Wireless sensors and Yggio, the open operational layer for cities, property owners and transport operators. Your data, your operations, your sovereignty.

LoRaWAN User and installation manual

Square Tracker for LoRaWAN

A 7 mm Wi-Fi tracker that scans when an asset starts or stops moving, so you know where it is without positioning infrastructure. This manual takes you from the opened box to a tracker in service, and keeps the technical reference at the end.

Revision A · October 2026 · Sensative AB

1Introduction

Square Tracker tells you where your assets are indoors. It scans the Wi-Fi access points around it when it starts or stops moving, and at set intervals, and a cloud service turns the scans into positions. Its accelerometer detects motion, so it can also report how much an asset is moved, and it gives an indication of the temperature. It is 58 × 58 × 7 mm, IP63, with a plain front and no holes.

The battery is built in (750 mAh) and lasts 10 years at 12 positions a day. For more frequent positions there is Square Tracker L, 15 mm thick with 6,000 mAh (see the Square Tracker L manual).

It works with any LoRaWAN network server (LoRaWAN 1.0.4, class A, OTAA) and reaches up to 10 km in line of sight. What it measures, when it reports and what it sends is decided by an application running inside the sensor, on Sensative’s Virtual Sensing Machine (VSM). This manual describes the application Tracker R27–R33, which can be configured, and replaced by a newer version, over the air or with NFC. Sensative can also offer alternative VSM applications for the same sensor, which give it a different task; see Which application is in the sensor.

What’s in the box

  • Square Tracker, with the adhesive already on the back

The keys (DevEUI and AppKey) come with the delivery information. The Square screw mounting kit is sold separately.

Parts of the sensor

Square Tracker, 7 mm thin, with a plain front
The front is plain, with no holes. The NFC field is at the lower left of the front: that is where you hold the phone. The back carries the adhesive and the label with the model, region and serial number.

2Before you start

A LoRaWAN sensor needs a little more preparation than a sensor that pairs with a hub. Have this ready first:

The sensor sends by radio to a gateway, the gateway to the network server, the network server to your application; settings go back as a downlink

You need

  • A LoRaWAN gateway within range, powered on and online
  • An account on a LoRaWAN network server (for example The Things Network, ChirpStack, Loriot or Actility), with the gateway added to it
  • The keys for the sensor: its DevEUI and AppKey, from the delivery information. The JoinEUI is the same for all Square sensors: 70B3D52C0001D4C3.
  • A phone with NFC, to start the sensor. Most smartphones have it; an iPhone needs an NFC reading app (see Finding the NFC antennas).
  • A payload decoder for Sensative VSM sensors in your network server or application (see Decoding the messages)
  • A cloud service that supports Wi-Fi positioning, for example Yggio. Without it the scans arrive, but give no position (see How Wi-Fi positioning works).

Choosing the place

  • On the asset: fix the sensor where it moves with the asset
  • Wi-Fi around it: the position comes from the Wi-Fi access points the sensor can see, so it works where there is Wi-Fi, typically indoors
  • Indoors or sheltered outdoors: the sensor is IP63
  • Range: up to 10 km in open line of sight, much less through walls and floors
  • Metal is fine: unlike Strips, a Square sensor can be mounted on metal without much effect on the radio. Avoid only closed metal enclosures, such as a shut steel cabinet, which also block Wi-Fi.

Finding the NFC antennas

NFC only reaches a couple of centimetres, so lay the phone flat against the sensor, antenna over antenna. You need to know where both antennas are, and the easiest way to find the spot is to move the phone slowly over the right area until the phone signals contact:

The NFC antenna is at the lower left of the sensor front; in the phone it is often near the top of the back
  • On the sensor: at the lower left of the front, with the logo along the bottom edge.
  • On an Android phone (recommended): switch NFC on, and turn on vibration or a sound for NFC in the phone’s settings, so that the phone tells you as soon as it has found the sensor. The antenna is usually on the back, near the top, often close to the camera, but it varies between models: the phone’s manual or the maker’s website shows where it is. If you cannot find it, move the back of the phone slowly over the sensor’s lower left corner until the phone vibrates.
  • Take off the phone case: a protective case, especially a thick one or one with metal or a magnet, can make it hard to get NFC contact. Remove it while you work with the sensor.
  • Then hold it still: to start a join, keep the phone still over the sensor for about 5 seconds. The vibration only means the phone has found the sensor. Keep the phone where it is until the sensor and the app have finished talking. With the Hugin app this takes a few seconds, because the app first unlocks the sensor through Sensative’s server. If you move away too early, the connection breaks and you have to start again.
  • On an iPhone: use an NFC reading app, such as NFC Reader & Scanner from the App Store. Open it and tap its NFC button, so that it shows Ready to Scan, before you touch the sensor. The iPhone’s antenna is at the top edge of the back. Hold that edge against the sensor’s lower left corner and keep it still; when the read succeeds, a web link with the sensor’s serial number opens. The iPhone NFC join guide (PDF) shows each step with pictures.

3Step by step: from box to ready

8 steps. Register the sensor in the network server before you hold the phone to it. Then join it, check the settings, and mount it last.

1

Unpack

Check the sensor and find its keys. The sensor sleeps until it meets an NFC field.

2

Register the sensor in the network server

  1. Add a new end device in your network server, with activation OTAA.
  2. Use these LoRaWAN settings: MAC version 1.0.4, regional parameters RP002-1.0.3, max EIRP 14 dBm, and the frequency plan for your region.
  3. Enter the DevEUI and the AppKey from the delivery information, and the JoinEUI 70B3D52C0001D4C3. Check them carefully: one wrong character and the join fails.
  4. Set up decoding of the messages (see Decoding the messages).
Done when: the device is listed in the network server, waiting for its first join.
3

Join the network with NFC

Hold the phone over the lower left corner of the front of Square Tracker and keep it still for about 5 seconds: that starts the join (see Finding the NFC antennas, also for iPhone). The phone may show a web link with the sensor’s serial number; you do not need to open it.

Register the sensor, hold a phone with NFC over the lower left corner, and it joins within about two minutes
Done when: the network server shows the join, usually within two minutes.
If the network is not yet reachable, the sensor tries again once a day, so the join can take up to 24 hours once the network is there. A new NFC touch starts an attempt at once.
4

Check the signal where it will sit

Put the sensor at the place where it will be mounted, and look at its messages in the network server: the join, and the first reports.

Good: the link must carry at least SF9. As a rule of thumb, look for an SNR above −5 dB and an RSSI above −115 dBm. That leaves a margin to the SF9 limit (about −12.5 dB SNR).
A weaker link forces the network server’s adaptive data rate (ADR) onto SF10–SF12. Each message then takes much longer to send, which costs battery and capacity. If the sensor is still on SF10–SF12 a day after installation, improve the link: move the gateway or the sensor, or add a gateway.
5

Configure (optional)

Square Tracker comes with the Tracker application. With the default settings it runs a scan train each time it starts or stops moving, and once a day while it is still; motion count and motion time are off. Change the settings to fit how often you need positions: every scan costs battery.

How to change them: see Changing the settings, the settings table and the worked examples.

6

Install

Choose one of two ways:

  1. Adhesive: clean the surface with a 50:50 mixture of isopropyl alcohol and water, so that it is free of dirt and grease, and let it dry. Peel the film off the adhesive on the back and press the sensor firmly in place.
  2. Screws, with the Square screw mounting kit (sold separately): two 2 mm adhesive plates on a marking foil. Use the foil to mark the drill holes, either beside the sensor or hidden behind it (then use ultra-low-profile flat-head screws). Screw the plates on with the thick adhesive side towards you, peel the films off the plates and the sensor, check the alignment, and press the sensor firmly onto the plates.
Mount it so that the front, with the NFC field at the lower left, can still be reached with a phone.
7

Test

Move the asset, or the sensor, and then leave it still.

Done when: about a minute after the movement starts, and again after it stops, Wi-Fi scans arrive, and the cloud service (for example Yggio) turns them into a position (see How Wi-Fi positioning works).
8

Ready

  • Registered in the network server, with the JoinEUI and the right region
  • Joined with NFC, and the messages are decoded
  • Signal checked at the final spot: SF9 or better
  • Connected to a cloud service that supports Wi-Fi positioning, for example Yggio
  • Settings checked, or changed as needed
  • Mounted on the asset, with the NFC corner reachable
  • Positions arriving when the asset moves

4Using the sensor

The settings named in bold are listed in the settings table.

How Wi-Fi positioning works

  • 2.4 GHz only: the radio scans only the 2.4 GHz band (2412–2484 MHz). Networks that broadcast only on 5 GHz are not seen.
  • Passive: the sensor listens for nearby Wi-Fi access points (802.11 b/g/n) and records their MAC addresses and signal strength (RSSI). It does not connect to any network, needs no password and sends nothing over Wi-Fi. The addresses travel in the LoRaWAN uplink.
  • How many: at least 2 access points are needed for a position, and more give a better one.
  • A cloud service is required: to get a position at all, the tracker must be connected to a cloud service that supports Wi-Fi positioning, for example Yggio. The service looks the addresses up in a database of mapped access points and returns the position. Munin and LoRa Cloud can also do this.
  • Accuracy: depends on how many known access points are around: typically 5–20 m indoors. With only one or two, expect the area rather than the room. Adding low-cost 2.4 GHz access points improves it.
  • Wi-Fi only: Square Tracker has no satellite positioning.

When it scans: the scan train

Each time the sensor starts moving, and each time it stops, it starts a scan train: a series of scans that ends as soon as one of them finds enough access points (the Minimum Wifi Count, 3 by default).

  1. After 1 minute, a limited Wi-Fi scan, on the channels in the Limited Wifi Scan Channel Mask (all channels by default).
  2. At the Still Wifi Scan Again At Minute (minute 2 by default), a second limited Wi-Fi scan.
  3. At the Full Wifi Scan At Minute, a full Wi-Fi scan, on the channels in the Full Wifi Scan Channel Mask (all channels by default).
  • Periodic scans: the scan train is also restarted at the Stationary Scan Interval while the sensor is still (1,440 minutes, once a day, by default) and at the Moving Scan Interval while it moves (off by default). Do not set an interval shorter than the scan train itself.
  • Scan budget: each scan uses one unit of a budget. The 15 Minute Scan Budget (3 by default) is added every 15 minutes, up to the Max Scan Budget (100 by default). If the budget runs out during a scan train, the remaining scans wait until it has been topped up.
  • Position on demand, with NFC: hold a phone to a sensor that is already joined, as when joining. It starts a scan train at once, and the result arrives as a new Wi-Fi scan uplink, which your cloud service turns into a position. This is the way to get a position on demand.

Motion and motion time

  • Detecting motion: the accelerometer detects when the sensor moves. The Still Threshold sets how strong a movement must be to count as motion while the sensor is still, and the Moving Threshold while it is moving. If they are set too low, the sensor believes it is always moving and does not start a scan train when it stops. Start from high values and lower them if the sensor is not sensitive enough.
  • Motion count: off by default. When it is on, the sensor sends the number of motions detected since it started, once an hour if it has changed.
  • Motion time: off by default. When it is on, the sensor sends the total number of minutes in which it has detected movement since it started, once an hour if it has changed.

Temperature

The temperature is measured inside the sensor every 15 minutes, with a typical accuracy of ±2 °C. It is an indication of the conditions around the asset, not a precise room temperature.

  • When it has changed by more than the Temperature Hysteresis (2 °C by default) since the last value sent, the sensor sends the new reading.
  • Every Average Temp Interval (2 hours by default), it sends the average temperature, if it has changed by more than the same hysteresis.
  • Above the Temperature Alarm High Level (60 °C) the alarm state becomes “high”, and below the Temperature Alarm Low Level (2 °C) it becomes “low”. The alarm is sent confirmed, and cancelled when the temperature is back between the levels.

Battery

Once a week the sensor estimates its remaining battery and sends it as a percentage. The estimate is based on the measured running time and the power used by the processor, radio, sensors and position scans.

Network and roaming

  • Confirmed messages: the temperature alarm is acknowledged by the network server, and the sensor sends it again if no acknowledgement arrives.
  • Rejoining: if the sensor is not joined, it tries to join once every 24 hours. If it was joined and has lost the network, it first makes a few quick join attempts. An NFC touch, as in step 3, starts a join attempt at once.
  • Losing the network: the sensor gives the network up if it hears nothing from it for the Downlink Timeout (24 hours by default; see Device registers).
  • Roaming: the sensor can be registered in up to 15 LoRaWAN networks, in priority order. Register it in each with the same DevEUI and JoinEUI, and with the last digit of the AppKey counting up: …00 for the first network, …01 for the second, and so on. Then set the Roaming Network Count. If the sensor loses its network, it tries the next one in turn. Every 24 hours it goes back to trying the first. More than one network makes each join take longer and use more power.

Decoding the messages

The messages are compact binary records, and their meaning depends on the application version. Decode them with a VSM-aware decoder:

  • Yggio decodes them with its built-in VSM translator, and keeps track of each sensor’s application version.
  • Other platforms: use Munin, Sensative’s open-source MQTT client. It decodes the messages for any network server, keeps the device state the decoder needs and the device time up to date, and solves Wi-Fi positions.
  • Your own integration: the open-source VSM translator is the decoder that Munin uses, available as a Node package. It needs two things from you: it must be able to store at least the rulesCrc32 for each sensor between messages, and it must be kept up to date, since new application versions are released without notice.

Wi-Fi scans arrive on port 23 or 24; the decoder handles both.

Changing the settings

There are two ways: over the air, with downlinks from your network server, or on site with the Hugin NFC app. Both usually start in the VSM Configuration Tool, which makes the downlinks for you.

  1. Pick the application: by name and version, or by the rulesCrc32 from the sensor’s port 15 message (see Which application is in the sensor).
  2. Choose a configuration: a released profile from the Profile Library (none are released for this application, see Released profiles), or Custom to set your own values. Each setting shows its description, unit and range.
  3. Take the result: one or more downlinks for port 2, or a single payload for port 7, in hex or base64, to send from your network server. Or a QR code to scan with the Hugin NFC app, which then writes the configuration to the sensor on site.
The sensor is a class A device: it picks up a downlink right after its next uplink. A new setting takes effect after the sensor’s next message at the earliest, and on a busy network it can take longer before the downlink gets through. Every setting that makes the sensor send more often costs battery.

5The Hugin NFC app

Hugin is an optional Android app for working with the sensor on site, over NFC. It needs an Android phone with NFC and GPS, and an Yggio user account. The sensor must also be registered in Yggio with your organisation as its owner: Hugin checks this with Yggio before it lets you work with the sensor. Hold the phone to the sensor as in Finding the NFC antennas. The app then shows the serial number, the application and its version, the state (for example joined), battery, link and region information, and the DevEUI. Depending on your rights in Yggio, it can read and apply configuration profiles, including one scanned as a QR code from the VSM Configuration Tool, and update the device time and position.

Installation, sign-in, flashing and troubleshooting are in the Hugin NFC app manual.

6Maintenance and removal

Battery

The battery is built in (750 mAh) and lasts 10 years at 12 positions a day in a good network (SF7–SF9). Frequent reporting and a weak link shorten it.

Removing Square Tracker

Slide dental floss behind the sensor and saw gently through the adhesive.

Moving to another network server

Delete the device from the old network server and add it to the new one. The sensor’s link check then fails, it leaves the old network and joins the new one. This usually takes one to two days. With the Hugin app you can restart it at once instead (Toggle On/Off), but that also resets any custom settings.

Storage and disposal

  • Store unused sensors at +10 to +30 °C.
  • The sensor contains a non-replaceable lithium manganese dioxide (LiMnO₂) battery, one of the most stable lithium chemistries. Do not open the sensor, and do not puncture it or heat it above +80 °C.
  • When the battery is empty, dispose of the whole sensor as a battery, for recycling. Near the end of its life the battery normally swells a little; this is expected.

7Troubleshooting

ProblemWhat to do
No scan when the asset stopsThe Still Threshold or the Moving Threshold is set too low, so the sensor believes it is still moving (see Motion and motion time). Raise them.
Scans stop when the asset moves a lotThe scan budget has run out. The remaining scans follow when it has been topped up; raise the 15 Minute Scan Budget only if the battery allows it.
No position, or a poor oneA position needs a cloud service that supports Wi-Fi positioning, for example Yggio, and enough 2.4 GHz access points that the service knows; networks on 5 GHz only are not seen. See How Wi-Fi positioning works.
Nothing happens when I hold the phone to itCheck that NFC is on and the phone case is off. Lay the phone flat against the lower left corner and move it slowly until it signals contact, then hold it still (see Finding the NFC antennas).
Join Request in the network server, but no Join AcceptCheck the keys, the JoinEUI 70B3D52C0001D4C3, the LoRaWAN version (1.0.4), the regional parameters (RP002-1.0.3) and the frequency plan. In US915 and AU915, the sub-band must match the gateway.
Nothing at all in the network serverCheck that the gateway is on and online, and that the sensor is in range and not inside a closed metal enclosure. Then start a new join with NFC, as in step 3.
“MIC mismatch”The keys are wrong. Check that they belong to this sensor and are typed correctly.
Messages arrive, but the decoder shows no readingsThe decoder has usually missed the application identity: send 00 on port 15, and check that the decoder is up to date (see Which application is in the sensor).
The Hugin app loses the connectionHold the phone still until the app has finished (see Finding the NFC antennas).
A new setting has no effectA downlink arrives only after the sensor’s next message, and later on a busy network (see Changing the settings). Check that it is still queued, and that it was made for the rulesCrc32 your sensor reports.
Messages missing or irregularCheck RSSI and SNR. The sensor may be too far from the gateway, or shut inside metal. Some channels can also be disturbed by interference on the same frequency band, for example from a nearby cellular transmitter or an RFID reader.

8Technical reference

For integrators. The values below are for the application Tracker R27–R33. Other versions can differ: check the VSM application documentation or the VSM Configuration Tool for yours.

Which application is in the sensor

Right after it has joined, the sensor sends its application identity, the rulesCrc32, on port 15. The decoder uses it to pick the right translation, and you need it to make the right downlinks. For this application it is:

ApplicationTracker
VersionR27–R33
rulesCrc323802553086 (hex E2A65AFE)

If you missed the message, send 00 on port 15 and the sensor sends its identity again. The Hugin NFC app also shows the application and its version on site.

Settings, ids and defaults belong to one application version. If your sensor reports another rulesCrc32, look that number up in the VSM application documentation or the VSM Configuration Tool instead of using the tables here.

Alternative applications: besides Tracker, Sensative can offer other VSM applications for the same hardware. They are available in the Hugin NFC app (Android) and can also be loaded into the sensor over LoRaWAN. Ask Sensative which applications fit your use. After a change, ask for the identity with 00 on port 15 and use the documentation for that application.

LoRaWAN and ports

LoRaWANMAC 1.0.4, regional parameters RP002-1.0.3, class A, OTAA, max EIRP 14 dBm
JoinEUI70B3D52C0001D4C3 (all Square and Puck sensors)
PortDirectionWhat it carries
1UplinkTemperature, motion count and time, battery (see Messages)
11UplinkThe same outputs in compressed form
15UplinkApplication identity (rulesCrc32), first thing after a join
15Downlink00 asks the sensor to send its application identity again
23, 24UplinkWi-Fi scans, for positioning. They arrive on port 23 or 24; the decoder handles both.
2DownlinkSettings and read requests (see Settings on port 2)
2UplinkThe sensor’s answer: the values it now has
7DownlinkA whole configuration in one payload (see A whole configuration on port 7)
7UplinkThe status of that configuration: None, Applied, Error or Dirty

Messages

Each output has an id and a scale. “Confirmed” outputs are acknowledged by the network server.

OutputIdSize and scaleUnitConfirmedSent
tempB02 bytes, × 0.01°CNoOn a change larger than the Temperature Hysteresis (measured every 15 minutes)
averageTempB12 bytes, × 0.01°CNoEvery Average Temp Interval, if changed by more than the Temperature Hysteresis
tempAlarm801 byte0 = no alarm, 1 = high, −1 = lowYesWhen the alarm state changes
motionCountBA4 bytesnumber of motions since startNoHourly if changed, when Enable Motion Count Report is on
motionTimeMinutesBB4 bytesminutes with motion since startNoHourly if changed, when Motion Time Enabled is on
batteryPercentAE1 byte% (estimated)NoOnce a week

Settings

The defaults are the values the sensor starts with. The id is what a port 2 downlink uses. Values are sent in the steps shown: the temperature hysteresis, in steps of 0.01, is sent as a hundred times its value; all the others are whole numbers.

SettingName in the applicationIdWhat it doesUnitRangeDefault
Still ThresholdstillMotionThreshold_mm_s2B3How strong a movement must be to count as motion while the sensor is still. Too low, and it believes it is always moving.mm/s²5–10,00050
Moving ThresholdmovingMotionThreshold_mm_s2B4How strong a movement must be to count as continued motion while the sensor is moving.mm/s²5–10,00030
Minimum Wifi CountminimumWifiCountA6How many Wi-Fi access points a scan must find for the scan train to stop.access points1–153
Still Wifi Scan Again At MinutesingleWifiScanAgain_minutesA5Minute of the second limited Wi-Fi scan after the sensor starts or stops moving. −1 switches it off. Avoid 1: the first scan is always at minute 1.minutes−1 to 1272
Full Wifi Scan At MinutefullWifiScan_minutesA8Minute of the full Wi-Fi scan after the sensor starts or stops moving. −1 switches it off. Avoid 1.minutes−1 to 127not documented
Limited Wifi Scan Channel MasklimitedScanChannelsB8The Wi-Fi channels for the limited scans, as a bit mask: channels 1 and 3 are binary 101, decimal 5. 0 means all channels. Fewer channels save power.bit mask0–65,5350
Full Wifi Scan Channel MaskfullScanChannelsB9The Wi-Fi channels for the full scan, as a bit mask in the same way.bit mask0–65,5350
Moving Scan IntervalmovingScanIntervalMinutesBCRestarts the scan train at this interval while the sensor is moving. −1 switches it off. Do not set it shorter than the scan train.minutes−1 to 32,768−1 (off)
Stationary Scan IntervalstationaryScanIntervalMinutesBDRestarts the scan train at this interval while the sensor is still. −1 switches it off.minutes−1 to 32,7671,440
15 Minute Scan BudgetquarterlyScanBudgetA4How many scans are added to the scan budget every 15 minutes.scans1–153
Max Scan BudgetmaxBudgetB5The most the scan budget can hold. Each scan uses one unit.scans1–32,767100
Enable Motion Count ReportmotionCountEnabledAA1 sends the number of motions detected, hourly if changed.on/off0–10
Motion Time EnabledmotionTimeEnabledAB1 sends the number of minutes with motion, hourly if changed.on/off0–10
Temperature HysteresistempHysteresisB2Change in temperature needed before a new reading or average is sent.°C, steps of 0.010.1–1272
Average Temp IntervalaverageTempIntervalHoursA0How often the average temperature is sent, if it has changed by more than the hysteresis.hours1–1272
Temperature Alarm Low LeveltempAlarmLowLevelA1Low alarm level. Must be below the high level, or the alarm is off.°C−128 to +1262
Temperature Alarm High LeveltempAlarmHighLevelA2High alarm level. Must be above the low level, or the alarm is off.°C−127 to +12760
Roaming Network CountroamNetworkCountA3Number of LoRaWAN network identities to try in turn (see Network and roaming).number1–151
Quick Rejoin AttemptsquickRejoinBudgetMaxB6How many quick join attempts the sensor makes after losing a network, before it goes back to one attempt a day.numbernot documentednot documented

Device registers

These belong to the sensor’s firmware rather than to the application, but the application uses them and they can be changed the same way. Leave them as they are unless you have a reason.

RegisterNameIdWhat it doesUnitRangeDefault
Downlink TimeoutLINKCHECK_TIMED0How long the sensor goes without hearing from the network before it gives the network up and becomes unjoined. Any downlink, an acknowledgement included, starts the time again. From half the time on, every uplink is sent confirmed; from 80 % on, the sensor also sends link checks of its own. 0 turns the check off. The sensor sets it back to 24 hours each time it starts.seconds300–2,592,00086,400
TX Power RangeTX_POWER_RANGED8The power index range for fast adaptive data rate: lowest in the low byte, highest in the high byte, each 0 (the region’s best) to 16 (DR0, maximum power). Raising it costs a lot of battery.2 bytes0–65,535

Released profiles

No ready-made profiles are released for this application. The sensor starts with the defaults in the settings table; to change them, use Custom in the VSM Configuration Tool.

Settings on port 2

A port 2 downlink is a list of records of 5 bytes each: one byte for the setting’s id, then the value as a signed 32-bit integer, most significant byte first. The value is in the setting’s own steps: a temperature hysteresis of 2 °C in steps of 0.01 is sent as 200; a scan interval of 30 minutes is sent as 30. Negative values are written in two’s complement, so −10 becomes FF FF FF F6. The sensor applies the values and answers on port 2 with the values it now has.

The ids belong to one application version. Another version can use the same id for a different setting, so a downlink made for one version can change the wrong setting in another. Always make the downlink for the rulesCrc32 the sensor itself reports.

Reading values

A port 2 downlink of one to four bytes is a read request: the sensor sends back the current value of each id in it.

Port 2 downlinkThe sensor answers with
04Current temperature, in hundredths of a degree
16The motion sensor
BDThe Stationary Scan Interval now set (any setting id works the same way)

A whole configuration on port 7

The VSM Configuration Tool can also pack a configuration into a single port 7 payload. It starts with the application’s CRC and ends with a checksum of the configuration (configCrc32). The sensor reports the result on port 7: None, Applied, Error or Dirty.

Worked example 1: Positions while the asset is moving

Restart the scan train every 30 minutes while the sensor is moving. Each restart uses scans from the budget and battery. Both examples were made in the VSM Configuration Tool for rulesCrc32 3802553086. Send one of the payloads, port 2 or port 7, not both.

SettingValueSent asRecord
Moving Scan Interval30 min30BC 00 00 00 1E
Port 2 (hex)BC 00 00 00 1E
Port 2 (base64)vAAAAB4=
Or port 7 (hex)E2 A6 5A FE 02 05 BC 00 00 00 1E 00 55 6F 44 60

Worked example 2: Motion count and motion time

Switch on the hourly reports of the number of motions and the minutes with motion, for example to see how much a piece of equipment is used.

SettingValueSent asRecord
Enable Motion Count Reporton1AA 00 00 00 01
Motion Time Enabledon1AB 00 00 00 01
Port 2 (hex)AA 00 00 00 01 AB 00 00 00 01
Port 2 (base64)qgAAAAGrAAAAAQ==
Or port 7 (hex)E2 A6 5A FE 02 0A AA 00 00 00 01 AB 00 00 00 01 00 F4 19 41 00

9Specifications

PositioningWi-Fi access-point scanning; a cloud geo-solving service is needed
SensorsMotion (3D accelerometer), temperature (typical ±2 °C)
RadioLoRaWAN 1.0.4, class A, OTAA; JoinEUI 70B3D52C0001D4C3
Frequency plansEU868 · US915 · AU915 · AS923-1 · AS923-2 · KR920 · IN865
RangeUp to 10 km in line of sight
ConfigurationNFC (Android) and over the air
ApplicationVSM application Tracker (R27–R33)
BatteryBuilt-in LiMnO2, 750 mAh; 10 years at 12 positions a day
IP ratingIP63
Operating temperature−20 to +60 °C
Dimensions58 × 58 × 7 mm
Weight23 g
MountingAdhesive, or the optional Square screw mounting kit

10Support

Sources: Sensative Docs, Square Tracker, FAQ Square & Puck and Hugin NFC application (read 24 October 2026); VSM Configuration Tool, application data for Tracker (read 26 October 2026); VSM application documentation on GitHub (3802553086-Tracker); VSM translator (open source); specifications from the sensative.com product data; Wi-Fi positioning: Semtech, Wi-Fi geolocation with LoRa Edge.