Wireless sensors and Yggio, the open operational layer for cities, property owners and transport operators. Your data, your operations, your sovereignty.

LoRaWAN User and installation manual

Square Tracker Xtreme for LoRaWAN

The rugged tracker for indoors and out: Wi-Fi and GNSS positioning in an IP68, IK06 housing with a screw frame. This manual takes you from the opened box to a tracker in service, and keeps the technical reference at the end.

Revision A · October 2026 · Sensative AB

1Introduction

Square Tracker Xtreme tells you where your assets are, indoors and outdoors. Outdoors it uses GNSS (GPS and BeiDou); indoors it scans the Wi-Fi access points around it. It scans when the asset starts or stops moving and at set intervals, and a cloud service turns the scans into positions. Its accelerometer detects motion, and it gives an indication of the temperature. The sealed, grey housing is IP68 and IK06, 67.2 × 60.4 × 13 mm, with a conformal-coated circuit board, for wet, dusty and knocked-about places.

The battery is built in (4,000 mAh) and lasts 10 years at 72 positions a day.

It works with any LoRaWAN network server (LoRaWAN 1.0.4, class A, OTAA) and reaches up to 10 km in line of sight. What it measures, when it reports and what it sends is decided by an application running inside the sensor, on Sensative’s Virtual Sensing Machine (VSM). This manual describes the application Tracker R27–R33, which can be configured, and replaced by a newer version, over the air or with NFC. Sensative can also offer alternative VSM applications for the same sensor, which give it a different task; see Which application is in the sensor.

What’s in the box

  • Square Tracker Xtreme, with the adhesive already on the back
  • The screw mounting frame

The keys (DevEUI and AppKey) come with the delivery information. Screws and cable ties are not included.

Parts of the sensor

Square Tracker Xtreme, a grey sealed square tracker
A sealed grey housing with no holes, and eyelets at the top and bottom for cable ties. The NFC field is at the lower left of the front: that is where you hold the phone. The back carries the adhesive and the label with the model, region and serial number.

2Before you start

A LoRaWAN sensor needs a little more preparation than a sensor that pairs with a hub. Have this ready first:

The sensor sends by radio to a gateway, the gateway to the network server, the network server to your application; settings go back as a downlink

You need

  • A LoRaWAN gateway within range, powered on and online
  • An account on a LoRaWAN network server (for example The Things Network, ChirpStack, Loriot or Actility), with the gateway added to it
  • The keys for the sensor: its DevEUI and AppKey, from the delivery information. The JoinEUI is the same for all Square sensors: 70B3D52C0001D4C3.
  • A phone with NFC, to start the sensor. Most smartphones have it; an iPhone needs an NFC reading app (see Finding the NFC antennas).
  • A payload decoder for Sensative VSM sensors in your network server or application (see Decoding the messages)
  • A cloud service that supports GNSS and Wi-Fi positioning, for example Yggio. Without it the scans arrive, but give no position (see GNSS positioning and How Wi-Fi positioning works).

Choosing the place

  • On the asset: fix the tracker where it moves with the asset
  • Sky view for GNSS: outdoors, GNSS needs an unobstructed view of the sky. Mount the tracker with the front, top or right side towards the sky, with nothing over it: a roof, a cover or the asset itself blocks the signal. GNSS does not work indoors or under a sheltering roof
  • Wi-Fi indoors: indoors the position comes from the 2.4 GHz Wi-Fi access points around the tracker (see How Wi-Fi positioning works)
  • Outdoors and in vehicles: the housing is IP68 and IK06, for rain, dust and knocks
  • Range: up to 10 km in open line of sight, much less through walls and floors

Finding the NFC antennas

NFC only reaches a couple of centimetres, so lay the phone flat against the sensor, antenna over antenna. You need to know where both antennas are, and the easiest way to find the spot is to move the phone slowly over the right area until the phone signals contact:

The NFC antenna is at the lower left of the sensor front; in the phone it is often near the top of the back
  • On the sensor: at the lower left of the front, with the logo along the bottom edge.
  • On an Android phone (recommended): switch NFC on, and turn on vibration or a sound for NFC in the phone’s settings, so that the phone tells you as soon as it has found the sensor. The antenna is usually on the back, near the top, often close to the camera, but it varies between models: the phone’s manual or the maker’s website shows where it is. If you cannot find it, move the back of the phone slowly over the sensor’s lower left corner until the phone vibrates.
  • Take off the phone case: a protective case, especially a thick one or one with metal or a magnet, can make it hard to get NFC contact. Remove it while you work with the sensor.
  • Then hold it still: to start a join, keep the phone still over the sensor for about 5 seconds. The vibration only means the phone has found the sensor. Keep the phone where it is until the sensor and the app have finished talking. With the Hugin app this takes a few seconds, because the app first unlocks the sensor through Sensative’s server. If you move away too early, the connection breaks and you have to start again.
  • On an iPhone: use an NFC reading app, such as NFC Reader & Scanner from the App Store. Open it and tap its NFC button, so that it shows Ready to Scan, before you touch the sensor. The iPhone’s antenna is at the top edge of the back. Hold that edge against the sensor’s lower left corner and keep it still; when the read succeeds, a web link with the sensor’s serial number opens. The iPhone NFC join guide (PDF) shows each step with pictures.

3Step by step: from box to ready

8 steps. Register the sensor in the network server before you hold the phone to it. Then join it, check the settings, and mount it last.

1

Unpack

Check the sensor and find its keys. The sensor sleeps until it meets an NFC field.

2

Register the sensor in the network server

  1. Add a new end device in your network server, with activation OTAA.
  2. Use these LoRaWAN settings: MAC version 1.0.4, regional parameters RP002-1.0.3, max EIRP 14 dBm, and the frequency plan for your region.
  3. Enter the DevEUI and the AppKey from the delivery information, and the JoinEUI 70B3D52C0001D4C3. Check them carefully: one wrong character and the join fails.
  4. Set up decoding of the messages (see Decoding the messages).
Done when: the device is listed in the network server, waiting for its first join.
3

Join the network with NFC

Hold the phone over the lower left corner of the front of Square Tracker Xtreme and keep it still for about 5 seconds: that starts the join (see Finding the NFC antennas, also for iPhone). The phone may show a web link with the sensor’s serial number; you do not need to open it.

Register the sensor, hold a phone with NFC over the lower left corner, and it joins within about two minutes
Done when: the network server shows the join, usually within two minutes.
If the network is not yet reachable, the sensor tries again once a day, so the join can take up to 24 hours once the network is there. A new NFC touch starts an attempt at once.
4

Check the signal where it will sit

Put the sensor at the place where it will be mounted, and look at its messages in the network server: the join, and the first reports.

Good: the link must carry at least SF9. As a rule of thumb, look for an SNR above −5 dB and an RSSI above −115 dBm. That leaves a margin to the SF9 limit (about −12.5 dB SNR).
A weaker link forces the network server’s adaptive data rate (ADR) onto SF10–SF12. Each message then takes much longer to send, which costs battery and capacity. If the sensor is still on SF10–SF12 a day after installation, improve the link: move the gateway or the sensor, or add a gateway.
5

Configure (optional)

Square Tracker Xtreme comes with the Tracker application. With the default settings it runs a scan train each time it starts or stops moving, and once a day while it is still: Wi-Fi first, and a GNSS scan as the last step if Wi-Fi finds too few access points. GNSS Mode, motion count and motion time are off. Change the settings to fit how often you need positions, and where: every scan costs battery.

How to change them: see Changing the settings, the settings table and the worked examples.

6

Install

Choose one way, or combine them:

  1. Screws, with the included mounting frame: fix the frame with M4 screws (not included).
  2. Adhesive: the adhesive is already on the back. Clean the surface with a 50:50 mixture of isopropyl alcohol and water, so that it is free of dirt and grease, and let it dry. Peel the film off the adhesive and press the tracker firmly in place.
  3. Cable ties: through the eyelets. Cable ties can be combined with adhesive for extra hold.
Square Tracker Xtreme in its mounting frame, fixed with two screws
With the mounting frame and two M4 screws.
Keep the front reachable for a phone (NFC), and outdoors keep the sky view free.
7

Test

Move the asset, or the tracker, and then leave it still. For GNSS, do this outdoors under an open sky.

Done when: after the movement starts, and again after it stops, scans arrive, and the cloud service (for example Yggio) turns them into a position (see GNSS positioning).
8

Ready

  • Registered in the network server, with the JoinEUI and the right region
  • Joined with NFC, and the messages are decoded
  • Signal checked at the final spot: SF9 or better
  • Connected to a cloud service that supports GNSS and Wi-Fi positioning, for example Yggio
  • Settings checked, or changed as needed
  • Mounted on the asset, with the front reachable and, outdoors, a free view of the sky
  • Positions arriving when the asset moves

4Using the sensor

The settings named in bold are listed in the settings table.

How Wi-Fi positioning works

  • 2.4 GHz only: the radio scans only the 2.4 GHz band (2412–2484 MHz). Networks that broadcast only on 5 GHz are not seen.
  • Passive: the sensor listens for nearby Wi-Fi access points (802.11 b/g/n) and records their MAC addresses and signal strength (RSSI). It does not connect to any network, needs no password and sends nothing over Wi-Fi. The addresses travel in the LoRaWAN uplink.
  • How many: at least 2 access points are needed for a position, and more give a better one.
  • A cloud service is required: to get a position at all, the tracker must be connected to a cloud service that supports GNSS and Wi-Fi positioning, for example Yggio. The service looks the addresses up in a database of mapped access points and returns the position. Munin and LoRa Cloud can also do this.
  • Accuracy: depends on how many known access points are around: typically 5–20 m indoors. With only one or two, expect the area rather than the room. Adding low-cost 2.4 GHz access points improves it.

When it scans: the scan train

Each time the sensor starts moving, and each time it stops, it starts a scan train: a series of scans that ends as soon as one of them finds enough access points (the Minimum Wifi Count, 3 by default).

  1. After 1 minute, a limited Wi-Fi scan, on the channels in the Limited Wifi Scan Channel Mask (all channels by default).
  2. At the Still Wifi Scan Again At Minute (minute 2 by default), a second limited Wi-Fi scan.
  3. At the Full Wifi Scan At Minute, a full Wi-Fi scan, on the channels in the Full Wifi Scan Channel Mask (all channels by default).
  4. At the GNSS Scan At Minute (minute 60 by default), a GNSS scan. The scan train then stops.
  • Periodic scans: the scan train is also restarted at the Stationary Scan Interval while the sensor is still (1,440 minutes, once a day, by default) and at the Moving Scan Interval while it moves (off by default). Do not set an interval shorter than the scan train itself.
  • Scan budget: each scan uses one unit of a budget. The 15 Minute Scan Budget (3 by default) is added every 15 minutes, up to the Max Scan Budget (100 by default). If the budget runs out during a scan train, the remaining scans wait until it has been topped up.
  • Position on demand, with NFC: hold a phone to a sensor that is already joined, as when joining. It starts a scan train at once, and the result arrives as a new scan uplink, which your cloud service turns into a position. This is the way to get a position on demand.

GNSS positioning

  • Default, Wi-Fi first: with the default settings (GNSS Mode 0) the tracker positions by Wi-Fi and uses GNSS (GPS and BeiDou) only as the last step of the scan train, when the Wi-Fi scans have found too few access points. Wi-Fi uses less power and works indoors and in built-up areas.
  • GNSS Mode: with GNSS Mode on, the scan train starts with a GNSS scan after 1 minute. If it finds the Minimum Satellite Count (3 by default), the result is sent and the train stops. If not, a backup Wi-Fi scan follows at the Fallback WIFI Scan At Minute (off by default), and the train stops.
  • Which to choose: for assets that are mostly outdoors, switch GNSS Mode on (GNSS first, with Wi-Fi as backup); for assets that are mostly indoors, keep the Wi-Fi scan train, the default. Worked example 1 shows the switch.
  • Sky view: GNSS needs an unobstructed view of the sky. It does not work indoors or under a sheltering roof (see Choosing the place).
  • Assisted scans: the tracker records the satellite signals and sends them; the cloud service works out the position. This makes a scan take 3–4 seconds instead of about 30. For good assisted scans the tracker needs the right time, within about 30 seconds, and an up-to-date almanac (the satellites’ orbit data).
  • Time and almanac: the tracker asks the network for the time before its Device Time Max Age runs out (see Device registers); once it has, the GNSS scans become autonomous. The application documentation recommends running Munin in the back end to keep the clock in sync and the almanac up to date (see Decoding the messages).

Motion and motion time

  • Detecting motion: the accelerometer detects when the sensor moves. The Still Threshold sets how strong a movement must be to count as motion while the sensor is still, and the Moving Threshold while it is moving. If they are set too low, the sensor believes it is always moving and does not start a scan train when it stops. Start from high values and lower them if the sensor is not sensitive enough.
  • Motion count: off by default. When it is on, the sensor sends the number of motions detected since it started, once an hour if it has changed.
  • Motion time: off by default. When it is on, the sensor sends the total number of minutes in which it has detected movement since it started, once an hour if it has changed.

Temperature

The temperature is measured inside the sensor every 15 minutes, with a typical accuracy of ±2 °C. It is an indication of the conditions around the asset, not a precise room temperature.

  • When it has changed by more than the Temperature Hysteresis (2 °C by default) since the last value sent, the sensor sends the new reading.
  • Every Average Temp Interval (2 hours by default), it sends the average temperature, if it has changed by more than the same hysteresis.
  • Above the Temperature Alarm High Level (60 °C) the alarm state becomes “high”, and below the Temperature Alarm Low Level (2 °C) it becomes “low”. The alarm is sent confirmed, and cancelled when the temperature is back between the levels.

Battery

Once a week the sensor estimates its remaining battery and sends it as a percentage. The estimate is based on the measured running time and the power used by the processor, radio, sensors and position scans.

Network and roaming

  • Confirmed messages: the temperature alarm is acknowledged by the network server, and the sensor sends it again if no acknowledgement arrives.
  • Rejoining: if the sensor is not joined, it tries to join once every 24 hours. If it was joined and has lost the network, it first makes a few quick join attempts. An NFC touch, as in step 3, starts a join attempt at once.
  • Losing the network: the sensor gives the network up if it hears nothing from it for the Downlink Timeout (24 hours by default; see Device registers).
  • Roaming: the sensor can be registered in up to 15 LoRaWAN networks, in priority order. Register it in each with the same DevEUI and JoinEUI, and with the last digit of the AppKey counting up: …00 for the first network, …01 for the second, and so on. Then set the Roaming Network Count. If the sensor loses its network, it tries the next one in turn. Every 24 hours it goes back to trying the first. More than one network makes each join take longer and use more power.

Decoding the messages

The messages are compact binary records, and their meaning depends on the application version. Decode them with a VSM-aware decoder:

  • Yggio decodes them with its built-in VSM translator, and keeps track of each sensor’s application version.
  • Other platforms: use Munin, Sensative’s open-source MQTT client. It decodes the messages for any network server, keeps the device state the decoder needs and the device time up to date, and solves Wi-Fi positions.
  • Your own integration: the open-source VSM translator is the decoder that Munin uses, available as a Node package. It needs two things from you: it must be able to store at least the rulesCrc32 for each sensor between messages, and it must be kept up to date, since new application versions are released without notice.

Wi-Fi scans arrive on port 23 or 24, and GNSS scans on port 21 (with metadata on port 22); the decoder handles them all.

Changing the settings

There are two ways: over the air, with downlinks from your network server, or on site with the Hugin NFC app. Both usually start in the VSM Configuration Tool, which makes the downlinks for you.

  1. Pick the application: by name and version, or by the rulesCrc32 from the sensor’s port 15 message (see Which application is in the sensor).
  2. Choose a configuration: a released profile from the Profile Library (none are released for this application, see Released profiles), or Custom to set your own values. Each setting shows its description, unit and range.
  3. Take the result: one or more downlinks for port 2, or a single payload for port 7, in hex or base64, to send from your network server. Or a QR code to scan with the Hugin NFC app, which then writes the configuration to the sensor on site.
The sensor is a class A device: it picks up a downlink right after its next uplink. A new setting takes effect after the sensor’s next message at the earliest, and on a busy network it can take longer before the downlink gets through. Every setting that makes the sensor send more often costs battery.

5The Hugin NFC app

Hugin is an optional Android app for working with the sensor on site, over NFC. It needs an Android phone with NFC and GPS, and an Yggio user account. The sensor must also be registered in Yggio with your organisation as its owner: Hugin checks this with Yggio before it lets you work with the sensor. Hold the phone to the sensor as in Finding the NFC antennas. The app then shows the serial number, the application and its version, the state (for example joined), battery, link and region information, and the DevEUI. Depending on your rights in Yggio, it can read and apply configuration profiles, including one scanned as a QR code from the VSM Configuration Tool, and update the device time and position.

Installation, sign-in, flashing and troubleshooting are in the Hugin NFC app manual.

6Maintenance and removal

Battery

The battery is built in (4,000 mAh) and lasts 10 years at 72 positions a day in a good network (SF7–SF9). Frequent reporting and a weak link shorten it.

Removing Square Tracker Xtreme

Slide dental floss behind the sensor and saw gently through the adhesive.

Moving to another network server

Delete the device from the old network server and add it to the new one. The sensor’s link check then fails, it leaves the old network and joins the new one. This usually takes one to two days. With the Hugin app you can restart it at once instead (Toggle On/Off), but that also resets any custom settings.

Storage and disposal

  • Store unused sensors at +10 to +30 °C.
  • The sensor contains a non-replaceable lithium manganese dioxide (LiMnO₂) battery, one of the most stable lithium chemistries. Do not open the sensor, and do not puncture it or heat it above +80 °C.
  • When the battery is empty, dispose of the whole sensor as a battery, for recycling. Near the end of its life the battery normally swells a little; this is expected.

7Troubleshooting

ProblemWhat to do
No GNSS position outdoorsGNSS needs an open sky: check that nothing covers the tracker and that its front, top or right side faces the sky. Keep the time and the almanac current (see GNSS positioning).
No scan when the asset stopsThe Still Threshold or the Moving Threshold is set too low, so the sensor believes it is still moving (see Motion and motion time). Raise them.
Scans stop when the asset moves a lotThe scan budget has run out. The remaining scans follow when it has been topped up; raise the 15 Minute Scan Budget only if the battery allows it.
No position, or a poor oneA position needs a cloud service that supports GNSS and Wi-Fi positioning, for example Yggio, and enough 2.4 GHz access points that the service knows; networks on 5 GHz only are not seen. See How Wi-Fi positioning works.
Nothing happens when I hold the phone to itCheck that NFC is on and the phone case is off. Lay the phone flat against the lower left corner and move it slowly until it signals contact, then hold it still (see Finding the NFC antennas).
Join Request in the network server, but no Join AcceptCheck the keys, the JoinEUI 70B3D52C0001D4C3, the LoRaWAN version (1.0.4), the regional parameters (RP002-1.0.3) and the frequency plan. In US915 and AU915, the sub-band must match the gateway.
Nothing at all in the network serverCheck that the gateway is on and online, and that the sensor is in range and not inside a closed metal enclosure. Then start a new join with NFC, as in step 3.
“MIC mismatch”The keys are wrong. Check that they belong to this sensor and are typed correctly.
Messages arrive, but the decoder shows no readingsThe decoder has usually missed the application identity: send 00 on port 15, and check that the decoder is up to date (see Which application is in the sensor).
The Hugin app loses the connectionHold the phone still until the app has finished (see Finding the NFC antennas).
A new setting has no effectA downlink arrives only after the sensor’s next message, and later on a busy network (see Changing the settings). Check that it is still queued, and that it was made for the rulesCrc32 your sensor reports.
Messages missing or irregularCheck RSSI and SNR. The sensor may be too far from the gateway, or shut inside metal. Some channels can also be disturbed by interference on the same frequency band, for example from a nearby cellular transmitter or an RFID reader.

8Technical reference

For integrators. The values below are for the application Tracker R27–R33. Other versions can differ: check the VSM application documentation or the VSM Configuration Tool for yours.

Which application is in the sensor

Right after it has joined, the sensor sends its application identity, the rulesCrc32, on port 15. The decoder uses it to pick the right translation, and you need it to make the right downlinks. For this application it is:

ApplicationTracker
VersionR27–R33
rulesCrc323802553086 (hex E2A65AFE)

If you missed the message, send 00 on port 15 and the sensor sends its identity again. The Hugin NFC app also shows the application and its version on site.

Settings, ids and defaults belong to one application version. If your sensor reports another rulesCrc32, look that number up in the VSM application documentation or the VSM Configuration Tool instead of using the tables here.

Alternative applications: besides Tracker, Sensative can offer other VSM applications for the same hardware. They are available in the Hugin NFC app (Android) and can also be loaded into the sensor over LoRaWAN. Ask Sensative which applications fit your use. After a change, ask for the identity with 00 on port 15 and use the documentation for that application.

LoRaWAN and ports

LoRaWANMAC 1.0.4, regional parameters RP002-1.0.3, class A, OTAA, max EIRP 14 dBm
JoinEUI70B3D52C0001D4C3 (all Square and Puck sensors)
PortDirectionWhat it carries
1UplinkTemperature, motion count and time, battery (see Messages)
11UplinkThe same outputs in compressed form
15UplinkApplication identity (rulesCrc32), first thing after a join
15Downlink00 asks the sensor to send its application identity again
23, 24UplinkWi-Fi scans, for positioning. They arrive on port 23 or 24; the decoder handles both.
21UplinkGNSS scans, for positioning
22UplinkGNSS scan metadata
2DownlinkSettings and read requests (see Settings on port 2)
2UplinkThe sensor’s answer: the values it now has
7DownlinkA whole configuration in one payload (see A whole configuration on port 7)
7UplinkThe status of that configuration: None, Applied, Error or Dirty

Messages

Each output has an id and a scale. “Confirmed” outputs are acknowledged by the network server.

OutputIdSize and scaleUnitConfirmedSent
tempB02 bytes, × 0.01°CNoOn a change larger than the Temperature Hysteresis (measured every 15 minutes)
averageTempB12 bytes, × 0.01°CNoEvery Average Temp Interval, if changed by more than the Temperature Hysteresis
tempAlarm801 byte0 = no alarm, 1 = high, −1 = lowYesWhen the alarm state changes
motionCountBA4 bytesnumber of motions since startNoHourly if changed, when Enable Motion Count Report is on
motionTimeMinutesBB4 bytesminutes with motion since startNoHourly if changed, when Motion Time Enabled is on
batteryPercentAE1 byte% (estimated)NoOnce a week

Settings

The defaults are the values the sensor starts with. The id is what a port 2 downlink uses. Values are sent in the steps shown: the temperature hysteresis, in steps of 0.01, is sent as a hundred times its value; all the others are whole numbers.

SettingName in the applicationIdWhat it doesUnitRangeDefault
Still ThresholdstillMotionThreshold_mm_s2B3How strong a movement must be to count as motion while the sensor is still. Too low, and it believes it is always moving.mm/s²5–10,00050
Moving ThresholdmovingMotionThreshold_mm_s2B4How strong a movement must be to count as continued motion while the sensor is moving.mm/s²5–10,00030
Minimum Wifi CountminimumWifiCountA6How many Wi-Fi access points a scan must find for the scan train to stop.access points1–153
Still Wifi Scan Again At MinutesingleWifiScanAgain_minutesA5Minute of the second limited Wi-Fi scan after the sensor starts or stops moving. −1 switches it off. Avoid 1: the first scan is always at minute 1.minutes−1 to 1272
Full Wifi Scan At MinutefullWifiScan_minutesA8Minute of the full Wi-Fi scan after the sensor starts or stops moving. −1 switches it off. Avoid 1.minutes−1 to 127not documented
Limited Wifi Scan Channel MasklimitedScanChannelsB8The Wi-Fi channels for the limited scans, as a bit mask: channels 1 and 3 are binary 101, decimal 5. 0 means all channels. Fewer channels save power.bit mask0–65,5350
Full Wifi Scan Channel MaskfullScanChannelsB9The Wi-Fi channels for the full scan, as a bit mask in the same way.bit mask0–65,5350
GNSS ModegnssModeAC1 starts each scan train with a GNSS scan, with an optional Wi-Fi backup. 0 is Wi-Fi first, with GNSS as the last step.on/off0–10
GNSS Scan At MinutegpsScan_minutesA9Minute of the GNSS scan, the last step of the scan train when GNSS Mode is off. −1 switches it off. Avoid 1, and avoid the same minute as the full Wi-Fi scan.minutes−1 to 12760
Minimum Satellite CountminimumGnssCountA7In GNSS Mode: how many satellites a GNSS scan must find for the scan train to stop.satellites1–153
Fallback WIFI Scan At MinutebackUpWifiGnssScanMinutesADIn GNSS Mode: minute of the backup Wi-Fi scan, if the GNSS scan did not find enough satellites. −1 switches it off. Do not set it before minute 1.minutes−1 to 127−1 (off)
Moving Scan IntervalmovingScanIntervalMinutesBCRestarts the scan train at this interval while the sensor is moving. −1 switches it off. Do not set it shorter than the scan train.minutes−1 to 32,768−1 (off)
Stationary Scan IntervalstationaryScanIntervalMinutesBDRestarts the scan train at this interval while the sensor is still. −1 switches it off.minutes−1 to 32,7671,440
15 Minute Scan BudgetquarterlyScanBudgetA4How many scans are added to the scan budget every 15 minutes.scans1–153
Max Scan BudgetmaxBudgetB5The most the scan budget can hold. Each scan uses one unit.scans1–32,767100
Enable Motion Count ReportmotionCountEnabledAA1 sends the number of motions detected, hourly if changed.on/off0–10
Motion Time EnabledmotionTimeEnabledAB1 sends the number of minutes with motion, hourly if changed.on/off0–10
Temperature HysteresistempHysteresisB2Change in temperature needed before a new reading or average is sent.°C, steps of 0.010.1–1272
Average Temp IntervalaverageTempIntervalHoursA0How often the average temperature is sent, if it has changed by more than the hysteresis.hours1–1272
Temperature Alarm Low LeveltempAlarmLowLevelA1Low alarm level. Must be below the high level, or the alarm is off.°C−128 to +1262
Temperature Alarm High LeveltempAlarmHighLevelA2High alarm level. Must be above the low level, or the alarm is off.°C−127 to +12760
Roaming Network CountroamNetworkCountA3Number of LoRaWAN network identities to try in turn (see Network and roaming).number1–151
Quick Rejoin AttemptsquickRejoinBudgetMaxB6How many quick join attempts the sensor makes after losing a network, before it goes back to one attempt a day.numbernot documentednot documented

Device registers

These belong to the sensor’s firmware rather than to the application, but the application uses them and they can be changed the same way. Leave them as they are unless you have a reason.

RegisterNameIdWhat it doesUnitRangeDefault
Downlink TimeoutLINKCHECK_TIMED0How long the sensor goes without hearing from the network before it gives the network up and becomes unjoined. Any downlink, an acknowledgement included, starts the time again. From half the time on, every uplink is sent confirmed; from 80 % on, the sensor also sends link checks of its own. 0 turns the check off. The sensor sets it back to 24 hours each time it starts.seconds300–2,592,00086,400
TX Power RangeTX_POWER_RANGED8The power index range for fast adaptive data rate: lowest in the low byte, highest in the high byte, each 0 (the region’s best) to 16 (DR0, maximum power). Raising it costs a lot of battery.2 bytes0–65,535
Device Time Max AgeGPS_TIME_MAX_AGECDHow long the sensor trusts its clock. Once this time has passed, the GNSS scans become autonomous (no longer assisted). From 80 % of it, the sensor asks the LoRaWAN network for the time with the standard DeviceTime request (DeviceTimeReq, LoRaWAN 1.0.3 and later); the network server must answer DeviceTime requests. The clock typically drifts a few seconds a day, more outdoors.seconds0–4,294,967,2950

Released profiles

No ready-made profiles are released for this application. The sensor starts with the defaults in the settings table; to change them, use Custom in the VSM Configuration Tool.

Settings on port 2

A port 2 downlink is a list of records of 5 bytes each: one byte for the setting’s id, then the value as a signed 32-bit integer, most significant byte first. The value is in the setting’s own steps: a temperature hysteresis of 2 °C in steps of 0.01 is sent as 200; a scan interval of 30 minutes is sent as 30. Negative values are written in two’s complement, so −10 becomes FF FF FF F6. The sensor applies the values and answers on port 2 with the values it now has.

The ids belong to one application version. Another version can use the same id for a different setting, so a downlink made for one version can change the wrong setting in another. Always make the downlink for the rulesCrc32 the sensor itself reports.

Reading values

A port 2 downlink of one to four bytes is a read request: the sensor sends back the current value of each id in it.

Port 2 downlinkThe sensor answers with
04Current temperature, in hundredths of a degree
16The motion sensor
BDThe Stationary Scan Interval now set (any setting id works the same way)

A whole configuration on port 7

The VSM Configuration Tool can also pack a configuration into a single port 7 payload. It starts with the application’s CRC and ends with a checksum of the configuration (configCrc32). The sensor reports the result on port 7: None, Applied, Error or Dirty.

Worked example 1: GNSS first, for assets that are mostly outdoors

Switch GNSS Mode on, with a backup Wi-Fi scan at minute 5 if the GNSS scan finds too few satellites. Both examples were made in the VSM Configuration Tool for rulesCrc32 3802553086. Send one of the payloads, port 2 or port 7, not both.

SettingValueSent asRecord
GNSS Modeon1AC 00 00 00 01
Fallback WIFI Scan At Minute55AD 00 00 00 05
Port 2 (hex)AD 00 00 00 05 AC 00 00 00 01
Port 2 (base64)rQAAAAWsAAAAAQ==
Or port 7 (hex)E2 A6 5A FE 02 0A AD 00 00 00 05 AC 00 00 00 01 00 3F 74 C4 7F

Worked example 2: Positions while the asset is moving

Restart the scan train every 30 minutes while the sensor is moving. Each restart uses scans from the budget and battery.

SettingValueSent asRecord
Moving Scan Interval30 min30BC 00 00 00 1E
Port 2 (hex)BC 00 00 00 1E
Port 2 (base64)vAAAAB4=
Or port 7 (hex)E2 A6 5A FE 02 05 BC 00 00 00 1E 00 55 6F 44 60

9Specifications

PositioningGNSS (GPS and BeiDou) outdoors, 2.4 GHz Wi-Fi scanning indoors; a cloud service that supports both is needed
SensorsMotion (3D accelerometer), temperature (typical ±2 °C)
RadioLoRaWAN 1.0.4, class A, OTAA; JoinEUI 70B3D52C0001D4C3
Frequency plansEU868 · US915 · AU915 · AS923-1 · AS923-2 · KR920 · IN865
RangeUp to 10 km in line of sight
ConfigurationNFC (Android) and over the air
ApplicationVSM application Tracker (R27–R33)
BatteryBuilt-in LiMnO₂, 4,000 mAh; 10 years at 72 positions a day
IP ratingIP68
Impact ratingIK06
Operating temperature−20 to +60 °C
Dimensions67.2 × 60.4 × 13 mm
Weight61 g
MountingScrew frame included; adhesive or cable ties through the eyelets also work

10Support

Sources: Sensative Docs, Square Tracker Xtreme (Dec 2024, including the GNSS scan times), FAQ Square & Puck and Hugin NFC application; VSM Configuration Tool, application data for Tracker (read 31 October 2026); VSM application documentation on GitHub (3802553086-Tracker); VSM translator (open source); specifications from the sensative.com product data; Wi-Fi positioning: Semtech, Wi-Fi geolocation with LoRa Edge.