0- Disabled
6.1.10.3 Periodic Transparent Mode Peek Time
Address: 1355
In this mode the unit open a window for the given peek time and passes all COM
messages transparently in a periodic manner.
The session will be between ignition ON to ignition OFF only.
If the Peek Time is different from the value 0 and the period time is 0 the transparent
mode will be for unlimited time during the ignition ON session. If the Peek Time is 0, the
periodical transparent mode feature will not work during the ignition ON session.
After downloading the new configuration by PL file, the unit will start working only after
reset event.
Upon receiving transparent mode OTA command, while the feature is active, the current
feature will work according to the OTA command (Activate/deactivate the transparent
mode) immediately while time changes will be updated only after completion of the
current cycle (after the previous “Periodic transparent mode cycle time” will expire).
Default: 2 seconds
Resolution: 1 second

Manual
6.1.10.4 Periodic Transparent Mode Cycle Time
Address: 1356
This sets the period of time between peeks, as mentioned in the previous parameter.
Default: 60 seconds
Resolution: 10 seconds
6.1.11 Distress Session Configuration

A Distress Session is one of four possible ways to deliver data to a Central Control (refer
to the Event Types generated by Cellocator devices section).
If the condition for the specific event is met, the unit will create a series of messages with
the same transmission reason. The messages will be uploaded to the Control Center
immediately with the first available communication transport (during IP session – over IP,
otherwise by SMS). The messages are not stored in the memory and if there is no cellular
coverage at the moment of sending – the message will be lost. Distress events do not
require any kind of acknowledge.
The number and time between messages in Distress Session is defined in parameters
below, but can be temporary overwritten by Distress Session initiation OTA command.
Distress session caused by the same trigger, occurred while the first session is not over
yet restarts the session from the beginning.
Distress session caused by different trigger, occurred while the first session is not over
yet causes new distress session (up to 5 distress sessions might be maintained
concurrently). The 6th distress session, while previous 5 are still active, will be lost.
It is also possible to initiate an endless (or specified duration) distress session by
command from CCC. Upon start, this session cancels all active distress sessions. The
session will be stopped by any other distress session or by a command from OTA.
6.1.11.1 Time between Distress Transmissions
Address: 72-73
Description: This parameter defines the amount of time between two consecutive
Distress Transmissions in distress session initiated by trigger of distress event.
The amount and the period of distress events generated during session initiated by OTA
command is defined by the command itself.
Data Format: 16-bit unsigned integer, 0.01 seconds resolution
Legal values span: 01h to FFFFh – 65535 (~11minutes)
Default value: 1000 (10 seconds)

Manual
6.1.11.2 Number of Distress Transmissions
Address: 75
Description: This parameter defines the amount of transmissions that will be generated
in a single distress session triggered by internal logic, if no more sensors are triggered.
The maximum time of single distress session is [this parameter]*[time between
transmissions]. Take into account up to another second per transmission (this is the time
that it takes the unit to prepare and arrange a transmission).
NOTE: A Distress session initiated by OTA command will contain the number of messages
specified in a command.
Legal values span: 01h (one transmission) through 00FFh (255 transmissions). 0 is
illegal.
Default value: 1
6.1.12 Wake Up Messages

In most of the cases the unit is sent to the installation site programmed with operational
PL file, but without a SIM card. The SIM card is being inserted on installation site.
In order to create an automatic association of the unit with the SIM number in CCC
application, the unit initiates a real-time message using SMS or GPRS, according to the
bitmap below.
In case Wake Up message has not been sent due to server side issue triggering Anti
flooding condition, The Wake Up message counter will be reset and the Number Of
Repetition counting will start again from 0.
6.1.12.1 Enable SMS Wake Up

Description: An SMS message/s (number is set in repetitions field of the same byte) will
be sent to the Default Destination SMS address upon power up, after successful
registration into Home or Roam GSM network, respectively to SMS rules (like pre-
programmed GSM operator’s selection, active transmissions block etc).
The “SMS Wake up” event does not require any type of ACK. The message shall be
retransmitted in case error.
NOTE: The “wake up” message will be transmitted even if active transmissions are
disabled. In addition, the time between Wake up SMS repeated messages will be 40
seconds (except for the CelloTrack Nano, in which the time between emergency
transmissions will be shorter but still dependent on network responses).
NOTE: In CelloTrack and CelloTrack-T, Wake up SMS will be sent every time the unit is
moved between Inactive to Active states.
Default value: 0 - disabled

Manual
6.1.12.2 Enable GPRS Wake Up

Description: The message will be sent to the Default Destination IP address upon power
up, after successful registration into Home or Roam GSM network, and dial up to GPRS,
respectively to GPRS rules (like pre-programmed GSM operator’s selection etc).
The message requires acknowledge – standard type 4 message, otherwise it will be resent
limited number of times (see description below).
6.1.12.3 Number of Repetitions

This parameter defines the amount of SMS Wake Up messages or/and the MAXIMUM
amount of GPRS Wake Up messages.
In case of failure during sending Wake Up event through GPRS (ACK not received) the
unit will try to resend the message within interval specified in Message Transit
Acknowledge Timeout for pre-programmed number of retries parameter (6 bits value, up
to 64 retries).
Note: Every time we establish new GPRS session, the repetition counter is reset to 0 and
the count is restarted.
Default: 5
6.1.13 Offline Tracking

Important: This feature is applicable to Cello and CelloTrack V28.
This mode is designed to enable offline data logging. During this mode the modem of the
unit remains off, although the GPS, processor and all the peripherals are managed by
unit's logic as usual. The unit is generating and storing logged events in its non-volatile
memory and once a day establish a connection to upload all of them during a single
communication session.
The modem is also temporarily switches on upon trigger of distress session.
The communication session for accumulated data upload will be initiated in the following
cases:
At the end of the day (upon expiration of the dedicated timeout after the Stop alert)
Upon filling of 90% of memory capacity
6.1.13.1 Enable Offline Tracking

If this bit is enabled (1) the unit switches the modem on and initiate the GPRS session
only when data download is required (see below). The rest of the time the modem
remains off.

Manual
Upon the end of data upload process the session and the modem is shut down.
The modem will also be switched on during distress sessions and real time alerts (Wake
up etc).
In case of wake up due to distress session (or real time alert) the modem will be switched
off after transmission of the last message (any valid Cellocator message will extend this
timeout by an additional 10 seconds).
Switching the modem on followed by GPRS dial up is initiated by the unit upon:
Immediately when memory is detected as at least 90% full.
A programmable delay after Stop. Delay is determined by parameter Time to Auto-
Upload.
After modem's wake up it will try to register into a GSM network. If the registration is not
accomplished during timeout, defined in "Maximum Network Registration Time" (address
270), the modem will be switched off until next wake up.
Any modem reset, occurred during the upload session, will be followed by modem wake
up and registration attempt as per "Maximum Network Registration Time" (address 270).
If the GSM registration is successful, the unit will get more time to dial up GPRS and
deliver the first message from the log (the total time from modem wake up is "Maximum
Network Registration Time" + 90 seconds, independently from the exact moment of GSM
registration). If during this timeout the unit failed to establish GPRS session and deliver
the first message - the modem shall be switched off until next wake up.
The unit will not switch off the modem while data transfer is in process;
The modem will be switched off:
While log is not empty: 90 seconds after last message reception (in case of session
drop or server failure).
While log is empty: 10 seconds after last valid message reception (including ACK)
Once the dial up attempts stop for one of the reasons described above, no more GPRS
dialup attempts (or modem wakes up followed by GPRS dial up attempts) will be made
until Stop Journey is detected. After such an event, dial up attempts will start again as
described above.
Maintenance Session, if enabled, will start immediately after ANY data session occurred
after periodical maintenance timeout expiration. In such a case the modem will be
switched off after the end of the maintenance session. There is no dedicated modem wake
up for maintenance session.
Serial data Forward mechanism (MDT, Garmin, transparent data ...) will behave in next
manner during offline mode:
During modem wake up due to Emergency session, then the data forwarded from COM
port will be forwarded to the server.
During modem wake up due to Ignition OFF or memory overfilling, then the data will
be lost.
Default: 0

Manual
6.1.13.2 Offline Tracking: Auto Upload after Ignition Off Event
Address: 255, bit 0

Description: If this bit is enabled (1), the unit will wake up the modem and establish
GPRS session upon expiration of a timeout (Time to Auto-Upload) after a Stop alert.
Default: 0
6.1.13.3 Offline Tracking: Auto Upload upon Memory Overflow
Address: 255, bit 1

Description: If this bit is enabled (1), the unit will wake up the modem and establish
GPRS session upon detection of memory overflow (90% full).
Default: 0
6.1.13.4 Offline Tracking: Time to Auto-Upload
Address: 259 – 260

Name in Programmer: Time to Autouploading
Description: Parameter defines time interval between Journey Stop and GPRS dial Up for
data upload.
Value resolution & span: Resolution is 4 Seconds. Span from: 4 seconds (0x0001), to
18:12 Hours (0xFFFF).
0x00 disables automatic upload.
Default value: 5400, (0x1518h), 1.5 Hours
6.1.14 Cell ID Based Location (Neighborhood list of the serving GSM cell)
Please note that CellId is not supported if “UMTS” band is selected in units with 3G
modem.
The Cell ID triangulation is an alternative location method. In cases when the GPS is not
available information regarding in-range cellular towers (Cells) with known location, along
with signal power or SNR (Signal to Noise Ratio) indication, might be used for location
approximation of the transmitting device.

Manual
-105dbm
-105dbm
-90dbm
-90dbm
-75dbm
-75dbm
~0.75km
~1.5km
~1km
-75dbm
-90dbm
-105dbm

Manual
The location of the transmitting vehicle in respect with the “in-range” cells and the RF
signal propagation attributes which can be significantly affected by reflectors, black spots,
interference, etc. all of this may influence the relative “reliability” of the SNR indication as
an estimator for the distance of the vehicle from the receiving Cell.
How does it work with Cellocator unit?
When the unit loses a GPS signal for longer than 2 minutes, it will poll modem for Cell ID
information. The modem will update with the following parameters of up to 7 cells (the
serving cells and up to 6 neighbor cells):
Base station identification code
Cell ID
Location Area Code
Received signal strength in dBm
The message, containing this information and CellID retrieval timestamp, will accompany
any log or distress message (as per configuration) generated by Cellocator unit during
GPS coverage loss.
Positioning software performs a triangulation calculation on the information and the data
is converted into a geographical location: strongest reception signal theoretically defines
closest cells.
Conditions to consider GPS coverage loss and restore
The GPS coverage loss in is considered when:
The GPS is communicating (connected)
The location appears as invalid for longer than 2 minutes in Standby mode or timeout,
programmed in "GPS Max On time" parameter in hibernation mode.
The GPS coverage restore in standby mode is considered when the GPS location is
considered as valid continually for longer than 1 minute in standby mode or 10 seconds in
hibernation.

Manual
Behavior during No GPS Mode

Once the "NO GPS" mode is started, the unit is polling Cell ID neighborhood information
from modem periodically, every 1 minute.
The data session (to operational server only) is suspended during polling, the connection
does not drop. Messages generated during Cell ID polling are delivered after data mode is
restored.
The Cell ID neighborhood data is stored in a unit and delivered as an additional message
to a central control after any event or distress message. The additional message contains
the next sequential message numerator for easy correlation.
Behavior during Full Hibernation
The Cell ID feature shall be inactive during full hibernation. The feature shall not be
activated even during modem peeking phases taking place while in full hibernation.
6.1.14.1 Enable Generation of Logged Cell ID Escorting Packet
Address: 201, bits 3 in Home Network

203, bit 3 in Roam Network
Description: If this flag is enabled, the unit will generate logged message type 9, (sub
data type 9) following any logged message type 0 while the GPS location is considered as
invalid.
The logged messages type 9/9 will be stored in the same buffer as corresponding
messages type 0 and use the same sequence of numerator for easy correlation.
The message type 9.9 will not be generated if the unit is not logged into GSM.
Default: 0 - disabled
6.1.14.2 Enable Generation of Real Time Cell ID Escorting Packet
Address: 201, bits 4 in Home Network

203, bit 4 in Roam Network
Description: If this flag is enabled, the unit will generate real time message type 9, (sub
data type 9) following any distress message type 0 while the GPS reading is considered as
invalid.
The real time messages type 9/9 will be delivered using the same rules as the
corresponding distress messages type 0 and use the same sequence of numerator for
easy correlation.

Manual
6.1.15 Internal Accelerometer Configuration

Movement Detection: The Cello unit can reliably detect movement start /end using its
onboard accelerometer, similarly to a technique implemented in CelloTrack. This capability
shall allow releasing an Ignition input for general usage or add another dimension for
movement detection: ignition switch separate from movement detection.
It is possible to select movement detection source programmatically: Ignition input
(backward compatible mode) or accelerometer.
If Start/Stop detection using accelerometer is enabled, the unit reassigns all the
functionality based on the status of Ignition to the status of movement.
Examples of such functionality: Start/Stop alerting, Driver Authentication, Hibernation
mode change etc.
The ignition input becomes a general purpose discrete pulled down input, monitored in
OTA and Serial messages. It might still be used for Ignition Switch status monitoring, but
operational mode will be switched according to movement status:
The unit changes its operational mode to STBEOn if movement is detected for longer
than defined in "Start Event time filter" programmable parameter on address 0d104.
The unit changes its operational mode to STBEOff if lack of movement is detected for
longer than defined in "Stop Event time filter" programmable parameter on address
0d105.
Towing Detection: The Cello unit shall be able to reliably detect towing using its
onboard accelerometer. The feature shall be applicable when:
An movement detection source is selected from ignition input.
The ignition switch is switched off, in other words - during parking.
Upon movement detection during parking the unit will wake up from hibernation,
alternatively generate an alert, then trigger legacy towing detection feature, based on
GPS data.
6.1.15.1 Movement detection type
Address 467, bits 2

Description: This bit enables selection of movement detection type: either actual vehicle
movement detection or engine operational mode change detection (engine start and
switch off).
Note: If accelerometer is set as an engine status detector – the Stop Event generation
may be delayed for (up to) 8 seconds (after expiration of the Stop Event filter).
Values span: 0 - movement, 1 – engine status
Default value: 0 - movement

Manual
6.1.15.2 Accelerometer Sensitivity
Address 467, bits 3-4

Description: It is possible to calibrate the sensitivity of the internal accelerometer (4
levels) and to adapt it to any vehicle. The default value of 1 is adapted to detect
movement start / end in standard family vehicle. In case of track it is recommended to
decrease the sensitivity level, in case of very silent vehicle – to increase it.
Values span: 0 - Very insensitive, 1 – Normal, 2 - Very sensitive, 3 - Spare
Default value: 1 – Normal
6.1.15.3 Movement Detection Source
Address 467, bit 0

Description: This bit defines what source will be used for movement detection: internal
accelerometer or Ignition input. If Accelerometer source is selected, all the logic normally
dependent on status of Ignition Switch will be re-linked to the status of Movement
detection.
Values span:
0 – Start/Stop alerts by status of Ignition switch (backward compatible mode),
1 – Start/Stop alerts by movement detection using accelerometer.
Default value: 0 – backward compatible mode.
6.1.15.4 Movement Detection: IgnitionOn Voltage Level Threshold
Address 468
Description: This parameter is relevant when Bits 5 and 0 of address 467 are set.
The vehicle’s battery voltage level is used as an additional source of information to
improve the vehicle’s movement state decision. We assume that when the vehicle’s
motor is on, the alternator starts generating electrical power to charge the battery and
thus the battery voltage increases. The Cello will detect this voltage increase and use it as
a necessary condition before it starts to analyze the accelerometer’s readings. The
combination of voltage level increase and accelerations indicates the vehicle is moving.
The Start Event shall be registered if movement by ACC is detected and the voltage of the
main battery is higher than this parameter during the entire Start Event registration
timeout.
The Stop Event shall be registered if NO movement by ACC is detected and the voltage of
the main battery is lower than this threshold during the entire Stop Event registration
timeout.
Data format: 8-bit unsigned, 0.1176470588235V/bit
Default value: 12.76V

Manual
6.1.16 Roaming List, GSM Operator Management

The non-volatile configuration is storing a list of 100 Public Land Mobile Networks (GSM
operators) with their priorities.
The end unit continuously* monitors a GSM operators (PLMNs) available on the air and
dynamically selects the best cost effective operator according to the pre-programmed
priority assigned to each one.
*The GSM operator selection mechanism is activated in 2 cases:
Periodically, according to pre-programmed timer
Upon new GSM registration, caused by reset or leaving the area covered by previously
selected network.
After one of the conditions listed above becomes true the state machine takes control
over the process and selects the best operator based on the list in the configuration
memory.
6.1.16.1 Timer of Auto Search
Address: 1008
Description: This parameter defines a timer, used by the system to repeat search of
available GSM networks in the air. The timer restarts each time when the unit is “taking
decision” to register in a specific PLMN, irrespectively to the result of registration attempt.
Data format: The parameter is an 8-bit integer, resolution of 10 minutes.
Value span: 1 to 255 (10 minutes to 2550 minutes, zero is automatically translated into
30 minutes)
Default value: 6
6.1.16.2 Consider Unknown Operators as Forbidden

Description: If this flag is set, any PLMN not listed in the programming will be
considered as forbidden.
Otherwise, if this bit is 0, any PLMN not listed in the programming will be considered as
enabled with lowest priority.
Default value: zero (not forbidden)
6.1.16.3 Number of PLMNs Programmed
Address: 1009
Description: This parameter defines a number of active records in PLMN table.
Zero value cancel Roaming List Management feature.
Value span: 0 to 100
Default value: zero

Manual
6.1.16.4 Public Land Mobile Networks (PLMN)
Addresses:
Address Value
1010-1012 PLMN 1
1013-1015 PLMN 2
…. ….
1307-1309 PLMN 100
Description & Data Format:

Each PLMN number is composed of two fields:
MMC-Mobile Country Code
MNC-Mobile Network Code
It will be stored in the configuration memory together with its priority as a single
parameter in the following way:
Priority PLMN (MCC-MNC)
Bit 23 Bit 20 Bit 19 Bit 1 Bit 0
The highest number in Priority field (15) is representing the most preferred network.
The value of 1 is the lowest priority, 2 - higher priority and so on.
The value of zero – is representing Forbidden PLMN.
NOTE: The network available in the air, but not listed in the pre-programmed PLMN list
will be treated as per configuration in “Consider Unknown Operators As Forbidden” above.
During searching of available networks (processing AT+COPS command) the modem is
busy and not available for any type of communication. This process might take up to 3
minutes, but in majority of the cases will be accomplished in less than 20 seconds.
In case no available network found during search, or all the available networks are
“forbidden” – the unit will hold and proceed with searching after expiration of Timer of
Auto Search.
Default value: zeroes

Manual
6.1.16.5 Operator Selection Flow Chart

Normal operation
Timer of available operator re- GSM Modem Wake up

search expired (after hibernation /reset
/AHR)
Yes Is Home
Connect to home network
network available?
Search for available networks until

at least one network is found
Is one (or more)

operators No
forbidden /
suspended?
Connect to the most Is one (or more) No
preferred operator
Yes operator in the
preferred list?
Yes
Yes Are there

not- No
Connect to the first unforbidden / forbidden /
unsuspended operator in the list suspended
operators?
Wait till successful

registration
Is 1348 bit5 =1
("consider
unknown
operators as
forbidden") Yes
Is it 3rd failure to Is the active
No connect to the No operator =
same operator? required
operator?
No
Yes
Yes
Mark the same operator as Let the modem select the
suspended (until "Proceed to operator
normal operation")
Restart timer of available

operator re-search
Proceed with normal

operation

Manual
6.1.17 GSM Jamming Detection & Reaction (Not Supported by 3G units)

The GSM Jamming detection supports two modes of operation:
Legacy Jamming Detection mode: Jamming is detected without any relation to the
Ignition state of the vehicle. In this operational mode, jamming detection can activate
up to two outputs for jamming driver feedback. The Jamming feedback is released by
OTA command or Ignition Sequence.
Jamming Outputs Release by OTA Send OTA Event
Command No
Jamming Output Release by Ignition Jamming Jamming Outputs
Activation Configuratin
2426-2433
Jamming Out1
Jamming
Modem Output
Detection Send OTA Event
Activation Out2
Advanced Jamming Detection mode: The jamming detection is depended on the

vehicle’s ignition state. Different outputs activations are allocated for Ignition On and
Ignition Off states. Each Ignition state can drive up to two driver feedback outputs.
Jamming Driver feedback outputs are released when jamming condition ends. The
user can terminate the jamming state by the legacy sources (OTA commands and
Ignition sequence). In the advanced mode, the user can configure the jamming
detection time filter and the Jamming End condition time filter. Jamming events will be
sent when jamming is detected or when jamming ends. The Jamming events will also
reflect the vehicle’s ignition state. The Ignition on jamming output activation
configuration is the same configuration array used by the legacy jamming outputs
activation.
Ignition On
Send OTA Event Parameters
No (Legacy Params)
Jamming 2426-2433
Ignition On Out1
Jamming
Send OTA Event Output
Out2
(Ignition On) Activation
Jamming
Modem Send OTA Event
Detection (Ignition OFF)
Ignition Off
Jamming Out1
Output
activation Out2
PL
Jamming Ignition Off
Criteria Parameters
(213) (New Parameters)
205-212

Manual
The following responses to jamming detection are available and switchable by unit's
programming:
The unit allows activating a vehicle horn and / or blinkers in pre-programmed
frequency and cadence.
Each of the outputs (horn and blinkers) is equipped by independent activation time
filter.
The unit allows activating nested immobilization (after vehicle's stop) and / or
immediate immobilization.
Unconditionally the unit stores dedicated event for jamming detection into its non-
volatile memory.
The unit enables releasing activated outputs by valid Dallas or by certain activity of
Ignition input.
6.1.17.1 GSM Jamming Detection
6.1.17.1.1 Telit
The cellular modem detects jamming and, if not during an active GPRS session, initiates
periodical reports to a microcontroller while jammed (every 3 seconds).
The jamming status is considered as GSM JAMMED upon reception of 3 consecutive
jamming detection notifications from the modem in 10 seconds. The unit stores a GSM
JAMMED event (TR206, TR Specific data 0) upon jamming status changing to Jammed.
The jamming status is considered as GSM NOT JAMMED upon reception of a dedicated
unsolicited message from the modem - "Operative". The unit stores a GSM JAMMED event
(TR206, TR Specific data 1) upon jamming status change to Not Jammed.
Since during an active GPRS session unsolicited Jamming detection indications are not
received, the microcontroller is temporary suspending GPRS session upon traffic jam
(missing ACKs for at least 30 seconds and 3 lost ACKs minimum).
NOTE: In this case (GSM Jamming during GPRS Session) the Acknowledge Timeout
directly affects time to Jamming Detection.
The unit will not suspend the GPRS session more than once; next session suspend can
only happen in a subsequent GPRS session.
6.1.17.1.2 Cinterion
The Cinterion modem, unlike Telit, is not limited by active GPRS sessions – the jamming
indications are issued in any state. The modem is not initiating any periodical report; it is
reporting GSM jamming state change upon jamming start and end. The unit is
immediately entering or leaving "Jamming" mode upon reception of the appropriate
notification from the modem.
6.1.17.2 Advanced GSM Jamming Detection Mode

Description: The Advanced Jamming detection mode differentiates between Ignition-On
and Ignition-Off jamming detection criteria. Each mode (Ignition On or Ignition Off) has

Manual
its dedicated outputs activation configuration parameters. The Advanced Jamming also
enables the configuration of the jamming detection threshold and the “Jamming End”
filter delay. OTA events reflecting the beginning and End of jamming sessions will be sent
whenever jamming is detected or jamming stops. 0-Legacy Jamming support (not
depended on Ignition state), 1-Advanced Jamming support, Ignition state depended.
Default value: zero (Disabled)
6.1.17.3 Disable GSM Jamming Event or Disable GSM Jamming Event during Ignition On

Description: This configuration parameter disables jamming OTA events. The
functionality of this configuration bit depends on the state of the Jamming detection mode
(See: Advanced GSM Jamming Detection Mode): If the advanced mode is configured, This
configuration bit will only disable jamming events started during Ignition On, If the
Advanced mode is not configured, this pin will disable all jamming events.
Note that Jamming detection started during Ignition On and ended while in Ignition Off
will be reported even if “Disable GSM Jamming Event during Ignition off” is enabled.
In addition, output activation as a reaction to jamming is independent from registration of
GSM JAMMED event.
Default value: zero (Jamming is NOT disabled)
6.1.17.4 GSM Jamming-End Time Filter
Address: 214
Description: The GSM Jamming-End Time Filter is only applicable if advanced jamming mode is enabled (See: Advanced GSM
Jamming Detection Mode). The Jamming-End Time Filter defines the time required for declaring “End of Jamming” event. End of
jamming will send a jamming end event and deactivate the associated outputs if configured by “Release by Jamming End” flag.
Setting the Jamming End Time Filter to 0 will result in immediate outputs deactivation. The filter is common for both Ignition-on
and Ignition-off jamming states. The timer resolution is 15 seconds.
Default value: 10 Minutes

6.1.17.5 GSM Jamming Detection Time Filter
Address: 213
Description: The GSM Jamming-End Time Filter is only applicable if advanced jamming mode is enabled (See: Advanced GSM
Jamming Detection Mode). The Jamming detection Time Filter defines the basic criteria for declaring jamming condition. The
time filter defines the minimal number of consecutive 3 seconds samples needed before jamming condition is detected. Each bit
represents time delay of 3 seconds. The minimal value is 1 (0 will be translated to 1 by the Firmware). Typically this parameter
will be set to 10, representing 30 Seconds time filter.
Default value: 30 Seconds (10)


Manual
6.1.17.6 Output Activation as a reaction to GSM Jamming Detection
Upon GSM jamming detection and expiration of activation timeouts, the unit can
concurrently activate two outputs. Once activated by Jamming Detection logic, the output
can only be deactivated by:
A command (OTA or serial)
Authorized Dallas
Ignition activity pattern
Once deactivated by user or by command the output will be activated again only upon the
next jamming detection. In other words: after the end of the active jamming session and
beginning of the next one.
NOTE: Reset does not deactivate an output activated upon jamming detection.
6.1.17.7.1 Output, Auto-Activated upon Jamming Detection
Address: 2426 for first output and 2429 for second output, bits 0-2
Description: This pair of parameters defines a numbers of outputs that will be activated
upon jamming detection.
Output name Output number
Feature Disabled 0
Siren 1
Gradual Stop 2
St. Immobilizer 3
LED 4
Blinkers 5
Reserved 6
Reserved 7
Value span: 1 to 5
Default value: zero
6.1.17.7.2 Delay for Output Activation
Address: 2432 for first output and 2433 for second output
Address: 211 for first output and 212 for second output
Description: This pair of parameters contain a time filters for output activation upon
GSM Jamming.
The event of Jamming detection will still be generated w/o any timeout.

Manual
If this parameter contains any number, different from zero, the output will not be
activated immediately upon Jamming detection, but after a pre-programmed timer. An
activation of the output will only occur if upon expiration of this timer a jamming session
is still active.
The timer for output activation will start upon detection of GSM Jamming and reset upon
detection of GSM Jamming end.
Resolution: 15 seconds / bit, maximum 63.75 minutes
Default value: zero (immediate activation upon Jamming detection)
6.1.17.7.3 Output Activation Pattern (Upon Jamming Detection)
Address: 205 for first output and 208 for second output, bits 3-5 (Advanced Mode during
Ignition-Off)
Description: This pair of parameters defines a activation pattern of outputs upon
jamming detection.
Setting Action
0 Pulse Activation (The output shall be activated for the time, defined in
"Pulse Outputs Width Period", addr. 140 dec
1 Change state to “active” upon jamming detection, change to inactive upon

release (by command, Dallas or Ignition Activity)
2 Activate Gradually (only compatible with Gradual Stop output)
3 Activate Nested (executed upon jamming detection only after vehicle stops,
e.g. Ignition off or 10 valid GPS packets showing speed lower than 1 km/h)
4 Template Activation (according to the settings described below)
5-7 Reserved

Manual
6.1.17.7 Template of Output Activation upon Jamming Detection
Example of template:
Two activations in a session, 1 second per activation, 2 sessions, 3 seconds between
sessions:
6.1.17.8.1 GSM Jamming - Output Activation Template - Activation Length
Address: 206 for first output and 209 for second output, bits 0-3 (Advanced Mode,
During Ignition-Off)
Description: This pair of parameters defines a length of activation of the selected output
upon GSM Jamming detection.
0 for the time, defined in "Pulse Outputs Width Period", addr. 140 dec
Value resolution: 0.5 second
Default value: zero
6.1.17.8.2 GSM Jamming - Output Activation Template - Number of Activations in a

Session
Description: This pair of parameters defines a number of activations of the selected
output upon GSM Jamming detection.
0 – cancels outputs activation upon jamming detection
Default value: zero
6.1.17.8.3 GSM Jamming - Output Activation Template - Number of Activation Sessions

Manual
Description: This pair of parameters defines a number of sessions of output activations
upon GSM Jamming detection.
0 – for cyclic activation all the time of jamming
Default value: zero
6.1.17.8.4 GSM Jamming - Output Activation Template - Time between the Activation
Sessions
Description: This pair of parameters defines a time between activation sessions of
output activations upon GSM Jamming detection.
Zero value: If zero is programmed the unit will only perform one session of activation
irrespectively to the programmed number of sessions.
Default value: zero
6.1.17.8 GSM Jamming Outputs Release

GSM jamming outputs can be released by Dallas key authentication or by Ignition sequence. When advanced jamming mode is
enabled (See: Advanced GSM Jamming Detection Mode), It is possible also to release the outputs when GSM jamming condition
ends.
6.1.17.9.1 Enable Output Release by GSM Jamming End condition while in Ignition-On
Address: 522, bit 5

Description: GSM Jamming-end detection will deactivate the outputs if this parameter is enabled. The “Jamming-End” state is
declared after no jamming detection is detected for the time defined in “GSM Jamming End Filter”:
0 - Jamming-End doesn’t affect the activation outputs.
1 - Jamming-End will deactivate the GSM Jamming activation outputs.
This bit is applicable for jamming end condition detected while the unit was in Ignition-On.
Values span: 0- Disable, 1 - Enable

Default value: Enable
6.1.17.9.2 Enable Output Release by GSM Jamming End condition while in Ignition-Off
Address: 522, bit 4

Description: GSM Jamming-end detection will deactivate the outputs if this parameter is enabled. The “Jamming-End” state is
declared after no jamming detection is detected for the time defined in “GSM Jamming End Filter”:
0 - Jamming-End doesn’t affect the activation outputs.
1 - Jamming-End will deactivate the GSM Jamming activation outputs.
This bit is applicable for jamming end condition detected while the unit was in Ignition-Off.
Values span: 0- Disable, 1 - Enable

Manual
Default value: Enable
6.1.17.9.3 Enable Output Release by Authorized Dallas
Address: 522, bit 7

Description: This bit enables deactivation of an output, activated by Jamming Detection
Logic, by an authorized Dallas key
Values span: 0 - Disable, 1 - Enable
Default value: zero
6.1.17.9.4 Enable Output Release by Ignition Activity
Address: 522, bit 6

Description: This bit enables deactivation of an output, activated by Jamming Detection
Logic, by the below specified sequence on Ignition line:
1. From ignition off state Switch Ignition on for a period between 0.5 to 2 seconds
(Ignore input change time filter)
2. Switch it back off for a period between 0.5 to 2 seconds (Ignore input change time filter)
3. Repeat 1 and 2 four times.
Upon detection of deactivation activity on Ignition the unit will:
Activate feedback "beep" (using feedback output/s)
Release an output
Values span: 0 - Disable, 1 - Enable
Default value: zero
6.1.18 Other Configuration Parameters related to Communication Settings
6.1.18.1 Disable Active Transmissions
Address: 6 bit 1
Description: If set to ‘1 the unit will not actively initiate any kind of connection - SMS,
GPRS or voice. It will reply to incoming SMS commands, if the relevant flags for the
current roaming/homing state are enabled.
Default: 0 – Enable Active Transmissions
6.1.18.2 Enable Command Authentication
Address: 1 bit 6
Description: If this feature is enabled authentication of every incoming message to the
unit (like command or acknowledge) will be verified. Each incoming message should
include a unique code, generated as a function of two variables:

Manual
Unit’s ID
8 bytes Auth Table, stored in non-volatile memory of the unit and concurrently in the
Communication Center application.
If the code will not be verified as authentic – the unit will not perform / acknowledge the
command and will erase it.
The unit supports dedicated Auth Table read/write commands over its wire protocol. See
description of the commands in a corresponding documentation.
The OTA Auth. table modification will be only be accepted by the unit if the Command
Authentication feature is DISABLED.
Default: 0 – Disabled
6.1.18.3 CelloTrack Enables APS mode

Description: If this flag is set (1) the CelloTrack unit will be operated in Automatic Power
Save mode. This operational mode will optimize the modem’s power consumption while
connected to the network.
Default value: one (enabled)
6.1.18.4 Enable Driver's Privacy (Invisible) Mode
Address: 6 bit 4
Description:
NOTE: This mode is not supported by security variants.
This mode is designed to allow the driver to allow/disallow tracking of their vehicle. After
entering Privacy mode, the unit will generate only Ignition On/Ignition Off events, no
Time or Distance events will be generated. The unit will still reply to interrogations and
perform commands from the Control center, but outgoing messages will not include
position information.
If the unit enters Privacy mode during Ignition On, it will generate pair of events:
“Ignition Off” with position information and “Ignition On” without position information. The
purpose of event generation is to define stop of tracking session.
If the unit leaves Privacy mode during Ignition On, it will generate pair of events:
“Ignition Off” without position information and “Ignition On” with position information. The
purpose of event generation is to define start of tracking session.
In order to enter Privacy mode:
The mode should be enabled by this configuration bit.
All the plain and distress events as well as other functionality assigned to "Shock
input" should be disabled.
The “Shock” input should be triggered to enter Privacy mode and released to leave
this mode.

Manual
6.1.18.5 "Private"/"Business" Mode Toggling
Address 465, bit 2 (1 – enable, 0 disable)

Description: It is possible to enable usage of "Lock input" (pin 5) as a
"Private"/"Business" mode toggler. If this bit is enabled, every time the Lock input is
triggered the unit switches to the opposite mode ("Private" to "Business" and vice versa).
The default mode is "Business".
The "Private" mode is finished upon:
The active ID is erased from RAM after journey end.
Lock Input trigger.
During "Private" mode the unit is continually activating Gd. Stop (pin 17) output, which is
serving as "Private" state monitoring LED.
During "Private" mode the unit is continually set bit 5 of byte 11 in every outbound OTA
msg type 0. Upon entering "Private" mode the bit 5 of byte 11 is set BEFORE generation
of the input trigger event/distress.

Manual
6.1.19 Business/Private Mode Toggling Flow Chart

Driver ID received
Is business/private
mode toggling
enabled ?
Yes
Gd.
Stop==deactivated
Activate Gd. Stop Deactivate Gd. Stop
output output
Reset bit 5 of byte
No 11 in msg. type 0
Set bit 5 of byte 11 Reset bit 5 of byte

in msg. type 0 Yes No 11 in msg. type 0
Lock Input Trigger
Consider generation Consider generation

input trigger allert input trigger allert
If current state
Business mode?
Driver ID erased
Gd.
Stop==deactivated
Reset bit 5 of byte

11 in msg. type 0
End
6.1.19.1 HRLS (High Resolution Logging Session) - Number of Events
Address: 491
Any system trigger (Input trigger, GPS reading based trigger etc.) can be configured to
trigger a High Resolution Logging Session (HRLS - HRLS is one of 4 available event
generation types; refer to the Event Types generated by Cellocator devices section).
During this session the unit is logging an event every valid GPS fix (every second). If the
GPS fix is invalid during HRLS - the event will not be logged.

Manual
The duration of HRLS is limited by:

Pre-programmed number of logged events as programmed in this parameter.
A timeout, closing the HRLS even if not all the events programmed in “Amount of
Events during HRLS” are logged (in case of poor GPS coverage).
HRLS Timeout [sec] = [Amount of Events during HRLS] x 2
There is no data upload during the High Resolution Logging Session – the events are
delivered after the end of HRLS.
Description: This parameter defines number of events, generated during High Resolution
Logging Session. Event is logged every second (if the GPS fix is valid), therefore the
parameter defines minimal duration of HRLS in seconds.
Events with invalid GPS fix will not be logged, and as a result the session could proceed
longer. Maximal duration of HRLS in seconds is twice bigger than the minimal one.
Value span: 0-255
Default value: 5
6.1.19.2 Number of Retries to Forward Data over UDP GPRS
Address: 283
Description: This parameter defines number of retries to forward data from the COM
port (for example from MDT) to the Central Control over UDP/IP. Such a message
requires acknowledge (msg type 4) from the Central Control. If the acknowledge will not
be received during the timeout defined by "Message Transit Acknowledge Timeout", the
unit will resend it number of times, defined in this parameter.
If all the reties forwarding data through UDP will fail, the same message will be sent by
SMS (if enabled in bytes 202, 204, bit 5).
Default value: 5
6.2 GPS Calibration
6.2.1 Base Unit (Measurement Factor of GPS Odometer)

Address: 80 to 83
Description: The value defines unit used for distance and odometer measurements. The
selected value (for example 100m, 1km or 1 mile) will be used by the unit as a lowest
distance unit to be reported and as a distance resolution.
The parameter is a 32-bit unsigned integer. Value is represented in centimeters. (100000
for 1 Km).
Valid values: Any non-zero value
Default Value: 100000

Manual
6.2.2 GPS Odometer Current Value

Address: 76 to 78
Description: This parameter stores the current “reading” of the vehicle odometer, in
“base units” (see previous parameter). Normally this value is programmed upon
installation (synchronization with vehicle odometer) and then maintained by the unit
itself.
NOTES:
This parameter does not require reset to be implemented.
Upon 'Ignition OFF' ('Stop Event time filter' elapsed), the unit will update the PL ('GPS
odometer’s current value') with the odometer value reported OTA (same as the value
serially found in 'Master Unit Status Request'), regardless of the 'GPS odometer’s
current value' in PL.
Having the 'GPS odometer’s current value' serially programmed requires Power recycle
in order to take effect.
OTA update of 'GPS odometer’s current value' will take effect immediately.
Data format: The parameter is a 24-bit integer
Value span: 000000h to FFFFFFh
Default value: 000000h
6.2.3 Report Max. Speed instead of Real Time Speed

Address: 1347 bit 0
Description: If this bit is enabled (0) the unit will report in each logged event (message
type 0 and 9) the maximum speed recorded from the previous logged event. This is useful
for comparison with police ticket report.
Even if this bit is enabled, any real time and distress events will still contain a snapshot of
the speed at the moment of message generation.
There is a bit in every OTA messages, clarifying the type of the reported speed (real-time
or maximum).
Default: Disabled (1)
6.2.4 Enable Voice Call Unsolicited Serial Status Messages

Address: 1347 bit 1
Description: If this bit is enabled the unit will initiate the Voice call status (Type 35h)
message over its serial port in 3 cases:
Incoming call waiting
Call connected (answered)
Call disconnected

Manual
6.2.5 Enable IMEI Transmission via Type 0 Message

Address: 1347 bit 4
Description: Enabling IMEI transmission will transmit the modem’s IMEI (up to 15 digits
decimal number or 50 bits) on each outbound type 0 message. Type 0 bytes 33-38 and
byte 41 bits 5 and 6 will carry the IMEI number as explained in the wireless
communication protocol under section 2.2.3.4, IMEA transmission. This feature was first
introduced as CR200 feature.
6.2.6 Enable GPS Navigation Start-Stop updates

Address: d99, bit 0 for plain event
d102, bit 0 for distress
Description: If this bit is set (1) the unit will generate an event/distress upon every GPS
reading validity status change.
Default: Both disabled (0)
6.2.7 GPS Navigation Start/Stop filter

Address: d500
Description: This parameter defines number of invalid GPS packets, required for
declaring a "GPS Navigation End"; it is also defines number of valid GPS packets required
to declare "GPS Navigation Start".
Note that the GPS validity is automatically declared as "invalid" upon wake up or after
reset.
Data format: The parameter is a 8-bits integer
Value span: 0-255 (value of zero cancels the filter)
Default value: 0Ah (10 seconds)
6.2.8 Enable Tight GPS PMODE Filter

Address: d509, bit 7
Description: If this flag is enabled, the unit will consider GPS data as valid only when
PMODE1=3 (in GPS Data, refer to the Cellocator Wireless protocol) or 4 and PMODE2=2.
Otherwise any of the following values of PMODE1:2,3,4,5 or 6 will be accepted as a valid
fix.
Values:
0 Requires 2≤PMODE1≤6 values to deem position as "Correct".
1 Requires PMODE1 equal to 3-4 values and PMODE2=2 to deem position as

Manual
"Correct".
First acquisition:
In order to speed up the GPS acquisition:
1. Upon initial boot (power up, excluding AHR) the GPS validity test will start according
to "Normal GPS PMODE Filter", irrespective of the setting in this parameter AND w/o
DOP validation.
This simplified validation routine will work until the first acquisition compatible with
"Tide GPS PMODE Filter" setting AND with DOP setting.
2. Upon achieving acquisition compatible with "Tide GPS PMODE Filter" the unit will start
behaving according to the setting in this parameter AND with DOP setting as usual.
Data format: The parameter is a flags bitmap, “1” - Enable, “0” – Disable
Value span: any 8-bit value, four upper bits are currently a don’t-care bits
Default value: 1
6.2.9 GPS DOP Threshold

Address: 1625
Description: Dilution of Precision (DOP) is a measure of how the geometry of the
satellites affects the current solution’s accuracy. This message provides a method to
restrict use of GPS solutions when the DOP is too high.
This is actually an additional GPS solution validation tool: the GPS packets with an HDOP
higher than the value in this parameter are marked as invalid.
Data format: unsigned 8 bits integer
Default value: 8
6.2.10 Synchronize Unit’s Time with GPS Time only when GPS is
Navigating
Address: 7, bit 3
Description: This flag defines the condition for time synchronization with GPS time:
0 - Anyway, even when GPS is not navigating
1 - Only when the GPS is navigating
Default value: 1
6.2.11 Velocity Threshold for HIGH SPEED Mode

Address: d455
Description: The unit can be configured to decrease frequency of Time and Distance
events on high speeds automatically. The speed threshold considered as "high speed" is
programmed into this parameter.

Manual
This parameter is used by Time based alert Period Multiplier for HIGH SPEED mode
(Address 92 and 35, bits 4 to 7) and by Distance Event Period Multiplier for HIGH SPEED
mode (Address 92 and 35, bits 0 to 3) parameters to define from what speed the number of
the events should be decreased.
Note, that the in order to switch the operational mode of the unit from "Low Speed Mode"
to "High Speed Mode" the system speed must raise 3km/h above the programmed speed.
Same way, in order to switch the operational mode of the unit from "High Speed Mode"
to "Low Speed Mode" the system speed must fall 3km/h below the programmed speed.
Data format: 8-bit unsigned, unit’s [cm/sec]
Default value: 60 k/h
6.2.12 GPS Maintenance Updates
6.2.12.1 Enable GPS Navigation Start-Stop Updates

Description: If this bit is set (1) the unit will generate an event/distress upon every GPS
reading validity status change. (Refer to wireless protocol for GPS signal validity
definition)
The validity status changes after 10 consecutive GPS frames with the same validity
status, different from the current one.
Default: Both disabled (0)
6.2.12.2 Enable Update per GPS Auto Factory Reset Updates

Description: If enabled, the unit will create an event or/and distress per GPS Factory
reset. Obviously the GPS Factory reset has to be enabled. See below description of GPS
Factory reset.
Default value: Both 0 (disabled)
6.2.12.3 Enable GPS Disconnection Updates

Description: If enabled, the unit will generate an event or/and distress of GPS
Disconnection upon detection of 10 sequential missing packets from GPS.
The first received packet from GPS will cause the unit to generate GPS connection alert.
Default value: Both 0 (disabled)

Manual
6.2.13 GPS Odometer Management
6.2.13.1 Enable Speed x Time Calculation (SxT)

Description: As a default, the unit queries the GPS every second. If that flag is enabled,
the unit multiplies the speed at a specific location by 1 second, the result being the
distance traveled during this second.
Speed (m/s) x 1 sec = elapsed distance (m)
Whenever the unit does not receive new GPS data for time, defined in Max Time between
GPS readings for SxT calculation it will not use the regular calculating algorithm. Instead,
it will ignore the time during which no reception was available and will restart calculating
the elapsed distance immediately when satellite reception reappears.
If both Pythagoras and SxT calculation are enabled, the unit will use SxT when there is a
valid GPS fix and Pythagoras when there is no GPS coverage.
Default: 1 - enabled
6.2.13.2 Enable Pythagoras Calculation

Description: If this flag is enabled the unit will calculate the distance between 2
consistent GPS queries according to the Pythagoras theorem:
If both Pythagoras and SxT calculation are enabled, the unit will use SxT when there is a
valid GPS fix and Pythagoras when there is no GPS coverage (from last GPS fix to the
next GPS fix).
Default: 1 - enabled
6.2.13.3 Reset Last Known Location on Ignition Off

Description: Relevant for Pythagoras and combined Pythagoras + SxT calculation. If
that flag is set (logical ‘1’) the unit will dismiss the last detected location per detection of
Ignition off. For future calculation will be used the first GPS fix obtained after Ignition On.
In other words the unit will ignore the distance, passed by the vehicle during Ignition Off
mode. The feature is useful in case when the vehicle is being towed from one place to
another.
Note that in this case the vehicle will also ignore the distance, passed from Ignition On to
first GPS fix obtained.

Manual
6.2.13.4 Max Time between GPS Readings for SxT Calculation
Address: 84
Description: This parameter stores the maximal time between two valid readings from
GPS (in seconds) to be qualified for SxT odometer accumulation.
When you make a configuration take into a consideration the following rule:
where:
max speed in km/h – maximum speed that the vehicle get during the normal usage.
Recommended 160km/h.
max time apart is a value programmed in this parameter.
base unit is “Base unit (measurement factor of GPS odometer)”, address 80-83.
Data format: The parameter is a 8-bit integer.
Value span: 1 to 255
Default value: 7
6.2.14 GPS Reset Settings
6.2.14.1 Enable GPS Auto Factory Reset
Address: 497, bit 7

Description: If this bit is set, the unit will trigger a Factory Reset of the GPS in the
following cases:
The GPS communicates, but service fields MODE1 and MODE2 are equal to 0 and 16
respectively for 10 minutes.
The GPS is communicating, but the data is considered as “not navigating” and the
service fields MODE1 and MODE2 are not equal to 0 and 16 respectively for 15
minutes. In this case the unit is resetting GPS using On/Off line. If the condition is
true for another 15 minutes – the unit will send factory reset command to GPS
(effectively the factory reset is sent once in 30 minutes).
Default value: 0
6.2.14.2 GPS Reset Upon Ignition Off
Address: 6, bit 2 when GPS is navigating

6, bit 3 when GPS is NOT navigating
Description: As with any ARM based module, the GPS has to be reset from time to time.
If one of hibernation modes is used, the GPS is reset upon entrance to hibernation.

Manual
But if the hibernation in not used the safest way to reset the GPS periodically is upon
Ignition change to Off state. There is an advantage of doing such a maintenance reset
when the GPS is navigating, because such a worm reset enables the shortest recovery
time. It is also possible to do it only when the GPS is not navigating anyway, but in this
case (for example on underground parking) the recovery might be longer.
Default values: bit 2 – 0 (disabled), bit 3 – 1 (enabled GPS reset upon ignition off when
the GPS is not navigating)
6.2.15 Vehicle’s Driver speed delta relative to GPS speed
Address: 510
Description: This byte represents the difference, in percent’s, between the vehicle’s
speed as measured by the GPS and the vehicle’s speed as presented to the driver on the
dashboard. Usually the driver display shows a speed which is about 5 % higher that the
real vehicle’s speed. This byte is vehicle type depended. The corrected speed will affect all
the speed related calculations like over speeding, speeding related outputs activations etc.
The corrected speed shall not affect the unit’s distance calculation, this mechanism will
continue using the real unit’s speed as received by the GPS.
NOTE: This parameter does not affect the CSA (Cellocator Safety Application) GPS. It has
only effect on Fleet related applications.
Default values: 0 %

Manual
6.3 Inputs & Outputs
6.3.1 Discrete Inputs Triggering Time Filters

These two bytes defines the input’s Additional Time Filters. The Additional Time Filter will
extend the input’s filtering capabilities separately for logical Raising and logical Falling.
The total filter is constructed from Common Discrete Inputs Time Filter (same for all
inputs and all states) and dedicated filter for each state change (Raising/Falling) of each
input.
It is possible to define asymmetric triggering delays for logical Raising and logical Falling
for each one of system's discrete inputs.
The Additional Time Filter supports multiple resolutions from seconds to hours.
Logical Status Input's Input Input's Input

of discrete status Raising status Falling
input changes OTA changes event
to High event to Low
Common Additional Common Additional

Discrete Inputs Begin Discrete Inputs End Time
Time Filter Time Time Filter Filter
Filter
6.3.1.1 Common Discrete Inputs Time Filter
Address: 136
Description: This parameter is aimed to protect unit’s discrete input from noise influence
and defines time, from input’s level change to change detection.
Data format: 8-bit unsigned, Resolution 10 msec.
Value span: 00h to FFh
Default value: d10
6.3.1.2 Additional Begin Time Filter Resolution
Address: bits 6 and 7

Door /
CelloTrack T, GP1 1357
Shock /
Manual
Distress 1361
Unlock 1363
Lock 1365
Ignition 1367
CFE_In1 1369
CFE_In2 1371
CFE_In3 1373
CFE_In4 1375
CFE_In5 1377
CFE_In6 1379
Description: This parameter defines resolution of the additional time filter applied in
addition to Common Filter before discrete input raising alert is generated.
Value Resolution Maximum possible value of

the filter
0 1 sec 63 sec
1 30 sec 31.5 min
2 5 min 5.25 hours
3 1 hour 63 hours
Default value: 0 – resolution of 1 second
6.3.1.3 Additional Begin Time Filter value
Address: bits 0-5

Door /
Shock /
Distress 1361
Unlock 1363
Lock 1365
Ignition 1367
Manual
CFE_In1 1369
CFE_In2 1371
CFE_In3 1373
CFE_In4 1375
CFE_In5 1377
CFE_In6 1379
Description: This parameter stores a value of the additional time filter applied in addition
to Common Filter before discrete input raising alert is generated. The resolution of the
value is configured in previous parameter (1 second to 1 hour).
Default value: 0 – additional filter disabled
6.3.1.4 Additional End Time Filter Resolution
Address: bits 6 and 7

Door /
Shock /
Distress 1362
Unlock 1364
Lock 1366
Ignition 1368
CFE_In1 1370
CFE_In2 1372
CFE_In3 1374
CFE_In4 1376
CFE_In5 1378
CFE_In6 1380
Description: This parameter defines resolution of the additional time filter applied in
addition to Common Filter after discrete input raising alert is generated.
Value Resolution Maximum possible value of

the filter
0 1 sec 63 sec

Manual
1 30 sec 31.5 min
2 5 min 5.25 hours
3 1 hour 63 hours
Default value: 0 – resolution of 1 second
6.3.1.5 Additional End Time Filter value
Address: bits 0-5

Door /
Shock /
Distress 1362
Unlock 1364
Lock 1366
Ignition 1368
CFE_In1 1370
CFE_In2 1372
CFE_In3 1374
CFE_In4 1376
CFE_In5 1378
CFE_In6 1380
Description: This parameter stores a value of the additional time filter applied in addition
to Common Filter after discrete input raising alert is generated. The resolution of the
value is configured in previous parameter (1 second to 1 hour).
Default value: 0 – additional filter disabled
6.3.2 Analog Measurement Averaging Time
Address: 466
Name in Programmer: Power Sources Measurement Time filter

Manual
Description: This parameter is aimed to protect analog measurement from noise

influence and defines averaging time. The reported value will be therefore an average
voltage for the period defined in this parameter. (The sampling rate is every 10msec).
Data format: 8-bit unsigned, resolution 10 msec
Default value: d100 (1 second)
6.3.3 Inputs in OTA Message
Address: 0, bit 3
Presentation of inputs in wireless Cellocator protocol
0 Legacy mode, inputs are presented in their raw (unprocessed) form.
1 Inputs are presented in their processed, logical form (inverted and

filtered).
Default value: 0
6.3.4 Enable Monitoring Logical Status of Ignition in OTA Packets

Description: If this bit is enabled (1) the ignition bit in all any outbound messages (OTA
and serial) will reflect logical status of Ignition (i.e. after the Ignition Filter)
Default value: 0 - Disable Logical
6.3.5 Enable Warning Output Activation during Gradual Immobilization
Address: 0, bit 5
Description: If enabled, a "blinkers" output (pin 18) will be activated when Gradual Stop
output is gradually or immediately activated (to notify surrounding driver that the vehicle
is going to blame and stop shortly).
Default value: 0 - Disable warning output activation
6.3.6 Outputs Pulse Width Period
Address: 140
Description: This parameter defines the activation duration time for pulse outputs (for
example some system feedbacks like Driver Authorization and others).
Data format: 8-bit unsigned, resolution is 100 mSec
Default value: D’10 (1 second)
Manual
6.3.7 LED Management
Address: 7, bit 4
Description: This flag enables LED monitoring, which is different in Fleet and Security
modifications of Cellocator units.
In fleet firmware modifications a sophisticated blinking pattern, monitoring GPS and GSM
status is provided, in a Security modification the LED monitors a security state of the
system.
In Car Sharing systems this bit also control the Proximity Reader LED
In Fleet Modification:
The blinking pattern is constructed from cycles of 2 blinking zones each, which will be
repeated by unit continually. The first zone will represent the functionality of GSM, the
second zone – GPS.
Each zone will last 3 seconds with 1 second of LED off interval between them.
On
GSM GPS GSM GPS
Monitoring Monitoring Monitoring Monitoring
zone zone zone zone
Off
t
3 sec 1 sec 3 sec 5 sec
5 seconds LED Off interval will separate between each cycle.

IMPORTANT: During the voice call, the LED will continually glow from the
moment of voice call trigger to the moment of voice call hang up.
The cycles of two blinking zones will be restored after the end of the voice call.
GSM Monitoring Zone definition
Status Blinking pattern
GSM off off
Not registered to GSM / No 200mse

c
SIM
3 seconds
Registered in Home GSM

0.5s
network
(not attached to GPRS) 3 seconds
Registered in Roaming GSM

network
(not attached to GPRS) 0.5s 0.5s
3 seconds

Manual
Attached to GPRS/home
0.5s 0.5s 0.5s
3 seconds
Attached to GPRS/roaming
0.5s 0.5s 0.5s 0.5s
3 seconds
GPS Monitoring Zone definition
Status Blinking pattern
GPS off off
GPS is unplugged / faulty 200mse

c
3 seconds
GPS communicating, but not

0.5s
navigating
3 seconds
GPS is in navigation mode

0.5s 0.5s
3 seconds
GPS is in GYRO mode (only 0.5s

0.5s 0.5s
for compatible models)
3 seconds
In Security modification
1 second on/1 second off – Alarm Armed
On - Silent delay
Slow Blinking – Passive Arming
Off – Standby
Rapid blinking – Alarm Triggered
Default value (Fleet and Security): 0 - LED Management Enable;
In CarSharing - Old
LED Management Disable bit – if this bit is enabled, the monitoring LED will behave in the
following manner:
Glow during voice session

Manual
Ignition On:
 0.5 second on and 2 seconds off while there is no GSM registration.
 Off - when GSM registered.
Ignition Off:
 Backwards compatible mode
 1 second on and 2 seconds off when reserved (for example, when there
is a Dallas ID other than zero in the low 17 slots of the Dallas ID array).
 Off - Ready for reservation.
 Enhanced mode
 1 second on and 2 seconds off when reserved (for example, when there
is a Dallas ID other than zero in the low 30 slots of the Dallas ID array).
 Off - Ready for reservation.
Default value: LED – disabled (1)

Manual
6.3.8 Analog (& Frequency) Inputs in OTA Message
Note that frequency counters are supported from FW30a.
6.3.8.1 Bytes 26-29 of OTA Message 0

Address: 1620 1621 1622 1623
Byte of OTA 26 27 28 29
Message 0
Description: The OTA protocol provides 4 bytes dedicated for monitoring of analog
inputs in few different message types. Those bytes can contain measurement from the
different fields as per the configuration below.
Obviously if the selected source of Data is an Analog input, the corresponding input shall
be programmed as an analog input in Input's Configuration.
Pin Number/Field Name Number to be Remarks

programmed
Non 0
Pin 14 / 1
Door
Pin 15 / Shock 2 Default for byte 29 of OTA

Message
0
Pin 16 / Panic 3
Pin 11/ Unlock 4
Pin 5 / Lock 5
Battery voltage (V bat) 6 Default for byte 27 of OTA

Message
0
Battery temperature (NTC), 7 Default for byte 28 of OTA

default for byte 3 Message 0.
Note: In CelloTrack T Power,
It is mandatory to select
NTC in one of the OTA bytes
(26-28) in order to enable
the charging function.
Regulated voltage 8
Input voltage 9 Default for byte 26 of OTA

Message 0

Manual
Pin Number/Field Name Number to be Remarks

programmed
CFE In 1 10
CFE In 2 11
CFE In 3 12
CFE In 4 13
CFE In 5 14
CFE In 6 15
First oneWire Temperature 16 Signed value ranging from

Sensor -55 to 125 Celsius
Second oneWire 17
Temperature Sensor
Third oneWire Temperature 18

Sensor
Forth oneWire Temperature 19

Sensor
6.3.9 Feedback Outputs
6.3.9.1 Use Blinkers Feedback
Address: 449, bit 4

Description: This parameter enables usage of Blinkers output (pin 18) for system and
security feedbacks, like Dallas ID reception confirmation beep, Silent Delay expiration
notification beeps and so on. It is recommended to use buzzer connected to a feedback
output. The Blinker's state will be preserved after SW/HW reset but not after Power
Recycle.
Default value: 0 – disabled
6.3.9.2 Use Siren Feedback
Address: 449, bit 0

Description: This parameter enables usage of Siren output (pin 8) for system and
security feedbacks, like Dallas ID reception confirmation beep, Silent Delay expiration
notification beeps and so on. It is recommended to use buzzer connected to a feedback
output.

Manual
6.3.10 Outputs Inversion Mask
6.3.10.1 Invert Blinkers Output
Address: 503, bit 3

Description: This parameter enables inversion of corresponding output's logic (pin 18).
Inverted output will be normally activated and will be turned off per OTA or serial output
activation command.
0 - Normal polarity (not activated - disconnected; activated – grounded)
1 - Inverted polarity (not activated - grounded; activated – disconnected)
Default value: 0 – Normal polarity
6.3.10.2 Invert Gradual Stop (PWM) Output
Address: 502, bit 2
Description: This parameter enables inversion of corresponding output's logic (pin 1 7).
activation command.
6.3.10.3 Invert Standard Immobilizer Output
Address: 503, bit 5
Description: This parameter enables inversion of corresponding output's logic (pin 7).
activation command.
6.3.11 Usage Counter Configuration
6.3.11.1 General Description

This feature is designed for continuous counting of the “Working time” of a device,
monitored by one or two unit’s inputs. Example of possible usage is – monitoring of an
engine's working hours.
The inputs who's "High State" time is counted are selectable by programming.

Manual
It is possible to assign each of two timers to a specific input, including the option to
assign both timers into the same input. Every input, including ignition, supports "High
State" or "usage" time calculation.
The value of the measured time from each input is located in the unit’s RAM (protected,
not erased on software reset). The unit makes mathematical rounding on partial minutes:
(1:29 will be counted as 1 minute and 1:30 and above as 2 minutes).
Once a day the values of both Usage Counters are backed up to the especial address in
non-volatile memory. The timer keeps time counting (from the value stored in RAM) each
time when the logical level of the appropriate input changes from low to high.
The time counting stops each time the logical level of the input changes from high to low.
Dedicated Read/Write commands over RS232 and OTA are provided for Usage Counters,
including a periodical Usage Counters update OTA packet.
6.3.11.2 Enable Usage Counters
Address: 7, bit 2
Description: In order to start Usage Counters time counting this bit shall be enabled (set
to 1).
Status of this parameter can be changed without reset.
Default: 0 - Disabled
6.3.11.3 Wake up from Hibernation upon Periodical Usage Counter Update Timer Expiration
Address: 1, bit 7
Description: This bit enables waking up the unit from full hibernation for periodic Usage
Counter update.
Default: 0 - Disabled
6.3.11.4 1st Usage Counter Input
Address: 1330
Description: The byte contains number of the input, utilized by the first Usage Counter.
The unit will use this parameter to backup the value of the 1st Usage Counter from RAM
once a day.
Input’s numbers definition:
Input's name Input's number
Door 0
Unlock2 Input 1
Ignition 5

Manual
Input's name Input's number
Panic 6
Unlock Input 7
Lock Input 10
In order to set the use of only one Usage Counter input, select inexistent input for the
second counter (for example 4).
Default: 0
6.3.11.5 2nd Usage Counter Input
Address: 1331
Description: The byte contains number of the input, utilized by a second Usage Counter.
The unit will use this parameter to backup the value of the 2 nd Usage Counter from RAM
once a day. In order to set use only one Usage Counter input – select inexistent input
number in this parameter (for example 4).
Default: 0
6.3.11.6 Reporting Interval of Usage Counters
Address: 1332
Description: This parameter defines Usage Counters reporting period. Setting this value
by standard programming access is not recommended, as it will require reset to be
implemented. Refer to OTA and serial protocol document for a dedicated update command
description.
Data format and resolution: 1 byte, 1 minute resolution (from 1 minute to 255
minutes). Zero value cancels timers reporting).
Default: 0 – reporting canceled
6.3.12 Frequency Metering
6.3.12.1 General Description

Pulse frequency measurement is supported on pair of Cello inputs (Door and Shock
inputs, pins 14 and 15).
The frequency measurement is implemented on the same ports as the analog
measurement; obviously only one of those functionalities can be active at a time).
The maximal possible frequency for measurement is 5 kHz, higher frequency causes
saturation of the measurement. The high level of measured signal shall be between 3V to
30V.
It is possible to use the measured number of pulses/second as a source for one of the
following system parameters:

Manual
Speed (in cm/sec)

General Purpose pulse frequency measurement
Each of the inputs will be defined as one of the above listed types type and assigned with
an appropriate scaling factor.
6.3.12.2 Frequency Input as a Speed Information Source

If the input is defined as a "speed source", the measured frequency value, multiplied by
an appropriate scaling factor is threaded by the unit as a value of speed [cm/sec]. This
value is replacing a value of speed received from GPS in all the applications: distance
calculations, OTA and serial packets, over/idle speeding detection etc.
In such a case the value of speed reported in OTA message type 0 and vector change
report message type 9) will be valid even if the GPS is not navigating.
The unit monitors and reports the speed source in (see also the Wireless Protocol):
The OTA msg type 0: Byte 16, bit 3.
The OTA msg type 9, Byte 16, bit 3
0 – GPS;
1 – Pulse frequency input.
NOTE: Only one input at a time is defined as a "speed source"; otherwise (if two inputs
are defined as speed source) the unit will utilize the first one (the smallest Input number
out of two) as a speed source and the second one as a GP input source.
If input on pin 14 is selected as GP freq. counter it will be considered as the 1st freq.
input, if input on pin 15 is selected as GP freq. counter it will be considered as the 2nd
freq. input.
Upon reset
The unit will report last known value of speed (calculated before the reset) until the new
value of speed will be calculated (up to 5 seconds).
Upon Power Up / Wake up after upgrade
The unit will report zero speed until new value of speed will be calculated (up to 5
seconds).
6.3.12.3 General Purpose Pulse Frequency Measurement

If the input is defined as a General Purpose pulse frequency measurement, the system is
continually measuring frequency on this input (while not in full hibernation) and updating
in the following cases:
Status message type0
Query from COM port
Query from OTA channel
Frequency Threshold violation

Manual
6.3.12.4 Auto Calibration of Frequency Inputs

Since the manual calibration is impossible to implement in a reality of multiple
installations it is required to propose a method, enabling calibration in minimal time and
with minimal installer's intervention.
There are two independent processes: calibration of speed and of GP frequency inputs.
The purpose of GP frequency input calibration is to set an optimal resolution for
measurement monitoring in 1 byte of OTA protocol.
The purpose of speed pulses input (Vss) calibration is to make an accurate conversion
from measured frequency in Hz to vehicle's speed in cm/sec.
6.3.12.4.1 OTA RPM (or GP Frequency) Input Calibration

Upon the end of the installation the installer switch on an ignition, keeps the engine
running on idle (for example on 700 rpm), call the operator and informs him with the
current reading of the tachometer.
The operator sends RPM calibration OTA command, containing the reading reported by
operator and number of frequency input. The unit measures a frequency from the RPM
input, and calculates the best Scaling Factor for the corresponding engine speed.
For example:
The idle engine speed, according to the front panel is 700rpm.
Maximum possible value of engine speed in standard vehicle might be assumed as
7000rpm (programmable in the next parameter), i.e. currently measured value is 10% of
the maximum, and value of 10 is received in an incoming OTA command.
The measured frequency at the moment of OTA command reception is 400 Hz; therefore
the maximum possible value is automatically set as 4000 Hz.
Fc– measured frequency during calibration (Hz)

P – Percentage of a maximum value received in command (%)
Fmax – maximum possible frequency on the wire (Hz)
Using the values from the example above the Scaling Factor, adapting the resolution of
the measurement will be calculated using the following equation:
Sfes – scaling factor of engine speed

Fmax – maximum possible frequency on the wire
(The value, automatically programmed in EEPROM upon the end of the calibration process
will be 64, refer to programming section below in this document)
Note that Cellocator Programmer automatically adapts the value and shows it as 0.064.
6.3.12.4.2 Restoring Value of RPM from the Receiving Value

The central control will have to apply the following conversion upon parsing of the
received value, in order to convert it to the real engine speed.

Manual
[rpm] ES – Momentary value of engine speed [Hz] (this value is received in an OTA
response to calibration command)
Xes – value representing Engine Speed, received in the message
– max possible value of RPM, programmable (7000 by default)
255 – max possible value representing Engine Speed, received in the message
6.3.12.4.3 Local RPM (or GP Frequency) Input Calibration

Local RPM calibration requires enabling a corresponding bit in the configuration (526 bit
2), 1 input and 1 output, which must be configured as a Calibration input and output on
parameters allocated on Address 516. The input is used to control the calibration process
and the output to provide a feedback to the installer (normally by driving a Buzzer).
Calibration Process:
1. Entering ‘RPM calibration mode’ by holding the configured input for 5 seconds. The
device will confirm this command by beeping the buzzer (at the configured output) 3
times (0.5s ON, 0.5s OFF). Device is then ready to start RPM calibration.
2. The following process should take place:
a) Make sure the Ignition is On and the vehicle is Idling (Halt timeout is expired)
b) Set engine to be stable on 1000 RPM, trigger the configured input (<5 Sec).
The device will confirm this command by pulsing the configured output (connected
to buzzer) once (0.5s beep).
c) Set engine to be stable on 2000 RPM, trigger the configured input (<5 Sec), the
device will confirm this command by pulsing the configured output (connected to
buzzer) once (0.5s beep).
d) Set engine to be stable on 3000 RPM, trigger the configured input (<5 Sec), the
device will confirm this command by pulsing the configured output (connected to
buzzer) once (0.5s beep).
e) The device will confirm RPM calibration success by 2 seconds long beep.
If the time between the calibration phases is longer than 30 seconds or there is no
linearity between the readings, a "bad" beep will be issued (5 beeps, 0.5s ON and 0.5s
OFF each) and the RPM calibration will fail.
If a calibration phase fails the unit will preserve the previous successful calibration phase
values.
Note: Max 10% error rate is allowed between two consecutive calibration phases. For
example: after calibrating the 1000 RPM step, the allowed values for the 2000 RPM is
between 1800-2200.

Manual
6.3.12.4.4 Local RPM Calibration Enable
Address: 526, bit 2

Description: this bit enables calibration of the RPM using local input and output.
Default: 0 - disable
6.3.12.4.5 Local RPM Calibration input selection

Description: This parameter selects the input, used during local calibration of the RPM.
Number Description
0 Disable
3 Door
4 Shock
5 Panic
6 CFE IN 1
7 CFE IN 2
8 CFE IN 3
9 CFE IN 4
10 CFE IN 5
11 CFE IN 6
Default: 0 – disable feature
6.3.12.4.6 Local RPM Calibration output selection

Description: This parameter selects the output, used during local calibration of the RPM.
Number Description
0 Disable
2 Gradual Stop
4 St. Immobilizer

Manual
Number Description
5 LED
6 CFE OUT 1
7 CFE OUT 2
6.3.12.4.7 Report engine hours based on RPM
Address: 526, bit 3
Description: This parameter is only applicable for a units containing CSA (iQ40, iQ50 or
CANiQ).
If this bit is enabled, and Engine RPM is used and it's value is higher then zero the unit
will count engine on minutes.
Upon end of the trip the unit will generate an OTA type 9 event to Fleet server, containing
sub-data 4 (GPS and Time) and sub-data 0x16 (number of minutes the engine was on
during this trip).
The same information will be sent also to CSA server, in Module 32 (End of Trip), under
the same conditions.
6.3.12.4.8 Speed (Vss) Input Calibration

Upon reception of OTA calibration command (refer to Wireless protocol, Command type
0x14) the unit shall enter the pulse counting mode until next ignition off. During this
mode the unit does not measure frequency on the specific input, but accumulates number
of pulses received during the entire driving period.
The driver will be asked by the operator to drive certain distance; the same value of
distance will be sent to the unit inside the calibration command sent to the unit at the
same time.
The driver will drive for the required distance according to the front panel reading, stop
and switch off the ignition.
The unit will use accumulated number of pulses to calculate the scaling factor as per the
description below.
Example:
60.000 pulses accumulated during 5km.
D– Driven distance [cm]

Acc – Accumulated number of pulses
Sfs – scaling factor of speed
Manual
(The value to be written to an EEPROM is 8333)

The accuracy of the reported speed and distance depends on the accuracy of distance
driven during calibration.
Below provided reference results of distance calculation accuracy, achieved after 2km
calibration distance:
Odometer value (trip of 479 km) Error [Km] Error [%]
GPS source +10 1.87%
VSS source -5 1.04%
6.3.12.4.9 Maximum Possible Scaled Frequency
Address 2368-2369
Description: This parameter contains the maximum possible value of scaled frequency,
measured on GP Frequency input.
In case of engine speed it will be a maximum possible engine speed in units of rpm (in
standard vehicle might be assumed as 7000rpm)
This value is used by the unit during the process of auto-calibration.
Default: 7000
6.3.12.4.10 Enable Frequency Violation Start Event
Address: 1677 (for Door input), and (1690 for Shock input) bit 2
Description: If enabled (‘1’), the unit will generate a dedicated event upon freq. violation
start.
6.3.12.4.11 Enable Frequency Violation Start Distress
Address: 1677 (for Door input), and (1690 for Shock input), bit 3
Description: If enabled (‘1’), the unit will generate distress session upon freq. violation
start.
6.3.12.4.12 Enable Frequency Violation End Event
Description: If enabled (‘1’), the unit will geneare a dedicated event upon freq. violation
end.
6.3.12.4.13 Enable Frequency Violation End Distress

Manual
Description: If enabled (‘1’), the unit will generate distress session upon freq. violation
end.
6.3.12.4.14 Don't Use Time Filter for Frequency Violation End
Description: If enabled (‘1’), the unit will not wait for the violation filter time and
generate violation end alert immediately after violation end.
Default: 0 – use filter
6.3.12.4.15 Ignore Violation on Ignition On
Description: If enabled (‘1’), the unit will not generate alert:
a) if upon ignition on a measured value is violating the threshold.
b) If after any type of reset a measured value is violating the threshold.
Default: 0 – report violation on Ignition On.
6.3.12.5 Pulse Counter

Fuel consumption is very basic feature in Fleet Management. Older vehicles without
embedded fuel consumption mechanisms usually install 3rd party Fuel Flow Meters
translating the fuel flow into electrical pulses. The Cello Pulse Counter feature will
integrate pulse counting into Cello’s legacy frequency measurement mechanism. The
solution will programmatically support any relation between Litters and resulted electrical
pulses to support multi vendor Flow Meters devices.
The user can send dedicated OTA request and get the measured fuel consumption in
Litters. The Litter measure will be calculated by multiplying the number of pulses
accumulated by programmable scaling factor.
The user can read and set the accumulated pulse count via PL accesses (OTA and serial).
The value in the PL is the raw pulse count.
6.3.12.5.1 Pulse Counter Scaling Factor
Address: 2442-2443 (For Door Input), and 2444-2445 (For Shock Input)
Description: When the Pulse Counter feature is enabled (Door/Shock “Input type” field
option 5) the pulse count will be translated to fuel volume units by multiplying the “Pulse
Counter” value by the “Pulse Counter Scaling Factor” value.
The consumed fuel will be reported periodically to the server using modular message (Msg
Type 9, Sub-data type 14).
The value is represented by 16 bits Little Endian.

Manual
Default: 1 – One pulse per Litter
6.3.12.5.2 Pulse Counter Current Pulse Count
Address: 2438-2441 (For Door Input), and 2434-2437 (For Shock Input)
option 5) this value represents the current pulse count.
The user can program this value to 0 in order to clear the current pulse count.
The value is represented by unsigned, 32 bits, Little Endian.
Default: 0
6.3.12.5.3 Pulse Counter Periodic Transmission Period
Address: 2446-2447 (Common for Door and Shock Inputs)

option 5) the unit starts sending periodic messages (Msg Type 9, Sub-data type 14)
containing values representing the amount of fuel volume consumed by the vehicle as
from the last Pulse Count reset.
This configuration value represents the time between message transmission in unit of 15
minutes.
Default: 0
6.3.12.6 Excessive RPM events Config
Address: 2448
Description: The unit will trigger event towards the communication center upon
detection of an appropriate driver behavior violation if this violation is enabled (1) in this
bitmask.
The feedback will be triggered upon violation of the logical conditions, irrespectively to the
generation (or not generation) of event/distress for the corresponding violation.
Reserved Excessive Excessive Excessive Excessive

RPM RPM RPM RPM
threshold 2 threshold 2 threshold 1 threshold 1
crossed crossed crossed crossed
Distress Logged Distress Logged
Event Event Event Event

Default: 0

Manual
6.3.12.7 Feedback for Excessive RPM Events 1/2
Address: 2449-2451 for Excessive RPM Event 1

2452-2454 for Excessive RPM Event 2
Description: The unit will trigger event towards the communication center upon
detection of an appropriate driver behavior violation if this violation is enabled (1) in this
Driver behavior continuous violation - Feedback bitmask
Address: 2449 for first event output
2452 for second event output
Reserved Output Activation Pattern (Upon Driver Output, auto-activated upon Driver behavior
behavior violation) violation detection
Driver behavior continuous violation - Output activation template

Number of activations in a session Activation length

Time between the activation sessions Number of activation sessions
Default: 0
6.3.12.8 Excessive RPM (Engine Speed) Threshold ½
Address: 2455-2456: Threshold 1

2457-2458: Threshold 2
Description: This parameter contains threshold for Excessive RPM (Engine Speed) event.
NOTES:
The value of Engine Speed is scaled value of frequency measurement, taken from the
input defined as General Purpose Frequency Meter.
If both multipurpose inputs are defined as General Purpose Frequency Meters, the
scaled value from Shock input (pin 15/20) will be used as a value of Engine Speed for
Coasting detection.
Default: 900

Manual
6.3.13 Modem & SIM
6.3.13.1 Shorten Cellular Registration Timeout
Address: 1 bit 1
Description: This programmable bit enables/disables a longer GSM registration to (5
minutes). In case of lack of GSM registration after an expiration of this timeout the
modem will be reset.
0 –5 minutes GSM registration timeout
1 - 30 seconds timeout
Default: 0 - 5 minutes GSM registration timeout
6.3.13.2 Enable Modem Power Control by Door, Shock Input
Address: by “Door” input: Address1, bit 4

By “Shock” input: Address 465, bit 1
Description: If enabled (‘1’), the modem will be switched off by “Door” or “Shock” input
active state detection; it will be turned back on by input inactive state detection; i.e. it is
required two states switch to use this feature (and not just a push button).
6.3.13.3 AHR (Auto Hardware Reset for Modem)

When one of the reasons listed below is detected the unit will attempt to Auto Hardware
Reset (AHR) its modem up to programmable number of reties (5 by default).
No GSM registration in Ignition On mode for programmable time
The modem does not respond to an AT commands (the unit queries the modem 5
times, if there is no reply the unit resets the modem after the 5th retry; after 4
modem resets caused by lack of response, the AHR is triggered).
The unit will create a dedicated event per each AHR (if enabled in Second Configuration
Byte).
6.3.13.3.1 Registration Lack Timeout (for AHR)
Address: 515
Description: stores the timeout value (in minutes), before AHR trigger if the following
conditions are true:
No GSM coverage
Ignition On mode
Data format: 1 byte, unsigned integer, resolution of minute. Zero value cancels the AHR
upon lack of GSM registration.

Manual
Default value: 30 minutes
6.3.13.3.2 Maximum Number of AHR
Address: 504’
Description: The low nibble of this parameter stores the maximal allowed number of AHR
retires in one session and the high nibble is currently reserved.
After the last AHR attempt, no more attempts will be made, even if the modem continues
to be non-responsive or not registered.
If the AHR mechanism is disabled due to sustained non-responsiveness / non-registration
(as explained above), it will only be re-enabled when achieving a full data connection, or
reaching the idle modem management loop, if data connection is prohibited.
Zero retry number will cancel AHR process. Please note that setting this parameter to 0 is
not recommended.
Reserved Maximum number of AHR retries that will be made
Data format: 1 byte = 2 nibbles.

Default value: bits 4-7 = 0, bits 0-3 = 5.
6.3.13.3.3 Enable AHR Reporting
Address: 1, bit 3
Description: If this bit is enabled the unit will store a plain event with dedicated
transmission reason (d200) upon each performed AHR.
Default: 0 (Disabled)
6.3.13.4 Modem Homologation Initialization Mode
Address: 525, bit 3

Description: This control bit changes the modem Codec and encryption initialization to
accord with modem homologation requirements.
Normal mode: AT#AUTOATT=1;#CODEC=0 && AT#ENCALG=5,3,
Homologation mode: AT#AUTOATT=0;#CODEC=7 && AT#ENCALG=5,1
Default: 0 (Normal mode)

Manual
6.3.14 Modem Reset Settings
6.3.14.1 Modem Reset Period
Address: 165-166
Description: This parameter defines the time for periodical modem software reset. This
period is restarted upon each manual and automatic modem reset as well as upon
entering full hibernation.
Data format: 2 bytes value, resolution of 1 minutes
Value span: 0 to 65535 (* Zero value in P disables periodical Modem Reset)
Default value (Dec): 1440 (24 hours)
6.3.14.2 Periodical Modem Reset Randomization
Address: 1352
Description: In case of GPRS network failure all the units are reconnecting to CC
simultaneously after the problem is rectified and it causes heavy communication load on
the CC server.
The Periodical Modem Reset timer is also restarted in all the units at the same time, after
concurrent reconnection to GPRS. It causes all the units to repeat simultaneous modem
resets and this way keeps creating peaks of load on customer’s communication server.
Randomization feature allows the unit to use pseudo random time for Periodical Modem
Reset timer.
The timer is restarted each time to a different value, limited by a programmable
threshold.
(P – Tr)≤ Modem Reset interval ≤(P+ Tr)
P - Periodical Modem Reset parameter
Tr - Periodical Modem Reset Threshold
Wrong programming protection: If P≥Tr the unit will NOT use the low limit of
randomization.
Example:
P=30minutes (res=1min) and Tr=45minutes (res=15min) =>-15< modem reset <75
In this case the lower limit of randomization will not be used:
P≤ modem reset interval ≤75
Data format: Resolution of programmable threshold is 15 minutes, 1 byte
Default value (Dec): 0 (no randomization)

Manual
6.3.15 GSM Band & GPRS Auth Type

Setting proper values of GSM band and PPP GPRS Connection Authentication type enables
accelerating the GSM and GPRS registration process.
On each modem’s initialization the unit will check GSM band setting and modify it if the
actual GSM band of the modem differs from the one, programmed in this section.
Same way on each modem’s initialization the unit will check the PPP GPRS Connection
Authentication type and modify it if the actual Authentication type of the modem differs
from programmed in this section.
“Backward compatibility” programming mode is applied by default. In this mode, the unit
will restore (only if the actual setting differs from the default) the factory setting of the
modem.
6.3.15.1 GSM Band Selection Mode
0 Factory setting, in case of Telit EGSM_DCS_900_1800
1 Manual Mode, see next parameter
Default: 0
6.3.15.2 GSM Band
(Only for Manual GSM Band Selection mode, see GSM Band Selection Mode)

** This feature is not applicable for Cello-CANiQ 3G variants as these Hw variants use
dedicated modems for Europe and North America (UE910 NAR and UE910 EUR come with
hard coded preset bands).
Band/mode code Description
0 EGSM/DCS (900/1800)
1 850/PCS (850/1900)
2-6 Reserved
7 GSM 850MHz + DCS 1800MHz
8 GSM 850MHz + PCS 1900MHz
9 850/EGSM/DCS/PCS (850/900/1800/1900)
10 CelloTrack3G: Selects GSM and UMTS modes with

automatic band selection: GSM: 850/900/1800/1900,
UMTS FDD: Band II/Band IV/Band V

Manual
Band/mode code Description
11 CelloTrack3G: Selects UMTS mode only, Automatic band

selection. UMTS FDD: Band II/Band IV/Band V
10-15 Reserved
Default:
Unit Type Default value
Cello 0
CelloTrack T 3G 11
CR300B 3G
CelloTrack T 2G 9
Cello-CANiQ 2G 9
6.3.15.3 PPP GPRS Connection Authentication Selection Mode
0 Factory setting, in case of Telit PAP
1 Manual Mode, see next parameter
Default: 0
6.3.15.4 PPP GPRS Connection Authentication type

(Only for Manual Authentication type)
0 PAP
1 CHAP
2 AUTO
3 Reserved
Default: 0

Manual
6.3.16 SIM PIN
6.3.16.1 Enable Auto SIM PIN Locking

Description: If this bit is enabled (‘1’) the unit will auto-lock the SIM card with the PIN
code programmed on addresses 0d1326 – 0d1329
NOTES:
Once enabled, the SIM PIN locking is irreversible; there is no way to cancel SIM PIN
locking by command.
The user has to upload the content of the programming after activation of this flag
and programming in order to re-synchronize between the configuration file and the
actual content of the programming.
IMPORTANT: Incorrect usage of this feature might cause SIM card blocking!
Refer to the description in the New SIM PIN section below for further details.
Default: 0 (disabled)
6.3.16.2 Active SIM PIN
Addresses: 197-200
Name in Programmer: SIM PIN
Description: This parameter stores the PIN code that will be entered to unlock the GSM
SIM card when required.
Data format (GSM): The bytes contain the digits of the PIN, encoded in BCD. The order
of the transmission is bytes with lower address first, lower nibbles first. If only the lower
nibble of a byte is used (this is legal only in the last byte – in case this is the last digit of
the PIN), the higher nibble should have all of its bits set (the nibble should contain 15
dec). The rest of the bytes that are not used should contain FFh.
Default value (dec): 1234
6.3.16.3 New SIM PIN
Addresses: 1326-1329
This parameter stores the new PIN code that should be used for locking the SIM Card
during the SIM Lock procedure. This code will replace the Active SIM PIN on address 197-
200 upon successful completion of the SIM Lock procedure:

Manual
Boot
Use number from "SIM

PIN" field when PIN code is
requested.
SIM No
Locking
Enabled?
Yes
SIM PIN Yes

==New
SIM PIN ?
No
Lock SIM with new SIM PIN

code" (old code is needed to
accomplish this procedure)
Replace SIM PIN by New PIN Normal operation

(usage of "SIM PIN")
NOTE: Since the unit is actively modifying content of its programming cells (replacing the
old Pin code by the new one) the configuration file and the actual content of programming
will lose synchronization. It is very important to synchronize them by uploading the actual
content of the configuration memory from the unit before next configuration cycle.
WARNING: Programming the same configuration file twice, without uploading an actual
content of programmable cells after the first programming, will cause immediate blocking
of the SIM card.
Data format (GSM): The bytes contain the digits of the PIN, encoded in BCD. The order
of the transmission is bytes with lower address first, lower nibbles first. If only the lower
nibble of a byte is used (this is legal only in the last byte – in case this is the last digit of
the PIN), the higher nibble should have all of its bits set (the nibble should contain 15
dec). The rest of the bytes that are not used should contain FFh.
Default value (dec): 1234

Manual
6.3.16.4 Lock to Certain IMSI
Address: 1914
Description: If this parameter contains a value of 5 or 6 BCD numbers, the unit will
validate an international mobile subscriber identity (MCC + MNC) of its SIM card ~15
seconds after any wake up. If the value of the SIM is different from the value predefined
in this parameter – the unit will switch off the modem. If this parameter contains a value
smaller than 5 digits the feature is disabled.
NOTE: This feature will not be supported in Cello-IQ builds.
6.4 Power Management
6.4.1 Power Management Mode
Address: 266’
Description: This parameter defines power consumption of the unit during Ignition Off
mode.
Power consumption reduction is achieved as a trade off with availability: as the availability
is lower, the power consumption is lower. The main power consumers of the unit are GPS
and GSM modules; the unit switches them off periodically during parking.
Programmed Mode Description Current

Value Description Consumption1
0 No Both GSM and GPS modules are Average: 37.35mA

hibernation fully active during parking, GPRS Peak: 181.2mA
session active
1 GPS Peeking The GSM modem active, GPRS (while GPS is off)
session active. Average: 23.69mA
The GPS is peeking as per Peak: 104.5mA
programming (see below)
2 Full Both GSM and GPS modules are (while both GPS &
Hibernation in asynchronous peeking as per GSM off)
programming below.
The unit does not respond to Average: 782uA
RS232 queries as well
Note: In this mode Security
Modification will not be able to
detect Signal Correlation
3 Full Relevant for CFE installations Average: 6mA
1
In lab conditions, no battery, Vin=13.7V, very good GPRS coverage over 900MHz GSM network.
The results might vary under different test conditions.

Manual
Programmed Mode Description Current

Value Description Consumption1
Hibernation only.
+ UART Same as Full Hibernation but the
(CFE ) External Serial port is left turned
on. This power mode will wake
the Cello unit when one of the
CFE inputs detects distress
events.
Default value: 2
6.4.2 Enable Automatic Hibernation on Low Power
Address: 1, bit 0
Description: This option allows the unit to enter the full hibernation (with single daily
synchronized GSM-GPS peeking) when main battery of the vehicle considered low. The
unit will leave full hibernation mode upon distress or ignition on.
6.4.3 Hibernation Mode Delay
Address: 271-272
Description: This parameter defines time interval between Stop Event and entering any
programmed Hibernation Mode.
Data format: 16-bit unsigned integer, 16 seconds resolution
Value span: 0x01 (16 seconds) through 0xFFFF (291 hours)
Default value: 60’, (16 minutes)
6.4.4 Enable Pre-Hibernation Update
Address: 4, bit 6 for event

4, bit 7 for distress
Description: This parameter enables and disables an update, before entering the full
hibernation mode.
The update is not generated during GSM or GPS communication peeks, only between the
Stop Event and entering the full hibernation; 15 seconds before an expiration of
Hibernation Mode Delay timeout (Address in 0d 271). Please note that network conditions
might postpone the hibernation by maximum 10 Seconds while waiting for Pre-
Hibernation message acknowledge.

Manual
In case of Hibernation Mode Delay timeout = 0, the event will be generated just after the
Stop event.
Default: Both disabled (zeroes)
6.4.5 Enable Data Forwarding from Serial Port by SMS (in Hibernation)
Address: 4 bit 5
Description: If this parameter is disabled, the unit will not try forwarding data from 3rd
party device connected to unit's COM port (over CSP or Transparent Data protocols)
through SMS in hibernation. (in case GPRS is not available or disabled, the forwarded data
will be accumulated in unit's buffer).
6.4.6 GPS Peeking
6.4.6.1 GPS Peeking – Max On Time
Address: 263
Description: GPS peeking is a power management of GPS receiver, which enables to
reduce its power consumption.
GPS peeking is activated in Ignition Off mode only, when Power Management mode is
defined as 1or 2.
This parameter defines the maximum amount of time the GPS is kept turned on while
peeking. The GPS will be turned off once a fix is achieved, or if the Max. On Time expires.
Value span: 01h (16 seconds) through 255 (68 minutes); zero value is illegal and
shouldn't be used
Default value: 5’ (1 minute 20 seconds)
6.4.6.2 GPS Peeking – Off Time (of Compact and 370-50)
Address: 264-265

Manual
Description: This parameter defines the amount of time between GPS peeks. (Refer to
the chart in GPS Peeking – Max On Time). During this time the GPS is turned off, to
conserve energy.
Value span: 01h (16 seconds between two consecutive peeks) through FFFFh (~12 days
between two consecutive peeks)
Default value: 675 (3 hours from the end of one peek to the start of the next one)
6.4.7 GSM Peeking
6.4.7.1 GSM Peeking – Maximum Network Registration Time
Address: 270
Description: GSM Peeking is a power management of GSM Modem, which allow to
reduce its power consumption.
GSM peeking is activated in Ignition Off mode only, when Power management mode is
defined as 2.
Maximum Network Registration Time: This parameter defines time interval, given to
GSM modem for registration into cellular network. If registration wasn’t accomplished
during that time – the modem is being turned off for Off Time.
If registration is being accomplished, the modem is kept turned on for time period defined
in Modem On Time parameter. The modem is switched back off when Modem On time
expires and there is no data transfer for at least 10 seconds.
Value span: 01h (16 seconds) through 255 (72.8 hours)
Default value: 4 (1 minute and 4 seconds)
6.4.7.2 GSM Peeking – Modem Off time
Address: 268-269

Manual
Description: This parameter defines the amount of time between GSM peeks. (Refer to
the chart in GSM Peeking – Maximum Network Registration Time). During this time the
GSM Modem is turned off, to conserve energy).
Data format: 16-bit unsigned integer, 16 seconds resolution.
between two consecutive peeks). Values below 32 seconds (<02h) are illegal and
shouldn’t be used.
Default value: 225 (1 hour from the end of one peek to the start of the next one)
6.4.7.3 GSM Peeking – Maximum Modem On time
Address: 267
Description: This parameter defines time the modem is kept turned on after the end of
the GSM registration. If GPRS is enabled, the unit will dial GPRS and connect to the
communication server during this time.
Value span: 01h through FFFFh; value of 0 is illegal and shouldn’t be used
Default value: 4 (1 minute and 4 seconds)
6.4.8 Battery Charging

The unit is equipped by a built in Li-Ion/Polymer CCCV charger, applying 0.5C (constant
current), charge the battery up to 4.1V, then CV (constant voltage) charge till 4.15V.
The charger will be activated in Ignition On mode (with an exception described below) in
temperature range between 0°C and 45C.
The full charge time of the standard 700mAh battery is ~2hours.

Manual
6.4.8.1 Maximum Backup Battery Extra Charge Time
Address: 138
Name in Programmer: Maximum extra charge time
Description: This parameter defines the maximum time for extra backup battery charge
in Ignition Off mode. The charge process begins upon Stop in case of detection of low
level of backup battery (see corresponding programming parameter), and continues for
the time defined in this parameter (if the unit does not enter hibernation).
Data format: 8-bit unsigned integer, resolution of 10.24 sec
Default value: 117 (~20 minutes)
6.4.8.2 Charge Irrespective of Operational Mode
Address: 1350 bit 0

Description: While this bit is set (1) the unit will activate the built in charger if the main
power source presents. In this case neither operational mode, not the ignition or
movement detection affect start or stop charging; only the logic of the built in charger
affects the charge process.
When this bit is disabled (0, legacy mode) the unit activates the charger only during
standby engine on mode and for limited time upon switching the ignition off.
6.5 Voice Call Settings (not supported by CelloTrack)
6.5.1 Voice Call Destination Number
Addresses: 273’-282
Description: Stores the default target address used by the unit to establish Voice call,
initiated by the driver. Under normal circumstances, this will be a voice line phone
number of Central Control room.
Data format: First byte should contain the total amount of digits that make up the actual
address (not including address type byte). Second byte is the address type byte, which
should be 91h for international address (recommended type to use, to allow roaming) or
81h for local address. The rest of the bytes contain the actual address, encoded in BCD.
The order of the transmission is bytes with lower address first, lower nibbles (nibble = 4
bit) first. If only the lower nibble of a byte is used (this is legal only in the last byte – in
case this is the last digit of the address), the higher nibble should have all of its bits set
(the nibble should contain 15 dec). The rest of the bytes that are not used should contain
FFh.
Default value: +972 52 5539819

Manual
6.5.2 GSM Related Preferences
6.5.2.1 Incoming Voice Call Enable

NOTE: The NOM-2 GSM networks do not allow incoming voice calls to the unit while GPRS
data is exchanged in an open socket. In that case the caller will be routed to voice mail
service or get busy tone. If the data exchange does not take place in a socket upon
incoming voice call – the voice call will be routed to the unit.
It is possible to query the modem for the serving GSM network type using an AT
command forwarding interface, refer to a Wire Protocol document for more details.
Addresses: In Home Network: 202 bit 3
In Roam Network: 204 bit 3
In Hibernation (only if enabled in corresponding Home or Roam GSM): 4 bit 3
Description: If this bit is enabled the unit will process an incoming voice calls and allow
manual or automatic (as per configuration) answering. Ring sound will be played in
speaker upon incoming call reception.
Setting of hibernation flag is treated as an AND condition with the corresponding GSM
network condition.
Example: If the unit is parked (in GPS peeking hibernation mode) in Roam network,
incoming calls in roaming are enabled AND incoming calls in hibernation are disabled –
the unit will ignore an incoming call.
Default: Enable (1) in Home and Hibernation, disabled (0) in Roaming
6.5.2.2 Outgoing Voice Call Enable

Description: If this bit is enabled the unit will enable voice call initiation.
network condition.
Example: If the unit is parked (in GPS peeking hibernation mode) in Roam network,
outgoing calls in roaming are disabled AND outgoing calls in hibernation are enabled – the
unit will ignore an initiate voice call command.
6.5.2.3 Enable Auto Answering Incoming Call


Manual
Description: If this bit is enabled the unit will auto answer any incoming voice call. One
Ring signal will be played in the hands free speaker before the call will be picked up by
the unit.
network condition.
6.5.3 Inputs Triggering Voice Call

Description: The voice calls initiated from cabin can be Plain Voice callas or Distress
voice calls.
There are 2 differences between those types:
Once initiated distress voce call cannot be hanged up from cabin, but only from
Central Control; the plain voice call can be hanged up from cabin.
Plain voice call is initiated immediately; distress voice call is initiated after distress
session.
Distress voice call feature provides an extension to the normal distress session
functionality: upon the end of the distress session caused by a trigger on a corresponding
input, the unit is initiating voice call to a Central Control. Obviously the corresponding
input must be programmed as a distress session trigger as well (refer to an Input's Events
section of this document).
The operator might also consider activation of Speaker Muting (see below) during the
distress voice call. This way the operator will be able to listen to what is happening in a
cabin without being compromised.
6.5.3.1 Initiate Distress Voice Call by Panic Input
Address: 505, bit 0

Description: If this bit is enabled (and the distress session for Panic input is enabled in
Input's Events section) the unit will initiate a distress voice call upon the end of the
distress session triggered by Panic input.
6.5.3.2 Initiate Distress Voice Call by Door Input
Address: 505, bit 1

Description: If this bit is enabled (and the distress session for Door input is enabled in
Input's Events section) the unit will initiate a distress voice call upon the end of the
distress session triggered by Door input.
Default: 0 – disabled

Manual
6.5.3.3 Enable Initialization & Answering Voice Call by Shock Input
Address: 465, bit 0

Description: If this bit is enabled trigger on Shock input (pin 15) can be used to answer
an incoming voice call and to hang up the active call (‘1 to enable, ‘0 to disable).
6.5.4 Speaker of Hands Free - Mute Settings
6.5.4.1 Temporary Mute Speaker during Auto-answered Incoming Calls
Address: 506, bit 0

Description: This flag should be enabled when it is required to wiretap happening in a
cabin without being compromised. Obviously the Auto-Answer incoming calls option have
to be enabled as well.
No indication of active voice call will appear in a cabin for pre-programmed time (defined
in "Speaker Mute Time During Auto-answered Incoming Calls" parameter) except glowing
LED.
After the expiration of this timeout the speaker will be automatically activated and the
operator will be able to communicate with the driver.
6.5.4.2 Temporary Mute Speaker during Distress Calls
Address: 506’, bit 1

Description: This flag should be enabled when it is required to wiretap the distress calls
in a "spy way". No indication of active voice call will appear in a cabin for pre-
programmed time (defined in "Speaker Mute Time During Distress Calls" parameter)
except glowing LED.
After the expiration of this timeout the speaker will be automatically activated and the
driver will be able to communicate with an operator.
6.5.4.3 Speaker Mute Time during Auto-answered Incoming Calls
Address: 507’
Description: This parameter defines speaker mute timeout upon auto answered incoming
voice call process (if “Temporary Mute Speaker During Auto-answered Incoming Calls”
flag is enabled.)
Default value: 30

Manual
6.5.4.4 Speaker Mute Time during Distress Calls
Address: 508’
Description: Defines speaker mute timeout upon distress voice call process (if
“Temporary Mute Speaker During Distress Calls” flag is enabled.)
Default value: 30
6.5.5 Volume and Gain Control Byte
6.5.5.1 Microphone Gain
Address: 1402, bits 0 to 2

Description: This parameter enables you to control Hands Free's Microphone gain
programmatically.
Programmed The Gain (Resolution

Value of 6 dB)
0 3 (18dB)
1 4
2 5
3 6
4 7
5-6 Not supported, auto set

to 0dB
Default value: 0
6.5.5.2 Speaker's Volume
Address: 1402, bits 3 to 5

Description: This parameter enables you to control Hands Free Speaker's gain of the
hands free programmatically.
Except the option to control the speaker's volume directly through the programmable
parameter, it is possible to control it using one or two inputs as described below.
Each input (except an ignition) can be assigned with a function of Volume control.
Functions 9 (volume up) and 10 (volume down) allows controlling the Speaker's Volume
by affecting this programmable parameter.

Manual
Every input's state change to "triggered" increases (or decreases, if the function is
"volume down") the value programmed in Speaker's Volume field by one and immediately
applies it.
Volume change can take place only during active voice session; trigger on of volume
control input while there is no active voice session is ignored by unit.
If there is only one volume control input defined (Volume up or Volume down) increasing
(or decreasing) the value of the parameter higher (or lower) then its max. (min) possible
value will cause the parameter to restore its lowest (highest) possible value.
Volume up:
0->1->2->3->4->5->6->7->0->1…
Volume down:
7->6->5->4->3->2->1->0->7->6…
Otherwise, if two volume control inputs are defined (Volume up AND Volume down),
increasing (or decreasing) the value of the parameter higher (or lower) then its max.
(min) possible value will be ignored by unit.
The "Fast Volume Change Mode"
The user is able to press the volume control constantly in order to increase/decrease
volume. In this case, button should be pressed continuously for 2 seconds in order to get
into “Fast Change” mode after which the volume will be changed in intervals of ½
seconds.
The first change will always occur immediately upon pressing the button independently of
the question whether the button is continually pressed for “fast change” or not.
Each time a volume change is applied by the state machine, a “tone” feedback is provided
thru the speaker of the hands free (half a second "1" DTMF signal).
Default value: 3
6.5.5.3 Ringer Volume
Description: This parameter enables to control Hands Free Speaker's gain of the hands
free programmatically.
Note that it is possible to control the value of this parameter according to the values in
the table below.
Programmed The Gain (Resolution

Value of 2 dB)
0 1
1 2
2 3
3 4
Default value: 2

Manual
6.6 Informative Parameters
6.6.1 Last Distance Event
Address: 85-88
Description: This parameter stores odometer value (in base units) recorded upon last
Distance event generation. This parameter is not recommended for user modification, it is
managed by the unit for recovery situations.
If upon programming the value programmed in this parameter will be higher than the
value of odometer, the unit will overwrite it with the value of odometer.
Data format: The parameter is a 32-bit integer
Value span: 32bits range
Default value: 0
6.6.2 Field for Customer Use
Address: 1314 – 1317

Description: This field is designed to store customer’s proprietary data (like specific
EEPROM content identifier).
Data format: Customer defined
Default value: zeros

Manual
7 Distance and Speed Events
7.1 Distance Events
7.1.1 Enable Distance Updates
Address: 99 bit 1 for Plain Events

102 bit 1 for Distress Events
Description: This parameter enables generation of the Events and/or Distresses upon
the passage of a certain distance.
The distance updates are generated with respect to Home or Roam GSM network and the
speed of the vehicle. Normally the customer would expect reported distance to be longer
in Roam networks (to save on a communication in roaming GSM) and on high speeds,
where the rear events can still provide a good picture of the root.
Default value: Both zeros (disabled)
7.1.2 Trip for a Distance Event
Address: 89 – 91 for Home Network

32 – 34 for Roam Network
Description: This parameter defines a distance between two consequences Distance
updates (events or distresses). The distance is in basic distance units.
Data format: The parameter is an unsigned a 24-bit integer
Default value: 5
7.1.3 Distance Event Multiplier for HIGH SPEED Mode
Address: 92, bits 0-3 for Home Network

35, bits 0-3 for Roam Network
Description: This parameter defines a multiplying factor of distance update for normal
and high speeds. The speed is considered "high" when higher then programmed in
Velocity threshold for HIGH SPEED mode on address 455.
For example: if Trip for a Distance event is set to 100 meters, and Distance Event
Multiplier for roaming is set to 4, the unit will set distance updates in roaming mode to
every 400 meters.
Default value: Both 1

Manual
7.2 Over (and Idle) Speed
7.2.1 Velocity Threshold for Over Speed Start Event
Address: 93
Description: This parameter stores velocity threshold used for Over Speeding session
start. If velocity of the vehicle is higher than this threshold, for longer than programmed
in the Ov***er Speed Duration filter parameter, the unit will consider over-speeding. If
corresponding updates are enabled, the unit will generate event or/and distress.
Note that the Overspeed start will be registered on a velocity of ~2km/h higher than
programmed. In addition, this threshold is only used when not in “Trailer mode” and not
in “Input dependent Over Speed” mode
Value resolution: Units in 32 cm/sec
Default value: 91 (105km/h)
7.2.2 Velocity Threshold for Over Speed End Event
Address: 94
Description: This parameter stores velocity threshold used for Over Speeding session
end (only if the Over Speeding session is already open). If velocity of the vehicle gets
lower than this threshold, for longer than programmed in Over Speed Duration filter
parameter (or immediately as per the configuration flag described below), the unit will
consider end of over-speeding.
If corresponding updates are enabled, the unit will generate event or/and distress.
Note that this threshold is only used when not in “Trailer mode” and not in “Input
dependent Over Speed” mode
Default value: 87 (100km/h)
7.2.3 Filter of Over Speed Duration
Address: 95
Description: This parameter stores timeout value, used to consider the speed violation
start/stop. It actually defines the over speed duration which will cause a corresponding
update (if enabled).
Value resolution & span: Duration resolution is 2.5 Seconds. Duration Span from: 0
seconds (0x00h), to 10min 30 sec (0xFEh).
Default value: 4, (10 seconds)

Manual
7.2.4 Do not use Time Filter to Close Over Speed Session
Address: 492, bit 4

Description: If this bit is set, any open over speed sessions will be closed when the
speed of the vehicle will get lower then "Velocity threshold for GPS over Speed End"
threshold.
Default value: 0 (disabled)
7.2.5 Alternative Over Speed Threshold for Input Dependent Mode
Address: 2391
Description: The unit supports automatic change of over-speed thresholds while certain
input is triggered.
This is useful to change over-speed threshold while raining (in this case the input will be
connected to the wipers wire) or at night (in this case the input will be connected to the
vehicle lights).
Function 12 is available in a list of options available for “Function assigned” byte in input’s
configuration. When it is selected for any input (except ignition), and this input is
triggered, the unit will automatically use speed threshold programmed on address 2391
as both Over-speed start and Over-speed end thresholds.
NOTES:
Over-speed threshold may change only while over-speed session is NOT active.
If the input changes its state while the over-speed session is active – the unit will
keep using over-speed thresholds selected upon over-speed session start.
If both the “Trailer mode” and “Input dependent Over Speed” modes are active
concurrently the unit will select the lowest speed threshold out of two.
Specific Transmission Reason byte of Over-Speed alert
Upon detection of over-speed violation the unit is sensing event or/and distress with
transmission reason 34(start)/42 (stop). The “Specific Transmission Reason” byte of those
messages will contain value “1” if the unit is utilizing alternative Over-speed thresholds
while generating them.
This parameter contains an alternative value of Over-speed threshold, used when an
input, programmed as “Over-speed threshold control” is triggered.
The same value is used for both Over-speed start and Over-speed end thresholds.
The over-speed time filter (programmed on address 95) shall expire prior to alert
generation irrespectively to the selected speed thresholds.
Resolution: 32 cm/sec
Default value: 70km/h

Manual
7.2.5.1 Velocity Threshold for Idle Speed Start Event
Address: 97
Description: This parameter stores velocity threshold used for Idle Speeding session
start (Idle Speeding refers to when the vehicle is parking with a working engine). If velocity of
the vehicle gets lower than this threshold, for longer than programmed in Idle Speed
Duration filter parameter (from ignition on or from higher speed), the unit will consider
Idle Speeding start.
Default value: 14 (16 km/h)
7.2.5.2 Velocity Threshold for Idle End Event
Address: 96
Description: This parameter stores velocity threshold used for Idle Speeding end (only if
the Idle Speeding session is already open). If velocity of the vehicle gets higher than this
threshold, for longer than programmed in Over Speed Duration filter parameter (or
immediately as per the configuration flag described below), the unit will consider end of
idle-speeding.
Default value: 16 (19 km/h)
7.2.5.3 Filter of Idle Speed Duration
Address: 98
Description: Timeout value, used to consider the idle speed violation start /end.
Value resolution & span: Duration resolution is 2.5 seconds.
Duration Span from: 0 seconds (0x00), to 10 min 50 sec (0xFE)
7.2.5.4 Multiplier for Idle Speed Start Detection Time Filter

Description: This parameter contains a value of multiplier, used to increase dramatically
Idle Speed Start detection time.
Time for generation = Idle Speed * (Multiplier +1)

Idle Speed Start Duration Filter
Value of 0 disables multiplier.

Manual
Default: zero
7.2.5.5 Do not use Time Filter to Close Idle Speed Session
Address: 492, bit 5

Description: If this bit is set, any open idle speed sessions will be closed when the speed
of the vehicle will get higher than "Velocity threshold for GPS Idle Speed End" for longer
than 10 seconds.
7.2.5.6 Start Idle Speed Timer with Ignition On
Address: 492, bit 6

Description: When this bit is set, the unit will start counting time to Idle Speed Start
from the Ignition On detection. Otherwise (if this bit is zero) the timer activated from the
first time the speed is getting lower than Velocity threshold for GPS Idle Speed Start
7.2.5.7 Create Idle/Over Speed End Update for an Open Session per Ignition Off
Address: 492, bit 7

Description: When this bit is set, the unit will close opened Idle/Over Speed sessions
upon ignition off and generate an appropriate updates.
Otherwise (this bit is zero) the unit will not generate an appropriate updates and simply
close any open speed session upon Ignition off.
7.2.6 Events and Distress Control
7.2.6.1 Enable Distress for Idle Speed Start/End
Address: 102, bit 3

Description: If this bit is set the unit will generate distress session upon every Idle
Speed start /end.
7.2.6.2 Enable Events for Idle Speed Start/End
Address: 99, bit 3

Description: If this bit is set the unit will generate an event upon every Idle Speed start
/end.
Manual
7.2.6.3 Enable Events for Over Speed Start/End
Address: 99, bit 2

Description: If this bit is set the unit will generate an event upon every Over Speed start
/end.
7.2.6.4 Enter Distress for Over Speed Start/End
Address: 102, bit 2

Description: If this bit is set the unit will generate distress session upon every Over
Speed start /end.
7.3 Sudden Course Changed and Sudden Speed Change

Sensors
Sudden Course Change and Sudden Speed Change sensors are derived from the GPS
output; they analyze the delta speed and course between GPS fixes.
The speed and course thresholds are provided separately for each of 4 ranges of speed.
7.3.1 Speed Thresholds V0, V1 and V2
Address: V0-473
V1-474
V2-475
Description: The 4 speed ranges are defined by 3 speed thresholds: V0, V1 and V2
Speed Range 3
V2
Speed Range 2
V1
Speed Range 1
V0
Speed Range 0
0 km/h
The speed ranges threshold (V0, V1, V2) must meet the condition: V0<V1<V2
Data format: 8 bits parameters with resolution of 16 cm/sec

Manual
7.3.2 Delta Speed and Delta Course for Speed Range X
Description: The sensors will trigger if the delta speed or/and course between two
adjacent valid fixes (the unit is getting an updated GPS data fix every 1 second)
exceeds a predefined speed or/and course thresholds for the specific speed
range (if the current or last fix is invalid, the sensors won't trigger).
The following table contains address of speed and course thresholds for each speed range:
Harsh Braking Acceleration Course Delta

Threshold Threshold Threshold
Speed Range 8 bits parameters 8 bits parameters 8 bits parameters
with resolution of with resolution of with resolution of
16 cm/sec 16 cm/sec 0.016 rad
Speed Range 0 476 511 480
Zero value in any of the parameters above will cancel the corresponding sensor for the
specific speed range.
Default Values:
Address (Dec) Value (Dec) Value
473 34 19.6 km/h
474 104 60 km/h
475 173 99.6 km/h
476 17 9.8 km/h
477 17 9.8 km/h
478 17 9.8 km/h
479 17 9.8 km/h
480 49 45°
481 49 45°
482 49 45°
483 49 45°
511 17 9.8 km/h
512 17 9.8 km/h

Manual
Address (Dec) Value (Dec) Value
513 17 9.8 km/h
514 17 9.8 km/h
7.3.3 Events, Distress and HRLS Updates Control
7.3.3.1 Sudden Speed Change (Acceleration and Harsh Braking)
Address: 99, bit 4 for Events

102, bit 4 for Distress
103, bit 4 for HRLS
Description: If this bit is set, the unit will generate a corresponding update for any
detected harsh acceleration and harsh braking.
Default Values: zeros (disabled)
7.3.3.2 Sudden Course Change

103, bit 5 for HRLS
Description: If this bit is set, the unit will generate a corresponding update for any
detected harsh course change.
7.3.4 Speed Limiting Geo-Fence
Speed limiting Geo-Fence enables the fleet manager to define speed limits within geo-
Fence boundaries. Each Geo-Fence entry in the configuration memory can define 1 of 4
possible speed thresholds. The Speed limiting Geo-Fence feature is enabled by setting the
field TOE (Type of Entry) in the Geo-Fence entry to 6. The unit can handle up to 4 over
lapping speed zones sessions concurrently.
Speed violations are reported via a dedicated type 0 message whenever the speed within
the Geo-Fence exceeds the configured speed threshold. End of speed violation session will
be reported when one of the following events occurs:
1. After violation start the speed fails lower then zone’s specific threshold according to
programmed over speed rules (after expiration of over-speed end time filter).
2. The unit leaves Geo-Zone boundaries.
3. Specific zone timeout expired (while inside zone boundaries).

Manual
Speed limiting decisions will be taken (both for start and for end of over speed) based on legacy time filter of over speed (at
address 0d95).
7.3.5 Speed Limiting Geo-Fence Enable
Speed Limiting Geo-Fence is enabled by setting the value of TOE (Type Of Entry) filed to
6. Please see TOE - Type Of Entry
7.3.6 Speed Limiting Geo-Fence Threshold Select
Each Geo-Fence entry has 2 bits filed called “Speed Limiting Threshold Select”. The filed
can select one of 1 of 4 possible threshold values. The 4 Geo-Fence Speed Limiting
thresholds are defined in
Speed Limiting Threshold Select
(Bits 31,30) Address of Speed Limit parameter in Configuration
Bit 31 Bit 30 memory
0 0 1917
0 1 1918
1 0 1919
1 1 1920
7.3.7 Speed Limiting Geo-Fence Threshold
Address: 1917, 1918, 1919, 1920

Description: These 4 parameters define the Geo-Fence speed limiting thresholds. The
speed limiting threshold is defined in units of Km/H.
Default: 20, 30, 30, 40
7.3.8 Speed Limiting Geo-Fence Alerts Enable
Generation of Speed limiting zone shall be enabled as follows:

Address: 1004, bit 5 Event
1005, bit 5 Distress
Description: : If this bit is enabled the unit will generate an alerts upon violation of
selected speed limit of the active Speed limiting zone. Speed session started within the
premises of a geozone will be terminated when the speed goes below the speed threshold
(inside the premises of the GeoFence) or when the vehicle goes out of the GeoFence.
Speed Limiting violation Start event: Type 0, TR212, STR=geo fence index.
Speed Limiting violation End event: Type 0. TR213, STR=geo fence index.
Default: 0 – both disabled

Manual
7.3.9 Speed Limiting Geo-Fence Output Activations
The same output activations properties used for “Driver Behavior over speeding” will be
used for Speed Limiting Geo-Fence. The “OverSpeed” feedback bit must be set in
Feedback for driver behavior violations bitmask to enable Speed Limiting Geo-Fence
outputs.
Please refer to:
Output, auto-activated upon momentary driver behavior violation detection

Template of continuous Output Activation upon detection of driver behavior violation
NOTE: When “Speed Limiting Zone” is selected in the GeoFence configuration the Fence
generic output activation will be automatically disabled.
7.4 Go (Start Movement) and Halt (Stop Movement) Events
This feature is intended to detect slow movement in traffic jams. The session is very
similar to Idle Speed feature described above, although serves for a different purpose
simultaneously with Idle Speed detection.
The session proposes set of programmable parameters, identical to those of Idle Speed
Algorithm:
"Go/Halt" speed detection Threshold
"Go/Halt" Threshold Time Filter
"Go/Halt" session configuration flags
"Go/Halt" events/distress control
The Go/Halt session is also used for Curve Smoothing feature to prevent generation of
unnecessary events of "course change" during parking.
7.4.1 Go/Halt Speed Detection Threshold
Address: 1387-1388
Description: This parameter stores velocity threshold for detection of movement start
(GO event) and movement end (Halt event).
If measured velocity is higher than this threshold for longer than the Time Threshold,
"Go" event will be triggered.
If measured velocity is lower than this threshold for longer than the Time Threshold,
"Halt" event will be triggered.
Value resolution: Units in cm/sec
Default value: 5 km/h

Manual
7.4.2 Go/Halt Time Threshold Filter
Address: 1389
Description: This cell stores a time filter for "Go/Halt events" generation, while the
speed of the vehicle complies with the logical condition described in the parameter above.
Value resolution & span: Duration resolution is 1 second. Duration Span from: 0
seconds (0x00), to 255 seconds (0xFF).
7.4.3 Go/Halt Session Control
These parameters allow setting especial aspects of the Go/Halt session.
7.4.3.1 Multiplier for Go/Halt Time Threshold Filter for "Halt" Detection

Description: Allows enlarging the "Halt Detection filter", in order to prevent Halt
detections on traffic lights. The value of the Time Threshold filter will be multiplied by the
value in this parameter.
Value of zero will cancel the Time Threshold filter for "Halt" event detection.
Default value: 0 – Cancel Time Threshold for "Halt"
7.4.3.2 Do not use Time Threshold Filter for "Go" Detection

Allows immediate "Go" detection, ignoring Time Threshold filter.
Default value: 0 – use time threshold for "Go"
7.4.3.3 Enable Go/Halt Updates

Description: If this bit is set, the unit will generate a corresponding (Go or Halt) update
upon detection.

Manual
8 Time and Trip Events
8.1 Start and Stop Alerts
8.1.1 Start Alert Generation Time Filter
Address: 104
Name in Programmer: Start Event Time Filter
Description: This parameter stores time filter, defining a required duration of stable
Ignition On state (after ignition state change) for triggering Start (driving session) alert.
The control of alert type (plain event / distress event) is made from Ignition Input
Settings folder.
Value resolution & span: Duration resolution is 2.56 seconds.
Default value: 7.74 sec
8.1.2 Stop Alert Generation Time Filter
Address: 105
Name in Programmer: Stop Event Time Filter
Description: This parameter stores time filter, defining a required duration of stable
Ignition Off state (after ignition state change) for triggering Stop (driving session) alert.
The control of alert type (plain event / distress event) is made from Ignition Input
Settings folder.
Value resolution & span: Duration resolution is 2.56 seconds
Default value: 7.74 sec
8.2 Time-based Alert
This group of parameter controls time period of the updates, generated by the unit
periodically between "Start" and "Stop" (when ignition switch is on). “Time alerts” or
periodical updates are not generated after "Stop" (when ignition switch is off).
This period is controlled also by the OTA Tracking Command and applied on the fly with
no reset.
Time-based alert period might be automatically modified by the unit in real time as a
function of the following conditions:
GSM condition: Home, Roam GSM network or No GSM coverage mode
Speed: High Speed mode or Normal Speed mode.

Manual
There is also a possibility of dynamic Time-based alert period modification as a function of

speed, refer to V-Trek feature below.
8.2.1 Time Alerts Resolution Definer
Address: 106, bit 7 for Home network

499, bit 7 for Roam network
Description: This bit defines resolution of the Timed Event Period. This resolution can be
either 4 (when this bit is 0) or 90 seconds (when this bit is 1).
Resolution of 4 seconds enables setting Time-based alert period up to every ~8.4
minutes, resolution of 90seconds, up to ~3:10 hours
Note: In case 3 parameters: " Force one second resolution Rome Mode ", "Resolution
Definer in Roaming Mode" and "Time Report Period value in Roaming Mode" parameters
are zero (value on address 499 and 526 bit 1 are 0), the unit will use Home parameters
(programmed on address 106 and 526 bit 0) during Roaming.
Default value: 0 – resolution of time-based alert period is 4 seconds
8.2.2 Time Alerts Period Value
Address: 106, bits 0-6 for Home network (TEPH)

499, bits 0-6 for Roam network (TEPR)
Description: This parameter stores a Time-based alert Period value with resolution
configured in previous parameter (4 or 90 seconds). Value 0 disables the time-based
alerts.
Note: In case 3 parameters: " Force one second resolution Rome Mode ", "Resolution
Definer in Roaming Mode" and "Time Report Period value in Roaming Mode" parameters
are zero (value on address 499 and 526 bit 1 are 0), the unit will use Home parameters
(programmed on address 106 and 526 bit 0) during Roaming.
Default value: 75 (300 seconds when resolution is set to 4 seconds)
8.2.3 Force one second resolution Roaming Mode
Address: 526, bit 0 for Home GSM network

526, bit 1 for Roam GSM network
Description: This parameter forces the resolution of Time-based alert to one second,
irrespectively to the values, programmed on addresses 106 and 499.
Default value: both 0 (disabled)

Manual
8.2.4 Time Alert Period Multiplier for HIGH SPEED Mode
Address: 92, bits 4-7 for Home GSM network

35, bits 4-7 for Roam GSM network
Description: This parameter stores the Multiplier of Time-based alert Period during HIGH
SPEED mode. For example if the programmed value is 2, on speed higher then Velocity
Threshold for HIGH SPEED mode the unit will generate Time-based alerts two times less
Value of zero disables the time-based alerts in High Speed mode.
Default value: 1
8.2.5 Time Report Period Multiplier for NOIP Mode
Address: 485
Description: This parameter enables automatic change of time events period during NO
IP mode (while GPRS is unavailable):
The basic time event period is multiplied by the factor programmed in this parameter.
Note: value of Zero is legal and considered by the unit as "1".
Default value: 1
8.2.6 Table of Time-based Alert Period Calculation

Home Network Roam Network
Time-based Time-based Time-based Time-based

alerts Resolution alerts Resolution alerts alerts
Definer= 0 Definer= 1 Resolution Resolution
Definer= 0 Definer= 1
Low TEPH * 4 (TEPH +1) * 90 TEPR * 4 (TEPR +1) * 90

Speed seconds seconds seconds seconds
High HSpeedHm * HSpeedHm * HSpeedRm * HSpeedRm *

Speed (TEPH * 4 (TEPH +1)* 90 (BPVR * 4 (BPVR+1)* 90
seconds) seconds seconds) seconds
Legend:
TEPH – Time-based alert Period in home network, bits 0:6 of address 106’
TEPR – Basic period value in roam network, bits 0:6 of address 499 (value of zero will
cause the unit to use Home settings during roaming)
HSpeedHm – Time-based alert period multiplier for high speed mode in Home
network, (bits 4:7 of address 92)
HSpeedRm – Time-based alert period multiplier for high speed mode in Roam
network, (bits 4:7 of address 35)

Manual
8.2.7 V-Trek: Dynamic Time-based Alerts Period Control as a Function of

Speed
V-Trek algorithm proposes an advanced automatic control of Time-based alert period

(Plain Events Only), intended to reduce communication costs by reduction of transmission
number without decrease in alert quality.
The V-Trek algorithm controls Time-based alerts period as a function of speed. Obviously
the time-based events shall be enabled in order to use V-Trek.
The V-Trek configuration relays on 4 parameters – minimum and maximum speed as well
as transmission interval for each speed (min and max). A lower time interval causes more
frequent transmissions.
NOTE: If all 4 parameters are set to zero, the V-Trek feature is not used. If the
parameters are set, normal Time-based alert management is canceled and replaced by V-
Trek.
(T1, V1) (T2, V2)
Reverse slope Normal slope
(T1, V1) (T2, V2)
Time
8.2.7.1 Normal Slope of V-Trek
Normal slope is used when it is required to reduce number of transmissions on high

speeds. The logic behind this is that number of turns on highways is lower than in city;
reducing location updates 5 times on a highway will not harm the quality of the route
traced on a map.
on speed lower than V1 the unit will not generate an events.
on speed higher than V2 the unit will constantly transmit with resolution of T2.
On speed in range between V1 and V2 the transmission rate is dynamically changing: the
update rate becomes slower as speed raises.
Normal Slope is considered when the V2>V1.

Manual
8.2.7.2 Reverse Slope of V-Trek
Reverse slope is used when it is required to reduce number of transmissions on low

speeds. The logic behind this is to reduce number of transmissions sent while driving in
traffic jams.
on speed lower than V2 the unit will constantly transmit with resolution of T2
on speed higher than V1 the unit will constantly transmit with resolution of T1
On speed in range between V1 and V2 the transmission rate is dynamically changing: the
update rate becomes faster as speed raises.
Reverse Slope is considered when the V2<V1.
8.2.7.3 V-Trek Time Period Calculation
The unit compares the time passed from the last Time-based alert generation with the
new calculated Time Period value (according to the current speed).
If the time passed from last Time-based alert is greater than the new calculated value of
Time Period then the “timed event” will be triggered immediately; otherwise it will be
triggered when the new calculated period will exceed.
8.2.6.3.1 V-Trek – V1 Speed
Address: 1310
Description: This parameter contains the value of V1 speed in km/h; see V-Trek feature
description above.
Data format: unsigned integer, km/h
Default value: 0
8.2.6.3.2 V-Trek – T1 Time
Address: 1311
Description This parameter contains the value of T1 time period in minutes; see V-Trek
feature description above.
Data format: unsigned integer, minutes
Default value: 0
8.2.6.3.3 V-Trek – V2 Speed
Address: 1312
Description: This parameter contains the value of V2 speed in km/h; see V-Trek feature
description above.
Data format: unsigned integer, km/h

Manual
Default value: 0
8.2.6.3.4 V-Trek – T2 Time
Address: 1313
Description: This parameter contains the value of T2 time period in minutes; see V-Trek
feature description above.
Data format: unsigned integer, minutes
Default value: 0
8.2.6.3.5 Event and Distress Control of Time Alert

Description: This parameter enables generation of Event or Distress alerts for Time-
based events, generated according to normal logic or V-Trek.
If both flags are disabled (0) the unit will still generate time-based plain events (due to
backward compatibility issue with an older system)
In order to cancel Time-based events the Time-based Period shall be reset (zero).
Default value: Both zeros, disabled
8.3 Curve Smoothing
The idea behind this feature is to provide a good correlation between the reported
locations to the roads on a map without significant increase of communication cost.
Neither time nor distance events enable tracking as a function of road curves (note that it
is possible to utilize sudden course change detection for "curve smoothing" with
significant traffic increase), and the path on the map doesn't appear accurate enough, as
shown below.

Manual
Detecting movement vector change dramatically improves the stickiness to the road and
readability of the reports, but will also dramatically increase the traffic:
The vector change detection has to be supported by data compression in order to ensure
good stickiness to a road curve for a reasonable price.
The vector change detection occurrence may be reported as a plain/distress events with
TR204 (vector change Report), or as a bulk of up to 6 vector change detection
occurrences, compressed into a single message type 9 , sub-data D (refer to a wireless
protocol for more details).
8.3.1 Enable Vector Change Detection Events /Distress

Description: If this bit is enabled, upon generation of Start (or the first GPS Nav. Start
after Start if there is no valid GPS upon Start) the unit stores reference vector of course.
The unit stores reference GPS stamp value (time, date, latitude, longitude, speed and
course) every time it is detecting change of course's vector.
The stored reference course value is compared with the value of course received with
every new valid GPS frame. If the received value of course differs from stored one more
then the value of vector change programmable parameter (5° by default), the unit
will log vector change detection occurrence (not event in the logged memory yet but in
a volatile memory) and replaces reference course value by the new one.
Note that if compressed vector change report is enabled, the value of this parameter will
be ignored.
If compressed vector change report (next parameter) is disabled the unit will
generate a dedicated event/distress type 0 with TR204 (Vector Change Report).
Default: Both disabled

Manual
8.3.2 Prevent Curve Smoothing Message Generation during "Halt" Mode

Description: If this bit is enabled (1):
The unit will stop Curve Smoothing message generation upon "Halt" session start
(irrespectively to GO/HALT event generation enable/disable programming flag).
The Curve Smoothing message generation will restart upon "Go" session start
(irrespectively to GO/HALT event generation enable/disable programming flag).
Default: disabled (0)
8.3.3 Enable Compressed Vector Change Report

Description: If this bit is enabled, settings of bit's 0 and 1 of this byte (previous
parameter) will be ignored. In this case the compressed vector change data will be sent
by the unit in the following cases:
Upon detection of 6th vector change detection occurrence. In this case the system
will generate a Msg type 9 containing all 6 vector change detection occurrences.
Timeout. If at least one vector change event is stored in unit's memory and no other
vector changes were generated by the unit during the pre-programmed period, the
system will generate Msg type 9 containing all previous vector change detection
occurrences.
Upon Stop. Msg type 9 containing all previous vector change detection occurrences
(if any) will be generated immediately upon stop report.
Upon reset command the Msg type 9 containing all previous vector change
detection occurrences (if any) will be generated.
The Compressed Vector change Report Msg type 9 will be logged in the same message
stack as plain event type 0, will utilize the same sequence of numerator and acknowledge
rules.
The Compressed Vector change Report Msg type 9 will NEVER be generated as real-time
or distress event, only as logged event.
Upon power up/reset the unit will record reference course/coordinates upon reception of
the first valid GPS packet.
Note: When no significant course changes are detected by the unit (for example when
driving long straight roads), the unit will send periodic “Compressed Vector Change
Reports” to avoid compressed data overflow.
8.3.4 Compressed Vector Change Report Timeout
Address: 1434

Manual
Description: This parameter contains a timeout to generate Msg type 9 containing all
logged vector change detection occurrences before six occurrences were accumulated.
This parameter will take affect when:
Compress Vector change Detection is enabled,
At least one vector change detection logged
No vector change detection occurrence is logged by the unit during the period defined
in this parameter
Range and resolution: Unsigned integer 8 bits, resolution of minutes
Default: 10 minutes
8.3.5 Vector Change Detection Angle
Address: 1435
This parameter defines the minimum course change from last logged event, considered as
Vector change Detection occurrence. Possible values are 0 to 180°.
Range and resolution: 8 bits, unsigned integer, resolution of degrees
Default: 5°
8.4 Communication Idle Alerts
8.4.1 Time between Communication Idle Alerts
Address: 70-71
Name in Programmer: Time between Comm.Idle Transmissions
Description: This parameter defines the maximum time without any communication. If a
message is not received within this timeout, an idle communication alert is registered.
The Idle Transmission alerts are independent from Ignition state. They will trigger even in
a Full Hibernation mode; it is possible (configuration bit described below) to wake up the
unit from the full hibernation in order to try delivering this type of alert in real time.
This algorithm is frequently used as a "Heart Bit" of the unit, the "Keep Alive" messaging.
Data format: 16-bit unsigned integer, 1 minute resolution.
Default value: D’30 (30 minutes)
8.4.2 Event and Distress Controls for Communication Idle Alert
Address: 493, bit 0 for plain event


Manual
Description: This bit enables alerting Idling of Communication with period programmed
in Time.
Default value: Event enabled (1), distress disabled (0)
8.4.3 Do not Wake Up from Hibernation upon Comm. Idle Distress
Address: 494, bit 7

Description: If this bit is set (1), the unit will not generate a distress Communication Idle
alert in full hibernation, and therefore will not wake up from full hibernation upon
expiration of Time between Communication Idle Alerts timeout.
Default value: 0 - wake up from full hibernation to alert Comm. Idle
8.5 Driver Authentication

There are a few possible usages for the Dallas (iButton™) key in the Cellocator unit:
As driver ID for fleet management application: In this case the driver can use any
Dallas key to identify himself; the Driver to Dallas association is performed on the
server side.
As driver ID for fleet management application with pre-programmed list of "known
drivers" (30 drivers maximum): In this case only the Dallas code from the list will
release an immobilization of the vehicle and will cause successful driver identification
alert to the server.
As vehicle owner identification for car-alarm application (security units only): In this
case the driver might identify himself with pre-programmed Dallas in order to release
the security unit from Alarm Armed state, while only 30 codes can be pre-
programmed.
As a Trailer ID (can work together with Driver ID over the same 1-Wire bus).
The driver authentication in fleet management application enables monitoring working
hours of each driver and tracking driver's activity.
The driver supposes to identify himself with his unique Dallas key before (or immediately
with) switching ignition on. From this moment to the end of the journey all the location
messages generated by Cellocator unit will include code of this Dallas.
The unit will erase this code from its memory shortly after switching Ignition to off.
There are two alerts dedicated to the Driver Authentication features: New Dallas Code
Received and Driving without authentication. There is also a dedicated alert for Trailer
connection status change.
Note: The ignition event initiating the authentication processes could be selected to start
from physical ignition signal or from the filtered ignition signal based on configurable
parameter: “Ignition filter source for starting Driver Authentication time calculations”
(address 0, bit 4).
The following diagrams describe typical authentication scenarios:

Manual
Ignition
State Ignition On
Maximum Time without

Authentication
Dallas Key
Presented
Driver Authentication Event

sent
Authentication
Reminder
Scenario 1: Driver authenticated

Ignition
State Ignition On
Maximum Time without Authentication
Dallas Key
Presented
Driving without
Authentication Event sent
Authentication
Reminder
Scenario 2: Driver not Authenticated
Ignition
Ignition Off
State
Time to Authentication loss
Forget last Dallas key
Immobilizer
Activate Immobilizer
Scenario 3: Erase Dallas key after Ignition Off

Manual
8.5.1 Enable Driving Without Authentication Alert

Description: If this bit is enabled, the unit will generate an alert of “Driving without
Authentication” in case a Dallas key was not detected before an expiration of Maximum
Time without Authentication timeout.
Default value: Event enabled (1), Distress disabled (0)
8.5.2 Enable Authentication Updated Alert

Description: If this bit is enabled, the unit will generate an “Authentication updated”
alert upon new Dallas key detection (this update can be limited to pre-programmed Dallas
keys only, see the parameter below).
Default value: Event enabled (1), Distress disabled (0)
8.5.3 Maximum Time without Authentication
Address: 111
Description: This parameter stores the value of maximum allowed time between Start
Event and transmission of message with transmission reason “Driving without
authentication”, in case the Dallas key was not detected.
If any Dallas key detected during the time period defined in this parameter, the unit will
send a message with new Dallas code and transmission reason “Driver Authenticated” (it
is also possible to deliver Driver ID Updated report only in case the iButton code fit one of
the programmed values).
Value resolution: 30 seconds, span: D’0 -255’
Default value: 2 (1 minute)
8.5.4 Enable Authentication Reminder Feedback Output Activation
Address: 123, bit 4

Description: If "Enable Authentication Reminder Output Activation" bit is enabled (see
below) – the unit will activate feedback output/s from Ignition On detection (after filter
defined by the next parameter) until one of the tree conditions below will come true:
Timeout defined by that parameter will expire
Any (or pre-programmed as per configuration bit below) Dallas code will be received

Manual
Ignition will be switched off

Default value: 1 - enable
8.5.5 Ignition Filter Source for Starting Driver Authentication Time

Calculations
Address: 0, bit 4
Description: This parameter defines a start point for timeouts for:
Reminder Feedback Output Activation (Ignition On)
Time to Authentication loss (Ignition Off, next parameter)
Timeout to Driving Without Authentication Event (Ignition On)
The 2 options are:
0 - Ignition ON/OFF filter + Inputs filter)
1 - Inputs filter only
Default value: 0
8.5.6 Time to Authentication Loss
Address: 112
Description: This parameter stores a time period, during which the unit will keep a last
detected Dallas Code after the Stop Event.
After this period of time the Dallas Code will be erased from unit’s memory and in every
outgoing transmission from the unit Authentication code will be sent as 0.
If during the time period, defined in this parameter, will be detected Start event – the unit
will keep sending last detected Dallas key (until Stop event) in every outgoing message.
If Immobilizer Activation enabled (see next parameter) this timer defines how long after
Stop event the Standard Immobilizer output (pin 7) will be activated.
Resolution: 0.5 minutes/bit
Data span: 0-255 (max value 127.5 minutes)
8.5.7 Activate Immobilizer while no active Dallas
Address: 1, bit 5
Description: If this bit is enabled the unit will activate its Standard Immobilizer output
(pin 7) from Authentication loss after Stop event (see previous parameter) until the driver
authorizes itself using Dallas Key (any Dallas key or known Dallas key, as per the Enable
Pre-defined driver ID’s list configuration bit).

Manual
NOTES:
This flag is only applicable to fleet edition of Cello and will not work in a security
variant.
If this flag is set (enabled), the Standard Immobilizer output (pin 7) will be
automatically activated immediately after SW reset or Power Recycle.
In CR300 devices, the immobilizer output can be switched to one of the available
device output pins ("Blinkers", "LEDs") using the configurable option located in
address 506. The selected output will maintain the same reset behavior a described in
note 2 above.
8.5.8 Enable Conditional Activation of Immobilizer
Address 0, bit 2
Description: If this bit is enabled (1), the unit will only perform self activation of
Immobilizer output while both conditions listed below are fulfilled:
An appropriate legacy logical condition is detected (No Driver ID in the memory,
Towing detection, reminder etc)
High signal detected on the ignition input.
Immobilizer output will be switched off immediately after one of the above conditions is
not present.
If this bit is disabled (0), immobilizer output is activated independently from the status of
an Ignition input.
NOTE: This bit is only affecting self activation of the output. Activation by command
(OTA or Serial) is still unconditional and independent from the status of an Ignition input.
Only the additional OTA/serial command or detection of Authorized Dallas switches off an
output activated by command.
Default: disabled (0)
8.5.9 Enable Pre-defined Driver ID’s List
Address: 123, bit 2

Description: If this bit is set the unit will compare received Dallas with the pre-
programmed list and will act accordingly. In case of reception of unknown code the unit
WILL NOT do the following:
Unblock Immobilizer (If Immobilizer Activation enabled)
Indicate Dallas reception by Feedback beep
Deactivate “Driver ID reminder feedback” outputs (if Enable Authentication Reminder
Output Activation enabled)
Send “New Driver ID” message

Manual
Record the unknown Dallas code as latest Driver ID

If valid Dallas is not received during the timeout, programmed in “Maximum time without
authentication” – the unit will send “Driving without ID” message, as it would do if no
Dallas is received at all.
8.5.10 Enable “Dallas ID Updated” Event even if it is not in the List
Address: D’123’, bit 3

Description: If this bit is set the unit will generate a Driver Authentication Update event
(TR 0d46) upon Dallas key detection even if it is not in the pre-programmed list. The
foreign (code not in the list) Dallas code is reported in every message type 0, but the unit:
Will not Unblock Immobilizer
Will not Indicate Dallas reception by Feedback beep
Will not Deactivate “Driver ID reminder feedback” outputs
Default Value: 0 - disabled
8.5.11 iButton Codes (30 Buttons)
Address: 429 to 446 (first 3 buttons codes),

1448 to 1609 (last 27 buttons)
Description: This section of the memory contains the identification data for 30 Dallas
iButtons.
Data format: Each button is assigned with 6 ID bytes. The data of these 6 bytes is
printed on the surface of the button, where every pair of hexadecimal digits is equivalent
to one byte.
Valid values: The data must exactly match the buttons data, or they would not work.
Default Value: All zeroes
8.5.12 Enable Feedback upon Authentication

Description: If enabled, the unit will activate pulse on the output/s programmed as the
System Feedbacks when new Dallas code is detected. The pulse will be activated for a
time, defined in an Outputs Pulse Width parameter (addr. 140 dec).
Default Value: Zero (disabled)

Manual
8.5.13 Enable Resending "Driver Authentication" Alert upon each

Detection

Description: If this bit is set the "Driver Authentication Update" event (TR 0d46) will be
generated every time when a Dallas key is attached to the reader (even if it has the same
code as last attached Dallas). Removing Dallas key for 1 second at least from the holder
will cause the unit to threat the Dallas as removed and the next attachment of the same
Dallas will cause new event generation.
Default Value: 0- disabled
8.5.14 Enable Dallas Bus Mode (1-Wire) Bus

Description: If this bit is cleared the Cello unit will start acting as 1-Wire Bus master
managing multiple 1-Wire slaves. If this bit is set the Cello unit will retain its legacy
behavior communicating with single slave 1-Wire device.
Default Value: 1- Dallas in Point to point mode (Bus mode disabled)
8.5.15 Enable Infinite Driver Notifications when Driver is not Identified

Description: If this bit is set, Driver Authentication Reminder will be generated
indefinitely overriding the timeout defined in: “Timeout of Driver Authentication
Reminder”.
Default Value: 0- Legacy Driver Authentication Alert period

Manual
8.6 Extended Driver Authentication
8.6.1 Enable Differentiation between Driver and Passenger

Description: If this is enabled (0), the unit will change the standard Driver ID
management logic (every new code automatically replacing a previous one) by an
extended logic of Driver/Passenger management as described below.
Default: 1 - Disable
8.6.1.1 Driver Identification
The User ID is considered "Driver ID" if received when there is no Dallas code in the RAM
(both in Ignition on and Ignition off mode).
Driver ID is treated by the unit similarly to the legacy Dallas ID (unique 48 bit iButton
identifier), except for the following:
Different code received (new iButton attached) while there is a Driver ID in the RAM:
 In ignition on: will be treated as "Passenger ID" (see below) and will not erase the
existing Driver ID from RAM
 In ignition off : will be ignored
If received code is identical to the active Driver ID in RAM – it will be ignored
The last bit of STR (in OTA alert, message type 0) contains status of Group ID
recognition ("1" – authenticated, "0" – not authenticated)
The first bit of STR (in OTA alert, message type 0) contains "0" (indicating "Driver ID")
If “differentiation between the driver and the passenger” (1 in this bit) is not enabled in
the programming – the unit is using the Legacy Driver ID algorithms.
8.6.1.2 Passenger Identification
The passenger identification only works when ”differentiation between the driver and the
passenger” is enabled in the programming.
The User ID is considered "Passenger ID" if:
Received in Ignition On mode
Received while there is an active Driver ID code in the RAM
Reception of "Passenger ID" causes the unit to generate a "Driver Authentication Update"
event (TRd46), containing received code in Dallas bytes of Msg type 0, while the STR
Specific byte contains:
The last bit of TR Specific byte shall contains status of Group ID recognition ("1" –
recognized, "0" – not recognized), see below.
The first bit of TR Specific byte contains "1" (indicating "Passenger ID")

Manual
Received "Passenger ID" is NOT replacing active Driver ID in the RAM. Once "Driver
Authentication Update" event/distress is generated, the Passenger ID code is "forgotten".
8.6.1.3 Driver/Passenger/Group Management Flow Chart

Dallas Code
received
No Is extended
support of DS1971
enabled?
Does the number

Yes Read 256bit begins with 0xA
EEPROM and the CS No
matches?
Legacy 01h Is the family code
behaviour using Read the ID (33h) 1
01h or 14h? 14h
the ID (33h)
Split into ID and Yes
group ID
Set Group ID to
9999
Set ID to the 6
bytes iButton ID
(33h)
Yes Does Group ID
fit?
Set Group ID
Authorized bit No
Reset Group ID
Authorized bit
Disarm Immobilizer
No Yes Is there Dallas No

Ignore Is Ignition On? Set Driver ID bit
code in RAM
Yes
Use ID as Driver
Set “passenger” ID ID (record as
bit active code in
Yes Is the received No RAM)
code identical to
the one in RAM Transmit new code
once & forget (Do not Consider
record as active code Feedback,
in RAM) Immobilizer, Event
generation and
Reminder
Consider Feedback
features,
activation
implemented in
the standard
Restore” Driver ID” codebase
bit
End

Manual
8.7 Trailer Connection Monitoring
The purpose of this feature is to enable detection and reporting of connection and
disconnection of a trailer to the track.
The trailer is equipped by identification device, connected to a 1-Wire bus port of
Cellocator unit. Once the trailer is connected, its identification device is continually
transmitting its Dallas ID.
The family of Dallas device used by the trailer is programmed in configuration. If such a
device is attached longer than the configurable timeout, the unit is assuming connection
of the trailer and vice versa (if disconnected longer than the configurable timeout, the unit
is assuming disconnection).
Limitations:
Only one trailer can be used at a time.
If two or more devices from the trailer’s Dallas family are concurrently and continually
attached to the bus, reliable trailer detection is not guaranteed.
If second device from the trailer’s Dallas family is attached while trailer is already
detected, this second device will be immediately considered as Driver/Passenger.
Upon trailer connection (expiration of a “Timeout for Trailer Connection status change“)
the unit will raise Bit 1 of Byte 41 in every outbound OTA msg type 0 to indicate that the
Trailer is connected.
Upon trailer disconnection the unit shall reset Bit 1 of Byte 41 in every outbound OTA msg
type 0 to indicate that the Trailer is disconnected.
It is possible to query trailer ID by OTA command (Command Code 0x16).
NOTES:
Trailer ID is never reported in other message types except message with TR199 and
31 (Reply to command, if Trailer ID was requested).
This feature requires the Dallas bus to be enabled Enable Dallas Bus (singleWire)
8.7.1 Dallas Family of Trailer Identifier
Address: 2393
Description: The following parameter contains Dallas family ID of the Trailer identifier.
If the device with selected family ID will be attached to the bus longer than programmed
in the “Timeout for Trailer Connection status change“ parameter - it will be considered as
Trailer.
If the device with selected family ID will be attached to the bus for less than programmed
in “Timeout for Trailer Connection status change“ parameter - it will be considered as
Driver/Passenger, while the corresponding reaction (event/feedback) will be issued upon
disconnection from the iButton.
Zero value in this parameter disables Trailer connection detection.

Manual
NOTE: This feature requires the Dallas bus to be enabled Enable Dallas Bus Mode
(singleWire)
Default value: 01h (iButton DS1990A)
8.7.2 Enable Trailer Connection Event

Description: If this bit is set (1) the unit will issue a dedicated event when the Dallas ID
of the Trailer’s family is continually connected (or disconnected) for longer that
programmed in the “Timeout for Trailer Connection status event” parameter.
The event will contain transmission reason 199 (Trailer connection status change), and
specific transmission reason (STR) 0 for trailer disconnected, 1 for trailer connected.
In both cases:
Bits 4-5 of byte 10 (OTA Msg type 0) contain value of 0b11 (Trailer ID)
Bytes 33-38 of OTA Msg type 0 with TR199 contain the ID of Trailer Identification
device.
8.7.3 Trailer Connection Distress

Description: If this bit is set (1) the unit will issue a dedicated distress when the Dallas
ID of the Trailer’s family is continually connected (or disconnected) for longer that
programmed in the “Timeout for Trailer Connection status event” parameter.
The distress will contain transmission reason 199 (Trailer connection status change), and
specific transmission reason (STR) 0 for trailer disconnected, 1 for trailer connected.
In both cases:
Bits 4-5 of byte 10 (OTA Msg type 0) contain value of 0b11 (Trailer ID)
Bytes 33-38 of OTA Msg type 0 with TR199 contain the ID of Trailer Identification
device.
8.7.4 Timeout for Trailer Connection Status Change
Address: 2392
Description: This parameter stores time period (in seconds) of continuous connection
(or disconnection) of the Dallas button (of family programmed in “Dallas Family of Trailer
Identifier“ parameter), used for triggering corresponding event or distress.
Default value: 15

Manual
8.7.5 Trailer Connected: Over Speed Start Velocity threshold
Address: 261
Description: The unit can apply different velocity thresholds for Over Speed session start and end when trailer is connected.
This parameter stores velocity threshold (in 32 cm/sec/bit) used for Over Speeding session start when trailer is connected.
If over speed session started by violating “Trailer connected” over speeding start threshold, it will be ended by reaching “Trailer
connected” over speeding end velocity threshold, even if the trailer disconnected between those two events.
NOTE: If both the “Trailer mode” and “Input dependent Over Speed” modes are active
Resolution: 32 cm/sec/bit
Default value: 0 cm/sec
8.7.6 Trailer Connected: Over Speed End Velocity Threshold
Address: 262
Description: The unit can apply different velocity thresholds for Over Speed session start and end when trailer is connected.
This parameter stores velocity threshold (in 32 cm/sec/bit) used for Over Speeding session end when trailer is disconnected.
If over speed session started by violating “Trailer connected” over speeding start threshold, it will be ended by reaching “Trailer
connected” over speeding end velocity threshold, even if the trailer disconnected between those two events.
NOTE: If both the “Trailer mode” and “Input dependent Over Speed” modes are active
Resolution: 32 cm/sec/bit
Default value: 0 cm/sec
8.8 Controlling of Work Time on Static Objects

Description: The purpose of this feature is to enable usage of existing equipment and software for controlling of employees
work time on static objects.
If this bit is set (1):
1. The unit will ignore all Driver ID logic (except feedback), irrespective of other configuration bits and programmed Dallas
codes.
2. Upon reception of any Dallas code of any group the unit will:
a. activate feedback if enabled
b. Irrespectively to the operational mode and Ignition status of the unit, generate pair of events containing received
Dallas code: Start event and Stop event (one after another, with no delay between them).
c. Bit’s 4-5 of byte 10 will contain value of 0b00 (Driver ID)
d. Bytes 33-38 of message will contain a received code.
e. Immediately after generation of pair of events the received Dallas will be erased from unit's memory.

Manual
8.9 Driver Behaviour
8.9.1 Coasting
8.9.1.1 Coasting Detection (Speed and RPM)
The unit detects start and stop of coasting: vehicle driving down a hill with not engaged
gear.
Every combination of speed and RPM may be configured as a trigger for coasting alert
(Transmission Reason – 21, Specific Transmission - 1 for Coasting start / 0 – for Coasting
stop).
The unit will generate an alert (“speed & RPM” start and stop”) when:
the RPM is below programmed threshold (or above programmed threshold);
AND
the speed is above programmed threshold (or below programmed threshold);
AND
the state lasts more than programmed time period.
8.9.1.2 Enable Coasting Event /Distress
Address: 1350, bit 3 for event, bit 4 for distress
Description: If this bit is set, and at least one of two multipurpose inputs (door/shock) is
defined as General Purpose Frequency Meter (Assigned function 1), upon detection of
Coasting the unit will generate an alert (event or/and distress, depends on the selected
bits) with Transmission Reason – 21, Specific Transmission - 1 for Coasting start / 0 – for
Coasting stop).
The unit will detect Coasting only if both Speed and Engine speed simultaneously violate
appropriate thresholds for longer than programmed in violation time filter.
NOTES:
Coasting detection.
Measurement of frequency by dedicated input consumes at least 1 second.
Except OTA alert Coasting detection can trigger output activation as a notification to
the driver. Refer to the description of the programming parameters below.
Default Values: 0 - disabled

Manual
8.9.1.3 Speed Threshold Type
Description: If this bit is set, the speed threshold programmed on address 2387 will be
treated as a maximum threshold (values of speed higher then this threshold will be
considered violating).
If this bit is zero, the speed threshold programmed on address 2387 will be treated as a
minimum threshold (values of speed lower then this threshold will be considered
violating).
Default Values: 0 - minimum threshold
8.9.1.4 Engine Speed Threshold Type
Description: If this bit is set, the engine speed threshold programmed on addresses
2388-2389 will be treated as a maximum threshold (values of engine speed higher then
this threshold will be considered violating).
If this bit is zero, the engine speed threshold programmed on address 2388-2389 will be
treated as a minimum threshold (values of engine speed lower then this threshold will be
considered violating).
Default Values: 0 - minimum threshold
8.9.1.5 Speed Threshold for Coasting
Address: 2387
Description: This parameter contains value of speed, used by Coasting detection feature
as a maximum or minimum speed threshold (as per a configuration bit on address 1350,
bit 1).
Resolution: km/h
Default value: 20
8.9.1.6 Engine Speed Threshold for Coasting
Address: 2388-2389
Description: This parameter contains value of engine speed, used by Coasting detection
feature as a maximum or minimum engine speed threshold (as per a configuration bit on
address 1350, bit 2).
NOTES:
Coasting detection.

Manual
Resolution: RPM
Default value: 900
8.9.1.7 Coasting Violation Period
Address: 2386
Description: This parameter contains an initial value of timer, used as a violation filter of
Coasting detection feature.
The unit will detect Coasting only if both Speed and Engine speed simultaneously violate
appropriate thresholds for longer than programmed in this parameter.
Resolution: seconds
Default value: 10
8.9.2 Behavior Violation Indications to Driver

The unit is supporting up to two feedback signals (visual and audible) for the following
driver behavior violations:
Over Speed
Coasting
Harsh Breaking
Harsh Acceleration
Sudden course change.
Idle speed
Excessive RPM
All above listed violations are spitted into 2 groups of continuous violations and
momentary violations.
Each group of violations can be escorted by template of indication to driver on two
assigned outputs as per configuration.
For continuous violations (over-speed, coasting and idle-speed) the activation only occurs
upon session start.
Violation to Idle-speed is an exception: in spite of being continuous violation, Idle-speed
is assigned by indication of momentary violation template.
Any combination of up to 2 outputs assigned for driver behavior is legal.
When single output is used as a feedback for two events, and those 2 events are
simultaneously pending, a predefined hard coded pattern will be activated till
simultaneous condition ends.
In case more than one feedback is activated simultaneously on the same output a special hard coded pattern will dominate the
output till there are no more simultaneous events.

Manual
Feedback
1
Feedback
2
Output
Special pattern reflecting
Simultaneous feedbacks
The special hardcoded feedback will be 250mSec On and 250mSec Off.
Interaction with other Output Activation mechanisms

The priority of the output activation upon over-speeding violation is the same as a priority
of feedback, i.e. – the lowest.
Any other output activation (manual activation, jamming, etc) has stronger priority and
will take control over the selected output when needed.
8.9.2.1 Feedback for Driver Behavior Violations Bitmask
Address: 2376
Bit 6 – Excessive RPM (According to Continuous violation template)
Bit 5 – Idle Speed (According to Momentary violation template)
Bit 4 - Sudden course change (According to Momentary violation template)
Bit 3 - Harsh Acceleration (According to Momentary violation template)
Bit 2 - Harsh Breaking (According to Momentary violation template)
Bit 1 – Coasting (According to Continuous violation template)
Bit 0 - Over Speed (irrespectively to the source of threshold, according to Continuous violation template). This bit
must be also enabled for “Speed Limiting GeoFence” feature.
The unit will trigger feedback upon detection of an appropriate driver behavior violation if
this violation is enabled (1) in this bitmask.
The feedback will be triggered upon violation of the logical conditions, irrespectively to the
generation (or not generation) of event/distress for the corresponding violation.
Default: 0xFF
8.9.2.2 Output, Auto-activated upon Momentary Driver Behavior Violation Detection
Addresses: 523, bits 0-2
524, bits 0-2

Description: This field contains the number of the output used by this notification routine.
Output’s name Output’s number
Feature Disabled 0
Siren 1
Gradual Stop 2

Manual
St. Immobilizer 3
LED 4
Blinkers 5
CFE Out 1 6
CFE Out 2 7
Default: (0) Notification disabled
8.9.2.3 Duration of Output Activation, upon Momentary Driver Behavior Violation Detection
524, bits 3-5

Description: This field contains the duration of the output activation upon momentary
driver behavior violation detection.
Zero - forbidden.
Resolution: 0.5 seconds/bit
Default: (1) 0.5 seconds
8.9.2.4 Number of Output Activation Repetitions upon Momentary Driver Behavior Violation
Detection
524, bits 6-7

Description: This field contains the number of the output activation repetitions (Duty
cycle 50%) upon momentary driver behavior violation detection.
Zero - forbidden.
Default: (1) Continuous repetition
8.9.2.5 Output, Auto-activated upon Continuous Driver Behavior Violation Detection
Description: This pair of parameters defines a numbers of outputs that will be activated
upon driver behavior violation.
Feature Disabled 0
Siren 1
Gradual Stop 2
St. Immobilizer 3

Manual
LED 4
Blinkers 5
CFE Out 1 6
CFE Out 2 7
Value span: 1to 5

Default value: zero
8.9.2.6 Output Activation Pattern (upon Continuous Driver Behavior Violation)
Description: This pair of parameters defines a activation pattern of outputs upon

detection of Driver behavior violation.
Setting Action
"Pulse Outputs Width Period", addr. 140 dec
1-3 Reserved
4 Template Activation (according to the settings described below)
5 Warning of delayed violation registration

(template activation - according to the settings described below)
NOTE: If user configures at first feedback according to “Warning of
delayed violation registration” pattern and at second feedback according
to "Template Activation” pattern the unit will function according to
“Warning of delayed violation registration” pattern.
6-7 Reserved
Default: (0) Pulse Activation
Template of continuous Output Activation upon detection of driver behavior

violation

Manual
Example of template: Two activations in a session, 1 second for each activation, 2

sessions, 3 seconds between sessions:
Warning of delayed violation registration

This option is only applicable for continuous driver behavior violations: coasting, Over-
speed and Excessive RPM.
If this option is selected, upon driver behavior violation detections the unit does the
following:
It does NOT generate an event immediately.
It activates selected output (after expiration of OverSpeed or Coasting filter)
according to a template definition on addresses 2377-2379 (for the first output) and
2380-2382 (for the second output).
The output shall be deactivated when one (of two) conditions come true:
The end of violation
OR
The violation lasts longer than the time defined in Driver behavior- continuous
violation feedback Logic: Feedback Violation Deactivation time threshold .
NOTE: The event shall only be generated if the violation lasts longer than 10 seconds.
The warnings will be triggered only after the programmable filters of coasting and over-
speeding
Outputs will be deactivated immediately when the condition will become not true or after
10 seconds (without the programmable filter).
8.9.2.7 Continuous Driver Behavior Violation - Output Activation Template Activation Length
Description: This pair of parameters defines a length of activation of the selected output
upon Driver behavior violation detection.
0 for the time, defined in "Pulse Outputs Width Period", addr. 140 dec.

Manual
Note that the duty cycle of activation is 50%, i.e. activation time is the same as off time.

Default value: 1(0.5 seconds)
8.9.2.8 Continuous Driver Behavior Violation - Output Activation Template: Number of

Activations in a Session
Description: This pair of parameters defines a number of activations of the selected

output upon Driver behavior violation detection.
0 – cancels outputs activation upon driver behavior violation detection.
Default value: 3
8.9.2.9 Continuous Driver Behavior Violation - Output Activation Template: Number of

Activation Sessions
Description: This pair of parameters defines a number of sessions of output activations

upon Driver behavior violation detection.
0 – cancels outputs activation upon driver behavior violation detection.
Default value: 1
8.9.2.10 Continuous Driver Behavior Violation - Output Activation Template: Time between
the Activation Sessions
Description: This pair of parameters defines a time between activation sessions of

output activations upon Driver behavior violation detection.
Zero value. If zero is programmed the unit will only perform one session of activation
irrespectively to the programmed number of sessions.
Default value: 2 (1 second)

Manual
8.9.3 Additional Thresholds for GP Frequency Meter

One is used as an activity start/stop detector (for example engine start/stop), the second
is used for a kick down detection.
Each threshold is equipped by independent time filter and transmission reason; the unit
generates a trigger upon violation of the thresholds in both directions: up and down.
8.9.3.1 Additional GP Frequency thresholds
Address: 1st threshold - 2372-2373

2nd threshold - 2374-2375
Default: 5000
Description: These parameters contain value of threshold for frequency measurement on

GP Frequency meter input.
The threshold is applied after scaling measurement result (in case of Engine speed
measurement the threshold will be programmed in RPM and not in Hz)
NOTE: If both multi-purpose inputs (Door and Shock) programmed as GP Frequency
meters, the thresholds are applied to shock input.
Resolution: scaled frequency.
Default: 1st threshold - 100
2nd threshold - 5000
8.9.3.2 Violation Timers of Additional GP Frequency Thresholds
Address: Timer of 1st threshold - 2370

Timer of 2nd threshold - 2371
Description: These parameters contain time, during which the measured frequency upon
change shall stay higher (or lower) than the corresponding threshold in order to generate
an appropriate alert (TR 210 for 1st threshold, 211 for 2nd threshold. STR 1 for “Raising”, 0
for “falling”).
Resolution: – seconds.
Default: 1st threshold – 10 seconds
2nd threshold – 5 seconds
8.9.3.3 Alert Bitmask: Violation of Additional GP Frequency Thresholds
Address: 1351
Type of alert 1st additional GP frequency 2nd additional GP frequency

threshold threshold
Raising Event Bit 0 Bit 4
Distress Bit 1 Bit 5
Falling Event Bit 2 Bit 6
Distress Bit 3 Bit 7

Manual
Description: This parameter contains a bitmask, allowing to mask an alerts generated as

a response to violation of additional GP Frequency threshold. ‘1’ enables a corresponding
alert and ‘0’ disables it (TR 210 for 1st threshold, 211 for 2nd threshold. STR byte will
contain 1 for “Raising”, 0 for “falling”).
Default: all zeroes (disabled)

Manual
9 Inputs Events
The Cellocator unit provides 6 inputs; the hardware of all those inputs varies from pulled
up, pulled down, wet (not equipped by pull up/down resistor) or adapted for frequency
measurement. Each input is equipped by a packet of legacy functions:
Trigger on the input cause generation of an event with an appropriate transmission
reason
Two inputs allow analog signal measurement
Same two inputs allow frequency measurement
Some affect unit's logic (like Ignition and door)
Each input (except ignition) is equipped by a configuration field, enabling to set up its
type and other attributes, like threshold, differentiating between logical 0 and logical 1.
Input Entry Type
Door Analog / discrete "wet" and "dry" contact, Frequency Counter
Shock Analog / discrete"wet" and "dry" contact, Frequency counter
Panic Discrete only, "dry" contact
Unlock Discrete only, "dry" contact
Lock Discrete only, "dry" contact
When configured as discrete input ("dry" or "wet") the table below defines the range of
voltage threshold for logical zero detection.
Wet (no internal pulling resistor) Dry (Internally pulled up)
Min allowed Defaults Max Min allowed Defaults Max

allowed allowed
Value in Volts (Programmed Value)
Shock 0V (0) 14.7V 30V (255) 0.2v (57) 1V (125) 1.45v (160)
(125)
Door 0V (0) 14.7V 30V (255) 0.2v (57) 1V (125) 1.45v (160)
(125)
Lock2 0.2v (57) 1.85V 2.36v (240)

(200)
N/A
Unlock 0.2v (57) 1.85V 2.36v (240)
(200)
2
The provided values are valid for Cello hardware A04 and above. If you own older hardware please contact our technical support for further information
concerning the highest possible zero detection value.

Manual
Wet (no internal pulling resistor) Dry (Internally pulled up)
Panic 0.2v (57) 1.85V 2.36v (240)

(200)
The table below provides threshold translation from the programmed value into voltage
on interface pin (Measurement error ±20mv).
Threshold Corresponding Threshold Corresponding

Value at PL voltage on Value at PL voltage on
file Door and file Lock/Unlock/Distress
Shock inputs
0-56 1.00v (in range 0-56 1.85v (in range value

value protection)
protection)
57 0.20v 57 0.20v
80 0.47v 80 0.47v
100 0.71v 100 0.69v
125 1.00v 125 1.00v
140 1.19v 140 1.15v
160 1.45v 160 1.39v
161-255 1.00v (in range 200 1.87v

value
protection)
204 1.91v
232 2.26v
240 2.37v
244-255 1.85v (in range value

protection)
9.1 4 – Ignition (Not Supported by CelloTrack)

Ignition input can be used for detection of journey's Start and Stop, which are key events
in unit's logic and require an especial treatment, or as a general purpose input (when
journey Start/Stop is detected using an accelerometer).
Journey's Start and Stop:
The system will enter hibernation mode between Journey's Stop and Journey's Start, and
will start generating periodical events between Journey's Start and Journey's Stop
Manual
In case it is used for detection of journey's Start and Stop, except "Common Discrete
Inputs Time Filter" applied to every input, the Start/Stop Alert Generation Time Filters are
applied as well.
A general purpose input:
If ignition input is used as a general purpose it is a internally pulled down and can
recognize the following signals:
Low (logical zero) 0V<Vin<3.5V
High: Vin>9V
Voltages between 3.5V to 9V are undefined.
9.1.1 Reporting Journey Start


488, bit 5 for HRLS
Description: if this bit is set the unit will generate a corresponding alert upon Journey
Start detection (by ignition or by accelerometer).
Default Value: Event enabled (1), Distress and HRLS – disabled (0(
9.1.2 Reporting Journey Stop


486, bit 5 for HRLS
Description: if this bit is set the unit will generate a corresponding alert upon Journey
Stop detection (by ignition or by accelerometer).
Default Value: Event enabled (1), Distress and HRLS – disabled (0(
9.1.3 Inverting Journey Start/Stop

Address: 100, bit 5
Description:
Once inverted:
The system will report “Journey Start” when low level (by ignition or by accelerometer) is
recognized and vise versa.
Default Value: (0) not inverted

Manual
9.1.4 Reporting Signal Falling on Ignition


487, bit 6 for HRLS
Description: if this bit is set the unit will generate a corresponding alert upon detection
of logical level falling from 1 to 0. In case this input is inverted, it will mean generation of
the alert upon disconnection of this input from (-).
NOTES:
This event is generated only when ignition input is set as GP.
This feature will not work when CFE configuration is used.
Default Value: zeros – disabled (0(
9.1.5 Reporting Signal Rising on Ignition


489, bit 6 for HRLS
Description: if this bit is set the unit will generate a corresponding alert upon detection
of logical level rising from 0 to 1. In case this input is inverted, it will mean generation of
the alert upon connection of this input to (-).
NOTES:
This event is generated only when ignition input is set as GP.
This feature will not work when CFE configuration is used.
Default Value: zero – disabled (0(
9.1.6 Inverting Ignition Input

Address: 101, bit 6
Description: Ignition input is internally pulled down and therefore does not require an
inversion in most of the cases.
In case it is serving as a GP and logical levels are opposite to physical levels – the input
shall be inverted.
Default Value: (0) not inverted
9.2 5 – Lock
This input is equipped by an internal pull up resistor and therefore can only serve as
discrete dry contact.

Manual
9.2.1 Function Assigned to Lock Input

Description: This field enables assignation of certain functionality to a Lock input.
Function Description
number
0 Use as a GP input (default)
1-8 Reserved
9 Volume Up (refer to Volume Control section in this document)
10 Volume Down (refer to Volume Control section in this document)
11 Reserved
12 Over-speed threshold control

If this function is selected, the unit will automatically use speed threshold
programmed on address 2391 as both Over-speed start and Over-speed end
thresholds while this input is triggered.
13-31 Reserved
Default Value: zero – GP input
9.2.2 Inverting Lock Input
Address: 101, bit 2

Description: Lock input is pulled up (internally); therefore it does require an inversion
when it is required to detect activation by low level (-).
Once inverted: the "low" level of signal (below threshold programmed in parameter
below) on this input will be treated as logical "1" (active). The "high" level of signal, as
well as floating state, on this input will be treated as logical "0" (not active).
Default Value: (1) inverted
9.2.3 Threshold for Lock Input
Address: 1704
Description: This threshold defines the highest voltage on this input, which will still be
considered as logical zero. Any voltage above the value programmed in this parameter
(as well as open contact) will be considered as logical "one".

Manual
The unit is continually sampling voltage on this input and comparing the average
measurement (refer to parameter below) with the threshold programmed in this
parameter.
Value span: 57 (0.2V) to 240 (2.36V). Any measured value below 57 or above 240
causes the unit to convert this value to default (200).
Default Value: 200 (1.85V)
9.2.4 Averaging Factor for Lock Input
Address: 1705
Description: The unit is continually sampling voltage on this input every 10 msec. The
moving average of sample's number (preprogrammed in this parameter) is compared with
the threshold (previous parameter) in order to decide concerning the logical level of the
input.
NOTE: In the operational modes listed below the unit is ignoring averaging factor and
processing each measurement sample separately:
In Full Hibernation mode, including the Modem / GPS On Time
In Signal Correlation Mode (applicable in security builds only)
Default Value: 10 samples
9.2.5 Reporting Signal Falling on Lock

487, bit 2 for HRLS
Description: If this bit is set the unit will generate a corresponding alert upon detection
9.2.6 Reporting Signal Rising on Lock

489, bit 2 for HRLS

Manual
9.3 11- Unlock

9.3.1 Function Assigned to Unlock Input

Name in Programmer: Assigned Function
Description: This field enables assignation of certain functionality to a Unlock input.
Function Description Comment

number
1-8 Reserved
11 Reserved

13-31 Reserved
9.3.2 Inverting Unlock Input
Address: 100, bit 7

Description: Unlock input is pulled up (internally); therefore it does require an inversion
above) on this input will be treated as logical "1" (active). The "high" level of signal, as
well as "not connected" state, on this input will be treated as logical "0" (not active).

Manual
9.3.3 Threshold for Unlock Input
Address: 1707
parameter.
Value span: 57 (0.2V) to 240 (2.36V). Any measured value below 57 or above 240
causes the unit to convert this value to default (200).
9.3.4 Averaging Factor for Unlock Input
Address: 1708
input.
In Full Hibernation mode, including the Modem/GPS On Time
9.3.5 Reporting Signal Falling on Unlock

486, bit 7 for HRLS

Manual
9.3.6 Reporting Signal Rising on Unlock

488, bit 7 for HRLS
9.4 14 – Door
9.4.1 Door Input Type

Description: This input is equipped by pair of internal resistors, which can be
programmatically turned into pull up, pull down or canceled at all. Therefore the input can
serve as digital or analog input of the types described below as well as a frequency
counter
Input Type Description

number
0
Discrete Dry Contact (on board pull-up)
1
Discrete Normal (Wet Input)
2
Analog Backward Compatible (0-2.5V)
3
Analog New Range (0 – 30V)
4
Frequency meter
5
Pulse Counter : Enables Pulse Counting mechanism
6-7
Reserved
Default Value: zero -Discrete Dry Contact
9.4.2 Function Assigned to Door input

Description: This field enables assignation of certain functionality to a Door input.

Manual

number
1 Use as a GP frequency meter (refer to frequency Only compatible to Type

metering section in this document) 4 (Frequency meter)
2 Use as a Speed source (refer to frequency metering

section in this document)
3-8 Reserved
11 Reserved

13-31 Reserved
9.4.3 Scaling Factor for Frequency Report on Door Input
Address: 1675-1676
Name in Programmer: Scaling Factor Frequency
Description: Applicable only if door is selected as input type 4. The scaling factor is
intended to be used for conversion of the measured frequency into common unit of speed
(cm/sec) in case the measurement is utilized as a speed source or into any other
common format, if the input is used as a GP pulse frequency counter.
NOTE: This value may be calculated and programmed by the unit automatically during
the Auto-Calibration Process. (Refer to the Frequency Metering Section in this document)
Stored value of Scaling Factor (Sf * 1000)
First Configuration Byte (MSB) Second configuration byte (LSB)
In case of Speed Source (Input's type 4, Assigned function 2):

The value utilized as a speed [cm/sec] will be calculated as follows:

Manual
S – Momentary value of speed [cm/sec]

Fs – Measured frequency
Sf – scaling factor
(The scaling factor is stored as follows: Sf=stored value/1000).
NOTE: In this case the scaling factor is given by the specific vehicle and actually
translating number of pulses into a speed (in cm/sec).
Example:
When calibrating a vehicle at 40 Km/h (1111cm/sec), the index obtained is 54 (that is, 54
pulses per second). When the measured value is 108 pulses, it means that the vehicle is
running at 80 Km/h (2222cm/sec).
In this case the scaling factor will be Sf=1111 /54=20.576.
Maximum value of a scaling factor of speed is Sf=65.535.
The stored value of Sf will be 65535.
In case of GP pulse frequency counter (Input's type 4, Assigned function 1):

The scaled value of the measurement will be reported in every position update from the
unit in one of the Analog Inputs monitoring bytes, as per the configuration described
above in this document.
The scaling factor, similarly to the previous case, is stored as follows:
Sf=stored value/1000
NOTE: Unlike the previous case the scaling factor here is a variable, adapted by the user
to report the measured frequency value with best possible resolution in one byte.
Example:
Assuming the GP Pulse Frequency input is used to measure the engine speed (in RPM);
When calibrating a vehicle at 2000 RPM, the measured value is 116 (that is, 116 pulses
per second). When the system receives 232 pulses it means that the vehicle is running at
4000 RPM.
If maximum available engine speed is 8kRPM, let's set a resolution of 32RPM/Bit
(8000/255) in order to be able to report the measured value in single byte.
In our example we measure 2000/116=17.24 RPM/bit. Using simple proportion lets
calculate the scaling factor:
Sf=17.24/32=0.53875
(stored value will be 0539)
The value reported in OTA message type 0 will be therefore:
Es – reported value of engine speed [32RPM/Bit]

Sf– scaling factor

Manual
9.4.4 Thresholds on Door as a General Purpose Frequency Counter
Address: 1678-1681
Description: This parameter defines minimum, maximum or range (as per the
configuration byte) thresholds for frequency measurement on Door GP Frequency
measurement input. Upon violation of this threshold for longer than the pre-programmed
period, the unit will generate an appropriate OTA msg type 0, with dedicated transmission
reason (192 dec).
NOTE: The threshold is applied on the result after scaling and not on the measured value
(Es [RPM] in case of Engine Speed measurement).
Each of the thresholds consumes 2 bytes: 1678-1679 for low threshold, 1680-1681 for
high threshold. The threshold is applied on General Purpose Pulse measurement input
only.
9.4.5 Time Filter for Frequency/Analog Door Input
Address: 1682
Description: (not applicable for discrete or wet types of input)
This parameter defines the violation time before generating a corresponding alert in
100mseconds resolution
Default value: Default value 50 (5 seconds)
9.4.6 Door Freq. Input Violation Type

Description: This parameter defines violation type as follows:
0 – Threshold 0 – Low Threshold

1 – High Threshold
1 – Range 0 – Keep In Range

1 - Keep Out range
Bit 1 Bit 0
Bit 1 defines type of the violation: threshold or range. If threshold type is selected, bits 0
define if the low or high thresholds are processed.
If range type is selected - bit 0 defines if the violating value is inside or outside the range.

Manual
9.4.7 Threshold for Door Input
Address: 1678
Description: Applicable only for discreet types (wet and dry)
This threshold defines the highest voltage on this input, which will still be considered as
logical zero. Any voltage above the value programmed in this parameter (as well as open
contact in case of dry) will be considered as logical "one".
NOTE: The type of input affects the voltage value; the same value will mean different
voltage for wet and discrete types.
parameter.
Value span for wet type: 0 (0V) to 255 (30V)
Value span for discrete type: 57 (0.2V) to 160 (1.45V). Any measured value below 57
or above 160 causes the unit to convert this value to default (125).
Default Value: 125 (1V)

Manual
9.4.8 Averaging Factor for Door Input
Address: 1686
moving average of sample's number (preprogrammed in this parameter) is reported to
the application and/or compared with the threshold (previous parameter) in order to
decide concerning the logical level of the input.
NOTE: In Full Hibernation mode the unit is ignoring averaging factor and processing each
measurement sample separately
9.4.9 Inverting Door Input
Address: 100, bit 0

Description: Inversion is only applicable when the input type is configured as one of the
discrete types.
When set as dry signal, the input is pulled up (internally); therefore it does require an
inversion when it is required to detect activation by low level (-).
When set as wet signal type - no inversion is required.
9.4.10 Reporting Signal Falling On Door

486, bit 0 for HRLS
Description: Only applicable when the input type is configured as one of the discrete
types.
If this bit is set the unit will generate a corresponding alert upon detection of logical level
falling from 1 to 0. In case this input is inverted, it will mean generation of the alert upon
disconnection of this input from (-).

Manual
9.4.11 Reporting Signal Rising on Door

488, bit 0 for HRLS
types.
rising from 0 to 1. In case this input is inverted, it will mean generation of the alert upon
connection of this input to (-).
Default Value: zeroes – disabled (0(
9.5 15 – Shock
9.5.1 Shock Input Type

counter.
Input Description
Type
number
0 Discrete Dry Contact (on board pull-up)
1 Discrete Normal (Wet Input)
2 Analog Backward Compatible (0-2.5V)
3 Analog New Range (0 – 30V)
4 Frequency Meter
5 Pulse Counter : Enables Pulse Counting mechanism
6-7 Reserved
Default Value: zero - Discrete Dry Contact

Manual
9.5.2 Function Assigned to Shock Input

Description: This field enables assignation of certain functionality to a Door input.

number


3-8 Reserved
11 Reserved

13-31 Reserved
9.5.3 Scaling Factor for Frequency Report on Shock Input
Address: 1688-1689
Description: Applicable only if shock input is selected as input type 4. The scaling factor
is intended to be used for conversion of the measured frequency into common unit of
speed (cm/sec) in case the measurement is utilized as a speed source or into any other

Manual
the Auto-Calibration Process. (Refer to frequency metering section in this document)

Example:
In this case the scaling factor will be Sf=1111 /54=20.576
Maximum value of an scaling factor of speed is Sf=65.535
The stored value of Sf will be 65535
The scaled value of the measurement will be reported in every position update from
the unit in one of the Analog Inputs monitoring bytes, as per the configuration
described above in this document.
Example:
4000 RPM.
Sf=17.24/32=0.53875

Manual

9.5.4 Threshold on Shock as a General Purpose Frequency Counter
Address: 1691-1694
Description: This parameter defines minimum, maximum or range (as per the
configuration byte) thresholds for frequency measurement on Shock GP Frequency
measurement input. Upon violation of this threshold for longer than the pre-programmed
period, the unit will generate an appropriate OTA msg type 0, with dedicated transmission
reason (192 dec).
NOTE: The threshold is applied on the result after scaling and not on the measured value
(Es [RPM] in case of Engine Speed measurement).
Each of the thresholds consumes 2 bytes: 1691-1692 for low threshold, 1693-1694 for
high threshold.
The threshold is applied on General Purpose Pulse measurement input only.
9.5.5 Time Filter for Violation of Frequency / Analog Shock Input
Address: 1695
Description: Applicable only for GP Frequency input or analog input types.
This parameter defines the violation time before generating a corresponding alert in
100mseconds resolution
Default value: Default value 50 (5 seconds)
9.5.6 Shock Freq. Input Violation Type

Description: This parameter defines violation type as follows:
0 – Threshold 0 – Low Threshold

1 – High Threshold
1 – Range 0 – Keep In Range

1 - Keep Out range
Bit 3 Bit 2

Manual
Bit 3 defines type of the violation: threshold or range. If threshold type is selected, bits 2
define if the low or high thresholds are processed.
If range type is selected - bit 2 define if the violating value is inside or outside the range.
9.5.7 Threshold for Shock Input
Address: 1691
parameter.
Value span for wet type: 0 (0V) to 255 (30V).

Manual
9.5.8 Averaging Factor for Shock Input
Address: 1699
measurement sample separately.
9.5.9 Inverting Shock Input
Address: 100, bit 1

Description: Inversion is only applicable when the input type is configured as one of the
discrete types.
When set as dry signal, the input is pulled up (internally); therefore it does require an
inversion when it is required to detect activation by low level (-).
When set as wet signal type - no inversion is required.
9.5.10 Reporting Signal Falling on Shock Input

486, bit 1 for HRLS
Description: only applicable when the input type is configured as one of the discrete
types.
falling from 1 to 0. In case this input is inverted, it will mean generation of the alert upon
disconnection of this input from (-).

Manual
9.5.11 Reporting Signal Rising on Shock Input

488, bit 1 for HRLS
types.
rising from 0 to 1. In case this input is inverted, it will mean generation of the alert upon
connection of this input to (-).
Default Value: zeroes – disabled (0(
9.6 16 – Panic
9.6.1 Function Assigned to Panic Input

Name in Programmer: Assigned Function
Description: This field enables assignation of certain functionality to a Panic input.

number
1-8 Reserved
11 Reserved

13-31 Reserved

Manual
9.6.2 Inverting Panic Input
Address: 100, bit 6

Description: Panic input is pulled up (internally); therefore it does require an inversion
9.6.3 Threshold for Panic Input
Address: 1701
parameter.
Value span: 57 (0.6V) to 240 (2.7V). Any measured value below 57 or above 240 causes
the unit to convert this value to default (200).
Default Value: 200
9.6.4 Averaging Factor for Panic Input
Address: 1702
input.
In Full Hibernation mode, including the Modem / GPS On Time
9.6.5 Reporting Signal Falling on Panic


Manual
486, bit 6 for HRLS

9.6.6 Reporting Signal Rising On Panic

488, bit 6 for HRLS

Manual
10 Power Events
10.1 Power Threshold Settings

The thresholds listed below are used to determine if the main and backup power sources
are low or disconnected.
Each of these conditions (low and disconnected) for each of the power sources (main and
backup) is equipped by pair of thresholds enabling to alerts in sessions.
In the graph below it is described the voltage level of the battery (fat purple line) is
decreasing lower than the Low Threshold of Low Level (the Low level alert is issued), then
the battery is replaced: unplugged (disconnected alert issued); then the new battery is
connected (both Low and Disconnected Battery sessions are closed concurrently).
10.1.1 Main Power Low Threshold – High/Low levels
Address: 115 – high level

116 – low level
Description: The unit will trigger “Main Battery low” alert if the measured level of the
main power will be lower than the value programmed in Main Power Low Threshold Low
Level parameter.
The unit will trigger “Main Battery OK” alert if the measured level of the main power will
be higher than the value programmed in Main Power Low Threshold High Level.
Default values: Address 115: 9.05V
Address 116: 8.58V

Manual
10.1.2 Main Power Disconnection Threshold – High/Low Levels

114 – low level
Description: The unit will trigger “Main battery disconnected” if the measured level of
the main power will be lower than the value programmed in Main Power Disconnection
Threshold Low Level parameter.
The unit will trigger “Main battery re-connected event” if the measured level of the main
power will be higher than the value programmed in Main Power Disconnection Threshold
High Level parameter.
Default values: Address 113 - 5.29V
Address 114 – 4.82V
10.1.3 Backup Battery Low Threshold – High/Low Levels

120 – low level
Description: The unit will trigger “Battery low” alert if the measured level of the backup
battery will be lower than the value programmed in Backup Battery Low Threshold Low
Level parameter.
Note that the unit is not charging the battery in Ignition Off mode except in the following
cases:
When the Battery Low alert was issued upon Stop Event. In this case the unit might
activate the charger for limited time (as specified in "Maximum extra charge time"
parameter)
"Charge irrespectively to an operational mode" parameter is enabled.
The unit will trigger “Battery OK” alert when the measured level of the Backup Battery will
become higher than the value, programmed in Backup Battery Power Low Threshold High
Level.
Note that since the measured voltage of the backup battery during charging is ~0.2V
higher then measurement without a charging it is possible that the unit will report status
change (battery low or battery high) too early.
In order to prevent this situation it is recommended not to set the battery thresholds to
tide.
Data format: 8-bit unsigned, 0.01647058823V/bit.
Default values: Address 119: 3.48V
Address 120: 3.52V

Manual
10.2 Power Events/Distress Control
10.2.1 Enabled Main Power Disconnected in Ignition Off Mode alert
Address: 121, bit 0 for events

Description: If this bit is set the unit will generate appropriate alerts upon detection
Main Power disconnected session start and end.
10.2.2 Enabled Main Power Low in Ignition Off Mode Alert

Main Power Low session start and end.
10.2.3 Enabled Backup Battery Disconnected in Ignition Off Mode Alert

Backup Battery Disconnect session start and end.
NOTE: The backup battery disconnection is sensed by voltage on NTC channel.
10.2.4 Enabled Backup Battery Low in Ignition Off Mode Alert

Backup Battery Low session start and end.

Manual
10.2.5 Enabled Main Power Disconnected in Ignition On Mode Alert

Main Power disconnected session start and end.
10.2.6 Enabled Main Power Low in Ignition On Mode Alert

Main Power Low session start and end.
10.2.7 Enabled Backup Battery Disconnected in Ignition On Mode Alert

Backup Battery Disconnect session start and end.
NOTES:
If backup battery is not installed the unit will not generate the "backup battery
disconnected" alert.
The backup battery disconnection is sensed by voltage on NTC channel.
10.2.8 Enabled Backup Battery Low in Ignition On Mode Alert

Backup Battery Low session start and end.

Manual
10.2.9 Period between the Alerts, Triggered by Detection of Power

Disconnection
Address: 1346
Description: Normally the trigger configured as a "plain event" is only generated once,
and the one configured as "distress" is generating single distress session upon trigger
detection (as described above in this document).
The "Main Power disconnected" is an exception from this rule. This alert can be generated
many times.
Note that if Main Power Disconnected alert is configured as "Distress" – it will cause a
number of Distress sessions, according to the number, programmed in this parameters.
Resolution and data format: Minutes, from 1 to 255. 0 – backward compatible mode,
cancels the repetitions (event or session will only be generated once)
Default value: 0 – repetitions canceled
10.3 Radio-Off Mode (Hardcoded - Always Enabled, Non

CelloTrack Variants only)
Previously in Address: 1349, bit 1 (Now it does not have any configuration bit)
Note that the bit was added in Codebase 30j and removed in 31p; in all other versions
this feature is always enabled.
The feature described below is not applicable for CelloTrack variants. For CelloTrack
Radio-Off please refer to: Radio-Off (CelloTrack and CelloTrack Power)
Description: When the main power of Cello is disconnected and the unit is solely working
from internal backup battery the unit will switch its modem upon discharge of the battery
lower than 3.5V.
This way the remaining charge of the battery will allow maintenance of GPS, processor
and memory for generation (without OTA sending) of high number of events before
entering "Shipment Mode" (battery disconnect).
The unit will do the following:
1. Log an especial event "modem off" (TRd207, specific data field 2) upon:
 Solely working from internal backup battery.
 Detection of internal backup battery voltage lower than 3.5V (on any temperature)
for longer than 1 second (100 samples).
2. Switch the modem off 2 seconds after the event generation, but keep generating and
logging events.
 The modem is switched off even if there is a data transfer upon timer expiration.
 Once switched off, the modem will be switched back on only upon main power
reconnection.
3. Log an especial event "Auto-Shipment due to a low power" (TRd207, specific data field
0) upon discharging to 3.25V for longer than 1 second (100 samples).

Manual
4. Enter "Shipment Mode".
Default (Hardcoded) value: 1 - Enabled

Manual
11 Geo-Fences and Towing
11.1 Geo-Fence
The group of parameters below contains configuration structures of 100 internal Geo-
Fences of Cellocator unit. Each geo-fence is a rectangular perimeter, activated in a
selected time of the day. It is equipped by violation condition, capable to trigger an alert
or output activity upon occurrence.
During Ignition On mode the unit is continually examining its location and checking if it is
violating a condition of one of the fields.
Each of a 100 geo-fences is a structure of 16 bytes in the following order:
Byte 15
Byte 14
Byte 13
Byte 12
Byte 11
Byte 10
Byte 9
Byte 8
Byte 7
Byte 6
Byte 5
Byte 4
Byte 3
Byte 2
Byte 1
Byte 0
Field Config Maximal Latitude of Fence's Maximal Longitude of Fence's Configuration
description . byte Latitude Centrum Longitude Centrum bytes 1,2 and 3
4 Displace- Displace-
ment ment
Address
Fence 0
2496-2512
2512
2496
Fence 1
2513-2528
2528
2512
Fence 99
4080-4095
4095
4080

Manual
11.1.1 Format of Geographical Perimeter
Address: 2496-4095
Name in Programmer: EdgePoint 0001 – 0100
Description: The perimeter is defined by center coordinates and maximal displacement
for each coordinate (the same structure for longitude and latitude). The coordinates are
the usual 10-8 radians format. The displacement is 10 8 256 radians (the same format like
the coordinates but without the least significant byte and the most significant byte,
keeping only the middle bytes).
Maximal Longitude Displacement Longitude of Fence's Centrum
Segment Byte 8 Segment Byte 7 Segment Byte 6 Segment Byte 5 Segment Byte 4 Segment Byte 3
Maximal Latitude Displacement Latitude of Fence's Centrum
Segment Byte 14 Segment Byte 13 Segment Byte 12 Segment Byte 11 Segment Byte 10 Segment Byte 9
Default value: all bytes are zeroes (all waypoints disabled).
11.1.2 Four Configuration Bytes of the Fence
Address: Bytes 0, 1, 2 and 15 of each fence:

Output Control End time hours3 End time minutes Start time hours Start time minutes
Thresholds Select
Output
31 Speed Limiting
Number
Geo-Fence
1 TOE (LSB)
29 Activation
24 TOE MSB
TOE MSB
pattern
30
28
27
26
25
23
22
21
20
19
18
17
16
15
14
13
12
11
10
9
8
7
6
5
4
3
2
0
Config. Byte 3 Config. Byte 2 Config. Byte 1 Config. Byte 0
Segment Byte 15 Segment Byte 2 Segment Byte 1 Segment Byte 0
3
In order to set certain fence to be permanently active the start time shall be set to 0:00 and the
end time to 24:00

Manual
11.1.3 TOE - Type of Entry

This field defines the usage of an appropriate Fence entry.
Bit 24 Bit 1 Bit 0 Entry type Geo Fence

Heading
Angle Support
0 0 0 Entry is inactive (the whole 16 No

bytes are ignored by the unit)
0 0 1 Entry is active and treated as Yes

waypoint data
0 1 0 Entry is “keep out” fence data Yes

(unit must be outside location
window)
0 1 1 Entry is “keep in” fence data (unit Yes

must be inside location window)
1 0 0 Entry is treated as Geo-hotspot Yes

(both entering and leaving cause a
trigger)
1 0 1 Entry is treated as Modem Off Yes

zone. The unit generates an event
and switches off the Cellular
modem 10 seconds after entering
the zone.
1 1 0 Speed limiting zone Yes
1 1 1 PHSN (Infrastructure) No
11.1.4 Waypoint
Waypoints are perimeters, which the unit has to be found in at least some of the time, at
defined time intervals. The unit must be found in the perimeter for at least one sample in
the whole time window. If this does not happen, the unit will trigger a dedicated alert.
11.1.5 Geo Hot Spot

Generates trigger on entry and exit to a fenced zone. Transmission reason 191, Trigger's
transmission-reason-specific data: Bits 0-6 is the index of the slot. Most significant bit (bit
7) indicates direction: entry to hot spot ("1") or exit from hot spot ("0"). Behavior is not
affected by fence logic bit. Please note, Hot-Spot does not trigger outputs.

Manual
11.1.6 No Modem Zone

Generates trigger when shutting down modem as a result of entry to "no modem zone".
Trigger is generated only for the first fence that causes the modem's shutdown. Upon
entry to another "no modem" zones, while modem is already turned off, no more triggers
are generated. Modem is shut down 10 seconds after entering "no modem zone",
regardless of trigger settings.
11.1.7 Output Control

Geo-fence violation can trigger output activation. This feature is designed to let the unit
automatically notify the driver that he is violating pre-programmed geo-fence rule and, in
critical cases, even auto- immobilize a vehicle.
5 bits in each entry are defined for output activation as follows:
Activation pattern Output Number
The violation of the "Keep In", "Keep out" Geo-Fence will trigger output activation upon
violation (after Geo-Fence violation filter);
The Modem Off zone will trigger an output while inside the Geo-Fence (note that it is
possible to invert the logic of some outputs programmatically and this way to trigger
output activation outside the fence).
The output will be automatically deactivated upon Geo-Fence violation end.
The output activated by Geo-Fence logic is persistent, e.g. not disturbed by reset or AHR.
Upon violation the activated output might be switched off by Output Control Command
from Central Control. The unit will "remember" the status of the output and will restore it
upon initialization in case of reset.
Once deactivated by command, the output will be re-activated upon next violation.
The logic of the zone violation is set by zone type in TOE of the zone (for example Keep
Out zone will cause an assigned output to be activated when the unit will enter this zone).
Outputs Number description:
Feature Disabled 0
Siren 1
Gradual Stop 2
St. Immobilizer 3
LED 4
Blinkers 5
CFE Out 3 6

Manual
CFE Out 4 or PSP indication beep (if PSP 7

was enabled, Relevant only for session
start i.e Entering the Zone)
11.1.8 Output Activation Pattern
Setting Action
"Pulse Outputs Width Period", addr. 140 dec.
1 Change state to “active” upon trigger
2 Activate Gradually (only compatible with Gradual Stop output)
3 Activate Nested (executed only after vehicle stops, e.g. Ignition off or 10
valid GPS packets showing speed lower than 1 km/h)
11.2 Fences Configuration
11.2.1 Geo Fence Logic
Address: 6, bit 5
Description: This parameter defines the reference of the unit to the geo-fences
(Applicable only for Keep In and Keep Out types).
Global context mode (fence logic = 0)
Keep in fences logic:
When position changes, trigger is generated if both terms below are true:
In the new position *ALL* keep-in fences are in violation state (meaning - position is
outside all keep-in fences).
Previously at least one of the fences wasn't in violation state (position was in the area
of at least one of the fences).
Trigger's transmission-reason-specific data is the index of latest slot that changed its
status to violation state.
Keep out fences logic:
When position changes, trigger is generated if both the terms below are true:
In the new position at least one of the fences is in violation state (meaning - position
is inside one of the keep-out fences).
Previously *ALL* keep-out fences weren't in violation state (position was outside the
area of all keep-out fences).

Manual
Trigger's transmission-reason-specific data is the index of latest slot that changed its
status to violation state.
Discrete context mode (fence logic = 1):
Triggers are generated discretely for violation of each keep-in/out fence, regardless of
other fences status. Trigger's transmission-reason-specific data is the index of the slot
that changed its status to violation state.
Default: 0 - Global context mode
11.2.2 Geo-Fence Violation Filter
Address: 1006
Description: This parameter designed to reduce number of fault Geo-Fence violation
events. It defines required amount of sequential valid GPS packets (GPS packets are
received every second) introducing Geo-Fence violation in order to generate an alert.
Default value: 1
11.2.3 Ignore Geo Fence Violation on Boot (after Reset)
Address: 1, bit 2
Description: If this bit is set, the "first geo-violation changes ignore" mode is activated.
This mode allows avoiding generation violation repetitions upon any kind of reset. In this
mode, the unit will use the first stable violation state as the baseline for subsequent
processing of geo-fences.
This means that any geo-fences in violation state on the first stable status are not
reported, and only subsequent changes are reported.
Once started, "first geo-violation changes ignore" mode terminates when:
A valid, stable GPS fix and geo-fence state is achieved. Any geo-violations at this point
are not reported, and used as baseline.
120 seconds timeout expires. The rationale for this is not ignore important changes
occurring at a later time, if this state started when there is no GPS coverage.
After "first geo-violation changes ignore mode" ends, subsequent geo-violation
changes are reported as usual.
Note that due to this mode's timeout, if GPS takes longer than 120 seconds to achieve a
fix after boot, any active geo-violation will be reported as usual when GPS fix is finally
achieved
Default value: 0 – Do not ignore violations on boot

Manual
11.2.4 Control of Geo-Fence Alters (Events and Distress)
11.2.4.1 Keep In Geo-Fence Zone Violation

1005, bit 0
Description: If this bit is enabled the unit will generate an alerts upon violation of Keep
In Type of Geo-Zones.
11.2.4.2 Keep Out Geo-Fence Zone Violation

1005, bit 1
Description: If this bit is enabled the unit will generate an alerts upon violation of Keep
Out Type of Geo-Zones.
11.2.4.3 Way Point Violation

1005, bit 2
Description: If this bit is enabled the unit will generate an alerts upon violation of Way
Point Type of Geo-Zones.
11.2.4.4 Geo Hot Spot Violation

1005, bit 3
Description: If this bit is enabled the unit will generate an alerts upon violation of Geo
Hot Spot Type of Geo-Zones.
11.2.4.5 No Modem Zone Entry

1005, bit 4
Description: If this bit is enabled the unit will generate an alerts upon violation of No
Modem Type of Geo-Zones.

Manual
11.2.5 Geo-Fence Heading Angle
Address: 1921 - 2020

Description: This feature enables each Geo-Fence to be conditioned by the vehicle’s
approach angle. An array of 100 bytes was allocated in the unit’s configuration memory to
hold the Geo-Fence approach angle entries. Each entry holds a number between 0 to 11
representing 12 possible angle ranges of 30 degrees with resolution of +- 30 Degrees. Each
entry also holds control bits to enable the Geo-Fence Angle for direct and opposite headings.
Enable Enable Opposite Spare Geo-Fence Approach Angle
direct approach angle
approach Code Engle [Degrease]
Angle
0 0
1 30
2 60
3 90
4 120
5 150
6 180
7 210
8 240
9 270
10 300
11 330
7 6 5 4 0-3
The following diagram shows possible scenario of a vehicle approaching geo-Fence with
predefined heading relative to earth’s north and the same vehicle approaching the same
geo-fence from the opposite direction. In this case both enable bits must be set to detect
the event. The feature can trigger outputs just like any Geo-Fence. It is possible to
generate audible alert via CE8 device if PSP is enabled and Geo-Fence output code
number 7 is selected. See Geo-Fence output control. For more information about the
relations between GEO-Fence heading and the TOE (Type of Entry field setting the Goe-
Fence functional settings please refer to: GeoEnceHeadingAngleSupport. Please note Hot-
Spot does not support output activation.

Manual
Opposite Approach
Angle
N
180
Camera
Geo-Fence
N
Direct Approach
180
Angle
11.3 Towing Detection (Not supported by CelloTrack)

Towing detection logic is activated in Engine Off mode irrespective of Hibernation mode.
The unit will store the coordinates upon Stop alert generation (only if the location
considered as valid).
During parking (continually, upon GPS peek, as per hibernation mode settings; the GPS
peek can also be activated upon movement detection by accelerometer) the unit will
examine its location and speed. If the location changes from the Journey Stop or speed
are detected while ignition switch is off – the towing alert will be triggered.
11.3.1 Speed Threshold
Address: 132 –133

Description: The unit will trigger “Speed Detected During Parking” alert if:
The measured value of speed will be higher than the value programmed in this
parameter.
Towing detection alert (event or distress) is enabled
Data format: 16-bit unsigned. Unit’s [cm/sec]
Default value: 200 (~7.2 km/h)
11.3.2 Geo-Fence Perimeter
Address: 134-135
Description: The unit will trigger “Geo-fence violation” alert if
latitude or longitude of the current location differ from the location
recorded upon Stop by more than programmed in this parameter.

Manual
Note that this alert will not be triggered if the location recorded upon Journey Stop is
invalid.
Data format: 16-bit unsigned integer, 10-8 radians resolution.
Default value: 1024
11.3.3 Towing Detection Filter
Address: 137
Description: This parameter defines how many valid consequent GPS fixes shall indicate
Towing Speed or Location Violation for generation of a corresponding alert.
Default value: 3 Filters
11.3.4 Enable GPS Wake Up upon Movement for Towing Detection
Address 467, bit 1

Description: This bit only affects if Movement detection source is set as "Ignition Input".
If this bit is set, the unit will wake up GPS for immediate legacy Towing Detection
procedure upon movement detection while ignition is off.
Default value: 1– wake up GPS
11.3.5 Towing Alerts (Distress and Event) Control
11.3.5.1 Enable Alert upon Towing Speed Detection
Address 99, bit 6 for event

Description: This bit enables generation of the Towing Speed alert upon detection.
Default: Both zeros (disabled)
11.3.5.2 Enable Alert upon Towing Location Detection
Address 99, bit 7 for event

Description: This bit enables generation of the Towing Location change alert upon
detection. Note that this alert will only be generated if valid GPS location was recorded
upon Stop Journey.

Manual
11.3.6 Towed Mode

This mode allows reporting periodically for the entire towing period.
11.3.6.1 Enable Towed Mode
Address 467, bit 6

Description: If this flag is enabled (1) the system will enter into a pseudo “STBEon”
mode upon towing, “Towed mode”. In this mode the unit will behave exactly as it would
do during “STBEon” mode (according to configuration of “STBEon”) except for the
following:
The Ignition Switch will remain off.
If Towed mode Start/Stop alerts enabled: TR – Instead of Driving Start Event (TR69)
the unit will send TR8/STR1
If Towed mode Start/Stop alerts enabled: TR – Instead of Driving Stop Event (TR53)
the unit will send TR8/STR2.
“Unit’s Mode of Operation” field in all corresponding Wire and Wireless packets will
contain 0x10.
If “Towed mode” is enabled, the settings of the following legacy Towing detection settings
are ignored:
Enable event (address 99/6)/distress (address 102/6) upon Towing speed detection
99, bit 6 for event.
Enable (address 99/7)/distress (address 102/7) upon Towing location detection
Enable.
GPS wake up upon movement for towing detection, address 467, bit 1.
Pre-conditions of usage of Towed mode

Address 467, bit 0 = 0 (Start/Stop by Ignition)
Address 467, bit 6 = 1 (Towed mode enabled)
Ignition input is off
Entrance
Movement is detected for longer than defined in the Towing Detection Filter.
Exit
Ignition input goes on (physical input status). In this case the unit will issue the
following:
 Event or/and distress TR8/STR2 – Towing Mode end.
 Event or/and distress (as per settings in address 470, bit 0 and 1) – Driving Start.
Idling (lack of movement) is detected for longer than defined in Towing Detection Filter.
In this case the unit will issue event or/and distress TR8/STR2 – Towing Mode end.

Manual
NOTE: In case towing is detected between Ignition Off and Stop Event generation, the unit will immediately generate
Towing Start, and the Stop Event will be lost.
Default – 0, disabled
11.3.6.2 Enable Towed Mode Start/Stop Alerts
Address 470, bit 0 - for event

bit 1 – for distress
Description: If one of these bits are enabled upon entrance into Towed Mode the unit will
generate event or distress TR8/STR1 and upon detection of Towed Mode end the unit will
generate TR8/STR2

Manual
12 Security (Car Alarm System)

This section is only applicable for Cello-R modifications.
The Security edition of the Cellocator unit is equipped with a built-in logic of Car Alarm
system. This logic is activated in Ignition Off mode in two cases:
Either automatically or upon expiration of pre-programmed timeout (Auto, or passive
arming)
Upon detection of vehicle lock by original remote controller. This detection is called
"Signal Correlation".
The security logic includes a number of operational modes, as described in the following
section.
12.1 Logical Modes of Alarm System

Mode Description LED Door, Immobilizer Lock/ Remarks
Name Ignition Unlock
inputs correlation
detection
Standby The alarm is Off Not armed Not Active Not armed The state will end by
Engine On disarmed; vehicle turning engine Off,
is ready for by Entering Garage
journey, engine or Transmission
on. Delay.
Standby The alarm is Off Not armed Not Active Lock detection The unit will remain
Engine Off disarmed, vehicle expected in this mode till
is ready for reception of Mode
to enter Pre-
journey, engine Change command
Arming Mode
off (OTA, Lock or
ignition on
detection), or
detection of trigger
on door input.
Once door opened
the unit will activate
timer of entering to
Arming Mode
(Passive Arming).
Passive Ignition is off, Slow Not Armed Active Correlation Lock Temporary Mode. If
Arming door was opened, blinking – 2 expected to during programmable
but no Correlation short enter Pre- timeout the Arm
Lock (or OTA flashes, 2 Arming Mode or Command or Dallas
Arm) command seconds off Silent delay (as Code was not
detected per detected – the unit
programming). will enter Pre-Arming
Dallas Code mode.
expected to
enter STBEoff
Mode

Manual

inputs correlation
detection
Pre -Arming The auto-arming On Not Armed Active Unlock Temporary Mode (30
timeout has just command seconds by default).
expired or the expected to This mode designed
unit has just enter Silent to prepare the
received Arm Delay (or vehicle to enter into
command. STBEoff, s per Armed mode.
configuration)
Armed Alarm is Armed Three short Armed Active Unlock In this mode any
flashes, 2 command attempt to open the
seconds off expected to door or turn ignition
enter Silent on will trigger an
Delay (or alarm and the unit
STBEoff, per will enter Alarm
configuration) Triggered mode.
Unlock command will
cause the unit to
enter Silent delay (or
STBEoff, per
configuration).
Silent Delay Unlock detected. Flashes of Not Armed Active Dallas Code This mode designed
The unit is waiting 0.5 seconds expected to to allow the driver to
for Dallas code in on, 0.5 enter Standby identify himself with
order to disarm seconds off mode Dallas Code. If
the alarm during pre-defined
time the code was
not received the
system will enter
Alarm Triggered
mode.
Usage of Silent delay
might be canceled
programmatically
Alarm Unauthorized Fast flashing Armed Active Dallas Code (or Alarm mode. The
Triggered intrusion attempt Correlation siren is working 30
detected Unlock) seconds per alert.
expected to The unit will send
enter Standby pre-defined number
mode of transmissions then
will re-enter Alarm
Armed mode.
If more than 3 alerts
were detected during
parking session from
the same sensor, 4th
trigger caused by the
same sensor will not
trigger Alarm
Triggered mode
again.

Manual

inputs correlation
detection
Garage Service mode 1 second on Not armed Not Active Lock Correlation Temporary Mode
1 second off expected to (predefined time).
leave garage Mode designed for
mode. service. Lock
sequence will case
unit to leave that
mode and enter Pre-
Arming.
Entering the mode:
switching the ignition
off while the Dallas is
attached to a holder.
12.2 Interactions between Operational Modes of Security Unit

Door wasn’t
opened
StandBy
Engine On Ignition Engine Off

Door
Opened
Passive
Lock Arming
After
timeout
Pre- Arming
Lock
Garage
mode
Dallas Code
Armed
received
Unlock, Input
Door trigger Dallas Code
Opened received
Triggered
Mode end
No Dallas Code Alarm

Silent Delay received Triggered

Manual
12.3 Arm/Disarm Detection

The unit detects an authorized Lock and Unlock commands from the original remote
controller and uses it as an Arm and Disarm commands for built in Car Alarm system.
The detection is performed by recording the activity of the vehicle upon Lock and Unlock
(for example system feedbacks by siren and/or blinkers) and using this recorded
sequence as a template.
Once Lock and Unlock (as unlocking the trunk of the vehicle will normally trigger different
system feedbacks, it is possible to record 2 templates for unlock process) activity
templates are recorded (upon installation), the unit continually uses them for signal
correlation between detected signal and the one recorded in its memory. Detection of
signal, exactly fitting one of the recorded one will trigger arming or disarming of the
system.
In order to improve the detection quality the unit is using 3 of its inputs for this
correlation process:
Lock (pin 5), which would be normally connected to vehicle's lock wire
Unlock (pin 11) , which would be normally connected to vehicle's unlock wire
Shock (pin 15), which will be connected to siren or blinkers of the vehicle in order to
detect system feedbacks issued upon Lock and Unlock
The length of the correlation process is 4 seconds, 104 samples.
12.3.1 Active Correlation Lines
Address: 287, bits 0, 1 and 2

Description: Using this parameter we can select ports, participating in an Arm/Disarm
detection (Signal Correlation) described above.
Setting bit 0 to '1 of this address will include Lock (pin 5)
Setting bit 1 to '1 of this address will include Shock (pin 11)
Setting bit 2 to '1 of this address will include Unlock (pin 15)
Default: 0x7
12.3.2 Max. Amount of Failure Samples
Address: 412
Description: This parameter defines the amount of samples in the detected activity, not
matching the recorded template, in order to still consider this activity as recognized Lock
or Unlock.

Manual
Default value: 10
12.4 Security Modes Timeouts
12.4.1 Time to Passive Arming
Address: 414
Description: This parameter is used to define time between opening the door (if If
parameter AutoArming independently from door parameter is disabled) in Standby Engine
off mode and entering Passive Arming mode (If enabled, refer to Security Logic
Configuration). If during this time the Arm command is received – the unit will enter Pre-
Arming mode directly.
Resolution: 30 seconds/bit
Value span: 01h (for 30 seconds) through 00FFh (for 127.5 minutes)
Default: 5 minutes
12.4.2 Time to Pre-Arming
Address: 415
Description: This parameter is used to define time from entering Passive Arming mode
to entering Pre-Arming, if during this time any Arm or Disarm (Dallas code) commands
were not received.
Value span: 01h (for 15 seconds) through 00FFh (~1 hour)
Default value: 10 minutes

Manual
12.4.3 Pre-Arming Time
Address: 413
Description: This parameter defines the time between reception of Arm Alarm command
and the actual Alarm Arming.
Resolution: 1 second/bit
Value span: 00h (to disable Pre-Arming) through FFh (for 255 seconds)
Default value: 30
12.4.4 Silent Delay Time
Address: 416
Description: This parameter is used to define time between intrusion into a vehicle
(trigger on door, correlation unlock or even the Ignition On, as per parameters below) in
Alarm Armed mode and entering the Alarm triggered mode, if during this time Disarm
(Dallas code) command is not received.
Note that few seconds before expiration of this timeout a beep sound will be issued by the
"system feedback" output with intervals of 5 seconds (default), see configuration
parameters below.
Resolution: 3 seconds/bit (i.e. a value of one means 3 seconds, a value of two means 6
seconds, etc.)
Value span: 01h (for 3 seconds) through 00FFh (~12.75 minutes)
Default: 20 (1 minute)
12.5 Silent Delay Configuration

The Silent Delay mode is designed to allow the driver to authorize himself with Dallas
Code. If during pre-defined time the code was not received the system will enter Alarm
Triggered mode.
12.5.1 Trigger Silent Delay upon Ignition On Detection

Description: This parameter defines the corresponding condition for Silent Delay Mode
start (while in Alarm Armed mode).

Manual
12.5.2 Trigger Silent Delay upon Door Open Detection
Address: 1401, bits 7

12.5.3 Trigger Silent Delay upon Correlation Unlock or Unlock2 Detection
Address ’428’, bit 1

Default: 0 – Enable Silent Delay
12.5.4 Number of Silent Delay Expiration Beeps

Description: This parameter enables setting number of expiration of Silent Delay
notification beeps, which will be activated on "feedback outputs" on address 450.
Zero value will disable Silent Delay expiration notification.
Default: 3
12.5.5 Time between Silent Delay Expiration Beeps

Description: this parameter enables setting time between expiration of Silent Delay
notification beeps, which will be activated on "feedback outputs" on address 450.
Zero value will disable Silent Delay expiration notification.
Default: 1
12.5.6 Maximum Time in Garage Mode
Address: 417
Description: This value is used to define the maximum amount of time the unit is
allowed to stay in garage mode.
Upon expiration of this timeout the unit will return to normal operation logic (starting
from Pre-Arming).

Manual
Resolution: 15 minutes/bit
Value span: zero – cancels time limitation of this mode, 01h (for 15 minutes) through
00FFh (~2.5 days).
Default: 8 hours
12.6 Inputs Armed by the Alarm
12.6.1 4 – Ignition
Address: 422, bit 5

Description: This flag enables arming the Ignition Input during Alarm Armed mode.
Default: 0 – trigger an alarm upon Ignition On detection
12.6.2 5 – Lock
Address: 422, bit 7

Description: This input in security edition will normally be used for Arm/Disarm
Correlation Detection, although might be enabled as an input armed during the Alarm
Armed mode and triggering the alarm.
Default: 0 disabled, used for Arm/Disarm Correlation Detection
12.6.3 11 - Unlock
Address: 423, bit 2

12.6.4 14 – Door
Address: 422, bit 0

Description: This input in security edition will normally be used for Intrusion Detection
and shall be configured as an input armed during the Alarm Armed mode and triggering
the alarm.
Obviously it shall be set as one of the discrete types on Address 1610, bits 6-7 for
security usage.
Default: 1 - armed during the Alarm Armed mode

Manual
12.6.5 15 – Shock
Address: 422, bit 1

Obviously it shall be set as one of the discrete types on Address 1612, bits 6-7 for
security usage.
12.6.6 16 – Panic
Address: 422, bit 6

Description: This input in security edition will normally be used for Panic button or an
additional security sensor connection.
In first case this input shall be disabled, in the second case it shall be configured as an
input armed during the Alarm Armed mode and triggering the alarm.
Default: 0 – serving as panic button
12.7 Security Transmissions
12.7.1 Number of Security Transmissions
Address: 426
Description: This parameter defines the amount of (active) transmissions that will be
sent in case of Car Alarm violation (Alarm Triggered mode), if no more sensors are
triggered.
The maximum time in Alarm Triggered mode is [this parameter] x [time between security
transmissions]. Take into account up to another second per transmission (this is the time
that it takes the unit to prepare and arrange a transmission).
Legal values span: 01h (one transmission) through 00FFh (255 transmissions).
Default value: 05 (five transmissions)
12.7.2 Time Between Security Transmissions
Address: 427
Description: This parameter defines the amount of time between two consecutive
transmissions (in case of Car Alarm violation, Alarm Triggered mode) on the wireless
channel.

Manual
Data Format: 8-bit unsigned integer, 2 seconds resolution

Legal values span: 01h (for 2 seconds) through 00FFh (for 8 minutes)
Default: 05 (10 seconds)
12.8 Security Configuration
12.8.1 Disable Auto Arming (Passive Arming)
Address: 428, bit 2

Description: If this bit is set to 1, the unit will not Auto Arm the unit after Ignition Off
detection.
Default: 0 – Auto-Arming enabled
12.8.2 Auto Arming Independent from Door
Address: 428, bit 3

Description: If this bit is enabled ('1'), the unit will activate an Auto Arming timer
immediately after detecting ignition off.
Otherwise, if the bit is '0', the Auto Arming timer will start only after detection of Ignition
Off followed by Door Open trigger.
Default: 1 – Auto-Arming upon ignition off
12.8.3 Auto-Gradual Stop Enable
Address: 428, bit 6

Description: If this bit is set (1) the gradual stop output is activated automatically in the
following cases:
Alarm is armed.
Alarm is triggered by ignition sense.
Alarm is not disarmed by user within 3 minutes from ignition on detection.
An output configured as system feedback will be activated for 30 last seconds before
commencing of auto gradual stop.

Manual
12.8.4 Trigger an Alarm Upon Main Power Disconnection Detection
Address: 424, bit 0

Description: This bit enables the triggering of an alarm upon detection of main power
disconnection while the alarm is armed.
Default: 1 – enabled
12.8.5 Spare
Address: 424, bit 1

Description:
Default:
12.8.6 Trigger an Alarm upon Towing Detection during Alarm Armed
Address: 421, bit 0

Description: This bit enables triggering an alarm upon detection of towing (dislocation
speed during parking).
12.9 Alarm Triggered Signals
12.9.1 Use Siren Output for Alarm Triggered Activation
Address: 450, bit 0

Description: This flag enables usage of Siren Output for Alarm notification during Alarm
Triggered mode.
Note: Siren output is unavailable for CAN variants

Default: 1 – Enabled
12.9.2 Use Blinkers Output for Alarm Triggered Activation
Address: 450, bit 4

Description: This flag enables usage of Blinkers Output for Alarm notification during
Alarm Triggered mode.

Manual
13 External Keyboard (Cello-AR Advance Recovery)

This section is only applicable for Cello-AR modifications.
The Cellocator units, integrated with the external security system, are a budgetary
alternative to the integrated alarm systems used today in the SVR market.
The Cello AR system contains the Cello unit, keyboard for driver authentication, up to 2
wired immobilizing devices and unlimited number of wireless immobilizing devices.
The Cello AR system supports Cello 31e features codebase and wireless access to
immobilizing system:
Security states: armed, disarmed, standby, garage / service, keypad locked. The
states also include manual and automatic procedures for entering and exiting the
states.
Disarming the system via user code, master code, and emergency disarming using the
ignition switch.
Changing the user code.
Identifying, assigning and removing the assignment of the immobilizing devices.
The CelloAR is adding the following functions to the legacy functions of key pad.
OTA communication with control center for Event reporting, parameters programming
and commands receiving.
Identification and authentication method based on user code, and authentication code
( more info is provided in the Driver Identification and Authentication
section in this document).
ECall and BCall using Cellocator Hands Free.
The key pad is integrated with Cello unit through proprietary protocol based on 1-
Wire™ protocol (refer to 1-Wire Interface Protocol).

Manual
13.1 Pairing Procedure

Pairing is a procedure of setting the detected Keyboard ID as a "valid" keyboard. Once
pairing procedure is completed, the unit will validate continuous presence of the specific
keyboard (if bit 5 of address 1910 is set the unit will not validate continuous presence of
the keyboard).
Once the specific keyboard disconnected or replaced, the unit reacts by an immediate
message generation and/or Alarm Cadence (configurable).
The pairing procedure is initiated by the keyboard: certain user activity inserts the system
into a pairing mode.
During pairing process the LED on the Keyboard is indicating pairing mode.
The keyboard ID, received during Pairing Request session is recorded as valid ID into a
non-volatile memory.
Any previous paired keyboard ID is erased upon new pairing.
Upon the Pairing Procedure end the unit will generate a msg. Type 0 with TR 91, STR 11 –
pairing accomplished
13.2 Keyboard Configuration
13.2.1 Enable Keyboard

Description: If this bit is enabled (1) – the system will:
 Allow data forwarding from/to the keyboard, connected to the 1-Wire port (using
OTA Msg type 9, sub-data 0xB)
 Allow particular parsing of the data received from keyboard (as described below)
and its monitoring in position messages.
13.2.2 Keyboard Msg Type 9 Data Source

Description: This bit defines OTA delivery method of messages type 9, triggered by
keyboard activity.
Zero – will cause the unit to deliver this message as a logged event using the same
rules (same numerator sequence, requires acknowledge)
One – will cause the unit to deliver it as a real time event. In this case the ACK is
unnecessary; the message will be delivered by first available communication
transport.
Default: 1 – Real time event

Manual
13.2.3 Wrong Keyboard ID Detection
Address: 1709
bit 2 Alarm Cadence
bit 3 Distress
bit 4 Event
Description: If a corresponding bit is enabled, and Pairing Procedure was accomplished,
the unit will activate an Alarm Cadence (see below in this document), generate and event
or distress upon detection of wrong (not paired) keyboard.
Event/ Distress
The event/distress message type 0 with TR 91, STR 10.

The unit will repeat event/distress every ignition on until the correct keyboard will be
detected or pairing procedure will be repeated.
Alarm Cadence
The unit will repeat the Alarm Cadence every ignition on until the correct keyboard will be
Default: All zeros (disabled)
13.2.4 Keyboard Disconnection Detection
Address: 1709
bit 5 Alarm Cadence
bit 6 Distress
bit 7 Event
Description: If this bit is enabled, and Pairing Procedure was accomplished, the unit will
activate an Alarm Cadence (see below in this document), generate and event or distress
16 seconds after last Keyboard ID detection.
Event/ Distress
The event/distress message type 0 with TR 201, STR 0.

The Com. Status bit in byte 33 will contain 1 (Communication Loss).
The unit will repeat event/distress every ignition on until the correct keyboard will be
detected or Pairing procedure will be repeated.

Manual
Alarm Cadence
The unit will repeat the Alarm Cadence every ignition on until the correct keyboard will be
Default: All zeros (disabled)
13.2.5 Enable Forwarding Data from Keyboard to Serial Port

Description: If this bit is enabled, any message forwarded from the Keyboard is
duplicated both to wire and to wireless channels.
Otherwise message forwarded from the Keyboard is only forwarded to to the wireless
channel.
Default: Zero (disabled)
13.2.6 Enable Malfunction Report
Address: 1710
bit 1 Distress
bit 2 Event
Description: If those bits are enabled upon reception of the corresponding message from
the keyboard the unit will trigger OTA message type 0 (event or distress) with
transmission reason 0d91 and STR described in the table below.
STR Description
0 Keypad Undefined Failure
1 Immobilizer device wires disconnection
2 Keypad locked
3 Relay malfunction
4 Ignition wire disconnected
5 Starter signal detection
6 Starter malfunction
7 Hotwiring Detection*
8 Primary cut unit failure
9 Secondary cut unit failure
10 Wrong keyboard ID detected
11 Pairing Accomplished
12 Keypad flash failed
13 Alarm Cadence Activated by Keyb
14 Alarm Cadence Deactivated by Keyb
128* ECALL Initiated
129* BCALL Initiated
* This STR is sent as single real time event before call initiation irrespectively from the
status of the bits.
Default: bit 1 Distress – 1 (enabled)
bit 2 Event 1 – (enabled)

Manual
13.2.7 Activate Alarm Cadence upon Hotwiring Detection

Description: If this bit is enabled the unit will auto-activate Alarm cadence upon
reception of corresponding (Hot Wiring) malfunction report from 1-Wire channel.
Default: 1 (enabled)
13.2.8 Generate Msg. Type 0 Reply for Commands Addressed to Keyboard

Description: If this bit is enabled in programming (address 1710, bit 4=1) the unit will
generate an active ACK (Message type 0, Reply) to OTA Messages type 9, sub-type B.
This ACK will contain command ID of the corresponding message type 9, sub-type B in its
message numerator field.
13.2.9 Disable Pairing

Description: If Pairing is enabled (Address 1710 bit 5) the unit will send OTA
event/distress message type 0 with TR 201, STR 0. The Com. Status in byte 33 of OTA
Msg type 0 will contain 1 indicating Communication Loss with the Keyboard or pairing
Failed.
If pairing is disabled (Address 1710 bit 5): the unit will send OTA event/distress message
type 0 with TR 201, STR 0. The Com. Status in byte 33 of OTA Msg type 0 will contain 1
indicating Keyboard communication loss only.
13.3 Alarm Cadence

Alarm Cadence is an activation of selected outputs for session of sequential pulses, used
for visual and audio alarm notification.
It is possible to activate an Alarm Cadence:
By OTA command type 0, Command Code 0x06, data field 1 – '1' to activated, '0' to
deactivate. Data Field 2 – don't care.
The 1-Wire interface, using keyboard initiated Msg h88, code 2.
Self activation, further to detection of wrong keyboard ID or keyboard disconnection
(per configuration).

Manual
13.3.1 Alarm Cadence outputs selection
Address: 450
Bit 0 – Siren (pin 8, unavailable in CAN variants)
Bit 4 – Blinkers (pin 18)
Description: During Alarm Cadence the unit will activate selected outputs according to
the template described below.
Default: both 1 – enabled
13.3.2 Alarm Cadence Template: Number of Cycles

Description: This parameter defines number of activations of selected outputs during
Alarm Cadence.
Default: both 1 – enabled
13.3.3 Alarm Cadence Template: On Time

Description: This parameter defines length of activation of selected outputs during Alarm
Cadence.
Resolution: 3 Seconds/bit
13.3.4 Alarm Cadence Template: Off Time

Description: This parameter defines time between activations of selected outputs during
Alarm Cadence.
Resolution: 3 Seconds/bit
13.4 BCALL (Brake down) Destination Number

Addresses: 167-176
Description: Stores the default target address used by the unit upon BCALL (Brake
down) call initiated from the Keyboard. Under normal circumstances, this will be the
number of a service center.

Manual
Data format: First byte should contain the total amount of digits that make up the actual
address (not including address type byte). Second byte is the address type byte, which
should be 91h for international address (recommended type to use, to allow roaming) or
81h for local address. The rest of the bytes contain the actual address, encoded in BCD.
The order of the transmission is bytes with lower address first, lower nibbles (nibble = 4
bit) first. If only the lower nibble of a byte is used (this is legal only in the last byte – in
case this is the last digit of the address), the higher nibble should have all of its bits set
(the nibble should contain 15 dec). The rest of the bytes that are not used should contain
FFh.
Default value: NULL

Manual
14 Reserved

Manual
15 CelloTrack
This section describes parameters associated with CelloTrack devices (both CelloTrack and
CelloTrack Power). The CelloTrack Power device has more programming features
associated with charging logic. Please refer to section 16 for more CelloTrack Power
configuration options.
15.1 CelloTrack Configuration 1

Address: 1318
Description: This parameter contains a bitmap, allowing controlling different activities of
the CelloTrack unit.
Enable GPS Enable Enable Disable Live Disable LED Disable LED Disable LED Disable LED
peeking in Event on Distress on tracking 2 in 1 in 2(System 1(GSM LED)
Live Peeking Peeking operation operation LED)
Tracking mode mode
Disable LED 1 (GSM LED) - If this flag is enabled (‘1’), the LED1 (GSM LED) of
CelloTrack unit will be disabled.
The bit is for Infrastructure only and is currently not operational
Disable LED 2 (System LED) - If this flag is enabled (‘1’), the LED2 (System LED) of
CelloTrack unit will be disabled.
The bit is for Infrastructure only and is currently not operational
Disable LED 1 in operation mode - If this bit is enabled (‘1’), the LED1 (GSM LED) of
CelloTrack unit will be disabled in Activated mode, but will still respond in Non-activated
mode during system activities like “Activation/Deactivation” procedures.
Disable LED 2 in operation mode - If this bit is enabled (‘1’), the LED1 (GSM LED) of
CelloTrack unit will be disabled in Activated mode, but will still respond in Non-activated
mode during system activities like “Activation/Deactivation” procedures.
Disable Live tracking - If this mode is Disabled (“0”) the unit will remain fully active
while movement is detected. This way the unit will not switch off GSM and GPS during the
entire trip. During this mode the unit is capable to generate periodical events (Time and
Distance) according to pre-programmed rules. If this mode is enabled (“1”), the unit will
be in hibernation during the entire trip. Only Start and Stop reports will be registered.
Note: If Disable Live Tracking is enabled, the “Stop Filter Event” will be hard coded to 40
Seconds.
See also "GPS Peeking in Live Tracking" parameter.
Enable Distress on Peeking - If this bit is disabled (“0”), then 20 to 30 seconds before
the end of the COM-Location glancing the unit will trigger a distress session, in form of
standard position message including latest GPS data and an appropriate transmission
reason (d252)

Manual
Enable Event on Peeking - If this bit is enabled (“1”), then 20 to 30 seconds before the
end of the COM-Location glancing the unit will trigger an event, in form of standard
position message including latest GPS data and an appropriate transmission reason
(d252)
GPS peeking during Live tracking - This bit is only applicable if bit 4 of the same
bitmask byte is enabled.
If this bit is enabled (“1”), the GPS will be operated in Live Tracking mode in a way,
enabling an additional power saving as described below.
In the normal Live Tracking mode (see above) all the modules of the unit are activated
and fully operational. When GPS Peeking during Live tracking is enabled the unit operates
a GPS by peeks with preprogrammed length (instead of permanent activation) during the
entire Live Tracking mode.
The GPS Peeks management is activated in the following conditions only:
GPS peaks in Live Tracking is enabled in EEPROM
Time Event interval is longer than 90 seconds
Between the Start event and Stop Event
Only after the first valid fix is obtained after the Start event
If the feature is enabled, the GPS will be switched off immediately after the Time Event
message generation, and will be activated back programmable time before the next Time
Event message generation.
Start Event
Time Event Time Event Time Event
TE Timeout
Communic.
Stop events when GPS peeking is enabled
GPS power
When the "Stop events" are set as distress, the unit will process them as any other
t
distress event, i.e. upon occurrence the GPS will be switched on for Distress session
period plus Extra GPS Time for distress timeout. Programmable
by default)
time (60 sec
GPS Fix received

While the "Stop" is set as a plain event, the unit will behave as follows:
If the event occurs after the time event peek – the unit will not switch GPS on and will
generate the event with the GPS stamp of the last time event. Then, after the
Hibernation Timeout expires, the unit will enter the full hibernation mode.
If the "Stop" event occurs during the pre-time event GPS peek – the unit will generate
the event with the existing GPS stamp (even if valid location not received yet); then,
after the Hibernation Timeout expires the unit will enter the full hibernation mode.
Default Value: 0x5F

Manual
15.2 CelloTrack Configuration 2

Address: 2
Description: This parameter contains a bitmap, allowing controlling different activities of
CelloTrack unit.
Cradle mount GPIO CONTROL 1 GPIO CONTROL 0 Enable Enable Disable Cell
Power save extended FixTime ID packets
charging algorithm on peeking)
temperature (Non
range CelloTrack T)
15.2.1 Disable Cell ID Packets on Peeking

If this bit is enabled (1), the unit will NOT generate a CellID message during glancing
(normal and ST), even if enabled in configuration (bits 6 and 7 of D’202’, D’204’) and
there is no valid GPS reading upon glancing event/distress generation.
15.2.2 Enable FixTime Algorithm (Non CelloTrack T Variants only)

During the Sleep mode the GPS, which is a primary source of real time clock is off and the
microcontroller with its crystal is hibernating. The clock of the unit during this time is
based on the RC oscillator, which is very inaccurate due to an inaccuracy of component's
values and ambient affect.
Long Sleep cycles therefore might cause significant time inaccuracy. The FixTime
algorithm switches off the crystal periodically and allows the microcontroller to calculate
the real time correction of the clock based on RC.
Such a management is significantly improving an accuracy of the self clock, although
increases current consumption by 3%-5% percents. It is recommended to activate
FixTime algorithm only when Specific Time Glancing is used or the sleep periods are
longer than 6 hours.
The FixTime feature is normally needed only for ST (Specific Time) Glancing; the
customers who do not use ST Glancing might save power by switching the FixTime
feature off.
"1" – default value means use FixTime, "0" – do not use FixTime
This feature is automatically enabled in CelloTrack T variants, no Configuration pin
assigned for it.
15.2.3 Enable Extended Charging Temperature Range

This bit is applicable only for CelloTrack Power.
It is setting an ambient temperature range allowed for battery charging.

Manual
0 - for ‘Normal’ range, shall be selected for Li-Poly battery with temperature range of
0-45 °C
1 - for ‘Extended’ range, shall be selected for Sonata® battery with temperature range
of -10-60 °C
Default Value: 0 – (for range of 0-45 °C)
15.2.4 GPIO Control 0/1 (CelloTrack only)

CelloTrack was built with true GPIO hardware support enabling the user to control the
functionality of the 2 GPIO lines connected via the harness. The configuration bits were
added to select between input functionality, output functionality and output with
feedback. The GPIO inputs 0 and 1 are called “Door” and “Shock” in the inputs description
above.
The user should note that if both GPIOs are disabled the unit will consume less energy
and thus increase the battery operational time.
GPIO CNTL 0 Description

0 GPIO disabled
1 GPIO functions as input only (Door)
2 GPIO functions as Output only (STD IMMOBILIZER)
3 GPIO functions as Output. The output actual state will be mirrored via the
input.
GPIO CNTL Description

1
0 GPIO disabled
1 GPIO functions as input only (Shock)
2 GPIO functions as Output only (LED)
3 GPIO functions as Output. The output actual state will be mirrored via the
input.
Default Value: 0 – no input/output connected
15.2.5 Cradle Mount Power Save (CelloTrack only)

This feature enables the user to optimize the unit’s power consumption if the unit’s
mounting policy is known in advance. If the unit will be mounted in the original supplied
cradle and the configuration bit will be set to 0 the unit static current consumption will be
decreased by 40uA. The same is true if the unit will not be mounted in Cradle this
configuration bit will be set to 1.
Cradle mount Description

power save

Manual
0 Tamper switch will consume minimal

energy during hibernation when not
inserted to cradle
1 Tamper switch will consume minimal

energy during hibernation when
inserted into the cradle
Default Value: 1 – Cradle mount
15.3 GPS Peeking On Time during Live Tracking

Address: 1616(dec)
This parameter only applicable when "GPS peeking during live tracking" bit of the bitmask
above is enabled.
The parameter contains a value of time used to power on the GPS before the Time Event
generation.
Resolution: seconds
Data range: 40-80seconds (any value lower than 40 will be mean 40, any value higher
than 80 will mean 80)
Default Value: 40 seconds
15.4 Activation/Deactivation Procedure Options

Address: 1447(Dec)
The Bitmask:
Enable Enable Enable Enable Send Cell Id GPS based GPS Activation/
Activation Activation Activation Activation upon Start Ignition based Deactivation
mode mode mode mode Report Enable Start procedure
change: change: change: change: Event
(Infrastructure) Sending Start 1 – Normal
“Active” “Active” move to move to Enable
events on (two buttons)
“Not “Not
Distress Logged timeout 0-Disable 0–
Active” Active”
Event Event 1-Enable Alternative
Distress Logged (Infrastructure)
0-Disable 0-Disable 0-Disable procedure
Event Event 0-Disable (One button)
1-Enable 1-Enable 1-Enable
0-Disable 0-Disable 1-Enable
1-Enable 1-Enable

Manual
15.4.1 Activation/Deactivation Procedure

It is possible to select programmatically between a standard Activation/Deactivation
procedure, using two buttons: Tamper switch and Front Button (FB) and alternative
Activation/Deactivation procedure using single button (the FB) only.
Activation/Deactivation Procedures Activation/Deactivation Procedures

using two buttons (Standard) using one button (Alternative)
Deactivation (from activated mode): Deactivation (from activated mode):

1) Deactivation by Button combination: 1) Deactivation by Button:
The Front Button (FB) is pressed for 3 Deactivation (from activated mode):
seconds The Front Button (FB) is pressed for 6
Tamper switch should not be pressed (the seconds.
device is out of the cradle) 2) Deactivation by OTA Command
2) Deactivation by OTA Command Type 0 command to force the CelloTrack unit
Type 0 command to force the CelloTrack unit to “Not Active” mode, see “Wireless
to “Not Active” mode, see “Wireless Communication Manual” in section 3.3
Communication Manual” in section 3.3 command code 0x1d.
command code 0x1d.
Deactivation process Indication:

Deactivation process Indication: The following LED sequence will be activated
The following LED sequence will be activated to reflect deactivation request was granted
to reflect deactivation request was granted and the unit has started its deactivation
and the unit has started its deactivation procedures. Please note that deactivation
procedures. Please note that deactivation procedures include also sending OTA event
procedures include also sending OTA event to reflect the fact the unit is about to be
to reflect the fact the unit is about to be Deactivated (TR 102).
Deactivated (TR 102).
IMAGE MISSING ABOVE

IMAGE MISSING ABOVE Unit Deactivated indication
Unit Deactivated indication The SYS LED glows for 2 seconds and then
The SYS LED glows for 2 seconds and then switches off. The device enters a Non-
switches off. The device enters a Non- Activated state until the next operation
Activated state until the next operation starts.
starts. Pressing FB while the device is in a cradle
Pressing FB while the device is in a cradle and activated will cause the unit to trigger
and activated will cause the unit to trigger the "Panic button triggered” procedure only.
the "Panic button triggered” procedure only.
Activation (from not-activated mode): Activation (from not-activated mode):

Manual
The Tamper switch is pressed (the device is The Front Button (FB) is pressed for 3
in a cradle) seconds
The Front Button (FB) is pressed for 3 Indication of Successful Activation:
seconds SYS LED blinks (second on/second off) while
Indication of Successful Activation: the FB is pressed in deactivated mode. After
SYS LED glows while the FB is pressed. After 4 seconds of FB triggering the LED is
3 seconds of FB triggering the LED is switching off – here the FB can be released.
switching off – here the FB can be released. When the GPS enters navigation SYS LED
If the FB is pressed while the Tamper switch start blinking twice (short blink (1/4 sec blink
is not pressed (the unit is out of the cradle) - once in 2 seconds)
the SYS LED begins to blink (1sec on/1 sec OTA event can be sent to reflect activation
off) in order to confirm a Non-Activated mode change (TR 102).
state.
When the GPS enters, navigation SYS LED
starts to blink twice (short blink (1/4 sec
blink once in 2 seconds)
OTA event can be sent to reflect activation
mode change (TR 102).
15.4.2 GPS-based Start Event Enable

If this bit is set then start report (logged or distress) will not be sent unless GPS has
detected a deflection from the original location.
If this bit is cleared then legacy functionality will be maintained: the start report will be
sent only based on the accelerometer.
Default value: 1 – normal procedure
15.5 CelloTrack: GPS-based Movement Timeout

Address: 1319 (dec)
This value will determine the GpsFix and Deflection timeout. After this time elapses a
start event will be sent towards the Center if enabled by bit “GPS based Ignition Send
events on timeout”
Resolution: 1 min
Data range: 0-255
Default Value: 60 min
15.6 Max Extra GPS On Time for Distress Mode

Address: 1618(dec)

Manual
15.6.1 Distress Mode during COM-Location Glancing State
In most of the operational scenarios, except of periodical events (COM-Location Glancing)

the customer will need to report additional events. For example – movement Start and
Stop, tampering detection or trigger of front button.
The correct way of reporting of such alerts is to generate a Distress session upon
detection of one of them (refer to a Distress Session definition in Programming manual).
Last event
sent
GSM 10/90 t
30 Distress GPRS or SMS
sec
sec
sec
GPS acquired for
or timeout
GPS Max GPS On Extra GPS t
The trigger
The Distress session, triggered during sleep mode, is managed according to the following
scenario:
Upon trigger of the distress session the unit immediately switches on both GPS and GSM
waits for GPS acquisition or for expiration of Max GPS On time + GPS Extra Time (this
parameter) programmable timeouts. During this time the modem has a chance to
registries into GSM and GPRS.
Once the GPS is acquired or both timeouts expired, the unit initiates another timeout of
30 seconds and then initiates the Distress session.
The unit tries to send each of the distress messages by GPRS; if GPRS is not enabled or
not available the message is sent by SMS. In case of SMS the time to next message of
the same distress session is automatically set to 90 seconds.
10 (or 90 in case of SMS) seconds after the last distress message both GSM and GPS are
switched off if no other Distress traffic is detected.
Data format: 1 byte, decimal value, one second resolution
Default Value: 60 seconds
15.7 Glancing at Specific Time (ST Glancing)

Address: 1614-1615(Dec)
Description: This feature enables reception of a repository update from all the units of
the fleet at the same time by wake up for a Com-Location glancing at the specified time of
the day.

Manual
In order to decrease the load on the communication server upon simultaneous update of
many units, the update time might not be absolutely accurate but may vary a bit as per
pre-programmed randomization rule.
Similar to a normal Com-Glancing, the ST Glancing message is generated 20 to 30
seconds before the end of the glancing (the programmed time is the time of the glancing
start, the wake up time) and follows the same rules, except the following items:
The unit only will generate ST (Specific Time) event if the Day field of Last Valid GPS
timestamp is not zero, which means that the GPS was navigating in the past and the
time is synchronized. Otherwise the message should not be generated
If randomization enabled, the actual time of the transmission will vary for every unit's
ID according to the rule below:
A= P+ (ID)Mod10*(6min)
A= Actual Transmission Time
P = Programmed time
ID= Unit's unique ID
The ST transmission is generated with the transmission reason of Glancing (0d252,
Transmission Reason Specific Data 0d1).
If both regular, interval-based glancing and ST glancing are enabled they both will be
maintained simultaneously and independently.
If the at the time, specified in the ST Time parameter the unit is in a non-hibernation
mode (like, for example, the Live Tracking), except the Normal Glancing, the unit will not
generate an ST Glancing message.
NOTE: If the ST Glancing events are enabled, certain increase in current consumption is
expected.
The CPU periodically wakes up the GPS module in order to synchronize an internal clock
with the RTC of GPS and in order to be able to send the life signal within a resolution of
no worse than 6 minutes.
The wake up mechanism is adaptive and determines the number of time that the GPS has
to be turned on by measuring the clock deviation size. In most of the cases, only one
synchronization wake up is required prior to the life signal event. From time to time, two
synchronization wake ups may be observed.
In order to make current consumption calculation easier, use "Specific time" event as
equal to (up to) 3 normal glancing events in 24 hours period (this is the worst case but
usually no more than 2).
First byte (1614)
Reserved Disable ST ST Hour (0-23)4

randomization (beginning of the glancing and not the event)
0 – enable time
Default value - 12
randomization
1 – disable time
randomization
(default value)
4
Setting the "ST Hour" to a value bigger than 23, will cancel the ST Glancing.

Manual
Bits 6-7 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Second byte (1615)
Enable ST Enable ST ST Minutes (0-59)5

Glancing Glancing (beginning of the glancing and not the event)
Distress Event
Default value - 00
(disabled (disabled
by default) by default)
Default Value: 0 on both addresses
5
Setting the "ST Minutes" to a value bigger than 59, will cancel the ST Glancing.

Manual
15.8 Radio-Off (CelloTrack and CelloTrack Power)

The Radio-Off feature was redesigned and adapted for battery powered CelloTrack
devices. Radio-Off mode starts when CelloTrack battery voltage decreases bellow 3.4
Volts for 30 consecutive seconds and initiates the following set of actions is performed:
1. A Radio-Off event is generated and logged.
2. All log history is saved into nonvolatile memory.
3. Cellular modem and GPS are turned off.
4. The Firmware enters idle state.
The Radio-Off preventive actions taken when battery reaches critical level will insure the
integrity of the logged history and facilitate smooth restart when power reapplied to the
device.
Cellotrack
Batt. Level
3.6Volts
Delay 3.5Volts
3.4Volts Delay
Delay
Radio-Off Radio-Off
Start End
Time
Radio-Off
Unit Mode mode On
OTA Messages
Early Radio Radio Off Message
Off Message sent to Log memory
Early radio off message will be generated by the unit when the battery voltage reaches
3.6 Volts or below for 30 consecutive seconds. The early Radio off message will inform the
server side that the unit’s battery voltage is very low and that Radio off mode is about to
start soon.
15.9 Advanced Glancing (peeking): CelloTrack and CelloTrack

Power
Addresses:
1337-1338: For Glancing time for movement and not charging state.
1339-1340: For Glancing time for No movement and charging state.
1341-1342: For Glancing time for movement and charging state.
Description: This feature enables the unit’s glancing (Peeking) period to be adapted to various operational states.

Manual
Glancing, or peeking, in CelloTrack units is a self initiated event designed to wake the unit from hibernation and send a
scheduled event. In CelloTrack, unlike other units, we do not support separate GPS and GSM peeking, both GPS and GSM
peeking in CelloTrack are governed by GSM peeking parameters. The most dominant peeking parameter is the GSM Peeking –
Modem Off time which sets the time between peeks. The Advanced Glancing (Peeking) feature enables the user to configure the
GSM Peeking – Modem Off time according to the unit’s charging state and its movement state. The motivation would be to
increase peeking frequency if we have reliable charging energy source or if we have both charging energy source and we are
moving (We have the energy, and we want to get more information about the unit’s location while traveling) etc. The user can
configure new values, overriding the legacy GSM Peeking – Modem Off time when movement or charging source are detected.
The block diagram bellow describes the functionality of the “Advanced Glancing Mechanism”. The new mechanism selects from
the PL configuration the appropriate Glancing time as function of the system state (Charging or moving).
Please note that when one of the above parameters (1337-1338, 1339-1340, 1341-1342) is set to 0, The legacy GSM Peeking –
Modem Off time will be used as glancing time.
Movement State
Charging State
(CellotrackPower Only) Advanced
Peeking Updated Glancing time
PL Mechanism (Modem Off-Time)
Config
The following table describes the relations between the system state (Charging or moving) and the glancing time. Each system
state glancing-time is represented by a dedicated configuration parameter. The unit’s firmware will select the relevant
configuration parameter when the system will change its state. The new glancing-time will be used in the next glancing period or
if distress or Active Logged event will be triggered.
Glancing No Movement Movement

Time
Not Charging Glancing time = Define by parameter located Glancing time = defined by parameter
at address 268. See located at address 1337-1338. See
GSM Peeking – Modem Off time CelloTrackGlangingTimeMovementNoCharg
e
Legacy time. If the parameter is set to 0, The glancing
time will be taken from GSM Peeking – Modem
Off time
If time is greater than 0 and less than 5 min
it will be considered 5 minutes.
Glancing time shall always be less than or
equal to GSM Peeking – Modem Off time.
Higher configurable values will be truncated
to GSM Peeking – Modem Off time.
Charging Glancing Time = defined by parameter Glancing time = defined by parameter
(CelloTrack located at address 1339-1340. located at address 1341-1342. See:
See: CelloTrackGlangingTimeNoMovementCharge CelloTrackGlangingTimeMovementCharge
Power Only)
If the parameter is set to 0, The glancing time If the parameter is set to 0, The glancing
will be taken from GSM Peeking – Modem Off time will be taken from GSM Peeking – Modem
Off time
time
If time is greater than 0 and less than 5 min it If time is greater than 0 and less than 5 min
will be considered 5 minutes. it will be considered 5 minutes.
Glancing time shall always be less than or Glancing time shall always be less than or
equal to GSM Peeking – Modem Off time. Higher equal to GSM Peeking – Modem Off time.
configurable values will be truncated to GSM Higher configurable values will be truncated
Peeking – Modem Off time. to GSM Peeking – Modem Off time.
The table below was added to reflect the fact that Charger power connected to CelloTrack
Power is not a sufficient condition for considering unit’s battery is actually being charged.

Manual
For example, when charging power is connected and the temperature is out of charging
range the battery will not be charged, in this case we are in NotCharging state.
Charger Power Charging Logic Status Charging Mode

source State
Connected Charging Charging
Not Charging due to extreme temperature NotCharging
Not Charging due to “Batt high” condition Charging
Disconnected NotCharging

between two consecutive peeks)
Default: Disabled (zeroes)

Manual
16 CelloTrack Power
This section describes dedicated CelloTrack Power configuration parameters. The
CelloTrack Power configuration parameters are an addendum to the standard CelloTrack
programming parameters as described in section 15.
The CelloTrack Power supports the following unique items:
CelloTrack Power indicates the charger status in its outputs vector (2nd outputs byte,
bit 7; 1- charging, 0 – not charging) in both wireless and wire protocols.
The unit reports the battery temperature measurement (sampled every second) in 4th
byte of analog inputs in both wire and wireless protocols.
The unit activates an external charger when all of the conditions below become true
concurrently:
1. The temperature is between 5°C and 45°C (upon charging the temperature might
increase by 5-6°C due to a self heating).
2. An external power supply is detected.
3. The battery measurement is lower than 4.1V.
4. The unit is not in hibernation (configurable).
The unit shall stop battery charging when:
1. The temperature out of threshold (after the first exceeding measurement).
2. An external power supply is disconnected.
3. The battery measurement is higher than 4.1V (configurable).
4. The unit enters hibernation.
NOTE: It is mandatory to select NTC in one of the OTA bytes (26-28) in order to enable
the charging function. See: Bytes 26-29 of OTA Message 0.
16.1 CelloTrack Power Configuration Settings

Address: 1446
Description: This parameter contains a bitmap controlling charging of CelloTrack power.
Not used Charging Stop upon "Battery Enabling Charging in

Full" detection Hibernation
0 – Keep charging 0 – Disable

1- Deactivate charging 1 - Enable
Charging Stop upon "Battery Full" detection - By default the unit will stop charging
when the battery voltage will reach 4.24V (for 2 consecutive measurements or 1 minute).
It is possible to disable this auto charger deactivation in order to let the CCCV controller
to do the job.

Manual
Enabling Charging in Hibernation - It is possible to enable charging in hibernation mode

when:
The temperature of the battery between 5°C and upon charging the temperature
might increase by 5-6°C due to self heating An external power supply is detected
The battery measurement is lower than 3.85V
The unit will stop battery charging when:
The measured temperature out of threshold (lower than 5°C and higher than 45°C).
An external power supply is disconnected.
The battery measurement is higher than 4.1V
Default value: 0
16.2 Time Event Resolution Multiplier for “External Power”

Mode
Address: 1619
This parameter defines a divider for Time Events resolution, when the CelloTrack is
connected to the external power source. It will happen if the CelloTrack is installed into a
trailer and connected to its power system. When the trailer will be connected to a track –
the CelloTrack will be powered from an external power source. In this case no power
reservation is required and we might consider transmitting much more frequently then
when draining the internal battery.
The original time event resolution is divided by the value stored in this parameter when
an external power source is detected.
Data format: 1 byte, decimal value. Zero is prohibited
Default Value: 1
16.3 Distance Event Resolution Multiplier for “External Power”

Mode
Address: 1624
This parameter defines a divider for Distance Events resolution, when the CelloTrack is
connected to the external power source. It will happen if the CelloTrack is installed into a
trailer and connected to its power system. When the trailer will be connected to a track –
the CelloTrack will be powered from an external power source. In this case no power
reservation is required and we might consider transmitting much more frequently then
when draining the internal battery.
The original distance event is divided by the value stored in this parameter when an
external power source is detected.
Data format: 1 byte, decimal value; zero is prohibited
Default Value: 1

Manual
17 CFE
17.1 General
Communication and Functionality Extender is designed to split the COM port of Cello
device and enables concurrent connection of multiple devices with COM interface (in the
future Bluetooth or USB connectivity might be developed).
Communication and Functionality Extender is utilizing HW architecture based on Cello
device and providing 26 interface pins in two connectors (6 pins and 20 pins).
The CFE used as serial multiplexer will associate between CFE serial interfaces and Cello
protocols. The relations between the protocols and the serial interfaces will be defined by
the PL.
In the downstream direction, each datagram coming from the OTA protocol will be
processed by the Cello FW and routed to its destination CFE serial protocol.
In the upstream direction, serial messages originated by the CFE serial interfaces will be
forwarded to the server (via OTA) based on the associated protocol assigned.

Manual
17.2 Block Diagram
Re-flashing JTag Bluetooth

Microcontroller STM101 64pins Module
Bluetooth
COM2 port +
HW flow
Readiness to USB port control
DC/DC 12/24V
Readiness to
D8 driver (to replace 4th COM
by D8 port)
Input’s Output’s Power

th CMOS to drivers drivers driver
5 COM port (ULN)
RS232 (+
Ignition)
4th COM port Outputs
DC out ready (5V)

GP Inputs + Ignition
3rd COM port
1st COM port Dedicated for Cello

Manual
17.3 Programmable CFE Parameters

The CFE programming parameters are part of the Cello configuration map. When CFE
related parameters are reconfigured via OTA programming command or serial
programming command an automatic process is triggered to submit the new configuration
from the Cello towards the CFE configuration memory.
Please note that changing Cello’s “Hibernation Mode Delay” will also initiate CFE’s
configuration map reprogramming as this parameter is used by CFE to coordinate full
system hibernation.
Cello Configuration command Periodic ping query detects

updated CFE config region in mismatch between Cello and CFE
the Cello Config map config maps (In the CFE reagon)
1 2
CFE CFE
Map 3 Map
Auto Reprogramming is initiated and
the CFE configuration map is
coppyed from Cello to CFE
Config Config
Cello CFE
17.3.1 CFE COM 1 (Cello Port) Configuration
Address: 1714, 1715
Reserved Baud rate

(for COM1 and COM2 (Bluetooth) hardcoded to 460800)

Manual
Address: 1716, 1717
Reserved Baud rate

Address: 1718, 1719
Reserved Baud rate

Address: 1720, 1721
Reserved Baud rate


Manual
17.3.5 CFE VOUT Control
Address: 1726
Reserved Enable Vout (5V)
17.3.6 CFE Hibernation Setting Bitmask
Address: 1727
Reserved Keep UART1 on during Full Enable Full Hibernation
hibernation
The flag "Keep UART1 ON during hibernation" is only applicable while the physical ignition
(Input 1 function = Ignition) is used as an ignition source. Otherwise UART1 is always on.
17.3.7 CFE Bluetooth Page Mode (Infrastructure)
Address: 1754
Description: Page mode controls whether iWRAP can be seen in the inquiry and whether
it can be connected. This command can also be used to change the page timeout.
0 - Bluetooth Switch off
1 - Unsupported
2 - iWRAP is NOT visible in the inquiry but answers calls
3 - iWRAP is visible in the inquiry and answers calls
4 - Just like mode 3 if there are NO connections. If there are connections, it is like mode
0. (default value)
Ignition On Average Hibernation
Bits 4-7 Bits 0-3
17.3.8 CFE Page Scan Mode (Infrastructure)
Address: 1757
Description: This parameter configures the Bluetooth page scan mode. The possible
values are:
0 - Mode R0 means that iWRAP IS connectable all the time. High current consumption!
Since iWRAP is all the time connectable, it will not be visible in the inquiry, no matter
what the page mode configuration is.
1 - Mode R1 means that iWRAP is connectable every 1.28 sec (the default value)
2 - Mode R2 means that iWRAP is connectable every 2.56 sec (lowest power consumption)

Manual
Ignition On Average Hibernation

Bits 4-7 Bits 0-3
17.3.9 CFE Bluetooth Pin Code (Infrastructure)
Address: 1758-1766
First byte contains the actual length (number of chars), 0-8, ASCII
Default value: 1234
17.3.10 CFE COM2 (Infrastructure)
Address: 1767-1768
Infrastructure
17.3.11 CFE Bluetooth Configuration (Infrastructure)
Address: 1769-1777
Infrastructure
17.3.12 CFE Local Bluetooth Device’s Friendly Name (Infrastructure)
Address: 1778-1809
Description: The maximum length of a Bluetooth friendly name is 31 characters (31
bytes). The first byte contains the actual length of the parameter (in ASCII chars).
Whenever length is zero – the 32 bits paired Cello’s Unit ID will be used as Local
Bluetooth device’s friendly name.
17.3.13 CFE Input Type / Assigned Function
Address: 1810, bits 5-7: Input 1

1816, bits 5-7: Input 2
1822, bits 5-7: Input 3
1828, bits 5-7: Input 4
1834, bits 5-7: Input 5
1810, bits 5-7: Input 6

Manual

counter
Input Type Description

number
0
Discrete Dry Contact (on board pull-up)
1
Discrete Normal (Wet Input)
2
Analog Backward Compatible (0-2.5V)
3
Analog New Range (0 – 30V)
4
Frequency meter
5
Pulse Counter : Enables Pulse Counting mechanism
6
12 bits Analog Backward Compatible (0-2.5V)
7
12 bits Analog New Range (0 – 30V)
Default Value: zero - Discrete Dry Contact
17.3.14 Function assigned to CFE input
Address: 1810, bits 0-3: Input 1

1816, bits 0-3: Input 2
1822, bits 0-3: Input 3
1828, bits 0-3: Input 4
1834, bits 0-3: Input 5
1810, bits 0-3: Input 6
Description: This field enables assignation of certain functionality to a CFE input.

number



Manual

number
3 CFE Ignition input Only for CFE Input 1
17.3.15 Scaling Factor for Frequency Report on CFE Input
Address: 1812, Input 1

1818, Input 2
1824, Input 3
1830, Input 4
1836, Input 5
1842, Input 6
Description: Applicable only if CFE is selected as input type 4. The scaling factor is
intended to be used for conversion of the measured frequency into common unit of speed
(cm/sec) in case the measurement is utilized as a speed source or into any other
the Auto-Calibration Process. (Refer to the Frequency Metering Section in this document)


Example:
In this case the scaling factor will be Sf=1111 /54=20.576

Manual
Maximum value of an scaling factor of speed is Sf=65.535

The stored value of Sf will be 65535
The scaled value of the measurement will be reported in every position update from the
unit in one of the Analog Inputs monitoring bytes, as per the configuration described
above in this document.
Example:
4000 RPM.
Sf=17.24/32=0.53875

17.3.16 Threshold for CFE Input (Discrete Wet/Dry)

1820, Input 2
1826, Input 3
1832, Input 4
1838, Input 5
1844, Input 6
Manual
parameter.
Value span for wet type: 0 (0V) to 255 (30V).
17.3.17 Averaging Factor for CFE Input

1817, Input 2
1823, Input 3
1829, Input 4
1835, Input 5
1841, Input 6
measurement sample separately
17.3.18 CFE Inputs State Update Configuration
Address: 1846
Description: CFE Inputs update message configuration (CFE to Cello).
Update period (resolution of Enable Enable
0.5 seconds) unsolicited periodic
Default: 1 updates (upon updates
change)
0- Deactivate
0- Deactivate 1 - activate
1 - activate
Bit 7 – Bit 2 Bit 1 Bit 0

Manual
17.3.19 Cello: Analog Measurements Update Period
Addresses: 520 – Home network

521 – Roaming network
NOTE: Modification does not require reset.

Resolution: 4 or 90 seconds as per resolution bit in a control byte.
Default value: both 1 minute (15)
Cello: Analog measurements update configuration bitmask.
Period multiplied by the resolution defined in Bit 2. Resolution Enable Enable

definer RT logged
0–4 0–
seconds 0– disable
1 – 90 disable 1-
seconds 1- enable
enable
17.4 CFE: CFE Status Update Configuration

Address: 1846
Enable unsolicited Enable periodic
Update period (resolution of 0.5 seconds) updates (upon change) updates
0- Deactivate 0- Deactivate
1 - activate 1 - activate
Description: This configuration byte controls the CFE I/O extender update message
behavior. Inputs sampled by the CFE are updated towards the Cello using periodic or
unsolicited messages. Usually we will use periodic updates if one of the inputs is
configured as Analog.
CFE inputs update message format is described in section: 4.5 CFE: Periodic / Unsolicited
Extended I/O Status upon change.
Default: 0 (disable)

Manual
17.5 CFE Serial MUX Protocol Selection

Address: 1437 - Serial interface 2
1438 - Serial interface 3
Upon reset the Cello FW shall read the PL and assign a protocol for each CFE interface.
The supported protocols are listed in the below table.
NOTE: The Serial programmer can be connected to any CFE serial interface provided the
programmer's serial physical layer format is compatible with the connected CFE serial
interface configuration. The only exception is when the CFE interface is in transparent
mode.
The supported protocols options are:
Code Protocol
0 Serial Interface Disabled
1 Garmin
2 PSP
3 DTCO
4 DFD
5 Transparent
6 RFID
7 Wire Protocol
For more detailed descriptions of the protocols, see the relevant section in this document
or in the OTA protocol document.

Manual
18 Crash Detection Feature
18.1 General
The unit’s accelerometer is used as a source for crash detection and reporting.
The feature includes 2 separate RMS based thresholds, one for light crash and one for
heavy crash.
The detection will not be possible when in full-hibernation mode (ignition is OFF).
The light crash detection requires the unit to be installed horizontally for gravity to be
eliminated.
18.2 Crash Detection Configurable Parameters
18.2.1 Light Crash Detection Threshold
Address: 2384 bits 0÷6 - Light crash detection threshold

Description: This parameter contains the value of acceleration RMS (gravity eliminated),
used to detect a light crash (any acceleration higher than this threshold and lower than
the threshold of heavy crash for longer than a filter above will be considered a light
crash).
Resolution: 0.072g
Valid range: 2g≤X≤9.2g, higher and lower programmed values are automatically
saturated.
Default: 2g
18.2.2 Heavy Crash Detection Threshold
Address: 2385 bits 0÷6 - Heavy crash detection threshold

Description: This parameter contains the value of acceleration RMS (gravity included),
used to detect a light crash (any acceleration higher than this threshold and lower than
the threshold of heavy crash for longer than a filter above will be considered a light
crash).
Resolution: 0.072g
Valid range: 2g≤X≤9.2g, higher and lower programmed values are automatically
saturated.
Default: 5g

Manual
18.2.3 Enable Crash Detection Events for Light/Heavy Crash
Address: 2390 bit 0 for Light Crash

2390 bit 1 for Heavy Crash
Description: If this bit is enabled, the unit will issue an event containing reason and sub-
reason when thresholds are crossed. If the Light crash is enabled, the unit’s logic assumes
it is installed parallel to ground (horizontally) and ignoring Z axis.
Default: 0 – Disable
18.2.4 Enable Distress for Light/Heavy Crash
Address: 2390 bit 2 for Light Crash

2390 bit 3 for Heavy Crash
Description: If this bit is enabled, the unit will issue a distress event containing reason
and sub-reason. If the Light crash is enabled, the unit is assuming that it is installed in
parallel to ground (horizontally) and ignoring Z axis.

Manual
19 CAN Bus Support (Cello-CANiQ)

The Cello-CANiQ configurable parameter is divided into two categories:
Traditional configurable values designed to enable/disable or set values of functional
parameters.
Array of configurable memory designed to hold CAN triggers and events as generated
by the CAN Editor.
19.1.1 Cello-CANiQ: CAN Operational Mode Select
Address: 4100
Description: This parameter contains a bitmap controlling the CAN bus operational
mode.
Enable DTC CAN operational mode select
19.1.2 Cello-CANiQ: CAN Operational Mode Select
Address: 4100, Bits 0-3

Description: These 4 bits control the Cello-CANiQ’s CAN bus operational mode. The
following table describes the modes and their corresponding codes:
Code Mode Description
0 Disable CAN Interface The CAN bus is disabled.
1 J1939 listener mode The unit functions as J1939 CAN bus listener. The
user can program the unit to monitor selected
J1939 information elements and use these
information elements to feed predefined system
variables such as RPM, Speed, Fuel Level etc.
The information intercepted via the J1939 bus
will also feed the Cello-CANiQ triggering
mechanism enabling the user to build complex
criteria for events generation and outputs
activations.

Manual
2 OBD2 Master mode The unit functions as OBD2 CAN master. The unit
will interrogate user selected OBD2 CAN
information element and use these information
elements to feed predefined system variables
such as RPM, Speed, Fuel Level etc. The
information read from the OBD2 CAN bus will
also feed the Cello-CANiQ triggering mechanism
enabling the user to build complex criteria for
events generation and outputs activations.
3 Service mode Service mode enables diagnostic tools to be

connected to the OBD2 CAN bus. The unit will
stop all active bus interrogation till it is moved
out of this mode.
Default: 0 - Disable CAN Interface
19.1.3 Enable DTC

Description: When this bit is set the unit will automatically mange the vehicle DTC
(Diagnostic Trouble Codes). The unit firmware will periodically poll for the DTC events
counter. When new DTC event is detected, the event code will be interrogated and sent to
the server using Type 11 module called DTC Module.

0 Disable DTC Disabled
1 Enable DTC Enabled
Default: 0 – DTC Disabled

Manual
19.2 Cello-CANiQ: OBD2 CAN Physical Layer Configuration

Address: 4101
mode.
OBD2 CAN Bus Format CAN Bus Rate
19.2.1 CAN Bus Rate

Description: These 4 bits control the Cello-CANiQ’s CAN bus data rate. Setting the value
to 15 will automatically select the bus rate.
Code CAN Bus rate

0 125 Kbps
1 250 Kbps
2 500 Kbps
3 1 M Kbps
4-14 Spare
15 Auto Rate detect
Default: 15 – Auto Rate Detection
19.2.2 OBD2 CAN Bus Format

Description: These 2 bits control the Cello-CANiQ’s OBD2 CAN bus data format. Setting
the value to 2 will activate automatic OBD2 format detection.
Code OBD2 CAN Bus Format

0 11 bits
1 29 bits
2 Auto OBD2 detection
Default: 2 – Auto OBD2 Detection

Manual
19.3 Cello-CANiQ: CAN Application Control 1

Address: 4102
Description: This parameter contains a bitmap controlling the CAN bus application.
Spare Enable CAN Enable CAN Enable CAN Enable CAN Speed source selection Enable CAN
as as Trip Fuel as VIN as RPM as Fuel
Odometer Consumption Source source Level
Source Source source
19.3.1 Enable CAN as Fuel Level Source AN Bus Rate

Description: Setting this bit enables the CAN interface to function as Fuel Level source.
The CAN interface (OBD2 CAN or J1939) data will be added to the Driver Behavior
statistics to characterize the fuel consumption patterns of the driver.
Code CAN as Fuel Level source AN Bus Rate

0 Disable
1 Enable
19.3.2 Speed Source Selection

Description: These bits select the unit’s speed source. The legacy speed sources
controlled by the unit’s fleet logic are coming from GPS or from frequency meter
connected to the vehicle’s Speed signal. The introduction of CAN interface enables the
unit to replace the traditional speed signal sources with data coming from the CAN bus.
CAN VSS (Vehicle Speed Source) coming from OBD2 or from J1932 can be selected as
unique source for speed. The unit also support automatic selection mode for autonomous
selection of the speed source between CAN and legacy sources.
Code Source Description

0 Legacy speed Source This option uses the legacy speed sources as implemented before
CAN interface was introduced. The legacy sources are speed coming
from GPS or speed coming from the frequency signal meter
connected to the vehicle’s speed source signal;
1 CAN VSS is the speed source The CAN bus (OBD2 or J1939) functions as the unit’s speed source.
The user should note that there are standard VSS (Vehicle Speed
Source) data elements for OBD2 and J1939. When a vehicle doesn’t
support the standard CAN information elements it is possible to
configure non Standard OBD2 queries and to assign the vehicle’s
responses as data feeding the unit’s speed source.

Manual
Code Source Description

2 Automatic selection between Legacy Fleet Automatic selection between Legacy Fleet speed Source and CAN
speed Source and VSS. The unit will automatically select the best vehicle speed source
based on availability and signal quality.
Default: 2 – Automatic Speed Source Selection
19.3.3 Enable CAN as RPM Source

Description: This control bit selects CAN interface (OBD2 or J1939) as the vehicle’s
engine RPM (Revolutions Per Minute) source. The Legacy RPM source is coming from the
unit’s frequency meter connected to the Vehicle’s engine RPM signal source.
Code CAN as RPM Source

0 Disable: use legacy setting
1 Enable: CAN interface is used
19.3.4 Enable CAN as VIN Source

Description: This control bit selects CAN interface (OBD2 or J1939) as the vehicle’s VIN
(Vehicle’s Identification Number) source. Setting this bit to “0” will select preprogrammed
string as the vehicle’s VIN. The preprogrammed VIN is controlled by Type 11 messages
designed to program the VIN to a non volatile memory. When this control bit is set to “1”
VIN will be read from the CAN bus interface.
Code MODE Description
0 Disable The VIN source is the unit’s nonvolatile memory. The

server side can program the unit’s VIN using
dedicated Type 11 messages as described in the unit
wireless communication manual.
Enable The VIN is coming from the OBD2 CAN interface.
19.3.5 Enable CAN as Trip Fuel Consumption Source

Description: This control bit enables the unit to estimate the vehicle’s fuel level based on
periodic fuel consumption measurements sent via the CAN interface (OBD2 or J1939). The
vehicle’s fuel level will be added to the Driver Behavior Trip Statistics as described in the

Manual
wireless communication manual under the CSA section module 32. This estimation
process will be used when the vehicle’s CAN interface doesn’t support generic Fuel Level
information element.

0 Disable Fuel consumption estimation is not used
1 Enable Fuel consumption algorithm is used to estimate the vehicle’s fuel level.
19.3.6 Enable CAN as Odometer Source

Description: This control bit enables the unit to derive it’s odometer from the CAN bus.
If the Vehicle doesn’t support generic Odometer CAN information element, this feature
will estimate the Odometer from the instantaneous speed data elements sent over the
CAN interface. Enabling CAN as Odometer source will be reflected in all fleet’s type 0
outgoing messages in byte number 10, bit number 7. The Odometer value will be added
to the Driver Behavior Trip Statistics as described in the wireless communication manual
under the CSA section module 32.

0 Disable CAN is not used as Odometer source
1 Enable Odometer is derived from the CAN interface.
19.4 Cello-CANiQ: Fuel Tank Capacity

Address: 4103 - 4104
Description: This configurable parameter holds the vehicle’s fuel tank capacity. The
parameter uses 100 mLitter resolution for max possible tank volume of 6553.6 Litters.
This value is used by the unit for converting between relative fuel tank levels, as sent
over the CAN bus, and the real amount of fuel in the vehicle’s tank.
Default: 4000 (40 Litters)
19.5 Cello-CANiQ: Speed Correction Delta

Address: 4105
Description: This parameter represents the difference between GPS speed and the
Vehicle’s speed as read from the CAN interface. Usually the vehicle’s speed measured by
the CAN interface is around 5% lower than the speed measured by the GPS. This
parameter enables the user to adjust the vehicle’s CAN based speed to the GPS by
multiplying the CAN VSS by this signed fraction value. The correction delta represents a
signed value between -127 to 128 with resolution of 0.1%.

Manual
Speed = CAN_VSS * (1+ SpeedCorrectionDelta)

Default: + 50 (+5 %)

Address: 4106
Spare Spare Spare Spare Spare Spare Enable Fleet Enable Fleet
End Of Trip End Of Trip
Emergency Logged
Report Report
19.6.1 Enable Fleet End-Of-Trip Logged Event

Description: This bit enables Fleet Logged End-Of-Trip report. The event is a Type 9
message with new sub type code 0x16 carrying trip related information such as the
Odometer and the fuel consumed during the trip.
19.6.2 Enable Fleet End-Of-Trip Distress Event

Description: This bit enables Fleet Distress (RAM) End-Of-Trip report. The event is a
Type 9 message with new sub type code 0x16 carrying trip related information such as
the Odometer and the fuel consumed during the trip.

Address: 4107
Spare Spare Spare Spare Spare Enable CAN Enable Spare

Bus Events OBD2 CAN
Queries
Status
Events

Manual
19.7.1 Enable OBD2 CAN Queries Status Events

Description: This bit enables the unit to send OBD2 CAN Query status events towards
the server. When the unit acts as OBD2 CAN bus master it actively queries the bus for
predefined information elements, when the bus fails to support or response to these
predefined queries the unit will react by sending dedicated Type 11 status message
described by module number 28 with event category 0 and event code 1. The message
format supports both standard OBD2 information elements and non standard OBD2
queries represented by their index id in the nonstandard queries.
19.7.2 Enable CAN Bus Events

Description: This bit enables the unit to send OBD2 CAN Bus status events towards the
server. the unit will decide if the bus is connected or disconnected to the vehicle based
on the vehicles response to the unit’s queries. The unit will react by sending dedicated
Type 11 status message described by module number 28 with event category 0 and event
code 2.
19.8 Cello-CANiQ: Standard OBD2 Queries Configuration

Address: 4130-4204
Description: This section enables the user to control the OBD2 CAN bus queries
properties. Selected OBD2 CAN queries are arranged in the unit’s memory as table where
each query is represented by its dedicated table index, see OBD2 Queries Table below.
The user can select up to 25 concurrent queries and control their query polling period. The
table below See: StandardOBD2QueriesConfigurationTable describes the space allocated
for Standard OBD2 queries control. Each entry has 3 fields: Control field to enable or
disable the query, Selected Standard PID filed to select the index of the selected query,
and Polling Time field to select the polling frequency.
The user should note that this table is configured by the Programmer Software tool as
part of the CAN properties configuration.

Manual
Start End Control Selected Polling

Standard time
Address Address Byte
PID index 100mSec
( 1 Byte)
(1 Byte) (1 Byte)
0 4130 4132
1 4133 4135
2 4136 4138
3 4139 4141
4 4142 4144
5 4145 4147
6 4148 4150
7 4151 4153
8 4154 4156
9 4157 4159
10 4160 4162
11 4163 4165
12 4166 4168
13 4169 4171
14 4172 4174
15 4175 4177
16 4178 4180
17 4181 4183
18 4184 4186
19 4187 4189
20 4190 4192
21 4193 4195
22 4196 4198
23 4199 4201
24 4202 4204
Standard OBD2 Queries Configuration Table
Index Mode PID Returned Description Variable Name Units Transformation

Bytes
0 1 1 4 Monitor status since DTCs NumberOfPndingDTC Number 1
cleared. (Includes malfunction
indicator lamp (MIL) status (bits A0 to A6)
and number of DTCs.)
1 1 1 4 Monitor status since DTCs MalfunctionIndicatorLam Bool
cleared. (Includes malfunction pStatus
indicator lamp (MIL) status
and number of DTCs.)
2 1 4 1 Calculated engine load value CalculatedEnginLoadVal % X*100/255
ue
3 1 5 1 Engine coolant temperature EngineCoolantTemperat C x-40
ur (–40 °C +215 °C)
4 1 0C 2 Engine RPM EngineRpm RPM x/4
5 1 0D 1 Vehicle speed VehicleSpeed Km/h 1

Manual
Index Mode PID Returned Description Variable Name Units Transformation

Bytes
6 1 0F 1 Intake air temperature IntakeAirTemperatur C x-40 (-4 to 215)
7 1 11 1 Throttle position ThrottlePosition % X*100/255
8 1 21 2 Distance traveled with MILOnDistance Km 1
malfunction indicator lamp
(MIL) on
9 1 6 1 Short term fuel % trim—Bank ShortTermFuelTrimBank % (x-128)*100/128
1 1
10 1 7 1 Long term fuel % trim—Bank LongTermFuelTrimBank % (x-128)*100/128
1 1
11 1 10 2 MAF air flow rate MaflerAirFlowRate grams/se x/100
c (0 to 655.35)
12 1 1F 2 Run time since engine start EnginOnTime Sec 1
(0-65535)
13 1 2F 1 Fuel Level Input FuelLevel % 1
14 1 30 1 # of warm-ups since codes NumberOfWarmupsSinc Number (0-255)
cleared eCodesCleared
15 1 31 2 Distance traveled since codes DistanceSinceCodeClear Km (0-65535
cleared ed
16 1 33 1 Barometric pressure BarometricPressure kPa 1
(0-255)
17 1 3C 2 Catalyst Temperature CatalystTemperature C x/10-40
Bank 1, Sensor 1 Sensor1Bank1 (0-6513.5)
18 1 41 4 Monitor status this drive cycle MonitorStatusThisDriver
Cycle
19 1 42 2 Control module voltage ControlModuleVoltage Volt x/100
(0-65535)
20 1 43 2 Absolute load value AbsoluteLoadValue % X*100/255
21 1 44 2 Command equivalence ratio CommandEquivalenceR
atio
22 1 45 1 Relative throttle position RelativeThrottlePosition % X*100/255
23 1 46 1 Ambient air temperature AmbientAirTemperature C x-40
24 1 47 1 Absolute throttle position B AbsoluteThrottlePosition % x*100/255
B
25 1 48 1 Absolute throttle position C AbsoluteTthrottlePosition % x*100/255
C
26 1 49 1 Accelerator pedal position D AcceleratorPedalPosition % x*100/255
D
27 1 4A 1 Accelerator pedal position E AcceleratorPedalPosition % x*100/255
E
28 1 4B 1 Accelerator pedal position F AcceleratorPedalPosition % x*100/255
F
29 1 4D 2 Time run with MIL on TimeRunWithMILOn Minute 1
(0-65535)
30 1 51 1 Fuel Type FuelType Set See Fuel Type Table
31 1 5E 2 Engine fuel rate EngineFuelRate l/H x*0.05
(0-301.992)
OBD2 Queries Table

Manual
19.9 Cello-CANiQ: Non Standard OBD2 Queries Configuration

Address: 4205-4399
Description: This section enables the user to control the Non Standard OBD2 CAN bus
queries properties. This configuration table supports up to 12 Non Standard queries. The
interface enables detailed defining of the OBD2 Non Standard query and it is associated
with the parser or filter used for the query answer processing.
The user should note that this table is configured by the Programmer Software tool.
Non Standard Entry Start Entry
Entry ID Add End
Add
0 4205 4220 Non Standard Entry 1
2 4237 4252
3 4253 4268
4 4269 4284
5 4285 4300
6 4301 4316
7 4317 4332
8 4333 4348
9 4349 4364
10 4365 4380
Non Standard OBD2 Queries Configuration Table
Each entry in the table has the following structure:

Control Byte Format
Byte Name Manufacturing User defined

Offset Specific Queries
Queries
Filter Index
(128 <Filter
(0-12)
Index < 255)
0 Control Byte
1 Polling time 100mSec Polling time Polling time
If set to 0 query shall behave
like “Not Active"
2 Query Response time out User defined User defined
10mSec resolution Shall not accede 300 Shall not accede
mSec 300 mSec
3 Query ID All zeros User defined
4 Query ID
5 Query ID
6 Query ID
7 Query Data Byte 0 Number of PIDs User defined

Manual
Byte Name Manufacturing User defined

Offset Specific Queries
Queries
Filter Index
(128 <Filter
(0-12)
Index < 255)
8 Query Data Byte 1 Query MODE (SID) User define
9 Query Data Byte 2 PID 1 User define
01 Query Data Byte 3 PID2 User define
00 Query Data Byte 4 PID3 User define
01 Query Data Byte 5 Number of expected

returned bytes PID1
returned bytes PID2
returned bytes PID3
05 ParserID/Filter Index ParserID FilterIndex
(number between 128 0-12
and 255)
(Identifies User
(Identifies configurable
manufacturing queries)
queries)
Non Standard OBD2 Query Configuration Entry
Bit Name Description

0 Query State
0 Not Active
1 Active
1 Spare Request Type (Infrastructure)
2-3 Identifier Extension 0- Global (default, taken from
CanPhysicalLayerConfig )
(Manufecturing mode only)
1- Can 11bits (User defined only)
2- Can 29 Bits (user Defined Only)
4-7 DLC – Data Length User Defined Only
Code Defines the actual number of payload bytes
0-8 ( by default set to 8)
Non Standard Entry Control Byte
19.10 Cello-CANiQ: CAN Bus Filters Configuration

Address: 4400-4399
Description: This section configures the Non Standard CAN bus low level filters. The
filters are used to identify specific incoming CAN messages by their ID and Mask values.
This filter table is designed to intercept J1939 PGNs or OBD2 messages sent from the
vehicle’s bus towards the unit.

Manual
The user should note that this table is configured by the Programmer Software tool.
Filter PL PL Control CAN ID CAN ID/MASK

Index Byte
Address Address 32 bits 32 bits
(1 Byte)
Start End (4 Bytes) (4 Bytes)
0 4400 4408 Control Byte
1 4409 4417
2 4418 4426
3 4427 4435
4 4436 4444
5 4445 4453
6 4454 4462
7 4463 4471
8 4472 4480
9 4481 4489
10 4490 4498
11 4499 4507
12 4508 4516
13 4517 4525
Bit Name Description

0 Filter 0-Filter Disable
Control 1-Filter Enable
1 FilterSize 16 or 32 bits (FSCx: 0=16 bits, 1=32 bits
(Infrastructure)
2-3 Frame format 0-Taken from Global
configuration
1- Can 11bit
2- Can 29bis
4 Id/mask 0-identifier List
1-identifier mask
(FBMx register)
(Infrastructure)
CAN Filter Control Byte Format
19.11 Cello-CANiQ: CAN Trigger Configuration Space

Address: 4530-6500
Description: This section configures CAN triggers. This area is list based data structure
describing the relations between CAN variables (J1939, Standard OBD2 and Non Standard
OBD2), trigger operators and trigger action operators. The data structure shall be
generated by the Cello-CANiQ editor which is part of the Cellocator Programmer.

Manual
20 oneWire Temperature Sensors

The oneWire Temperature Sensors feature enables “new platform” Hw units to be
connected to up to 4 oneWire temperature sensors. The oneWire temperature sensors are
based on Maxims's DS18B20 chip, see:
http://datasheets.maximintegrated.com/en/ds/DS18B20.pdf. The user can connect up to
4 oneWire temperature sensors in parallel. The users need first to enable the oneWire Bus
mode.
OW-TEMP-Bx-xxx
OneWire Temperature
Sensors
DallasBus Cello
Type 0 message includes 4 bytes containing 4 possible measurement sources. The user
can select the source of these 4 bytes by configuring the measurement source as
described in Bytes 26-29 of OTA Message 0. It is possible to select each one of the 4
oneWire temperature sensors as source. If Type 0 measurements are required, the user
needs to configure the “OneWire Update Period” to be none zero value and configure
“Enable RT” or “Enable Logged” configuration bits. See: oneWire temperature
measurement update configuration for more information. The user has also the ability to
poll the unit for measured temperature results by issuing a type 9 request. The unit will
process the request and send a consolidated Type 9 message response with all the 4
measurements. It is mandatory to set non zero “Update Period” to enable the
temperature sensors before issuing Type 9 request. The detailed Type 9 message format
is described in: Cellocator Wireless Communication Protocol: “Section 2.6.21: oneWire
Temperature Sensor Measurement – OutBound (Sub. Data 0x19)” and section
3.6.15: oneWire Temperature Sensor Measurement Request– InBound (Sub. Data 0x19)
The feature supports different “Update Periods” for GSM Home and Roam network. When
both “update Periods” values are set to 0, the feature is considered disabled.

Manual
20.1 oneWire Temperature Measurement Update Configuration

Address: 2459: Home Network
2460: Roam Network
mode.
Configuration Byte Format:
Update period Enable Enable

RT logged
0– 0–
disable disable
1- 1 - enable
enable
Bit Bit Bit Bit Bit Bit 2 Bit 1 Bit 0

7 6 5 4 3
Configuration Byte Modes:
Update Enable Enable Description

Period RT Logged
0 0 0 The Feature Is Disabled
0 0 1
0 1 0
0 1 1
≠0 0 0 The Temp. Sensors are polled in the rate defined
under: “Update Period”. Messages are not sent
autonomously. The unit will answer Type 9
measurements requests.
under: “Update Period”. Only logged Temp.
Measurements are transmitted. The unit will
answer Type 9 measurements requests.
under: “Update Period”. Only RT Temp.
under: “Update Period”. Both RT and Logged
Default: 0 - Feature Disabled

Manual

Manual
21 GNSS External/Internal Antenna (Only GNSS)

Cello-IQ Hw Units supporting GNSS (Global Navigation Satellite System) can
automatically select between External and Internal Antenna based on user configurable
parameters and GNSS reception quality. The block diagram bellow shows the inputs
affecting the decision logic which includes the current Antenna selection state, The GNSS
Fix status and the configuration. The decision logic implemented as state machine will
select the best antenna source. It is also possible to disable one of the possible antenna
sources. The GNSS configurable parameter define the no-fix timout for moving between
External and Internal GNSS Antenna sources.
GNSS Internal/External
GNSS navigation Antenna state
fix start_stop machine
filter GPS antenna
control
Engine ON
GPS antenna
state
PL parameters
Summary of configurable states:
External no-fix- Internal no-fix- Decision

time time
0 0 Fixed on internal antenna only
0 Non-Zero Fixed on internal antenna only
Non-Zero 0 Fixed on External antenna only
Non-Zero Non-Zero Default (initial state of) antenna will be the
External
21.1 GNSS Internal Antenna No-Fix-Time Timeout (GNSS

Variants only)
Address: 0d518
Description:
Internal no-fix-time:
Time in seconds, 0=Disable , Minimum value = 40 Sec , default = 0 (disable)

Manual
21.2 GNSS External Antenna No-Fix-Time Timeout (GNSS

Variants only)
Address: 0d518
Description:
Internal no-fix-time:
Time in seconds, 0=Disable , Minimum value = 40 Sec , default = 0 (disable)

Manual
22 Auxiliary Satellite Unit

Compatibility: GNSS units support this feature natively and CR300 units (starting 41x
firmware) as an optional feature.
This feature enables an auxiliary satellite communication device to be activated when the
Cello unit losses GSM or GPRS connectivity. The Auxiliary Satellite unit could be activated
in two operational modes:
Basic Auxiliary Satellite Mode:
In this mode the Cello unit turns on the Auxiliary Satellite modem when “No GSM” or "no
GPRS" condition is detected. In this mode the Auxiliary Satellite modem autonomously
generate location events based on its embedded GPS. The Auxiliary Satellite Modem will
be turned off, and control will be moved to the GSM network when the Cello unit detects
GSM or GPRS network connectivity.
The "Blinkers" output control the Auxiliary Satellite device. While Cello or CR300/B is
hibernating, its auxiliary satellite device will be turned off. The end unit will automatically
turn the auxiliary unit on when GSM or GPRS is lost for the time defined in section 22.1.1.
The Cello unit will automatically turn off the auxiliary unit when GSM or GPRS is restored
for at least the time defined in 22.1.2.
Advanced Auxiliary Satellite Mode (Infrastructure, currently not implemented):
The advanced Auxiliary Satellite support uses the Auxiliary Satellite unit as an alternative
path for communication with the server. Unlike the basic mode, the advanced mode will
send the legacy Cellocator messages via the satellite link to the server. The messages
sent over the satellite communication link are stored into the Satellite service provider
server’s data base and sent via the internet to the fleet management server.
Both Basic and advanced Satellite share the same criteria for declaring “GSM / GPRS
Loss” and “GSM / GPRS reconnect”. The feature's configurable options include timeout
values defining "GSM loss" and "GSM reconnect" timeouts. Both values must be Non Zero
for the feature to be operational.
22.1 Auxiliary Satellite: Cellular network connect-reconnect

criteria
Address: 650: Bit 0

Description: This bit defines the criteria for declaring cellular network availability.
Setting the bit to 0 (GSM) will switch the unit to Satellite mode when GSM network is not
found. Setting the bit to 1(GPRS) will switch to Satellite mode when GPRS network is not
found (while GSM might be available).
0-GSM
1-GPRS

Manual
22.2 Falling Back to Satellite
22.2.1 Auxiliary Satellite: No GSM-GPRS Timeout (Basic, Advanced)
Address: 1345: Bits 0-3

Description: This configurable parameter defines No-Cellular network time criteria for
the unit to switch on its auxiliary satellite device. The NO-Cellular configurable timeout
has configurable resolution of 0.5 or 16 minutes per bit. The configurable parameter must
be non-zero for the feature to function.
This parameter is common for both Basic and Advanced Auxiliary Satellite modes.
Default value: 0 – Feature Disabled
NOTE: Please note that when the “Auxiliary Satellite Unit- Cellular network connect
reconnect criteria” (Add. 650, Bit 0) is configured for “GPRS”, the minimal value must be
2 (1 Minute).
22.2.2 Auxiliary Satellite: Timeout Resolution for No GSM-GPRS
Address: 650, Bit 1

Description: This parameter defines the resolution for NO GSM-GPRS Timeout.
Auxiliary Satellite Unit - Timeout Resolution

resolution for No GSM
(Address 650, Bit1)
0 30 Seconds
1 16 Minutes
Default value: 0 – 30 Seconds
22.3 Restore Cellular
22.3.1 Auxiliary Satellite: GSM-GPRS Reconnect Timeout (Basic,

Advanced)
Address: 1345: Bits 4-7

Description: This parameter defies the criteria for declaring Cellular network as restored.
This configurable parameter defines the "Cellular Network Reconnect" timeout in
programmable resolution (0.5 minutes o16 minutes). The configurable parameter must be
non-zero for the feature to function.
This parameter is common for both Basic and Advanced Auxiliary Satellite modes.
Default value: 0 – Feature Disabled

Manual
22.3.2 Auxiliary Satellite: Timeout Resolution of GSM-GPRS Reconnect
Address: 650, Bit 2

Description: This parameter defines the resolution for NO GSM-GPRS Timeout.
Auxiliary Satellite Resolution

Unit- Timeout
resolution for No GSM
(Address 650, Bit1)
0 30 Seconds
1 16 Minutes
Default value: 0 – 30 Seconds
22.4 Satellite Control Bitmask

Address: 650
Reserved Auxiliary Reserved Reserved Auxiliary Timeout Timeout Auxiliary

Satellite Satellite resolution of resolution for Satellite
Unit- Unit- Enable GSM-GPRS No GSM- Unit- Cellular
Satellite Periodic Reconnect GPRS network
Operational Distress connect
Mode Events reconnect
0-Basic 0-Disable criteria:
0-GSM
1- 1-Enable
Operational 1-GPRS
Default value: 0 – GSM
22.4.1 Auxiliary Satellite Unit- Enable Periodic Distress Events
Address: 650: Bit 3

Description: When the unit is in Advanced Satellite mode and NO GSM condition is
detected and this bit is enabled, the unit will start sending periodic Distress events with
Transmit Reason 44 (Timed Event). If the unit is in hibernation, the periodic distress will
turn on the Auxiliary Satellite for a distress transmission session. The Period between the
Distress Event is defined in the parameter: Auxiliary Satellite Unit- Periodic Distress
Report Period, Address 656.
Default value: 0 – Disabled

Manual
22.4.2 Auxiliary Satellite Unit - Satellite Operational Mode
Address: 650: Bit 6

Description: This bit defines the Auxiliary Satellite Operational mode. The bit selects
between Basic and Advanced mode. The basic mode only turns the Auxiliary Satellite unit
on while the advanced mode uses the satellite unit as an alternative transmission channel
to the fleet server.
0-Basic Satellite Mode
1-Advanced Satellite Mode
Default value: 0 – Basic
22.4.3 Auxiliary Satellite Unit - Periodic Distress Report Period
Address: 656:
Description: This parameter defines the period between Periodic Distress Events. This
parameter is only relevant when: Auxiliary Satellite Unit - Enable Periodic Distress Events
is enabled.
Resolution: 30 Seconds
Default value: 10 – 5 Minutes

Manual
23 Driver Behaviour
23.1.1 Driver Behavior (CSA) Disable
Address: 1350: Bit 7

Description: When this bit is set in Cello-IQ variants (Cello-IQ and Cello-CANiQ) the
driver behavior will be completely disabled.
Data format: 0 – Driver Behavior Enabled, 1 – Driver Behavior Disabled.
Default value: 0 – Driver Behavior Enabled

Manual
24 CelloTrack Nano
24.1 Overview
The CelloTrack Nano is an asset tracking solution, aimed at addressing the growing
market of small assets management and cargo delivery and expanding the target markets
to which the CelloTrack family applies: cargo tracking applications, smaller assets and
high value mobile equipment, shorter tracking periods, as well as lone worker and lost
child scenarios.
The target asset types are cargo boxes, airborne containers (temperature controlled or
regular), cargo pallets, small size high-value assets (such as machines and small
generators), high value suitcases and equipment (such as art, medical), and so on.
Target applications may include inventory management throughout short/mid-term Track
& Trace, shipment and distribution management, security (anti-theft), protection (anti-
vandal, break-in detection) and more.
The CelloTrack Nano can interface via a short-range RF link to multiple peripherals called
"MultiSense" devices, which acts as Wireless Sensors Network (WSN). Read more about
MultiSense devices in section ‎25.
The CelloTrack Nano inherited all CelloTrack-T functionality and added new functionality
described in this section. For further information about the product, please refer to the
CelloTrack Nano Product Overview document.
SR-RF links MultiSense

(Remote sensor with short-
range RF communication)
MultiSense
Cellular link
CelloTrack range RF communication)
Nano
(with its internal sensors)
MultiSense
range RF communication)

Manual
24.2 User Interface – Buttons, LEDs and Buzzer
24.2.1 Buttons
24.2.1.1 General
Each press on a Nano button when the unit is active activates a short audible beep by the
buzzer (if enabled accordingly; read more about this setting here).
24.2.1.2 Right Button
!
The right button, marked " ", when pressed for 2 seconds or more (even if not released),
followed by engagement feedback (buzzer and/or LED - configurable here and here),
generates a panic event which will be sent to the server. An ACK sent by the server will
generate another reception feedback – which is configurable here.
24.2.1.3 Left Button

This button has no related configuration parameters but is mentioned here anyway, just
to give the full scope of the buttons in the CelloTrack Nano.
The left button, marked " ", when pressed for less than 3 seconds, will open the
configurable size indication time window.
In addition, this button is turning the unit ON and OFF:
Turn ON: Press 3 seconds while turned OFF. After that the system will self-test, as
described here.

Manual
Turn OFF: Press for 5 seconds while turned ON. At the end of that period, the turning
ON/OFF occurs even if the button is not released.
24.2.1.4 Check-in Function

Pressing simultaneously (with ~200mS tolerance) on both buttons for at least 1 second
(and less than 5 seconds), followed by a 0.5 second buzzer beep for every elapsed second
(if enabled, as described here) and/or LEDs feedback (as configured here), transmits the
current location once.
It is also related to set the baseline reference accelerometer position of the man down
feature detailed here.
24.2.1.5 MultiSense Pairing Feature

Pressing simultaneously (with ~200mS tolerance) on both buttons for more than 5
seconds will initiate the MultiSense in-field pairing process. See more details in section
‎25.2.4.
24.2.2 LEDs
24.2.2.1 Left LED
The left LED, marked " " and " ", gives indication of the power/battery and
deviations (as described here).
When the unit is turned ON, or a short press is made on the left button (shorter than 5
seconds), or following reset command, (also see section ‎24.2.1.1), all the following LED
indications are restarted according to the "Indications time window" parameter described
here.
Battery status: When the unit is turned ON, short blinks of 100mS every X seconds show
the battery status, according to the following legend:
Battery is 50-100% - Green:
█__________________█__________________█__________________█_...
Battery is 20-49% - Orange:

█__________________█__________________█__________________█_...
Battery is 0-19% - Red:

█__________________█__________________█__________________█_...
Out of range (deviations alert) indications:

When the unit is turned ON, or a short press made (shorter than 5 seconds) on the left
button, only the most severe indication from the following list is displayed once, if that
violation/deviation still exists.

Manual
When any sensor creates an out-of-range (alert) event, and if enabled by the bit in this
configuration area, the left LED will signal a 3 second long continuous (once) or non-
continuous pulse according to the following color scheme:
Light sensor out of range: __████████████████___
Accelerometer out of range: __████████████████___
Temperature out of range: __████████████████___
Geo-fence violation: __█████_█████_█████___
"Light sensor out of range" means the light level of the local sensor crossed the
"open/close package threshold" event.
"Accelerometer out of range" means an orientation change event only.
"Temperature out of range" means the local temperature sensor is either above the upper
TH or below the lower TH.
"Geo-fence violation" means all the possible kinds of violation supported and defined in
the legacy version.
The priority in case more than a single sensor is out of range or deviated: from bottom to
top (geo-fence is the highest priority, going down to light sensor which has the lowest
priority). After that the lowest priority is for the battery status indication mentioned at the
beginning of this section.
In general, switching between different indications is done without any gaps/delays so
they look continuous (overlap).
The non-continuous pulse is: 800mS ON, 300mS OFF, 800mS ON, 300mS OFF, 800mS
ON (once and every time a button is pressed).
All these out-of-range indications are displayed only for the "Indications time window".
This time window also restarts after the left button is pressed again (as described here).
After that they are cleared (turned OFF).
See also the configuration bits described here that enable each sensor out-of-range
indication on the LED.
Charging indications:
When the micro-USB connector is plugged-in and charging is in progress, whether from
the charger (AC wall adaptor) or PC, the left LED will act as described in the following
table.

Manual
Unit mode: OFF (inactive) ON (active)

During actual charging Constantly orange Constantly orange
Inside the "Indications time Regular LEDs indications
After charge
window"
completion Constantly green
After (outside) the "Indications Constantly green
time window"
Battery Fault Constantly red Constantly red
These indications have the highest priority and they override all other indications on this
LED.
24.2.2.2 Right LED
The right LED is marked "GPS" and " ".

This LED has two time slots of 5 seconds long each; the first one is for indications from
cellular modems (in green) and the second one is for GNSS module indications (in
orange).
Each pulse is 500mS ON and 500mS OFF.
Cellular modem indications:
HSDPA/HSUPA (3G) communication:
██________________________________________________________|
GPRS/EDGE communication:
██___██__________________________________________________|
Registered (GSM-2G):
██___██___██____________________________________________|
Not registered (no activated network found):
██___██___██___██______________________________________|
GNSS module indications:

Tracking good (Fix "Tight"):
██________________________________________________________|
Tracking poor (Fix "Plain"):
██___██__________________________________________________|
Acquisition (from power-up to "Plain" or "Tight"):
██___██___██____________________________________________|
No satellites at all ("no fix" after fix), only at the first operation and cannot be reached if
using A-GPS:
██___██___██___██______________________________________|
For example the light for a GPRS communication and good tracking will look like the
following:
█_█___________________█______________________█_█___________________█__…

Manual
--------5Sec--------
All these indications are only displayed for the time set in the "Indications time window".
After that they are cleared and not displayed.
24.2.3 Buzzer
24.2.3.1 Definitions
Buttons feedback beep = 20mS ON |
Short beep = 200mS ON ██
Dual short beeps = 200mS ON, 200mS OFF, 200mS ON ██___██
Dual long beeps = 1 Sec ON, 200mS OFF, 1 Sec ON █████████___█████████
Long beep = 2 Sec ██████████████████
24.2.3.2 Buzzer Logic

Upon power-up (turning ON) or system reset from any reason: short beep.
After a successful BIST process: dual short beeps.
If enabled here, every valid pressing on the buttons will sound the "Buttons feedback
beep" (20mS).
If enabled here, Panic /Check-in event activation operates the beeps, as explained in
section ‎24.2.1.5.
If enabled here, after a Panic (special distress) event is acknowledged by the server:
long beep.
Dial-in feature: In lone worker scenarios, some ringing from the unit buzzer may be
needed, to catch the worker’s attention. If enabled here, when the modem receives a
ring/s for a voice call, it rings with its buzzer for 4 seconds and then stops, according
to the ring beeps pattern described above.
If enabled here, when any active sensors go out of the defined limits (all meanings of
the "out-of-range" are explained here), plus geo-fences (all legacy violations related
to geo-fences are relevant here too), the unit shall sound short beeps every
configurable time if the "Indications time window" defined here is open/active.
If enabled here (bit 5), a short beep is sounded upon any power-up packet received
from a paired/preregistered MultiSense.
‎ 4.2.1.5.
See SR-RF pairing (and un-pairing) process related beeps in section 2
If any overlap of beeps should occur, the buzzer shall be activated on an OR basis,
meaning the actual sound should be a superposition of all signals together.

Manual
24.2.4 Indications after Power Up (Built-In Self-Test)

The unit shall perform a Built-In Self-Test (BIST) upon any of the following cases:
When battery is connected, while the system was active before disconnection.
After turning ON (moving unit from inactive to active mode, at the end of the 3 second
press duration).
Upon receiving a reset command.
The Built-In Self-Test (BIST) includes GNSS module, Cellular modem basic (local)
communication and confirmation a SIM and battery exists.
The indications look like the example below for the first 5÷10 seconds only, on the right
LED:
Turning ON press feedback from the buzzer:
█______________________________________________________..._...|
If all tested component are OK:
|________________________________________________________██
and on the buzzer:
█______________________________________________________█_█
GNSS module failure (Basic communication):
|__________________________________________________██___██
Cellular modem failure (Basic communication + SIM card valid):
|____________________________________________██___██___██
Battery failure:
|______________________________________██___██___██___██
---------------------first 5÷10 Sec after turn ON---------------------
‎ 4.2.3.1.
Short beep and dual-short beeps are defined in section 2
The priority of failures is in descending order, battery being the highest. And only the
highest priority is displayed.
Timing is 500mS ON and 500mS OFF.
All buttons are blocked/ignored during the entire BIST period.

Manual
24.3 System Modes
24.3.1 Improved Tracking Mode

In this mode, the Nano adds the extra take locations between transmissions.
Since the entire system is hibernating most of the time, the battery life is prolonged.
Refer to the external battery life calculator for more details.
In this mode, the unit uses an improved glancing of not-live-tracking related to the legacy
mechanism:
Samples its sensors according to the table below and logs them efficiently. Look for
distress (critical) events (such as tamper, sensor reading crossed some predefined
critical threshold) to report them immediately.
Takes GNSS locations extra configurable times a day and logs them internally as
Type-0 and/or type-11 with the same message but encapsulated, as mentioned in the
Wireless Protocol document, depending on the configuration bits in PL address 603,
bits 0-1, as defined here.
GNSS and cellular modems are also activated upon distress event occurrences to
immediately report the position of the event. A transmission is sent even if the GNSS
has not got a fix after the timeout. As with the legacy version, if no fix is reached the
Cell-ID transmission logic is used.
The GNSS module is shut down, disregarding any applicative constraints to preserve
energy.
Turns on the cellular modem and transmits to the server, which is configurable in the
GSM Peeking – Modem Off time parameter, including the logged positions,
measurements and events.
For all cellular transmissions, the entire log memory is transferred/uploaded, and then
cleared upon an ACK from the server. In case there is no ACK or no link, it acts as per
the legacy behavior.
At all other times, the main MCU is sleeping (hibernating). During these times, the
"Hibernation Mode Delay" parameter is maintained (the default is 2:40 minutes).
GSM periodic
glancing
GNSS peeking
(legacy)
Nano take location interval Nano take location interval

GNSS peeking
(improved
modes)
Extra GNSS
peeks and log it
Sensor name Sampling rate Comment

All power sources, light sensor, 1 Second
battery NTC and other analog
inputs
Accelerometer 1 Second

Manual
Sensor name Sampling rate Comment

Accurate temperature Defined according to this and In Nano 20 only
this parameters
Barometer/Pressure 1 minute In Nano 20 only
24.3.2 Improved Tracking with POD Mode (Infrastructure)

This mode, which will be supported in the 2nd phase of the project only, is the same as the
regular improved mode, except the Nano is also addressable and available for
communication at all times.
The battery life is much shorter in this mode. Refer to the external battery life calculator
for more details.
24.4 The Layers Concept

Layer-0: The HW and FW layer
The FW activates the HW to sample the various sensors of the system every predefined
time.
Some of the sensors’ sample rates are configurable and some are constant (i.e.
hardcoded).
The samples always occur and are not conditional.
Layer-1: The periodic glancing layer

Only when the unit is not moving (aka stationary state, "hibernating"), or ST glancing:
Periodic glancing as defined in legacy (refer to the CelloTrack-T).
According to a specific time of day (aka "ST glancing", see legacy).
In every transmission the unit will transmit its location and the last sample of all
sensors in the system.
There is some ratio between location and full sensors glancing, as described in section
‎24.3.1.
Layer-2: Movement related events

When the unit is moving (in motion state, i.e. ignition-ON state):
Legacy capabilities of offline and online tracking (in future powered variants)
including:
 Time events
 Distance events
 Speed events
 Geo fencing
 Curve smoothing

Manual
Layer-3: Sensors layer (data logging)

For each supported sensor, the user is able to determine:
The applicative sampling/logging rate (if applicable)
Monitoring rules (what triggers an event)
Feedback rules (buzzer and LEDs activation patterns)
Data upload rules
24.5 USB
24.5.1 Usage
Micro-B female USB connector, through which the unit can perform the following
functions:
Charge the internal battery from the supplied AC-adaptor or PC USB port.
Interface via PC USB port for configuration.
Interface via PC USB port for firmware updating.
24.5.2 Charging Speed

The internal charger supports 2 charging speeds:
The slow speed is used when the unit recognizes the source as "weak", such as a USB
1.0 PC port, weak AC-adaptors or weak car-adaptors. The charging current in this
case is ~100mA so a complete charge can sometimes take more than 10 hours.
The faster speed is automatically chosen when the source is recognized to be able to
supply enough current. The charging current in this case is ~330mA, so a complete
charge will take less than 5 hours.
24.5.3 Charging Modes

The unit has 2 modes of charging:
FW controlled: The Nano FW decides when to start and stop charging. It charges the
battery to a certain hardcoded high-level charge point (e.g. 90%) and then lets the
battery be consumed to the level of a hardcoded low-level charge point (e.g. 75%)
before another charge cycle is started. In this way, the battery oscillates between
90% and 75% forever and the left LED toggles between green and yellow forever.
To set this mode, set the parameter of "Charging Stop upon Battery Full detection" to
"Stop charging".
This mode of operation is more suitable for constantly powered systems and it keeps
the battery healthier in the long run.
HW controlled: The charger chip decides when the battery has reached full charge
(100%) and then stops charging it. Indication on the left LED turns from orange to
green. This operation is restarted every 5 hours.
To set this mode, set the parameter of "Charging Stop upon Battery Full detection" to

Manual
"Keep charging".
This mode is more suitable for systems that get charged from time to time, but the
system is not powered constantly.
24.6 Sensors
HW Block Accelerometer Ambient Pressure Accurate Humidity Sensor (of
Light Sensor Temperature the MultiSense)
Function
Sensor Sensor
/Feature
Tilt tamper X
Orientation change X
Man-down X
Motion vs. stationary X
Report on absolute orientation X
Open/Close package X
Altimeter X
Temperature /Humidity
X X
measuring and logging
24.6.1 Use of IIR Filters

The IIR (infinite impulse response) filter used in many points in the design acts according
to the following formula:
Upon power-up/reset/init the Sum gets an initial value of: Sum0  Sample0 x Factor
The Avg, which is actually the filtered value, is always: Avg = Sum/Factor
After the initiation point on each sample: Sumn =Sumn-1 – Avg + samplen
In this way, the actual time that will take the filtered value (Avg) to get from a certain
steady-state value to some TH level is a function of start-point, end-point and the
programmed factor.
24.6.2 Accelerometer
The accelerometer sensor is sampled once every second, and in addition it gives
interrupts to the Nano when it has an impact larger than the following preconfigured
threshold.
The reported impacts create impact events if enabled in the following mask here.
The sampled X,Y,Z value of the current acceleration are filtered (by IIR filter) and taken
to calculate the RMS value, and roll and pitch angles. From these values it can derive a
variety of features and links to their programming parameters:
Tilt tamper
Orientation change
Man-down
Detection when the unit is in motion and when it is stationary. As this is legacy
behaviour, see more details in section ‎6.1.15 above.

Manual
Reports on the absolute orientation at every transmission in both type-0 and type-11.
24.6.3 Ambient Light Sensor (ALS)

This sensor is used mainly to know if the package that holds the unit inside is closed
(dark) or open (with some light).
The light sensor is sampled once every second and filtered by a configurable IIR filter.
The filtered level is compared against the configured threshold and if events are enabled
here or here the unit creates open package or closed package events respectively.
24.6.4 Pressure Sensor (Altimeter)

The air pressure is measured every 1 minute, and is filtered and converted (by the chip)
to meters.
The unit reports this value on every type-0 (at 32m resolution) and type-11 (at 0.1m
resolution) transmission.
24.6.5 Accurate Temperature Sensor

This ±1°C accuracy sensor is sampled according to a configurable rate when it is within
the configured limits and according to other configurable rate when out those limits for
more than this time.
‎ 4.9.10.
See more details under section 2
24.7 SR-RF functionality

SR-RF (Short-Range Radio-Frequency) is described in detail in section ‎25.
24.8 Communication Protocols

Communication protocols and concept are all described in the Cellocator Wireless
Communication Protocol document.
24.9 Parameters Descriptions and Notes
24.9.1 Nano Take Location Interval
Address: 2039 – (LSB)

2040, bits 0-5 (MSB)
Description: The unit performs an extra "take location" between 2 consecutive cellular
transmissions and logs them.
This interval is from the last fix or timeout of "Max GPS on time", and it is parallel to the
legacy "GPS off time" parameter.
Manual
GSM periodic
glancing
GNSS peeking
(legacy)
Nano take location interval Nano take location interval

GNSS peeking
(improved
modes)
Extra GNSS
peeks and log it
Resolution: 1 minute
Data format: 14 bits
Data range: 1÷16383 (0=Disable extra peeking = same as legacy)
Default value: 0x168 = 360 = 6 hours
24.9.2 System Mode
Address: 2040 bits 6-7

Description: This sets the Nano’s main mode.
This system mode configuration is stronger than the configuration in the legacy "Enable
live Tracking" bit.
Value Unit mode
00 Tracking legacy
01 Tracking improved
10 Reserved
11 Reserved
‎ 4.3.1.
Default value: 01 = 1 = Tracking improved. See more details about this mode in 2
24.9.3 Legacy Events Type-11 Configuration
First refer to the messaging concept described in section 5.1 of the Cellocator Wireless
Communication Protocol document.
Addresses 540÷603 are allocated to contain a total of 512 bits, 2 bits for each one of
the 256 possible transmission reasons of type-0 legacy events.
This enables the configuration of each transmission reason to be also sent over type-11
messages (if enabled, and regardless of type-0 legacy event configuration) as a Logged
Event, as an "Active Log event" or as both, in the following way:

Manual
Address 540:
7 6 5 4 3 2 1 0
TR=3 TR=2 TR=1 TR=0
Logged "Active log Logged "Active log Logged "Active log Logged "Active log
event" event" event" event"
…
And so on….till:
Address 603:
7 6 5 4 3 2 1 0
TR=255 TR=254 TR=253 TR=252
Logged "Active log Logged "Active log Logged "Active log Logged "Active log
event" event" event" event"
Default value: all zeroes (Disabled)

These fields can only be edited in the specialized table in the Cellocator Programmer tool.
Only relevant transmission reasons will appear in the table, all according to the table in
section 2.2.3.11 of the Cellocator Wireless Communication Protocol document.
24.9.4 Tilt Tamper
In order to detect detachment of the Nano unit from the installation surface (along with
its cradle or when installed without a cradle), a tilt-tamper mechanism can be used.
When orientation (by earth gravity) on each axis changes more than the configured angle
threshold when compared to the steady state for a longer time than the configured timer
threshold, the unit will report it.
When a tilt tamper event is created, there is no other such event until the system has stabilized.
24.9.4.1 Tilt Tamper Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the tilt-tamper
feature.
Tilt-tamper messaging Reserved
Type-11 Type-0
Logged "Active log Logged Distress
event"
Bit 7 Bit 6 Bit 5 Bit 4 Bits 0-3
Default value: 0x00 = All disabled

Manual
24.9.4.2 Tilt-Tamper Angle Change Threshold
Address: 2045
Description: Tilt threshold in degrees.
Resolution: 0.588º
Data format: 1 byte
Data range: 0÷255 = 0.588º÷150º, (0=Disable the entire feature; the recommended
range is 30º÷100º)
Default value: 0x4D= 77 = 45.276º
24.9.4.3 Tilt-Tamper Time Filter

Description: Tilt time filter.
Data format: 4 bits
Data range: 0÷15 Seconds (0=Disable the entire feature)
Default value: 0 = Disabled
24.9.5 Accelerometer Based Impact / Free-fall Detection
Used in order to detect harsh and dangerous incidents such as crashes, haphazard
loading/unloading, and breaching attempts.
It is based on the inherent interrupt mechanism (of the accelerometer chip) for
acceleration passing a certain threshold. Either upwards (usually >1.5g), which is
considered an impact, or downwards (usually < 0.5g), which was probably caused by a
free-fall incident.
This impact or free-fall is configurable by a PL bit in the MultiSense, and fixed to impact
only in the Nano itself. In phase 2, the Nano will also support the same configuration bit
and free-fall feature (Infrastructure).
When the acceleration reading is higher than the configurable threshold, at any axis, for
more than the configurable time, it is considered an impact event and the chip will
generate an interrupt.
If enabled (see below), it is reported via the cellular link along with the peak RMS
acceleration magnitude of that incident.

Manual
24.9.5.1 Accelerometer Impact/Free-fall Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the Accelerometer
impact/free-fall feature.
Accelerometer impact/free-fall messaging Reserved
Type-11 Type-0
event"

NOTE: If none of these bits are enabled, then the entire feature is disabled.
24.9.5.2 Accelerometer Impact Threshold

Description: Nano impact threshold.
Resolution: 63mg
Data format: 7 bits, decimal value
Data range: 0÷127 = 0÷8g
Default value: 0x20 = 32 = 2.016g
24.9.5.3 Accelerometer Impact Time Filter

Description: Nano impact time filter.
Resolution: 1 ODR cycle (=20mS)
Data range: 0÷63 ODR cycles = 0÷1260mS
Default value: 0x04 = 4 ODR cycles = 80mS
24.9.6 Orientation Change

This feature can be used to detect rollover situations, where the tracked asset is rolled on
one of its sides or upside down.
When the earth-gravity is moving more than the configured angle threshold, it shall be
considered as an "Orientation change" event.

Manual
24.9.6.1 Orientation Change Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the Orientation
change feature.
Orientation change messaging Reserved
Type-11 Type-0
event"
24.9.6.2 Orientation Change Threshold
Address: 2051
Description: When the earth-gravity is moving more than this angle threshold, it shall be
considered as an "Orientation change" event.
Resolution: 0.588º
Data format: 1 byte, decimal value
Data range: 0÷255 = 0.588º÷150º (0 = Disable the entire feature)
Default value: 0x4D = 77 = 45.276º
24.9.7 Man-down
The "Check-in" operation fixates the 3 axis accelerometer values as a baseline reference.
During the 24 hour time-window after the "Check-in" operation, or until a man-down
alarm is declared (an event was created, which can happen only once per check-in press),
changing the unit orientation value above the threshold (in each axis, separately) related
to the fixated baseline orientation will initiate a "Man down" event.
24.9.7.1 Man-down Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the Man-down
feature.
Man-down messaging Reserved
Type-11 Type-0
event"

Manual
24.9.7.2 Man-down Threshold
Address: 2054
Description: When the earth gravity is moving more than the defined angle threshold, it
is considered a "Man down" event.
Resolution: 0.667º
Data range: 0÷255 = 0.667º÷170.085º (0= Disable the entire feature)
Default value: 0x43 = 67 = Tilt angle of 44.689º
24.9.7.3 Man-down Time Filter

Description: Man-down time filter, after which the event is created.
Data range: 2÷63 Second (0 or 1 values are illegal and should not be set)
Default value: 0x05= 5 = 5 Seconds
24.9.8 Package Open/Close Events
This feature is based on a light sensor and a filter.

After a stable amount of time in low-light state (below the configured threshold), the unit
triggers a "Package closed" event.
In this state, any sudden increase of light level higher than the intensity thresholds and
longer than the configured time, triggers a "Package opened" event.
24.9.8.1 Open Package Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the open package
feature (for both Nano and MultiSense).
Open package messaging Reserved
(for both Nano and MultiSense)
Type-11 Type-0
event"

Manual
24.9.8.2 Close Package Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the close package
feature (for both Nano and MultiSense).
Close package messaging Reserved
(for both Nano and MultiSense)
Type-11 Type-0
event"
24.9.8.3 Package Open/Closed Light Threshold
Address: 2058
Description: When the filtered light level crosses this threshold upwards, it will be
considered a "Package open" event. When the filtered light level crosses this threshold
downwards, it will be considered a "Package close" event.
Resolution: 2.5 lux
Data range: 0÷255 = 0÷637.5 lux
Default value: 0x04 = 10 lux
24.9.8.4 Package Open/Closed Filter Factor

Description: This is the IIR filter convergence coefficient. Low values will give a faster
response than higher ones.
Data range: 2÷63 Second (0 or 1 values are illegal and should not be set)
Default value: 0x02 = Fastest response

Manual
24.9.9 Analog Source Selection
One of the measured sensors can be selected and routed to one of the type-0 legacy
analog channels.
Note that only a single Nano source and type can be selected.
The selection is done by the following 2 selector parameters, the Source of measurement
and Sensor type, see below.
24.9.9.1 Source of Measurement
Address: 2064
Description: This is the ENUM of this field:
0x00÷0x0F – MultiSense unit (according to its location in the PL, whether
occupied/enabled or not)
0xFC – Guest MultiSense (not in the list)
0xFD – High accuracy or specialized sensors of the Nano 20 (for example: Accurate
temperature sensor, pressure sensor, etc)
0xFE – MCU internal (temperature only)
0xFF – Reserved
Default value: 0xFD = High accuracy or specialized sensors of the Nano 20
24.9.9.2 Sensor Type
Address: 2065
Description: This in the ENUM of this field:
0 = Reserved
1 = Temperature
2 = Humidity (MultiSense only)
3 = Pressure (Nano only)
4 = Ambient Light Sensor (4 lux resolution)
NOTE: All units and resolutions are the thin (8-bit) versions as used in type-0.
Default value: 0x01 = Temperature
24.9.10 Temperature and Humidity Measurements

The unit has a buffer, which is divided equally between the existing (defined in the PL)
channels.
There are up to 33 queues in a system; each queue shall contain up to 48 samples.
The multiplication of number of samples and number of queues shall not exceed 1155.

Manual
Examples:
Full system (16 humidity sources + 17 temperature sources), each queue will be 35
samples.
10 temperature sources, each queue will be 48 samples.
13 humidity sources + 14 temperature sources, each queue will be 42 samples.
CelloTrack nano
M.S= MultiSense
M.S
Q1
1
M.S
Q2
2
Log
Wrapping
& Logging
machine
M.S Tx
Q16
16
Flash mem.
10K Events log mem.
Nano
Q17 (Also cyclic)
inherent
Total of 1155 samples

in the cyclic buffers
Each source has its separated state machine, and each buffer includes records and
header.
IMPORTANT: If a specific channel is not configured correctly and/or has illegal values,
for example:
The lower-TH is higher than the upper-TH
Out of range values
Sampling rate or sampling during violation zeroed

Manual
Alert time is less than one sampling time

In such cases, the system will ignore this channel completely: no events, no logging and
no transmissions will be sent.
If the Alert time is more than one sampling time and less than 2 sampling times it will
wait 2 sampling time periods.
If the Alert time is more than 2 sampling times the unit will wait the defined sampling
time.
T or RH%
Back to
limits point
Violation Alert Out of
point state alert
Relaxed Cyclic
sampling Buffer
rate
Alert duration
High
Limit Temp./Humid. Temp./Humid.
Alert time filter Alert time filter
0 t
Transmission
of the buffer Alert Transmission
sampling of the buffer after
Low rate configured timer or after
Limit (higher) alarm cancelation. As
long as the “Alert
retransmissions timeout”
hasn’t expired yet.
(The buffer is cleared
even if the message is not
transmitted)
NOTES:
Both "Low limit" and "High limit" thresholds are concurrently active. The unit always
takes both of them into account.
There are two sampling rates; one when not in alarm mode called "Relaxed sampling
rate" and one in alert mode called "Alert sampling rate".
If logging sampling rate (hours +minutes) or relaxed/alert sampling rates are zeroed
or none of the related events are enabled – the entire feature is disabled.
IMPORTANT: All the parameters in the following sections (from sections ‎24.9.10.1 to
‎24.9.10.12) are related to the Nano only. The parallel parameters for MultiSense units
are described in section ‎25.4.
24.9.10.1 Relaxed Temperature Sampling Rate
Address: 2066
Description: This is the sampling rate when the channel is not in alert state.

Manual
Data range: 0÷255 = 0÷510. Valid range is 2÷510 seconds
Default value: 0x1E = 60 seconds
24.9.10.2 Temperature Alert High Limit Threshold
Address: 2067
Description: Temperature high limit threshold; above this is a violation.
Resolution: 1ºC
Data format: 1 byte, Signed (2's complementary) value.
Data range: -127÷128, Valid range is -50÷100 ºC
Default value: 0x00 = 0ºC
24.9.10.3 Temperature Alert Low Limit Threshold
Address: 2068
Description: Temperature low limit threshold; below this is a violation.
Resolution: 1ºC
Data format: 1 byte, Signed (2's complementary) value.
Data range: -127÷128, Valid range is -50÷100 ºC
Default value: 0xEC = -20ºC
24.9.10.4 Temperature Alert Time Filter
Address: 2069
Description: Timeout before alert generation, after a TH is crossed; also used to exit an
alert state after reverting to filter limits.
NOTE: This parameter will be rounded to the closest sampling time units.
Data format: 1 byte, decimal value.
Data range: 0÷255, Valid range is 1÷255 minutes
Default value: 0x02 = 2 minutes

Manual
24.9.10.5 Alert Temperature Sampling Rate
Address: 2070
Description: Time for a violation to become an alert, and also reverting from non-
violation to non-alert.
Data range: 0÷255, Valid range is 1÷255 = 2÷510 seconds
Default value: 0x1E = 60 seconds
24.9.10.6 High Limit Violation Event

Description: These bits enable (=1) or disable (=0) the messaging for the High limit
violation event (both temperature and humidity).
High limit violation event Reserved
(both temperature and humidity)
Type-11 Type-0
event"
24.9.10.7 Low Limit Violation Event

Description: These bits enable (=1) or disable (=0) the messaging for the Low limit
violation event (both temperature and humidity).
Low limit violation event Reserved
(both temperature and humidity)
Type-11 Type-0
event"
24.9.10.8 Nano Alert Retransmit Time
Address: 2073
Description: If an alert is not canceled by a special command (see the OTA protocol), the
unit will keep retransmitting the buffer over and over again every this defined period,
until the timeout expires.

Manual
NOTES:
The value will be rounded to the closest whole "Alert temperature/humidity sampling
rate" units.
From this parameter the number of samples to send in a single transmission is
calculated and then this number of samples is kept (and not the time).
For example: If sampling rate is 5 minutes and this parameter is 1 hour, the unit will
transmit every 12 samples (and not 1 hour), even if some samples are missing from a
MultiSense for instance.
If less than one unit of "Alert temperature/humidity sampling rate" is transmitted, the
feature is disabled.
If it has a larger value than the queue size, it will retransmit every full queue.
A buffer can only be transmitted via type-11 messages. The retransmissions are also
sent (if enabled) over type-0 messages with current single measurements only.
Data range: 0÷255 minutes
Default value: 0x0F = 15 minutes
24.9.10.9 Nano Alert Retransmissions Timeout
Address: 2074
Description: If alert is not cleared, the buffer keeps being retransmitted until this
timeout expires.
Resolution: 10 minutes
Data range: 0÷255, Valid range is 1÷255 = 10÷2550 Minutes, 0=Disable
Default value: 0x0C = 2 hours
24.9.10.10 Temp. & Humidity Idle Transmission Event Configuration

Description: The Temp. & humidity idle transmission event in context of data logging
transmission when this time elapses since the last transmission.
If no alerts or special events occur for a long time, the system may not transmit anything
for a long time. On the other hand, the user may want to be able to still get the data-
logger functionality more frequently. When the “Temp. & humidity idle transmission
event” bit is set, the data-logger will send its buffers anyway after this time has elapsed.
These bits enable (=1) or disable (=0) the messaging for the temp. & humidity idle
transmission event configuration.
Temp. & humidity idle transmission event
configuration

Manual
Type-11
Logged "Active log event"
Bit 7 Bit 6
24.9.10.11 Transmit After This Time Elapsed Since Last Transmission (Hours)

Description: If no alert occurred, the unit will transmit the buffer anyway after the
defined time (hours + minutes; minutes is defined in the next parameter).
Data range: 0÷31, Valid range is 0÷23 hours
Default value: 0x00 = 0 hours
24.9.10.12 Transmit After This Time Elapsed Since Last Transmission (Minutes)

Description: If no alert occurred, the unit will transmit the buffer anyway after the
defined time (hours + minutes).
Data range: 0÷63, Valid range is 0÷59 minutes
Default value: 0x00 = 0 Minutes
24.9.11 Indications Time Window
Address: 2080
Description: After power-up or reset, the units indication (Buzzer and LEDs) are shut
down after the defined "Indications time window" value, in order to conserve energy.
When the unit is in ON state, every button press longer than 200mS but shorter than 5
seconds will prolong or open the indications window by restarting this "Indications time
window".
Note that a zero value can result in an unstable system and therefore should not be used.
Data range: 0÷255, valid range 1÷255 (4÷1020 seconds)
Default value: 0x08= 32 seconds

Manual
24.9.12 Buzzer Configuration
24.9.12.1 Buzzer Enable Bits

Description: These bits enable (=1) or disable (=0) the various buzzer indications.
Panic was Ring beeps on Beep on Panic Buzzer Check-in Button press
Reserved = 00
ACKed by dial in registered feedback Buzzer Buzzer
server MultiSense feedback feedback
Buzzer power-up
feedback
Default value: 0xFC = All enabled
24.9.12.2 Buzzer Beeps Interval On Out Of Limits Alert
Address: 2078
Description: When the configured sensors go out of their limits, repeating beeps are
sounded at the defined interval.
Data range: 0÷255, valid range is 1÷255 seconds
Default value: 0x0A = 10 seconds
24.9.13 LEDs Configuration
Address: 2079
Description: These bits enable (=1) or disable (=0) the various LED indications.
Panic LED feedback Check-in LED
feedback
Bits 7 Bit 6
Note that all these battery indications are displayed only for the "Indications time window"
time. After that they are cleared (turned OFF).
Default value: 0x3 = both enabled

Manual
24.9.13.1 Battery State LED Interval

Battery state LED interval
‎ 4.2.2
Description: This is the time between consecutive LED blinks of battery level. See 2
for more details.
All these battery indications are displayed only for the "Indications time window" time.
After that they are cleared (turned OFF).
Data range: 0÷31 seconds (0=Disable blinks entirely)
Default value: 0x05= 5 seconds
24.9.14 Check-in Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the Check-in
feature.
Check-in messaging Reserved
Type-11 Type-0
event"
24.9.15 Work-ID Messaging

Description: The unit promotes a "Work ID" counter on every power turn-ON operation
by the user.
This 32-bit counter is initialized to 0 only at the production line.

Manual
These bits enable (=1) or disable (=0) the messaging for the work-ID counter feature.
Reserved Work-ID messaging
Type-11 Type-0
event"
Bits 4-7 Bit 3 Bit 2 Bit 1 Bit 0
Default value: 0x02 = Type-0 Logged is enabled, all the rest are disabled.
24.9.16 Exception Handling

All meanings of "out-of-range" are explained here.
24.9.16.1 Exception Indications Configuration #1
Address: 2082
Description: For each type of event the following can be configured:
Whether the event activates the buzzer.
Whether the event activates the LEDs.
Light sensor Light sensor Reserved = 00 Accelerometer Accelerometer
Reserved = 00
out-of-range out-of-range sensor out-of- sensor out-of-
LED Buzzer range LED range Buzzer
indication indication indication indication
24.9.16.2 Exception Indications Configuration #2
Address: 2083
Description: For each type of event, the following can be configured:
Whether the event activates the buzzer.
Whether the event activates the LEDs.
Reserved = 00 Temperature Temperature Geo-Fence Geo-Fence
Reserved = 00
out-of-range out-of-range General LED General Buzzer
LED indication Buzzer output indication output indication
indication

Manual
24.9.17 SR-RF Block
24.9.17.1 SR-RF Block Main Configuration
Address: 2084
Description: These bits enable (=1) or disable (=0) the SR-RF (Short-Range Radio-
Frequency) block functionally feature.
Nano is master of Reserved = Process (and report on)
Reserved = 00000
several slave 0 MultiSense units not in the
sensors enable list (guests)

The following 4 parameters are common to all connected MultiSense units in a system.
24.9.17.2 Proximity/Keep-Alive Transmission Timer
Address: 2085-2086
Description: This sets the timer via which MultiSense units transmit their keep-alive
messages. These transmissions are independent and should occur on their times anyway.
If by coincidence it is precisely overlapped (e.g. Proximity timer=200, Relaxed
timer=100), only the shorter one of them will be transmitted.
Data range: 0÷65535, valid range is 2÷ 43200 = 4÷86400 seconds, but it is not
recommended to set it below 20 seconds.
Default value: 0x0E10 = 3600 seconds = 1 hour
24.9.17.3 Active Sensors Sampling Relaxed Timer
Address: 2087-2088
Description: This sets the timer via which MultiSense units transmit their measurements
messages if no violation of thresholds occurred.
Data range: 0÷65535, valid range is 2÷43200 = 4÷86400 seconds, but it is not
Default value: 0x0096 = 300 seconds

Manual
24.9.17.4 Active Sensors Sampling Violating Timer
Address: 2089-2090
Description: This sets the timer via which MultiSense units transmit their measurements
messages if violation of thresholds occurred.
Data range: 0÷65535, valid range is 2÷43200 = 4÷86400 seconds, but it is not
Default value: 0x003C = 60 seconds
24.9.17.5 MultiSense Temperature/Humidity Alert Time Filter
Address: 2091
Description: Timeout before alert generation, after a TH is crossed; also used to exit
alert state after reverting to defined limits.
Note: This parameter will be rounded to the closest sampling time units.
Data range: 0÷255, valid range is 1÷ 255 minutes
Default value: 0x02= 2 minutes
24.10 Installations
The Nano unit can be installed in a variety of ways. For more details, refer to the
Installation Guide.

Manual
25 MultiSense and MultiSense-TH
25.1 Introduction
The MultiSense is a remote peripheral sensor, communicating and configured by the

CelloTrack Nano via a short-range RF link.
There are 2 models of MultiSense: regular devices that can measure temperature called
"MultiSense" and "MultiSense-TH" devices which have a combined temperature and
humidity sensor.
The MultiSense device has the following sensors:
Temperature sensor
Humidity sensor (only in the MultiSense-TH model)
Hall effect magnetic sensor
Ambient Light Sensor (ALS)
Accelerometer sensor
The system supports up to 16 fully programmable MultiSense devices.
If "guest mode" is enabled here, the Nano unit will also connect with MultiSense units not
in its list, read their sensors and pass the data (in raw format) to the server. Only listed
MultiSense units also get configuration blocks and their readings are fully processed by
the Nano.
25.2 Operation
25.2.1 Marking
The magnet icon symbolizes the location of the magnet sensor. The permanent magnet
should be installed against it with distance of body-to-body of 1-3cm.
The eye icon symbolizes the light sensor direction, to which the source of light should be
directed.

Manual
25.2.2 Battery
Use only CR2450 size battery. Be careful not to install the battery at the wrong polarity as
it could damage the device.
Choose the exact battery model and manufacturer of the battery according to the
required temperature range.
To install a battery, unscrew the upper half from the base half until the two triangles on
the side are aligned, and then pull it.
25.2.3 Button and Blue LED

When the battery is inserted, the unit always goes to active mode and the blue LED
lights for 3 seconds.
When active, every short press (up to 1 second long) triggers sampling and
transmission and the blue LED blinks 5 times.
When active, a long press (longer than 4 seconds) will turn the unit OFF (inactive
mode), accompanied by 3 blue LED blinks.
When the unit is off (inactive mode), a long press (longer than 4 seconds) will turn the
unit ON and the blue LED lights up for 3 seconds (as per the battery insertion above).
25.2.4 Pairing Process

Closed loop pairing (in the field pairing, over SR-RF) is performed by pressing
simultaneously on both Nano buttons for 5 consecutive seconds. However, note the
following:
If an active indications window exists, it will be closed.
If the 2 buttons are pressed for more than 1 second but released before completing
the 5 consecutive seconds, it will create a check-in event.
If enabled here, a beep is heard for every elapsed second in the first 4 seconds; if the
check-in buzzer enabled bit is set or not "Dual short beeps" after the 5 th second (0.5
second each) indicate ‘pairing time frame mode’ is open for “SR-RF Pairing time
window”.
During this time window:
The Nano’s left LED flashes orange 0.5 Sec ON, 0.5 Sec OFF (assuming no charger or
PC are connected; if connected it has higher priority on the LED).
User powers-up a MultiSense device.
As the Nano pairs with the MultiSense, a long beep (2 seconds) is heard. In addition,
the MultiSense LED blinks twice (after the 3 second long power-on LED pulse): 200mS
OFF, 200mS ON, 200mS OFF, 200mS ON.
Only one MultiSense device can be paired during a single "SR-RF Pairing time window"
(to avoid mistakes). The timer for the "SR-RF Pairing time window" is renewed
automatically after each successful MultiSense pairing in order to give the operator the
opportunity to pair devices one after the other.

Manual
Upon every newly added MultiSense to the system a "MultiSense added" event is
created; for every unpaired device a "MultiSense removed" event is created.
As the "SR-RF Pairing time window" expires, and at least one MultiSense was
added/removed, the Nano will automatically perform a system reset.
If no new MultiSense was paired, and the "SR-RF Pairing time window" expired, the
red right LED will turn on for 2 seconds (with no beep).
If all 16 devices are defined (MAC address ≠ 00:00:00:00:00:00), a new MultiSense
unit cannot be paired.
There are no retries for each step of this process.
IMPORTANT: After pairing and unpairing operations, the queue allocation should be
restarted (by performing a reset to the entire unit).
Pre-configuration before field pairing of units is possible, just note that when a new
MultiSense is paired in field, it will get the first vacant index, starting from #1 and up to
#16, and will get the corresponding pre-configured parameters for its index.
25.2.5 Unpairing Process

As per the pairing process, except that during the "SR-RF Pairing time window" the user
turn off the MultiSense device; the Nano recognizes it and approves the unpairing with
dual long beeps (1 second each, with OFF time 200mS between them) and with the
orange LED turning off.
If no approval was given, it is possible to reattempt the procedure.
25.3 Sensors
25.3.1 Accelerometer
The accelerometer sensor is sampled on every wake-up and Tx cycle and in addition
triggers an interrupt (asynchronous transmission) when it has an impact larger than the
preconfigured threshold.
The reported impacts create impact events, if enabled here.
The sampled X,Y,Z values are reported on every MultiSense provisioning message and the
calculated RMS value on every impact/free-fall event.
25.3.2 Ambient Light Sensor (ALS)

This sensor is used mainly to detect if the package that holds the unit inside is closed
(dark) or open (exposed to some light).
The light sensor is sampled once on every wake-up and Tx cycle.
The level is compared against the configured threshold and if events are enabled (as
described here or here) the unit creates open package or closed package events
respectively.

Manual
25.3.3 Accurate Temperature Sensor

This ±1°C accuracy sensor is sampled according to a configurable rate when it is within
the configured limits and according to other configurable rates when out those limits for
more than this time.
‎ 4.9.10.
See more details in section 2
25.3.4 Humidity Sensor

This ±4% accuracy relative-humidity sensor is sampled according to a configurable rate
when it is within the configured limits and according to other configurable rates when out
those limits for more than this time.
‎ 4.9.10 above.
See more details in section 2
25.3.5 Magnetic Sensor

This sensor is binary. It recognizes if a strong enough magnetic field exists or not.
If enabled here, upon any change of state, it triggers an interrupt and an asynchronous
wake-up and Tx cycle.
25.4 Parameter Descriptions and Notes
25.4.1 MultiSense Units Provisioning

If 5 consequent keep alive periods (according to the parameter here) have passed and
no messages whatsoever were received from it (no advertisements at all), the relevant
MultiSense is considered "lost" and should be reported as a "MultiSense provisioning
message" event with the problem code of "1 = Lost communication".
If a marked "lost" MultiSense is received again (any advertisement), a communication-
restore event is sent ("MultiSense provisioning message" event with the problem code of
"2 = Communication restored").
25.4.1.1 MultiSense Provisioning Event Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the MultiSense
provisioning.
MultiSense provisioning event messaging
Type-11 Type-0
event"
Bit 3 Bit 2 Bit 1 Bit 0

Manual
25.4.2 MultiSense Open/Close Door/Window Feature

The MultiSense comprises a magnetic sensor that can give indication of the presence or
absence of a strong magnetic field (permanent magnet, with specified strength, less than
30mm in distance).
Any change of state is reported immediately to the Nano.
25.4.2.1 MultiSense Open/Close Door/Window Event Messaging

Description: These bits enable (=1) or disable (=0) the messaging for the MultiSense
Open/Close door/window feature.
MultiSense Open/Close door/window event messaging
Type-11 Type-0
event"
Bit 7 Bit 6 Bit 5 Bit 4

All these parameters are set using the Nano editor screen accessed from the Cellocator
Programmer tool.
25.4.3 SR-RF Pairing Time Window

Description: Timeout before "in the field" pairing window is closed. See more details
here.
Data range: 0÷31, valid range is 1÷31 (10÷310 seconds)
Default value: 0x02 = 20 seconds
25.4.4 Specific MultiSense parameters
Address: 2092÷2235
Description: These addresses contains an array of 16 configuration blocks; one block of
9 bytes per MultiSense.
Each one of the 16 blocks looks as described in the following parameters.

Manual
25.4.4.1 Sensors Enable Bitmask - 1st Byte
Description: Enable bit for every sensor and feature.

Reserved Temperature Humidity Hall- Light Accelerometer Tx on violations Reserved
sensor enable sensor effect sensor sensor enable only (mode)
enable sensor enable
enable
Keep-alive only
and upon
violations
25.4.4.2 MultiSense Temperature Upper Limit Threshold - 2nd Byte
Description: MultiSense Temperature upper limit threshold.

Resolution: 1ºC
Data format: Signed (2's complementary) decimal value
Data range: 0÷255, valid range is 0÷80, -1÷-40 = -40÷80 ºC
Default value: 0x00 = 0ºC
25.4.4.3 MultiSense Temperature Lower Limit Threshold - 3rd Byte
Description: MultiSense Temperature lower limit threshold.

Resolution: 1ºC
Data format: Signed (2's complementary) decimal value
Data range: 0÷255, valid range is 0÷80, -1÷-40 = -40÷80 ºC
Default value: 0xEC = -20ºC
25.4.4.4 MultiSense Humidity Upper Limit Threshold - 4th Byte
Description: MultiSense Humidity upper limit threshold.

Resolution: 1%
Data range: 0÷255, valid range is 0÷100 %
Default value: 0x50 = 80%

Manual
25.4.4.5 MultiSense Humidity Lower Limit Threshold - 5th Byte
Description: MultiSense Humidity lower limit threshold.

Resolution: 1%
Data range: 0÷255, valid range is 0÷100 %
Default value: 0x14 = 20%
25.4.4.6 MultiSense Impact or Free-fall Selection - 6th Byte, Bit 7
Description: MultiSense Impact or Free-fall selection; 0=Impact, 1=Free-fall.

Default value: 0 = Impact
25.4.4.7 MultiSense Impact/Free-fall Event Threshold - 6th Byte, Bits 0÷6
Description: MultiSense Impact/Free-fall event threshold in g (earth gravity) units.

Recommended values for Impact mode is >1.5g.
Recommended values for free-fall mode is <0.7g.
Resolution: 63mg (full scale is ±8g)
Data range: 0÷127 = 0÷8g
Default value: 0x20 = 2g
25.4.4.8 MultiSense Package Open/Closed Light Threshold - 7th Byte
Description: MultiSense Package open/closed light threshold

Resolution: 2 lux
Data format: 7 bits, 1 byte, decimal value
Data range: 0÷255 = 0÷510 lux
Default value: 0x05 = 10 lux
25.4.4.9 Reserved Bytes - 8th and 9th Bytes
Thoee bytes are empty and reserved (=0x00).

Manual
Appendix A Revision history

Version Date Description
Initial version, based on v31d rev21.Added:
31e rev1 22.03.12 1. Obsolete functionality of Feedback of overspeed removed.
2. Session of output activation: Zero value. If zero is programmed the
unit will only perform one session of activation irrespectively to the
programmed number of sessions.
3. Existing patterns of Feedback to Driver behaviors violations
converted to feedbacks to Continuous violations only
4. New patterns of Momentary Feedbacks to Driver behavior violations
added
5. Added change of resolution in Idle and Over
speed filters (2.5 seconds instead of 2.56)
6. Charts of Template output activation fixed
7. Added flag of conditional immobilizer activation
8. Added note, that Over-speed is registered on a speed ~2km/h higher
then programmed.
Added Cello-AR section
31e rev2 4.4.12
Added new configurable features for Enhanced Car Sharing
31h rev3 15.8.2012
Added Voice Dialing support
31j rev1 15.8.2012 Added Speed Limiting Geo-Fence support
Updated PBR driver behavior

31g 7.11.2012 Pulse Counting
CelloTrack3G
CFE IO
31i 19.11.2012
6.3.16.4: Add Lock to Certain IMSI
31n 27.12.2012 6.3.8.1: SingleWire temperature sensors support (CFE)
31n.1 01.01.2012 1. Section 5.2.18: Rephrase Dallas Bus Enable.

2. Section 8.7, 8.7.1: Added note, trailer Id must
have the Dallas bus enabled.
31p 03.01.2012 1. Section 5.2.18: Rephrase Dallas Bus Enable.

2. Section 8.7, 8.7.1: Added note, trailer Id must
have the Dallas bus enabled.
3. CFE related sections are defined as
infrastructure.
4. Section 6.2.4: Rename the parameter to :
Enable Voice Call unsolicited serial status
messages.
5. Section 7.4: Speed limiting Zone moved to 7.4
from 7.3.4. Add more explanations for speed
limiting geoFence output activations
6. Section 7.4.4: Describe how to activate speed
limiting geoFence outputs based on driver
behavior definitions.
7. Section 8.9.2.1: Over Speed: add remark about
speed limiting geoFence.

Manual
31u 07.03.2013 Change in section 17.5:
Address 1436 turned to Spare

Address 1437 CFE multiplexer protocol assignment
for serial interface 2 (Infrastructure for Bluetooth)
for serial interface 3
Section 5.2.1 Application Configuration (Five

Bitmask Bytes) :
Address 6, bit 6 : Enable CFE
Address 6, bit 0: Enable CFE as I/O ExtenderUnused
Address 7: bit 0: LED output state after Power
Recycle: 0-LED inactive, 1-LED Active
(Infrastructure)
Address 1347:
Bit 2 : Enable CFE connected&disconnected distress
Bit 3 : Enable CFE connected&disconnected events
Section 6.1.1.4.15 Maintenance server Session time

update
Address: 1400
Description: The maintenance server will use default
3 Min session timeout when first connecting to the
C+ server. After the first message arrives from the
maintenance server towards the unit, the FW will
cancel the 3 Min time out, or what left of it, and
replace it with new session timeout value defined by
this parameter.
Valid values: Min time 30 Sec: 3
Resolution: 10 Sec
Default value: 30 Seconds
Removed parameter "PSP Unit’s On Time for T-

Command processing" in address 1345.
Removed limitation of "CellId will not be supported

in 2G bands is APS mode is enabled".
Removed "Create Halt event for open session per

ignition Off" entirely at d1390/7.
17.1 Added some details in general description

about CFE MUX.
17.5 CFE Serial MUX protocol selection – new

section.
Manual
31s 18.03.2013 Security version: Remove “Trigger an Alarm Upon

Reset During Alarm Armed” address 424, bit 1
Section 8.9.2 Behavior Violation Indications to Driver:

added description for simultaneous driver feedback when
single output is used for two driver events.
Section 6.2.2: Notes added to describe “GPS odometer’s

current value” parameter
31w 9.04.2013 CR200, Added support for OTA IMEI transmission
based on control bit described in configuration byte
1347 bit 4.
The IMEI mapping into OTA type 0 messages is
reflected in the wireless protocol.
Section 8.3.3 Enable Compressed Vector Change

Report: Add note describing why periodical
“Compressed Vector Change reports” are sent when
the unit is driving without significant course
changes.
Section 8.9.2: Updated figure describing driver

behavior simultaneous events on single output
31x 30.04.2013 Added new chapter 18 and parameters for new

crash detection feature in Cello / Cello-AR.
31x 30.05.2013 Added the section of 6.1.10.3 and 6.1.10.4 –

Periodic transparent mode (hotfix), configurable via
parameters at addresses 1355 and 1356.
Section 10.3: Turned d1349-bit1 "Enable Radio-Off"

to hardcoded enabled and the bit is free now.
32f 15.08.2013 SP 2.5
 Section 17.3: add more info about Cello to CFE
reprogramming.
5.0.0.1 8.09.2013  Section 4.5: Added “Active Logged Events”
 The Term CelloTrack represents both
CelloTrack2G and CelloTrack3G.
 Add addresses 1333 to 1336: CelloTrack
parameters, not part of PL.
 Addresses 1337-1342: New parameters for
advanced glancing.
 Section 5.2.1: Add control bit for “Active Logged
Event” Enable.
 Section 15.8: Updated CelloTrack Radio-Off
 Section 15.9: Advanced glancing
 Section 17.3: add more info about Cello to CFE
reprogramming.

Manual

 Configuration space is now 8K for new Cello
devices. Allocate new space for the new CelloIQ
configuration memory address 6656 to 8191.
 New document version numbering 5.0.0.1
5.0.0.3 30.10.2013  New Parameter:
2459 OneWire Temperature msg 9
update rate. Home Network
2460 OneWire Temperature msg 9

update rate. Roam Network
Cello-CANiQ: CAN operational mode select
4100
4101 Cello-CANiQ: OBD2 CAN

Physical layer Configuration
4102 Cello-CANiQ: CAN Application

Control 1
Cello-CANiQ : Vehicle’s Fuel tank capacity
4103-4104
4105 Cello-CANiQ: Speed Correction

Delta
 Address 0: Added new bit: Bit 1, Enable infinite

driver notification when Driver is not identified
 Section 8.5.16: Added description for “Enable
infinite driver notification when Driver is not
identified.
 Added Section 21: GNSS External/Internal
Antenna selection
 Added Section 20: oneWire Temperature
Sensors
 Update the Cello-CAN-iQ section
5.0.0.4 Nov. 19,  Add comment about “Enable FixTime Algorithm”

2013 is not applicable in CelloTrack T variants.
5.0.0.5 Dec. 8,  Section 11.2.5: Added Geo-Fence Heading Angle

2013 infrastructure
5.0.0.6 Dec 30,  Section 11.2.5: Add comment about hot-sport

2013 output support.
 11.1.7: Remove Hot-Spot as a reason for output
triggering.
 Section 6.3.8.1: Update Bytes 26-29 oneWire
measurement range
 Section 6.1.14: Add comment about Cell ID
during full hibernation
 Section 8.5.15: Change 1-wire default mode to
point to point

Manual
5.0.0.7 Dec 30,  Section 6.3.15.2: Add more information about

2013 manual band/mode selection in view of new
modems used in CelloTrack T, Cello-CANiQ
5.0.0.8 Jan 5, 2013  Section 8.6.1: Change the description as "1"
represents the feature is disabled and not
enabled as the description suggested.
5.0.0.9 Jan 20,  Section 22: Add support for Auxiliary Satellite
2013 communication device power control.
 Section 23.1.1: Driver Behavior Disable
5.0.0.10 March. 25,  CR300 functionality and features
2014  USIM application support (CR300 only)
 CR300 Compatibility matrix, Add comment:
Transparent mode optional feature enabled
doesn't mean Forwarding is enabled.
 Section 5.2.10, Add note about STD Immobilizer
output behavior after reset and power recycle
 Section 8.5.8: Add comment about CR300
output behavior after reset and Power recycle.
 Section 6.3.8.1: added comment about NTC
analog source in CelloTrack Power.
 Section 16: Add note: NTC analog source
selection is mandatory for CelloTrack Power
churching to function.
 Section 6.3.13.3.2 : Added comment about
AHR: " Zero retry number will cancel AHR
process. Please note that setting this parameter
to 0 is not recommended".
5.0.0.11 April 3,  Section 7.3.7: Added section for Speed Limiting

2014 Thresholds
5.0.0.12 May 12,  Section 22: Add: Advanced Satellite Mode

2014  Advanced Jamming Detection configuration
allocated, (Infrastructure at address 205 to
214).
5.0.0.13 June 2,  Section 6.1.11.2: Number of Distress
2014 transmissions, a value of 0 indicates that
distress transmission will not be sent.
 Section 6.1.12.1: Add note about time between
SMS transmission to be 40 Sec.
 Section 6.4.7.2, Section 6.4.7.3: add note:
Value of 0 is illegal and shouldn’t be used.
 Section 6.1.17: New jamming operating mode
supporting Jamming while in Ignition-On and
Ignition-Off.
 Section 6.1.12: Enable SMS Wake up. Rephrase
the description, SMS wake up messages will be
retransmitted. Add a phrase about Wake up
messages and anti flooding.
 Section 6.1.12.1: Add note about Wake up SMS

Manual

in CelloTrack and CelloTrack T.
5.0.0.14 August 6,  Section 6.1.17.9: Add two conditions for
2014 Jamming release: Ignition On and Off
 Rename “Enable GSM switch off by shock(Door)
input" to be “Enable modem’s power control by
shock(Door) input"
 Section 15.1: Add note to “Disable Live
Tracking”
 Section 6.1.20.1.2: Remove note about
Cinterion modem jamming detection. The issue
was solved
 Remove duplication of: Renew GPRS upon drop
 Section 5.2.11: Added CR300B 3G I/O Control
for CR300b 3G
 Section 5.2.11: Added CR300B 3G I/O Control
 Section 7.2.4: Change the definition of “Don’t
use time filter to close over speed session”.
 Section 6.3.13.4: added homologation
initialization mode
5.0.0.15 September  Section 6.4.7.2: Update the minimum legal
30, 2014 value of "GSM Peeking – Modem Off time"
parameter to 02h = 32 seconds.
 Section 6.1.12.1: Added "(except in CelloTrack
Nano, there the time between emergency
transmissions will be shorter but still dependent
on the network responses)."
 Section 15.4: bits 4,5,6,7: Added Control bits
for activation mode change events.
 Section 9.2.7: Added additional time filter for
Lock Input (Infrastructure).
Unlock Input (Infrastructure).
Door Input (Infrastructure).
Shock Input (Infrastructure).
Panic Input (Infrastructure).
 Added parameter at Address 517: Local RPM
Calibration Input/output selection
(Infrastructure).
 Section 4.3: Added comment: “Distress session
may be prolonged by up to 20 Seconds after the
transmission of the last distress message”.
 Section 15.8: (CelloTrack) update the Radio Off
diagram with “Early radio off”. Add description
for “Early Radio Off” condition.
 Section 6.4.6.1: added "Zero value is illegal and
shouldn't be used.”
 Section 6.1.1.2: Anti-Flooding, Rewrite the

Manual

feature description.
 Section 6.2.15: Change the default to 0 %
 Section 5.2.1: Address 525: change to “Special
modem initialization mode”
5.0.0.16 October 13,  Section 6.1.1.1: Change in “Events Delivery

2014 Algorithm”. Only one pending event will be
handled (used to be up to 16 pending events).
5.0.0.17 October 27,  Section 22: Restructure and add definition for
2014 configurable cellular network detection (GSM or
GPRS)
 Section 8.5: Add timing diagram for Driver
authentication scenarios. Add note about ignition
event source
 Section 8.5.6: Change the name of the
parameter (byte 0, bit 4) to “Ignition filter
source for starting Driver Authentication time
calculations”
 Section 8.5.5:” Timeout of Driver Authentication
Reminder” Removed: duplicated.
 Section 6.3.5: Change the name to “6.3.5
Enable warning output activation during
Gradual immobilization”
 Section 15.1, Section 15.7: Change the timing
for event sending before COM-Location glancing
end to 20 to 30 seconds (Was 30)
 Section 15.4.1: Updated CelloTrack Deactivation
procedures.
5.0.0.18 November  Section 22.1.1: Add note: Please note that when
16, 2014 the “Auxiliary Satellite Unit- Cellular network
connect reconnect criteria” (Add. 650, Bit 0) is

Manual

configured for “GPRS”, the minimal value must
be 2 (1 Minute).
Major version:
5.1.0.0 November
 Added new sections for CelloTrack Nano and
26, 2014
MultiSense.
 Moved the version history to an appendix at the
end of the document.
 Corrected general formatting of the entire doc.
5.1.0.1 December  Section 24.2.2: Some corrections of buttons and
3, 2014 LEDs naming from #1 to "left".
 Section 24.5.2: Renamed it from "Charging" to
"Charging speed".
 Section 24.5.3: Added new section describing
the 2 charging modes of operation.
 Section 24.6: Added HW-block / Features
matrix.
 Section 24.9.10.1, 24.9.10.4, 24.9.10.5:
updated that those parameters are not related
to humidity (only temperature).
 Section 24.9.10.5: Corrected the address to
2070.
 Section 24.9.12.1: Updated the name from
"Enable bits" to "Buzzer enable bits".
5.1.0.2 December  Sections 24.9.17.2÷24.9.17.4: Updated the
11, 2014 minimum time to be 4 Seconds and added that
"it's not recommended to set it below 20
Seconds".
Section 22:
5.1.0.3 December
 Auxiliary Satellite Unit is not only for GNSS
17, 2014
units, CR300 added
 GSM loss/restore is not the only condition for
Aux Sat activation: GPRS added
 Auxiliary Satellite Unit- Cellular network
connect-reconnect criteria - not an infrastructure
anymore.
 "Auxiliary Satellite Unit- No Cellular network
found Timeout (Basic, Advanced)" renamed to
"Auxiliary Satellite: No GSM-GPRS Timeout
(Basic, Advanced)"
 Other parameters of Basic Satellite feature
renamed same way.
 Added parameters:
o Timeout resolution of GSM-GPRS
Reconnect
o Timeout resolution for No GSM-GPRS
Sections 24-25: After technical writer review and corrections.
5.1.1.0 December
22, 2014

Manual

Updated "nano" to "Nano" all over the doc.
5.1.1.1 December Section 24.9.4.3: corrected the data range and default value of the tilt time
30, 2014 filter.
Sections 24.9.10.1, 24.9.10.11, 24.9.10.12: Very minor corrections.
Section 24.9.15: added description to work-ID feature.
Technical Writer edit.
5.1.2.0 January 8,
2015
5.1.2.1 January 15, Bug fixes:

2015 1. d'1389/1 "Go Halt Time Threshold filter" -
default value changed to - 3 (sec)
2. d' 104/1 "Start Event time filter" - default
value changed to 7.74 (sec)
3. d' 105/1 "Stop Event time filter" - default
value changed to 7.74 (sec)
4. BCALL (Brake down) Destination Number
address fixed to 167-176
5. Speed limiting decisions in Speed limiting
Geo-Fence (both start and end of overspeed)
in will be taken based on legacy time filter of
overspeed (at address 0d95) (instead of 2
new parameters, one for start and second for
end)
6. Added clarification that Alarm Cadence
outputs selection Bit 0 – Siren (pin 8) is
unavailable in CAN variants
7. Added System limitation for "Velocity
threshold for High speed mode" threshold:
3km/h hysteresis.
8. Added note: In case both "Resolution Definer
in Roaming Mode" and "Time Report Period
value in Roaming Mode" parameters are zero
(value on address 499 is 0), in Roaming the
unit will use Home parameters (programmed
on address 106).
9. Added note, claiming that 0 in Time Report
Period Multiplier for NOIP mode is considered
as 1.
5.2.0.0 20/1/15 To Release of Product Tree GA, 33o

1. Added parameter Force one second
resolution
2. Added section of Local RPM (or GP
Frequency) Input Calibration
3. The previous RPM (or GP Frequency) Input
Calibration renamed to "OTA RPM (or GP
Frequency) Input Calibration"

Manual

4. Added Discrete Inputs Triggering Time Filters
section. Old description of Input Additional
Time Filter - removed
5. Added parameter "Report engine hours
based on RPM"
6. Added supported baud rates 19200 and
460800 (only system port, not including CFE
ports)


Cellocator Manual GPS

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Cellocator Manual GPS

Caricato da

Copyright:

Formati disponibili

Cellocator Cello

Proprietary and Confidential

Revised and Updated: January 20, 2015

Copyright © 2015 by Pointer Telocation, Ltd.

Warranty Exceptions and Disclaimers

Cellocator Cello Programming Manual Page 2 of 365

Cellocator Cello Programming Manual Page 3 of 365

Cellocator Cello Programming Manual Page 4 of 365

5.2.25 Geo-Fence Alert Mask ..................................................................................................54

Cellocator Cello Programming Manual Page 5 of 365

Cellocator Cello Programming Manual Page 6 of 365

6.5.5 Volume and Gain Control Byte .................................................................................... 161

8.3.1 Enable Vector Change Detection Events /Distress .......................................................... 181

Cellocator Cello Programming Manual Page 8 of 365

9.1.3 Inverting Journey Start/Stop ...................................................................................... 208

Cellocator Cello Programming Manual Page 9 of 365

9.6.2 Inverting Panic Input ................................................................................................. 227

Cellocator Cello Programming Manual Page 10 of 365

11.3.6 Towed Mode ............................................................................................................. 245

Cellocator Cello Programming Manual Page 11 of 365

13.2.1 Enable Keyboard ....................................................................................................... 259

Cellocator Cello Programming Manual Page 12 of 365

17.3 Programmable CFE Parameters ................................................................................... 283

Cellocator Cello Programming Manual Page 13 of 365

19.4 Cello-CANiQ: Fuel Tank Capacity ................................................................................. 300

Cellocator Cello Programming Manual Page 14 of 365

24.3.2 Improved Tracking with POD Mode (Infrastructure) ....................................................... 326

Cellocator Cello Programming Manual Page 15 of 365

25.3.2 Ambient Light Sensor (ALS) ........................................................................................ 351

Cellocator Cello Programming Manual Page 16 of 365

1.1 About this Document

1.2 Applicability Table

Cello Family Fw: 33o Cello-IQ30, Cello-CANiQ, Cello CANiQ 3G

CelloTrack All information related to CelloTrack in this document

Cello-IQ FW Version 33e: Full CFE support with 8KBytes memory

Cello-CANiQ FW Version 33e: Full CFE support with 8KBytes memory

Cellocator Cello Programming Manual Page 17 of 365

CR300 FW Version 41q.

FR0011 Gradual immobilize: See Note1 bellow

NOTE: This feature requires additional CR300 output

1.4 Document Conventions

Cellocator Cello Programming Manual Page 18 of 365

2 Accessing the Configuration Memory via Wireless

Cellocator Cello Programming Manual Page 19 of 365

3 Accessing the Configuration Memory via Direct

4 Event Types generated by Cellocator devices

4.1 Logged (Plain) Event

4.2 HRLS Event

4.3 Distress Event

Cellocator Cello Programming Manual Page 20 of 365

It is also possible to initiate an endless (or specified duration) distress session by

4.4 Security Event

4.5 Active Logged (Plain) Event (CelloTrack-T/Nano only)

1.5 Minutes 30 Sec

Wait for GPS Fix

Ack. From Server

During Live Tracking

Cellocator Cello Programming Manual Page 21 of 365

Cellocator Cello Programming Manual Page 22 of 365

5 Address and Bitmask Field Allocation Tables

5.1 Address Allocation Table

0 Application Configuration byte 1

1 Application Configuration byte 2

3-4 Hibernation mode communication settings