FCC ID: 2AH4HATD600 LTE Cat-M1 Tracker

ATD600S User Guide August 10, 2021 Version 0.1.1 1 1 1.1 1.2 1.3 Preface ................................................................................................................................................................4 Purpose .......................................................................................................................................................4 Glossary .......................................................................................................................................................4 Reference ....................................................................................................................................................4 2 Installation ..........................................................................................................................................................4 2.1 Before installation .......................................................................................................................................4 2.1.1 Unpackaging and accessory checking ..................................................................................................4 2.1.2 Active device ........................................................................................................................................6 2.1.3 Config device .......................................................................................................................................6 2.2 Installation ...................................................................................................................................................6 3 Function ..............................................................................................................................................................8 3.1 Brief introduction of beacon scanning ........................................................................................................8 3.1.1 When to scan beacons .........................................................................................................................8 3.1.2 Beacon scanning ..................................................................................................................................8 3.2 Brief introduction of sampling location data ..............................................................................................8 3.2.1 When to sample location data ............................................................................................................8 3.2.2 Get location data .................................................................................................................................8 3.3 Data report ..................................................................................................................................................9 3.3.1 When to report data ............................................................................................................................9 3.4 alarm ...........................................................................................................................................................9 3.4.1 UAM alarm ...........................................................................................................................................9 3.4.2 Low Battery alarm ...............................................................................................................................9 3.4.3 Geofence in and/or out alarm .......................................................................................................... 10 3.5 Power management ................................................................................................................................. 10 3.5.1 Into sleep .......................................................................................................................................... 10 3.5.2 Wake up ............................................................................................................................................ 10 3.6 button and LED indication ........................................................................................................................ 10 3.6.1 Device under normal work mode .................................................................................................. 10 3.6.2 Device under set up mode ............................................................................................................ 11 3.6.3 LED description ................................................................................................................................. 11 2 LKL, Historical data .......................................................................................................................................... 11 4 LKL ............................................................................................................................................................ 11 Historical data .......................................................................................................................................... 11 4.2.1 When to save historical data and report history data ...................................................................... 11 5 How to do a BLE FOTA ..................................................................................................................................... 12 Connect with BLE...................................................................................................................................... 12 FOTA ......................................................................................................................................................... 18 6 Wireless UART ................................................................................................................................................. 23 6.1 What is wireless UART? ............................................................................................................................ 23 How to setup wireless UART? .................................................................................................................. 23 How to connect a device? ........................................................................................................................ 25 7 Use BLE to config device .................................................................................................................................. 29 4.1 4.2 5.1 5.2 6.2 6.3 Version 0.1.0 0.1.1 Date 3/12/2021 8/10/2021 Author Tina Zhou JQ Wang Comments Init version, for DVT sample Add some photos 3 1 Preface 1.1 Purpose For better support sales team, R&D team make this document to let team know how to install and use ATD600 device. 1.2 Glossary UAM: Un-authorized Movement LKL: Last Known Location NCL: Network Connection Lost MQTT: Message Queue Telemetry Transport QoS: Quality of Service 1.3 Reference For the information of reference manual or document of this document please see Table 1.1. Name Version Table 1.1 Reference Document List 2 Installation 2.1 Before installation 2.1.1 Unpackaging and accessory checking When you get device, you will see the key information like SN, IMEI, MAC address on the boxs label, please check them with label of the back of device, if you find them are not match, then should pop up an issue. 4 5 Figure 2.1 label on the box(will update) Accessory Here is the component list:

1. ATD600 2. package 3. screw, 2 pcs Figure 2.2 Device and cables 2.1.2 Active device Due to device will go to Set Up mode after production, so, before using it, we need active the device, the easy way to do this is pressing the button for more than three seconds, you can see the green led and blue led blink, it means device is activated. Figure 2.3 Button 2.1.3 Config device There are 3 ways to config the device, such as wireless UART, APP, and over backend, chapter 7 shows you how to use APP to config the device. Key items The APN (username (apn username), password (apn psword)), server URL (and Port) and cellRAT(Network setting) we need config at first, otherwise, device cannot make connection established. Notice:

1: default APN is: mobilogix1.telefonica.com 2: default URL is: mbxiotfusion.mobilogix.com:1883 3: default cellRAT is 3, which support both GSM and eMTC RATs. Here is the RAT selection 0: 2G only 1: 2G + NB 2: 2G + NB + M1 3: 2G + M1 4: NB only 5: NB + M1 6: M1 only 2.2 Installation Step 1 6 Step 2 Step 3 Figure 2.8 Example location 7 3 Function 3.1 Brief introduction of beacon scanning 3.1.1 When to scan beacons There are two ways to scan beacons. 1. periodically sample (default 4h, GNSS sample frequency) 2. double press button 3.1.2 Beacon scanning When the sampling period is reached, device begins to scan beacons for 10s (default, Duration of sleep beacon scan), then stop scanning until next calling. Enable/Disable/Scan Duration/Scan Period are configurable. Notice:

3. Data format:

1. Beacon scanning is disabled by default. 2. Beacon scanning can be configured by GNSS sample frequency, Duration of sleep beacon scan). Sample frequent should be more than 4 and report period should be less than or equal to 24h.

{"000383":[{"ts":1615515383072,"values":{"mac":"5C:85:7E:20:01:F7","type":"250e","rssi":-

38,"bat":2915,"t":22.4,"h":60.6,"p":1010.0,"mj":1001,"mn":383,"gps":0,"lat":0.000000,"long":0.000000,"mcc":"

460","mnc":"00","lac":"1D2B","cellid":"2C5EB3F","gateway":"A600S20500002H"}}]}

3.2 Brief introduction of sampling location data 3.2.1 When to sample location data There are four ways to get location data. 1. periodically sample (default 4h, GNSS sample frequency). 2. UAM event trigged. 3. Low battery event trigged. 4. double press button 3.2.2 Get location data On the upon conditions, device begins to sample location data once. 1. Get location data is enabled by default. 2. Get location data can be configured by GNSS sample frequency. Sample frequent should be more than 4 and report period should be less than or equal to 24h. 3. Data format:

Notice:

8

{"ts":1615269209136,"values":{"ET":"LD","SN":"A600S20500029H","IMEI":"864475040056136","IMSI":"460044 339301547","IPW":3979,"SS":0,"CS":"LTE Cat NB1","OP":"CHINA MOBILE","LAC":"","CI":"","GFT":0,"LAT":22.576006,"LONG":114.054672,"Heading":240,"Altitude":157.000000,"

HDOP":1.230000,"NoS":5,"GFS":1}}

3.3 Data report 3.3.1 When to report data After setting the sampleCount(default 4, report sample data after sample a certain number of times) and sample frequent(default 4(h), GNSS sample frequency), every (sampleCount)*( sample frequent) hours will try to report data to cloud. sample frequent should be more than 4 and report period should be less than or equal to 24h. 1. 2. Report data can be configured by report sample data after sample a certain number of times, GNSS sample 3. When you press button for two times, device will report BP message, then sample and report beacons Notice:

frequency data 3.4 alarm 3.4.1 UAM alarm UAM is a key feature for our device, when shake device, once reach the threshold (UAM shake Value default is 20, UAMAlarm shake number default is 5), device will report UAM once and report location data once. Notice:

1. UAM alarm can be configured by UAM Alarm En-Disable, UAM shake Value, UAMAlarm shake number 2. UAM alarm is disabled by default. 3. Data format:

{"ts":1615278226096,"values":{"ET":"UAM","SN":"A600S20500002H","IMEI":"865284046405886","IMSI":"4600 46260108483","IPW":3559,"SS":0,"CS":"GSM","OP":"CHINA MOBILE CMCC","LAC":"25F0","CI":"DDF","GFT":0,"LAT":0.000000,"LONG":0.000000,"Heading":0,"Altitude":0.000000,"H DOP":0.000000,"NoS":0,"GFS":0}}

3.4.2 Low Battery alarm If internal power lower than 3300mv, device will report Low internal battery to server. Notice:

1. Low Battery alarm can be configured by bat alarm endisable, bat alarm value 2. Low Battery alarm is disabled by default. 3. Data format:

{"ts":1577836861040,"values":{"ET":"IBL","SN":"A600S20500002H","IMEI":"865284046405886","IMSI":"460046 260108483","IPW":3555,"SS":0,"CS":"GSM","OP":"CHINA MOBILE 9 CMCC","LAC":"25F0","CI":"DDF","GFT":0,"LAT":0.000000,"LONG":0.000000,"Heading":0,"Altitude":0.000000,"H DOP":0.000000,"NoS":0,"GFS":0}}

3.4.3 Geofence in and/or out alarm This alarm can be divided into Geofence In and Geofence Out alarm, after setting center point

(geofenceAlarm Point) and radius of geofence cycle and enable it, device will report the alarm after get location data from GPS. Here is an example of Geofence Out. Notice:

1. Geofence in and/or out alarm can be configured by geofenceAlarm Point, geofenceAlarm Radius geofenceAlarm En-disable 2. Geofence in and/or out alarm alarm is disabled by default. 3. Data format:

{"ts":1615282576160,"values":{"ET":"GO","SN":"M420S202000086H","IMEI":"865284046405738","IMSI":"4600 46260108484","IPW":4115,"SS":0,"CS":"GSM","OP":"CHINA MOBILE CMCC","LAC":"25F0","CI":"DDF","GFT":1615282575,"LAT":22.575430,"LONG":114.053322,"Heading":208,"Altitu de":321.000000,"HDOP":11.400000,"NoS":4,"GFS":1}}

3.5 Power management Into sleep 3.5.1 When BLE is not connected, on the one of the below circumstances, device will go to sleep, otherwise, device will never fall asleep. 1. sleep time is timeout (timeout value is different in different scenes, when sampling beacons, the value is 2. 3. 60S, when reporting messages, the value is 540S). If GPS is fixed, and there is no message need to be uploaded to the cloud, device will go to sleep in seconds. If GPS is not fixed, and there is no message need to be uploaded to the cloud, device will read GPS for about 30s then enter sleep. 3.5.2 Wake up Wake up condition:

1. UAM 2. Button press 3. periodically wake up (default 4h, GNSS sample frequency) 3.6 button and LED indication 3.6.1 Device under normal work mode key action function 10 quick press one time Red LED blink once, to tell device is alive and in normal mode. quick press two times sampling and report data to cloud, like on demand feature after send report data to cloud blink the red LED based on ACK or NACK (blink 3x for ACK, blink 4x for NACK). quick press three times Reboot system. long press for over 3s Switch to set up modes. 3.6.2 Device under set up mode key action 1 shot press long press for 3s function Red LED blink twice, to tell device is in set up mode Reboot device to active device, let device into normal work mode, device will register GSM/GNSS and report the beacon data Table 3.1 Table 3.2 3.6.3 LED description Index Green Work mode Normal mode Blue Red Set up mode Normal mode Set up mode 4 LKL, Historical data Description 1: fast blinking: device is connecting with server. 2: slow blinking: try to register network. 3: solid: connection established. off 1: slow blinking: try to lock GPS. 2: solid: GPS is locked. off Please see table 3.1&3.2 4.1 LKL Some time, GPS may not get locked, if this happened, device would use last time position data instead of current invalid data, the GPSFIX flag is the indicator, when it is 1, means current GPS is fixed and data is valid, when it is 2, means GPS not fixed, and the location data is last time data, when it is 0, means data is invalid and GPS not fixed. 4.2 Historical data 4.2.1 When to save historical data and report history data 1. If reporting data failed or GSM signal is bad, or if there are too many data full the message queue, the rest data will be saved in case of loss. 11 2. When network OK, and the real-time data is already sent to the server, device will send the history data to server and delete data in memory. Notice:

1. isHistory is used in the message to mark it is historical data, for example:

{"ts":1577836861040,"values":{"isHistory":1,"ET":"IBL","SN":"A600S20500002H","IMEI":"865284046405886","I MSI":"460046260108483","IPW":3563,"SS":0,"CS":"GSM","OP":"CHINA MOBILE CMCC","LAC":"25F0","CI":"DDF","GFT":0,"LAT":0.000000,"LONG":0.000000,"Heading":0,"Altitude":0.000000,"H DOP":0.000000,"NoS":0,"GFS":0}}

2. At most 2000 historical message sets is supported. 5 How to do a BLE FOTA 5.1 Connect with BLE 1. Due to MBX APP not available, so, we use third party APP. please download EFR Connect APP from Google play or Apple store. 2. after you open this APP, select Develop, show like this:

12 3. then you can search your device, for easier, you can set filer (input ATD600), like this:

13 4. select the right device according to the mac address and connect with it. 14 5. after connection, it shows like this:

15 6. create bond, the passkey is xxxxxx. 16 7. after bonding, you can see like this. 17 5.2 FOTA 4. press the menu show as above, and select OTA DFU 18 5. then use default setting, make a PARTIAL OTA 19 6. select your image file from your phone, press Application to add image, like following picture. 20 7. press OTA to start a FOTA after you load the right Image file. 21 8. after done, just press END, like this:

22 6 Wireless UART Notice: Wireless UART is only valid before first entering sleep. 6.1 What is wireless UART?

As we know, we can get the device`s running log or configure parameters by a serial port connection. Now, we add an EV board as a wireless bridge between PC and MT4200 to achieve the same functionality. It is convenient for us to read the device`s log after the assembly is complete. 23 6.2 How to setup wireless UART?

1. Connect EV board to PC through USB. We use EFR32BG13 radio board. 2. Radio board need to be program (The firmware is scanner-rtos v001.s37) at first run. 3. Open a terminal and open the EV board`s COM. The baud rate is 115200. 24 6.3 How to connect a device?

1. First, EV board will print device list. The format is 0,SN,mac address 25 2. Connect to your device by sending 1,SN,mac address 3. Send AT command to read or write parameter. 26 4. Disconnect by sending 2, SN,mac address or 2,0 5. Attach simple command table at here:

Command mbxReboot mbxEnter mbxExit mbxSN?

mbxHW?

mbxSW?

mbxMac?

mbxSURL?

Description reboot device disable running log (work in normal mode) enable running log (work in normal mode) read SN read hardware version read firmware version read MAC address read server(MQTT) URL mbxSURL="mbxiotfusion.mobilogix.com"1883 write server(MQTT) URL 27 mbxSNP?

read server name and password mbxSNP="862549047761260",""

write server name and password mbxMqttToken?

read MQTT token mbxMqttToken="efccc44eaf36200e44b3"

write MQTT token mbxFURL="http://mbxfota.mobilogix.com",80 write FOTA URL mbxAPN="mobilogix1.telefonica.com"

mbxAPNNP?

read APN name and password mbxAPNNP="mobilogix""88889999"

write APN name and password read FOTA URL read APN write APN read PDP write PDP read geofence state enable/disable geofence read geofence radius write geofence radius read genfence center point read UAM state enable/disable UAM read UAM threshold write UAM threshold read battery voltage read IMEI from modem 28 mbxFURL?

mbxAPN?

mbxPDP?

mbxPDP=1 mbxGF?

mbxGF=1 mbxGFR?

mbxGFR=500 mbxGFCP?

mbxUAM?

mbxUAM=1 mbxUAMV?

mbxUAMV=5,20 mbxBattery?

mbxAT=1,AT+GSN mbxGFCP=114.054428,22.574591 write genfence center point mbxAT=1,AT+CCID read ICCID form modem mbxEnScanBcn?

mbxEnScanBcn=

mbxScanBcn?

mbxScanBcn=600,10 read beacon scanning state enable/disable beacon scanning read beacon scanning time (unit:s) write beacon scanning time (unit:s)

(here 600 is fixed and 10 is the scanning time) sampleConfig?

get sample configuration sampleConfig= frequece, report frequency set sample frequece/report frequency mbxCellRAT?

mbxCellRAT=

Read network setting Write network setting Table 6.1: AT Command Table 7 Use BLE to config device 1. Connect with BLE, detail information please refer to 5.1. 2. Then select Unknow service, you can see like this:

29 3. then please click review every item by click Read and Write, and also please review following configuration table:

Here is the command table:

Default 1.0.0 user description Firmware Version PDP value apn psword apn username bat alarm value bat alarm endisable Read Write Comment TRUE Fault TRUE TRUE TRUE TRUE rang is 1~16 TRUE Max length is 25 bytes TRUE Max length is 25 bytes 3300 mV TRUE TRUE TRUE TRUE 0/1 mode switch 01 TRUE TRUE OPERATION_MODE_SETUP = 0x0, can exit this mode by connecting external power OPERATION_MODE_NORMAL = 0x1, OPERATION_MODE_MANUFACTURE

= 0x2, Only ready for Setup mode and Normal mode TRUE FALSE 16 bytes FALSE TRUE 0/1 FALSE TRUE 0/1 TRUE TRUE 4-24 TRUE TRUE 1-6 F4 01 114.054428;22.574590 TRUE TRUE TRUE TRUE 0/1 TRUE TRUE 0/1 30 1 01 4 4 00 01 ATD600 sn reboot reset Factory GNSS sample frequency report sample data after sample a certain number of times geofenceAlarm Radius geofenceAlarm Point geofenceAlarm En-disable UAM Alarm En-Disable TRUE TRUE TRUE TRUE http://mbxfota.mobilogix.com TRUE TRUE 80 TRUE Max length is 51 bytes TRUE Max length is 4 bytes device Apn mobilogix1.telefonica.com TRUE TRUE Max length is 56 bytes server Port 1883 TRUE TRUE Max length is 4 bytes server url mbxiotfusion.mobilogix.com TRUE TRUE Max length is 51 bytes TRUE TRUE 0: 2G only 1: 2G + NB 2: 2G + NB + M1 3: 2G + M1 4: NB only 5: NB + M1 6: M1 only TRUE TRUE 0/1 TRUE TRUE Table 7.1 BLE command table 20 5 UAM shake Value UAMAlarm shake number fota Url fota Port Network setting Beacon scanning on/off beacon scan duration 03 01 10 31 8. FCC Statement This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help. FCC Radiation Exposure Statement This device complies with FCC radiation exposure limits set forth for an uncontrolled environment and it also complies with Part 15 of the FCC RF Rules. This equipment must be installed and operated in accordance with provided instructions and the antenna(s) used for this transmitter must be installed to provide a separation distance of at least 20 cm from all persons and must not be co-located or operating in conjunction with any other antenna or transmitter. End-users and installers must be provided with antenna installation instructions and consider removing the no-collocation statement. This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:

(1) this device may not cause harmful interference, and

(2) this device must accept any interference received, including interference that may cause undesired operation. Caution!

Any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. 32 9. Canada Statement This device contains licence-exempt transmitter(s)/receiver(s) that comply with Innovation, Science and Economic Development Canadas licence-exempt RSS(s). Operation is subject to the following two conditions:

(1) This device may not cause interference.

(2) This device must accept any interference, including interference that may cause undesired operation of the device. Lmetteur/rcepteur exempt de licence contenu dans le prsent appareil est conforme aux CNR dInnovation, Sciences et Dveloppement conomique Canada applicables aux appareils radio exempts de licence. Lexploitation est autorise aux deux conditions suivantes :

1) Lappareil ne doit pas produire de brouillage;

2) Lappareil doit accepter tout brouillage radiolectrique subi, mme si le brouillage est susceptible den compromettre le fonctionnement. The device meets the exemption from the routine evaluation limits in section 2.5 of RSS 102 and compliance with RSS-102 RF exposure, users can obtain Canadian information on RF exposure and compliance. Le dispositif rencontre l'exemption des limites courantes d'valuation dans la section 2.5 de RSS 102 et la conformit l'exposition de RSS-102 rf, utilisateurs peut obtenir l'information canadienne sur l'exposition et la conformit de rf. This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter. This equipment should be installed and operated with a minimum distance of 20 centimeters between the radiator and your body. Cet metteur ne doit pas tre Co-plac ou ne fonctionnant en mme temps qu'aucune autre antenne ou metteur. Cet quipement devrait tre install et actionn avec une distance minimum de 20 centimtres entre le radiateur et votre corps. 33

(Mobilogix, Inc.) Federal Communications Commission Authorization and Evaluation Division Confidentiality Request regarding application for certification of FCC ID: 2AH4HATD600. Pursuant to Sections 0.457 and 0.459 of the Commissions Rules, we hereby request confidential treatment of information accompanying this application as outlined below:

Exhibit Type Schematics Block Diagram, Operational Description Parts List Tune up procedure File Name 4. Schematics 5. Block Diagram 6. Operational Description 14. Part lists 15. Tune up procedure The above materials contain trade secrets and proprietary information not customarily released to the public. The public disclosure of these materials may be harmful to the applicant and provide unjustified benefits to its competitors. The applicant understands that pursuant to Section 0.457 of the Rules, disclosure of this application and all accompanying documentation will not be made before the date of the Grant for this application. Pursuant to DA04-1705 June 15, 2004 of the Commissions public notice, we also request temporary confidential treatment180 day of information accompanying this application as outlined below:

File Name 8. User Manual 9. Internal Photos 10. External Photos 11. Test Setup Photos Exhibit Type Manual Internal Photos, External Photos, Test Setup Photos, Sincerely, Ramy Mourad Rev 11/20/07

< Mobilogix, Inc.>

Declaration of Authorization We Name: Mobilogix, Inc. Address: 5500 Trabuco Rd, Suite 150, Irvine, California, United States Declare that:

Name Representative of agent: Rose Liu Agent Company name: BTL Inc. Address: No.3 Jinshagang 1st Road, Shixia, Dalang Town City: Dong Guan Country: China is authorized to apply for Certification of the following product(s) and signing all the related documents including 731 forms:

Product description: LTE Cat-M1 Tracker Type designation: ATD600S Trademark: Mobilogix FCC ID: 2AH4HATD600 on our behalf. Date: 2021-09-15 City: Irvine Name: Ramy Mourad Function: VP, R&D Signature: