CM100 LoRaWAN Beacon Receiver User Guide

Device Information: Model CM100, devEui ffffff100004d12a, gateway IP 192.168.31.205, Modbus Slave ID 14, BACnet Device ID 114

1 Protocol Overview

The CM100 reports nearby beacon data (beacon ID, RSSI, battery), online status, and signal quality on Fport 210.

1.1 Uplink Data Protocol (Fport 210)

Payload format (Fport 210):

Byte	Field	Description
0	Reserved	Always `0x00` (protocol version)
1 … N	TLV pairs	`[Type(1 B)][Value(N B)]` … repeating until end

Each Type byte determines the field name and the number of following value bytes:

Type	Value Bytes	Field Name	Encoding	Scale	Unit	Notes
`0x01`	1	`model`	uint8	—	—	Model code = 0x1E
`0x93`	1	`batteryLevel`	uint8	—	%	0–100 % battery level
`0x6D`	1	`packetType`	uint8	—	—	0x00=heartbeat 0x01=data report
`0xD9`	1+N	`beaconData`	block	—	—	1-byte length + beacon scan data block; see Beacon sub-table below
`0xB8`	1	`batteryLowAlarm`	uint8	—	—	0=normal 1=low battery alarm event
`0x14`	1	`sosEvent`	uint8	—	—	0=normal 1=SOS danger

0xD9 Beacon Data Block (CM100 / GB100)

Offset	Bytes	Field	Encoding	Notes
0	1	dataLength	uint8	Total block data bytes N
1	4	timestamp	uint32 BE	Unix timestamp of scan
5	1	beaconCount	uint8	Number of beacons M
Per beacon (10 bytes each):
0	1	flags	uint8	Bit 0=timestamp valid; Bit 1=repeat send
1	4	beaconId	uint32 BE	Last 4 bytes of beacon MAC address
5	2	timeOffset	uint16 BE	Seconds before scan timestamp
7	1	rssi	int8	Signed RSSI (dBm)
8	1	batteryLevel	uint8	0–100 %; 255=invalid
9	1	scannedCount	uint8	Number of beacons scanned

Absolute time of each beacon = timestamp − timeOffset

JavaScript Decoder Example:

// CM100 Beacon Receiver — Fport 210 uplink decoder
function decodeUplink(bytes) {
  var i = 1, r = {};
  function u16(b,o){ return (b[o]<<8)|b[o+1]; }
  function u32(b,o){ return ((b[o]<<24)|(b[o+1]<<16)|(b[o+2]<<8)|b[o+3])>>>0; }
  function i8(b,o) { var v=b[o]&0xFF; return v>127?v-256:v; }
  while (i < bytes.length) {
    var t = bytes[i++];
    switch (t) {
      case 0x01: r.model        = bytes[i++]; break;
      case 0x93: r.batteryLevel = bytes[i++]; break;
      case 0x6D: r.packetType   = bytes[i++]; break;
      case 0x14: r.sosEvent     = bytes[i++]; break;
      case 0xB8: r.batteryLowAlarm = bytes[i++]; break;
      case 0xD9: {
        // Variable-length beacon data block
        var len = bytes[i++];
        var blkEnd = i + len;
        var ts = u32(bytes, i); i+=4;
        var cnt = bytes[i++];
        r.beaconTimestamp = ts;
        r.beacons = [];
        for (var b=0; b<cnt && i+10<=blkEnd; b++) {
          var flags=bytes[i], id=u32(bytes,i+1), off=u16(bytes,i+5);
          r.beacons.push({
            idHex: id.toString(16).padStart(8,'0').toUpperCase(),
            absoluteTime: ts - off,
            rssi: i8(bytes, i+7),
            batteryLevel: bytes[i+8],
            scannedCount: bytes[i+9]
          });
          i += 10;
        }
        i = blkEnd; break;
      }
      default: i++; break;
    }
  }
  return r;
}

Script download: LPP.zip

Compatibility note: LPP.js is developed and tested against ChirpStack v4.17.0. The ChirpStack JavaScript codec API may differ across versions — if you are running a different ChirpStack version, review and adjust the script as needed before deployment.

2 Getting Uplink Data

⚠️ The IP addresses (192.168.31.205 / 192.168.31.193), ChirpStack API token, Slave ID, BACnet Device ID, and devEui in the examples below are for demonstration only. Replace them with your actual gateway IP, ChirpStack API token, and device parameters.

2.1 ChirpStack MQTT Subscription

Subscribe to the MQTT topic to receive real-time uplink frames:

Application ID — 3ef9e6b9-ec54-4eda-86b8-a5fb46899f39 is the factory-default ChirpStack
application built into the gateway. Replace it with your actual application
ID if you have created a different one.

Gateway IP — 192.168.31.205 is the gateway WAN port IP shown as an
example. Replace it with your actual gateway IP address.

Device EUI — ffffff100004d12a is the EUI of the example device.
Replace it with the EUI shown in the gateway device list, or use +
as a wildcard to subscribe to all devices at once.

# Subscribe to one specific device
mosquitto_sub -h 192.168.31.205 -p 1883 \
  -u gateway -P mqtt88888888 \
  -t "application/3ef9e6b9-ec54-4eda-86b8-a5fb46899f39/device/ffffff100004d12a/event/up"

# Subscribe to ALL devices on ALL applications (wildcard)
mosquitto_sub -h 192.168.31.205 -p 1883 \
  -u gateway -P mqtt88888888 \
  -t "application/+/device/+/event/up"

Example uplink payload (JSON):

{
  "devEui": "ffffff100004d12a",
  "fPort": 210,
  "object": {
    ...  (decoded LPP fields)
  }
}

2.2 IoT Hub HTTP API

Send a GET request to retrieve the latest device state:

curl -s "http://192.168.31.205:8070/api/getStatus?devEui=ffffff100004d12a"
{
  "success": true,
  "result": {
    "batteryLevel": 7,
    "beaconIdHex": "0066562E",
    "beaconRssi": -74,
    "beaconBatteryLevel": 100,
    "beaconBatteryValid": true,
    "batteryLowAlarm": false,
    "sosEvent": false,
    "isHeartbeat": false,
    "model": "CM100"
  }
}

2.3 IoT Hub Modbus TCP — Python Script

Script download: modbus_tcp_read.py

Use modbus_tcp_read.py to poll all registers at once:

python3 modbus_tcp_read.py --ip 192.168.31.205 --port 502 \
    --slaveId 14 --sensorType CM100
Target: 192.168.31.205:502 | Slave ID: 14 | Sensor: CM100
================================================================================================================================================================
Attribute                | Addr   | FC  | Format     | Order        | Cnt | Scale    | Raw(Hex)            | Value              | Unit
----------------------------------------------------------------------------------------------------------------------------------------------------------------
online                   | 6      | 03  | Bit/Bool   | Big(ABCD)    | 1   | x1       | 0001                | true               | none
lastOnlineTime           | 7      | 03  | UnixTime   | Big(ABCD)    | 2   | x1       | 69CC C850           | 1775028304         | second
batteryLevel             | 9      | 03  | Int16      | Big(ABCD)    | 1   | x1       | 0007                | 7.0                | percent
beaconIdHex              | 10     | 03  | String(32B) | ASCII        | 16  | x1       | 3030 3636 3536 3245 ... | 0066562E           | none
beaconRssi               | 26     | 03  | Int16      | Big(ABCD)    | 1   | x1       | FFB6                | -74.0              | none
beaconBatteryLevel       | 27     | 03  | Int16      | Big(ABCD)    | 1   | x1       | 0064                | 100.0              | percent
beaconBatteryValid       | 28     | 03  | Bit/Bool   | Big(ABCD)    | 1   | x1       | 0001                | true               | none
batteryLowAlarm          | 29     | 03  | Bit/Bool   | Big(ABCD)    | 1   | x1       | 0000                | false              | none
sosEvent                 | 30     | 03  | Bit/Bool   | Big(ABCD)    | 1   | x1       | 0000                | false              | none
isHeartbeat              | 31     | 03  | Bit/Bool   | Big(ABCD)    | 1   | x1       | 0000                | false              | none
model                    | 56     | 03  | String(24B) | ASCII        | 12  | x1       | 434D 3130 3000 0000 ... | CM100              | none
rssi                     | 68     | 03  | Int16      | Big(ABCD)    | 1   | x1       | FFB1                | -79.0              | none
... (13 fields total)

2.4 IoT Hub Modbus TCP — Modbus Poll

Tool download: Modbus Poll 9.5.0.1507.zip

Open Modbus Poll, connect to 192.168.31.205:502, Slave ID 14
Menu Setup → Read/Write Definition, set Function Code = FC03, Start Address = 6, Length = 64
Click OK — values update in real-time

2.5 IoT Hub BACnet BIP — Python Script

Script download: bacnet_read.py

Use bacnet_read.py to read all BACnet objects:

python3 bacnet_read.py --ip 192.168.31.205 --port 47808 --id 114
Target: 192.168.31.205:47808 | BACnet ID: 114 | Scan: 11400-11499
------------------------------------------------------------
Type | Instance | Offset | Value                    | Object Name
------------------------------------------------------------
BI   | 11402    | 2      | active                   | ffffff100004d12a.online
AI   | 11403    | 3      | 1775028352.00            | ffffff100004d12a.lastOnlineTime
AI   | 11404    | 4      | 7.00                     | ffffff100004d12a.batteryLevel
CV   | 11405    | 5      | 0066562E                 | ffffff100004d12a.beaconIdHex
AI   | 11406    | 6      | -74.00                   | ffffff100004d12a.beaconRssi
AI   | 11407    | 7      | 100.00                   | ffffff100004d12a.beaconBatteryLevel
BI   | 11408    | 8      | active                   | ffffff100004d12a.beaconBatteryValid
BI   | 11409    | 9      | inactive                 | ffffff100004d12a.batteryLowAlarm
BI   | 11410    | 10     | inactive                 | ffffff100004d12a.sosEvent
BI   | 11411    | 11     | inactive                 | ffffff100004d12a.isHeartbeat
CV   | 11415    | 15     | CM100                    | ffffff100004d12a.model
AI   | 11416    | 16     | -79.00                   | ffffff100004d12a.rssi
... (13 objects total)

2.6 IoT Hub BACnet BIP — YABE

Tool download: SetupYabe_v2.1.0.exe

Open YABE, connect to 192.168.31.205:47808
Expand Device 114 in the device tree
Browse AI/BI/AV/BV/CV objects to view real-time values