AT&T AT Commands Guide for the M14A2A LTE Module

1/206
Contents

Contents ..................................................................................................................... 2

1. Introduction .......................................................................................................9

1.1. Purpose and Scope .........................................................................................9

1.2. Definitions and Abbreviations ........................................................................9

1.3. AT Command Availability.............................................................................. 10

2. Configuration Commands ................................................................................. 11

2.1. AT&F Reset AT Command Settings to Factory Default Values ......................11

2.2. AT&V Display Current Configuration ............................................................ 12

2.3. ATQ Result Code Presentation Mode ........................................................... 13

2.4. ATV Result Code Format Mode .................................................................... 14

2.5. ATX CONNECT Result Code Format .............................................................. 15

2.6. ATZ Restore AT Command Settings from a User Defined Profile ................. 16

2.7. AT+CMEE Error Message Format ................................................................. 17

2.8. AT+CSCS Character Set ................................................................................. 19

2.9. AT+CFUN Functionality Level ....................................................................... 21

2.10. AT+GCAP Capabilities List ............................................................................. 23

2.11. AT$QCPWRDN Powering Down The UE ....................................................... 24

3. Status Control Commands ................................................................................ 25

3.1. AT+CEER Extended Error Report .................................................................. 25

3.2. AT+CPAS Activity Status ................................................................................ 26

2/206
 3.3. AT+WS46 Select Wireless Network .............................................................. 28

3.4. AT%STATUS Query Module Status ................................................................ 29

4. Serial Interface Control Commands ................................................................... 32

4.1. AT&C Set Data Carrier Detect (DCD) Line Mode .......................................... 32

4.2. AT&D Set Data Terminal Ready (DTR) Line Mode ........................................ 32

4.3. AT&S Set Data Set Ready (DSR) Line Mode .................................................. 33

4.4. ATE AT Command Echo................................................................................. 34

4.5. AT+IPR Bit Rate ............................................................................................. 35

5. Security Commands.......................................................................................... 37

5.1. AT+CPIN PIN Authentication ........................................................................ 37

5.2. AT+CLCK Facility Lock ................................................................................... 39

5.3. AT+CPWD Change Password ........................................................................ 42

5.4. AT+CPINR Display PIN Counter ..................................................................... 44

6. Identification Commands ................................................................................. 46

6.1. ATI Display Product Identification Information ............................................ 46

6.2. AT+CGMI Request Manufacturer Identification ........................................... 47

6.3. AT+GMI Request Manufacturer Identification ............................................. 48

6.4. AT+CGMM Request Model Identification .................................................... 49

6.5. AT+GMM Request Model Identification ...................................................... 50

6.6. AT+CGMR Request Revision Identification of Software Status .................... 51

6.7. AT+GMR Request Revision Identification of Software Status ...................... 52

6.8. AT+CGSN Request International Mobile Equipment Identity (IMEI)............ 53

6.9. AT+GSN Request International Mobile Equipment Identity (IMEI).............. 54

6.10. AT+CIMI Request International Mobile Subscriber Identity (IMSI) .............. 55

3/206
7. Network Service Commands ............................................................................. 57

7.1. AT+COPN Read Operator Names.................................................................. 57

7.2. AT+COPS Operator Selection........................................................................ 58

7.3. AT+CPOL Preferred Operator List ................................................................. 62

7.4. AT+CPLS Select Preferred Operator List ....................................................... 66

7.5. AT+CREG Network Registration Status ......................................................... 68

7.6. AT+CSQ Signal Quality .................................................................................. 71

7.7. AT$QCSYSMODE Quesy Current System Mode of ME ................................. 72

7.8. AT$QCRSRP Display Neighbor Cell Information RSRP .................................. 73

7.9. AT$QCRSRQ Display Neighbor Cell Information RSRQ ................................. 74

8. Packet Domain Related Commands .................................................................. 76

8.1. AT+CGACT PDP Context Activate Or Deactivate........................................... 76

8.2. AT+CGDATA Enter Date State ....................................................................... 77

8.3. AT+CGATT GPRS Attach Or Detach ............................................................... 80

8.4. AT+CGDCONT Define PDP Context ............................................................... 81

8.5. AT+CGEREP GPRS Event Reporting ............................................................... 85

8.6. AT+CGREG Packet Domain Network Registration Status ............................. 87

8.7. AT+CEREG Packet Domain Network Registration Status .............................. 89

8.8. AT+CGCONTRDP PDP Context Read Dynamic Parameters ........................... 93

8.9. AT+CGEQOS Define EPS Quality of Service .................................................. 96

8.10. AT+CGPADDR Show PDP Address ............................................................... 100

8.11. ATD*99# Request Packet Domain service .................................................. 102

8.12. AT$QCPDPP Set Type of Authentication for PDP-IP Connections .............. 102

8.13. AT%PDNSET Define PDP Context And Authentication ............................... 104

4/206
 8.14. AT$QCRMCALL Triggers an RmNet Call ...................................................... 106

8.15. AT+CNMPSD No More PS data ................................................................... 108

8.16. AT$QCDNSP Sets Primary DNS IP Address ................................................. 109

8.17. AT$QCDNSS Sets Secondary DNS IP Address ............................................. 110

8.18. AT$QCDEFPROF Sets a Given Profile Number as a Default ........................ 111

8.19. AT$ECMCALL Triggers an ECM Call ............................................................. 112

8.20. AT%PDNACT PDP Context Activate Or Deactivate ..................................... 114

8.21. AT%CMATT LTE network Attach Or Detach ................................................ 116

9. USIM related Commands ................................................................................ 119

9.1. AT+CRSM Restricted SIM Access ................................................................ 119

9.2. AT+ICCID SIM Card Identification Number ................................................. 120

9.3. AT%CCID Reads the ICCID from SIM EFICCID ............................................. 121

10. Internet Service Commands............................................................................ 123

10.1. AT@INTERNET Start Internet Service ......................................................... 123

10.2. AT@DNSSEVR DNS Server Setting .............................................................. 124

10.3. AT@DNSRESVDON Resolve Domain Name ................................................ 125

10.4. AT@SOCKDIAL Socket Dial-Up-Network .................................................... 127

10.5. AT@SOCKCREAT Socket Creation ............................................................... 128

11. AT@SOCKCREAT=<protocol_type>,<ip_version> ............................................. 129

12. @SOCKCREAT:(1-2),(0-1) ................................................................................. 129

12.1. AT@SOCKCONN Socket Connect ................................................................ 129

12.2. AT@SOCKREAD Socket Read ...................................................................... 130

12.3. @SOCKDATAIND Notification for Data Received........................................ 132

12.4. AT@SOCKWRITE Socket Write ................................................................... 133

5/206
 12.5. AT@SOCKRECV UDP Socket Data Receive.................................................. 135

12.6. AT@SOCKSEND UDP Socket Data Send ...................................................... 137

12.7. AT@SOCKCLOSE Socket Close .................................................................... 138

12.8. AT@SOCKERR Socket Error Code ............................................................... 138

12.9. AT@FTPOPEN FTP Open............................................................................. 140

12.10. AT@FTPCLOSE FTP Close ............................................................................ 141

12.11. AT@FTPGET FTP GET Operation ................................................................ 142

12.12. AT@FTPGETDATA FTP GET data ................................................................. 143

12.13. AT@FTPFILESIZE FTP Query File Size .......................................................... 145

12.14. AT@FTPPUT FTP PUT Operation ................................................................ 145

12.15. AT@ FTPPUTDATA FTP PUT data ................................................................ 146

12.16. AT@FTPDEL FTP Delete File ....................................................................... 148

12.17. AT@PINGREQ Ping Request ....................................................................... 149

13. Hardware Related Commands ........................................................................ 152

13.1. AT@GPIOREQ Request to Control A GPIO.................................................. 152

13.2. AT@GPIOCFG Configure The Specific GPIO ............................................... 153

13.3. AT@GPIOGET Get The Logical State of The Specific GPIO ......................... 154

13.4. AT@GPIOSET Set The Logical State of The Specific GPIO .......................... 155

13.5. AT@THERMO Thermal Detection .............................................................. 157

13.6. AT@ADCOP Analog-to-Digital Converter Operation .................................. 159

14. Miscellaneous Commands .............................................................................. 161

14.1. @EXTERR Response of the Proprietary AT Command for Errors ............... 161

14.2. @FUNEWIND Indicator for New Firmware Notification ............................ 162

14.3. @FUEXECIND Indication for Upgrade Availability ...................................... 162

6/206
 14.4. @FUDONEIND Indication that the Module’s Firmware Upgrade Process is
Complete ................................................................................................................ 163

14.5. AT@FUSENDSTATE State of the Upgrading Process Sent to the Module ... 164

14.6. AT@FURECVFILE Receive the Firmware File Using HEX ............................. 165

14.7. AT@HOSTINFO Send the Host’s information to the Module ..................... 166

15. Short Messages Service ....................................................................................167

15.1 Introduction....................................................................................................167

15.2 Select message service +CSMS.......................................................................168

15.3 Preferred message storage +CPMS............................................................. ...169

15.4 Preferred message format +CMGF.................................................................170

15.5 Save settings +CSAS........................................................................................171

15.6 Restore settings +CRES.................................................................................. .171

15.7 Show text mode parameters +CSDH..............................................................172

15.8 New message indication +CNMI.....................................................................172

15.9 Incoming SMS/CBM indication via different AT interfaces +UDCONF=82......176

15.10 Select service for MO SMS messages +CGSMS.............................................176

15.11 Read message +CMGR..................................................................................177

15.12 New message acknowledgement to MT +CNMA.......................................180

15.13 List message +CMGL.....................................................................................181

15.14 Send message +CMGS..................................................................................183

15.15 Write message to memory +CMGW.............................................................184

7/206
 15.16 Send message from storage +CMSS.............................................................185

15.17 Set text mode parameters +CSMP...............................................................186

15.18 Delete message +CMGD...............................................................................187

15.19 Primary notification event reporting +CPNER..............................................188

15.20 Service center address +CSCA.......................................................................188

15.21 Select cell broadcast message types +CSCB..................................................189

15.22 Read concatenated message +UCMGR.........................................................190

15.23 List concatenated message +UCMGL............................................................193

15.24 Send concatenated message +UCMGS..........................................................195

15.25 Write concatenated message to memory +UCMGW....................................196

15.26 More messages to send +CMMS...................................................................197

15.27 Peek message +UCMGP.................................................................................198

15.28 Message waiting indication +UMWI..............................................................199

A Supported Error Codes .....................................................................................201

B Proprietary Error Codes ....................................................................................203

C References .......................................................................................................204

D AT Commands Flow Examples ...........................................................................205

8/206
1. Introduction

1.1. Purpose and Scope

This document provides information about the AT command set supported by the M18Q2
and M14A2.
The various AT commands are listed and associated with the M18Q2 and M14A2 Software
Release.

The AT commands in this document are divided into the following sections:
1. Configuration Commands
2. Status Control Commands
3. Serial Interface Control Commands
4. Security Commands
5. Identification Commands
6. Network Service Commands
7. Packet Domain Related Commands
8. USIM related Commands
9. Internet Service Commands
10. Hardware Related Commands
11. Miscellaneous Commands

The error codes supported for the CMEE commands are provided for the software
developer’s reference.

Note:
For a detailed description of standard 3GPP AT commands, refer to specification
(3GPP TS 27.007).

1.2. Definitions and Abbreviations

GSM Global System for Mobile Communications
UMTS Universal Mobile Telecommunications System
LTE Long Term Evolution

9/206
 PLMN Public Land Mobile Network
IMEI International Mobile Station Equipment Identity
USIM Universal Subscriber Identity Module
IMSI International Mobile Subscriber Identity

1.3. AT Command Availability

Some AT command or command parameters are not shared between all module products.
The AT command availability will be indicated in each table in section 2 below. Regarding AT
command parameters which are supported by certain special modules only, a note will be
added to that parameter in the descriptions in this document.

10/206
2. Configuration Commands

2.1. AT&F Reset AT Command Settings to Factory Default

Values
AT&F parameter command syntax
Command Possible response(s)
&F[<value>] Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

TA sets all parameters to their defaults as specified by a user memory profile or by the
manufacturer.

M14A2A will resets TA after command is executed successfully and field <value> is
mandatory and need to be filled as 0.

Defined values:

<value>: integer
0 – Reset parameters; only a “0” value is available.

Example: Reset to default AT command settings

AT&F0
OK

11/206
2.2. AT&V Display Current Configuration
AT&V parameter command syntax
Command Possible response(s)
&V Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The AT command will return the setting of several AT command parameters applicable to
the current operating mode.

Defined values:

Example: Display of the current configurations for AT commands

AT&V
&C: 2; &D: 2; &E: 0; &F: 0; &S: 0; &W: 0; E: 1; L: 0; M: 0; Q: 0; V:
1;
X: 1; Z: 0; \Q: 3; \S: 0; \V: 0; O: 0; S0: 0; S2: 43; S3: 13; S4: 10;
S5: 8; S6: 2; S7: 0; S8: 2; S9: 6; S10: 14; S11: 95; S30: 0; S103: 1;
S104: 1; +FCLASS: 0; +ICF: 3,3; +IFC: 2,2; +IPR: 115200; +DR: 0;
+DS: 0,0,2048,6; +CMEE: 2; +WS46: 12; +CFUN:; +CBST: 0,0,1;
+CRLP: (61,61,48,6,0),(61,61,48,6,1),(240,240,52,6,2);
+CV120: 1,1,1,0,0,0; +CHSN: 0,0,0,0; +CSSN: 0,0; +CREG: 0; +CGREG: 0;
+CEREG: 0; +CSCS: "GSM"; +CSTA: 129; +CR: 0; +CRC: 0;
+CGDCONT:

12/206
 (1,"IPV4V6","","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0);
+CGDSCONT: ; +CGTFT: ; +CGEQREQ: ; +CGEQMIN: ; +CGEQOS: ; +CGQREQ: ;
+CGQMIN: ; +CGEREP: 0,0; +CGDATA: "PPP"; +CGCLASS: "A"; +CGPIAF:
0,0,0,0;
+CGSMS: 1; +CSMS: 0; +CMGF: 0; +CSAS: 0; +CRES: 0; +CSCA: "",;
+CSMP: ,,0,0; +CSDH: 0; +CSCB: 0,"",""; +ES: ,,; +ESA: 0,,,,0,0,255,;
+CMOD: 0; +CEMODE: 0; +CVHU: 1; ; ; ; ; ; ; +CPIN: , ;
+CMEC: 0,0,0,0; +CIND: 0,0,0,0,0,0,0,0; +CMER: 0,0,0,0,0; +CGATT: 0;
; +CPBS: "ME"; +CPMS: "ME","ME","ME"; +CNMI: 0,0,0,0,0; +CMMS: 0;
+CCUG: 0,0,0; +COPS: 0,0,""; +CUSD: 0; +CAOC: 1; +CCWA: 0;
+CPOL: 0,2,"",0,0,0,0; +CPLS: 0; +CTZR: 0; +CTZU: 0; +CLIP: 0; +COLP:
0;
+CDIP: 0; +CLIR: 0; +CSDF: 1; +CEN: 0; *CNTI: 0; ^DSCI: 0; ^MODE: 0

OK

2.3. ATQ Result Code Presentation Mode

ATQ parameter command syntax
Command Possible response(s)
Q[<value>] Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

Result code suppression.

13/206
Defined values:

<value>: integer
0 – Enables result codes
1 – Disables result codes

Example:

Case 1: Enables returning of the result code “OK” to the host

ATQ0
OK
ATE
OK

Case 2: Disables returning of the result code “OK” to the host

ATQ1

2.4. ATV Result Code Format Mode

ATV parameter command syntax
Command Possible response(s)
V[<value>] Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

DCE response format.

14/206
Defined values:

<value>: integer
0 – Displays result codes in numeric form
1 – Displays result codes in verbose form

Example:

Case 1: Enables returning of the result code “OK” to the host

ATV1
OK
ATE
OK

Case 2: Enables returning of the result code “0” to the host

0TV0

2.5. ATX CONNECT Result Code Format

ATX parameter command syntax
Command Possible response(s)
X[<value>] Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

Result code selection and call progress monitoring control.

15/206
Defined values:

<value>: integer
0 – Sends a CONNECT message when a connection is established by blind dialing;
ignores dial tone and busy signals
1 – Enables additional result code CONNECT<rate>; disables dial tone and busy
detection
2 – Enables additional result codes CONNECT <rate> and NO DIALTONE; disables
busy detection; enables dial tone detection
3 – Enables additional result codes CONNECT <rate> and BUSY; enables busy
detection; disables dial tone detection
4 – Enables additional result codes CONNECT <rate>, BUSY, and NO DIALTONE;
enables busy and dial tone detection

Example: Enables additional result codes CONNECT <rate> and BUSY; enables busy
detection; disables dial tone detection

ATX3
OK
ATD*99#
CONNECT 150000000

2.6. ATZ Restore AT Command Settings from a User

Defined Profile
ATZ parameter command syntax
Command Possible response(s)
Z[<value>] Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

16/206
Description:

TA sets all parameters to their defaults as specified by a user memory profile or by the
manufacturer.

M14A2A will resets TA after command is executed successfully and not support optional
field <value>.

Defined values:

<value>[**]: integer
0 – User Profile Number; only a “0” value is available.
Note: * indicates M14A2A only; ** indicates M18Q2 only

Example: Only profile 0 is available for restoration, example for M18Q2.

ATZ0
OK
ATZ1
ERROR

2.7. AT+CMEE Error Message Format

AT+CMEE parameter command syntax
Command Possible response(s)
+CMEE=[<n>] Normally respond:
OK

If something is wrong, then respond:

ERROR
+CMEE? Normally respond:
+CMEE:<n>
OK

17/206
 If something is wrong, then respond:
ERROR
+CMEE=? Normally respond:
+CMEE:(list of supported <n>)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The set command disables or enables the use of result code +CME ERROR: <err> as an
indication of an error relating to the functionality of the MT. When enabled, MT related
errors cause a +CME ERROR: <err> final result code instead of the regular ERROR final result
code. “ERROR” is returned normally when an error is related to syntax, invalid parameters,
or TA functionality.

Defined values:

<n>: integer
0 – Disable +CME ERROR: <err> result code and use ERROR
1 – Enable +CME ERROR: <err> result code and use numeric <err> values
2 – Enable +CME ERROR: <err> result code and use verbose <err> values

Example:

Case 1: Enable +CME Error and use numeric form.

AT+CMEE=1
OK
AT+CPIN?
+CME ERROR: 10

18/206
Case 2: Enable +CME Error and use verbose form.
AT+CMEE=2
OK
AT+CPIN?
+CME ERROR: SIM not inserted

2.8. AT+CSCS Character Set

AT+CSCS parameter command syntax
Command Possible response(s)
+CSCS=[<chset>] Normally respond:
OK

If something is wrong, then respond:

ERROR
+CSCS? Normally respond:
+CSCS:<chset>
OK

If something is wrong, then respond:

ERROR
+CSCS=? Normally respond:
+CSCS:(list of supported <chset>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

19/206
The set command informs TA which character set <chset> is used by the TE. TA is then able
to convert character strings correctly between TE and MT character sets. When TA-TE
interface is set to 8-bit operation and the TE alphabet to 7-bit operation, the highest bit
shall be set to zero.

Defined values:

<chset>: character set as a string type (Conversion schemes not listed here can be defined
by manufacturers.)
"GSM"[**] – GSM 7 bit default alphabet (3GPP TS 23.038); this setting easily
causes software-flow control (XON/XOFF) problems.
"IRA" – International reference alphabet
"UCS2" – 16-bit universal multiple-octet coded character set (Refer to
ISO/IEC10646 [32].); UCS2 character strings are converted to
hexadecimal numbers from 0000 to FFFF; e.g. "004100620063"
equals three 16-bit characters with decimal values 65, 98, and 99.
"HEX"[*] – Character strings consist only of hexadecimal numbers from 00 to
FF; e.g. "032FE6" equals three 8-bit characters with decimal values 3,
47 and 230; no conversions to the original MT character set shall be
done.
"8859-1"[*] – ISO 8859 Latin 1 character set
"PCCP437"[*] – PC character set Code Page 437
Note: * indicates M14A2A only; ** indicates M18Q2 only

Example:

Case 1: Set coding scheme to GSM 7 bit default alphabet and query the settings.
AT+CSCS="GSM"
OK
AT+CSCS?
+CSCS: "GSM"

OK

Case 2: Query-supported coding schemes, setting an invalid value will return “ERROR”. The
example is for M18Q2 only.
AT+CSCS=?
+CSCS: ("IRA","GSM","UCS2")

20/206
OK
AT+CSCS="UTF8"
ERROR

2.9. AT+CFUN Functionality Level

AT+CFUN parameter command syntax
Command Possible response(s)
+CFUN=[<fun>[,<rst>]] Normally respond:
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CFUN? Normally respond:
+CFUN:<fun>
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CFUN=? Normally respond:
+CFUN:(list of supported <fun>),(list of supported <rst>)
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
Reference: 3GPP TS 27.007

21/206
Description:

The set command selects the level of functionality <fun> in the MT. The highest level of
power drawn is at "full functionality". The minimum power is drawn at "minimum
functionality". The level of functionality between these may also be specified by
manufacturers. When supported by manufacturers, MT resetting with the <rst>
parameter may be utilized. Refer to Table A-1 Error codes supported for CMEE commands
for possible <err> values.

Defined values:

<fun>: integer
0 – Minimum functionality
1 – Full functionality
4 – Disable phone both transmit and receive RF circuits
5[**] – Factory Test Mode
6[**] – Reset Mode
7[**] – Offline Mode

<rst>: integer
0 – Do not reset the MT before setting it to <fun> power level
1 – Reset the MT before setting it to <fun> power level

Note: * indicates M14A2A only; ** indicates M18Q2 only

Example:

Case 1: Query the supported +CFUN values. The example is for M18Q2 only.
AT+CFUN=?
+CFUN: (0-1,4-7),(0-1)

OK

Case 2: Go to the airplane mode and then go back to normal mode.

AT+CFUN=0
OK

22/206
 AT+CFUN=1
OK

2.10. AT+GCAP Capabilities List

AT+GCAP parameter command syntax
Command Possible response(s)
+GCAP Normally respond:
+GCAP: <capability>s
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The AT command will request overall capabilities of TA.

Defined values:

<capability>: string, the capabilities of TA, ex: +CGSM, +CLTE1…etc.

Example: Request overall capabilities of TA

AT+GCAP
+GCAP: +CLTE1
OK

23/206
2.11. AT$QCPWRDN Powering Down The UE
AT$QCPWRDN parameter command syntax
Command Possible response(s)
$QCPWRDN Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: Qualcomm 80-VR432-1
Note: Accepts no arguments

Description:

This command is used to power down the UE.

Defined values:

24/206
3. Status Control Commands

3.1. AT+CEER Extended Error Report

AT+CEER parameter command syntax
Command Possible response(s)
+CEER Normally respond:
+CEER:<report>
OK

If something is wrong, then respond:

ERROR
+CEER=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command causes the TA to return one or more lines of information text
<report>,determined by the MT manufacturer. This should offer the user of the TA an
extended report of the reason for:
 the failure in the last unsuccessful call setup (originating or answering) or in-call
modification
 the last call release
 the last unsuccessful GPRS attach or unsuccessful PDP context activation
 the last GPRS detach or PDP context deactivation

25/206
Typically, the text will consist of a single line containing the cause information given by the
GSM/UMTS network in textual format.

Defined values:

<report>: string, the total number of characters, including line terminators, in the
information text shall not exceed 2,041 characters.
Example: Display CEER status

at+cgdcont?
+CGDCONT:
1,"IPV4V6","UNINET","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
OK
at+cgatt=1
OK
at+cgact?
+CGACT: 1,1
OK
at+cgatt=0
OK
at+ceer
+CEER: EMM detached
OK

3.2. AT+CPAS Activity Status

AT+CPAS parameter command syntax
Command Possible response(s)
+CPAS Normally respond:
+CPAS:<pas>
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>

26/206
 +CPAS=? Normally respond:
+CPAS:(list of supported <pas>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command returns the activity status <pas> of the MT. It can be used to
interrogate the MT before requesting action from the phone. Refer to Table A-1 Error codes
supported for CMEE commands for possible <err> values.

Defined values:

<pas>: integer
0 – Ready (MT allows commands from TA/TE.)
1 – Unavailable (MT does not allow commands from TA/TE.)
2 – Unknown (MT is not guaranteed to respond to instructions.)
3 – Ringing (MT is ready for commands from TA/TE, but the ringer is active.)
4 – Call in progress (MT is ready for commands from TA/TE, but a call is in progress.)
5 – Asleep (MT is unable to process commands from TA/TE because it is in a low
functionality state.)

Example: Query CPAS status

at+cgdcont?
+CGDCONT:
1,"IPV4V6","TESTSIM","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
OK
at+cgatt=1
OK

27/206
 at+cpas
+CPAS: 4
OK

3.3. AT+WS46 Select Wireless Network

AT+WS46 parameter command syntax
Command Possible response(s)
+WS46=<n>[*] Normally respond:
OK

If something is wrong, then respond:

ERROR
+WS46? Normally respond:
<n>
OK

If something is wrong, then respond:

ERROR
+WS46=? Normally respond:
(list of supported <n>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007
Note: * indicates M14A2A only; ** indicates M18Q2 only

Description:

The AT command is intended for reading the current status of the network selection.

28/206
The M14A2A support only E-UTRAN. The modem returns E-UTRAN for the read and test
command. The set command accepts only E-UTRAN.

Defined values:

<n>: integer
12[**] – GSM Digital Cellular Systems (GERAN only)
22[**] – UTRAN only
25[**] – 3GPP Systems (GERAN, UTRAN and E-UTRAN)
28 – E-UTRAN only
29[**] – GERAN and UTRAN

Note: * indicates M14A2A only; ** indicates M18Q2 only

Example: Select wireless network for M14A2A.

AT+WS46?
28
OK
AT+WS46=28
OK
AT+WS46=25
ERROR
AT+WS46=?
(28)
OK

3.4. AT%STATUS Query Module Status

AT%STATUS parameter command syntax
Command Possible response(s)
%STATUS=<subsystem> Normally respond:
<subsystem>: <status>[,<status_info>]
OK

If something is wrong, then respond:

ERROR
%STATUS=? Normally respond:

29/206
 %STATUS: (list of supported <subsystem>s)
OK

If something is wrong, then respond:

ERROR
Reference: Altair_SW_201_AT_Commands Guide_Rev3.pdf

Description:

The AT command is intended for retrieves current status of specified UE subsystem.

Defined values:

<subsystem>: string
INIT – Module initial status
USIM – USIM type status
RRC – RRC status
ROAM – Roam status
UICC – UICC status
<status>: integer or string
For “INIT”: integer
0 – UE init process ongoing (calibration in progress)
1 – UE init process has finished (calibration complete)
2 – UE init process has finished (calibration complete) but with critical errors.
(SYS_CRITICAL)
For “USIM”: string
“USIM: REAL USIM, LTE”
“USIM: REAL USIM, non-LTE”
“USIM: USIM SIMULATOR”
“USIM: NO USIM”
“USIM: REAL USIM DEACTIVATED”
"USIM: INVALID USIM”

30/206
 "USIM: PERSONALIZATION ERROR"
"USIM: REMOTE USIM"
For “RRC”: string
“RRC: IDLE”
“RRC: CONNECTED”
“RRC: UNKNOWN” – Used for all other states (init, standby, flight mode, etc.)
For “ROAM”:
0 – UE is not roaming (UE isn’t camped at all or UE is camped on
HPLMN/EHPLMN)
1 – UE is roaming and camped on VPLMN
For “UICC”:
0 – SIM is not inserted
1 – SIM inserted, init is in progress
2 – SIM init passed, wait for PIN unlock
3 – Personalization failed, wait for run-time depersonalization
4 – Activation completed. Reported when “Ready” state is reported by
“AT+CPIN?”
5 – Activation completed. RAM cache also ready
Example: Query USIM/RRC/INIT status.

AT%STATUS="INIT"
INIT: 1
OK
AT%STATUS="RRC"
RRC: IDLE
OK
AT%STATUS="USIM"
USIM: REAL USIM, LTE, Activated 1 times, Verified 1 times
OK
AT%STATUS="UICC"
UICC: 5
OK

31/206
4. Serial Interface Control Commands

4.1. AT&C Set Data Carrier Detect (DCD) Line Mode

AT&C parameter command syntax
Command Possible response(s)
AT&C[<value>] Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: ITU-T Recommendation V.250

Description:

Circuit 109 DCE RLSD (DCD) behavior

Defined values:

<value>: integer
0 – Circuit 109 (CF) always ON
1 – Circuit 109 (CF) ON in accordance with the specified service
2 – Circuit 109 (CF) always on except a wink on channel disconnect

4.2. AT&D Set Data Terminal Ready (DTR) Line Mode

AT&D parameter command syntax
Command Possible response(s)
AT&D[<value>] Normally respond:

32/206
 OK

If something is wrong, then respond:

ERROR
Reference: ITU-T Recommendation V.250

Description:

AT&D determines how the ME responds if the DTR line is changed from and ON to OFF state
during data connection. It’s circuit 108 DTE DTR behavior.

Defined values:

<value>: integer
0 – Ignores circuit 108/2 (CD)
1 – Enters Online Command state following ON-to-OFF transition of circuit 108/2
2 – Enters Command state following ON-to-OFF transition of circuit 108/2

4.3. AT&S Set Data Set Ready (DSR) Line Mode

AT&S parameter command syntax
Command Possible response(s)
AT&S[<value>] Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: ITU-T Recommendation V.250

33/206
Description :

AT&S determines how the ME sets the DSR line depending on its communication state. This
command is not configurable. DSR control management Default – Always ON (&S0)

Defined values:

<value>: integer
0 – DSR line is always ON
1 – UE in command mode then DSR will be off; UE in data mode then DSR is on.

4.4. ATE AT Command Echo

ATE parameter command syntax
Command Possible response(s)
E<value> Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The set command enables/disables the command echo.

Defined values:

<value>: integer

34/206
 0 – Disables command echo
1 – Enables command echo (factory default); hence the commands sent to the
device are echoed back to the DTE before the response is given.

Note: If this parameter is omitted, the command has the same behavior as ATE1.
But M14A2A not support, the <value> has to be inputed as mandatory parameter.

Example: Turn on/turn off echo.

ATE0
OK
(AT) – not display
OK
(ATE1) – not display
OK
AT
OK

4.5. AT+IPR Bit Rate

AT+IPR parameter command syntax
Command Possible response(s)
+IPR=<rate> Normally respond:
OK

If something is wrong, then respond:

ERROR
+IPR? Normally respond:
+IPR:<rate>
OK

If something is wrong, then respond:

ERROR
+IPR=? Normally respond:
+IPR: (list of supported <rate>s)
OK

35/206
 If something is wrong, then respond:
ERROR
Reference: 3GPP TS 27.007

Description:

Fixed DTE rate; this numeric extended-format parameter specifies the data rate at which
the DCE will accept commands; auto baud rate detection is not supported.

Defined values:

<rate >: integer, transmission rate, ex:115200

Example: Set rate by IPR

AT+IPR=115200
OK
AT+IPR?
+IPR: 115200
OK

36/206
5. Security Commands

5.1. AT+CPIN PIN Authentication

AT+CPIN parameter command syntax
Command Possible response(s)
+CPIN=<pin>[,<newpin>] Normally respond:
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CPIN? Normally respond:
+CPIN:<code>
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
Reference: 3GPP TS 27.007

Description:

The set command sends a password to the MT which is necessary before its operation (such
as SIM PIN, SIM PUK, or PH-SIM PIN). If the PIN is to be entered twice, the TA shall
automatically repeat the PIN. If there is no pending PIN, no action will be performed
towards MT, and an error message “+CME ERROR” is returned to TE. Refer to Table A-1
Error codes supported for CMEE commands for possible <err> values.

37/206
Defined values:

<pin>, <newpin>: string

<code> string, values reserved by the present document:
READY – MT is not pending for any password.
SIM PIN – MT is waiting for the SIM PIN to be given.
SIM PUK – MT is waiting for the SIM PUK to be given.
PH-SIM PIN – MT is waiting for the phone-to-SIM card password to be given.
PH-FSIM PIN – MT is waiting for the phone-to-initial SIM-card password to be
given.
PH-FSIM PUK – MT is waiting for the phone-to-initial-SIM-card unblocking
password to be given.
SIM PIN2 – MT is waiting for the SIM PIN2 to be given. This <code> is
recommended to be returned only when the last executed
command results in a PIN2 authentication failure (i.e. +CME
ERROR: 17); if PIN2 is not entered immediately after the failure, it
is recommended that MT does not block its operation.
SIM PUK2 – The MT is waiting for the SIM PUK2 to be given. This <code> is
recommended to be returned only when the last executed
command results in a PUK2 authentication failure (i.e. +CME
ERROR: 18); if PUK2 and new PIN2 are not entered immediately
after the failure, it is recommended that MT does not block its
operation.
PH-NET PIN – MT is waiting for the network personalization password to be
given.
PH-NET PUK – MT is waiting for the network personalization unblocking
password to be given.
PH-NETSUB PIN – MT is waiting for the network subset personalization password to
be given.
PH-NETSUB PUK – MT is waiting for the network subset personalization unblocking
password to be given.
PH-SP PIN – MT is waiting for the service provider personalization password
to be given.
PH-SP PUK – MT is waiting for the service provider personalization unblocking
password to be given.
PH-CORP PIN – MT is waiting for the corporate personalization password to be
given.

38/206
 PH-CORP PUK – MT is waiting for the corporate personalization unblocking
password to be given.

Example: Query PIN status and enter PIN code

AT+CPIN?
+CPIN: SIM PIN
OK
AT+CPIN="1234"
OK
AT+CPIN?
+CPIN: READY
OK

5.2. AT+CLCK Facility Lock

AT+CLCK parameter command syntax
Command Possible response(s)
+CLCK=<fac>,<mode>[,<passwd>[,<class>]] Normally respond:
OK
when <mode>=2 and command successful:
+CLCK:<status>[,<class1>
[<CR><LF>+CLCK:<status>,<class2>
[...]]
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CLCK=? Normally respond:
+CLCK:(list of supported <fac>s)
OK

If something is wrong, then respond:

ERROR

39/206
 Reference: 3GPP TS 27.007

Description:

The execute command is used to lock, unlock, or interrogate an MT or a network facility

<fac>. A password is normally required to perform such actions. When querying the status
of a network service (<mode>=2), the response line for a “not active” case (<status>=0)
should be returned only if service is not active for any <class>. Refer to Table A-1 Error
codes supported for CMEE commands for possible <err> values. This command should be
abortable when network facilities are set or interrogated.

Call-barring facilities are based on GSM/UMTS supplementary services. (Refer to

3GPP TS 22.088.) The interaction of these with other commands based on other
GSM/UMTS supplementary services is described in the GSM/UMTS standard.

The test command returns facility values supported as a compound value.

Defined values:

<fac>: string, values reserved by the present document:

"PS"[*] – PH-SIM (lock PHone to SIM/UICC card) (MT requests a password when
other-than-current SIM/UICC cards have been inserted; MT may have
stored information regarding a certain number of previously used cards
thus not requiring passwords when they are inserted.)
[**]
"PF" – Locks the phone to the very first inserted SIM/UICC card (also referred
to in the present document as PH-FSIM) (MT requests the password
when SIM/UICC cards other than the first SIM/UICC card has been
inserted.)
"SC" – SIM (lock SIM/UICC card) (The SIM/UICC requests the password when
the MT powers up and when this lock command has been issued.)
"AO"[**] – BAOC (Barr All Outgoing Calls) (Refer to 3GPP TS 22.088 clause 1.)
"OI"[**] – BOIC (Barr Outgoing International Calls) (Refer to 3GPP TS 22.088
clause 1.)
"OX"[**] – BOIC-exHC (Barr Outgoing International Calls except to the Home

40/206
 Country) (Refer to 3GPP TS 22.088 clause 1.)
[**]
"AI" – BAIC (Barr All Incoming Calls) (Refer to 3GPP TS 22.088 clause 2.)
"IR"[**] – BIC-Roam (Barr Incoming Calls when Roaming outside the home
country) (Refer to 3GPP TS 22.088 clause 2.)
"AB"[**] – all barring services (Refer to 3GPP TS 22.030.) (applicable only for
<mode>=0)
"AG"[**] – All outgoing barring services (Refer to 3GPP TS 22.030.) (applicable
only for <mode>=0)
"AC"[**] – All incoming barring services (Refer to 3GPP TS 22.030.) (applicable
only for <mode>=0)
[**]
"FD" – SIM card or active application in the UICC (GSM or USIM) fixed dialing
memory feature (If PIN2 authentication has not been performed during
the current session, PIN2 is required as <passwd>.)
"PN" – Network Personalization (Refer to 3GPP TS 22.022.)
"PU" – network subset personalization (Refer to 3GPP TS 22.022.)
"PP" – service provider personalization (Refer to 3GPP TS 22.022.)
"PC" – corporate personalization (Refer to 3GPP TS 22.022.)
Note: * indicates M14A2A only; ** indicates M18Q2 only

<mode>: integer
0 – unlock
1 – lock
2 – query status

<status>: integer
0 – not active
1 – active

<passwd>: string, shall be the same as the password specified for the facility from the MT
user interface or with the command Change Password +CPWD

<classx>: integer, this is a sum of integers each representing a class of information (default
7 - voice, data and fax):
1 – voice (telephony)
2 – data (refers to all bearer services; with <mode>=2 this may refer only to some
bearer service if TA does not support values 16, 32, 64, and 128.)
4 – fax (facsimile services)
8 – short message service

41/206
 16 – data circuit sync
32 – data circuit async
64 – dedicated packet access
128 – dedicated PAD access

Example: Query and set PIN enable/disable status

AT+CLCK="SC",2
+CLCK: 0
OK
AT+CLCK="SC",1,"1234"
OK
AT+CLCK="SC",2
+CLCK: 1
OK

5.3. AT+CPWD Change Password

AT+CPWD parameter command syntax
Command Possible response(s)
+CPWD=<fac>,<oldpwd>,<newpwd> Normally respond:
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CPWD=? Normally respond:
+CPWD: list of supported (<fac>,<pwdlength>)s
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

42/206
Description:

Action command sets a new password for the facility lock function defined by the command
Facility Lock +CLCK. Refer to Table A-1 Error codes supported for CMEE commands for
possible <err> values.

The test command returns a list of pairs which present the available facilities and the
maximum length of their password.

Defined values:

<fac>: string, values reserved by the present document:

"P2" – SIM PIN2
[*]
"PS" – PH-SIM (lock PHone to SIM/UICC card) (MT requests a password when
other-than-current SIM/UICC cards have been inserted; MT may have
stored information regarding a certain number of previously used cards
thus not requiring passwords when they are inserted.)
"SC" – SIM (lock SIM/UICC card) (The SIM/UICC requests the password when
the MT powers up and when this lock command has been issued.)
"AO"[**] – BAOC (Barr All Outgoing Calls) (Refer to 3GPP TS 22.088 clause 1.)
"OI"[**] – BOIC (Barr Outgoing International Calls) (Refer to 3GPP TS 22.088
clause 1.)
"OX"[**] – BOIC-exHC (Barr Outgoing International Calls except to the Home
Country) (Refer to 3GPP TS 22.088 clause 1.)
"AI"[**] – BAIC (Barr All Incoming Calls) (Refer to 3GPP TS 22.088 clause 2.)
"IR"[**] – BIC-Roam (Barr Incoming Calls when Roaming outside the home country)
(Refer to 3GPP TS 22.088 clause 2.)
"AB"[**] – all barring services (Refer to 3GPP TS 22.030.) (Applicable only for
<mode>=0.)
[**]
"AG" – All outgoing barring services (Refer to 3GPP TS 22.030.) (Applicable only
for <mode>=0.)
"AC"[**] – All incoming barring services (Refer to 3GPP TS 22.030.) (Applicable only
for <mode>=0.)
"PN"[*] – Network Personalization (Refer to 3GPP TS 22.022.)

43/206
 "PU"[*] – network subset personalization (Refer to 3GPP TS 22.022.)
"PP"[*] – service provider personalization (Refer to 3GPP TS 22.022.)
[*]
"PC" – corporate personalization (Refer to 3GPP TS 22.022.)
Note: * indicates M14A2A only; ** indicates M18Q2 only

<oldpwd>, <newpwd>: string type, <oldpwd> shall be identical to the password specified
for the facility from the MT user interface or with command Change Password
+CPWD; <newpwd> is the new password. The maximum length of the password
can be determined with <pwdlength>.
Example: Enable PIN and change PIN code

AT+CPIN?
+CPIN: SIM PIN
OK
AT+CPIN="0000"
OK
AT+CPIN?
+CPIN: READY
OK
AT+CPWD="SC","0000","1234"
OK

5.4. AT+CPINR Display PIN Counter

AT+CPINR parameter command syntax
Command Possible response(s)
+CPINR[=<sel_code>] Normally respond:
+CPINR:<code>,<retries>[,<default_retries>]
[<CR><LF>+CPINR:<code>,<retries>[,<default_retries>]
[...]]
OK

If something is wrong, then respond:

ERROR
+CPINR=? Normally respond:
OK

44/206
 If something is wrong, then respond:
ERROR
Reference: 3GPP TS 27.007

Description:

Execution command cause the MT to return the number of remaining PIN retries for the MT
passwords with intermediate result code +CPINR: <code>,<retries>[,<default_retries>] for
standard PINs.

Defined values:

<retries>: integer, number of remaining retries per PIN.

<default_retries>: integer, number of default/initial retries per PIN.
<sel_code><code>: string
"SIM PIN" – SIM PIN code
"SIM PUK" – SIM PUK code
"SIM PIN2" – SIM PIN2 code
"SIM PUK2" – SIM PUK2 code
"PH-NET PIN" – Network Personalization code
"PH-SIM PIN" – PH-SIM lock code

Example: Query remain retries for all PINs

AT+CPINR
+CPINR: SIM PIN, 3, 3
+CPINR: SIM PUK, 10, 10
+CPINR: SIM PIN2, 3, 3
+CPINR: SIM PUK2, 10, 10
+CPINR: PH-NET PIN, 3, 3
+CPINR: PH-SIM PIN, 3, 3
OK

45/206
6. Identification Commands

6.1. ATI Display Product Identification Information

ATI parameter command syntax
Command Possible response(s)
ATI Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference:

Description:

Display Product Identification Information

Defined values:

Example:

ATI
Manufacturer: WNC
Model: M18Q2
Revision: MPSS: M18Q2_v12.04.162021 APSS: M18Q2_v00.07.162132
CUSTAPP:
SVN: 01
IMEI: 004402330002308
+GCAP: +CGSM
OK

46/206
6.2. AT+CGMI Request Manufacturer Identification
AT+CGMI parameter command syntax
Command Possible response(s)
+CGMI Normally respond:
<manufacturer>
OK

If something is wrong, then respond:

ERROR
+CGMI=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command causes the TA to return one or more lines of information text
<manufacturer>, determined by the MT manufacturer, which is intended to permit the user
of the TA to identify the manufacturer of the MT to which it is connected. Typically, the text
will consist of a single line containing the name of the manufacturer, but manufacturers
may choose to provide more information if desired. Refer to Table A-1 Error codes
supported for CMEE commands for possible <err> values.

Defined values:

<manufacturer>: string, the total number of characters, including line terminators, in the
information text shall not exceed 2,048 characters. Text shall not contain the
sequence 0<CR> or OK<CR>.
Example:

47/206
 AT+CGMI
WNC
OK

6.3. AT+GMI Request Manufacturer Identification

AT+GMI parameter command syntax
Command Possible response(s)
+GMI Normally respond:
<manufacturer>
OK

If something is wrong, then respond:

ERROR
+GMI=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: ITU-T V.25ter

Description:

The execution command causes the TA to return one or more lines of information text
<manufacturer>, determined by the MT manufacturer, which is intended to permit the user
of the TA to identify the manufacturer of the MT to which it is connected. Typically, the text
will consist of a single line containing the name of the manufacturer, but manufacturers
may choose to provide more information if desired. Refer to Table A-1 Error codes
supported for CMEE commands for possible <err> values.

Defined values:

48/206
<manufacturer>: string, the total number of characters, including line terminators, in the
information text shall not exceed 2,048 characters. Text shall not contain the
sequence 0<CR> or OK<CR>.

6.4. AT+CGMM Request Model Identification

AT+CGMM parameter command syntax
Command Possible response(s)
+CGMM Normally respond:
<model>
OK

If something is wrong, then respond:

ERROR
+CGMM=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command causes the TA to return one or more lines of information text
<model>, determined by the MT manufacturer, which is intended to permit the user of the
TA to identify the specific model of the MT to which it is connected. Typically, the text will
consist of a single line containing the name of the product, but manufacturers may choose
to provide more information if desired. Refer to Table A-1 Error codes supported for CMEE
commands for possible <err> values.

Defined values:

49/206
<model>: string, the total number of characters, including line terminators, in the
information text shall not exceed 2,048 characters.
Example:

AT+CGMM
M18Q2
OK

6.5. AT+GMM Request Model Identification

AT+GMM parameter command syntax
Command Possible response(s)
+GMM Normally respond:
<model>
OK

If something is wrong, then respond:

ERROR
+GMM=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: ITU-T V.25ter

Description:

The execution command causes the TA to return one or more lines of information text
<model>, determined by the MT manufacturer, which is intended to permit the user of the
TA to identify the specific model of the MT to which it is connected. Typically, the text will
consist of a single line containing the name of the product, but manufacturers may choose

50/206
to provide more information if desired. Refer to Table A-1 Error codes supported for CMEE
commands for possible <err> values.

Defined values:

<model>: string, the total number of characters, including line terminators, in the
information text shall not exceed 2,048 characters.

6.6. AT+CGMR Request Revision Identification of Software

Status
AT+CGMR parameter command syntax
Command Possible response(s)
+CGMR Normally respond:
<revision>
OK

If something is wrong, then respond:

ERROR
+CGMR=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command causes the TA to return one or more lines of information text
<revision>, determined by the MT manufacturer, which is intended to permit the user of

51/206
the TA to identify the version, revision level or date, or other pertinent information of the
MT to which it is connected. Typically, the text will consist of a single line containing the
version of the product, but manufacturers may choose to provide more information if
desired. Refer to Table A-1 Error codes supported for CMEE commands for possible <err>
values.

Defined values:

<revision>: string, the total number of characters, including line terminators, in the
information text shall not exceed 2,048 characters.
Example:

AT+CGMR
MPSS: M18Q2_v12.04.162021 APSS: M18Q2_v00.07.162132 CUSTAPP:
OK

6.7. AT+GMR Request Revision Identification of Software

Status
AT+GMR parameter command syntax
Command Possible response(s)
+GMR Normally respond:
<revision>
OK

If something is wrong, then respond:

ERROR
+GMR=? Normally respond:
<revision>
OK

If something is wrong, then respond:

ERROR
Reference: ITU-T V.25ter

52/206
Description:

The execution command causes the TA to return one or more lines of information text
<revision>, determined by the MT manufacturer, which is intended to permit the user of
the TA to identify the version, revision level or date, or other pertinent information of the
MT to which it is connected. Typically, the text will consist of a single line containing the
version of the product, but manufacturers may choose to provide more information if
desired. Refer to Table A-1 Error codes supported for CMEE commands for possible <err>
values.

Defined values:

<revision>: string, the total number of characters, including line terminators, in the
information text shall not exceed 2,048 characters.

6.8. AT+CGSN Request International Mobile Equipment

Identity (IMEI)
AT+CGSN parameter command syntax
Command Possible response(s)
+CGSN Normally respond:
<sn>
OK

If something is wrong, then respond:

ERRORor
+CME ERROR: <err>
+CGSN=? Normally respond:
OK

If something is wrong, then respond:

53/206
 ERROR
Reference: 3GPP TS 27.007

Description:

The execution command causes the TA to return one or more lines of information text <sn>,
determined by the MT manufacturer, which is intended to permit the user of the TA to
identify the individual MT to which it is connected. Typically, the text will consist of a single
line containing the IMEI (International Mobile station Equipment Identity; refer to
3GPP TS 23.003.) number of the MT, but manufacturers may choose to provide more
information if desired. Refer to Table A-1 Error codes supported for CMEE commands for
possible <err> values.

Defined values:

<sn>: string, the total number of characters, including line terminators, in the information
text shall not exceed 2,048 characters.
Example:

AT+CGSN
004402330002308
OK

6.9. AT+GSN Request International Mobile Equipment

Identity (IMEI)
AT+GSN parameter command syntax
Command Possible response(s)
AT+GSN Normally respond:
<sn>
OK

54/206
 If something is wrong, then respond:
ERROR
or
+CME ERROR: <err>
AT+GSN=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: ITU-T V.25ter

Description:

AT+GSN delivers the International Mobile Equipment Identity (IMEI). The command is
identical to AT+CGSN.

Defined values:

<SN>: string, International Mobile Equipment Identity (IMEI) used to identify a GSM
mobile equipment to the GSM network.

6.10. AT+CIMI Request International Mobile Subscriber

Identity (IMSI)
AT+CIMI parameter command syntax
Command Possible response(s)
+CIMI Normally respond:
<IMSI>
OK

55/206
 If something is wrong, then respond:
ERROR
or
+CME ERROR:<err>
+CIMI=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command causes the TA to return <IMSI>, which is intended to permit the TE
to identify the individual SIM card or active application in the UICC (GSM or USIM) which is
attached to MT. Refer to Table A-1 Error codes supported for CMEE commands for possible
<err> values.

Defined values:

<IMSI>: string, International Mobile Subscriber Identity (string without double quotes)
Example:

AT+CIMI
001010123456789
OK

56/206
7. Network Service Commands

7.1. AT+COPN Read Operator Names

AT+COPN parameter command syntax
Command Possible response(s)
+COPN Normally respond:
+COPN:<numeric1>,<alpha1>
[<CR><LF>+COPN:<numeric2>,<alpha2>
[...]]
OK

If something is wrong, then respond:

ERROR

or
+CME ERROR:<err>
+COPN=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execute command returns the list of operator names from the MT. Each operator code
<numericn> that has an alphanumeric equivalent <alphan> in the MT memory shall be
returned. Refer to Table A-1 Error codes supported for CMEE commands for possible <err>
values.

57/206
Defined values:

<numericn>: string, operator in numeric format (Refer to +COPS.)

<alphan>: string, operator in long alphanumeric format (Refer to +COPS.)
Example: Read operator names

AT+COPN
……
+COPN: "90126","TIM¡sea"
+COPN: "90145","AISatSea"
+COPN: "99899","UZMOBILE"
OK
AT+COPN=?
OK

7.2. AT+COPS Operator Selection

AT+COPS parameter command syntax
Command Possible response(s)
+COPS=[<mode>[,<format> Normally respond:
[,<oper>[,<AcT>]]]] OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+COPS? Normally respond:
+COPS:<mode>[,<format>,<oper>[,<AcT>]]
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>

58/206
 +COPS=? Normally respond:
+COPS: [list of supported (<stat>,long alphanumeric
<oper>,short alphanumeric <oper>,numeric
<oper>[,<AcT>])s][,,(list of supported <mode>s),(list of
supported <format>s)]
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR: <err>
Reference: 3GPP TS 27.007

Description:

The set command forces an attempt to select and register the GSM/UMTS network operator.
<mode> is used to select whether the selection is performed automatically by the MT or is
forced by this command to operator <oper> (It shall be provided in format <format>.) to a
certain access technology, indicated in <AcT>. If the selected operator is not available, no
other operator shall be selected (except <mode>=4). If the selected access technology is not
available, then the same operator shall be selected in other access technology. The selected
operator name format shall also apply to further read commands (+COPS?). <mode>=2
forces an attempt to deregister from the network. The selected mode affects all further
network registration. (E.g. after <mode>=2, MT shall not be registered until <mode>=0 or
<mode>=1 is selected.) Refer to Table A-1 Error codes supported for CMEE commands for
possible <err> values. This command should be abortable when registration/deregistration
attempts are made.

The read command returns the current mode, the currently selected operator, and the
current Access Technology. If no operator is selected, <format>, <oper>, and <AcT> are
omitted.

The test command returns a set of five parameters, each representing an operator present

59/206
in the network. A set consists of an integer indicating the availability of the operator <stat>,
a long and short alphanumeric format of the name of the operator, a numeric format
representation of the operator, and access technology. Any of the formats may be
unavailable and should then be an empty field. The list of operators shall be in the following
order: home network and networks referenced in the SIM or active application in the UICC
(GSM or USIM) which will be subsequently in the following order: HPLMN selector, User
controlled PLMN selector, Operator controlled PLMN selector and PLMN selector (in the
SIM or GSM application), and other networks.

It is recommended (although optional) that after the operator list TA returns lists of
supported <mode> and <format>, these lists shall be delimited from the operator list by
two commas.

The access technology selected parameters <AcT> should only be used in terminals capable
of registering to more than one access technology. Selection of <AcT> does not limit the
capability to cell reselections, even though an attempt is made to select an access
technology, the phone may still re-select a cell using another access technology.

Defined values:

<mode>: integer
0 – automatic (The <oper> field is ignored.)
1 – manual (The <oper> field shall be present; <AcT> is optional.)
2 – deregister from the network
3 – set only <format> (for read command +COPS?), do not attempt
registration/deregistration (<oper> and <AcT> fields are ignored); this value is
not applicable in cases of a read-command response.
[**]
4 – manual/automatic (<oper> field shall be present); if manual selection fails,
automatic mode (<mode>=0) is initiated.
Note: * indicates M14A2A only; ** indicates M18Q2 only

<format>: integer
0 – long format alphanumeric <oper>
1 – short format alphanumeric <oper>
2 – numeric <oper>

<oper>: string, <format> indicates if the format is alphanumeric or numeric; long

alphanumeric format can be up to 16 characters long and short format up to 8
characters (Refer to GSM MoU SE.13.); numeric format is the GSM Location Area

60/206
 Identification number (Refer to 3GPP TS 24.008 subclause 10.5.1.3.) which consists
of a three-BCD-digit country code coded as in ITU-T Recommendation E.212 Annex A,
plus a two BCD digit network code, which is administration-specific; the returned
<oper> shall not be in BCD format, but in IRA characters converted from BCD. The
number is composed with the following structure: (country code digit 3)(country
code digit 2)(country code digit 1)(network code digit 3)(network code
digit 2)(network code digit 1)

<stat>: integer
0 – unknown
1 – available
2 – current
3 – forbidden

<AcT>: integer, access technology selected

[**]
0 – GSM
1[**] – GSM Compact
2[**] – UTRAN
3[**] – GSM w/EGPRS (Refer to Note 1.)
4[**] – UTRAN w/HSDPA (Refer to Note 2.)
5[**] – UTRAN w/HSUPA (Refer to Note 2.)
6[**] – UTRAN w/HSDPA and HSUPA (Refer to Note 2.)
7 – E-UTRAN
Note: * indicates M14A2A only; ** indicates M18Q2 only

Example:

Case 1: Network scan for M14A2A, UE need to disconnect the data call first.
at%CMATT=0
OK
at+cops=?
+COPS: (1,"Test Usim","Test","00101",7),,(0-4),(0-2)
OK
at%CMATT=1
OK

Case 2: Set network name display format for M14A2A.

61/206
 at+cops=3,0
OK
at+cops?
+COPS: 0,0,"Test Usim",7
OK
at+cops=3,1
OK
at+cops?
+COPS: 0,1,"Test Usim",7
OK
at+cops=3,2
OK
at+cops?
+COPS: 0,2,"00101",7
OK

Case 3: Scan network for M18Q2.

AT+COPS?
+cops: 0,0,"MD8475A_SmartStudio USIM",7
OK
AT+COPS=0,1
OK
AT+COPS=?
+cops:
(2,"MD8475A_SmartStudio","MD8475A","00101",7),,(0,1,2,3,4),(0,1,2)
OK
AT+COPS=0,1
OK
AT+COPS?
+cops: 0,1,"MD8475A USIM",7
OK

7.3. AT+CPOL Preferred Operator List

AT+CPOL parameter command syntax

62/206
Command Possible response(s)
+CPOL=[<index>][,<format> Normally respond:
[,<oper>[,<GSM_AcT>, OK
<GSM_Compact_AcT>,
<UTRAN_AcT>,<E-UTRAN_AcT>]]] If something is wrong, then respond:
ERROR
or
+CME ERROR:<err>
+CPOL? Normally respond:
+CPOL:<index1>,<format>,<oper1>[,<GSM_AcT1>,<
GSM_Compact_AcT1>,<UTRAN_AcT1>,<E-UTRAN_
AcT1>]
[<CR><LF>+CPOL:<index2>,<format>,<oper2>[,<GS
M_AcT2>,<GSM_Compact_AcT2>,<UTRAN_AcT2>,<
E-UTRAN_AcT2>]
[...]]
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CPOL=? Normally respond:
+CPOL: (list of supported <index>s),(list of
supported <format>s)
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
Reference: 3GPP TS 27.007

63/206
Description:

This command is used to edit the PLMN selector with Access Technology lists in the SIM
card or active application in the UICC (GSM or USIM).

The execute command writes an entry in the SIM/USIM list of preferred PLMNs, previously
selected by the command +CPLS. If no list has been previously selected, the User controlled
PLMN selector with Access Technology, EFPLMNwAcT, is the one accessed by default. If
<index> is given but <oper> is omitted, entry is deleted. If <oper> is given but <index> is
omitted, <oper> is put in the next free location. If only <format> is given, the format of the
<oper> in the read command is changed. The Access Technology selection parameters,
<GSM_AcT>, <GSM_Compact_AcT>, and <UTRAN_AcT> and <E-UTRAN_AcT> are required
when writing user-controlled PLMN selectors with Access Technology, EFPLMNwAcT,
operator-controlled PLMN selectors with Access Technology EFOPLMNwAcT, and HPLMN
selectors with Access Technology EFHPLMNwAcT. (Refer to 3GPP TS 31.102.) Refer to Table
A-1 Error codes supported for CMEE commands for possible <err> values.

Note 1: MT can also update the User controlled PLMN selector with Access
Technology EFPLMNwAcT automatically when new networks are selected.
Note 2: The Operator controlled PLMN selector with Access Technology
EFOPLMNwAcT can only be written if the write access condition in the
SIM/USIM has been previously verified.

The read command returns all used entries from the SIM/USIM list of preferred PLMNs
previously selected by the command +CPLS with the Access Technologies for each PLMN in
the list.

The test command returns the whole index range supported by the SIM.

Defined values:

<indexn>: integer, the order number of operators in the SIM/USIM preferred operator list

<format>: integer
0[**] – long-format alphanumeric <oper>
1[**] – short-format alphanumeric <oper>
2 – numeric <oper>
Note: * indicates M14A2A only; ** indicates M18Q2 only

64/206
<opern>: string, <format> indicates if the format is alphanumeric or numeric (Refer to
+COPS.)

<GSM_AcTn>: integer, GSM access technology:

0 – access technology not selected
1 – access technology selected

<GSM_Compact_AcTn>: integer, GSM compact access technology

0 – access technology not selected
1 – access technology selected

<UTRAN_AcTn>: integer type; UTRAN access technology

0 – access technology not selected
1 – access technology selected

<E-UTRAN_AcTn>: integer, E-UTRAN access technology

0 – access technology not selected
1 – access technology selected

Example: Read preferred operator list

AT+CPOL?
+CPOL: 1,2,"46008",0,0,0,1
+CPOL: 2,2,"46000",0,0,0,1
+CPOL: 3,2,"46002",0,0,0,1
+CPOL: 4,2,"46007",0,0,0,1
+CPOL: 5,2,"46008",0,0,1,0
+CPOL: 6,2,"46000",0,0,1,0
+CPOL: 7,2,"46002",0,0,1,0
+CPOL: 8,2,"46007",0,0,1,0
+CPOL: 9,2,"46008",1,0,0,0
+CPOL: 10,2,"46000",1,0,0,0
+CPOL: 11,2,"46002",1,0,0,0
+CPOL: 12,2,"46007",1,0,0,0
OK
AT+CPOL=?
+CPOL: (1-80),(0-2)
OK
AT+CPOL=1,0

65/206
OK
AT+CPOL?
+CPOL: 2,0,"CHINA MOBILE",0,0,0,1
+CPOL: 3,0,"CHINA MOBILE",0,0,0,1
+CPOL: 4,0,"CHINA MOBILE",0,0,0,1
+CPOL: 5,0,"CHINA MOBILE",0,0,1,0
+CPOL: 6,0,"CHINA MOBILE",0,0,1,0
+CPOL: 7,0,"CHINA MOBILE",0,0,1,0
+CPOL: 8,0,"CHINA MOBILE",0,0,1,0
+CPOL: 9,0,"CHINA MOBILE",1,0,0,0
+CPOL: 10,0,"CHINA MOBILE",1,0,0,0
+CPOL: 11,0,"CHINA MOBILE",1,0,0,0
+CPOL: 12,0,"CHINA MOBILE",1,0,0,0
OK

7.4. AT+CPLS Select Preferred Operator List

AT+CPLS parameter command syntax
Command Possible response(s)
+CPLS=<list> Normally respond:
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CPLS? Normally respond:
+CPLS:<list>
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CPLS=? Normally respond:

66/206
 +CPLS:(list of supported <list>s)
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
Reference: 3GPP TS 27.007

Description:

This command is used to select one PLMN selector with Access Technology list in the
SIM card or active application in the UICC (GSM or USIM), that is used by the +CPOL
command.

The execute command selects a list in the SIM/USIM. Refer to Table A-1 Error codes
supported for CMEE commands for possible <err> values.
The read command returns the selected PLMN selector list from the SIM/USIM.
The test command returns the whole index range supported lists by the SIM/USIM.

Defined values:

<list>: integer
0 – User controlled PLMN selector with Access Technology EFPLMNwAcT, if not
found in the SIM/UICC, then the PLMN preferred list EFPLMNsel (This file is only
available in the SIM card or GSM application selected in UICC.)
1 – Operator controlled PLMN selector with Access Technology EFOPLMNwAcT
2 – HPLMN selector with Access Technology EFHPLMNwAcT

Example: Select prefer network list for AT+CPOL operation

AT+CPLS?
+CPLS: 0
OK

67/206
AT+CPLS=?
+CPLS: 0,1,2
OK
AT+CPLS=1
OK
AT+CPLS?
+CPLS: 1
OK

7.5. AT+CREG Network Registration Status

AT+CREG parameter command syntax
Command Possible response(s)
+CREG=[<n>] Normally respond:
OK

If something is wrong, then respond:

ERROR
+CREG? Normally respond:
+CREG:<n>,<stat>[,<lac>,<ci>[,<AcT>]]
OK

If something is wrong, then respond:

ERROR
+CREG=? Normally respond:
+CREG:(list of supported <n>)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

68/206
Description:

The set command controls the presentation of an unsolicited result code +CREG: <stat>
when <n>=1 and there is a change in the MT’s circuit-mode network registration status or
code +CREG: <stat>[,<lac>,<ci>[,<AcT>]] when <n>=2 and there is a change of the network
cell.

Note 1: If the MT also supports GPRS services and/or EPS services, the +CGREG
command and +CGREG: result codes and/or the +CEREG command and
+CEREG: result codes apply to the registration status and location
information for those services.

The read command returns the status of result-code presentation and an integer <stat>
which shows whether the network has currently indicated the registration of the MT.
Location information elements <lac>, <ci> and <AcT> are returned only when <n>=2 and MT
is registered in the network. Refer to Table A-1 Error codes supported for CMEE commands
for possible <err> values.

Defined values:

<n>: integer
0 – disable network registration unsolicited result code
1 – enable network registration unsolicited result code +CREG: <stat>
2 – enable network registration and location information unsolicited result code
+CREG: <stat>[,<lac>,<ci>[,<AcT>]]
[*]
3 – enable network registration, location information and cause value information
unsolicited result code +CREG:
<stat>[,[<lac>],[<ci>],[<AcT>][,<cause_type>,<reject_cause>]]
Note: * indicates M14A2A only; ** indicates M18Q2 only

<stat>: integer, circuit mode registration status

0 – not registered; MT is not currently searching a new operator to register to.
1 – registered, home network
2 – not registered; but MT is currently searching a new operator to register to.
3 – registration denied
4 – unknown
5 – registered, roaming

69/206
<lac>: string, two byte location area code or tracking area code in hexadecimal format (e.g.
"00C3" equals 195 in decimal format)

<ci>: string, four byte GERAN/UTRAN/E-UTRAN cell ID in hexadecimal format

<AcT>: integer, access technology of the serving cell

0 – GSM
1 – GSM Compact
2 – UTRAN
3 – GSM w/EGPRS (Refer to Note 1.)
4 – UTRAN w/HSDPA (Refer to Note 2.)
5 – UTRAN w/HSUPA (Refer to Note 2.)
6 – UTRAN w/HSDPA and HSUPA (Refer to Note 2.)
7[*] – E-UTRAN
Note: * indicates M14A2A only; ** indicates M18Q2 only

Example: Query current registration status and enable registration status unsolicited notify.

AT+CREG?
+CREG: 0,5
OK
AT+CREG=?
+CREG: (0-2)
OK
AT+CREG=1
OK
AT+CREG?
+CREG: 1,5
OK
at+cfun=0
OK
at+cfun=1
OK
+CREG: 2
+CREG: 1

70/206
7.6. AT+CSQ Signal Quality
AT+CSQ parameter command syntax
Command Possible response(s)
+CSQ Normally respond:
+CSQ:<rssi>,<ber>
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
+CSQ=? Normally respond:
+CSQ:(list of supported <rssi>s),(list of supported <ber>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command returns the received signal strength indication <rssi> and channel
bit error rate <ber> from the MT. Refer to Table A-1 Error codes supported for CMEE
commands for possible <err> values.
The test command returns values supported as compound values

Defined values:

<rssi>: integer
0 – -113 dBm or less
1 – -111 dBm

71/206
 2...30 – -109 dBm to –53 dBm
31 – -51 dBm or greater
99 – not known or not detectable

<ber>: integer, channel bit error rate (in percent)

0...7 – as RXQUAL values in the table in 3GPP TS 45.008 subclause 8.2.4
99 – not known or not detectable

Example: Query signal quality

AT+CSQ
+csq: 26,99
OK
AT+CSQ=?
+CSQ: (0-31,99),(0-7,99)
OK

7.7. AT$QCSYSMODE Quesy Current System Mode of ME

AT$QCSYSMODE parameter command syntax
Command Possible response(s)
$QCSYSMODE? Normally respond:
$QCSYSMODE:<sysmode>
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>
Reference: Qualcomm 80-VR432-1

72/206
Description:

Returns current system mode of ME Provides details regarding the support of

LTE/HSUPA/HSDPA

Defined values:

<sysmode>: string,
"NOT DETERMINED"
"GSM"
"WCDMA"
"LTE"
"WCDMA - HSDPA"
"WCDMA - HSUPA"
"WCDMA - HSDPA and HSUPA"
"WCDMA - HSDPA+"
"WCDMA - HSDPA+ and HSUPA"
"WCDMA - DC HSDPA+"
"WCDMA - DC HSDPA+ and HSUPA"
"WCDMA - 64QAM HSDPA+"
"WCDMA - 64QAM HSDPA+ and HSUPA"
"WCDMA - DC HSDPA+ and DC HSUPA"

Example: Query current system mode

AT$QCSYSMODE?
LTE
OK

7.8. AT$QCRSRP Display Neighbor Cell Information RSRP

AT$QCRSRP parameter command syntax
Command Possible response(s)
$QCRSRP? Normally respond:
$QCRSRP:<cell id><EARFCN><rsrp>
OK

73/206
 If something is wrong, then respond:
ERROR
or
+CME ERROR:<err>
Reference: Qualcomm 80-VR432-1
Note: Only the read command is supported.

Description:

This command is used to display neighbor cell information cell ID, EARFCN, RSRP.

Defined values:

<cell id>: integer

<EARFCN>: integer
<rsrp>: integer
Example: Query RSRP value

AT$QCRSRP?
$QCRSRP: 000,2175,"-085.70"
OK

7.9. AT$QCRSRQ Display Neighbor Cell Information RSRQ

AT$QCRSRP parameter command syntax
Command Possible response(s)
$QCRSRQ? Normally respond:
$QCRSRQ:<cell id><EARFCN><rsrq>
OK

If something is wrong, then respond:

ERROR

74/206
 or
+CME ERROR:<err>
Reference: Qualcomm 80-VR432-1
Note: Only the read command is supported.

Description:

This command is used to display neighbor cell information cell ID, EARFCN, RSRQ.

Defined values:

<cell id>: integer

<EARFCN>: integer
<rsrq>: integer
Example: Query RSRQ value

AT$QCRSRQ?
$QCRSRQ: 000,2175,"-09.60"
OK

75/206
 8. Packet Domain Related Commands

8.1. AT+CGACT PDP Context Activate Or Deactivate

AT+CGACT parameter command syntax
Command Possible response(s)
+CGACT=[<state>[,<cid>[,<cid>[,...]]]] Normally respond:
OK

If something is wrong, then respond:

ERROR
+CGACT? Normally respond:
+CGACT:<cid>,<state>
[<CR><LF>+CGACT:<cid>,<state>
[...]]
OK

If something is wrong, then respond:

ERROR
+CGACT=? Normally respond:
+CGACT:(list of supported <state>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command is used to activate or deactivate the specified PDP context(s).

□ Normal □ Internal Use  Confidential □ Restricted Confidential

76/206
Defined values:

<state>: integer, a numeric parameter that indicates the state of PDP context activation
0 – deactivated
1 – activated

<cid>: integer, a numeric parameter which specifies a particular PDP context definition.
(Refer to the +CGDCONT and +CGDSCONT commands.)
Example: PDP Context activation/deactivation

AT+CGACT?
+CGACT: 1,1
+CGACT: 2,0
OK
AT+CGACT=?
+CGACT: (0,1)
OK
AT+CGACT=1
OK
AT+CGACT?
+CGACT: 1,1
+CGACT: 2,1
OK

8.2. AT+CGDATA Enter Date State

AT+CGDATA parameter command syntax
Command Possible response(s)
+CGDATA=[<L2P>[,<cid>[,<cid>[,...]]]] Normally respond:
CONNECT
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR:<err>

77/206
 +CGDATA=? Normally respond:
+CGDATA: (list of supported <L2P>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The execution command causes the MT to perform whatever actions are necessary to
establish communication between the TE and the network using one or more Packet
Domain PDP types. This may include performing a PS attach and one or more PDP context
activations. If the <L2P> parameter value is unacceptable to the MT, the MT shall return an
ERROR or +CME ERROR response. Otherwise, the MT issues the intermediate result code
CONNECT and enters a V.250 online data state.

Commands succeeding the +CGDATA command in the AT command line shall not be
processed by the MT.

The detailed behavior after the online data state has been entered is dependent on the PDP
type. It is described briefly in 3GPP TS 27.060 and in more detail in 3GPP TS 29.061 and the
specifications for the relevant PDPs. The PS attachment and PDP context activation
procedures may occur prior to or during the PDP startup if they have not already been
performed using the +CGATT and +CGACT commands.

If context activation occurs during the PDP startup, one or more <cid> may be specified in
order to provide the information needed for the context activation request(s).

During each PDP startup procedure, the MT may have access to some or all of the following
information:
 The MT may have a priori knowledge; for example, it may implement only one
PDP type.
 The command may have provided an <L2P> parameter value.

78/206
  The TE may provide a PDP type and/or PDP address to the MT during in the PDP
startup procedure.

If any of this information is in conflict, the command will fail.

Any PDP type and/or PDP address present in the above information shall be compared with
the PDP type and/or PDP address in any context definition specified in the command in the
order in which their <cid> parameters appear. For a context definition to match:
 The PDP type must match exactly.
 The PDP addresses are considered “matching” if they are identical or if either or
both addresses are unspecified. For example, a PPP NCP request specifying PDP
type = IP and no PDP address would cause the MT to search through the
specified context definitions for one with PDP type = IP and any PDP address.

The context shall be activated using the matched value for the PDP type and a static PDP
address if available, together with the other information found in the PDP context definition.
If a static PDP address is not available, then a dynamic address is requested.

If no <cid> is given or if there is no matching context definition, the MT shall attempt to

activate the context with whatever information is available to the MT. The other context
parameters shall be set to their default values.

If the activation is successful, data transfer may proceed.

After data transfer is complete and the layer 2 protocol termination procedure has
successfully completed, the V.250 command state is re-entered and the MT returns the final
result code “OK”.

In the event of an erroneous termination or a failure to start up, the V.250 command state is
re-entered and the MT returns the final result code NO CARRIER or, if enabled,
+CME ERROR. Attach, activate, and other errors may be reported.

The test command is used for requesting information on the supported layer 2 protocols.
This command may be used in both normal and modem compatibility modes.

Defined values:

<L2P>: a string parameter that indicates the layer 2 protocol to be used between the TE and
PPP – point-to-point protocol for a PDP such as IP

If the value is omitted, the layer 2 protocol is unspecified. Other values are reserved and will
result in an ERROR response.

79/206
<cid>: integer, a numeric parameter which specifies a particular PDP context definition
(Refer to the +CGDCONT and +CGDSCONT commands.)
Example: Enter PPP state

AT+CGDATA=?
+CGDATA: ("PPP")
OK
AT+CGDATA="PPP",1
CONNECT 150000000

8.3. AT+CGATT GPRS Attach Or Detach

AT+CGATT parameter command syntax
Command Possible response(s)
+CGATT=[<state>] Normally respond:
OK

If something is wrong, then respond:

ERROR
+CGATT? Normally respond:
+CGATT:<state>
OK

If something is wrong, then respond:

ERROR
+CGATT=? Normally respond:
+CGATT:(list of supported <state>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

80/206
Description:

The execution command is used to attach the MT to, or detach the MT from, the Packet
Domain service.

Defined values:

< state >: integer, a numeric parameter that indicates the state of PS attachment
0 – Detached
1 – Attached

Example: Detach/Attach network for M18Q2

AT+CGATT?
+CGATT: 1
OK
AT+CGATT=?
+CGATT: (0,1)
OK
AT+CGATT=0
OK
AT+CGATT?
+CGATT: 0
OK

8.4. AT+CGDCONT Define PDP Context

AT+CGDCONT parameter command syntax
Command Possible response(s)
+CGDCONT=[<cid>[,<PDP_type>[ Normally respond:
,<APN>[,<PDP_addr>[,<d_comp> OK
[,<h_comp>[,<IPv4AddrAlloc>[,<
emergency indication>]]]]]]]] If something is wrong, then respond:
ERROR
+CGDCONT? Normally respond:

81/206
 +CGDCONT:<cid>,<PDP_type>,<APN>,<PDP_addr>,<
d_comp>,<h_comp>[,<IPv4AddrAlloc>[,<emergency i
ndication>]]
[<CR><LF>+CGDCONT:<cid>,<PDP_type>,<APN>,<PD
P_addr>,<d_comp>,<h_comp>[,<IPv4AddrAlloc>[,<e
mergency indication>]]
[...]]
OK

If something is wrong, then respond:

ERROR
+CGDCONT=? Normally respond:
+CGDCONT:(range of supported
<cid>s),<PDP_type>,,,(list of supported
<d_comp>s),(list of supported <h_comp>s),(list of
supported <IPv4AddrAlloc>s),(list of supported
<emergency indication>s)
[<CR><LF>+CGDCONT:(range of supported
<cid>s),<PDP_type>,,,(list of supported
<d_comp>s),(list of supported <h_comp>s),(list of
supported <IPv4AddrAlloc>s),(list of supported
<emergency indication>s)
[...]]
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The set command specifies the PDP context parameter values for a PDP context identified

82/206
by the (local) context identification parameter <cid>. The number of PDP contexts that may
be in a defined state at the same time is provided by the range returned by the test
command.

For EPS, the PDN connection and its associated EPS default bearer is identified herewith.
For EPS, the <PDP_addr> parameter value shall be omitted.

A special form of the set command +CGDCONT=<cid> causes the values for the context
number <cid> to become undefined.

The read command returns the current settings for each defined context.

The test command returns values supported as a compound value. If the MT supports
several PDP types using the parameter <PDP_type>, the parameter value ranges for each
<PDP_type> are returned on a separate line.

Defined values:

<cid>: integer, a numeric parameter which specifies a particular PDP context definition;
the parameter is local to the TE-MT interface and is used in other PDP
context-related commands. The range of permitted values (minimum value = 1) is
returned by the test form of the command.
<PDP_type>: string, a string parameter which specifies the type of packet data protocol
IP – Internet Protocol (IETF STD 5)
IPV6 – Internet Protocol, version 6 (IETF RFC 2460)
IPV4V6 – Virtual <PDP_type> introduced to handle dual IP stack UE capability.
(Refer to 3GPP TS 24.301.)
PPP – Point to Point Protocol (IETF STD 51)

<APN>: string, a string parameter which is a logical name that is used to select the GGSN
or the external packet data network.
If the value is null or omitted, then the subscription value will be requested.

<PDP_addr>: string, a string parameter that identifies the MT in the address space
applicable to the PDP.
If the parameter value is null or omitted, then a value may be provided by the TE
during the PDP startup procedure or, failing that, a dynamic address will be
requested.
The read form of the command will continue to return the null string even if an address has
been allocated during the PDP startup procedure. The allocated address(es) may be read

83/206
using the +CGPADDR command.
<d_comp>: integer, a numeric parameter that controls PDP data compression (applicable
for SNDCP only) (Refer to 3GPP TS 44.065.)

0 – off
1 – on (manufacturer-preferred compression)
2 – V.42bis
3 – V.44
Other values are reserved.
Note: M14A2A <d_comp>: Data compression is not supported. Parameters are
omitted.

<h_comp>: integer, a numeric parameter that controls PDP header compression (Refer to
3GPP TS 44.065 and 3GPP TS 25.323.)
0 – off
1 – on (manufacturer-preferred compression)
2 – RFC1144 (applicable for SNDCP only)
3 – RFC2507
4 – RFC3095 (applicable for PDCP only)
Other values are reserved.

<IPv4AddrAlloc>: integer, a numeric parameter that controls how the MT/TA requests to
get the IPv4 address information
0 – IPv4 Address Allocation through NAS Signaling
1 – IPv4 Address Allocated through DHCP

<Emergency Indication>: integer, a numeric parameter used to indicate whether the PDP
context is for emergency bearer services
0 – PDP context is not for emergency bearer services.
1 – PDP context is for emergency bearer services.

Example: Modify APN profile

AT+CGDCONT?
+CGDCONT:
1,"IPV4V6","broadband","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
OK
AT+CGDCONT=?
+CGDCONT: (1-24,100-179),"IP",,,(0-2),(0-4),(0-1),(0-1)

84/206
+CGDCONT: (1-24,100-179),"PPP",,,(0-2),(0-4),(0-1),(0-1)
+CGDCONT: (1-24,100-179),"IPV6",,,(0-2),(0-4),(0-1),(0-1)
+CGDCONT: (1-24,100-179),"IPV4V6",,,(0-2),(0-4),(0-1),(0-1)
OK
AT+CGDCONT=2,"IPV4V6","test"
OK
AT+CGDCONT?
+CGDCONT:
1,"IPV4V6","broadband","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
+CGDCONT:
2,"IPV4V6","test","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
OK
AT+CGDCONT=3,"PPP","TESTPPP"
OK

8.5. AT+CGEREP GPRS Event Reporting

AT+CGEREP parameter command syntax
Command Possible response(s)
+CGEREP=[<mode>[,<bfr>]] Normally respond:
OK

If something is wrong, then respond:

ERROR
+CGEREP? Normally respond:
+CGEREP:<mode>,<bfr>
OK

If something is wrong, then respond:

ERROR
+CGEREP=? Normally respond:
+CGEREP:(list of supported <mode>s),(list of supported
<bfr>s)
OK

85/206
 If something is wrong, then respond:
ERROR
Reference: 3GPP TS 27.007

Description:

The set command enables or disables sending of unsolicited result codes, +CGEV: XXX from
MT to TE in the case of certain events occurring in the Packet Domain MT or the network.
The <mode> controls the processing of unsolicited result codes specified within this
command. <bfr> controls the effect on buffered codes when <mode> 1 or <mode> 2 is
entered. If a setting is not supported by the MT, ERROR or +CME ERROR: is returned.

The read command returns the current mode and buffer settings.
The test command returns the modes and buffer settings supported by the MT as
compound values.

Defined values:

<mode>: integer, a numeric parameter

0 – buffer unsolicited result codes in the MT; if the MT result code buffer is full, the
oldest values can be discarded. No codes are forwarded to the TE.
1 – discard unsolicited result codes when the MT–TE link is reserved (e.g. in on-line
data mode); otherwise forward them directly to the TE.
2 – buffer unsolicited result codes in the MT when the MT-TE link is reserved (e.g.
in on-line data mode) and flush them to the TE when the MT-TE link becomes
available; otherwise forward them directly to the TE.

<bfr>: integer, a numeric parameter

0 – The MT buffer of unsolicited result codes defined within this command is
cleared when <mode> 1 or <mode> 2 is entered.
1 – MT buffer of unsolicited result codes defined within this command is flushed to
the TE when <mode> 1 or <mode> 2 is entered. (An OK response shall be issued
before flushing the codes.)

86/206
Example: Modify event report

AT+CGEREP?
+CGEREP: 0,0
OK
AT+CGEREP=?
+CGEREP: (0-2),(0-1)
OK
AT+CGEREP=1,1
OK
AT+CGEREP?
+CGEREP: 1,1
OK

8.6. AT+CGREG Packet Domain Network Registration

Status
AT+CGREG parameter command syntax
Command Possible response(s)
+CGREG=[<n>] Normally respond:
OK

If something is wrong, then respond:

ERROR
+CGREG? Normally respond:
+CGREG:<n>,<stat>[,<lac>,<ci>[,<AcT>,<rac>]]
OK

If something is wrong, then respond:

ERROR
+CGREG=? Normally respond:
+CGREG:(list of supported <n>)
OK

87/206
 If something is wrong, then respond:
ERROR
Reference: 3GPP TS 27.007

Description:

The set command controls the presentation of an unsolicited result code +CGREG: <stat>
when <n>=1 and there is a change in the MT's GPRS network registration status or code
+CGREG: <stat>[,<lac>,<ci>[,<AcT>,<rac>]] when <n>=2 and there is a change of the
network cell.

The read command returns the status of result code presentation and an integer <stat>
which shows whether the network has currently indicated the registration of the MT.
Location information elements <lac>, <ci>, <AcT>, and <rac> are returned only when <n>=2
and MT is registered in the network.

Defined values:

<n>: integer, a numeric parameter

0 – Disable network registration unsolicited result code
1 – Enable network registration unsolicited result code +CGREG: <stat>
2 – Enable network registration and location information unsolicited result code
+CGREG: <stat>[,<lac>,<ci>[,<AcT>,<rac>]]

<stat>: integer, a numeric parameter that indicates the GPRS registration status
0 – Not registered; MT is not currently searching an for operator to register to.
1 – Registered, home network
2 – Not registered, but MT is currently trying to attach or searching an operator to
register to.
3 – Registration denied
4 – Unknown
5 – Registered, roaming

<lac>: string, two byte location area code or tracking area code in hexadecimal format

88/206
 (E.g. "00C3" equals 195 in decimal.)

<ci>: string, four byte GERAN/UTRAN/E-UTRAN cell ID in hexadecimal format

<AcT>: integer, a numeric parameter that indicates the access technology of the serving
cell
0 – GSM
1 – GSM Compact
2 – UTRAN
3 – GSM w/EGPRS (Refer to Note 2.)
4 – UTRAN w/HSDPA (Refer to Note 3.)
5 – UTRAN w/HSUPA (Refer to Note 3.)
6 – UTRAN w/HSDPA and HSUPA (Refer to Note 3.)
7 – E-UTRAN
Note 2: 3GPP TS 44.060 specifies the System Information messages which provide
information about whether the serving cell supports EGPRS.
Note 3: 3GPP TS 25.331 specifies the System Information blocks which provides
information about whether the serving cell supports HSDPA or HSUPA.

<rac>: string, one byte routing area code in hexadecimal format

Example: Check current packet domain network registration status

AT+CGREG?
+CGREG: 0,5
OK
AT+CGREG=?
+CGREG: (0-2)
OK
AT+CGREG=1
OK
AT+CGREG?
+CGREG: 1,5
OK

8.7. AT+CEREG Packet Domain Network Registration Status

AT+CEREG parameter command syntax

89/206
 Command Possible response(s)
+CEREG=[<n>] Normally respond:
OK

If something is wrong, then respond:

ERROR
+CEREG? Normally respond:
+CEREG:<n>,<stat>[,[<tac>],[<ci>],[<AcT>[,
<cause_type>,<reject_cause>]]]
OK

If something is wrong, then respond:

ERROR
+CEREG=? Normally respond:
+CEREG:(list of supported <n>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The set command controls the presentation of an unsolicited result code +CEREG: <stat>
when <n>=1 and there is a change in the MT’s EPS network registration status in E-UTRAN
or unsolicited result code.

+CEREG: <stat>[,[<tac>],[<ci>],[<AcT>]] when <n>=2 and there is a change of the network

cell in EUTRAN. The parameters <AcT>, <tac> and <ci> are sent only if available. The value
<n>=3 further extends the unsolicited result code with [,<cause_type>,<reject_cause>]
when available and when the value of <stat> is changed. Refer to Table A-1 Error codes
supported for CMEE commands for possible <err> values.

90/206
NOTE 1: If the EPS MT in GERAN/UTRAN/E-UTRAN also supports circuit mode services
and/or GPRS services, the +CREG command and +CREG: result codes and/or the +CGREG
command and +CGREG: result codes apply to the registration status and location
information for those services.

The read command returns the status of result code presentation and an integer <stat>
which shows whether the network has currently indicated the registration of the MT.
Location information elements <tac>, <ci> and <AcT>, if available, are returned only when
<n>=2 and MT is registered in the network. The parameters [,<cause_type>,<reject_cause>],
if available, are returned when <n>=3.

Test command returns values supported as a compound value.

Defined values:

<n>: integer
0 – Disable network registration unsolicited result code
1 – Enable network registration unsolicited result code +CEREG: <stat>
2 – Enable network registration and location information unsolicited result code
+CEREG: <stat>[,[<tac>],[<ci>],[<AcT>]]
3 – Enable network registration, location information, and EMM cause value
information unsolicited result code +CEREG:
<stat>[,[<tac>],[<ci>],[<AcT>][,<cause_type>,<reject_cause>]]

<stat>: integer, indicates the EPS registration status

0 – Not registered, MT is not currently searching an operator to register to
1 – Registered, home network
2 – Not registered, but MT is currently trying to attach or searching an operator to
register to
3 – Registration denied
4 – Unknown (e.g. out of E-UTRAN coverage)
5 – Registered, roaming
6 – Registered for "SMS only", home network (not applicable)
7 – Registered for "SMS only", roaming (not applicable)
8 – Attached for emergency bearer services only (Refer to NOTE 2)
9 – Registered for "CSFB not preferred", home network (not applicable)
10 – Registered for "CSFB not preferred", roaming (not applicable)
NOTE 2: 3GPP TS 24.008 and 3GPP TS 24.301 specify the condition when the MS is
considered as attached for emergency bearer services.

91/206
<tac>: string, two byte tracking area code in hexadecimal format (e.g. "00C3" equals 195
in decimal)

<ci>: string, four byte E-UTRAN cell ID in hexadecimal format

<AcT>: integer, indicates the access technology of the serving cell

0 – GSM (not applicable)
1 – GSM Compact (not applicable)
2 – UTRAN (not applicable)
3 – GSM w/EGPRS (Refer to NOTE 3) (not applicable)
4 – UTRAN w/HSDPA (Refer to NOTE 4) (not applicable)
5 – UTRAN w/HSUPA (Refer to NOTE 4) (not applicable)
6 – UTRAN w/HSDPA and HSUPA (Refer to NOTE 4) (not applicable)
7 – E-UTRAN
NOTE 3: 3GPP TS 44.060 specifies the System Information messages which give the
information about whether the serving cell supports EGPRS.
NOTE 4: 3GPP TS 25.331 specifies the System Information blocks which give the
information about whether the serving cell supports HSDPA or HSUPA.

<cause_type>: integer, indicates the type of <reject_cause>.

0 – Indicates that <reject_cause> contains an EMM cause value, Refer to 3GPP TS
24.301 Annex A.
1 – Indicates that <reject_cause> contains a manufacturer-specific cause.

<reject_cause>: integer, contains the cause of the failed registration. The value is of a type
defined by <cause_type>.
Example: Check LTE network registration status

AT+CEREG?
+CEREG: 0,1
OK
AT+CEREG=?
+CEREG: (0-2)
OK
AT+CEREG=1
OK
AT+CEREG?
+CEREG: 1,1

92/206
OK
AT+CGATT=0
OK
+CEREG: 2

8.8. AT+CGCONTRDP PDP Context Read Dynamic

Parameters
AT+CGCONTRDP parameter command syntax
Command Possible response(s)
+CGCONTRDP[=<cid>] Normally respond:
[+CGCONTRDP: <cid>,<bearer_id>,<apn>[,<l
ocal_addr and subnet_mask>[,<gw_addr>[,<DNS_prim_addr>
[,<DNS_sec_addr>[,<PCSCF_prim_addr>[,<PCSCF_sec_addr>[,<I
M_CN_Signalling_Flag>[,<LIPA_indication>]]]]]]]]]
[<CR><LF>+CGCONTRDP: <cid>,<bearer_id>,<apn>[,<local_addr
and
subnet_mask>[,<gw_addr>[,<DNS_prim_addr>[,<DNS_sec_a
ddr>[,<P-CSCF_prim_addr>[,<PCSCF_sec_addr>[,<IM_CN_Signall
ing_Flag>[,<LIPA_indication>]]]]]]]]
[...]]
OK

If something is wrong, then respond:

ERROR
or
+CME ERROR: <err>
+CGCONTRDP=? Normally respond:
+CGCONTRDP: (list of <cid>s associated with active
contexts)
OK

If something is wrong, then respond:

ERROR

93/206
 or
+CME ERROR: <err>
Reference: 3GPP TS 27.007

Description:

The execution command returns the relevant information <bearer_id>, <apn>, <local_addr
and subnet_mask>, <gw_addr>, <DNS_prim_addr>, <DNS_sec_addr>, <P-CSCF_prim_addr>,
<PCSCF_sec_addr>, <IM_CN_Signalling_Flag> and <LIPA_indication> for an active
non-secondary PDP context with the context identifier <cid>.

If the MT has dual-stack capabilities, two lines of information are returned per <cid>. The
first line contains the IPv4 parameters followed by one line with the IPv6 parameters.

If the parameter <cid> is omitted, the relevant information for all active non-secondary PDP
contexts is returned.

The test command returns a list of <cid>s associated with active non-secondary contexts.

Defined values:

<cid>: integer, specifies a particular non-secondary PDP context definition. The parameter
is local to the TE/MT interface and is used in other PDP context-related commands.
(Refer to the +CGDCONT and +CGDSCONT commands.)

<bearer_id>: integer, identifies the bearer, i.e. the EPS bearer in EPS and the NSAPI in
UMTS/GPRS.

<apn>: string, a logical name that was used to select the GGSN or the external packet data
network.

<local_addr and subnet_mask>: string, shows the IP address and subnet mask of the MT.
The string is given as dot-separated numeric (0–255) parameters on the form:
"a1.a2.a3.a4.m1.m2.m3.m4" for IPv4
or"a1.a2.a3.a4.a5.a6.a7.a8.a9.a10.a11.a12.a13.a14.a15.a16.m1.m2.m3.m4.m5.m6.
m7.m8.m9.m10.m11.m12.m13.m14.m15.m16" for IPv6. When +CGPIAF is

94/206
 supported. Its settings can influence the format of this parameter returned with the
execute form of +CGCONTRDP.

<gw_addr>: string, shows the Gateway Address of the MT. The string is given as
dot-separated numeric (0–255) parameters.
When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<DNS_prim_addr>: string, shows the IP address of the primary DNS server.

When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<DNS_sec_addr>: string, shows the IP address of the secondary DNS server.

When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<P_CSCF_prim_addr>: string, shows the IP address of the primary P-CSCF server.

When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<P_CSCF_sec_addr>: string, shows the IP address of the secondary P-CSCF server.

When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<IM_CN_Signalling_Flag>: integer, shows whether the PDP context is for IM CN

subsystem-related signalling only or not.
0 – PDP context is not for IM CN subsystem-related signalling only
1 – PDP context is for IM CN subsystem-related signalling only

<LIPA_indication>: integer, indicates that the PDP context provides connectivity using a
LIPA PDN connection. This parameter cannot be set by the TE.
0 – indication not received that the PDP context provides connectivity using a LIPA
PDN connection
1 – indication received that the PDP context provides connectivity using a LIPA
PDN connection

Example: Check current active PDP context status

AT+CGCONTRDP=?
+CGCONTRDP: ( 1 )

95/206
OK
AT+CGCONTRDP=1
+CGCONTRDP: 1,5,broadband,192.168.1.1,,192.168.1.2,192.168.1.3
OK

8.9. AT+CGEQOS Define EPS Quality of Service

AT+CGEQOS parameter command syntax
Command Possible response(s)
+CGEQOS=[<cid>[,<QCI>[,<DL_GBR>,<UL_GBR Normally respond:
>[,<DL_MBR>,<UL_MBR]]]] OK

If something is wrong, then respond:

ERROR
+CGEQOS? Normally respond:
[+CGEQOS:
<cid>,<QCI>,[<DL_GBR>,<UL_GBR
>],[<DL_MBR>,<UL_MBR>]]
[<CR>>LF>+CGEQOS:
<cid>,<QCI>,[<DL_GBR>
,<UL_GBR>],[<DL_MBR>,<UL_MBR>]
[...]]
OK

If something is wrong, then respond:

ERROR

96/206
 +CGEQOS=? Normally respond:
+CGEQOS: (range of supported
<cid>s),(list of
supported <QCI>s),(list of supported
<DL_GBR>s),(list of supported
<UL_GBR>s),(list of
supported <DL_MBR>s),(list of
supported
<UL_MBR>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

The set command allows the TE to specify the EPS Quality of Service parameters <cid>,
<QCI>, [<DL_GBR> and <UL_GBR>], and [<DL_MBR> and <UL_MBR>] for a PDP context or
Traffic Flows. (Refer to 3GPP TS 24.301 and 3GPP TS 23.203.) When in UMTS/GPRS the MT
applies a mapping function to UTMS/GPRS Quality of Service. Refer to Table A-1 Error codes
supported for CMEE commands for possible <err> values.

A special form of the set command, +CGEQOS= <cid> causes the values for context number
<cid> to become undefined.

The read command returns the current settings for each defined QoS.
The test command returns the ranges of the supported parameters.

Defined values:

<cid>: integer, specifies a particular EPS Traffic Flows definition in EPS and a PDP Context
definition in UMTS/GPRS. (Refer to the +CGDCONT and +CGDSCONT commands.)

97/206
<QCI>: integer, specifies a class of EPS QoS. (Refer to 3GPP TS 24.301.)
0 QCI is selected by the network.
[1 – 4] value range for guaranteed bit rate Traffic Flows
[5 – 9] value range for non-guaranteed bit rate Traffic Flows
[128 – 254] value range for Operator-specific QCIs

<DL_GBR>: integer, indicates DL GBR in case of GBR QCI; the value is in kbit/s. This
parameter is omitted for a non-GBR QCI. (Refer to 3GPP TS 24.301).

<UL_GBR>: integer, indicates UL GBR in case of GBR QCI. The value is in kbit/s. This
parameter is omitted for a non-GBR QCI. (Refer to 3GPP TS 24.301.)

<DL_MBR>: integer, indicates DL MBR in case of GBR QCI. The value is in kbit/s. This
parameter is omitted for a non-GBR QCI. (Refer to 3GPP TS 24.301.)

<UL_MBR>: integer, indicates UL MBR in case of GBR QCI. The value is in kbit/s. This
parameter is omitted for a non-GBR QCI. (Refer to 3GPP TS 24.301.)

<cid>: integer, specifies a particular non-secondary PDP context definition. The parameter
is local to the TE/MT interface and is used in other PDP context-related commands.
(Refer to the +CGDCONT and +CGDSCONT commands.)

<bearer_id>: integer, identifies the bearer, i.e. the EPS bearer in EPS and the NSAPI in
UMTS/GPRS.

<apn>: string, a logical name that was used to select the GGSN or the external packet data
network.

<local_addr and subnet_mask>: string, shows the IP address and subnet mask of the MT.
The string is given as dot-separated numeric (0–255) parameters on the form:
"a1.a2.a3.a4.m1.m2.m3.m4" for IPv4 or
"a1.a2.a3.a4.a5.a6.a7.a8.a9.a10.a11.a12.a13.a14.a15.a16.m1.m2.m3.m4.m5.m6.m
7.m8.m9.m10.m11.m12.m13.m14.m15.m16" for IPv6. When +CGPIAF is supported,
its settings can influence the format of this parameter returned with the execute
form of +CGCONTRDP.

<gw_addr>: string, shows the Gateway Address of the MT. The string is given as
dot-separated numeric (0–255) parameters.
When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

98/206
<DNS_prim_addr>: string, shows the IP address of the primary DNS server.
When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<DNS_sec_addr>: string, shows the IP address of the secondary DNS server.

When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<P_CSCF_prim_addr>: string, shows the IP address of the primary P-CSCF server.

When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<P_CSCF_sec_addr>: string, shows the IP address of the secondary P-CSCF server.

When +CGPIAF is supported, its settings can influence the format of this parameter
returned with the execute form of +CGCONTRDP.

<IM_CN_Signalling_Flag>: integer, shows whether the PDP context is for IM CN

subsystem-related signalling only or not.
0 – PDP context is not for IM CN subsystem-related signalling only.
1 – PDP context is for IM CN subsystem-related signalling only.

<LIPA_indication>: integer, indicates that the PDP context provides connectivity using a
LIPA PDN connection. This parameter cannot be set by the TE.
0 – indication not received that the PDP context provides connectivity using a LIPA
PDN connection
1 – indication received that the PDP context provides connectivity using a LIPA PDN
connection

Example: Query current EPS QOS parameter

at+cgeqos?
+CGEQOS:
OK
at+cgeqos=?
+CGEQOS:
(1-24,100-179),(0-9),(0-150000),(0-50000),(0-150000),(0-50000)
OK
at+cgeqos=1,0
OK

99/206
at+cgeqos?
+CGEQOS: 1,0,0,0,0,0
OK
at+cgeqos=2,1
OK
at+cgeqos?
+CGEQOS: 1,0,0,0,0,0
+CGEQOS: 2,1,0,0,0,0
OK

8.10. AT+CGPADDR Show PDP Address

AT+CGPADDR parameter command syntax
Command Possible response(s)
+CGPADDR=[<cid>[, Normally respond:
<cid>[,...]]] +CGPADDR:<cid>[,<PDP_addr_1>[,<PDP_addr_2>]]
[<CR><LF>+CGPADDR: <cid>,[<PDP_addr_1>[,<PDP_addr_2>]]
[...]]
OK

If something is wrong, then respond:

ERROR
+CGPADDR=? Normally respond:
+CGPADDR:(list of defined <cid>s)
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

100/206
Description:

The execution command returns a list of PDP addresses for the specified context identifiers.
The test command returns a list of defined <cid>.

Defined values:

<cid>: integer, a numeric parameter which specifies a particular PDP context definition
(Refer to the +CGDCONT and +CGDSCONT commands.); if no <cid> is specified, the
addresses for all defined contexts are returned.

<PDP_addr_1> and <PDP_addr_2>: each is a string that identifies the MT in the address
space applicable to the PDP. The address may be static or dynamic. For a static
address, it will be the address set by the +CGDCONT and +CGDSCONT commands
when the context was defined. For a dynamic address, it will be the address
assigned during the last PDP context activation that used the context definition
referred to by <cid>. Both <PDP_addr_1> and <PDP_addr_2> are omitted if none are
available. Both <PDP_addr_1> and <PDP_addr_2> are included when both IPv4 and
IPv6 addresses are assigned, with <PDP_addr_1> containing the IPv4 address and
<PDP_addr_2> containing the IPv6 address.
The string is provided as a dot-separated numeric (0–255) parameter of the form:
a1.a2.a3.a4 for IPv4 and
a1.a2.a3.a4.a5.a6.a7.a8.a9.a10.a11.a12.a13.a14.a15.a16 for IPv6.

Example: Query current IP addresses

AT+CGPADDR=?
+CGPADDR: (1,2)
OK
at+cgdcont?
+CGDCONT:
1,"IPV4V6","broadband","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
+CGDCONT:
2,"IPV4V6","test","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
OK
at+cgpaddr=2
+CGPADDR: 2,192.168.1.11
OK

101/206
8.11. ATD*99# Request Packet Domain service
ATD*99# parameter command syntax
Command Possible response(s)
ATD*99# Normally respond:
CONNECT

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

This command causes the MT to perform whatever actions are necessary to establish a
communication between the TE and the external PDN.

Defined values:

Example: Request packet network service

ATD*99#
CONNECT 150000000

8.12. AT$QCPDPP Set Type of Authentication for PDP-IP

Connections
AT$QCPDPP parameter command syntax
Command Possible response(s)

102/206
 $QCPDPP= <cid>, Normally respond:
<auth_type>, OK
<password>, <username>
If something is wrong, then respond:
ERROR
$QCPDPP? Normally respond:
$QCPDPP: <cid>,<auth_type>,< username >
OK

If something is wrong, then respond:

ERROR
Reference: Qualcomm 80-VR432-1

Description:

Sets the default secondary IP address used for Domain Name Services (DNS); used only if no
DNS server address is received over the air during PDP context activation. The value is
stored in NVRAM.

Defined values:

<username>: string, string of the PDP user name

<password>: string, string of the PDP password name
<cid>: integer, a value between 1 and 24
<auth_type>: integer
0 – None
1 – PAP
2 – CHAP
Example: Query current authentication type

AT$QCPDPP?
$QCPDPP: 1,0
$QCPDPP: 2,0

103/206
OK
AT$QCPDPP=2,1,"testpass","testuser"
OK
AT$QCPDPP?
$QCPDPP: 1,0
$QCPDPP: 2,1,"testuser"
OK

8.13. AT%PDNSET Define PDP Context And Authentication

AT%PDNSET parameter command syntax
Command Possible response(s)
%PDNSET: Normally respond:
<ext_session_id>[,<apnname>[,<ip_type>[, OK
<ppp_auth>[,<user>,<passw>[,<auth_host
>]]],[<pcscf_discovery>]]] If something is wrong, then respond:
ERROR
%PDNSET? Normally respond:
%PDNSET:
<ext_session_id>[,<apnname>[,<ip_type>[
,<ppp_auth>[,<user>,<passw>[,<auth_hos
t>]]],[<pcscf_discovery>]]]
OK

If something is wrong, then respond:

ERROR
%PDNSET=? Normally respond:
%PDNSET:
<ext_session_id>[,<apnname>[,<ip_type>[
,<ppp_auth>[,<user>,<passw>[,<auth_hos
t>]]],[<pcscf_discovery>]]]
OK

If something is wrong, then respond:

ERROR

104/206
 Reference: Altair_SW_201_AT_Commands
Guide_Rev3.pdf

Description:

The command is intended to set the run-time PDN parameters for data PDNs exposed to
the host.

In addition, the APN name and IP type provided in the command will override the default
PDN settings from the embedded APN table stored into the UE NV. The PPP security
parameters are run-time only and are not stored into non-volatile memory.

The command will be effective immediately, which means that if parameters are different
from those already in use, the PDN will be deactivated, updated locally and on the server
(via LTE messages), and then reactivated.

If the <ip_type> parameter is missing, the IPv4v6 will be applied.

Missed PPP security parameters will completely remove the previous PPP security setting.

The command is intended to substitute the previous %PPPAUTH command which is not
synced with other PDN parameter definitions.

Defined values:

<ext_session_id>: integer, numeric value of the session identifier defined in the NP

config file.
<apnname>: string, indicates the APN name configured for the PDN.
<ip_type>: string
 “IP”
 “IPv6”
 “IPv4v6”
<ppp_auth>: string , PPP authentication type
 “NONE”
 “PAP”

105/206
  “CHAP”
<user>: string, username used for authentication
<passw>: string, password used for authentication
<auth_host>: string, host name used for authentication (optional)
<pcscf_discovery>: integer, numeric value for PCSCF discovery

Example: Query and set APN profile

AT%PDNSET?
%PDNSET: 1,internet11111,IP,,,,,0
OK
AT%PDNSET=?
%PDNSET:
<ext_session_id>[,<apnname>[,<ip_type>[,<ppp_auth>[,<user>,<passw>[,<auth_host>]]],[
<pcscf_discovery>]]]
OK
AT%PDNSET=1,"internet","IPV4V6","CHAP","test","test","test_host",0
OK
AT%PDNSET?
%PDNSET: 1,internet,IPV4V6,CHAP,test,test,test_host,0
OK

8.14. AT$QCRMCALL Triggers an RmNet Call

AT$QCRMCALL parameter command syntax
Command Possible response(s)
$QCRMCALL =<Action>, <Instance> Normally respond:
[,<IP Type>[,<Tech Pref >[,<umts $QCRMCALL: <Instance>,<IP Type>
profile number>[,<cdma profile OK
number>[,<APN>]]]]]
If something is wrong, then respond:
ERROR
$QCRMCALL? Normally respond:
$QCRMCALL: <Instance>,<IP Type>
OK

106/206
 If something is wrong, then respond:
ERROR
$QCRMCALL=? Normally respond:
$QCRMCALL: (list of defined <Action>s),(list of
defined <Instance>s),(list of defined <IP
Type>s),(list of defined <Tech Pref>s),(list of
defined <umts profile number>s),(list of defined
<cdma profile number>s),
OK

If something is wrong, then respond:

ERROR
Reference: Qualcomm 80-VR432-1

Description:

Command triggers an RmNet call based on the <Action> parameter which is typically a start
of an RmNet Call or stop of a RmNet call.

Defined values:

< Action >: integer

0 – Stop
1 – Start
<Instance>: integer, 1 to RMNET_ NUM_LAPTOP_INSTANCES
<IP Type>: integer, protocol type
1 – Ipv4
2 – Ipv6
3 – Ipv4v6
<Tech Pref>: integer, preferenece technology
1 – 3GPP2
2 – 3GPP

107/206
<umts_profile>: integer, profile identifier from 1 to 24
<APN>: string, maximum length is 100 characters
Example: Start RMNET call

AT$QCRMCALL?
OK
AT$QCRMCALL=1,1
$QCRMCALL: 1, V4
OK

8.15. AT+CNMPSD No More PS data

AT+CNMPSD parameter command syntax
Command Possible response(s)
+CNMPSD Normally respond:
OK

If something is wrong, then respond:

ERROR
+CNMPSD=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

This command indicates that no application on the MT is expected to exchange data. Upon
receiving this command, the final result code “OK” is returned.

108/206
When in UTRAN, if further conditions defined in 3GPP TS 25.331 are met, this can cause
transmission of a SIGNALLING CONNECTION RELEASE INDICATION message with the cause
"UE Requested PS Data session end".

This command may be used in both normal and modem compatibility modes.

Defined values:

Example: No more ps data

AT+CNMPSD
OK
AT+CNMPSD=?
OK

8.16. AT$QCDNSP Sets Primary DNS IP Address

AT$QCDNSP parameter command syntax
Command Possible response(s)
$QCDNSP=<address> Normally respond:
OK

If something is wrong, then respond:

ERROR
$QCDNSP? Normally respond:
$QCDNSP:<address >
OK

If something is wrong, then respond:

ERROR
Reference: Qualcomm 80-VR432-1

109/206
Description:

Sets the default primary IP address used for Domain Name Services (DNS); used only if no
DNS server address is received over the air during PDP context activation. The value is
stored in NVRAM.

Defined values:

< address >: string, a string parameter which specifies an IP address.

Example: Set primary DNS

AT$QCDNSP?
$QCDNSP: 0.0.0.0
OK
AT$QCDNSP=8.8.8.8
OK
AT$QCDNSP?
$QCDNSP: 8.8.8.8
OK

8.17. AT$QCDNSS Sets Secondary DNS IP Address

AT$QCDNSS parameter command syntax
Command Possible response(s)
$QCDNSS=<address> Normally respond:
OK

If something is wrong, then respond:

ERROR
$QCDNSS? Normally respond:
$QCDNSS:<address>
OK

If something is wrong, then respond:

ERROR
Reference: Qualcomm 80-VR432-1

110/206
Description:

Sets the default secondary IP address used for Domain Name Services (DNS); used only if no
DNS server address is received over the air during PDP context activation. The value is
stored in NVRAM.

Defined values:

< address >: string, a string parameter which specifies a IP address

Example: Set secondary DNS

AT$QCDNSS?
$QCDNSS: 0.0.0.0
OK
AT$QCDNSS=8.8.8.8
OK
AT$QCDNSS?
$QCDNSS: 8.8.8.8
OK

8.18. AT$QCDEFPROF Sets a Given Profile Number as a

Default
AT$QCPDPCFGE parameter command syntax
Command Possible response(s)
$QCDEFPROF=<family>,<subs_id>,<pr Normally respond:
ofile_id> OK

If something is wrong, then respond:

ERROR

111/206
 $ QCDEFPROF? Normally respond:
$QCDEFPROF:<family>,< subs_id >,<profile_id>
OK

If something is wrong, then respond:

ERROR$QCDEFPROF:<family>,< subs_id
>,<profile_id>
Reference: Qualcomm 80-VR432-1

Description:

Sets the given profile number as the default profile for the family of the specified
technology and subscription

Defined values:

<family>: imteger, range is from 1 to 16

<subs_id>: integer, range is from 1 to 3. For non-DSDS targets, the <subs_id> is limited to
1.
<profile_id>: integer, range is form 1 to 16
Example: Set default profile number

AT$QCDEFPROF=1,1,1
OK
AT$QCDEFPROF?
$QCDEFPROF: 0,1,1
$QCDEFPROF: 1,1,1
OK

8.19. AT$ECMCALL Triggers an ECM Call

AT$ECMCALL parameter command syntax

112/206
 Command Possible response(s)
$ECMCALL=<action> Normally respond:
OK

If something is wrong, then respond:

ERROR
$ECMCALL? Normally respond:
$ECMCALL:<status>
OK

If something is wrong, then respond:

ERROR$ECMCALL:<status>
$ECMCALL=? Normally respond:
$ECMCALL: (list of defined <action>s)
OK

If something is wrong, then respond:

ERROR
Reference

Description:

The command triggers an ECM call based on the <Action> parameter which is typically a
start of an ECM Call or a stop of an ECM call.

Defined values:

<action>: integer
0 – Stop an ECM call.
1 – Start an ECM call.
<status>: integer
0 – No ECM call was started.

113/206
 1 – An ECM call was started.
Example: Trigger an ECM call

AT$ECMCALL?
$ECMCALL: 0
OK
AT$ECMCALL=?
$ECMCALL: (0-1)
OK
AT$ECMCALL=1
$ECMCALL: 1
OK
AT$ECMCALL?
$ECMCALL: 1
OK

8.20. AT%PDNACT PDP Context Activate Or Deactivate

AT%PDNACT parameter command syntax
Command Possible response(s)
%PDNACT=<act>,[<sessionID>][,<apnname Normally respond:
>] OK

If something is wrong, then respond:

ERROR
%PDNACT? Normally respond:
%PDNACT:<sessionID>,<stat>,<APN>,<cid>
][<CR><LF>%PDNACT:<sessionID>,<stat>,<
APN>,<cid>][...]]
OK

If something is wrong, then respond:

ERROR

114/206
 %PDNACT=? Normally respond:
%PDNACT: (list of defined
<act>s),<ext_session_id> [,<APN>]
OK

If something is wrong, then respond:

ERROR
Reference: Altair_SW_201_AT_Commands
Guide_Rev3.pdf

Description:

This command is used by external Host to instruct eCM to expose and connect (disconnect)
specific PDN to the Host. There may be more than one PDN exposed to Host.

There may be more than one PDN exposed to Host.

Session ID is Altair proprietary session identifier, which is defined for each session
established over-the-air in NP config file named ‘/etc/config/ecm’.

User can use <apnname> or <sessionID> or both to identify PDN. If both are defined, PDN is
identified by <apnname>.

The PDNs terminated in modem cannot be exposed to Host and any attempt to activate
them from host will return ERROR. PDN sharing between Host and modem is not supported
yet.

Defined values:

<act>: integer, numeric value, indicates the required action.

0 – Deactivate
1 – Activate
<sessionID>: integer, numeric value of session identifier defined in NP config file.
<apnname>: string, indicates the APN name configured for the PDN.

115/206
<stat>: integer, numeric value, indicates the actual PDN state.
0 – Deactivate
1 – Activate
<cid>: integer, a numeric parameter which specifies a particular PDP context definition.
Example: Activate/Deactivate PDP context

AT%PDNACT?
%PDNACT: 1,1,internet,1
OK
AT%PDNACT=?
%PDNACT: (0-1), <ext_session_id> [,<APN>]
OK
AT%PDNACT=0,1
OK
AT%PDNACT?
%PDNACT: 1,0,internet,1
OK
AT%PDNACT=1,1
OK
AT%PDNACT?
%PDNACT: 1,1,internet,1
OK

8.21. AT%CMATT LTE network Attach Or Detach

AT%CMATT parameter command syntax
Command Possible response(s)
%CMATT=<act> Normally respond:
OK

If something is wrong, then respond:

ERROR

116/206
 %CMATT? Normally respond:
%CMATT: <state>
OK

If something is wrong, then respond:

ERROR
%CMATT=? Normally respond:
%CMATT: (list of defined <act>s)
OK

If something is wrong, then respond:

ERROR
Reference: Altair_SW_201_AT_Commands
Guide_Rev3.pdf

Description:

AT command sent from external Host, which instructs LTE module (eCM application) to
attach or detach the LTE network.

Defined values:

<act>: integer, numeric value, instruct the device to attach or detach the LTE network.
0 – Detach
1 – Attach
Example: Detach/Attach LTE network

at%CMATT=0
OK
AT%CMATT?
%CMATT: 0
OK
at%CMATT=1

117/206
OK
AT%CMATT?
%CMATT: 1
OK

118/206
9. USIM related Commands

9.1. AT+CRSM Restricted SIM Access

AT+CRSM parameter command syntax
Command Possible response(s)
+CRSM=<command>[,<fileid>[,<P1>, Normally respond:
<P2>,<P3>[,<data>[,<pathid>]]]] +CRSM:<sw1>,<sw2>[,<response>]
OK

If something is wrong, then respond:

ERRORor
+CME ERROR: <err>
+CRSM=? Normally respond:
OK

If something is wrong, then respond:

ERROR
Reference: 3GPP TS 27.007

Description:

By using this command instead of Generic SIM Access +CSIM TE application has easier but
more limited access to the SIM database. Set command transmits to the MT the SIM
<command> and its required parameters. If a SIM installed in the currently selected card
slot, the MT handles internally all SIM-MT interface locking and file selection routines.

As response to the command, MT sends the actual SIM information parameters and
response data. MT error result code +CME ERROR may be returned when the command
cannot be passed to the SIM, but failure in the execution of the command in the SIM is

119/206
reported in <sw1> and <sw2> parameters. Refer to Table A-1 Error codes supported for
CMEE commands for possible <err> values.

Coordination of command requests to SIM and the ones issued by GSM/UMTS application
inside the MT is implementation dependent. However the TE should be aware of the
precedence of the GSM/UMTS application commands to the TE commands.

Defined values:

<command>: integer, command passed on by the MT to the SIM(refer to 3GPP TS 51.011).

176 – READ BINARY
178 – READ RECORD
192 – GET RESPONSE
214 – UPDATE BINARY
220 – UPDATE RECORD
242 – STATUS
203 – RETRIEVE DATA
219 – SET DATA
All other values are reserved.
<fileid>: integer
<P1>, <P2>, <P3>: integer

<data>: string, information which shall be written to the SIM

<pathid>: string
Example: Read binary EFIMSI(28423)

AT+CRSM=176,28423,0,0,9
+CRSM: 144,0,"080910101032547698"
OK

9.2. AT+ICCID SIM Card Identification Number

AT+ICCID parameter command syntax
Command Possible response(s)
AT+ICCID Normally respond:
<iccid>
OK

120/206
 If something is wrong, then respond:
ERROR
Reference:

Description:

AT+CCID serves to query the SIM card identification number.

Defined values:

<iccid>: string, a string of 19 or 20 decimal digits, which reflects SIM ICCID value; the
format of the ICCID is: MMCC IINN NNNN NNNN NN C x
MM = Constant (ISO 7812 Major Industry Identifier)
CC = Country Code
II = Issuer Identifier
N{12} = Account ID ("SIM number")
C = Checksum calculated from the other 19 digits using the Luhn algorithm
x = An extra 20th digit which may be returned by SIM, but it is not officially part of
the ICCID.

Example: Read SIM card ICCID

AT+ICCID
ICCID: 89860012345678901234
OK

9.3. AT%CCID Reads the ICCID from SIM EFICCID

AT%CCID Parameter parameter command syntax
Command Possible response(s)
%CCID Normally respond:

121/206
 <iccid>
OK

If something is wrong, then respond:

ERROR
Reference: Altair_SW_201_AT_Commands Guide_Rev3.pdf

Description:

The execution command reads the ICCID (card identification number) from SIM EFICCID. It is
a unique identification number for the SIM. If a SIM card is not inserted, the ERROR is
returned by execution command.

Defined values:

<iccid>: string, a string of 19 or 20 decimal digits, which reflects SIM ICCID value; the
format of the ICCID is: MMCC IINN NNNN NNNN NN C x
MM = Constant (ISO 7812 Major Industry Identifier)
CC = Country Code
II = Issuer Identifier
N{12} = Account ID ("SIM number")
C = Checksum calculated from the other 19 digits using the Luhn algorithm
x = An extra 20th digit which may be returned by SIM, but it is not officially part of
the ICCID.

Example: Read SIM card ICCID

AT%CCID
8952530076180102132
OK

122/206
10. Internet Service Commands

10.1. AT@INTERNET Start Internet Service

AT@INTERNET parameter command syntax
Command Possible response(s)
@INTERNET=<action> Normally respond:
OK

If something is wrong, then respond:

ERROR
@INTERNET? @INTERNET:<status>
OK
@INTERNET=? @INTERNET:(0-1)
OK

Description:

This command is for switching to support Internet service or not based on the <action>
parameter. When switching to support Internet service, it also implicitly changes the
interface to type III, otherwise changes to type II(Please refer to SW Developer Guide for
details). It is noted that this command should be the first command before any command
goes. <action> parameter 0 is implicitly the default that means it is not necessary to switch
explicitly by this command with <action> parameter 0. Executing Any other command firstly
implicitly switch the interface to type II. Once starting Internet service, it is impossible to
stop Internet service unless the system reboots. All of the following commands for Internet
service only work after Internet service is started by this command.

Defined values:

<action>: integer

123/206
 1 – Start Internet service and implicitly change the interface to be type III.
0 – Don’t start Internet service and implicitly change the interface to be type II.
<status>: integer
1 – Internet service was started.
0 – Internet service was not started.

Example:

AT@INTERNET=1
OK
AT@SOCKDIAL=1
OK
/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1
……………

10.2. AT@DNSSEVR DNS Server Setting

AT@DNSSEVR parameter and command syntax
Command Possible response(s)
AT@DNSSEVR=<pri_sevr>, Normally respond:
[<sec_sevr>] OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@DNSSEVR? [@DNSSEVR:<pri_sevr>[,<sec_sevr>]]
OK
AT@DNSSEVR=? @DNSSEVR:(<pri_sevr>),(<sec_sevr>)
OK

124/206
Description:

This command serves to query or set the manual DNS servers.

Defined values:

<pri_sevr>: string, the primary DNS server IP address

<sec_sevr>: string, the secondary DNS server IP address
<err_code>: integer: error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

Example:

AT@INTERNET=1
OK
AT@SOCKDIAL=1
OK

/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1

AT@DNSSEVR=“8.8.8.8”
OK

AT@DNSSEVR?
@DNSSEVR:“8.8.8.8”
OK

10.3. AT@DNSRESVDON Resolve Domain Name

AT@DNSRESVDON parameter and command syntax
Command Possible response(s)
AT@DNSRESVDON=<domain_name> Normally respond:
[@DNSRESVDON:<ip_address>]
[@DNSRESVDON:<ip_address>]
…………………………

125/206
 OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@DNSRESVDON? ERROR
AT@DNSRESVDON=? @DNSRESVDON:(<ip_address>)
OK

Description:

This command serves to resolve IP from domain name by querying a DNS server.

Defined values:

<domain_name>: string, the domain name to be resolved

<ip_address>: string, the IP address reported from the DNS server
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

Example:

AT@INTERNET=1
OK

AT@SOCKDIAL=1
OK

/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1

AT@DNSSEVR=“8.8.8.8”
OK

126/206
 AT@DNSRESVDON=“www.wnc.com.tw”
@DNSRESVDON:“10.37.238.17”
OK

10.4. AT@SOCKDIAL Socket Dial-Up-Network

AT@SOCKDIAL parameter and command syntax
Command Possible response(s)
AT@SOCKDIAL=<action > Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@SOCKDIAL?
@SOCKDIAL:<status>
OK
AT@SOCKDIAL=? @SOCKDIAL:(0-1)
OK

Description:

This command serves to dial up the packet switch data service for socket connections.

Defined values:

<action>: integer
0 – Hang up Network
1 – Dial up Network
<status>: integer
0 – No Dial up Network started

□ Normal □ Internal Use  Confidential □ Restricted Confidential

127/206
 1 – A Dial up Network started
<err_code> : integer, error code; refer to Table B-1: Error codes supported for
@EXTERR commands.

Example:

AT@INTERNET=1
OK

AT@SOCKDIAL=1
OK

/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1

10.5. AT@SOCKCREAT Socket Creation

AT@SOCKCREAT parameter and command syntax
Command Possible response(s)

128/206
 11. AT@SOCKCREAT=<protocol_ty Normally respond:
pe>,<ip_version> @SOCKCREAT:<socket_id>
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@SOCKCREAT? [@SOCKCREAT:<socket_id>[,<socket_id>[,……]]]
OK
AT@SOCKCREAT=? 12. @SOCKCREAT:(1-2),(0-1)
OK

Description:

This command serves to create a socket.

Defined values:

<socket_id>: integer, the identifier of the created socket

<protocol_type>: integer
1 – TCP
2 – UDP
<ip_version>: integer
0 – IPv4
1 – IPv6
<err_code>: integer, error code: refer to Table B-1: Error codes supported for @EXTERR
commands.

12.1. AT@SOCKCONN Socket Connect

AT@SOCKCONN parameter and command syntax
Command Possible response(s)

129/206
 AT@SOCKCONN=<socket_id>,< Normally respond:
destination_ip_address>,<remo OK
te_port>[,<connection_timeout
>] If something is wrong, then respond:
@EXTERR:<err_code>
AT@SOCKCONN? [@SOCKCONN:<socket_id>[,<socket_id>[,……]]]
OK
AT@SOCKCONN=? @SOCKCONN:(1-6),(<destination_ip_address>),(1-655
35)[,(30-360)]
OK

Description:

This command serves to connect a remote server for the specific TCP socket.

Defined values:

<socket_id>: integer, the identifier of the specified socket

<destination_ip_address>: string, the IP address of the destination server
<remote_port>: integer, the specific remote port in the target destination; the range is
1–65,535.
<connection_timeout>: integer, the connection timeout for immediate response if the
TCP session cannot connect to the target destination; the range is 30–360 (in
seconds). Default is 120.
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

12.2. AT@SOCKREAD Socket Read

AT@SOCKREAD parameter and command syntax
Command Possible response(s)

130/206
 AT@SOCKREAD=<socket_i Normally respond:
d>,<max_length> @SOCKREAD:<actual_length>,<hex_data>
OK
@SOCKDATAIND: <socket_id>,<still_left>

If something is wrong, then respond:

@EXTERR:<err_code>
AT@SOCKREAD? ERROR
AT@SOCKREAD=? @SOCKREAD:(1-6),(1-1500)
OK

Description:

This command serves to read the data stored in the buffer of the specified socket.

Defined values:

<socket_id>: integer, the identifier of the specified socket

<max_length>: integer, the requested length of the data to be read; the range is 1–1,500
(in bytes).
<actual_length>: integer, the actual length of data which were read out; the range is
0–1,500 (in bytes).
<hex_data>: string, <actual_length> bytes of data with binary-coded hexadecimal format
to be read from the specific socket. The external host processor side needs to
convert the binary-coded hexadecimal format to original payload data (For example,
<hex_data> which is a string “302A48D5” will be converted to be an array which is
0x30 0x2A 0x48 0xD5 at the external host processor side).
<still_left>: integer, a indication for notifying that there are still data waiting for reading
from the specific socket.(Please refer to 10.8 @SOCKDATAIND Notification for Data
Received.)
0 – Nothing was received yet.
1 – Something were received.

131/206
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

12.3. @SOCKDATAIND Notification for Data Received

@SOCKDATAIND parameter command syntax
Command Possible response(s)
@SOCKDATAIND=<socket_id>,<still_left>
Reference:
Note: Unsolicited Response Message

Description:

Notification for data received from the specific TCP/UDP socket. After being indicated by
this notification, the external host processor should retrieve data from the data module by
AT@SOCKREAD as soon as possible. If the external host processor doesn’t retrieve data
quickly enough, it is possible that TCP/UDP packets will be lost forever. Under this condition,
the external host processor has responsibility to negotiate with the server for data
retransmittion.

Defined values:

<socket_id>: integer, the identifier of the specified socket

<still_left>: integer, a indication for notifying that there are still data waiting for reading
from the specific socket.
0 – Nothing was received yet.
1 – Something were received.
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands

132/206
12.4. AT@SOCKWRITE Socket Write
AT@SOCKWRITE parameter and command syntax
Command Possible response(s)
AT@SOCKWRITE=<socket Normally respond:
_id>,<write_bytes>,<hex_ @SOCKWRITE:<actual_length>
data> OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@SOCKWRITE? ERROR
AT@SOCKWRITE=? @SOCKWRITE:(1-6),(1-1500),(<hex_data>)
OK

Description:

This command serves to write data to the specified socket.

Defined values:

<socket_id>: integer, the identifier of the specified socket

<write_byte>: integer, the requested length of data to be written; the range is 1–1,500 (in
bytes).
<hex_data>: string, <actual_length> bytes of data with binary-coded hexadecimal format
to be written into the specific socket. The external host processor side needs to
convert the original payload data to the binary-coded hexadecimal format (For
example, the original payload data which is an array 0x30 0x2A 0x48 0xD5 will be
converted to <hex_data> which is a string “302A48D5” sent from the external host
processor side).
<actual_length>: integer, the actual length of data which were written; the range is
0–1,500 (in bytes).
<err_code>: integer: error code; refer to Table B-1: Error codes supported for @EXTERR

133/206
 commands.

Example:

AT@INTERNET=1
OK

AT@SOCKDIAL=1
OK

/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1

AT@SOCKCREAT=1
@SOCKCREAT:1
OK

AT@DNSRESVDON="www.wnc.com.tw"
@DNSRESVDON="10.37.238.17"
OK

AT@SOCKCONN=1,"10.37.238.17",80
OK

/* The content sent by this command is as the below:

GET index.html HTTP/1.1
Host: www.wnc.com.tw
(blank line)
*/
AT@SOCKWRITE=1,47,"47455420696E6465782E68746D6C20485454502F312E310
D0A486F73743A207777772E776E632E636F6D2E74770D0A"
@SOCKWRITE:47
OK

@SOCKDATAIND:1,1

134/206
/* The content received by this command is as the below:
HTTP/1.1 200 OK
Date: Thu, 21 Apr 2016 17:29:53 GMT
Server: Apache/2.2.14 (Win32)
Last-Modified: Sat, 20 Nov 2015 07:16:26 GMT
Accept-Ranges: bytes
Content-Length: 54
Content-Type: text/html
(blank line)
<html><body><h1>Welcom to WNC WWW ~</h1></body></html>
*/
AT@SOCKREAD=1,1024
@SOCKREAD:254,"485454502F312E3120323030204F4B0D0A446174653A2054687
52C2032312041707220323031362031373A32393A353320474D540D0A536572766
5723A204170616368652F322E322E3134202857696E3332290D0A4C6173742D4D6
F6469666965643A205361742C203230204E6F7620323031352030373A31363A323
620474D540D0A4163636570742D52616E6765733A2062797465730D0A436F6E746
56E742D4C656E6774683A2035340D0A436F6E74656E742D547970653A207465787
42F68746D6C0D0A0D0A3C68746D6C3E3C626F64793E3C68313E57656C636F6D207
46F20574E4320575757207E3C2F68313E3C2F626F64793E3C2F68746D6C3E"
OK

AT@SOCKCLOSE=1
OK

12.5. AT@SOCKRECV UDP Socket Data Receive

AT@SOCKRECV parameter and command syntax
Command Possible response(s)
AT@SOCKRECV=<socket_i Normally respond:
d>,<max_length> @SOCKRECV:<actual_length>,<hex_data>
OK
@SOCKDATAIND: <socket_id>,<still_left>

If something is wrong, then respond:

135/206
 @EXTERR:<err_code>
AT@SOCKRECV? ERROR
AT@SOCKRECV =? @SOCKRECV:(1-6),(1-1500)
OK

Description:

This command serves to receive the data stored in the buffer of the specified UDP socket.

Defined values:

<socket_id>: integer, the identifier of the specified UDP socket

<max_length>: integer, the requested length of the data to be received; the range is
1–1,500 (in bytes).
<actual_length>: integer, the actual length of data which are received; the range is
0–1,500 (in bytes).
<hex_data>: string, <actual_length> bytes of data with binary-coded hexadecimal format
to be received from the specific UDP socket. The external host processor side needs
to convert the binary-coded hexadecimal format to original payload data (For
example, <hex_data> which is a string “302A48D5” will be converted to be an array
which is 0x30 0x2A 0x48 0xD5 at the external host processor side).
<still_left>: integer, a indication for notifying that there are still data waiting for receiving
from the specific UDP socket.(Please refer to 10.8 @SOCKDATAIND Notification for
Data Received.)
0 – Nothing was received yet.
1 – Something were received.
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

136/206
12.6. AT@SOCKSEND UDP Socket Data Send
AT@SOCKSEND parameter and command syntax
Command Possible response(s)
AT@SOCKSEND=<socket_i Normally respond:
d>,<write_bytes>,<hex_d @SOCKSEND:<actual_length>
ata> OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@SOCKSEND? ERROR
AT@SOCKSEND=? @SOCKSEND:(1-6),(1-1500),(<hex_data>)
OK

Description:

This command serves to send data to the specified UDP socket.

Defined values:

<socket_id>: integer, the identifier of the specified UDP socket

<write_byte>: integer, the requested length of data to be sent; the range is 1–1,500 (in
bytes).
<hex_data>: string, <actual_length> bytes of data with binary-coded hexadecimal format
to be written into the specific UDP socket. The external host processor side needs to
convert the original payload data to the binary-coded hexadecimal format (For
example, the original payload data which is an array 0x30 0x2A 0x48 0xD5 will be
converted to <hex_data> which is a string “302A48D5” sent from the external host
processor side).
<actual_length>: integer, the actual length of data which are sent; the range is 0–1,500 (in
bytes).
<err_code>: integer: error code; refer to Table B-1: Error codes supported for @EXTERR

137/206
 commands.

12.7. AT@SOCKCLOSE Socket Close

AT@SOCKCLOSE parameter and command syntax
Command Possible response(s)
AT@SOCKCLOSE=<socket_id> Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@SOCKCLOSE? ERROR
AT@SOCKCLOSE=? @SOCKCLOSE:(1-6)
OK

Description:

This command serves to close the specified socket.

Defined values:

<socket_id>: integer, the identifier of the specified socket

<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

12.8. AT@SOCKERR Socket Error Code

AT@SOCKERR parameter and command syntax
Command Possible response(s)
AT@SOCKERR=<socket_id> Normally respond:

138/206
 @SOCKERR:<error_code>
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@SOCKERR? ERROR
AT@SOCKERR=? @SOCKERR:(1-6)
OK

Description:

This command serves to get the last error code of the specified socket.

Defined values:

<socket_id>: integer, the identifier of the specified socket

<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.
Example:

AT@INTERNET=1
OK

AT@SOCKDIAL=1
OK

/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1

AT@SOCKCREAT=1
@SOCKCREAT:1
OK

139/206
 AT@DNSRESVDON="www.wnc.com.tw"
@DNSRESVDON="10.37.238.17"
OK

/* Something failed happened when connecting. */

AT@SOCKCONN=1,"10.37.238.17",80
@EXTERR:517

/* Get the last failed reason of socket connection, return the failure
is that no response is from the server. */
AT@SOCKERR=1
@SOCKERR:520
OK

12.9. AT@FTPOPEN FTP Open

AT@FTPOPEN parameter and command syntax
Command Possible response(s)
AT@FTPOPEN=<server_ip Normally respond:
>,[<port>],[“<user_name> OK
”],[“<password>”][,[<
trans_type>]] If something is wrong, then respond:
@EXTERR:<err_code>
AT@FTPOPEN? ERROR
AT@FTPOPEN=? @FTPOPEN:<server_ip>,(1-65535),[<user_name>],[<passwo
rd>][,(0-1)]
OK

Description:

140/206
This command serves to connect to the specified FTP server.

Defined values:

<server_ip>: string, IP address of the specified FTP server

<port>: integer, FTP service port; the default port is 21, and the range is 1–65,535.
<user_name>: string, user name for the FTP login
<password>: string, password for the FTP login
<trans_type>: integer, file transfer type
0 – binary (default)
1 – ascii
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

12.10. AT@FTPCLOSE FTP Close

AT@FTPCLOSE parameter and command syntax
Command Possible response(s)
AT@FTPCLOSE Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@FTPCLOSE? ERROR
AT@FTPCLOSE=? OK

Description:

This command serves to close the connection to the specified FTP server.

Defined values:

141/206
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

12.11. AT@FTPGET FTP GET Operation

AT@FTPGET parameter and command syntax
Command Possible response(s)
AT@FTPGET=<file_name> Normally respond:

OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@FTPGET? ERROR
AT@FTPGET=? @FTPGET:<file_name>

OK

Description:

This command to perform the GET operation from the specified FTP server.

Defined values:

<file_name>: string, the file name with the full path of its file size to be stored at the
specified FTP site
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

142/206
12.12. AT@FTPGETDATA FTP GET data
AT@FTPGETDATA parameter and command syntax
Command Possible response(s)
AT@FTPGETDATA Normally respond:
@FTPGETDATA=<remain>,<hex_data_len>,<hex_data>
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@FTPGETDATA? ERROR
AT@FTPGETDATA=? @FTPGETDATA:
OK

Description:

This command serves to get file content from the specified FTP server.

Defined values:

<remain>: integer,
0 – There is no remaining data to get (I.e. the entire GET operation has been
completed)
other value – There are remaining data to get
<hex_data_length>: nteger, the actual length of <hex_data> gotten from the FTP server.
<hex_data>: string, <hex_data_length> bytes of data with binary-coded hexadecimal
format which were gotten from the FTP server. The external host processor side
needs to convert the binary-coded hexadecimal format to original payload data (For
example, <hex_data> which is a string “302A48D5” will be converted to be an array
which is 0x30 0x2A 0x48 0xD5 at the external host processor side).
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

143/206
Example:

AT@INTERNET=1
OK

AT@SOCKDIAL=1
OK

/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1

AT@DNSRESVDON="ftp.wnc.com.tw"
@DNSRESVDON="10.37.238.117"
OK

AT@FTPOPEN="10.37.238.117",,"",""
OK

AT@FTPGET="/test.txt"
OK

AT@FTPFILESIZE="/test.txt"
@FTPFILESIZE:20
OK

/* Retrieve from the file test.txt with text content as the below:
This is a test file.
*/
AT@FTPGETDATA
@FTPGETDATA:0,20,"54686973206973206120746573742066696C652E"
OK

AT@FTPCLOSE
OK

144/206
12.13. AT@FTPFILESIZE FTP Query File Size
AT@FTPFILESIZE parameter and command syntax
Command Possible response(s)
AT@FTPFILESIZE=<file_name> Normally respond:
@FTPFILESIZE:<file_size>
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@FTPFILESIZE? ERROR
AT@FTPFILESIZE=? @FTPFILESIZE:<file_name>
OK

Description:

This command serves to query the specified file size from the specified FTP server.

Defined values:

<file_name>: string, the file name with the full path stored at the specified FTP site
<file_size>: integer, The file size of the specified file is reported from the specified FTP
site.
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

12.14. AT@FTPPUT FTP PUT Operation

AT@FTPPUT parameter and command syntax
Command Possible response(s)

145/206
 AT@FTPPUT=<file_name> Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@FTPPUT? ERROR
AT@FTPPUT=? @FTPPUT:<file_name>
OK

Description:

This command serves to perform the PUT operation to the specified FTP server.

Defined values:

<file_name>: string, the file name with the full path stored at the specified FTP site
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

12.15. AT@ FTPPUTDATA FTP PUT data

AT@FTPPUTDATA parameter and command syntax
Command Possible response(s)
AT@FTPPUTDATA=<remain>, Normally respond:
<hex_data_len>,<hex_data> OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@FTPPUTDATA? ERROR
AT@FTPPUTDATA=? @FTPPUTDATA:(< remain>),<hex_data_len>, (<hex_data>)
OK

146/206
Description:

This command serves to upload file content to the specified FTP server.

Defined values:

<remain>: integer
0 – There is no remaining data to upload (that is, the whole PUT operation will be
complete after this operation.)
1 – There is remaining data to upload.
<hex_data_length>: integer, the actual length of <hex_data> to be put to the FTP server.
<hex_data>: string, <hex_data_length> bytes of data with binary-coded hexadecimal
format which will be put to the FTP server. The external host processor side needs to
convert the original payload data to the binary-coded hexadecimal format (For
example, the original payload data which is an array 0x30 0x2A 0x48 0xD5 will be
converted to <hex_data> which is a string “302A48D5” sent from the external host
processor side).
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

Example:

AT@INTERNET=1
OK

AT@SOCKDIAL=1
OK

/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1

147/206
 AT@DNSRESVDON="ftp.wnc.com.tw"
@DNSRESVDON="10.37.238.117"
OK

AT@FTPOPEN="10.37.238.117",,"",""
OK

AT@FTPPUT="/test.txt"
OK

/* Write text content as the below to the file test.txt:

This is a test file.
*/
AT@FTPPUTDATA
@FTPPUTDATA:0,40,"54686973206973206120746573742066696C652E"
OK

AT@FTPFILESIZE="/test.txt"
@FTPFILESIZE:20
OK

AT@FTPCLOSE
OK

12.16. AT@FTPDEL FTP Delete File

AT@FTPDEL parameter and command syntax
Command Possible response(s)
AT@FTPDEL=<file_name> Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@FTPDEL? ERROR

□ Normal □ Internal Use  Confidential □ Restricted Confidential

148/206
 AT@FTPDEL=? @FTPDEL:<file_name>
OK

Description:

This command serves to perform the DELETE operation for a file on the specified FTP server.

Defined values:

<file_name>: string, the file name with the full path stored at the specified FTP site
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

12.17. AT@PINGREQ Ping Request

AT@PINGREQ parameter and command syntax
Command Possible response(s)
AT@PINGREQ=<ip_address>[ Normally respond:
,<retry_num>[,[<timeout>]]] @PINGREQ:<reply_id>,<ip_address>,<reply_time>,<ttl>
[@PINGREQ:<reply_id>,<ip_address>,<reply_time>,<ttl>]
…………………………
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@PINGREQ? ERROR
AT@PINGREQ=? @PINGREQ :(<ip_address>)[,(<retry_num>)[,[(<timeout>)
]]]
OK

149/206
Description:

This command serves to send a PING request.

Defined values:

<ip_address>: string, the IP address to be pinged

<retry_num>: integer, the retry number for requesting a ping
<timeout>: integer, the timeout waiting for a single echo reply; the range is 1–600 (in
100 ms increments), and the default is 50.
<ttl>: integer, time to live; the range is 1–255, and the default is 128.
<reply_id>: integer, the identifier for individual reply of the ping request
<reply_time>: integer, the range is 1–600 (in 100 ms increments).
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

Example:

AT@INTERNET=1
OK

AT@SOCKDIAL=1
OK

/* The external host processor should wait for @SOCKDIAL:1 to make sure
the socket data call is made successfully or not. */
@SOCKDIAL:1

AT@DNSRESVDON="www.wnc.com.tw"
@DNSRESVDON="10.37.238.17"
OK

AT@PINGREQ="10.37.238.17"
@PINGREQ:1,"10.37.238.17",17,128
@PINGREQ:2,"10.37.238.17",19,128

150/206
@PINGREQ:3,"10.37.238.17",23,128
OK

151/206
13. Hardware Related Commands

13.1. AT@GPIOREQ Request to Control A GPIO

AT@GPIOREG parameter and command syntax
Command Possible response(s)

AT@GPIOREQ=<action>,<pin Normally respond:

> OK

If something is wrong, then respond:

@EXTERR:<err_code>

AT@GPIOREQ? ERROR

AT@GPIOREQ=? @GPIOREQ:(0-1),(<pin>)
OK

Description:

This command serves to enable the specific pin to be a GPIO.

Defined values:

<action>: integer
0 – Disable the specific pin to be a GPIO.
1 – Enable the specific pin to be a GPIO.

<pin>[#1]: integer, the specific pin to be controlled.

<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

Note #1: M14A2A support GPIO 1, 2, 3, 4, 5, 6, 7, 8, 46, 47, 48, 49, 87, 93, 94, 95, 96,
97; M18Q2 support GPIO 2, 3, 4, 7, 94, 95, 96.

152/206
13.2. AT@GPIOCFG Configure The Specific GPIO
AT@GPIOCFG parameter and command syntax
Command Possible response(s)

AT@GPIOCFG=<pin>,<directi When the command is AT@GPIOCFG=<pin>,0

on>[,<state>] Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>

When the command is AT@GPIOCFG=<pin>,0,<state>

Always respond:
@EXTERR:<err_code>

When the command is AT@GPIOCFG=<pin>,1,<state>

Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>

When the command is AT@GPIOCFG=<pin>,1

Always respond:
@EXTERR:<err_code>

AT@GPIOCFG? ERROR

AT@GPIOCFG=? @GPIOCFG:(<pin>),(0-1)[,(0-1)]
OK

Description:

153/206
This command serves to configure the specific GPIO.

Defined values:

<pin>: integer, the specific pin to be controlled.

< direction>: integer
0 – Configure to be an input pin.
1 – Configure to be an output pin.

<state>: integer
0 – Set the voltage level of the specific pin to be low (default).
1 – Set the voltage level of the specific pin to be high.

<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

13.3. AT@GPIOGET Get The Logical State of The Specific

GPIO
AT@GPIOGET parameter and command syntax
Command Possible response(s)

AT@GPIOGET=<pin> Normally respond:

@GPIOGET:<state>
OK

If something is wrong, then respond:

@EXTERR:<err_code>

AT@GPIOGET? ERROR

AT@GPIOGET=? @GPIOGET:(<pin>)
OK

154/206
Description:

This command serves to get the state of the specific GPIO.

Defined values:

<pin>: integer, the specific pin to be controlled.

<state>: integer
0 – The voltage level of the specific pin is low.
1 – The voltage level of the specific pin is high.

<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

13.4. AT@GPIOSET Set The Logical State of The Specific

GPIO
AT@GPIOSET parameter and command syntax
Command Possible response(s)

AT@GPIOSET=<pin>,<state> Normally respond:

OK

If something is wrong, then respond:

@EXTERR:<err_code>

AT@GPIOSET? ERROR

AT@GPIOSET=? @GPIOSET:(<pin>),(0-1)
OK

155/206
Description:

This command serves to set the state of the specific GPIO.

Defined values:

<pin>: integer, the specific pin to be controlled.

<state>: integer
0 – Set the voltage level of the specific pin to be low.
1 – Set the voltage level of the specific pin to be high.

<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

Example:

AT@INTERNET=1
OK

/* Enable GPIO_07 to be a GPIO. */

AT@GPIOREQ=1,7
OK

/* Configure GPIO_07 to be an output but forget to give a initial state.

An error code will be responded for warning. */
AT@GPIOCFG=7,1
@EXTERR:513

/* Configure GPIO_07 to be an output and initialize its logical level

to low. */
AT@GPIOCFG=7,1,0
OK

/* Check GPIO_07’s state to make sure it is under logical level low

if necessary. */
AT@GPIOGET=7
@GPIOGET:0
OK

156/206
/* Set GPIO_07’s logical level to be high. */
AT@GPIOSET=7,1
OK

/* Re-configure GPIO_07 to be an input pin. */

AT@GPIOCFG=7,0
OK

/* Try to set an input to be specific logical level and get a erroneous

response with failure code. */
AT@GPIOSET=7,1
@EXTERR:521

/* Try to get the logical level of an input. Respond it is logical high

now. */
AT@GPIOGET=7
@GPIOGET:1
OK

/* Release GPIO_07 when you don’t need to control GPIO_07 any more.
Be careful, GPIO_07’s state is unpredictable after being released. */
AT@GPIOREQ=0,7
OK

13.5. AT@THERMO Thermal Detection

AT@THERMO parameter and command syntax
Command Possible response(s)

AT@THERMO=<sensor_id>[, When the command is AT@THERMO=<sensor>

<threshold>] Normally respond:
@THERMO:<temperature>
OK

If something is wrong, then respond:

157/206
 @EXTERR:<err_code>

AT@THERMO? ERROR
[**]
AT@THERMO=? @THERMO:(0-6)[,(<threshold>)]
OK

or
[*]
@THERMO:(0-5)[,(<threshold>)]
OK

Description:

This command serves to query the temperature of the specific sensor or to set the
threshold of the specific sensor for a notification.

Defined values:

<sensor_id>[#1]: integer
0 – The first sensor on the module.
1 – The second sensor on the module.
2 – The third sensor on the module.
3 – The forth sensor on the module.
4 – The fifth sensor on the module.
………
n – The n-th sensor on the module.

<temperature>: integer, current temperature in degree Celsius for the specific snesor.
<threshold>[#2]: integer, the threshold to be monitored in degree Celsius.

<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.
Note #1: The total number of sensors depends on platform, please check with WNC
hardware for details.
Note #2: Reserved for future.

158/206
 Note: * indicates M14A2A only; ** indicates M18Q2 only

Example:

AT@INTERNET=1
OK

/* Read the first sensor embedded on a WNC data module. */

AT@THERMO=0
@THERMO:34
OK

/* Read the eighth sensor which doesn’t exist on a WNC data module and
get an error code */
AT@THERMO=7
@EXTERR:513

13.6. AT@ADCOP Analog-to-Digital Converter Operation

AT@ADCOP parameter and command syntax
Command Possible response(s)

AT@ADCOP=<action>[,<freq When the command is AT@ADCOP=1

uency>] Normally respond:
@ADCOP:<result>
OK

If something is wrong, then respond:

@EXTERR:<err_code>

When the command is AT@ADCOP=1,<frequency>

Normally respond:
@ADCOP:<result>
OK
…<frequency> x 100ms later…
@ADCOP:<result>

159/206
 …<frequency> x 100ms later…
@ADCOP:<result>
…<frequency> x 100ms later…
@ADCOP:<result>

If something is wrong, then respond:

@EXTERR:<err_code>
When the command is AT@ADCOP=0
Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>
AT@ADCOP? ERROR

AT@ADCOP=? @ADCOP:(0-1)[,(0-100)]
OK

Description:

Thia command serves to start a measurement of AD converter.

Defined values:

< action>: integer

0 – Stop measuring.
1 – Start to measure.

<frequency>[*]: integer, the frequency of continous report of measurements in 100

milliseconds. Range is from 1 to 100.
<result>: integer, the value of a measurement.
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands.

160/206
 Note: * indicates M14A2A only; ** indicates M18Q2 only

Example:

AT@INTERNET=1
OK

/* Read a measurement from the embedded voltage ADC on a WNC data module
and respond 1.414567 volt. */
AT@ADCOP=1
@ADCOP:1.414567
OK

14. Miscellaneous Commands

14.1. @EXTERR Response of the Proprietary AT Command

for Errors
@EXTERR parameter command syntax
Command Possible response(s)
@EXTERR=<err_code>
Reference:
Note: Response

Description:

Response of proprietary AT command for errors

Defined values:

161/206
<err_code>: integer, error code; refer to Table B-1: Error codes supported for @EXTERR
commands

14.2. @FUNEWIND Indicator for New Firmware

Notification
@FUNEWIND parameter command syntax
Command Possible response(s)
@FUNEWIND:<file_size>
Reference:
Note: Unsolicited Response Message

Description:

An Indication to notify there is a new firmware to be installed.

Defined values:

<file_size>: integer, the file size of the downloaded host firmware. If <file_size> is 0, it
means that the previous firmware is abandoned and state should be changed to
initial value – 0.

14.3. @FUEXECIND Indication for Upgrade Availability

@FUEXECIND parameter command syntax
Command Possible response(s)
@FUEXECIND:<type>
Reference:
Note: Unsolicited Response Message

162/206
Description:

Command Indication for an indication that there an upgrade available

Defined values:

< type>: integer

0 – The module begin the upgrade process.
1 – The host should execute the upgrade process now.

14.4. @FUDONEIND Indication that the Module’s

Firmware Upgrade Process is Complete

@FUDONEIND parameter command syntax
Command Possible response(s)
@FUDONEIND:<result>
Reference:
Note: Unsolicited Response Message

Description:

Command Indication for notification that the module’s firmware-upgrade process is

complete.

Defined values:

163/206
< result>: integer
0 – Completed with no errors
1 – Failed; error number 1 (TBD)

14.5. AT@FUSENDSTATE State of the Upgrading Process

Sent to the Module

AT@FUSENDSTATE parameter command syntax
Command Possible response(s)
@ FUSENDSTATE =<state> Normally respond:
OK

If something is wrong, then respond:

@EXTERR:<err_code>
@ FUSENDSTATE? ERROR
@ FUSENDSTATE =? @ FUSENDSTATE:(0-7)
OK

Description:

Command Indication to notify that the module’s firmware-upgrade process is complete.

Defined values:

<state>: integer
0 – Initial value
1 – Begin upgrading the firmware.
2 – The firmware has updated successfully.
3 – Not enough storage for the new firmware package
4 – CRC check failure for the newly downloaded package

164/206
 5 – Unsupported package type.
6 – Firmware update failed.
7 – Do not upgrade this firmware at this moment.

14.6. AT@FURECVFILE Receive the Firmware File Using

HEX
AT@FURECVFILE parameter command syntax
Command Possible response(s)
@FURECVFILE=<offset>,<l Normally respond:
ength> @FURECVFILE: <hex_data>
OK

If something is wrong, then respond:

@EXTERR:<err_code>
@ FURECVFILE? ERROR
@ FURECVFILE =? @FURECVFILE:(<offset>),(1-1500)

Description:

Command for retrieving the content of the firmware form the module.

Defined values:

<offset>: integer, the range is 0–(file_size-1); offset of FW File.0

<length>: integer, data length of this transmission must be within a range of 1–1,500.
<hex_data>: string, maximal <length> bytes of data with binary-coded hexadecimal
format which were received from the module. The external host processor side
needs to convert the binary-coded hexadecimal format to original payload data (For
example, <hex_data> which is a string “302A48D5” will be converted to be an array

165/206
 which is 0x30 0x2A 0x48 0xD5 at the external host processor side).

14.7. AT@HOSTINFO Send the Host’s information to the

Module
AT@HOSTINFO parameter command syntax
Command Possible response(s)
@HOSTINFO=<ver_number>,<m Normally respond:
anufacturer>,<model_name>,<m OK
odel_id>
If something is wrong, then respond:
@EXTERR:<err_code>
@HOSTINFO? ERROR
@HOSTINFO =? @HOSTINFO:(<ver_number>),(<manufacturer>),(<m
odel_name>),(<model_id>)
OK

Description:

Command sending the host’s information to the module

Defined values:

<ver_number>: string, indicates the firmware version number of the host

<manufacturer>: string, indicates the manufacturer of host
<model_name>: string, indicates the model name of host
<model_id>: string, indicates the model id of host

166/206
15 Short Messages Service
Warning: This functionality is currently in beta.

15.1 Introduction
In case of errors all the SMS related AT commands return the result codes defined in Appendix A.2 instead of
the usual error result codes listed in Appendix A.1.
Parameter <index> description for ME (ME message), SM ((U)SIM message) and MT (ME + SM) memory cases:
• 0: SMS class 0 stored in RAM (the last one received).
• Values between 1 and 300: SMS stored in the ME message storage.
• Values between 301 and (301 + (n-1)): SMS stored in the SIM (n depends on the SIM card used).
TOBY-L200-00S / TOBY-L200-50S / TOBY-L210-00S / TOBY-L210-50S / MPCI-L200-00S / MPCI-L210-00S
The <index> parameter the range goes from 1 to n (n depends on the SIM Card used) and represents
the index of SMS stored in the SIM.
The SMSes class 0 are not stored in RAM.
SARA-G300 / SARA-G310
The <index> parameter the range goes from 1 to n (n depends on the SIM Card used) and represents
the index of SMS stored in the SIM.
Parameter <index> description for BM (Broadcast Message) memory case:
• LISA-U / SARA-U series - Values between 1 and 300: Cell Broadcast messages are stored only if there is at
least an empty location available in the BM memory (that is located in the file system)
• SARA-G / LEON-G series - Values between 1 and 5: Cell Broadcast messages are stored using a circular buffer
so they are always saved even if the BM memory (that is located in RAM) is full. Since the Cell Broadcast
messages are stored in RAM, they will be lost after a power-off or reset of the module.
Parameter <index> description for SR (status Report) memory case:
• LISA-U / SARA-U series - Values between 1 and 300: Status Report messages are stored only if there is at least
an empty location available in the SR memory (that is located in the file system).
The following limitations apply related to the SMS usage:
Single SMS
• 160 characters if <dcs> = "GSM 7 bit default alphabet data"
• 140 octets if <dcs> = "8-bit data"
• 70 UCS2 characters (2 bytes for each one) if <dcs>="16-bit uncompressed UCS2 data"
Concatenated SMS (where supported) - "8-bit reference number" type
• 153 characters if <dcs> = "GSM 7 bit default alphabet data"
• 134 octets if <dcs> = "8-bit data"
• 67 UCS2 characters (2 bytes for each one) if <dcs>="16-bit uncompressed UCS2 data"
Concatenated SMS (where supported) - "16-bit reference number" type
• The limits are the same as the "8-bit reference number" type, but are decreased by one unit
A concatenated SMS can have as many as 255 parts.
For a complete overview of SMS, see the 3GPP TS 23.040 [8].

167/206
15.2 Select message service +CSMS

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No - +CMS Error

15.2.1 Description
Selects message service <service>. It returns the types of messages supported by the MT.

15.2.2 Syntax
Type Syntax Response Example
Set AT+CSMS=<service> +CSMS: <mt>,<mo>,<bm> AT+CSMS=1
OK +CSMS: 1,1,1
OK
Read AT+CSMS? +CSMS: <service>,<mt>,<mo>,<bm> +CSMS: 0,1,1,1
OK OK
Test AT+CSMS=? +CSMS: (list of supported <service>s) +CSMS: (0-1)
OK OK

15.2.3 Defined values
Parameter Type Description
<service> Number • 0: Refer to 3GPP TS 23.040 [8] and 3GPP TS 23.041 [9]; syntax of AT commands is compatible
with 3GPP TS 27.005 [16] phase 2; phase 2+ features may be supported if no new command
syntax is required
• 1: Refer to 3GPP TS 23.040 [8] and 3GPP TS 23.041 [9]; syntax of AT commands is compatible
with 3GPP TS 27.005 [16] phase 2+
<mt> Number Mobile terminated messages
• 0: not supported
• 1: supported
<mo> Number Mobile originated messages
• 0: not supported
• 1: supported
<bm> Number Broadcast messages
• 0: not supported
• 1: supported

15.2.4 Notes
• Set <service> to 1 to acknowledge an incoming message (either SMS or Status Report) with +CNMA
command.
• If <service> is changed from 1 to 0 and one or more parameters of the +CNMI command are in phase 2+,
switch the +CNMI parameters to phase 2 specific values before entering phase 2.

168/206
15.3 Preferred message storage +CPMS
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
partial Yes NVM No Up to 3 min +CMS Error

15.3.1 Description
Selects memory storages <mem1>, <mem2> and <mem3>. If the chosen storage is supported by the MT but
not suitable, the +CMS ERROR: <err> error result code should be returned.
See the test command for the supported memory types for each memory storage.

15.3.2 Syntax
Type Syntax Response Example
Set AT+CPMS=<mem1>[,<mem2>[, AT+CPMS: <used1>,<total1>,<used2>, AT+CPMS="BM","SM","SM"
<mem3>]] <total2>,<used3>,<total3>
+CPMS: 0,5,0,50,0,50
OK
OK
Read AT+CPMS? +CPMS: <mem1>,<used1>,<total1>, +CPMS: "MT",4,350,"MT",4,350,"MT",
<mem2>,<used2>,<total2>,<mem3>, 4,350
<used3>,<total3>
OK
OK
Test AT+CPMS=? +CPMS: (list of supported <mem1>s), +CPMS: ("MT","ME","SM","BM",
(list of supported <mem2>s),(list of "SR"),("MT","ME","SM"),("MT","ME",
supported <mem3>s) "SM")
OK OK

15.3.3 Defined values
Parameter Type Description
<mem1> String Memory used to read and delete messages. The supported values may vary:
• "ME": ME message storage
• "SM": (U)SIM message storage
• "MT" (factory-programmed value): "ME"+"SM", "ME" preferred
• "BM": Broadcast Message storage
• "SR": Status Report storage
The default value is the currently set value.
<mem2> String Memory used to write and send SMS. The supported values may vary:
• "ME": ME message storage
• "SM": (U)SIM message storage
• "MT" (factory-programmed value): "ME"+"SM", "ME" preferred
The default value is the currently set value.
<mem3> String Memory preferred to store the received SMS. The supported values may vary:
• "ME": ME message storage
• "SM": (U)SIM message storage
• "MT" (factory-programmed value): "ME"+"SM", "ME" preferred
The default value is the currently set value.
<used1> Number Number of used message locations in <mem1>
<total1> Number Total number of message locations in <mem1>
<used2> Number Number of used message locations in <mem2>
<total2> Number Total number of message locations in <mem2>
<used3> Number Number of used message locations in <mem3>

169/206
Parameter Type Description
<total3> Number Total number of message locations in <mem3>

15.3.4 Notes
 TOBY-L200-00S / TOBY-L200-50S / TOBY-L210-00S / TOBY-L210-50S / MPCI-L200-00S / MPCI-L210-00S
• Only "SM" message storage is supported.
• The factory-programmed value is "SM", "SM" and "SM".
 LEON-G
• <mem1> = "SR" (Status Report storage) is not supported.
 SARA-G
• <mem1> = "SR" (Status Report storage) is not supported.
 SARA-G300 / SARA-G310
• "ME" and "MT" message storages are not supported.
• The factory-programmed value is "SM", "SM" and "SM" .

15.4 Preferred message format +CMGF

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes Profile No - +CMS Error

15.4.1 Description
Indicates to the MT which input and output format of messages shall be used.

15.4.2 Syntax
Type Syntax Response Example
Set AT+CMGF=[<mode>] OK AT+CMGF=1
OK
Read AT+CMGF? +CMGF: <mode> +CMGF: 1
OK OK
Test AT+CMGF=? +CMGF: (list of supported <mode>s) +CMGF: (0-1)
OK OK

15.4.3 Defined values
Parameter Type Description
<mode> Number Indicates the format of messages used with send, list, read and write commands and URCs
resulting from receiving SMSes messages:
• 0 (default and factory-programmed value): PDU mode
• 1: text mode

15.4.4 Notes
 TOBY-L201
• The default value is 1 when the module is configured in Verizon mode (+UMNOCONF=3).

170/206
15.5 Save settings +CSAS

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full No NVM No - +CMS Error

15.5.1 Description
Saves active message service settings from the current active memory (RAM) to non-volatile memory (NVM). The
settings related to the +CSCA (the current SMSC address stored in RAM), +CSMP and +CSCB commands are
stored in a specific SMS profile (only one profile is available).

15.5.2 Syntax
Type Syntax Response Example
Set AT+CSAS[=<profile>] OK AT+CSAS
OK
Test AT+CSAS=? +CSAS: (list of supported <profile>s) +CSAS: (0)
OK OK

15.5.3 Defined values
Parameter Type Description
<profile> Number Specific SMS profile index where to store the active message settings. The factory-programmed
value is 0.

15.6 Restore settings +CRES

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No < 10 s +CMS Error

15.6.1 Description
Restores message service settings from a non-volatile memory (NVM) to the current active memory (RAM). The
settings related to the +CSCA (the SMSC address in the SIM card is also updated), +CSMP and +CSCB commands
are read from a specific SMS profile (only one profile is available).

15.6.2 Syntax
Type Syntax Response Example
Set AT+CRES[=<profile>] OK AT+CRES=0
OK
Test AT+CRES=? +CRES: (list of supported <profile>s) +CRES: (0)
OK OK

15.6.3 Defined values
Parameter Type Description
<profile> Number Specific SMS profile index from where to read the message service settings

171/206
15.7 Show text mode parameters +CSDH
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No - +CMS Error

15.7.1 Description
Controls whether detailed SMS header information is shown in text mode (+CMGF=1).
This affects the responses of the +CMGR (Chapter 11.11), +CMGL (Chapter 11.13), +CSMP (Chapter 11.17),
+CSCA (Chapter 11.20) AT commands and the +CMT, +CMTI, +CDS, +CDSI, +CBM, +CBMI (Chapter 11.8) URCs.

15.7.2 Syntax
Type Syntax Response Example
Set AT+CSDH=[<show>] OK AT+CSDH=1
OK
Read AT+CSDH? +CSDH: <show> +CSDH: 0
OK OK
Test AT+CSDH=? +CSDH: (list of supported <show>s) +CSDH: (0-1)
OK OK

15.7.3 Defined values
Parameter Type Description
<show> Number • 0 (default value and factory-programmed setting): do not show detailed SMS header
information
• 1: show detailed SMS header information

15.8 New message indication +CNMI

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
partial Yes Profile No - +CMS Error

15.8.1 Description
Selects the procedure to indicate the reception of a new SMS in case of the MT is active (the DTR signal is ON). If
the MT is inactive (the DTR signal is OFF), the message reception should be done as specified in 3GPP TS 23.038 [7].
The SMSes of class 0 (normally displayed via MMI) are indicated on DTE via URC +CMTI: "SM",0 , wherein
0 represents an SMS without SIM-storage ("SM" indicates only that no other specific setting is needed
to read the SMS via AT+CMGR=0).
The <tooa>, <fo>, <pid>, <dcs>, <sca>, <tosca>, <length> parameters in the text mode +CMT URC are
displayed only if +CSDH=1 is set.
The +UCMT URC notifies the SMS-DELIVER status for 3GPP2 Mobile Terminated SMSes; it is equivalent to +CMT
but valid only for 3GPP2 SMS (i.e. 3GPP2 SMS over IMS received on Verizon MNO).

172/206
15.8.2 Syntax
Type Syntax Response Example
Set AT+CNMI=[<mode>[,<mt>[,<bm>[, OK AT+CNMI=1,1
<ds>[,<bfr>]]]]]
OK
Read AT+CNMI? +CNMI: <mode>,<mt>,<bm>,<ds>, +CNMI: 0,0,0,0,0
<bfr>
OK
OK
Test AT+CNMI=? +CNMI: (list of supported <mode>s),(list +CNMI: (0-2),(0-3),(0-3),(0-2),(0-1)
of supported <mt>s),(list of supported
OK
<bm>s),(list of supported <ds>s),(list of
supported <bfr>s)
OK
URC +CMTI: <mem>,<index> +CMTI: "SM",5
URC Text mode (+CMGF=1): +CMT: "+393475234652",,"14/11/21,
11:58:23+01"
+CMT: <oa>,[<alpha>],<scts>[,<tooa>,
<fo>,<pid>,<dcs>,<sca>,<tosca>, Hello world
<length>]<CR><LF><data>
PDU mode (+CMGF=0):
+CMT: ,<length><CR><LF><pdu>
URC Text mode (+CMGF=1): +UCMT: 1,+1231241241,"18:02:28+0
8",,,,2,,,,,6
+UCMT: <message_id>,<oa>,<scts>,
[<priority>],[<privacy>],[<callback_ Hello!
number>],<encoding>,[<status>],
[<num_sms>,<part>,<reference>],
<length><CR><LF><text>
PDU mode (+CMGF=0):
+UCMT: <pdu_length><CR><LF><pdu>
URC +CBMI: <mem>,<index> +CBMI: "BM",48
URC Text mode (+CMGF=1): +CBM: 271,1025,1,1,1
+CBM: <sn>,<mid>,<dcs>,<page>, The quick brown fox jumps over the lazy
<pages><CR><LF><data> dog 0123456789
PDU mode (+CMGF=0):
+CBM: <length><CR><LF><pdu>
URC +CDSI: <mem>,<index> +CDSI: "MT",2
URC Text mode (+CMGF=1): +CDS: 6,202,"+393492323583",145,
"14/07/25,13:07:16+02","14/07/25,
+CDS: <fo>,<mr>,[<ra>],[<tora>],<scts>,
16:35:44+02",0
<dt>,<st>
PDU mode (+CMGF=0):
+CDS: <length><CR><LF><pdu>

15.8.3 Defined values
Parameter Type Description
<mode> Number Controls the processing of URCs specified within this command:
• 0 (default value): buffer URCs in the MT; if the MT buffer is full, the oldest indication may be
discarded and replaced with the new received indications (ring buffer)
• 1 (factory-programmed value): discard indication and reject new received message URCs when
MT-DTE link is reserved; otherwise forward them directly to the DTE
• 2: buffer URCs in the MT when the serial link is busy (e.g. data-transfer); otherwise forward
them directly to the DTE
• 3: forward URCs directly to the TE. TA-TE link specific inband technique used to embed result
codes and data when MT is in on-line data mode
<mt> Number Specifies the rules for managing the received SMS according the message's Data Coding Scheme
(DCS):
• 0 (default value and factory-programmed value): No SMS-DELIVER indications are routed to
the TE

173/206
Parameter Type Description
• 1: if SMS-DELIVER is stored in the MT, indication of the memory location is routed to the DTE
using the +CMTI URC
• 2: SMS-DELIVER (except class 2 SMS) are routed directly to the DTE (but not saved in the module
file system or SIM memory) using the +CMT URC. If MT has its own display device then class
0 SMS and SMS in the message waiting indication group (discard message) may be copied to
both MT display and to DTE. In this case MT shall send the acknowledgement to the network.
Class 2 SMSs and messages in the message waiting indication group (storage message) result
in indication as defined in <mt>=1
• 3: Class 3 SMS-DELIVERs are routed directly to DTE using URCs defined in <mt>=2. Messages
of other data coding schemes result in indication as defined in <mt>=1
<bm> Number Specifies the rules for managing the received Cell Broadcast messages (CBM):
• 0 (default value and factory-programmed value): no CBM indications to the DTE
• 1: if the CBM is stored in the MT, an indication of the used memory location is routed to DTE
using the +CBMI URC
• 2: new CBMs are routed directly to the DTE using the +CBM URC
• 3: class 3 CBMs are routed directly to DTE using URCs defined in <bm>=2. If CBM storage is
supported, messages of other classes result in indication as defined in <bm>=1
<ds> Number Specifies the rules for managing the Status Report messages:
• 0 (default value and factory-programmed value): no SMS-STATUS-REPORTs are routed to the
DTE
• 1: SMS-STATUS-REPORTs are routed to the DTE using the +CDS URC
• 2: if SMS-STATUS-REPORT is stored in the MT, the indication of the memory location is routed
to the DTE using the +CDSI URC
<bfr> Number Controls the buffering of URCs:
• 0 (default value and factory-programmed value): MT buffer of URCs defined within this
command is flushed to the DTE when <mode> 1...3 is entered (OK final result code shall be
given before flushing the codes).
• 1: MT buffer of URCs defined within this command is cleared when <mode> 1...3 is entered
<mem> String Same as defined in +CPMS Defined Values
<index> Number Storage position
<length> Number Two meanings:
• in text mode: number of characters
• in PDU mode: PDU's length in octets without the Service Center's address. In example: 0
39121430100038166F6000004E374F80D: this is a PDU with Service Center's number +1234,
that generates the address 03912143 (4 octets). Thus in this case <length>=13.
<pdu> String Protocol data unit: each 8-bit octet is presented as two IRA character long hexadecimal numbers,
e.g. octet with integer value 42 is presented to TE as two characters 2A (IRA 50 and 65)
<oa> String Originator address
<scts> String Service center time stamp in time-string format, see the <dt>
<data> String In the case of SMS: 3GPP TS 23.040 [8] TP-User-Data in text mode responses; format:
• if <dcs> indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used and <fo> indicates
that 3GPP TS 23.040 [8] TP-User-Data-Header-Indication is not set:
o if TE character set other than "HEX" (refer command Select TE Character Set +CSCS in
3GPP TS 27.007 [2]): ME/TA converts GSM alphabet into current TE character set according
to rules of Annex A
o if TE character set is "HEX": ME/TA converts each 7-bit character of GSM 7 bit default
alphabet into two IRA character long hexadecimal number (e.g. character TODO: what
character should go here? ( (GSM 7 bit default alphabet 23) is presented as 17 (IRA 49
and 55))
• if <dcs> indicates that 8-bit or UCS2 data coding scheme is used, or <fo> indicates that 3GPP
TS 23.040 [8] TP-User-Data-Header-Indication is set: ME/TA converts each 8-bit octet into two
IRA character long hexadecimal number (e.g. octet with integer value 42 is presented to TE as
two characters 2A (IRA 50 and 65))
In the case of CBS: 3GPP TS 23.041 [9] CBM Content of Message in text mode responses;
format:
• if <dcs> indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used:
o if TE character set other than "HEX" (refer command +CSCS in 3GPP TS 27.007 [2]): ME/
TA converts GSM alphabet into current TE character set according to rules of Annex A

174/206
Parameter Type Description
o if TE character set is "HEX": ME/TA converts each 7-bit character of the GSM 7 bit default
alphabet into two IRA character long hexadecimal number
• if <dcs> indicates that 8-bit or UCS2 data coding scheme is used: ME/TA converts each 8-bit
octet into two IRA character long hexadecimal number
<sn> Number CBM serial number
<mid> Number CBM message identifier
<dcs> Number Data Coding Scheme
<page> Number CBM Page Parameter bits 4-7 in integer format as described in 3GPP TS 23.041 [9]
<pages> Number CBM Page Parameter bits 0-3 in integer format as described in 3GPP TS 23.041 [9]
<fo> Number First octet of the SMS TPDU (see 3GPP TS 23.040 [8])
<mr> Number Message reference
<ra> String Recipient address field
<tora> Number Type of address of <ra> - octet
<dt> String Discharge time in format "yy/MM/dd,hh:mm:ss+zz"; the time zone is expressed in steps of 15
minutes. The range goes from -48 to +56
<st> Number Status of a SMS STATUS-REPORT
<message_id> Number Message-ID of the 3GPP2 SMS
<priority> Number 3GPP2 priority:
• 0: normal
• 1: interactive
• 2: urgent
• 3: emergency
<privacy> Number 3GPP2 privacy
• 0: not restricted
• 1: restrictive
• 2: confidential
• 3: secret
<callback_number> String Callback number
<encoding> Number Text encoding
• 2: ASCII7
• 3: IA5
• 4: UCS2
• 8: ISO 8859-1
• 9: GSM7
<num_sms> Number Total number of SMS
<part> Number Fragment part number
<reference> Number 3GPP2 reference ID

15.8.4 Notes
• The incoming SMS/CBM URC indications will be displayed only on the AT interface where the last +CNMI
command was set. As a general rule, the command should be issued by the DTE:
o After start-up
o After using the Z and &F command (which reset the command configuration)
o Whenever the incoming SMS URCs indications are requested on a different AT interface
• When <mt> is not set to 0 the arrival of an SMS is notified by switching the RI line from OFF to ON for 1
s.. This is done in respect to the RI line of all the AT interface
• The behaviour described in the note above can be configured via the +UDCONF=82 AT command (where
this command is supported).
 TOBY-L2 / MPCI-L2
• The RI line switching from OFF to ON for 1 s is only performed on the AT interface where the +CNMI
command is issued (with <mt> not set to 0).
• <mode> = 3 is not supported.
• <bm> = 1 and <bm> = 3 are not supported.

175/206
 • <ds> = 2 is not supported.
 SARA-G / LEON-G / LISA-U / SARA-U
• <mode> = 3 is not supported.
• The +UCMT URC is not supported.

15.9 Incoming SMS/CBM indication via different AT interfaces

+UDCONF=82
+UDCONF=82
Modules LISA-U200-03S LISA-U200-83S LISA-U201 SARA-U260-03S SARA-U270-03S SARA-U270-53S SARA-U280-03S
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full No No No - +CME Error

15.9.1 Description
Allows the module to provide SMS/CBM indications on different AT command interfaces: the incoming SMS/CBM
URC indications will be displayed on each AT command interface where the command +CNMI is issued.
When the URC indications are disabled, that is <mode> parameter of +CNMI equals to 0 or one (or more) of the
+CNMI parameters <mt>, <bm>, <ds> equals 0, they are removed from all the AT terminals
The behaviour regarding the +CNMI values loaded from the module Profile, during start-up phase and by using
Z/&F AT commands, remains unchanged.

15.9.2 Syntax
Type Syntax Response Example
Set AT+UDCONF=82,<CNMI_conf_status> OK AT+UDCONF=82,0
OK
Read AT+UDCONF=82 +UDCONF: 82,<CNMI_conf_status> AT+UDCONF=82
OK +UDCONF: 82,1
OK

15.9.3 Defined values
Parameter Type Description
<CNMI_conf_status> Number Enables / disables the incoming SMS/CBM indication via different AT command interfaces.
Allowed values:
• 0 (factory-programmed value): the incoming SMS/CBM URC indications will be displayed only
on the AT interface where the last +CNMI command was issued
• 1: the incoming SMS/CBM indications via different AT interfaces is enabled. The URC about
the incoming SMS/CBM indications will be displayed on each AT interface where the command
+CNMI was issued.

15.10 Select service for MO SMS messages +CGSMS

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full No NVM No - +CME Error

15.10.1 Description
Specifies the service (PS or CS) or service preference that the MT will use to send MO SMS messages.

176/206
In particular:
• in 2G RAT, PS service means GPRS and CS service means transmission on GSM dedicated channels;
• in 3G RAT, PS service means transmission on PS domain SRB (Signalling Radio Bearer) and CS service means
transmission on CS domain SRB; SRB can be mapped to several UMTS transport channels, e.g. RACH/FACH
or DCH;
• in 4G RAT, PS service means IMS messaging on EPS bearers and CS service means transmission on SGs
(Signalling Gateways).

15.10.2 Syntax
Type Syntax Response Example
Set AT+CGSMS=[<service>] OK AT+CGSMS=1
OK
Read AT+CGSMS? +CGSMS: <service> +CGSMS: 1
OK OK
Test AT+CGSMS=? +CGSMS: (list of supported <service>s) +CGSMS: (0-3)
OK OK

15.10.3 Defined values
Parameter Type Description
<service> Number Service or service preference to be used:
• 0 (default value): PS
• 1 (factory-programmed value): CS
• 2: PS preferred (use CS if PS is not available)
• 3: CS preferred (use PS if CS is not available)

15.11 Read message +CMGR

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No Up to 3 min (<1 +CMS Error
s for prompt ">"
when present)

15.11.1 Description
Returns the message with location value <index> from message storage <mem1> to the DTE.
The parameters <tooa>,<fo>,<pid>,<dcs>,<sca>,<tosca>,<length>,<cdata> shall be displayed only if
+CSDH=1 is set.
The syntax AT+CMGR=0 allows to display an SMS class 0 if it is signalized to MT, because no MMI is
available in the MT (see also the note from command +CNMI).
If the <index> value is out of range (it depends on AT+CPMS command setting) or it refers to an empty
position, then "+CMS ERROR: invalid memory index" error result code is returned.

15.11.2 Syntax
Type Syntax Response Example
Set Text mode (+CMGF=1): (SMS-DELIVER) AT+CMGR=303
AT+CMGR=<index>
+CMGR: "REC READ",
"+393488535999",,"07/04/05,18:0

177/206
Type Syntax Response Example
+CMGR: <stat>,<oa>,[<alpha>],<scts>[, 2:28+08",145,4,0,0,"+393492000466",
<tooa>,<fo>,<pid>,<dcs>,<sca>, 145,93
<tosca>,<length>]
You have a missed called. Free
<data> information provided by your operator.
OK OK
(SMS-SUBMIT)
+CMGR: <stat>,<da>,[<alpha>][,<toda>,
<fo>,<pid>,<dcs>,[<vp>],<sca>,<tosca>,
<length>]
<data>
OK
(SMS-STATUS-report)
+CMGR: <stat>,<fo>,<mr>,[<ra>],
[<tora>],<scts>,<dt>,<st>
OK
(SMS-COMMAND)
+CMGR: <stat>,<fo>,<ct>[,<pid>,
[<mn>],[<da>],[<toda>],<length>
[<cdata>]]
OK
(CBM storage)
+CMGR: <stat>,<sn>,<mid>,<dcs>,
<page>,<pages>
<data>
OK
PDU mode (+CMGF=0): +CMGR: <stat>,[<alpha>],<length> AT+CMGR=1
AT+CMGR=<index>
<pdu> +CMGR: 1,,40
OK 0791934329002000040
C91932309826614000080
70328045218018D4F29CFE0
6B5CBF379F87C4EBF41E4340
82E7FDBC3
OK
Test AT+CMGR=? OK

15.11.3 Defined values
Parameter Type Description
<index> Number Storage position
<stat> Number • 0: in PDU mode or "REC UNREAD" in text mode: received unread SMS
• 1: in PDU mode or "REC READ" in text mode: received read SMS
• 2: in PDU mode or "STO UNSENT" in text mode: stored unsent SMS
• 3: in PDU mode or "STO SENT" in text mode: stored sent SMS
<oa> String Originator address
<alpha> String Alphanumeric representation of <da> or <a> corresponding to the entry found in the
phonebook 3GPP TS 24.008 [12]. The parameter is not managed.
<scts> String Service center time stamp in time-string format, see <dt>
<tooa> Number Type of address of <oa> - octet
<fo> Number First octet of the SMS TPDU (see 3GPP TS 23.040 [8])
<pid> Number TP-Protocol-Identifier (default 0); see the 3GPP TS 23.040 [8]
<dcs> Number Data Coding Scheme
<sca> String Service center address field
<tosca> Number Type of address of <sca> - octet in Number format (for more details see the 3GPP TS 24.008
[12]); default 145 when string includes '+', otherwise default 129
<length> Number Two meanings:
• in text mode: number of characters

178/206
Parameter Type Description
• in PDU mode: PDU's length in octets without the Service Center's address. In example 0
39121430100038166F6000004E374F80D: this is a PDU with Service Center's number +1234,
that generates the address 03912143 (4 octets). Thus in this case <length> = 13.
<data> String In the case of SMS: 3GPP TS 23.040 [8] TP-User-Data in text mode responses; format:
• if <dcs> indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used and <fo> indicates
that 3GPP TS 23.040 [8] TP-User-Data-Header-Indication is not set:
o if TE character set other than "HEX" (see +CSCS command description): ME/TA converts
GSM alphabet into current TE character set according to rules of Annex A
o if TE character set is "HEX": ME/TA converts each 7-bit character of GSM 7 bit default
alphabet into two IRA character long hexadecimal number (e.g. character TODO: what
character should go here? (GSM 7 bit default alphabet 23) is presented as 17 (IRA 49 and
55))
• if <dcs> indicates that 8-bit or UCS2 data coding scheme is used, or <fo> indicates that 3GPP
TS 23.040 [8] TP-User-Data-Header-Indication is set: ME/TA converts each 8-bit octet into two
IRA character long hexadecimal number (e.g. octet with integer value 42 is presented to TE as
two characters 2A (IRA 50 and 65))
In the case of CBS: 3GPP TS 23.041 [9] CBM Content of Message in text mode responses;
format:
• if <dcs> indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used:
o if TE character set other than "HEX" (see +CSCS command description): ME/TA converts
GSM alphabet into current TE character set according to rules of Annex A
o if TE character set is "HEX": ME/TA converts each 7-bit character of the GSM 7 bit default
alphabet into two IRA character long hexadecimal number
• if <dcs> indicates that 8-bit or UCS2 data coding scheme is used: ME/TA converts each 8-bit
octet into two IRA character long hexadecimal number
<da> String Destination address
<toda> Number Type of address of <da> - octet
<vp> Number Format depending of the <fo> setting:
• Relative format: validity period starting from when the SMS is received by the SMSC, in range
0-255 (default value 167); for more details see the 3GPP TS 23.040 [8]
<vp> Validity period value
0 to 143 (TP-VP + 1) x 5 minutes (i.e. 5 minutes intervals
up to 12 hours)
144 to 167 12 hours + ((TP-VP -143) x 30 minutes)
168 to 196 (TP-VP - 166) x 1 day
197 to 255 (TP-VP - 192) x 1 week

• Absolute format: absolute time of the validity period termination in string format ("yy/MM/dd,
hh:mm:ss+zz") (see the 3GPP TS 23.040 [8]); the time zone is expressed in steps of 15 minutes.
The range goes from -48 to +56
<mr> Number Message reference
<ra> String Recipient address field
<tora> Number Type of address of <ra> - octet
<dt> String Discharge time in format "yy/MM/dd,hh:mm:ss+zz"; the time zone is expressed in steps of 15
minutes. The range goes from -48 to +56
<st> Number Status of an SMS STATUS-REPORT
<ct> Number TP-Command-Type (default 0)
<mn> Number See the 3GPP TS 23.040 [8] TP-Message-Number in integer format
<cdata> String TP-Command-Data in text mode responses
<sn> Number CBM serial number
<mid> Number CBM message identifier
<page> Number 3GPP TS 23.041 [9] CBM Page Parameter bits 4-7 in integer format
<pages> Number 3GPP TS 23.041 [9] CBM Page Parameter bits 0-3 in integer format
<pdu> String Protocol data unit: each 8-bit octet is presented as two IRA character long hexadecimal numbers,
e.g. octet with integer value 42 is presented to TE as two characters 2A (IRA 50 and 65)

179/206
15.12 New message acknowledgement to MT +CNMA
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No < 150 s +CMS Error

15.12.1 Description
Confirms the reception of a new message (SMS-DELIVER or SMS-STATUS-REPORT) which is routed directly to the
TE (see the +CNMI command). This acknowledgement command shall be used when +CSMS parameter <service>
equals 1. The MT shall not send another +CMT or +CDS (see the +CNMI command) unsolicited result codes to
the TE before the previous one is acknowledged. If the MT does not get acknowledgement within required time
(network timeout), the MT should respond as specified in 3GPP TS 24.011 [13] to the network. The MT shall
automatically disable routing to the TE by setting both <mt> and <ds> values of +CNMI to zero. If the command
is executed, but no acknowledgement is expected, or some other MT related error occurs, the final result code
+CMS ERROR: <err> is returned.
In PDU mode, it is possible to send either positive (RP-ACK) or negative (RP-ERROR) acknowledgement to the
network. The <n> parameter defines which one will be sent. Optionally (when <length> is greater than zero)
an acknowledgement TPDU (SMS-DELIVER-REPORT for RP-ACK or RP-ERROR) may be sent to the network. The
entering of PDU is done similarly as specified in +CMGS command, except that the format of <ackpdu> is used
instead of <pdu> (i.e. SMSC address field is not present). The PDU shall not be bounded by double quotes.

15.12.2 Syntax
Type Syntax Response Example
Set Text mode (+CMGF=1): OK AT+CNMA
AT+CNMA OK
PDU mode (+CMGF=0): OK AT+CNMA=1,5
AT+CNMA[=<n>[,<length> [PDU is >0007000000 <Ctrl-Z>
given<Ctrl-Z>/<ESC>]]]
OK
Test AT+CNMA=? Text mode (+CMGF=1): OK
OK
PDU mode (+CMGF=0): +CNMA: (0-2)
+CNMA: (list of supported <n>s) OK
OK

15.12.3 Defined values
Parameter Type Description
<n> Number • 0: the command operates similarly as defined for the text mode
• 1: sends RP-ACK (or buffered result code received correctly)
• 2: sends RP-ERROR (if PDU is not given, ME/TA shall send SMS-DELIVER-REPORT with 3GPP TS
23.040 [8] TP-FCS value set to 'FF' (unspecified error cause))
<length> Number PDU's length in octets without the Service Center's address

180/206
15.13 List message +CMGL
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No Up to 3 min (<1 +CMS Error
s for prompt ">"
when present)

15.13.1 Description
Returns SMS messages with status value <stat> from message storage <mem1> to the DTE. Some are displayed
only when setting +CSDH=1 (see +CSDH, Chapter 11.7). If status of the received message is "received unread",
status in the storage changes to "received read".

15.13.2 Syntax
Type Syntax Response Example
Set Text mode (+CMGF=1): Command successful and SMS-DELIVERs: AT+CMGL
AT+CMGL[=<stat>] +CMGL: <index>,<stat>,<oa>,[<alpha>], +CMGL: 303,"REC READ","+39340
[<scts>][,<tooa>,<length>] 1234999",,"08/08/06,10:01:38+08"
<data> You have a missed called. Free
information provided by your operator.
[+CMGL: <index>,<stat>,<oa>,
[<alpha>],[<scts>][,<tooa>, OK
<length>]<data>[...]]
OK
Command successful and SMS-SUBMITs:
+CMGL: <index>,<stat>,<da>,[<alpha>],
[<toda>, <length>]
<data>
[+CMGL: <index>,<stat>,<da>,
[<alpha>],[<toda>, <length>]<data>[...]]
OK
Command successful and SMS-STATUS-
REPORTs:
+CMGL: <index>,<stat>,<fo>,<mr>,
[<ra>],[<tora>],<scts>,<dt>,<st>
[+CMGL: <index>,<stat>,<fo>,<mr>,
[<ra>],[<tora>],<scts>,<dt>,<st> [...]]
OK
Command successful and SMS-
COMMANDs:
+CMGL: <index>,<stat>,<fo>,<ct>
[+CMGL: <index>,<stat>,<fo>,<ct>[...]]
OK
Command successful and CBM storage:
+CMGL: <index>,<stat>,<sn>,<mid>,
<page>,<pages><data>
[+CMGL: <index>,<stat>,<sn>,<mid>,
<page>,<pages>,<data>[...]]
OK
PDU mode (+CMGF=0): Command successful: AT+CMGL=1

181/206
Type Syntax Response Example
AT+CMGL[=<stat>] +CMGL: <index>,<stat>,[<alpha>], +CMGL: 305,1,,57 079193432900
<length> 1185440ED0D637396C7EBBCB000090
9092708024802A050003000303DEA0
<pdu>
584CE60205D974791994769BDF3A90
[+CMGL: <index>,<stat>,[<alpha>], DB759687E9F534FD0DA2C9603419
<length>]
OK
<pdu> [...]

Test AT+CMGL=? +CMGL: (list of supported <stat>s) +CMGL: ("REC UNREAD","REC READ",
"STO UNSENT","STO SENT","ALL")
OK
OK

15.13.3 Defined values
Parameter Type Description
<stat> Number or Number type in PDU mode (default value: 4), or string type in text mode (default value: "ALL");
String indicates the status of message in memory
• 0: in PDU mode or "REC UNREAD" in text mode: received unread SMS messages
• 1: in PDU mode or "REC READ" in text mode: received read SMS messages
• 2: in PDU mode or "STO UNSENT" in text mode: stored unsent SMS messages
• 3: in PDU mode or "STO SENT" in text mode: stored sent SMS messages
• 4: in PDU mode or "ALL" in text mode: all SMS messages
<index> Number Storage position
<oa> String Originator address
<alpha> String Alphanumeric representation of <da> or <a> corresponding to the entry found in the
phonebook 3GPP TS 24.008 [12]. The parameter is not managed.
<scts> String Service center time stamp in time-string format; refer to <dt>
<tooa> Number Type of address of <oa> - octet
<length> Number Two meanings:
• in text mode: number of characters
• in PDU mode: PDU's length in octets without the Service Center's address. In example 0
39121430100038166F6000004E374F80D: this is a PDU with Service Center's number +1234,
that generates the address 03912143 (4 octets). Thus in this case <length> = 13.
<data> String This is the TP-User-Data in text mode; the decoding depends on the DCS (Data Coding Scheme)
and the FO (First Octect) of the SMS header 3GPP TS 23.040 [8]; format:
• if DCS indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used and FO indicates
that 3GPP TS 23.040 [8] TP-User-Data-Header-Indication is not set:
o if TE character set other than "HEX" (refer command Select TE Character Set +CSCS in
3GPP TS 27.007 [2]): ME/TA converts GSM alphabet into current TE character set according
to rules of Annex A
o if TE character set is "HEX": ME/TA converts each 7-bit character of GSM 7 bit default
alphabet into two IRA character long hexadecimal number (e.g. character TODO: what
character should go here? (GSM 7 bit default alphabet 23) is presented as 17 (IRA 49 and
55))
• if DCS indicates that 8-bit or UCS2 data coding scheme is used, or FO indicates that 3GPP TS
23.040 [8] TP-User-Data-Header-Indication is set: ME/TA converts each 8-bit octet into two IRA
character long hexadecimal number (e.g. octet with integer value 42 is presented to TE as two
characters 2A (IRA 50 and 65))
In the case of CBS: 3GPP TS 23.041 [9] CBM Content of Message in text mode responses;
format:
• if DCS indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used:
o if TE character set other than "HEX" (refer command +CSCS in 3GPP TS 27.007 [2]): ME/
TA converts GSM alphabet into current TE character set according to rules of Annex A
o if TE character set is "HEX": ME/TA converts each 7-bit character of the GSM 7 bit default
alphabet into two IRA character long hexadecimal number
if DCS indicates that 8-bit or UCS2 data coding scheme is used: ME/TA converts each 8-bit octet
into two IRA character long hexadecimal number
<da> String Destination address
<toda> Number Type of address of <da> - octet
<fo> Number First octet of the SMS TPDU (see 3GPP TS 23.040 [8])

182/206
Parameter Type Description
<mr> Number Message reference
<ra> String Recipient address field
<tora> Number Type of address of <ra> - octet
<dt> String Discharge time in format "yy/MM/dd,hh:mm:ss+zz"; the time zone is expressed in steps of 15
minutes. The range goes from -48 to +56
<st> Number Status of an SMS STATUS-REPORT
<ct> Number TP-Command-Type (default 0)
<sn> Number CBM serial number
<mid> Number CBM message identifier
<page> Number 3GPP TS 23.041 [9] CBM Page Parameter bits 4-7 in integer format
<pages> Number 3GPP TS 23.041 [9] CBM Page Parameter bits 0-3 in integer format
<pdu> String Protocol data unit: each 8-bit octet is presented as two IRA character long hexadecimal numbers,
e.g. octet with integer value 42 is presented to TE as two characters 2A (IRA 50 and 65)
<dcs> Number Data Coding Scheme

15.14 Send message +CMGS

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No Up to 3 min (<1 +CMS Error
s for prompt ">"
when present)

15.14.1 Description
Sends a message from a DTE to the network (SMS-SUBMIT). The message reference value <mr> is returned to
the DTE for a successful message delivery. <Ctrl-Z> indicates that the SMS shall be sent, while <ESC> indicates
aborting of the edited SMS.
The entered text/PDU is preceded by a ">" (Greater-Than sign) character, and this indicates that the
interface is in "text/PDU enter" mode. The DCD signal shall be in ON state while the text/PDU is entered.

15.14.2 Syntax
Type Syntax Response Example
Set Text mode (+CMGF=1): +CMGS: <mr> AT+CMGS="0171112233"<CR>
AT+CMGS=<da>[,<toda>]<CR> OK > This is the text<Ctrl-Z>
text is entered<Ctrl-Z/ESC> +CMGS:2
OK
PDU mode (+CMGF=0): +CMGS: <mr> AT+CMGS=13<CR>
AT+CMGS=<length><CR> OK > 039121430100038166F600000
4E374F80D<Ctrl-Z>
PDU is given<Ctrl-Z/ESC>
+CMGS:2
OK
Test AT+CMGS=? OK

15.14.3 Defined values
Parameter Type Description
<da> String Destination address
<toda> Number Type of address of <da> - octet
<text> String SMS String

183/206
Parameter Type Description
<stat> Number or Number type in PDU mode (default value: 2), or string type in text mode (default value: "STO
String UNSENT"); indicates the status of message in memory
• 0: in PDU mode or "REC UNREAD" in text mode: received unread SMS messages
• 1: in PDU mode or "REC READ" in text mode: received read SMS messages
• 2: in PDU mode or "STO UNSENT" in text mode: stored unsent SMS messages
• 3: in PDU mode or "STO SENT" in text mode: stored sent SMS messages
<text> String SMS String
<index> Number Storage position
<length> Number Two meanings:
• in text mode: number of characters
• in PDU mode: PDU's length in octets without the Service Center's address. In example: 0
39121430100038166F6000004E374F80D is a PDU with Service Center's number +1234, that
generates the address 03912143 (4 octets). Thus in this case <length>=13.
<PDU> String Protocol Data Unit: each 8-bit octet of the PDU must be written as two IRA character long
hexadecimal numbers, e.g. octet with integer value 42 must be written as two characters 2A (IRA
50 and 65)

15.15 Write message to memory +CMGW

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No <10 s +CMS Error

15.15.1 Description
Stores a message (SMS-DELIVER or SMS-SUBMIT) to memory storage <mem2> and returns the memory location
<index> of the stored message. <Ctrl-Z> indicates that the SMS shall be stored, while <ESC> indicates aborting
of the edited SMS.
The entered text/PDU is preceded by a ">" (Greater-Than sign) character, and this indicates that the
interface is in "text/PDU enter" mode. The DCD signal shall be in ON state while the text/PDU is entered.

15.15.2 Syntax
Type Syntax Response Example
Set Text mode (+CMGF=1): +CMGW: <index> AT+CMGW="091137880"<CR>
AT+CMGW[=<oa/da>[,<tooa/toda>[, OK > This is the text<Ctrl-Z>
<stat>]]]<CR>
+CMGW:303
text is entered<Ctrl-Z/ESC>
OK
PDU mode (+CMGF=0): +CMGW: <index> AT+CMGW=13<CR>
AT+CMGW=<length>[,<stat>]<CR> OK > 039121430100038166F600000
4E374F80D<Ctrl-Z>
PDU is given<Ctrl-Z/ESC>
+CMGW:303
OK
Test AT+CMGW=? OK

184/206
15.15.3 Defined values
Parameter Type Description
<da> String 3GPP TS 23.040 [3] TP-Destination-Address Address-Value field in string format; BCD numbers
(or GSM 7 bit default alphabet characters) are converted to characters of the currently selected
TE character set (refer command +CSCS in 3GPP TS 27.007 [9]); type of address given by <toda>
<oa> String 3GPP TS 23.040 [8] TP-Originating-Address Address-Value field in string format; BCD numbers
(or GSM 7 bit default alphabet characters) are converted to characters of the currently selected
TE character set (refer command +CSCS in 3GPP TS 27.007 [2]); type of address given by <tooa>
<tooa> Number 3GPP TS 24.011 [13] TP-Originating-Address Type-of-Address octet in integer format (default
value: refer to <toda>)
<toda> Number 3GPP TS 24.011 [13] TP-Destination-Address Type-of-Address octet in integer format (when first
character of <da> is + (IRA 43) default is 145, otherwise default is 129)
<stat> Number or Number type in PDU mode (default value: 2), or string type in text mode (default value: "STO
String UNSENT"); indicates the status of message in memory
• 0: in PDU mode or "REC UNREAD" in text mode: received unread SMS messages
• 1: in PDU mode or "REC READ" in text mode: received read SMS messages
• 2: in PDU mode or "STO UNSENT" in text mode: stored unsent SMS messages
• 3: in PDU mode or "STO SENT" in text mode: stored sent SMS messages
<text> String SMS String
<index> Number Storage position
<length> Number Two meanings:
• in text mode: number of characters
• in PDU mode: PDU's length in octets without the Service Center's address. In example: 0
39121430100038166F6000004E374F80D is a PDU with Service Center's number +1234, that
generates the address 03912143 (4 octets). Thus in this case <length>=13.
<PDU> String Protocol Data Unit: each 8-bit octet of the PDU must be written as two IRA character long
hexadecimal numbers, e.g. octet with integer value 42 must be written as two characters 2A (IRA
50 and 65)

15.16 Send message from storage +CMSS

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No Up to 3 min (<1 +CMS Error
s for prompt ">"
when present)

15.16.1 Description
Sends message with location value <index> from the preferred message storage <mem2> to the network (SMS-
SUBMIT or SMS-COMMAND). If a new recipient address <da> is given for SMS-SUBMIT, it will be used instead of
the one stored with the message. Reference value <mr> is returned to the DTE on successful message delivery.

15.16.2 Syntax
Type Syntax Response Example
Set Text mode (+CMGF=1): +CMSS: <mr> AT+CMSS=302
AT+CMSS=<index>[,<da>[,<toda>]] OK +CMSS: 3
OK
PDU mode (+CMGF=0): +CMSS: <mr> AT+CMSS=302
AT+CMSS=<index> OK +CMSS: 4
OK
Test AT+CMSS=? OK

15.16.3 Defined values
Parameter Type Description
<index> Number Storage position
<da> String Destination address
<toda> Number Type of address of <da> - octet
<mr> Number Message reference

185/206
15.17 Set text mode parameters +CSMP
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No < 10 s +CMS Error

15.17.1 Description
Selects values for additional parameters needed when an SMS is sent to the network or placed in a storage when
text format message mode is selected. For more details see the 3GPP TS 23.038 [7] and the 3GPP TS 23.040 [8].

15.17.2 Syntax
Type Syntax Response Example
Set AT+CSMP=<fo>,<vp>[,<pid>[,<dcs>]] OK AT+CSMP=17,167,0,0
OK
Read AT+CSMP? +CSMP: <fo>,<vp>,<pid>,<dcs> +CSMP: 17,167,0,0
OK OK
Test AT+CSMP=? OK

15.17.3 Defined values
Parameter Type Description
<fo> Number First octet of the SMS TPDU (see 3GPP TS 23.040 [8])
<vp> Number Format depending on the values of the bit3/bit4 of the <fo> (SMS-SUBMIT case):
bit 3 bit 4 Format
0 0 Validity period not present
0 1 Validity period present, relative
format
1 0 Reserved
1 1 Validity period present,
absolute format

• Relative format: validity period, counted from when the SMS-SUBMIT is received by the SMSC,
in range 0-255 (the default value is 167); for more details see the 3GPP TS 23.040 [8]
<vp> Validity period value
0 to 143 (TP-VP + 1) x 5 minutes (i.e. 5 minutes intervals
up to 12 hours)
144 to 167 12 hours + ((TP-VP -143) x 30 minutes)
168 to 196 (TP-VP - 166) x 1 day
197 to 255 (TP-VP - 192) x 1 week

• Absolute format: absolute time of the validity period termination in string format ("yy/MM/dd,
hh:mm:ss+zz") (see the 3GPP TS 23.040 [8]); the time zone is expressed in steps of 15 minutes.
The range goes from -48 to +56
<pid> Number TP-Protocol-Identifier (default value: 0); see the 3GPP TS 23.040 [8]
<dcs> Number Data Coding Scheme. The default value is 0

15.17.4 Notes
 TOBY-L2 / MPCI-L2
• The absolute format of the validity period is not supported.

186/206
15.18 Delete message +CMGD
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
partial Yes No No < 55 s +CMS Error

15.18.1 Description
Deletes the message from the preferred message storage <mem1 >, if <flag> = 0 or not present, in location
<index>. Otherwise the messages are deleted following the rules specified by <flag>.
When deleting a message from an empty location, the module returns "OK".

If the <index> value is out of range (it depends on AT+CPMS command setting), then the error "+CMS
ERROR: invalid memory index" is returned.

15.18.2 Syntax
Type Syntax Response Example
Set AT+CMGD=<index>[,<flag>] OK AT+CMGD=3
OK
Test AT+CMGD=? +CMGD: (list of supported <index>s),(list +CMGD: (1-350),(0-4)
of supported <flag>s)
OK
OK

15.18.3 Defined values
Parameter Type Description
<index> Number Storage position
<flag> Number Deletion flag. If present, and different from 0, <index> is ignored:
• 0 (default value): delete the message specified in <index>
• 1: delete all the read messages from the preferred message storage, leaving unread messages
and stored mobile originated messages (whether sent or not) untouched
• 2: delete all the read messages from the preferred message storage and sent mobile originated
messages, leaving unread messages and unsent mobile originated messages untouched
• 3: delete all the read messages from the preferred message storage, sent and unsent mobile
originated messages leaving unread messages untouched
• 4: delete all the messages from the preferred message storage including unread messages

15.18.4 Notes
 SARA-G / LEON-G
• The "BM" memory entries cannot be deleted.

187/206
15.19 Primary notification event reporting +CPNER
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full No No No - +CME Error

15.19.1 Description
Configures the reporting of primary notification events when received from the network. Primary notification
events are used for Public Warning Systems like ETWS (Earthquake and Tsunami Warning Systems).
The UE will discard the duplicate primary notification.

The notification is considered a duplicate of the previous if it has equal <message_identifier> and <serial_
number> and arrives from the same PLMN. A primary notification message stored to detect duplication
is automatically cleared after three hours of not receiving any message.

15.19.2 Syntax
Type Syntax Response Example
Set AT+CPNER=<reporting> OK AT+CPNER=1
OK
Read AT+CPNER? +CPNER: <reporting> +CPNER: 1
OK OK
Test AT+CPNER=? +CPNER: (list of supported <reporting>s) +CPNER: (0-1)
OK OK
URC +CPNERU: <message_identifier>,<serial_
number>,<warning_type>

15.19.3 Defined values
Parameter Type Description
<reporting> Number Configures the reporting of primary notification events:
• 0 (factory-programmed value): primary notification events disabled
• 1: primary notification events enabled
<message_identifier> String Hexadecimal character format. It contains the message identifier (2 bytes) of the primary
notification
<serial_number> String Hexadecimal character format. It contains the serial number (2 bytes) of the primary notification
<warning_type> String Contains the warning type (2 bytes) of the primary notification.

15.20 Service center address +CSCA

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No < 10 s +CMS Error

15.20.1 Description
Updates the SMSC address, through which mobile originated SMSes are transmitted. In text mode the setting is
used by send and write commands. In PDU mode the setting is used by the same commands, but only when the
length of SMSC address coded into <pdu> parameter equals zero.

This command sets the service center value both in the RAM (this value is actually the SMSC address used)
and in the SIM card. Through the read command the value of current service center stored in the RAM
is displayed. At the power on, the MT reads the SMSC address in the SIM card and the same value is
set in RAM.

188/206
15.20.2 Syntax
Type Syntax Response Example
Set AT+CSCA=<sca>[,<tosca>] OK AT+CSCA="0170111000",129
OK
Read AT+CSCA? +CSCA: <sca>,<tosca> +CSCA: "",129
OK OK
Test AT+CSCA=? OK

15.20.3 Defined values
Parameter Type Description
<sca> String Service center address
<tosca> String Type of address of <sca> (for more details refer to 3GPP TS 24.008 [12]); default 145 when
string includes '+', otherwise default 129

15.21 Select cell broadcast message types +CSCB

+CSCB
Modules SARA-G300 SARA-G310 SARA-G340-00S SARA-G340-01S SARA-G350-00S SARA-G350-00X SARA-G350-01B SARA-
G350-01S LEON-G
LISA-U SARA-U
TOBY-L200 TOBY-L201 TOBY-L210-00S TOBY-L210-02S TOBY-L210-50S TOBY-L210-60S TOBY-L220 TOBY-L280
MPCI-L2
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No < 10 s +CMS Error

15.21.1 Description
Selects which types of CBM's are to be received by the MT.

15.21.2 Syntax
Type Syntax Response Example
Set AT+CSCB=[<mode>[,<mids>[,<dcss>]]] OK AT+CSCB=0,"1,5,10-11,40",""
OK
Read AT+CSCB? +CSCB: <mode>,<mids>,<dcss> +CSCB: 0,"",""
OK OK
Test AT+CSCB=? +CSCB: (list of supported <mode>s) +CSCB: (0-1)
OK OK

15.21.3 Defined values
Parameter Type Description
<mode> Number • 0: message types specified in <mids> and <dcss> accepted
• 1: message types specified in <mids> and <dcss> not accepted
<mids> String Contains all possible combinations of CBM message identifiers (<mid>). See the 3GPP TS 23.0
41 [9], chapter 9.4. When RAT is UMTS up to 2048 message identifiers can be set; defining an
exceeding combination will not cause an error result code and exceeding values will be ignored.
<dcss> String Contains all possible combinations of CBM data coding schemes (<dcs>). See the 3GPP TS 23.0
38 [7], chapter 5

189/206
15.21.4 Notes
• If <mode>=0 and <mids> is an empty string, receiving of CB SMS is stopped.
 TOBY-L2 / MPCI-L2
• The modules read on boot the files below from the USIM and they configure the CBM reception accordingly:
o EFCBMID (Cell Broadcast Message Identifier for Data Download): this EF contains the message identifier
parameters which specify the type of content of the cell broadcast messages which are to be passed
to the USIM.
o EFCBMI (Cell Broadcast Message identifier selection): this EF contains the Message Identifier Parameters
which specify the type of content of the cell broadcast messages that the subscriber wishes the UE
to accept.
o EFCBMIR (Cell Broadcast Message Identifier Range selection): this EF contains ranges of cell broadcast
message identifiers that the subscriber wishes the UE to accept.
• The maximum number of <mids> is 30.
• These commands perform these actions:
o AT+CSCB=0 enables all the indications
o AT+CSCB=1 disables all the indications
• To activate a custom range of mids perform the following actions:
1. Power on the module, insert a valid SIM and insert its PIN (if needed).
2. Read the current SIM configuration with AT+CSCB read command
3. Modify the configuration by adding or removing some <mids> and/or <dcss> ranges.
4. Enabling or disabling the reception of all <mids> and <dcss> will be stored in NVM, but not in SIM
due to SIM data storage limitations.
5. If the list must be modified after having enabled or disabled everything add or remove a <mids> or
<dcss>, re-read the configuration with the AT+CSCB read command and then set it as needed.
 LISA-U1
• When RAT is UMTS up to 1024 message identifiers can be set.

15.22 Read concatenated message +UCMGR

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No Up to 3 min +CMS Error

15.22.1 Description
Returns the message with location value <index> from message storage <mem1> to the DTE and shows additional
information when the message is a segment of a concatenated one.

For SMS-DELIVER the parameters <tooa>, <fo>, <pid>, <dcs>, <sca>, <tosca>, <length> shall be
displayed only if +CSDH=1 is set.
For SMS-SUBMIT the parameters <toda>, <fo>, <pid>, <dcs>, <vp>, <sca>, <tosca>, <length> shall be
displayed only if +CSDH=1 is set.
For SMS-COMMAND <pid>, <mn>, <da>, <toda>, <length> <cdata> shall be displayed only if +CSDH=1
is set.
The syntax AT+UCMGR=0 allows to display an SMS class 0 if it is signalized to MT, because no MMI is
available in the MT (see also the note from command +CNMI, Chapter 11.8).
If status of the received message is "received unread", status in the storage changes to "received read".

The command is supported only for text mode (+CMGF=1).

190/206
 If the <index> value is out of range (it depends on the preferred message storage, +CPMS command,
settings) or it refers to an empty position, then the "+CMS ERROR: invalid memory index" error result
code is returned.

15.22.2 Syntax
Type Syntax Response Example
Set AT+UCMGR=<index> (SMS-DELIVER) AT+UCMGR=1
+UCMGR: <stat>,<oa>,[<alpha>], +UCMGR:"REC READ",
<scts>[,<tooa>, <fo>,<pid>,<dcs>, "+393488535999",,"07/04/05,18:0
<sca>,<tosca>,<length>][,<seq>,<max>, 2:28+08",145,4,0,0,"+393492000466",
<iei>,<ref>] 145,153,1,2,0,127
<data> u-blox reserves all rights to this document
and the information contained herein.
OK
Reproduction, use or disclosure to third
(SMS-SUBMIT) parties without express permis
+UCMGR: <stat>,<da>,[<alpha>] OK
[<toda>,<fo>,<pid>,<dcs>,[<vp>],<sca>,
<tosca>,<length>][,<seq>,<max>,<iei>,
<ref>]
<data>
OK
(SMS-STATUS-report)
+UCMGR:<stat>,<fo>,<mr>,[<ra>],
[<tora>]<scts><dt>,<st>
OK
(SMS-COMMAND)
+UCMGR: <stat>,<fo>,<ct>[,<pid>,
[<mn>],[<da>],[<toda>],<length>
[<cdata>]]
OK
(CBM storage)
+UCMGR: <stat>,<sn>,<mid>,<dcs>,
<page>,<pages>
<data>
OK
Test AT+UCMGR=? OK

15.22.3 Defined values
Parameter Type Description
<index> Number Storage position
<stat> String Indicates the status of message in memory:
• "REC UNREAD": received unread SMS
• "REC READ": received read SMS
• "STO UNSENT": stored unsent SMS
• "STO SENT": stored sent SMS
<oa> String Originator address
<alpha> String Alphanumeric representation of <da> or <oa> corresponding to the entry found in the
phonebook 3GPP TS 24.008 [12]. The parameter is not managed.
<scts> String Service center time stamp in time-string format, refer to <dt>
<tooa> Number Type of address of <oa> - octet
<fo> Number First octet of the SMS TPDU (see 3GPP TS 23.040 [8])
<pid> Number TP-Protocol-Identifier (default 0); refer to 3GPP TS 23.040 [8]
<dcs> Number Data Coding Scheme

191/206
Parameter Type Description
<sca> String Service center address field
<tosca> Number Type of address of <sca> - octet in Number format (for more details refer to 3GPP TS 24.008
[12]); default 145 when string includes '+', otherwise default 129
<length> Number Number of characters
<seq> Number Sequence number of the current short message (1-255)
<max> Number Maximum number of short messages in the concatenated short message (1-255)
<iei> Number Information Element Identifier, the possible values are the following:
• 0: Concatenated short messages, 8-bit reference number
• 8: Concatenated short messages, 16-bit reference number
<ref> Number Concatenated short message reference number:
• 0-255: Concatenated short messages, 8-bit reference number case
• 0-65535: Concatenated short messages, 16-bit reference number case
<data> String In the case of SMS: 3GPP TS 23.040 [8] TP-User-Data in text mode responses; format:
• if <dcs> indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used and <fo> indicates
that 3GPP TS 23.040 [8] TP-User-Data-Header-Indication is not set:
o if TE character set other than "HEX" (refer command Select TE Character Set +CSCS
Chapter 4.10): ME/TA converts GSM alphabet into current TE character set according to
rules of 3GPP TS 27.005 [16] Annex A
o if TE character set is "HEX": ME/TA converts each 7-bit character of GSM 7 bit default
alphabet into two IRA character long hexadecimal number (e.g. character TODO: what
character should go here? (GSM 7 bit default alphabet 23) is presented as 17 (IRA 49 and
55))
• if <dcs> indicates that 8-bit or UCS2 data coding scheme is used, or <fo> indicates that 3GPP
TS 23.040 [8] TP-User-Data-Header-Indication is set: ME/TA converts each 8-bit octet into two
IRA character long hexadecimal number (e.g. octet with integer value 42 is presented to TE as
two characters 2A (IRA 50 and 65))
In the case of CBS: 3GPP TS 23.041 [9] CBM Content of Message in text mode responses;
format:
• if <dcs> indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used:
o if TE character set other than "HEX" (refer command +CSCS chapter 26.15): ME/TA
converts GSM alphabet into current TE character set according to rules of 3GPP TS 27.0
05 [16] Annex A
o if TE character set is "HEX": ME/TA converts each 7-bit character of the GSM 7 bit default
alphabet into two IRA character long hexadecimal number
if <dcs> indicates that 8-bit or UCS2 data coding scheme is used: ME/TA converts each 8-bit
octet into two IRA character long hexadecimal number
<da> String Destination address
<toda> Number Type of address of <da> - octet
<vp> Number Format depending of the <fo> setting:
• Relative format: validity period starting from when the SMS is received by the SMSC, in range
0-255 (default value 167); for more details refer to 3GPP TS 23.040 [8]
<vp> Validity period value
0 to 143 (TP-VP + 1) x 5 minutes (i.e. 5 minutes intervals
up to 12 hours)
144 to 167 12 hours + ((TP-VP -143) x 30 minutes)
168 to 196 (TP-VP - 166) x 1 day
197 to 255 (TP-VP - 192) x 1 week

Absolute format: absolute time of the validity period termination in string format ("yy/MM/dd,
hh:mm:ss+zz") (refer to 3GPP TS 23.040 [8]); the time zone is expressed in steps of 15 minutes.
The range goes from -48 to +56
<mr> Number Message reference
<ra> String Recipient address field
<tora> Number Type of address of <ra> - octet
<scts> String Service center time stamp in time-string format, refer to <dt>
<dt> String Discharge time in format "yy/MM/dd,hh:mm:ss+zz"; the time zone is expressed in steps of 15
minutes. The range goes from -48 to +56
<st> Number Status of an SMS STATUS-REPORT

192/206
Parameter Type Description
<ct> Number TP-Command-Type (default 0)
<mn> Number 3GPP TS 23.040 [8] TP-Message-Number in integer format
<mid> Number CBM message identifier
<cdata> String TP-Command-Data in text mode responses
<sn> Number CBM serial number
<page> Number 3GPP TS 23.041 [9] CBM Page Parameter bits 4-7 in integer format
<pages> Number 3GPP TS 23.041 [9] CBM Page Parameter bits 0-3 in integer format

15.23 List concatenated message +UCMGL

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No Up to 3 min (<1 +CMS Error
s for prompt ">"
when present)

15.23.1 Description
Returns SMS messages with status value <stat> from message storage <mem1> to the DTE and shows additional
information when the message is a segment of a concatenated one.

For SMS-DELIVER the parameters <tooa>, <length> shall be displayed only if +CSDH=1 is set.

For SMS-SUBMIT the parameters <toda>, <length> shall be displayed only if +CSDH=1 is set.

If status of the received message is "received unread", status in the storage changes to "received read".

The command is supported only for text mode (+CMGF=1).

15.23.2 Syntax
Type Syntax Response Example
Set AT+UCMGL[=<stat>] SMS-DELIVERs: AT+UCMGL
+UCMGL: <index>,<stat>,<oa>, +UCMGL: 304,"REC READ","+39340
[<alpha>],[<scts>][,<tooa>,<length>][, 1234999",,"08/08/06,10:01:38+08",
<seq>,<max>,<iei>,<ref>] 145,152,1,2,8,32767
<data> u-blox reserves all rights to this document
and the information contained herein.
[+UCMGL: <index>,<stat>,<oa>,
Reproduction, use or disclosure to third
[<alpha>],[<scts>][,<tooa>,<length>][,
parties without express permi
<seq>,<max>,<iei>,<ref>]<data>[...]]
+UCMGL: 305,"REC READ","+39340
OK
1234999",,"08/08/06,10:01:40+08",
145,29,2,2,8,32767
ssion is strictly prohibited.
OK
SMS-SUBMITs:
+UCMGL: <index>,<stat>,<da>,
[<alpha>],[<toda>, <length>][,<seq>,
<max>,<iei>,<ref>]
<data>
[+UCMGL: <index>,<stat>,<da>,
[<alpha>],[<toda>,<length>][,<seq>,
<max>,<iei>,<ref>]<data>[...]]
OK
SMS-STATUS-REPORTs:

193/206
Type Syntax Response Example
+UCMGL: <index>,<stat>,<fo>,<mr>,
[<ra>],[<tora>],<scts>,<dt>,<st>
[+UCMGL: <index>,<stat>,<fo>,<mr>,
[<ra>],[<tora>],<scts>,<dt>,<st> [...]]
OK
SMS-COMMANDs:
+UCMGL: <index>,<stat>,<fo>,<ct>
[+UCMGL: <index>,<stat>,<fo>,<ct>[...]]
OK
CBM storage:
+UCMGL: <index>,<stat>,<sn>,<mid>,
<page>,<pages><data>
[+UCMGL: <index>,<stat>,<sn>,<mid>,
<page>,<pages>,<data>[...]]
OK
Test AT+UCMGL=? +UCMGL: (list of supported <stat>s) +UCMGL: ("REC UNREAD","REC READ",
"STO UNSENT","STO SENT","ALL ")
OK
OK

15.23.3 Defined values
Parameter Type Description
<stat> String Indicates the status of message in memory:
• "REC UNREAD": received unread SMS messages
• "REC READ": received read SMS messages
• "STO UNSENT": stored unsent SMS messages
• "STO SENT": stored sent SMS messages
• "ALL": all SMS messages (default value)
<index> Number Storage position
<oa> String Originator address
<alpha> String Alphanumeric representation of <da> or <oa> corresponding to the entry found in the
phonebook 3GPP TS 24.008 [12]. The parameter is not managed.
<scts> String Service center time stamp in time-string format; refer to <dt>
<tooa> Number Type of address of <oa> - octet
<length> Number Number of characters
<seq> Number Sequence number of the current short message (1-255)
<max> Number Maximum number of short messages in the concatenated short message (1-255)
<iei> Number Information Element Identifier, the possible values are the following:
• 0: Concatenated short messages, 8-bit reference number
• 8: Concatenated short messages, 16-bit reference number
<ref> Number Concatenated short message reference number:
• 0-255: Concatenated short messages, 8-bit reference number case
• 0-65535: Concatenated short messages, 16-bit reference number case
<data> String In the case of SMS: 3GPP TS 23.040 [8] TP-User-Data in text mode responses; format:
• if <dcs> indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used and <fo> indicates
that 3GPP TS 23.040 [8] TP-User-Data-Header-Indication is not set:
o if TE character set other than "HEX" (refer command Select TE Character Set +CSCS
chapter 26.15): ME/TA converts GSM alphabet into current TE character set according to
rules of 3GPP TS 27.005 Annex A [16]
o if TE character set is "HEX": ME/TA converts each 7-bit character of GSM 7 bit default
alphabet into two IRA character long hexadecimal number (e.g. character TODO: what
character should go here? (GSM 7 bit default alphabet 23) is presented as 17 (IRA 49 and
55))
• if <dcs> indicates that 8-bit or UCS2 data coding scheme is used, or <fo> indicates that 3GPP
TS 23.040 [8] TP-User-Data-Header-Indication is set: ME/TA converts each 8-bit octet into two

194/206
Parameter Type Description
IRA character long hexadecimal number (e.g. octet with integer value 42 is presented to TE as
two characters 2A (IRA 50 and 65))
In the case of CBS: 3GPP TS 23.041 [9] CBM Content of Message in text mode responses;
format:
• if <dcs> indicates that 3GPP TS 23.038 [7] GSM 7 bit default alphabet is used:
o if TE character set other than "HEX" (refer command +CSCS chapter 26.15): ME/TA
converts GSM alphabet into current TE character set according to rules of 3GPP TS 27.0
05 [16]Annex A
• if TE character set is "HEX": ME/TA converts each 7-bit character of the GSM 7 bit default
alphabet into two IRA character long hexadecimal number
if <dcs> indicates that 8-bit or UCS2 data coding scheme is used: ME/TA converts each 8-bit
octet into two IRA character long hexadecimal number
<da> String Destination address
<toda> Number Type of address of <da> - octet
<fo> Number First octet of the SMS TPDU (see 3GPP TS 23.040 [8])
<mr> Number Message reference
<ra> String Recipient address field
<tora> Number Type of address of <ra> - octet
<dt> String Discharge time in format "yy/MM/dd,hh:mm:ss+zz"; the time zone is expressed in steps of 15
minutes. The range goes from -48 to +56
<st> Number Status of an SMS STATUS-REPORT
<ct> Number TP-Command-Type (default 0)
<sn> Number CBM serial number
<mid> Number CBM message identifier
<page> Number 3GPP TS 23.041 [9] CBM Page Parameter bits 4-7 in integer format
<pages> Number 3GPP TS 23.041 [9] CBM Page Parameter bits 0-3 in integer format
<dcs> Number Data Coding Scheme

15.24 Send concatenated message +UCMGS

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No Up to 3 min (<1 +CMS Error
s for prompt ">"
when present)

15.24.1 Description
Sends one segment of a concatenated message from a DTE to the network (SMS-SUBMIT). The message reference
value <mr> is returned to the DTE for a successful message delivery. <Ctrl-Z> indicates that the SMS shall be sent,
while <ESC> indicates aborting of the edited SMS.
The command is supported only for text mode (+CMGF=1).

The entered text is preceded by a ">" (Greater-Than sign) character, and this indicates that the interface
is in "text enter" mode. The DCD signal shall be in ON state while the text is entered.

15.24.2 Syntax
Type Syntax Response Example
Set AT+UCMGS=<da>,[<toda>],<seq>, +UCMGS: <mr> AT+UCMGS="0171112233",,1,2,0,
<max>,<iei>,<ref><CR> 127<CR>
OK
text is entered<Ctrl-Z/ESC> > u-blox reserves all rights to thi
document and the information contained
herein. Reproduction, use or disclosure to
third parties without express permis<Ctrl-
Z>

195/206
Type Syntax Response Example
+UCMGS:2
OK
AT+UCMGS="0171112233",,2,2,0,
127<CR>
> sion is strictly prohibited.<Ctrl-Z
+UCMGS:3
OK
Test AT+UCMGS=? OK

15.24.3 Defined values
Parameter Type Description
<da> String Destination address
<toda> Number Type of address of <da> - octet
<seq> Number Sequence number of the current short message (1-255)
<max> Number Maximum number of short messages in the concatenated short message (1-255)
<iei> Number Information Element Identifier, the possible values are the following:
• 0: Concatenated short messages, 8-bit reference number
• 8: Concatenated short messages, 16-bit reference number
<ref> Number Concatenated short message reference number:
• 0-255: Concatenated short messages, 8-bit reference number case
• 0-65535: Concatenated short messages, 16-bit reference number case
<text> String SMS String
<mr> Number Message reference

15.25 Write concatenated message to memory +UCMGW

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No < 10 s +CMS Error

15.25.1 Description
Stores one segment of a concatenated message (SMS-DELIVER or SMS-SUBMIT) to memory storage <mem2>
and returns the memory location <index> of the stored message. <Ctrl-Z> indicates that the SMS shall be stored,
while <ESC> indicates aborting of the edited SMS.

The command is supported only for text mode (+CMGF=1)

The entered text is preceded by a ">" (Greater-Than sign) character, and this indicates that the interface
is in "text enter" mode. The DCD signal shall be in ON state while the text is entered.

15.25.2 Syntax
Type Syntax Response Example
Set AT+UCMGW=[<oa/da>],[<tooa/toda>], +UCMGW: <index> AT+UCMGW="091137880",,,1,2,8,
[<stat>],<seq>,<max>,<iei>,<ref><CR> 32767<CR>
OK
text is entered<Ctrl-Z/ESC> > u-blox reserves all rights to thi
document and the information contained
herein. Reproduction, use or disclosure to
third parties without express permi<Ctrl-
Z>
+UCMGW:302
OK

196/206
Type Syntax Response Example
AT+UCMGW="091137880",,,2,2,8,
32767<CR>
> ssion is strictly prohibited.<Ctrl-Z
+UCMGW:303
OK
Test AT+UCMGW=? OK

15.25.3 Defined values
Parameter Type Description
<da> String 3GPP TS 23.040 [8] TP-Destination-Address Address-Value field in string format; BCD numbers
(or GSM 7 bit default alphabet characters) are converted to characters of the currently selected
TE character set (refer command +CSCS in 3GPP TS 27.007 [2]); type of address given by <toda>
<oa> String 3GPP TS 23.040 [8] TP-Originating-Address Address-Value field in string format; BCD numbers
(or GSM 7 bit default alphabet characters) are converted to characters of the currently selected
TE character set (refer command +CSCS chapter Chapter 4.10); type of address given by <tooa>
<tooa> Number 3GPP TS 24.011 [13] TP-Originating-Address Type-of-Address octet in integer format (default
refer <toda>)
<toda> Number 3GPP TS 24.011 [13] TP-Destination-Address Type-of-Address octet in integer format (when first
character of <da> is + (IRA 43) default is 145, otherwise default is 129)
<stat> String Indicates the status of message in memory:
• "REC UNREAD": received unread SMS messages
• "REC READ": received read SMS messages
• "STO UNSENT": stored unsent SMS messages
• "STO SENT": stored sent SMS messages (default value)
<seq> Number Sequence number of the current short message (1-255)
<max> Number Maximum number of short messages in the concatenated short message (1-255)
<iei> Number Information Element Identifier, the possible values are the following:
• 0: Concatenated short messages, 8-bit reference number
• 8: Concatenated short messages, 16-bit reference number
<ref> Number Concatenated short message reference number:
• 0-255: Concatenated short messages, 8-bit reference number case
• 0-65535: Concatenated short messages, 16-bit reference number case
<text> String SMS String
<index> Number Storage position

15.26 More messages to send +CMMS

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No - +CMS Error

15.26.1 Description
Controls the continuity of SMS relay protocol link. When enabled, multiple SMS messages can be sent much
faster as link is kept open.

15.26.2 Syntax
Type Syntax Response Example
Set AT+CMMS=[<mode>] OK AT+CMMS=2
OK
Read AT+CMMS? +CMMS: <mode> +CMMS: 2
OK OK
Test AT+CMMS=? +CMMS: (list of supported <mode>s) +CMMS: (0-2)

197/206
Type Syntax Response Example
OK OK

15.26.3 Defined values
Parameter Type Description
<mode> Number • 0 (default value): disabled
• 1: keep enabled until the time between the response of the latest message send command
(such as +CMGS) and the next send command exceeds 5 s, then close the link and switch
<mode> automatically back to 0
• 2: keep permanently enabled. The link is closed after each send sequence, but <mode> is not
switched back to 0

15.27 Peek message +UCMGP

Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full Yes No No Up to 3 min +CMS Error

15.27.1 Description
Returns the message with location value <index> from message storage <mem1> to the DTE, the same as +CMGR
does.
The SMS message is only 'peeked', i.e. its status is not forced to "received read SMS mode" after reading.
The syntax, defined values and remarks are the same as described for +CMGR.
The PIN verification is not required when the preferred memory storage is "ME".

15.27.2 Syntax
Type Syntax Response Example
Set Text mode (+CMGF=1): (SMS-DELIVER) AT+UCMGP=303
AT+UCMGP=<index> +UCMGP: <stat>,<oa>,[<alpha>], +UCMGP: "REC UNREAD",
<scts>[,<tooa>,<fo>,<pid>,<dcs>,<sca>, "+393488535999",,"07/04/05,18:0
<tosca>,<length>] 2:28+08",145,4,0,0,"+393492000466",
145,93
<data>
You have a missed called. Free
OK
information provided by your operator.
(SMS-SUBMIT)
OK
+UCMGP: <stat>,<da>,[<alpha>][,
<toda>,<fo>,<pid>,<dcs>,[<vp>],<sca>,
<tosca>,<length>]
<data>
OK
(SMS-STATUS-report)
+UCMGP: <stat>,<fo>,<mr>,[<ra>],
[<tora>],<scts>,<dt>,<st>
OK
(SMS-COMMAND)
+UCMGP: <stat>,<fo>,<ct>[,<pid>,
[<mn>],[<da>],[<toda>],<length>
[<cdata>]]
OK
(CBM storage)

198/206
Type Syntax Response Example
+UCMGP: <stat>,<sn>,<mid>,<dcs>,
<page>,<pages>
<data>
OK
PDU mode (+CMGF=0): +UCMGP: <stat>,[<alpha>],<length> AT+UCMGP=1
AT+UCMGP=<index> <pdu> +UCMGP: 0,,40
OK 0791934329002000040C9193230982
661400008070328045218018D4F29CF
E06B5CBF379F87C4EBF41E434082E7F
DBC3
OK
Test AT+UCMGP=? OK

15.27.3 Defined values
Parameter Type Description
<index> Number Storage position

15.28 Message waiting indication +UMWI

+UMWI
Modules LISA-U200-01S LISA-U200-02S LISA-U200-03S LISA-U200-52S LISA-U200-62S LISA-U200-82S LISA-U200-83S LISA-
U201 LISA-U230 LISA-U260 LISA-U270 SARA-U
TOBY-L200-02S TOBY-L210-02S TOBY-L220 TOBY-L280-02S MPCI-L200-02S MPCI-L210-02S MPCI-L280
Attributes Syntax PIN required Settings saved Can be aborted Response time Error reference
full No No No - +CME Error

15.28.1 Description
Provides information regarding the Message Waiting Indication (MWI) third level method (3GPP defined in 3GPP
TS 23.040 [8]) and CPHS method [66] following AT&T Device Requirements [61].
The set command enables / disables the URC presentation. The URCs are by default enabled.
MWI is based on specific EFs not present in all SIM cards. In case these EFs are not present, the information text
response is an error result code ("+CME ERROR: operation not allowed" if +CMEE is set to 2) and no URCs will
be displayed.
The URCs are displayed in groups of variable number which depends on the EFs present in the SIM card
3GPP TS 31.102 [19] and Common PCN Handset Specification [66].

15.28.2 Syntax
Type Syntax Response Example
Set AT+UMWI=<mode> OK AT+UMWI=1
OK
Read AT+UMWI? +UMWI: <mode>,<status>,<type>[, +UMWI: 1,0,1
<count>]
+UMWI: 1,0,2
[+UMWI: <mode>,<status>,<type>[,
+UMWI: 1,1,3,255
<count>][...]]
+UMWI: 1,0,4
OK
OK
Test AT+UMWI=? +UMWI: (list of supported <mode>s) +UMWI: (0-1)
OK OK
URC +UMWI: <status>,<type>[,<count>] +UMWI: 1,1,3
[+UMWI: <status>,<type>[,<count>] +UMWI: 1,2,5

199/206
Type Syntax Response Example
[...]] +UMWI: 1,3,255
+UMWI: 0,4

15.28.3 Defined values
Parameter Type Description
<mode> Number Indicates whether the +UMWI URC is enabled or not:
• 0: disable the +UMWI URC
• 1 (factory-programmed value): enable the +UMWI URC
<status> Number Indicator the status for the respective <type>:
• 0: clear; no messages waiting
• 1: set; messages waiting
<type> Number Indicates the basic message indication type:
• 1: Voice Message Waiting (third level method) or Voice Message Waiting on Line 1 (CPHS
method)
• 2: Fax Message Waiting
• 3: Electronic Mail Message Waiting
• 4: Extended Message Type Waiting (i.e. see the 3GPP TS 23.038 [7])
• 5: Video Message Waiting
• 6: Voice Message Waiting on Line 2 (CPHS method)
• 7: reserved for future use
<count> Number Number of messages waiting for the respective <type>, range 1-255. 255 means that the
number of waiting messages is unknown.

15.28.4 Notes
• If <status>=0, the <count> parameter is omitted.

200/206
A Supported Error Codes
The +CME error codes availability is represented in the following tables:
M18Q2 M14A2A
Yes Yes

Table A-1: Error codes supported for +CME

Error Code Error Message
0 Phone failure
1 No connection to phone
2 Phone adaptor link reserved
3 Operation not allowed
4 Operation not supported
5 PH-SIM PIN required
6 PH-FSIM PIN required
7 PH-FSIM PUK required
10 SIM not inserted
11 SIM PIN required
12 SIM PUK required
13 SIM failure
15 SIM wrong
16 Incorrect password
17 SIM PIN2 required
18 SIM PUK2 required
20 Memory full
21 Invalid index
22 Not found
23 Memory failure
24 Text string too long
25 Invalid characters in text string
26 Dial string too long
27 Invalid characters in dial string

201/206
30 No network service
31 Network timeout
32 Network not allowed - emergency calls only
40 Network personalisation PIN required
41 Network personalisation PUK required
42 Network subset personalization PIN required
43 Network subset personalization PUK required
44 Network provider personalization PIN required
45 Service provider personalization PUK required
46 Corporate personalization PIN required
47 Corporate personalization PUK required
49 EAP method not supported
50 Incorrect parameters
51 Parameter length error for all Auth commands
52 Temporary error for all auth cmds
100 Unknown
103 Illegal Mem_Store
106 Illegal ME
107 GPRS services not allowed
111 PLMN not allowed
112 Location area not allowed
113 Roaming not allowed in this location area
132 Service option not supported
133 Requested service option not subscribed
134 Service option temporarily out of order
148 Unspecified GPRS error
149 PDP authentication failure
150 Invalid mobile class

202/206
B Proprietary Error Codes
The proprietary error codes availability is represented in the table below:
M18Q2 M14A2A
Yes No

The following table details the error codes supported only by @EXTERR for Internet Service
commands.

Table B-1: Error codes supported for @EXTERR commands

Error Code Error Message
512 Invalid argument(s) is(are) input.
513 Wrong argument numbers are input.
514 Out of memory.
515 Temporary failure.
516 System is busy.
517 Network error.
518 Invalid IP address is input.
519 Invalid domain name is input.
520 No response from the server.
521 Operation failure.
522 The specific GPIO is not supported.
523 I2C device address is not specified yet.
524 N/A

203/206
C References
Related documents

Standards Number
AT command set for 3GPP User Equipment (UE) 3GPP TS 27.007 (Release 9)
Equipment (DTE - DCE) interface for Short Message 3GPP TS 27.005 (Release 7)
Service (SMS) and Cell Broadcast Service (CBS)
Serial Asynchronous Automatic Dialing and Control ITU-T V.25ter (Jul 1997)
Data Transmission Systems and Equipment — Serial PCCA STD-101 (Jun 1995)
Asynchronous
Automatic Dialing and Control for Character Mode DCE
on Wireless Data Services
In-band DCE control and synchronous data modes for ITU-T V.80 (Aug 1996)
asynchronous DTE
Asynchronous Facsimile DCE Control, Service Class I ITU-T T.31 (Aug 1995)
Data Service Options for Spread Spectrum Systems TIA/EIA/IS-707-A-2 (Mar 2001)
Terminal Equipment to User Equipment (TE-UE) 3GPP TS 27.010
multiplexer protocol
QMI AT 1.2, QMI Access Terminal Svc Spec 80-VB816-22
Comprehensive AT Command Set in AMSSSoftware 80-VR432-1

204/206
D AT Commands Flow Examples
Fig.D-1 WNC CM Tool Boot Flow for M14A2A

205/206
Fig.D-2 WNC CM Tool Auto APN flow for M18Q2

206/206