Research Assisted GPS (and CASIC protocol) on ATGM336H

[JosephHewitt]

The ATGM336H GNSS module states that it supports A-GPS, but there doesn't seem to be any documentation with instructions on how to send ephemeris data to it.

I found a helpful thread discussing ephemeris injection using an AT6558 module which may be relevant to the ATGM336H too: https://forum.espruino.com/conversations/371360/?offset=0

I attempted the methods described in that thread, specifically pushing the data from here: api.smawatch.cn/epo/ble_epo_offline.bin to the module as-is.

This .bin file appears to be a series of CASIC commands, already ready to send to a module. I got the following response from the module after pushing that data; even when adding a lot of delays so the data was pushed slowly enough for the module to process:

ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 00 08 07 00 00 0c 07 05 00
ba ce 00 05 01 08 05 00 00 0c 05 05 01
ba ce 00 05 01 08 06 00 00 0c 06 05 01

This PDF states that ba ce is a CASIC protocol header. This confirms that some kind of CASIC communication is working on this module.

It also states that ba ce 00 05 00 is an ACK-NACK (message NOT correctly received). Whereas ba ce 00 05 01 is an ACK-ACK meaning the message was OK.

This is one block (out of 33) sent to the module from the PC (from the .bin file downloaded above):

ba ce 48 00 08 07 9d f3 c7 ab 53 d2 0c
a1 93 2c dc 06 b3 67 28 2a fb d4 3d d8
61 e2 d8 26 2f b8 3d b6 81 a2 ff ff 6e
46 e8 02 7d 02 b6 08 d9 24 0c 02 31 00
96 00 e1 1d 1a 01 e1 1d 00 00 7c ce 06
00 b0 ff 00 d6 14 00 00 3f 01 03 00 00
82 e7 97 5e

A total of 33 ba ce-prefixed blocks (like shown above) were sent to the module, but I only captured the 13 responses above. Maybe some data wasn't captured correctly or maybe the module didn't respond to all.

Since I got 2/33 ACKs, it appears to have partially worked, but I could not verify if there was a change to the speed of acquiring a satellite lock. The module does not appear to send NMEA messages corresponding to the state of the ephemeris data, making it hard to tell if things are working.

This project on GitHub appears to have implemented A-GPS for the ATGM336H using the method described above: https://github.com/RafaelReyesCarmona/TinyTrackGPSPlus?tab=readme-ov-file#atgm336h

HOWEVER, They appear to be pushing the base64 encoded version (from here) to the module. I also tried that myself, and got no response from the module. The base64 version originates from the smawatch.cn version above (source). I suspect that implementation does not work.

Further reading

(slightly related?) geary/AnyTone-D868UV#61
(Further CASIC information? In Chinese) https://www.icofchina.com/d/file/xiazai/2020-09-22/20f1b42b3a11ac52089caf3603b43fb5.pdf