1 Contents 01 Quectel Antenna Services 01 Quectel Advantages 01 Instruments 02 5G Antennas 04 Cellular (4G/3G/2G) Antennas 08 GNSS Antennas 14 Wi-Fi & Bluetooth Antennas 15 Combo Antennas 17 ISM Antennas 17 Cable Assemblies Quectel Antenna Services Consulting & Evaluation ■ Feasibility & Architecture Study ■ Risk Identification ■ Initial Proof of Concept ■ Antenna Component Selection Testing & Certification ■ Antenna OTA Testing ■ Interference Mitigation ■ Support for CE/FCC/PTCRB Radio Approval ■ Pre-certification OTA Testing for 2G/3G/4G/5G Quectel Advantages Solutions for the Entire Wireless RF Front End Complete RF Antenna Testing Services Global One Stop Engineering Support Vertical Integration of Antenna Resources Approved for Use with Quectel Modules Instruments Design ■ Antenna Placement ■ Antenna Layout Design ■ RF Specification Design ■ Antenna System Design & Optimization ■ Gerber File Review Manufacturing ■ Antenna Samples ■ Tooling & Molding ■ Assembly and Production Testing ■ Delivery Antenna Module Engineering Support Keysight CATR2305G Rhode & Schwarz WPTC-XS RayZone2800 ETS-AMS-8923-150 1 Quectel Antennas 5G Antennas Product YE0001BA YE0003AA YE0007AA YE0025AA Frequency Bands (MHz) 600–6000 Technology 5G Cable Length (mm) n/a Connector Type SMA Male (center pin) Mounting Type Terminal Dimensions (mm) 221 × 26.95 × 13.5 Matched Quectel Modules 5G/4G/3G/2G/LPWA 699–5000 5G n/a SMA Male (center pin) Terminal 190 × Φ 16 600–6000 5G n/a SMA Male (center pin) Terminal 152.4 × 21.79 × 14.49 698–960,1710–5000 5G n/a SMA Male (center pin) Terminal 199 × 22 5G Antennas Product YE0027AA YE0028AA YE0037AA YXH001AA YBY00A0KA Frequency Bands (MHz) 699–5000 Technology 5G Cable Length (mm) 3000 Connector Type SMA Male (center pin) Mounting Type Magnetic Dimensions (mm) 221 × Φ 61 Matched Quectel Modules 5G/4G/3G/2G/LPWA 700–2700, 3300–5000 5G 1500 SMA Male (center pin) Magnetic 234 × Φ 60 700–5000 5G 1000 SMA Male (center pin) Magnetic 88 × Φ 30 700–960, 1710–2690, 3300–5000 5G 1000 SMA Male (center pin) Magnetic 285 × 45 700–960, 1710–2690, 3300–5000 5G n/a N-J (Male pin with internal thread) Terminal Φ 20 × 300 The parameters shall be subject to the Specification. 2 Quectel Antennas 5G Antennas Product YF0002AA YF0002BA YF0002CA YF0002DA Frequency Bands (MHz) 700-960, 1710-2700, 3300-5000 Technology 5G 1710-2700, 3300-5000 5G Cable Length (mm) n/a n/a Connector Type Spring contact Spring contact Mounting Type Screw Screw Dimensions (mm) 60.1 × 12.25 × 10.1 Matched Quectel Modules 5G/4G/3G/2G/LPWA 41.25 × 10.1 × 10.1 1710-2700, 3300-5000 5G n/a Spring contact Screw 37.25 × 9.6 × 10.1 700-960, 1710-2700, 3300-5000 5G n/a Spring contact Screw 50.25 × 20.1 × 10.1 5G Antennas Product YF0017AA YF0017BA YF0020AA YC0018AA YC0018AAEVB Frequency Bands (MHz) 1500–6000 Technology 5G Cable Length (mm) 193 ±3 Connector Type IPEX Ⅳ Mounting Type Adhesive Dimensions (mm) 49 × 13 × 0.13 Matched Quectel Modules 5G/4G/3G/2G/LPWA 1100–6000 5G 193 ±3 IPEX Ⅳ Adhesive 49 × 13 × 0.13 600–6000 5G 184 ±3 IPEX Ⅳ Adhesive 90.15 × 15.2 × 0.13 617-6000 5G n/a n/a SMD 42 × 7 × 3 617-6000 5G n/a n/a n/a 140 × 40.4 The parameters shall be subject to the Specification. 3 Quectel Antennas 5G Antennas Product YP0009AA YP0009BA YP0009CA Frequency Bands (MHz) 1500–6000 Technology 5G Cable Length (mm) 193 ±3 Connector Type IPEX Ⅳ Mounting Type Adhesive Dimensions (mm) 49 × 13 × 0.85 Matched Quectel Modules 5G/4G/3G/2G/LPWA 1100–6000 5G 193 ±3 IPEX Ⅳ Adhesive 49 × 13 × 0.85 600–6000 5G 188 ±3 IPEX Ⅳ Adhesive 78.5 × 14.2 × 0.85 Cellular (4G/3G/2G) Antennas Product YC0001AA YC0002AA YC0003AA YC0003AAEVB YC0017BA YC0017BAEVB Frequency Bands 698–960, (MHz) 1710–2690 Technology LTE (4G) Cable Length (mm) n/a Connector Type n/a Mounting Type SMD Dimensions (mm) 35.0 × 8.5 × 3.0 Matched Quectel Modules 4G/3G/2G/LPWA 698–960, 1710–2690 LTE (4G) n/a n/a SMD 42 × 10 × 3 The parameters shall be subject to the Specification. 4 698-2700 LTE (4G) n/a n/a SMD 40 × 7 × 3 698-2700 LTE (4G) n/a n/a n/a 120 × 43 698-3800 LTE (4G) n/a n/a SMD 26 × 8 × 3 698-3800 LTE (4G) n/a n/a n/a 140 × 36 Quectel Antennas Cellular (4G/3G/2G) Antennas Product YF0022AA YF0007BA YPCA004AA Frequency Bands (MHz) 700–2690 Technology LTE (4G) Cable Length (mm) 75 ±3 Connector Type RF1 Mounting Type Adhesive Dimensions (mm) 40 × 15 × 1.6 Matched Quectel Modules 4G/3G/2G/LPWA 600–960, 1427.9–1495.9, 1710–2170, 2300–2700 LTE (4G) 75 ±3 RF1 Adhesive 50 × 25 × 0.85 Cellular (4G/3G/2G) Antennas Product YFCA002AA YF0006DA 700–2690 LTE (4G) 100 ±3 IPEX Ⅰ Adhesive 40 ×10 × 1 YF0028AA Frequency Bands (MHz) 700–2690 Technology LTE (4G) Cable Length (mm) 75 ±3 Connector Type RF1 Mounting Type Adhesive Dimensions (mm) 30 × 20 × 0.13 Matched Quectel Modules 4G/3G/2G/LPWA 690–960, 1710–2170, 2300–2690 LTE (4G) 75±3 IPEX Ⅰ Adhesive 50 × 25 × 0.13 698-3000 LTE (4G) 150 ±2 IPEX Ⅰ Adhesive 96 × 21 × 0.2 The parameters shall be subject to the Specification. 5 Quectel Antennas Cellular (4G/3G/2G) Antennas Product YECT002AA YECT003AA YE0009AA YPR00A0AA YCN001AA Frequency Bands (MHz) 700–960,1710–2690 Technology LTE (4G) Cable Length (mm) n/a Connector Type SMA Male (center pin) Mounting Type Terminal Dimensions (mm) 196.2 × 16 × 13 Matched Quectel Modules 4G/3G/2G/LPWA 698-960, 1710-2700 LTE (4G) n/a SMA Male (center pin) Terminal 113× Φ 10 824–2700 LTE (4G) n/a SMA Male (center pin) Terminal 190 × 16 700–2700 LTE (4G) n/a SMA Male (center pin) Terminal 194.3 ×15.95 700–2700 LTE (4G) n/a SMA Male (center pin) Terminal 144 × Φ 13 Cellular (4G/3G/2G) Antennas Product YE0006AA YE0010AA YB0010AA YB0016AA Frequency Bands (MHz) 700–2700 Technology LTE (4G) Cable Length (mm) 1500 Connector Type SMA Male (center pin) Mounting Type Magnetic Dimensions (mm) 318 × Φ 30 Matched Quectel Modules 4G/3G/2G/LPWA 698–2700 LTE (4G) 1000 ±30 SMA Male (center pin) Adhesive 152 × 18 × 5.9 The parameters shall be subject to the Specification. 6 698–960, 1710–2690 LTE (4G) 2000 ±30 SMA Male Magnetic Φ 81.5 × 16 698–960, 1710–2700 LTE (4G) 3000 ±50 SMA Male (center pin) Screw 54 × 91 Quectel Antennas Cellular (4G/3G/2G) Antennas Product YE0012AA YE0021AA YE0029AA Frequency Bands 824–960, (MHz) 1710–2690 Technology LTE (4G) Cable Length (mm) 250 ±10 Connector Type SMA Male (center pin) Mounting Type Adhesive Dimensions (mm) 116.5 × 21.7 × 5.6 Matched Quectel Modules 4G/3G/2G/LPWA 690–960, 1710–2690 LTE (4G) 1500 ±30 SMA Male (center pin) Magnetic 112 × 29.8 700–2700 LTE (4G) 3000 ±50 SMA Male (center pin) Magnetic 88 × Φ 30 Cellular (4G/3G/2G) Antennas Product YDX001AA YE0002AA YE0013AA YGL001AA Frequency Bands (MHz) 824–2690 Technology LTE (4G) Cable Length (mm) n/a Connector Type SMA Male (center pin) Mounting Type Terminal Dimensions (mm) 208 × Φ 12 Matched Quectel Modules 4G/3G/2G/LPWA 699–2700 LTE (4G) n/a RP-SMA Male (center receptacle) Terminal 174.6 × 19.2 700–2700 LTE (4G) n/a SMA Male (center pin) Terminal 115.4 × 17.5 × Φ 10.2 700–960,1710–2690 LTE (4G) n/a SMA Male (center pin) Terminal 196.2 × 16 × 13 The parameters shall be subject to the Specification. 7 Quectel Antennas Cellular (4G/3G/2G) Antennas Product YE0008AA YE0011AA YKL001CA Frequency Bands (MHz) 824–960, 1710–2170 , 2500–2700 Technology LTE (4G) Cable Length (mm) n/a Connector Type SMA Male (center pin) Mounting Type Terminal Dimensions (mm) 52 × Φ 10 Matched Quectel Modules LPWA/3G/2G module series 824–960, 1710–2170, 2500–2700 LTE (4G) n/a SMA Male (center pin) Terminal 50 × Φ 10 NB: 800–1000, 1700–1900 2G/3G/NB-IoT 310 ±10 SMA Male (center pin) Screw 50 × 48 GNSS Antennas Product YC0013AA YC0013AAEVB YC0008AA YC0008AAEVB Frequency Bands (MHz) 1559-1606 Technology GNSS Cable Length (mm) n/a Connector Type n/a Mounting Type SMD Dimensions (mm) 3.2 × 1.6 × 0.6 Matched Quectel Modules GNSS L1 module series 1559-1606 GNSS n/a n/a n/a 90 × 50 The parameters shall be subject to the Specification. 8 1173, 1575 GNSS L1 & L5 (passive) n/a n/a SMD 30 × 5 × 5 GNSS L1/L5 module series 1173, 1575 GNSS L1 & L5 (passive) n/a n/a n/a 80 × 36 Quectel Antennas GNSS Antennas Product YCGA001AA YCGA002AA YG0038AA Frequency Bands (MHz) 1559-1606 Technology GNSS L1 Cable Length (mm) n/a Connector Type n/a Mounting Type Pin Mounting Dimensions (mm) 10 × 10 × 4 Matched Quectel Modules GNSS L1 module series 1559-1606 GNSS L1 n/a n/a Pin Mounting 12 × 12 × 4 1559-1606 GNSS L1 n/a n/a Pin Mounting 13 × 13 × 4 GNSS Antennas Product YG0043AA YG0046AA YG0005AA YG0062AA YG0048AA Frequency Bands (MHz) 1559-1606 Technology GNSS L1 Cable Length (mm) n/a Connector Type n/a Mounting Type Pin Mounting Dimensions (mm) 15 × 15 × 4 Matched Quectel Modules GNSS L1 module series 1559-1606 GNSS L1 n/a n/a Pin Mounting 18 × 18 × 2 1559-1606 GNSS L1 n/a n/a Pin Mounting 18 × 18 × 4 1559-1606 GNSS L1 n/a n/a Pin Mounting 25 × 25 × 4 1176, 1575 GNSS L1 & L5 n/a n/a Pin mounting 18 × 18 × 4 & 25 × 25 × 4 GNSS L1/L5 module series The parameters shall be subject to the Specification. 9 Quectel Antennas GNSS Antennas Product YCGO004AA YCGO005AA YCGO006AA YCGO007AA YG0034AA YG0021AA Frequency Bands (MHz) 1559-1606 Technology GNSS L1 (passive) 1559-1606 GNSS L1 (passive) Cable Length (mm) 50±2 50±2 Connector Type IPEX Ⅰ IPEX Ⅰ Mounting Type Cable Mounting Cable Mounting Dimensions (mm) 10 × 10 × 6.5 15 × 15 × 6.5 Matched Quectel Modules GNSS L1 module series 1559-1606 GNSS L1 (passive) 50±2 IPEX Ⅰ Cable Mounting 18 × 18 × 6.5 1559-1606 GNSS L1 (passive) 50±2 IPEX Ⅰ Cable Mounting 25 × 25 × 6.5 1559–1606 GNSS L1 (active) 35±2 IPEX Ⅰ Cable Mounting 13 ×13 × 6.8 1560–1605 GNSS L1 & B1 & G1 (active) 42 ±3 IPEX Ⅰ Cable Mounting 18.4 × 18.4 × 8.86 GNSS Antennas Product YG0032AA YG0015AA YCGO008AA YCGO009AA YCGO010AA YCGO011AA Frequency Bands (MHz) Technology Beidou: 1561 ±5 ; GPS: 1575 ±5 GNSS L1 & B1 & G1 (active) Cable Length (mm) 55 1559–1606 GNSS L1 (active) 55 ±3 Connector Type IPEX Ⅰ IPEX Ⅰ Mounting Type Cable Mounting Cable Mounting Dimensions (mm) 18 × 18 × 6.6 25 × 25 × 8.25 Matched Quectel Modules GNSS L1 module series 1559-1606 GNSS L1 (active) 50±3 IPEX Ⅰ Cable Mounting 10 × 10 × 6.5 1559-1606 GNSS L1 (active) 50±2 IPEX Ⅰ Cable Mounting 15 × 15 × 6.5 1559-1606 GNSS L1 (active) 50±3 IPEX Ⅰ Cable Mounting 18 × 18 × 6.5 1559-1606 GNSS L1 (active) 50±3 IPEX Ⅰ Cable Mounting 25 × 25 × 6.5 The parameters shall be subject to the Specification. 10 Quectel Antennas GNSS Antennas Product YCGS004AA YCGS005AA YCGS006AA Frequency Bands (MHz) 1560–1606 Technology GNSS L1 & G1 Cable Length (mm) n/a Connector Type n/a Mounting Type SMD Dimensions (mm) 9 × 9 × 4 Matched Quectel Modules GNSS L1 module series GNSS Antennas Product YAT001AA 1560–1606 GNSS L1 & G1 n/a n/a SMD 18 × 18 × 4 YAT001BA 1560–1606 GNSS L1 & G1 n/a n/a SMD 25 × 25 × 4 YBS00A1AA Frequency Bands (MHz) 1176, 1575 Technology GNSS L1 & L5 (active) Cable Length (mm) n/a Connector Type n/a Mounting Type Cable Mounting Dimensions (mm) 25 × 25 × 4 & 18 × 18 × 4 Matched Quectel Modules GNSS L1/L5 module series 1176, 1575 GNSS L1 & L5 (active) n/a n/a Cable Mounting 25 × 25 × 2 & 18 × 18 × 2 1176, 1575 GNSS L1 & L5 (active) n/a n/a Cable Mounting 40 × 40 × 4 & 45 × 45 × 6 The parameters shall be subject to the Specification. 11 Quectel Antennas GNSS Antennas Product YAT001CA YG0030AA YCGO014AA Frequency Bands (MHz) 1176, 1575 Technology GNSS L1 & L5 (active) Cable Length (mm) 40 ±2 Connector Type IPEX Ⅰ Mounting Type Cable Mounting Dimensions (mm) 25 × 25 × 2 & 18 × 18 × 4 Matched Quectel Modules GNSS L1/L5 module series 1176, 1575 GNSS L1 & L5 (passive) 100 ±2 IPEX Ⅰ Cable Mounting 52 × 52 × 9.9 L5: 1166–1186 L1: 1559–1606 GNSS L1 & L5 (passive) 142 IPEX Ⅰ Cable Mounting 50 × 50 × 19.0 GNSS Antennas Product YFGA001AA YFGA002AA YFGA003AA YFGA004AA Frequency Bands 1160–1270, (MHz) 1560–1605 Technology GNSS L1 & 2 & L5 & L6 Cable Length (mm) 100 Connector Type IPEX Ⅰ Mounting Type Adhesive Dimensions (mm) 74.56 × 24.5 × 0.25 Matched Quectel Modules GNSS L1/L5 module series 1559–1609 GNSS L1 100 IPEX Ⅰ Adhesive 61.15 × 11.24 GNSS L1 module series The parameters shall be subject to the Specification. 12 1559–1609 GNSS L1 100 IPEX Ⅰ Adhesive 39.45 x 13.25 1160–1270, 1560–1605 GNSS L1 & 2 & L5 & L6 100 IPEX Ⅰ Adhesive 43 × 24 × 0.12 GNSS L1/L5 modules Quectel Antennas GNSS Antennas Product YG0035AA YLY001CA YB0017AA YG0028AA Frequency Bands (MHz) 1561, 1575 Technology GNSS L1 & B1 & G1 (active) Cable Length (mm) 3000 ±20 Connector Type SMA Male (center pin) Mounting Type Magnetic Dimensions (mm) 50.3 × 38.4 × 17.1 Matched Quectel Modules GNSS L1 module series 1568 ±10 GNSS L1 & B1 & G1 (active) 2000 SMA Male (center pin) Magnetic 45.5 × 38 × 13.5 GPS L1/L5, BD B1/B2, GLONASS L1 1561–1602, 1166–1186 GNSS L1 & L5 (active) GNSS L1 & L5 (active) L = 3000 SMA Male (center pin) Magnetic 3000 SMA Male (center pin) Magnetic 61.5 × 56.5 × 23 Φ 54 × 38 GNSS L1/L5 module series GNSS Antennas Product YG0065AA YEGT001AA YEGT002AA YG0063AA Frequency Bands (MHz) 1575–1602 Technology GNSS L1 (active) Cable Length (mm) 3000 Connector Type FAKRA Female (Code C) Mounting Type Magnetic Dimensions (mm) 34.5 × 37.5 × 12.5 Matched Quectel Modules GNSS L1 modules 1559-1606 GNSS L1 n/a SMA Male (center pin) Terminal 50 × Ø10 All GNSS L1 modules 1559–1606 GNSS L1 n/a SMA Male (center pin) Terminal 52 × Ø10 GPS L1/L2/L5; BDS B1/B2/B3; GLONASS L1/L2; Galileo E1/E5a/E5b/E6; L-band All GNSS bands + L-band Corrections n/a TNC Female Screw Φ 165 × 68 All GNSS L1/L2/L5 modules The parameters shall be subject to the Specification. 13 Quectel Antennas Wi-Fi & Bluetooth Antennas Product YC0009AA YC0010AA YEWM001AA Frequency Bands (MHz) 2400–2500 Technology Wi-Fi (Bluetooth) Cable Length (mm) n/a Connector Type n/a Mounting Type SMD Dimensions (mm) 3.2 × 1.6 × 0.5 Matched Quectel Modules FC30R 2400–2500 Wi-Fi (Bluetooth) n/a n/a SMD 5.2 × 2.0 × 1.2 2400–2500 Wi-Fi (Bluetooth) 1500 SMA Male (center pin) Magnetic Φ 30 ×77.4 Wi-Fi & Bluetooth Antennas Product YF0011AA YF0026AA YF0027AA YF0029AA YF0023AA YF0023CA Frequency Bands 2400–2500, (MHz) 5150–5850 2400–2500, 4900–5850, 5925-7125 2400–2500, 4900–5850, 5925-7125 2410–2490 , 4920–5925 2400–2500, 5150–5850, 5925-7125 2400–2500, 5150–5850, 5925-7125 Technology Wi-Fi (Bluetooth) Wi-Fi (Bluetooth) Wi-Fi (Bluetooth) Wi-Fi (Bluetooth) Wi-Fi (Bluetooth) Wi-Fi (Bluetooth) Cable Length (mm) 44 ±13 100 ±2 100 ±2 100 ±2 100±2 Connector Type IPEX Ⅰ (U.FL Generation Ⅰ) IPEX Ⅰ (U.FL Generation Ⅰ) IPEX Ⅰ (U.FL Generation Ⅰ) IPEX Ⅰ (U.FL Generation Ⅰ) RF I Generation Mounting Type Adhesive Adhesive Adhesive Adhesive Adhesive 100±2 RF I Generation Adhesive Dimensions (mm) Matched Quectel Modules 38.9 × 9 × 0.12 All Wi-Fi/BT modules (Except Wi-Fi 6E) 28.9 × 11 × 0.2 All Wi-Fi/BT modules 42 × 7 × 0.2 30 × 30 × 0.25 All Wi-Fi/BT modules (Except Wi-Fi 6E) 22.90 × 11.70 All Wi-Fi/BT modules 37.80 × 7.50 The parameters shall be subject to the Specification. 14 Quectel Antennas Wi-Fi & Bluetooth Antennas Product YE0031AA YE0032AA YE0038AA YEWT004AA YEWN001AA Frequency Bands 2.4–2.5 GHz, (MHz) 5.15–5.85 GHz Technology Wi-Fi (Bluetooth) 2.4–2.5 GHz, 5.15–5.85 GHz Wi-Fi (Bluetooth) Cable Length (mm) n/a n/a Connector Type SMA Male (center pin) SMA Male (center pin) Mounting Type Terminal Terminal Dimensions (mm) 52 ±2 50 ±2 Matched Quectel Modules All Wi-Fi/BT modules (Except Wi-Fi 6E) 2400–2500, 5150–5850 Wi-Fi (Bluetooth) n/a SMA Male (center pin) Terminal 195 × 13 2400–2500, 5150–7150 Wi-Fi 6E (Bluetooth) n/a SMA Male (center pin) Terminal 109 × Φ 10 All Wi-Fi/BT modules 2400–2500, 5150–5850 Wi-Fi (Bluetooth) n/a RP-SMA Male (Center Receptacle) Terminal 200 × 13 All Wi-Fi/BT modules (Except Wi-Fi 6E) Combo Antennas Product YB0007AA YB0008AA YB0009AA YB0014AA Frequency Bands (MHz) Technology 700–960, 1710–2690 , 3300–5000 5G Cable Length (mm) 500 Connector Type SMA Male (center pin) Mounting Type Screw Dimensions (mm) Matched Quectel Modules Φ 120 × 43 All 5G modules (RM50xQ Series, RG50xQ Series) & All 4G/3G/2G modules & GNSS L1 modules 4G MAIN: 698–960, 1710–2690; GNSS: 1575.42 ±5, 1561.098 ±5; 4G DIV: 1710–2690 Main LTE & DIV LTE & GNSS 300 SMA Male (center pin) Adhesive Φ 84 × 17.5 4G: 824–960, 1710–2690; GPS, BD: 1575.42 ±10, 1561 ±10 LTE & GNSS 310 SMA Male (center pin) Screw 33 × 48 All 4G/3G/2G modules & GNSS L1 modules LTE Main & Div: 698–960, 1700–2700; GNSS: 1561–1571; 1602–1606 Main LTE & DIV LTE & GNSS 3000 SMA Male (center pin) Screw 81 × 27.5 The parameters shall be subject to the Specification. 15 Quectel Antennas Combo Antennas Product YB0015AA YKL001AA YB0032AA YB0033AA YB0022AA Frequency Bands (MHz) Technology LTE: 698–960, 1700–2700; Wi-Fi, Bluetooth: 2400– 2500; GNSS: 1561 ±5, 1575 ±5 LTE/GPS & BD/Wi-Fi Bluetooth: 2400–2500; 4G: 824–960; 1710–2690; GPS, BD: 1575.42 ±10, 1561 ±10 700–960, 1700–2700 LTE/GPS & BD/Wi-Fi Main LTE & DIV LTE Cable Length (mm) 300 310 2000 Connector Type SMA Male (center pin) SMA Male (center pin) SMA Male (Center Pin) Mounting Type Screw Screw Screw Dimensions (mm) 54 × 91 33 × 48 Φ 120 × 43 Matched Quectel Modules 4G/3G/2G modules & GNSS L1 modules & Wi-Fi modules All 4G/3G/2G modules LTE Main & Div: 700–960, 1700–2700 ; GNSS: 1559– 1610 (active) Main LTE & DIV LTE & GNSS 2000 LTE Main & Div: 700–2700; Wi-Fi: 2400–5850 ; GNSS: 1561/1575.42/1602 Main LTE & DIV LTE & GNSS & Wi-Fi1 & Wi-Fi2 1000 SMA Male (Center Pin) FME Female Connector Screw Screw Φ 120 × 43 All 4G/3G/2G modules & GNSS L1 modules Φ 120 × 43 4G/3G/2G modules & GNSS L1 modules & Wi-Fi, Bluetooth modules Combo Antennas Product YB0031AA YEMA003AA YEMA004AA YWL00A0AA YB0026AA YEWN004AA Frequency Bands (MHz) LTE: 698–960; 1710–2690; GNSS: 1575.42 ±5, 1561.098 ±5 LTE: 700–2700 1561/1575.42/1602 Technology LTE & GNSS LTE & GNSS Cable Length (mm) 300 3000 Connector Type SMA Male (center pin) 4G: FAKRA D GNSS: FAKRA C Mounting Type Dimensions (mm) Adhesive Φ 84 ×17.5 Adhesive Φ 84 × 17.5 Matched Quectel Modules All 4G/3G/2G modules & GNSS L1 modules 4G: 698–960 , 1710–2690 Wi-Fi & Bluetooth: 2400–2500 698–960, 1710–2690 LTE: 700–2700 ; Wi-Fi: 2400–5850; GNSS: 1561/1575.42/1602 2400–2500, 5150–5850 LTE & Wi-Fi Main LTE & DIV LTE LTE & GNSS & Wi-Fi1 & Wi-Fi2 Wi-Fi MIMO 900 1500 1000 300 GNSS: FAKRA_C, LTE: SMA Male (Center Pin) SMA Male (Center Pin) FAKRA_D, Wi-Fi 1: FAKRA_ SMA Male (Center Pin) I, Wi-Fi 2: FAKRA_I Screw Screw Screw Screw Φ 81 ×14.5 Φ 81 × 27.5 Φ 120 ×43 Φ 46 ×15 All 4G/3G/2G modules & Wi-Fi modules All 4G/3G/2G modules All 4G/3G/2G modules & GNSS L1 modules & Wi-Fi, Bluetooth modules Wi-Fi modules The parameters shall be subject to the Specification. 16 Quectel Antennas ISM Antennas Product YE0019AA YE0039BA YEIM001AA Frequency Bands (MHz) Technology Cable Length (mm) Connector Type Mounting Type Dimensions (mm) 450–470 ISM SMA Male (center pin) Terminal 109 × 10 430-470, 790-960 ISM 75 SMA Male (center pin) Adhesive 117 × 21.81 × 5.47 Cable Assemblies Product YM0003AA YM0015AA YM0003CA 465–475 ISM 2000 SMA Male (center pin) Magnetic Φ 30 × 131 YM0003AB YM0013AA Frequency Bands (MHz) Technology Cable Length (mm) Connector Type Mounting Type Dimensions (mm) Matched Quectel Modules 0–6000 0–6000 Cable Cable 100 150 SMA-female to IPEX Ⅰ SMA-female to IPEX Ⅰ Screw Screw 100 150 All modules (5G excluded) 0–6000 Cable 200 SMA-female to IPEX Ⅰ Screw 200 0–6000 Cable 200 RP-SMA-female to IPEX Ⅰ Screw 200 0–6000 Cable 300 SMA-female to IPEX Ⅰ Screw 300 Product YM0004AA YM0005AA YSAN001AA YBY00A0HA YBY00A0JA YBY00A0IA Frequency Bands (MHz) Technology Cable Length (mm) Connector Type Mounting Type Dimensions (mm) Matched Quectel Modules 0–6000 0–6000 0–6000 Cable Cable Cable 100 150 300 SMA-female to IPEX Ⅳ SMA-female to RF Ⅳ SMA-female to RF Ⅳ Screw Screw Screw 100 150 300 All 5G modules (RM50xQ Series, RG50xQ Series) 0–6000 Cable 200 0–6000 Cable 250 N-K-female to IPEX Ⅰ N-female to IPEX Ⅰ Screw Screw 200 250 All modules (5G excluded) Bracket - - All modules The parameters shall be subject to the Specification. 17 V1.7.4 2022.04

BG77xA-GL&BG95xA-GL DFOTA Application Note LPWA Module Series Version: 1.0 Date: 2022-09-15 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 1 / 31 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 2 / 31 LPWA Module Series About the Document Revision History Version 1.0 Date 2021-04-25 2022-09-15 Author Nikola BLAZIC/ Milan DJORDJEVIC Nikola BLAZIC/ Milan DJORDJEVIC Description Creation of the document First official release BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 3 / 31 LPWA Module Series Contents About the Document ................................................................................................................................3 Contents .................................................................................................................................................... 4 Table Index ...............................................................................................................................................6 Figure Index ..............................................................................................................................................7 1 Introduction .......................................................................................................................................8 1.1. Applicable Modules ..................................................................................................................8 1.2. Special Mark.............................................................................................................................9 2 Trigger DFOTA by AT Commands .................................................................................................10 2.1. Firmware Update Procedure ..................................................................................................10 2.1.1. Get Delta Firmware Package ....................................................................................... 11 2.1.2. Put Delta Firmware Package on HTTP(S)/CoAP(S) Server......................................... 11 2.1.3. Check APN Setting and Network Status ...................................................................... 11 2.1.4. Execute AT Command to Update Firmware.................................................................12 2.2. DFOTA-Related AT Commands..............................................................................................12 2.2.1. AT Command Introduction ...........................................................................................12 2.2.1.1. Definitions .........................................................................................................12 2.2.1.2. AT Command Syntax ........................................................................................12 2.2.2. Declaration of AT Command Examples .......................................................................13 2.2.3. Description of At Command Mode and Data Mode......................................................13 2.2.4. AT+QFOTADL Update Firmware via DOFTA ............................................................14 2.2.4.1. AT+QFOTADL= Update Firmware When Delta Firmware Package is Stored on HTTP(S) Server .............................................................14 2.2.4.2. AT+QFOTADL= Update Firmware When Delta Firmware Package is Stored on CoAP(S) Server..............................................................16 2.2.4.3. AT+QFOTADL='COM:', Upload Delta a Firmware Package to Flash .......................................................................................................................... 17 2.2.4.4. AT+QFOTADL=,[] Extended DFOTA Functions....................18 2.2.5. AT+QCFGEXT='fota_apn' Configure IP Family and APN for DFOTA* .....................20 2.3. Example .................................................................................................................................20 3 Trigger DFOTA with LwM2M* .........................................................................................................22 3.1. Firmware Update Procedure ..................................................................................................22 3.1.1. Download Firmware Image ..........................................................................................23 3.1.2. Update Firmware .........................................................................................................24 3.2. URC of Firmware Updating with LwM2M................................................................................25 3.2.1. Download Progress URCs ...........................................................................................25 3.2.1.1. In-Band Mode ...................................................................................................25 3.2.1.2. Out-of-Band HTTP(S) Mode .............................................................................25 3.2.1.3. Out-of-Band CoAP(S) Mode .............................................................................26 3.2.2. Update Progress URCs ...............................................................................................27 3.2.2.1. +QIND: 'FOTA','START' Updating Started ....................................................27 BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 4 / 31 LPWA Module Series 3.2.2.2. +QIND: 'FOTA','END', Updating Finished ............................................27 4 Summary of Error Codes................................................................................................................28 5 Appendix References .....................................................................................................................30 BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 5 / 31 LPWA Module Series Table Index Table 1: Special Mark ................................................................................................................................ 9 Table 1: Type of AT Commands............................................................................................................... 12 Table 2: Summary of / Codes .......................................................................... 28 Table 3: Summary of Codes.............................................................................................. 28 Table 4: Summary of Codes........................................................................................................... 29 Table 5: Related Documents ................................................................................................................... 30 Table 6: Terms and Abbreviations............................................................................................................ 30 BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 6 / 31 LPWA Module Series Figure Index Figure 1: DFOTA Procedure (Triggered by AT Command) ...................................................................... 10 Figure 2: LwM2M Firmware Image Downloading .................................................................................... 23 Figure 3: Call Flow of Package URI Observing and Firmware Downloading........................................... 24 Figure 4: Call Flow of 'Update' Resource Observing and Update Event Processing.............................. 25 BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 7 / 31 LPWA Module Series 1 Introduction Quectel BG77xA-GL and BG95xA-GL modules support DFOTA (Delta Firmware Upgrade Over-The-Air) feature, which allows users to update firmware wirelessly. A delta firmware package, which contains only the differences between the current and the target update version, is needed before firmware updating in DFOTA. Therefore, DFOTA is time-saving and can reduce unnecessary data transmission. This document mainly explains how to update the firmware of BG77xA-GL and BG95xA-GL modules via DFOTA, which can be triggered either by AT+QFOTADL or the LwM2M server. 1.1. Applicable Modules Table 1: Applicable Modules Module Family BG77xA-GL BG95xA-GL Model BG770A-GL BG773A-GL BG950A-GL BG951A-GL BG953A-GL BG955A-GL BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 8 / 31 LPWA Module Series 1.2. Special Mark Table 2: Special Mark Mark * Definition Unless otherwise specified, an asterisk (*) after a function, feature, interface, pin name, command, or argument indicates that the function, feature, interface, pin, AT command, or argument is under development and currently not supported; and the asterisk (*) after a model indicates that the sample of the model is currently unavailable. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 9 / 31 LPWA Module Series 2 Trigger DFOTA by AT Commands 2.1. Firmware Update Procedure The following chart illustrates the DFOTA procedure triggered by the AT command, provided that the delta firmware package is stored on an HTTP(S)/CoAP(S) server. 2. Put the package on HTTP(S)/CoAP(S) Server HTTP(S)/CoAP(S) Server 1. Get delta firmware package LTE/EGPRS (HTTP(S)/CoAP(S)) 5. Automatically download the package from HTTP(S)/CoAP(S) server via LTE/EGPRS network Ext. MCU 3. Check APN setting and network status Quectel Module 4. Execute AT+QFOTADL 6. Automatically update module firmware Figure 1: DFOTA Procedure (Triggered by AT Command) BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 10 / 31 LPWA Module Series As shown in the above figure, the following steps need to be performed to update the firmware when the delta firmware package is stored on the HTTP(S)/CoAP(S) server: Step 1: Get a delta firmware package from Quectel. Step 2: Put the delta firmware package on the HTTP(S)/CoAP(S) server. Step 3: Check the APN setting and network status. Step 4: Execute AT+QFOTADL, and the delta firmware package will be downloaded automatically to the module from the HTTP(S)/CoAP(S) server via LTE/EGPRS network (Step '5' in the figure above). Then, the firmware of the module will be updated automatically (Step '6' in the figure above). 2.1.1. Get Delta Firmware Package Before updating, check the current firmware version with AT+GMR and select a target firmware version, and then send the two firmware versions to Quectel or module supplier to get a delta firmware package. 2.1.2. Put Delta Firmware Package on HTTP(S)/CoAP(S) Server Step 1: Set up the HTTP(S)/CoAP(S) server before using the DFOTA function (Quectel does not provide such servers). Step 2: Put the delta firmware package on the server and record its storage path. Step 3: After executing the corresponding AT command, the module downloads the delta firmware package using the URL path of the file uploaded on the server. 2.1.3. Check APN Setting and Network Status Step 1: Check APN setting: check if the APN is set properly after putting the delta firmware package on the HTTP(S)/CoAP(S) server. For instance, the APN for a Telstra (U)SIM card should be 'Telstra.internet'. The relevant AT commands are listed below: ⚫ AT+QCFGEXT='fota_apn': Query DFOTA APN. ⚫ AT+QCFGEXT='fota_apn',0,'Telstra.internet': Set DFOTA APN. Step 2: Check network status: after the APN setting is confirmed, make sure that the data network is registered before firmware updating. The relevant AT commands are listed below: ⚫ AT+CSQ: Query signal quality ⚫ AT+CEREG?: Query network registration status (Optional: AT+CGREG? for modules using 2G network) ⚫ AT+COPS?: Query the registered operator For more information about the above commands, see document [1]. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 11 / 31 LPWA Module Series 2.1.4. Execute AT Command to Update Firmware After checking the APN setting and network status, execute AT+QFOTADL to download the delta firmware package to the module from the HTTP(S)/CoAP(S) server via LTE/EGPRS network. Then, the firmware of the module will be updated. For an example, see Chapter 2.3. 2.2. DFOTA-Related AT Commands 2.2.1. AT Command Introduction 2.2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 3: Type of AT Commands Command Type Test Command Read Command Write Command Syntax Description AT+=? AT+? Test the existence of corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. AT+=[,[,[...]]] Set user-definable parameter value. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 12 / 31 Execution Command AT+ LPWA Module Series Return a specific information parameter or perform a specific action. 2.2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.2.3. Description of At Command Mode and Data Mode The COM port of the modules has two working modes: AT command mode and data mode. In AT command mode, the data inputted via the COM port are treated as AT commands, while in data mode, they are treated as data. ⚫ Exit Data Mode Inputting +++ or pulling the MAIN_DTR pin up can make the COM port exit data mode. To prevent +++ from being misinterpreted as data: 1) Do not input any character for at least 1 s before and after inputting +++. 2) Input +++ within 1 s, and wait until OK is returned. When OK is returned, the COM port exits data mode and enters AT command mode. If you are exiting data mode by pulling the MAIN_DTR pin up, make sure to set AT&D1 first. ⚫ Enter Data Mode After AT+QFOTADL='COM:',, is executed, the COM port enters data mode. If you input +++ or pull the MAIN_DTR pin up to make the port exit data mode, the execution of this command will be interrupted before a response is returned. In such a case, the COM port cannot re-enter data mode if you execute ATO. NOTE See document [1] for more information on AT&D and ATO. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 13 / 31 LPWA Module Series 2.2.4. AT+QFOTADL Update Firmware via DOFTA AT+QFOTADL Update Firmware via DOFTA Test Command AT+QFOTADL=? Response OK NOTE Before downloading, via HTTP(S), CoAP(S) or COM port, the UFS partition will be erased. 2.2.4.1. AT+QFOTADL= Update Firmware When Delta Firmware Package is Stored on HTTP(S) Server This command initiates automatic module firmware updating via DFOTA. Once AT+QFOTADL is executed, the delta firmware package is automatically downloaded to the module. After downloading the delta firmware package, the module automatically updates the firmware. The module reboots if the firmware has been updated successfully, otherwise, it returns an error message and exits DFOTA. If the delta firmware package is stored on the HTTP(S) server, AT+QFOTADL= is executed to start automatic firmware updating via DFOTA. The module downloads the delta firmware package from the HTTP(S) server over the air and updates the firmware automatically. AT+QFOTADL= Stored on HTTP(S) Server Write Command AT+QFOTADL= Update Firmware When Delta Firmware Package is Response OK +QIND: 'FOTA','HTTPSTART' +QIND: 'FOTA','DOWNLOADING', +QIND: 'FOTA','DOWNLOADING', ... +QIND: 'FOTA','HTTPEND', +QIND: 'FOTA','RESETTING' +QIND: 'FOTA','START' +QIND: 'FOTA','UPDATING', +QIND: 'FOTA','UPDATING', … +QIND: 'FOTA','END', If there is any error: +CME ERROR: BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 14 / 31 LPWA Module Series Maximum Response Time Characteristics 300 ms The command takes effect immediately. Parameter String type. Maximum length: 700 bytes. It should start with 'HTTP://' or 'HTTPS://'. For example: 'HTTP://:/' String type. IP address or domain name of the HTTP(S) server. Integer type. HTTP(S) server port number. Default value: 80. Range: 1-65535. String type. File path on HTTP(S) server. Integer type. HTTP(S) result code. 0 Downloaded successfully. Any other value Error code. See Chapter 4 for more information. Integer type. Download progress is expressed as a percentage. Integer type. Update result code. 0 Updated successfully. Any other value Error code. See Chapter 4 for more information. Integer type. Error code. See Chapter 4 for more information. NOTE 1. In the DFOTA mode, there will be no response on AT port until updating is finished. The updating might last for a few minutes. 2. After a smooth downloading process, the module is reset to enter the DFOTA mode. Once the updating is finished, the module restarts into the normal mode. 3. If the module is powered down during the updating, the module automatically enters the DFOTA mode and continues the interrupted firmware updating the next time it is powered up. 4. 1) If SSL certificates are needed for downloading the firmware package from an HTTPS server, they should be loaded with AT+QHTTPCFG='sslctxid'[,]. For more information, see document [2]. 2) Certificate uploading method: AT+QFUPL can be used to upload the certificates. For more information about the command, see document [3]. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 15 / 31 LPWA Module Series 2.2.4.2. AT+QFOTADL= Update Firmware When Delta Firmware Package is Stored on CoAP(S) Server If the delta firmware package is stored on a CoAP(S) server, execute this command to enable automatic firmware updating via DFOTA. The module downloads the delta firmware package from the CoAP(S) server wirelessly and updates the firmware automatically. AT+QFOTADL= Stored on CoAP(S) Server Write Command AT+QFOTADL= Update Firmware When Delta Firmware Package is Response OK +QIND: 'FOTA','COAPSTART' +QIND: 'FOTA','COAPEND', +QIND: 'FOTA','RESETTING' +QIND: 'FOTA','START' +QIND: 'FOTA','UPDATING', +QIND: 'FOTA','UPDATING', ... +QIND: 'FOTA','END', Maximum Response Time Characteristics If there is any error: +CME ERROR: 300 ms The command takes effect immediately. Parameter String type. Maximum length: 700 bytes. It should start with 'CoAP://' or 'CoAPS://'. For example: 'CoAP://:/'. String type. IP address or domain name of the CoAP(S) server. Integer type. CoAP(S) server port number. Default value: 5683. Range: 1-65535. String type. File path on CoAP(S) server. Integer type. CoAP(S) result code. 0 Downloaded successfully. Any other value Error code. See Chapter 4 for more information. Integer type. Update result code. 0 Updated successfully. Any other value Error code. See Chapter 4 for more information. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 16 / 31 LPWA Module Series Integer type. Error code. See Chapter 4 for more information. NOTE If SSL certificates are needed for downloading the delta firmware package from a CoAP server, they should be loaded with AT+QCOAPCFG='dtls',[[,]]. For more information, see document [4]. 2.2.4.3. AT+QFOTADL='COM:', Upload a Delta Firmware Package to Flash This command uploads a delta firmware package to the NAND flash. If a delta firmware package already exists in the NAND flash, it will be overwritten when a new package is uploaded. After this command is executed and CONNECT is returned, the module switches to data mode. When the uploaded data reach , or if no data are inputted when is reached, the module exits data mode automatically. During data transmission, inputting +++ or pulling up MAIN_DTR can make the module exit data mode. More information about data mode is provided in Chapter 2.2.3. AT+QFOTADL='COM:', Upload a Delta Firmware Package to Flash Write Command AT+QFOTADL='COM:',[,] Response CONNECT TA switches to data mode (transparent transmission mode), and the binary delta firmware package can be inputted. When the total size of the inputted data reaches , TA returns to command mode and sends the following response: +QFOTADL: , OK Maximum Response Time Characteristics If there is any error: +CME ERROR: 300 ms The command takes effect immediately. Parameter Integer type. File size expected to be uploaded. Unit: byte. Integer type. Waiting time for data to be inputted to UART. Default value: 5. Range: 1–65535. Unit: s. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 17 / 31 LPWA Module Series Integer type. Uploaded file size. Unit: byte. Checksum of uploaded data. Integer type. Error code. See Chapter 4 for more information. NOTE 1. is limited by the flash space for the delta firmware package. The maximum flash space of the modules is 3788 KB. 2. is a 16-bit checksum based on bitwise Exclusive-OR (XOR). It is calculated by XOR-ing all even bytes (stored as upper 8 bits), and likewise XOR-ing all odd bytes (stored as lower 8 bits) of this checksum. This checksum can be used to verify if the data have been uploaded correctly. 3. +++ sequence causes TA to end command execution and switch to command mode. However, the previously uploaded data are preserved into the file. 4. When executing the command, the data must be entered after CONNECT is returned. 5. Due to the physical limitations of the platform, i.e., write speed to the NOR flash memory, the upload feature has 2 operating modes to guarantee that the entire file will be written without data loss. The two modes are: 1) uploading without activated flow control; 2) uploading with activated flow control. If the flow control is not activated, the maximum file size is limited to 200,000 bytes. Attempting to send larger files will result in an error. When HW flow is activated by executing AT+IFC=2,2, there is no file size limitation other than available disk space. In this mode, on the client-side, the RTS and CTS must be switched on before sending the file to ensure safe file transfer. If RTS and CTS pins are not physically connected, then the software flow control is available as an alternative. The software flow control can be enabled using AT+QCFGEXT='xonoff',1. This implementation of SW flow control is only implemented for data. This means that the user must listen for the Xon (0x11) and Xoff (0x13) and interpret them as the flow control characters. In this case, when sending data there are no special characters. 2.2.4.4. AT+QFOTADL=,[] Extended DFOTA Functions This command supports several extended functions with different parameters, such as: triggering a DFOTA update with a local DFOTA firmware package, getting DFOTA firmware package information, and deleting a DFOTA firmware package. AT+QFOTADL=[,] Extended DFOTA Functions Write Command AT+QFOTADL=[,] Response If is omitted and =1, start DFOTA updating. OK If is omitted and =3, return the current DFOTA update trigger mode. +QFOTADL: , BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 18 / 31 LPWA Module Series Maximum Response Time Characteristics OK If is omitted and =4, return the size of the local DFOTA package. +QFOTADL: , OK If is omitted and =5, delete the DFOTA package. OK If is present and =3, configure the DFOTA update trigger mode. OK If there is any error related to ME functionality: +CME ERROR: If there is any other error: ERROR 10 s The command takes effect immediately. The configuration is not saved. Parameter Integer type. 1 Start DFOTA updating 2 Reserved 3 Configure whether to trigger DFOTA updating automatically after downloading the delta firmware package (takes effect on HTTP(S) and CoAP(S)) 4 Get the size of local delta firmware package 5 Delete the local delta firmware package If =3, 0 Trigger DFOTA updating with AT+QFOTADL=1. 1 Trigger DFOTA updating automatically once the delta firmware package is downloaded. If =4, represents the size of the local delta firmware package. Unit: Byte. Integer type. Error code. See Chapter 4 for more information. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 19 / 31 LPWA Module Series 2.2.5. AT+QCFGEXT='fota_apn' Configure IP Family and APN for DFOTA* This command configures the IP family and APN for DFOTA. AT+QCFGEXT='fota_apn' Configure IP Family and APN for DFOTA Write Command AT+QCFGEXT='fota_apn',,[,,] Response If the optional parameters are omitted, query the current setting: +QCFGEXT: 'fota_apn',,[,,] OK If any of the optional parameters is specified, set the IP family and APN for DFOTA: OK Maximum Response Time Characteristics If there is any error: ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter Integer type. IP family. 0 IPv4 address family 1 IPv6 address family 2 IPv4 and IPv6 address family String type. Access point name. String type. Username of selected APN. String type. Password of selected APN. 2.3. Example Update the firmware when the delta firmware package is stored on an HTTPS server. //The delta firmware package has already been stored on an HTTPS server. //The HTTPS server address is 'https://www.quectel.com:100/update.ua'. AT+CSQ;+CEREG?;+COPS? //Query network status. +CSQ: 26,99 BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 20 / 31 LPWA Module Series +CEREG: 0,1 +COPS: 0,0,'Telstra Mobile Telstra',7 OK //Execute AT+QFOTADL to enable automatic firmware updating via DFOTA, and then the module starts to download the delta firmware package and update firmware automatically. AT+QFOTADL='https://www.quectel.com:100/update.ua' OK +QIND: 'FOTA','HTTPSTART' +QIND: 'FOTA','DOWNLOADING',5% … +QIND: 'FOTA','HTTPEND',0 //Finish downloading the delta firmware package from the HTTPS server. +QIND: 'FOTA','RESETTING' //The module is reset and then enters DFOTA mode. +QIND: 'FOTA','START' +QIND: 'FOTA','UPDATING',1% +QIND: 'FOTA','UPDATING',8% ... +QIND: 'FOTA','UPDATING',100% +QIND: 'FOTA','END',0 //Finish updating the firmware. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 21 / 31 LPWA Module Series 3 Trigger DFOTA with LwM2M* 3.1. Firmware Update Procedure OMA defines the application layer communication protocol between an LwM2M server and an LwM2M client, which is located in an LwM2M device. For the modules, the LwM2M protocol is used to manage device provisioning and triggers a DFOTA procedure. For the DFOTA update on the module, a Firmware Update Object is provided by the LwM2M specification. Routine DFOTA updating with LwM2M steps: Step 1: Write 'Package'/'Package URI' to trigger the downloading of a firmware image, so that the DFOTA application automatically downloads the firmware image from an LwM2M server. Step 2: Post 'Update' to trigger firmware updating on the module, so that the DFOTA application automatically finishes firmware updating with the candidate firmware image. The LwM2M client is notified about the new firmware by the LwM2M server using CoAP(S). The client sends the notification to a registered DFOTA application. The DFOTA application downloads the delta firmware package from the server and stores it in the file system of the modules. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 22 / 31 LPWA Module Series Key components of the LwM2M DFOTA process on the module are presented in the following figure. LwM2M and DFOTA Servers CoAP(S) HTTP(S)/CoAP(S) ThreadX LwM2M Client Firmware Update Object Boot Loader (SBL) Load image based on Cookie Clear Cookie Boot Result DFOTA Application Download Image Set DFOTA Cookie Request Reboot Get Boot Result Security Authenticates Image FLASH File System Boot Partition DFOTA Partition DFOTA Cookie Figure 2: LwM2M Firmware Image Downloading 3.1.1. Download Firmware Image About 'Firmware Update Object' in LwM2M, the detailed interaction between an LwM2M client and an LwM2M server is described below. The LwM2M client should register and observe the 'Package URI' resource in the Firmware Update Object, which is shown on the server when the client is registered successfully. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 23 / 31 LwM2M Client DFOTA Application Write Package/ Package URI Register to get Firmware Object Update In-Band Download Package (CoAP(S)) Send Firmware Image LPWA Module Series FLASH Out-of-Band Send Package URI Set Download State Download Package (HTTP(S)/CoAP(S)) Write to DFOTA Partition Figure 3: Call Flow of Package URI Observing and Firmware Downloading NOTE In the In-Band mode, the module downloads a firmware package from the LwM2M server directly via the CoAP(S) protocol and sends the downloaded package to the DFOTA application. All 'firmware update' actions are done by the application. However, in the Out-of-Band mode, the module downloads a firmware package from the HTTP(S)/CoAP(S) server to the module. 3.1.2. Update Firmware The LwM2M server should observe the 'State' resource in the Firmware Update Object. If the 'State' has changed to 'Downloaded', 'Update' resource is executed to trigger the firmware updating procedure. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 24 / 31 LPWA Module Series LwM2M Client DFOTA Application Security File System Post 'Update' Register to get Firmware Object Update Firmware Update Set DFOTA Cookie Request Reboot SysMon Figure 4: Call Flow of 'Update' Resource Observing and Update Event Processing 3.2. URC of Firmware Updating with LwM2M 3.2.1. Download Progress URCs 3.2.1.1. In-Band Mode When the DFOTA firmware updating is triggered in the LwM2M in-band mode, the following URCs are outputted to notify the user of downloading progress. +LWM2M: 'FOTA','DOWNLOADING' Notify Downloading Progress URC Format: +LWM2M: 'FOTA','DOWNLOADING','START' URC Format: +LWM2M: 'FOTA','DOWNLOADING','COMPLETED' Downloading procedure started. Downloading procedure completed. 3.2.1.2. Out-of-Band HTTP(S) Mode When the DFOTA firmware updating is triggered in the LwM2M out-of-band HTTP(S) mode, the following URCs are outputted to notify the user of the downloading progress. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 25 / 31 LPWA Module Series +QIND: 'FOTA','HTTP' Notify Downloading Progress URC Format: +QIND: 'FOTA','HTTPSTART' URC Format: +QIND: 'FOTA','DOWNLOADING', ... URC Format: +LWM2M: 'FOTA','DOWNLOADED', Downloading procedure started. Downloading progress in percentage. Downloading operation result. Parameter Integer type. Downloading progress in percentage. Integer type. HTTP(S) result code. 0 Downloaded successfully. Any other value Error code. See Chapter 4 for more information. 3.2.1.3. Out-of-Band CoAP(S) Mode When the DFOTA firmware update is triggered in the LwM2M out-of-band CoAP(S) mode, the following URCs are outputted to notify the user of downloading progress. +QIND: 'FOTA','COAP' Notify Downloading Progress URC Format: +QIND: 'FOTA','COAPSTART' URC Format: +LWM2M: 'FOTA','DOWNLOADED', Downloading procedure started. Downloading operation result. Parameter Integer type. CoAP(S) result code. 0 Downloaded successfully. Any other value Error code. See Chapter 4 for more information. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 26 / 31 LPWA Module Series 3.2.2. Update Progress URCs 3.2.2.1. +QIND: 'FOTA','START' Updating Started +QIND: 'FOTA','START' Updating Started URC Format: +QIND: 'FOTA','START' Notify the user of update start. 3.2.2.2. +QIND: 'FOTA','END', Updating Finished +QIND: 'FOTA','END', Updating Finished URC Format: +QIND: 'FOTA','END', Notify the user of update completion. Parameter Error code. See Chapter 4 for more information. BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 27 / 31 LPWA Module Series 4 Summary of Error Codes These error codes indicate errors related to mobile equipment or network. The detailed information about , , and is provided in the following tables. Table 4: Summary of / Codes / 0 701 702 703 704 705 706 707 708 710 Meaning Download successful Unknown error Server connection failed Request failed Download timeout URL error File does not exist Witing data to file failed Downloaded file is too large Ddownloaded package check failed Table 5: Summary of Codes Meaning 0 Updated successfully 504 Firmware update failed 505 Update package does not exist BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 28 / 31 LPWA Module Series 506 Package data integrity check failed 511 Package is mismatched with the current firmware 512 DFOTA unknown error Table 6: Summary of Codes Meaning 421 Time-out Failed to allocate memory. If file size is > 200 KB then the flow 427 control must be used 590 Input parameter invalid 591 DFOTA is ongoing BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 29 / 31 LPWA Module Series 5 Appendix References Table 7: Related Documents Document Name [1] Quectel_BG77xA-GL&BG95xA-GL_AT_Commands_Manual [2] Quectel_BG770A-GL&BG95xA-GL_HTTP(S)_Application_Note [3] Quectel_BG770A-GL&BG95xA-GL_FILE_Application_Note [4] Quectel_BG77xA-GL&BG95xA-GL_CoAP_Application_Note Table 8: Terms and Abbreviations Abbreviation AP APN APP CoAP(S) CTS DFOTA DTLS EFS EGPRS HTTP(S) HW IP Description Application Processor Access Point Name Application Constrained Application Protocol (Secure) Clear to Send Delta Firmware Upgrade Over-the-Air Datagram Transport Layer Security Embedded File System Enhanced General Packet Radio Service Hyper Text Transport Protocol (Secure) Hardware Internet Protocol BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 30 / 31 IPv4 IPv6 KB LTE LPWA LwM2M MCU NAND NOR OMA PSK RTS SBL SSL TA UART URC URI URL USB (U)SIM XOR LPWA Module Series Internet Protocol Version 4 Internet Protocol Version 6 Kilobytes Long-Term Evolution Low-Power Wide-Area Lightweight M2M Microcontroller Unit/Microprogrammed Control Unit NOT-AND NOT-OR Open Mobile Alliance Pre-Shared Key/Phase Shift Keying Ready to Send Serial Bootloader Secure Sockets Layer Terminal Adapter Universal Asynchronous Receiver/Transmitter Unsolicited Result Code Uniform Resource Identifier Uniform Resource Locator Universal Serial Bus Universal Subscriber Identity Module Exclusive-OR BG77xA-GL&BG95xA-GL_DFOTA_Application_Note 31 / 31

EP06&EG06&EM06 Series SLIC Application Note LTE-A Module Series Version: 1.0 Date: 2022-07-12 Status: Released LTE-A Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. EP06&EG06&EM06_Series_SLIC_Application_Note 1 / 15 LTE-A Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. EP06&EG06&EM06_Series_SLIC_Application_Note 2 / 15 LTE-A Module Series About the Document Revision History Version 1.0 Date Author 2022-05-23 Shaun DUAN 2022-07-12 Shaun DUAN Description Creation of the document First official release EP06&EG06&EM06_Series_SLIC_Application_Note 3 / 15 LTE-A Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 2 Description of AT Commands ........................................................................................................... 7 2.1. AT Command Introduction ......................................................................................................... 7 2.1.1. Definitions........................................................................................................................ 7 2.1.2. AT Command Syntax ...................................................................................................... 7 2.2. Declaration of AT Command Examples ..................................................................................... 8 2.3. AT+QSLIC Enable/Disable SLIC............................................................................................. 8 3 Design Scheme ................................................................................................................................. 10 3.1. Block Diagram .......................................................................................................................... 10 3.1.1. Modem ...........................................................................................................................11 3.1.2. AP...................................................................................................................................11 3.2. Main Functions of SLIC.............................................................................................................11 3.2.1. Voice Data Transmission and Control............................................................................11 3.2.2. Phone Control ................................................................................................................11 3.2.3. Call State Control .......................................................................................................... 12 4 SLIC Function List ............................................................................................................................ 13 5 Appendix References ....................................................................................................................... 15 EP06&EG06&EM06_Series_SLIC_Application_Note 4 / 15 LTE-A Module Series Table Index Table 1: Type of AT Commands ................................................................................................................... 7 Table 2: SLIC Function List ........................................................................................................................ 13 Table 3: Terms and Abbreviations .............................................................................................................. 15 EP06&EG06&EM06_Series_SLIC_Application_Note 5 / 15 LTE-A Module Series 1 Introduction This document introduces the SLIC function of Quectel EP06, EG06, and EM06 series modules, including AT commands, the design scheme, and the function list. EP06&EG06&EM06_Series_SLIC_Application_Note 6 / 15 LTE-A Module Series 2 Description of AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Type of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. EP06&EG06&EM06_Series_SLIC_Application_Note 7 / 15 LTE-A Module Series 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3. AT+QSLIC Enable/Disable SLIC This command enables or disables the SLIC. AT+QSLIC Enable/Disable SLIC Test Command AT+QSLIC=? Response +QSLIC: (list of supported s),(range of supported s) Read Command AT+QSLIC? OK Response +QSLIC: [,] Write Command AT+QSLIC=, OK Response OK Maximum Response Time Characteristics If there is any error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. Enable or disable SLIC. 0 Disable 1 Enable Integer type. Set SLIC type. 0 Reserved 1 LE9641 (not supported currently) EP06&EG06&EM06_Series_SLIC_Application_Note 8 / 15 LTE-A Module Series 2 SI32185 3 LE9643 Example AT+QSLIC=? +QSLIC: (0,1),(0-3) OK AT+QSLIC=0,3 OK AT+QSLIC=1,3 OK AT+QSLIC? +QSLIC: 1,3 OK //Test command. //Disable SLIC. //Enable SLIC and set the SLIC platform type to LE9643. //Query the current configurations. EP06&EG06&EM06_Series_SLIC_Application_Note 9 / 15 LTE-A Module Series 3 Design Scheme 3.1. Block Diagram The software framework design of the SLIC function of the module is shown in the following figure: VoLTE Service & CS Voice Service Audio Voice Core Services QMI SLIC App Voice Server PCM Call Manager DSCI AT AT^DSCI ATA/ ATD/ CHLD/ VTS/... Control Driver PCM SPI SLIC RJ11 Control Path Data Path Figure 1: Block Diagram SLIC Function NOTE Please refer to the AT Commands Manual of the module for details of the AT commands in this chapter. EP06&EG06&EM06_Series_SLIC_Application_Note 10 / 15 LTE-A Module Series 3.1.1. Modem The module provides AT commands on the Modem to implement call functions, including that for originating a call (ATD), answering an incoming call (ATA), hanging up a call (ATH), reporting call status (AT^DSCI), managing call related supplementary services (AT+CHLD), and DTMF (AT+VTS), etc. These commands directly control the Modem to implement call related services. 3.1.2. AP SLIC application and Voice Sever application are developed on the AP of the module based on AT commands mentioned above. SLIC application supports the following functions: controlling the call status of the Modem through the phone state machine and AT commands, interacting with SLIC devices through SPI, and obtaining the operation information and controlling the line status of the phone. Voice Server application supports the following functions: controlling the voice link switch and the voice data transmission, controlling the PCM clock switch, providing a local ringtone scheme, and outputting the standard busy, waiting, and end tones of different countries or regions. 3.2. Main Functions of SLIC SLIC supports three functions: voice data transmission and control, phone control, and call state control. 3.2.1. Voice Data Transmission and Control Based on VoLTE protocol stack and audio management components, the module implements the call function based on voice link and SLIC device. The module transmits the downlink voice data to SLIC chip through a sound card, the SLIC chip decodes the voice data into analog signal, and transmits the signal to the phone through RJ11. After that, the phone plays the voice through a speaker. At the same time, the voice analog signal collected by the microphone of the phone is transmitted to the SLIC chip that encodes the analog signal into digital signal, namely the voice data, and then transmits it to the voice uplink through the sound card. 3.2.2. Phone Control The operations supported by the phone include: the DTMF key, off-hook, on-hook, and the flash button. When you do the above operations on the phone, the SLIC chip obtains the phone signal through RJ11, analyses the phone actions, and writes them to the register of the SLIC chip. Then the module reads the relevant registers of the SLIC chip through SPI driver to obtain the phone operations. Besides, the module can configure the SLIC register through the SPI driver to make the SLIC chip generate a signal to the phone, and then the phone can achieve functions such as ringing and displaying caller ID. EP06&EG06&EM06_Series_SLIC_Application_Note 11 / 15 LTE-A Module Series 3.2.3. Call State Control Based on the VoLTE protocol stack, the Modem reports the call status to an SMD channel after AT^DSCI=1 is executed. The SLIC application on the AP obtains the call status through the SMD channel. At the same time, the SLIC application on the AP can send AT commands to the Modem through the SMD channel to realize functions such as answering an incoming call (ATA), hanging up a call (ATH), managing call-related supplementary services such as call holding and conference call (AT+CHLD). EP06&EG06&EM06_Series_SLIC_Application_Note 12 / 15 LTE-A Module Series 4 SLIC Function List This chapter introduces the detailed SLIC functions of the module. Table 2: SLIC Function List Function Power Management Off-Hook On-Hook Dialling Caller ID Ringing Answering a Call Originating a Call Out-of-Band DTMF Call Switching (Call on Hold) 3-Way Calling (Conference Call) Detailed Description 1. After SLIC is enabled, the phone is powered on and the its screen lights up. 2. After SLIC is disabled, the phone is powered off and its screen is turned off. In the on-hook state, if there is no incoming call, the phone plays dial tone after off-hook. 1. In a call, it hangs up the current call. 2. During dialling, it terminates the dialling and clear the dialled number. In the on-hook state, you will hear the dial tone after the off-hook until pressing the DTMF key to input the expected numbers. The call is dialed 5 seconds after you press the last number. In the on-hook state, when there is an incoming call, the incoming call number is displayed on the phone screen. In the on-hook state, the phone will ring when there is an incoming call. In the on-hook state, when there is an incoming call, the phone can be answered after off-hook. 1. After dialling, the phone starts the voice call. 2. After an incoming call is answered, the phone starts the voice call. During a voice call, the phone can send the corresponding signal after pressing the keys '0'~'9', '#', or '*'. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then when you press the flash button again, the call to B is on hold, and the phone will switch back to the call to A. By repeatedly pressing the flash button, you can switch between the calls to A and B. 1. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then if you press key '3' within 500 milliseconds to 2 seconds after pressing the flash button, the calls to A and B will be merged, and the 3-way calling is EP06&EG06&EM06_Series_SLIC_Application_Note 13 / 15 Dial Tone Busy Tone Waiting Tone End Tone LTE-A Module Series realized. 2. If you need to add more parties into the current call, perform the following steps: 1) Press the flash button again to hold the merged call to A and B, the dial tone starts again. 2) Dial the number of a third party (e.g., C) to originate a new call. After that, the flash button can be pressed to switch between the merged call to A and B and the call to C. 3) Press the flash button, and then press key '3' within 500 milliseconds to 2 seconds to merge the calls. After that, the call to A and B and that to C are merged. 3. If you need to add more parties, repeat 1) to 3) above. The module supports conference calls with up to 6 callees. In the on-hook state and there is no incoming call, after off-hook, the phone plays the dial tone. When the module originates a call and the callee rejects the call, the phone plays the busy tone (or ring tone of the operator). When the module is in a voice call, and another party calls the module, the phone plays the waiting tone (or ring tone of the operator). When the module is in a voice call, and the other party hangs up, the phone plays the end tone. EP06&EG06&EM06_Series_SLIC_Application_Note 14 / 15 LTE-A Module Series 5 Appendix References Table 3: Terms and Abbreviations Abbreviation AP CS DTMF PCM QMI SLIC SMD SPI TA VoLTE Description Access Point Circuit Switched Dual-Tone Multifrequency Pulse Code Modulation Qualcomm Message Interface Subscriber Line Interface Circuit Shared Memory Driver Serial Peripheral Interface Terminal Adapter Voice over Long-Term Evolution EP06&EG06&EM06_Series_SLIC_Application_Note 15 / 15

EM12&EG12&EG18 Series SLIC Application Note LTE-A Module Series Version: 1.0 Date: 2022-07-12 Status: Released LTE-A Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. EM12&EG12&EG18_Series_SLIC_Application_Note 1 / 15 LTE-A Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. EM12&EG12&EG18_Series_SLIC_Application_Note 2 / 15 LTE-A Module Series About the Document Revision History Version 1.0 Date Author 2022-05-23 Shaun DUAN 2022-07-12 Shaun DUAN Description Creation of the document First official release EM12&EG12&EG18_Series_SLIC_Application_Note 3 / 15 LTE-A Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 2 Description of AT Commands ........................................................................................................... 7 2.1. AT Command Introduction ......................................................................................................... 7 2.1.1. Definitions........................................................................................................................ 7 2.1.2. AT Command Syntax ...................................................................................................... 7 2.2. Declaration of AT Command Examples ..................................................................................... 8 2.3. AT+QSLIC Enable/Disable SLIC............................................................................................. 8 3 Design Scheme ................................................................................................................................. 10 3.1. Block Diagram .......................................................................................................................... 10 3.1.1. Modem ...........................................................................................................................11 3.1.2. AP...................................................................................................................................11 3.2. Main Functions of SLIC.............................................................................................................11 3.2.1. Voice Data Transmission and Control............................................................................11 3.2.2. Phone Control ................................................................................................................11 3.2.3. Call State Control .......................................................................................................... 12 4 SLIC Function List ............................................................................................................................ 13 5 Appendix References ....................................................................................................................... 15 EM12&EG12&EG18_Series_SLIC_Application_Note 4 / 15 LTE-A Module Series Table Index Table 1: Type of AT Commands ................................................................................................................... 7 Table 2: SLIC Function List ........................................................................................................................ 13 Table 3: Terms and Abbreviations .............................................................................................................. 15 EM12&EG12&EG18_Series_SLIC_Application_Note 5 / 15 LTE-A Module Series 1 Introduction This document introduces the SLIC function of Quectel EM12-G, EG12, and EG18 series modules, including AT commands, the design scheme, and the function list. EM12&EG12&EG18_Series_SLIC_Application_Note 6 / 15 LTE-A Module Series 2 Description of AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Type of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. EM12&EG12&EG18_Series_SLIC_Application_Note 7 / 15 LTE-A Module Series 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3. AT+QSLIC Enable/Disable SLIC This command enables or disables the SLIC. AT+QSLIC Enable/Disable SLIC Test Command AT+QSLIC=? Response +QSLIC: (list of supported s),(range of supported s) Read Command AT+QSLIC? OK Response +QSLIC: [,] Write Command AT+QSLIC=, OK Response OK Maximum Response Time Characteristics If there is any error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. Enable or disable SLIC. 0 Disable 1 Enable Integer type. Set SLIC type. 0 Reserved 1 LE9641 (not supported currently) EM12&EG12&EG18_Series_SLIC_Application_Note 8 / 15 LTE-A Module Series 2 SI32185 3 LE9643 Example AT+QSLIC=? +QSLIC: (0,1),(0-3) OK AT+QSLIC=0,3 OK AT+QSLIC=1,3 OK AT+QSLIC? +QSLIC: 1,3 OK //Test command. //Disable SLIC. //Enable SLIC and set the SLIC platform type to LE9643. //Query the current configurations. EM12&EG12&EG18_Series_SLIC_Application_Note 9 / 15 LTE-A Module Series 3 Design Scheme 3.1. Block Diagram The software framework design of the SLIC function of the module is shown in the following figure: VoLTE Service & CS Voice Service Audio Voice Core Services QMI SLIC App Voice Server PCM Call Manager DSCI AT AT^DSCI ATA/ ATD/ CHLD/ VTS/... Control Driver PCM SPI SLIC RJ11 Control Path Data Path Figure 1: Block Diagram SLIC Function NOTE Please refer to the AT Commands Manual of the module for details of the AT commands in this chapter. EM12&EG12&EG18_Series_SLIC_Application_Note 10 / 15 LTE-A Module Series 3.1.1. Modem The module provides AT commands on the Modem to implement call functions, including that for originating a call (ATD), answering an incoming call (ATA), hanging up a call (ATH), reporting call status (AT^DSCI), managing call related supplementary services (AT+CHLD), and DTMF (AT+VTS), etc. These commands directly control the Modem to implement call related services. 3.1.2. AP SLIC application and Voice Sever application are developed on the AP of the module based on AT commands mentioned above. SLIC application supports the following functions: controlling the call status of the Modem through the phone state machine and AT commands, interacting with SLIC devices through SPI, and obtaining the operation information and controlling the line status of the phone. Voice Server application supports the following functions: controlling the voice link switch and the voice data transmission, controlling the PCM clock switch, providing a local ringtone scheme, and outputting the standard busy, waiting, and end tones of different countries or regions. 3.2. Main Functions of SLIC SLIC supports three functions: voice data transmission and control, phone control, and call state control. 3.2.1. Voice Data Transmission and Control Based on VoLTE protocol stack and audio management components, the module implements the call function based on voice link and SLIC device. The module transmits the downlink voice data to SLIC chip through a sound card, the SLIC chip decodes the voice data into analog signal, and transmits the signal to the phone through RJ11. After that, the phone plays the voice through a speaker. At the same time, the voice analog signal collected by the microphone of the phone is transmitted to the SLIC chip that encodes the analog signal into digital signal, namely the voice data, and then transmits it to the voice uplink through the sound card. 3.2.2. Phone Control The operations supported by the phone include: the DTMF key, off-hook, on-hook, and the flash button. When you do the above operations on the phone, the SLIC chip obtains the phone signal through RJ11, analyses the phone actions, and writes them to the register of the SLIC chip. Then the module reads the relevant registers of the SLIC chip through SPI driver to obtain the phone operations. Besides, the module can configure the SLIC register through the SPI driver to make the SLIC chip generate a signal to the phone, and then the phone can achieve functions such as ringing and displaying caller ID. EM12&EG12&EG18_Series_SLIC_Application_Note 11 / 15 LTE-A Module Series 3.2.3. Call State Control Based on the VoLTE protocol stack, the Modem reports the call status to an SMD channel after AT^DSCI=1 is executed. The SLIC application on the AP obtains the call status through the SMD channel. At the same time, the SLIC application on the AP can send AT commands to the Modem through the SMD channel to realize functions such as answering an incoming call (ATA), hanging up a call (ATH), managing call-related supplementary services such as call holding and conference call (AT+CHLD). EM12&EG12&EG18_Series_SLIC_Application_Note 12 / 15 LTE-A Module Series 4 SLIC Function List This chapter introduces the detailed SLIC functions of the module. Table 2: SLIC Function List Function Power Management Off-Hook On-Hook Dialling Caller ID Ringing Answering a Call Originating a Call Out-of-Band DTMF Call Switching (Call on Hold) 3-Way Calling (Conference Call) Detailed Description 1. After SLIC is enabled, the phone is powered on and the its screen lights up. 2. After SLIC is disabled, the phone is powered off and its screen is turned off. In the on-hook state, if there is no incoming call, the phone plays dial tone after off-hook. 1. In a call, it hangs up the current call. 2. During dialling, it terminates the dialling and clear the dialled number. In the on-hook state, you will hear the dial tone after the off-hook until pressing the DTMF key to input the expected numbers. The call is dialed 5 seconds after you press the last number. In the on-hook state, when there is an incoming call, the incoming call number is displayed on the phone screen. In the on-hook state, the phone will ring when there is an incoming call. In the on-hook state, when there is an incoming call, the phone can be answered after off-hook. 1. After dialling, the phone starts the voice call. 2. After an incoming call is answered, the phone starts the voice call. During a voice call, the phone can send the corresponding signal after pressing the keys '0'~'9', '#', or '*'. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then when you press the flash button again, the call to B is on hold, and the phone will switch back to the call to A. By repeatedly pressing the flash button, you can switch between the calls to A and B. 1. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then if you press key '3' within 500 milliseconds to 2 seconds after pressing the flash button, the calls to A and B will be merged, and the 3-way calling is EM12&EG12&EG18_Series_SLIC_Application_Note 13 / 15 Dial Tone Busy Tone Waiting Tone End Tone LTE-A Module Series realized. 2. If you need to add more parties into the current call, perform the following steps: 1) Press the flash button again to hold the merged call to A and B, the dial tone starts again. 2) Dial the number of a third party (e.g., C) to originate a new call. After that, the flash button can be pressed to switch between the merged call to A and B and the call to C. 3) Press the flash button, and then press key '3' within 500 milliseconds to 2 seconds to merge the calls. After that, the call to A and B and that to C are merged. 3. If you need to add more parties, repeat 1) to 3) above. The module supports conference calls with up to 6 callees. In the on-hook state and there is no incoming call, after off-hook, the phone plays the dial tone. When the module originates a call and the callee rejects the call, the phone plays the busy tone (or ring tone of the operator). When the module is in a voice call, and another party calls the module, the phone plays the waiting tone (or ring tone of the operator). When the module is in a voice call, and the other party hangs up, the phone plays the end tone. EM12&EG12&EG18_Series_SLIC_Application_Note 14 / 15 LTE-A Module Series 5 Appendix References Table 3: Terms and Abbreviations Abbreviation AP CS DTMF PCM QMI SLIC SMD SPI TA VoLTE Description Access Point Circuit Switched Dual-Tone Multifrequency Pulse Code Modulation Qualcomm Message Interface Subscriber Line Interface Circuit Shared Memory Driver Serial Peripheral Interface Terminal Adapter Voice over Long-Term Evolution EM12&EG12&EG18_Series_SLIC_Application_Note 15 / 15

EG512R-EA SLIC Application Note LTE-A Module Series Version: 1.0 Date: 2022-07-12 Status: Released LTE-A Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. EG512R-EA_SLIC_Application_Note 1 / 15 LTE-A Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. EG512R-EA_SLIC_Application_Note 2 / 15 LTE-A Module Series About the Document Revision History Version 1.0 Date Author 2022-05-23 Shaun DUAN 2022-07-12 Shaun DUAN Description Creation of the document First official release EG512R-EA_SLIC_Application_Note 3 / 15 LTE-A Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 2 Description of AT Commands ........................................................................................................... 7 2.1. AT Command Introduction ......................................................................................................... 7 2.1.1. Definitions........................................................................................................................ 7 2.1.2. AT Command Syntax ...................................................................................................... 7 2.2. Declaration of AT Command Examples ..................................................................................... 8 2.3. AT+QSLIC Enable/Disable SLIC............................................................................................. 8 3 Design Scheme ................................................................................................................................. 10 3.1. Block Diagram .......................................................................................................................... 10 3.1.1. Modem ...........................................................................................................................11 3.1.2. AP...................................................................................................................................11 3.2. Main Functions of SLIC.............................................................................................................11 3.2.1. Voice Data Transmission and Control............................................................................11 3.2.2. Phone Control ................................................................................................................11 3.2.3. Call State Control .......................................................................................................... 12 4 SLIC Function List ............................................................................................................................ 13 5 Appendix References ....................................................................................................................... 15 EG512R-EA_SLIC_Application_Note 4 / 15 LTE-A Module Series Table Index Table 1: Type of AT Commands ................................................................................................................... 7 Table 2: SLIC Function List ........................................................................................................................ 13 Table 3: Terms and Abbreviations .............................................................................................................. 15 EG512R-EA_SLIC_Application_Note 5 / 15 LTE-A Module Series 1 Introduction This document introduces the SLIC function of Quectel EG512R-EA module, including AT commands, the design scheme, and the function list. EG512R-EA_SLIC_Application_Note 6 / 15 LTE-A Module Series 2 Description of AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Type of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. EG512R-EA_SLIC_Application_Note 7 / 15 LTE-A Module Series 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3. AT+QSLIC Enable/Disable SLIC This command enables or disables the SLIC. AT+QSLIC Enable/Disable SLIC Test Command AT+QSLIC=? Response +QSLIC: (list of supported s),(range of supported s) Read Command AT+QSLIC? OK Response +QSLIC: [,] Write Command AT+QSLIC=, OK Response OK Maximum Response Time Characteristics If there is any error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. Enable or disable SLIC. 0 Disable 1 Enable Integer type. Set SLIC type. 0 Reserved 1 LE9641 (not supported currently) EG512R-EA_SLIC_Application_Note 8 / 15 LTE-A Module Series 2 SI32185 3 LE9643 Example AT+QSLIC=? +QSLIC: (0,1),(0-3) OK AT+QSLIC=0,3 OK AT+QSLIC=1,3 OK AT+QSLIC? +QSLIC: 1,3 OK //Test command. //Disable SLIC. //Enable SLIC and set the SLIC platform type to LE9643. //Query the current configurations. EG512R-EA_SLIC_Application_Note 9 / 15 LTE-A Module Series 3 Design Scheme 3.1. Block Diagram The software framework design of the SLIC function of the EG512R-EA module is shown in the following figure: VoLTE Service & CS Voice Service Audio Voice Core Services QMI SLIC App Voice Server PCM Call Manager DSCI AT AT^DSCI ATA/ ATD/ CHLD/ VTS/... Control Driver PCM SPI SLIC RJ11 Control Path Data Path Figure 1: Block Diagram SLIC Function NOTE Please refer to the AT Commands Manual of the module for details of the AT commands in this chapter. EG512R-EA_SLIC_Application_Note 10 / 15 LTE-A Module Series 3.1.1. Modem The module provides AT commands on the Modem to implement call functions, including that for originating a call (ATD), answering an incoming call (ATA), hanging up a call (ATH), reporting call status (AT^DSCI), managing call related supplementary services (AT+CHLD), and DTMF (AT+VTS), etc. These commands directly control the Modem to implement call related services. 3.1.2. AP SLIC application and Voice Sever application are developed on the AP of the module based on AT commands mentioned above. SLIC application supports the following functions: controlling the call status of the Modem through the phone state machine and AT commands, interacting with SLIC devices through SPI, and obtaining the operation information and controlling the line status of the phone. Voice Server application supports the following functions: controlling the voice link switch and the voice data transmission, controlling the PCM clock switch, providing a local ringtone scheme, and outputting the standard busy, waiting, and end tones of different countries or regions. 3.2. Main Functions of SLIC SLIC supports three functions: voice data transmission and control, phone control, and call state control. 3.2.1. Voice Data Transmission and Control Based on VoLTE protocol stack and audio management components, the module implements the call function based on voice link and SLIC device. The module transmits the downlink voice data to SLIC chip through a sound card, the SLIC chip decodes the voice data into analog signal, and transmits the signal to the phone through RJ11. After that, the phone plays the voice through a speaker. At the same time, the voice analog signal collected by the microphone of the phone is transmitted to the SLIC chip that encodes the analog signal into digital signal, namely the voice data, and then transmits it to the voice uplink through the sound card. 3.2.2. Phone Control The operations supported by the phone include: the DTMF key, off-hook, on-hook, and the flash button. When you do the above operations on the phone, the SLIC chip obtains the phone signal through RJ11, analyses the phone actions, and writes them to the register of the SLIC chip. Then the module reads the relevant registers of the SLIC chip through SPI driver to obtain the phone operations. Besides, the module can configure the SLIC register through the SPI driver to make the SLIC chip generate a signal to the phone, and then the phone can achieve functions such as ringing and displaying caller ID. EG512R-EA_SLIC_Application_Note 11 / 15 LTE-A Module Series 3.2.3. Call State Control Based on the VoLTE protocol stack, the Modem reports the call status to an SMD channel after AT^DSCI=1 is executed. The SLIC application on the AP obtains the call status through the SMD channel. At the same time, the SLIC application on the AP can send AT commands to the Modem through the SMD channel to realize functions such as answering an incoming call (ATA), hanging up a call (ATH), managing call-related supplementary services such as call holding and conference call (AT+CHLD). EG512R-EA_SLIC_Application_Note 12 / 15 LTE-A Module Series 4 SLIC Function List This chapter introduces the detailed SLIC functions of the module. Table 2: SLIC Function List Function Power Management Off-Hook On-Hook Dialling Caller ID Ringing Answering a Call Originating a Call Out-of-Band DTMF Call Switching (Call on Hold) 3-Way Calling (Conference Call) Detailed Description 1. After SLIC is enabled, the phone is powered on and the its screen lights up. 2. After SLIC is disabled, the phone is powered off and its screen is turned off. In the on-hook state, if there is no incoming call, the phone plays dial tone after off-hook. 1. In a call, it hangs up the current call. 2. During dialling, it terminates the dialling and clear the dialled number. In the on-hook state, you will hear the dial tone after the off-hook until pressing the DTMF key to input the expected numbers. The call is dialed 5 seconds after you press the last number. In the on-hook state, when there is an incoming call, the incoming call number is displayed on the phone screen. In the on-hook state, the phone will ring when there is an incoming call. In the on-hook state, when there is an incoming call, the phone can be answered after off-hook. 1. After dialling, the phone starts the voice call. 2. After an incoming call is answered, the phone starts the voice call. During a voice call, the phone can send the corresponding signal after pressing the keys '0'~'9', '#', or '*'. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then when you press the flash button again, the call to B is on hold, and the phone will switch back to the call to A. By repeatedly pressing the flash button, you can switch between the calls to A and B. 1. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then if you press key '3' within 500 milliseconds to 2 seconds after pressing the flash button, the calls to A and B will be merged, and the 3-way calling is EG512R-EA_SLIC_Application_Note 13 / 15 Dial Tone Busy Tone Waiting Tone End Tone LTE-A Module Series realized. 2. If you need to add more parties into the current call, perform the following steps: 1) Press the flash button again to hold the merged call to A and B, the dial tone starts again. 2) Dial the number of a third party (e.g., C) to originate a new call. After that, the flash button can be pressed to switch between the merged call to A and B and the call to C. 3) Press the flash button, and then press key '3' within 500 milliseconds to 2 seconds to merge the calls. After that, the call to A and B and that to C are merged. 3. If you need to add more parties, repeat 1) to 3) above. The module supports conference calls with up to 6 callees. In the on-hook state and there is no incoming call, after off-hook, the phone plays the dial tone. When the module originates a call and the callee rejects the call, the phone plays the busy tone (or ring tone of the operator). When the module is in a voice call, and another party calls the module, the phone plays the waiting tone (or ring tone of the operator). When the module is in a voice call, and the other party hangs up, the phone plays the end tone. EG512R-EA_SLIC_Application_Note 14 / 15 LTE-A Module Series 5 Appendix References Table 3: Terms and Abbreviations Abbreviation AP CS DTMF PCM QMI SLIC SMD SPI TA VoLTE Description Access Point Circuit Switched Dual-Tone Multifrequency Pulse Code Modulation Qualcomm Message Interface Subscriber Line Interface Circuit Shared Memory Driver Serial Peripheral Interface Terminal Adapter Voice over Long-Term Evolution EG512R-EA_SLIC_Application_Note 15 / 15

EG060K&EG120K Series SLIC Application Note LTE-A Module Series Version: 1.0 Date: 2022-07-12 Status: Released LTE-A Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. EG060K&EG120K_Series_SLIC_Application_Note 1 / 15 LTE-A Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. EG060K&EG120K_Series_SLIC_Application_Note 2 / 15 LTE-A Module Series About the Document Revision History Version 1.0 Date Author 2022-05-23 Shaun DUAN 2022-07-12 Shaun DUAN Description Creation of the document First official release EG060K&EG120K_Series_SLIC_Application_Note 3 / 15 LTE-A Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 2 Description of AT Commands ........................................................................................................... 7 2.1. AT Command Introduction ......................................................................................................... 7 2.1.1. Definitions........................................................................................................................ 7 2.1.2. AT Command Syntax ...................................................................................................... 7 2.2. Declaration of AT Command Examples ..................................................................................... 8 2.3. AT+QSLIC Enable/Disable SLIC............................................................................................. 8 3 Design Scheme ................................................................................................................................. 10 3.1. Block Diagram .......................................................................................................................... 10 3.1.1. Modem ...........................................................................................................................11 3.1.2. AP...................................................................................................................................11 3.2. Main Functions of SLIC.............................................................................................................11 3.2.1. Voice Data Transmission and Control............................................................................11 3.2.2. Phone Control ................................................................................................................11 3.2.3. Call State Control .......................................................................................................... 12 4 SLIC Function List ............................................................................................................................ 13 5 Appendix References ....................................................................................................................... 15 EG060K&EG120K_Series_SLIC_Application_Note 4 / 15 LTE-A Module Series Table Index Table 1: Type of AT Commands ................................................................................................................... 7 Table 2: SLIC Function List ........................................................................................................................ 13 Table 3: Terms and Abbreviations .............................................................................................................. 15 EG060K&EG120K_Series_SLIC_Application_Note 5 / 15 LTE-A Module Series 1 Introduction This document introduces the SLIC function of Quectel EG060K and EG120K series modules, including AT commands, the design scheme, and the function list. EG060K&EG120K_Series_SLIC_Application_Note 6 / 15 LTE-A Module Series 2 Description of AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Type of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. EG060K&EG120K_Series_SLIC_Application_Note 7 / 15 LTE-A Module Series 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3. AT+QSLIC Enable/Disable SLIC This command enables or disables the SLIC. AT+QSLIC Enable/Disable SLIC Test Command AT+QSLIC=? Response +QSLIC: (list of supported s),(range of supported s) Read Command AT+QSLIC? OK Response +QSLIC: [,] Write Command AT+QSLIC=, OK Response OK Maximum Response Time Characteristics If there is any error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. Enable or disable SLIC. 0 Disable 1 Enable Integer type. Set SLIC type. 0 Reserved 1 LE9641 (not supported currently) EG060K&EG120K_Series_SLIC_Application_Note 8 / 15 LTE-A Module Series 2 SI32185 3 LE9643 Example AT+QSLIC=? +QSLIC: (0,1),(0-3) OK AT+QSLIC=0,3 OK AT+QSLIC=1,3 OK AT+QSLIC? +QSLIC: 1,3 OK //Test command. //Disable SLIC. //Enable SLIC and set the SLIC platform type to LE9643. //Query the current configurations. EG060K&EG120K_Series_SLIC_Application_Note 9 / 15 LTE-A Module Series 3 Design Scheme 3.1. Block Diagram The software framework design of the SLIC function of the module is shown in the following figure: VoLTE Service & CS Voice Service Audio Voice Core Services QMI SLIC App Voice Server PCM Call Manager DSCI AT AT^DSCI ATA/ ATD/ CHLD/ VTS/... Control Driver PCM SPI SLIC RJ11 Control Path Data Path Figure 1: Block Diagram SLIC Function NOTE Please refer to the AT Commands Manual of the module for details of the AT commands in this chapter. EG060K&EG120K_Series_SLIC_Application_Note 10 / 15 LTE-A Module Series 3.1.1. Modem The module provides AT commands on the Modem to implement call functions, including that for originating a call (ATD), answering an incoming call (ATA), hanging up a call (ATH), reporting call status (AT^DSCI), managing call related supplementary services (AT+CHLD), and DTMF (AT+VTS), etc. These commands directly control the Modem to implement call related services. 3.1.2. AP SLIC application and Voice Sever application are developed on the AP of the module based on AT commands mentioned above. SLIC application supports the following functions: controlling the call status of the Modem through the phone state machine and AT commands, interacting with SLIC devices through SPI, and obtaining the operation information and controlling the line status of the phone. Voice Server application supports the following functions: controlling the voice link switch and the voice data transmission, controlling the PCM clock switch, providing a local ringtone scheme, and outputting the standard busy, waiting, and end tones of different countries or regions. 3.2. Main Functions of SLIC SLIC supports three functions: voice data transmission and control, phone control, and call state control. 3.2.1. Voice Data Transmission and Control Based on VoLTE protocol stack and audio management components, the module implements the call function based on voice link and SLIC device. The module transmits the downlink voice data to SLIC chip through a sound card, the SLIC chip decodes the voice data into analog signal, and transmits the signal to the phone through RJ11. After that, the phone plays the voice through a speaker. At the same time, the voice analog signal collected by the microphone of the phone is transmitted to the SLIC chip that encodes the analog signal into digital signal, namely the voice data, and then transmits it to the voice uplink through the sound card. 3.2.2. Phone Control The operations supported by the phone include: the DTMF key, off-hook, on-hook, and the flash button. When you do the above operations on the phone, the SLIC chip obtains the phone signal through RJ11, analyses the phone actions, and writes them to the register of the SLIC chip. Then the module reads the relevant registers of the SLIC chip through SPI driver to obtain the phone operations. Besides, the module can configure the SLIC register through the SPI driver to make the SLIC chip generate a signal to the phone, and then the phone can achieve functions such as ringing and displaying caller ID. EG060K&EG120K_Series_SLIC_Application_Note 11 / 15 LTE-A Module Series 3.2.3. Call State Control Based on the VoLTE protocol stack, the Modem reports the call status to an SMD channel after AT^DSCI=1 is executed. The SLIC application on the AP obtains the call status through the SMD channel. At the same time, the SLIC application on the AP can send AT commands to the Modem through the SMD channel to realize functions such as answering an incoming call (ATA), hanging up a call (ATH), managing call-related supplementary services such as call holding and conference call (AT+CHLD). EG060K&EG120K_Series_SLIC_Application_Note 12 / 15 LTE-A Module Series 4 SLIC Function List This chapter introduces the detailed SLIC functions of the module. Table 2: SLIC Function List Function Power Management Off-Hook On-Hook Dialling Caller ID Ringing Answering a Call Originating a Call Out-of-Band DTMF Call Switching (Call on Hold) 3-Way Calling (Conference Call) Detailed Description 1. After SLIC is enabled, the phone is powered on and the its screen lights up. 2. After SLIC is disabled, the phone is powered off and its screen is turned off. In the on-hook state, if there is no incoming call, the phone plays dial tone after off-hook. 1. In a call, it hangs up the current call. 2. During dialling, it terminates the dialling and clear the dialled number. In the on-hook state, you will hear the dial tone after the off-hook until pressing the DTMF key to input the expected numbers. The call is dialed 5 seconds after you press the last number. In the on-hook state, when there is an incoming call, the incoming call number is displayed on the phone screen. In the on-hook state, the phone will ring when there is an incoming call. In the on-hook state, when there is an incoming call, the phone can be answered after off-hook. 1. After dialling, the phone starts the voice call. 2. After an incoming call is answered, the phone starts the voice call. During a voice call, the phone can send the corresponding signal after pressing the keys '0'~'9', '#', or '*'. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then when you press the flash button again, the call to B is on hold, and the phone will switch back to the call to A. By repeatedly pressing the flash button, you can switch between the calls to A and B. 1. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then if you press key '3' within 500 milliseconds to 2 seconds after pressing the flash button, the calls to A and B will be merged, and the 3-way calling is EG060K&EG120K_Series_SLIC_Application_Note 13 / 15 Dial Tone Busy Tone Waiting Tone End Tone LTE-A Module Series realized. 2. If you need to add more parties into the current call, perform the following steps: 1) Press the flash button again to hold the merged call to A and B, the dial tone starts again. 2) Dial the number of a third party (e.g., C) to originate a new call. After that, the flash button can be pressed to switch between the merged call to A and B and the call to C. 3) Press the flash button, and then press key '3' within 500 milliseconds to 2 seconds to merge the calls. After that, the call to A and B and that to C are merged. 3. If you need to add more parties, repeat 1) to 3) above. The module supports conference calls with up to 6 callees. In the on-hook state and there is no incoming call, after off-hook, the phone plays the dial tone. When the module originates a call and the callee rejects the call, the phone plays the busy tone (or ring tone of the operator). When the module is in a voice call, and another party calls the module, the phone plays the waiting tone (or ring tone of the operator). When the module is in a voice call, and the other party hangs up, the phone plays the end tone. EG060K&EG120K_Series_SLIC_Application_Note 14 / 15 LTE-A Module Series 5 Appendix References Table 3: Terms and Abbreviations Abbreviation AP CS DTMF PCM QMI SLIC SMD SPI TA VoLTE Description Access Point Circuit Switched Dual-Tone Multifrequency Pulse Code Modulation Qualcomm Message Interface Subscriber Line Interface Circuit Shared Memory Driver Serial Peripheral Interface Terminal Adapter Voice over Long-Term Evolution EG060K&EG120K_Series_SLIC_Application_Note 15 / 15

LC29H (BA,CA,DA) DR&RTK Application Note GNSS Module Series Version: 1.0 Date: 2022-09-19 Status: Released GNSS Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal nonexclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. LC29H(BA,CA,DA)_DR&RTK_Application_Note 1 / 31 GNSS Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any thirdparty intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. LC29H(BA,CA,DA)_DR&RTK_Application_Note 2 / 31 GNSS Module Series About the Document Document Information Title Subtitle Document Type Document Status LC29H (BA, CA, DA) DR&RTK Application Note GNSS Module Series Application Note Released Revision History Version Date Description - 2022-02-25 Creation of the document 1.0 2022-09-19 First official release LC29H(BA,CA,DA)_DR&RTK_Application_Note 3 / 31 GNSS Module Series Contents About the Document .................................................................................................................................. 4 Contents ...................................................................................................................................................... 5 Table Index.................................................................................................................................................. 6 Figure Index ................................................................................................................................................ 7 1 Introduction ......................................................................................................................................... 8 2 Configuration....................................................................................................................................... 9 2.1. DR Configuration........................................................................................................................ 9 2.1.1. Orientation....................................................................................................................... 9 2.1.2. Mounting........................................................................................................................ 10 2.1.3. DR Calibration................................................................................................................11 2.2. RTK Configuration.................................................................................................................... 12 2.2.1. RTCM Input ................................................................................................................... 12 3 DR Related Messages....................................................................................................................... 14 3.1. PQTM Messages ..................................................................................................................... 14 3.1.1. PQTMDRCAL................................................................................................................ 14 3.1.2. PQTMIMUTYPE ............................................................................................................ 15 3.1.3. PQTMVEHMSG ............................................................................................................ 15 3.1.3.1. If = 1 ................................................................................................ 16 3.1.3.2. If = 2 ................................................................................................ 17 3.1.3.3. If = 3 ................................................................................................ 18 3.1.3.4. If = 4 ................................................................................................ 18 3.1.4. PQTMSAVEPAR ........................................................................................................... 19 3.1.5. PQTMRESTOREPAR ................................................................................................... 20 3.1.6. PQTMINS ...................................................................................................................... 21 3.1.7. PQTMIMU ..................................................................................................................... 22 3.1.8. PQTMGPS .................................................................................................................... 23 3.1.9. PQTMCFGEINSMSG.................................................................................................... 24 3.1.10. PQTMVEHMOT ............................................................................................................ 26 3.1.11. PQTMSENMSG ............................................................................................................ 26 3.1.11.1. If = 4 .................................................................................................. 27 3.2. PAIR Messages........................................................................................................................ 28 3.2.1. Packet Type: 6010 PAIR_CUSTOM_SET_MSG_OUTPUT ......................................... 28 3.2.2. Packet Type: 6011 PAIR_CUSTOM_GET_MSG_OUTPUT ......................................... 29 4 Appendix A References.................................................................................................................... 31 5 Appendix B Special Characters ...................................................................................................... 32 LC29H(BA,CA,DA)_DR&RTK_Application_Note 4 / 31 GNSS Module Series Table Index Table 1: Supported RTCM Input Messages ............................................................................................... 12 Table 2: Related Document........................................................................................................................ 31 Table 3: Terms and Abbreviations .............................................................................................................. 31 Table 4: Special Characters ....................................................................................................................... 32 LC29H(BA,CA,DA)_DR&RTK_Application_Note 5 / 31 GNSS Module Series Figure Index Figure 1: Reference Frame .......................................................................................................................... 9 Figure 2: Module Orientation...................................................................................................................... 10 Figure 3: Module Mounting Example ..........................................................................................................11 LC29H(BA,CA,DA)_DR&RTK_Application_Note 6 / 31 GNSS Module Series 1 Introduction This document describes the dead reckoning (DR) and real-time kinematic (RTK) features, including DR and RTK configurations and DR related messages for Quectel LC29H (BA), LC29H (CA) and LC29H (DA) modules. The features supported by each module are as follows: ⚫ LC29H (BA) supports DR and RTK. ⚫ LC29H (CA) only supports DR. ⚫ LC29H (DA) only supports RTK. LC29H(BA,CA,DA)_DR&RTK_Application_Note 7 / 31 GNSS Module Series 2 Configuration 2.1. DR Configuration 2.1.1. Orientation The LC29H (BA) and LC29H (CA) modules are designed to work on two-wheel or four-wheel vehicles. Both modules integrate an IMU as well as the GNSS receiver. Therefore, you must ensure that the device incorporating the module is firmly fixed to vehicle body. No relative movement is allowed between vehicle and device and maximum isolation from shock or vibration must be applied. Manually holding the device is not acceptable. The best way to guarantee good installation is to firmly screw the device down to the vehicle frame. Mounting location should permit easy access to power supply and GNSS antenna, and should not be exposed to excessive heat. Definitions of reference frame axes: ⚫ X-axis points towards the right of the vehicle. ⚫ Y-axis points towards the front of the vehicle. ⚫ Z-axis points towards the roof of the vehicle. X Y Figure 1: Reference Frame Z LC29H(BA,CA,DA)_DR&RTK_Application_Note 8 / 31 Module orientation is shown below: Z Yaw GNSS Module Series Pitch X Y Roll Figure 2: Module Orientation NOTE Firmly affix the device incorporating the module to vehicle body. Select a structurally sound location that is not prone to flexing (bending motion of vehicle chassis). 2.1.2. Mounting There are no mounting direction and angle limitations for mounting the Quectel LC29H (BA) or LC29H (CA) module on the vehicle. The reference model is as follows: LC29H(BA,CA,DA)_DR&RTK_Application_Note 9 / 31 X Y Y GNSS Module Series Z Z Figure 3: Module Mounting Example 2.1.3. DR Calibration The module needs to be calibrated before the DR functionality will be useful. The DR calibration steps are as listed below: Step 1: Fix the device incorporating the module on the vehicle frame firmly. Any displacement, rotation or tilt of the device relative to vehicle plane, however small, may cause performance issues and/or void the calibration. LC29H(BA,CA,DA)_DR&RTK_Application_Note 10 / 31 GNSS Module Series Step 2: Calibration should be performed under good GNSS signal and clear sky conditions. Step 3: Power up the module, then start the vehicle on a plain surface. Step 4: Drive at a speed of more than 3 m/s, and perform 3–4 turning movements. The module will start self-calibration, which would be completed in approximately 3 minutes. Step 5: The calibration process ends when of $PQTMDRCAL message value is 2 (DR is fully calibrated). See Chapter 3.1.1 PQTMDRCAL for details about the message. After the calibration, there is no limit to driving trajectory and driving dynamics. You can perform verification tests in the following scenarios: 1) Open sky area, urban main road (high C/N0 levels). 2) Tunnels (assessment of DR performance during absence of satellite visibility). 3) Viaduct (assessment of DR performance during weak signal conditions). 4) Underground vehicle parking (DR performance during satellite signal absence). 5) Surrounding areas with dense buildings (occurrence of multi-path signals). 6) City boulevards (weak satellite signals). 7) Urban canyon (high multi-path signals with limited sky view). NOTE If the speed sensor of the vehicle is connected to the module, make sure that its precision is at least 0.05 m/tick. 2.2. RTK Configuration 2.2.1. RTCM Input Quectel LC29H (BA) and LC29H (DA) modules support the RTCM 10403.3 input messages listed in the table below. Table 1: Supported RTCM Input Messages Message Type 1005 1006 1074 Description Stationary RTK Reference Station ARP Stationary RTK Reference Station ARP with Antenna Height GPS MSM4 LC29H(BA,CA,DA)_DR&RTK_Application_Note 11 / 31 Message Type 1077 1084 1087 1094 1097 1114 1117 1124 1127 Description GPS MSM7 GLONASS MSM4 GLONASS MSM7 Galileo MSM4 Galileo MSM7 QZSS MSM4 QZSS MSM7 BDS MSM4 BDS MSM7 GNSS Module Series LC29H(BA,CA,DA)_DR&RTK_Application_Note 12 / 31 GNSS Module Series 3 DR Related Messages 3.1. PQTM Messages This chapter outlines the Quectel DR related PQTM (proprietary NMEA) messages supported by the Quectel LC29H (BA) and LC29H(CA) modules. 3.1.1. PQTMDRCAL Indicates the DR calibration state. Type: Output Synopsis: $PQTMDRCAL,,,* Parameter: Field Format Unit Numeric - Numeric - Numeric - Description Message version. Fixed as 1. DR calibration state. 0 = Not calibrated 1 = DR is lightly calibrated 2 = DR is fully calibrated Navigation type. 0 = No position 1 = GNSS only 2 = DR only 3 = Combination Example: $PQTMDRCAL,1,0,1*5C LC29H(BA,CA,DA)_DR&RTK_Application_Note 13 / 31 GNSS Module Series 3.1.2. PQTMIMUTYPE Outputs the IMU type once after each boot-up. Type: Output Synopsis: $PQTMIMUTYPE,,* Parameter: Field Format Unit Numeric - Numeric - Description Message version. Fixed as 1. IMU type. 0 = IMU error 1 = LSM6DSR 2 = ICM-40608 3 = BMI160 4 = ICM-42670 Example: $PQTMIMUTYPE,1,2*52 3.1.3. PQTMVEHMSG Inputs/outputs vehicle information. Type: Input/output Synopsis: $PQTMVEHMSG,,,[,,…,]* Parameter: Field Format Unit Numeric - Description Type of message input/output via UART interface. 1 = Vehicle speed (in m/s) 2 = Cumulative wheel tick LC29H(BA,CA,DA)_DR&RTK_Application_Note 14 / 31 GNSS Module Series Field Format Numeric to Numeric Unit Description Millisecond - 3 = Speeds of four wheels (in m/s) 4 = Cumulative wheel ticks of four wheels Timestamp since power-on. 32-bit unsigned integer. Always 0 when this message is input. Vehicle information. This field varies with the message type. See Chapter 3.1.3.1 If = 1 to 3.1.3.4 If = 4 for details. NOTE can only be 2 for LC29H (BA) and LC29H (CA) with software versions dedicated for twowheel vehicles. Contact Quectel Technical Support for details about the software versions. 3.1.3.1. If = 1 Synopsis: $PQTMVEHMSG,1,,* Parameter: Field Format Numeric Numeric Unit Millisecond m/s Description Timestamp since power-on. 32-bit unsigned integer. Always 0 when this message is input. Speed. Range: -100 to 100. Result: Returns the input vehicle speed with timestamp: $PQTMVEHMSG,1,,* Example: //Input: $PQTMVEHMSG,1,0,3.6*1C //Output: $PQTMVEHMSG,1,3748292,3.6*1D LC29H(BA,CA,DA)_DR&RTK_Application_Note 15 / 31 GNSS Module Series 3.1.3.2. If = 2 Synopsis: $PQTMVEHMSG,2,,,* Parameter: Field Format Numeric Numeric Numeric Unit Description Timestamp since power-on. 32-bit unsigned integer. Millisecond Always 0 when this message is input. Tick Cumulative wheel ticks. Forward/backward indicator. 0 = Invalid state 1 = Forward 2 = Backward Result: Returns the input cumulative wheel tick with timestamp: $PQTMVEHMSG,2,,,* Example: //Input: $PQTMVEHMSG,2,0,100,1*18 //Output: $PQTMVEHMSG,2,153954,100,1*27 NOTE 1. When inputting cumulative wheel ticks through UART interface, make sure the input rate is at least 10 Hz. 2. For LC29H (BA) and LC29H (CA) with software versions dedicated for two-wheel vehicles: 1) Keep always 1; 2) The input cumulative wheel tick with timestamp will not be output. Contact Quectel Technical Support for details about the software versions. LC29H(BA,CA,DA)_DR&RTK_Application_Note 16 / 31 GNSS Module Series 3.1.3.3. If = 3 Synopsis: $PQTMVEHMSG,3,,,,,* Parameter: Field Format Numeric Numeric Numeric Numeric Numeric Unit Millisecond m/s m/s m/s m/s Description Timestamp since power-on. 32-bit unsigned integer. Always 0 when this message is input. Left front wheel speed. Range: -100 to 100. Right front wheel speed. Range: -100 to 100. Left rear wheel speed. Range: -100 to 100. Left rear wheel speed. Range: -100 to 100. Result: Returns the input speeds of four wheels with timestamp: $PQTMVEHMSG,3,,,,,* Example: //Input: $PQTMVEHMSG,3,0,3.6,3.6,3.6,3.6*19 //Output: $PQTMVEHMSG,3,3748292,3.6,3.6,3.6,3.6*18 3.1.3.4. If = 4 Synopsis: $PQTMVEHMSG,4,,,,,* Parameter: Field Format Numeric Unit Millisecond Description Timestamp since power-on. 32-bit unsigned integer. Always 0 when this message is input. LC29H(BA,CA,DA)_DR&RTK_Application_Note 17 / 31 GNSS Module Series Field Format Unit Numeric Tick Numeric Tick Numeric Tick Numeric Tick Numeric - Description Left front wheel tick count. Right front wheel tick count. Left rear wheel tick count. Right rear wheel tick count. Forward/backward indicator. 0 = Invalid state 1 = Forward 2 = Backward Result: Returns the input cumulative wheel ticks of four wheels with timestamp: $PQTMVEHMSG,4,,,,,* Example: //Input: $PQTMVEHMSG,4,0,100,100,100,100,1*03 //Output: $PQTMVEHMSG,4,153954,100,100,100,100,1*3C 3.1.4. PQTMSAVEPAR Saves the configurations set via $PQTM commands or $PAIR6010 into NVM. Reset the module after executing this command. Type: Command Synopsis: $PQTMSAVEPAR* Parameter: None LC29H(BA,CA,DA)_DR&RTK_Application_Note 18 / 31 GNSS Module Series Result: ⚫ If successful, the module returns: $PQTMSAVEPAR,OK*72 ⚫ If failed, the module returns: $PQTMSAVEPAR,ERROR,* Parameter: Field Format Numeric Unit Description Error code. - 1 = Invalid parameters 2 = Failed execution Example: $PQTMSAVEPAR*5A $PQTMSAVEPAR,OK*72 3.1.5. PQTMRESTOREPAR Restores all DR related configurations to default values. Type: Command Synopsis: $PQTMRESTOREPAR* Parameter: None Result: ⚫ If successful, the module returns: $PQTMRESTOREPAR,OK*3B ⚫ If failed, the module returns: $PQTMRESTOREPAR,ERROR,* LC29H(BA,CA,DA)_DR&RTK_Application_Note 19 / 31 Parameter: Field Format Numeric Example: $PQTMRESTOREPAR*13 $PQTMRESTOREPAR,OK*3B GNSS Module Series Unit Description Error code. - 1 = Invalid parameters 2 = Failed execution 3.1.6. PQTMINS Outputs navigation results. Type: Output Synopsis: $PQTMINS,,,,,,,,,,,* Parameter: Field Format Numeric Numeric Numeric Numeric Numeric Numeric Numeric Unit Description Millisecond Degree Timestamp since power-on. 32-bit unsigned integer. Solution type. 0 = DR not ready. Roll and pitch ready. 1 = DR not ready. GNSS, roll, pitch, and relative heading ready. 2 = GNSS + DR mode. DR calibrated. 3 = DR only mode. Latitude. Degree Longitude. Meter Height. m/s Northward velocity. m/s Eastward velocity. LC29H(BA,CA,DA)_DR&RTK_Application_Note 20 / 31 GNSS Module Series Field Format Numeric Numeric Numeric Numeric Unit m/s Degree Degree Degree Description Downward velocity. Roll angle. Pitch angle. Heading angle. Example: $PQTMINS,240951,1,31.82222216,117.11578436,62.555605,-0.004233,0.005535,0.004011,0.00,0.00,127.41*40 NOTE 1. All angles are scaled from -180.0 to 179.9 with a wrap-around to 0.0 at +180.0. -180.0 = South, 180.0/0.0 = North, +90.0 = East, and -90.0 = West. 2. This message is only supported by LC29H (BA) and LC29H (CA) with software versions dedicated for two-wheel vehicles. Contact Quectel Technical Support for details about the software versions. 3.1.7. PQTMIMU Outputs the IMU raw data: acceleration, angular rate, and hardware wheel ticks. These values should match vehicle frame, see Figure 1: Reference Frame for details. Type: Output Synopsis: $PQTMIMU,,,,,,,,< WheelTickCNT>,* Parameter: Field Format Numeric Numeric Numeric Unit Millisecond m/s^2 Description Timestamp since power-on. 32-bit unsigned integer. Acceleration in X-axis direction. m/s^2 Acceleration in Y-axis direction. LC29H(BA,CA,DA)_DR&RTK_Application_Note 21 / 31 GNSS Module Series Field Format Numeric Numeric Numeric Numeric Numeric Numeric Unit Description m/s^2 Acceleration in Z-axis direction. deg/s Angular rate in X-axis direction. deg/s Angular rate in Y-axis direction. deg/s Angular rate in Z-axis direction. Tick Cumulative wheel ticks. Millisecond Last tick timestamp. Example: $PQTMIMU,45454,-1.356730,-0.210568,9.757930,0.564879,0.549612,-0.412209,0,0*77 NOTE This message is only supported by LC29H (BA) and LC29H (CA) with software versions dedicated for two-wheel vehicles. Contact Quectel Technical Support for details about the software versions. 3.1.8. PQTMGPS Outputs the position status in GNSS only mode. Type: Output Synopsis: $PQTMGPS,,,,,,,,,,,,* Parameter: Field Format Numeric Numeric Numeric Unit Description Millisecond Timestamp since power-on. 32-bit unsigned integer. Second Time of week. Degree Latitude. LC29H(BA,CA,DA)_DR&RTK_Application_Note 22 / 31 GNSS Module Series Field Format Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Unit Degree Meter m/s Degree Meter - Numeric - Description Longitude. Altitude. Ground speed (two-dimensional). Heading of vehicle (two-dimensional). Horizontal accuracy estimate. Horizontal dilution of precision. Position dilution of precision. Number of satellites used in navigation. Fix mode. 0 = No fix 2 = 2D fix 3 = 3D fix Example: $PQTMGPS,86139,94183,31.82218794,117.11579022,65.755080,0.027,94.68,2.533952,0.555471,0.88 6183,29,3*6B NOTE This message is only supported by LC29H (BA) and LC29H (CA) with software versions dedicated for two-wheel vehicles. Contact Quectel Technical Support for details about the software versions. 3.1.9. PQTMCFGEINSMSG Sets/gets $PQTMINS, $PQTMIMU and $PQTMGPS message configurations. Type: Set/get Synopsis: //Set message configurations: $PQTMCFGEINSMSG,,,,,* //Get message configurations: LC29H(BA,CA,DA)_DR&RTK_Application_Note 23 / 31 GNSS Module Series $PQTMCFGEINSMSG,* Parameter: Field Format Unit Numeric Numeric Numeric Numeric Numeric Hz Description Set/get message configurations. 0 = Get 1 = Set Enable/disable the output of $PQTMINS message. 0 = Disable 1 = Enable Enable/disable the output of $PQTMIMU message. 0 = Disable 1 = Enable Enable/disable the output of $PQTMGPS message. 0 = Disable 1 = Enable Set the output rate of $PQTMINS, $PQTMIMU or $PQTMGPS message. It can be 1, 2, 4, 5, 10. $PQTMGPS always outputs at 1 Hz even if configured to greater than 1 Hz. Result: ⚫ If successful, the module returns: $PQTMCFGEINSMSGOK*16 ⚫ If failed, the module returns: $PQTMCFGEINSMSGERROR*4A Example: //Set message configurations: $PQTMCFGEINSMSG,1,1,1,1,10*3F $PQTMCFGEINSMSGOK*16 //Get message configurations: $PQTMCFGEINSMSG,0*0E $PQTMEINSMSG,0,1,1,1,10*3E NOTE 1. Send $PQTMSAVEPAR*5A and reset the module for $PQTMCFGEINSMSG to take effect. 2. This command is only supported by LC29H (BA) and LC29H (CA) with software versions dedicated LC29H(BA,CA,DA)_DR&RTK_Application_Note 24 / 31 GNSS Module Series for two-wheel vehicles. Contact Quectel Technical Support for details about the software versions. 3.1.10. PQTMVEHMOT Outputs vehicle motion information after DR calibration. Type: Output Synopsis: $PQTMVEHMOT,,,* Parameter: Field Format Numeric Numeric Numeric Unit m/s2 deg/s Description Message version. Fixed as 1. Peak acceleration of vehicle. Peak angular rate of vehicle. Example: $PQTMVEHMOT,1,0.288124,0.159930*0A NOTE This message is only supported by LC29H (BA) and LC29H (CA) with software versions dedicated for four-wheel vehicles. Contact Quectel Technical Support for details about the software versions. 3.1.11. PQTMSENMSG Outputs sensor information. Type: Output Synopsis: $PQTMSENMSG,,,[,,…,]* LC29H(BA,CA,DA)_DR&RTK_Application_Note 25 / 31 GNSS Module Series Parameter: Field Format Numeric Numeric to Numeric Unit Description 4 = IMU sensor data matching vehicle reference frame. - See Figure 1: Reference Frame for details. Millisecond Timestamp since power-on. 32-bit unsigned integer. Sensor information. See Chapter 3.1.11.1 If - = 4 for details. 3.1.11.1. If = 4 Synopsis: $PQTMSENMSG,4,,,,,,< IMU_ACC_X>,,* Parameter: Field Format Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Unit Millisecond Celsius dps dps dps g g g Description Timestamp since power-on. IMU temperature. IMU X-axis gyro value. IMU Y-axis gyro value. IMU Z-axis gyro value. IMU X-axis accelerometer value. IMU Y-axis accelerometer value. IMU Z-axis accelerometer value. Example: $PQTMSENMSG,4,1977253,29.830917,1.727613,0.015743,0.804347,-0.250096,0.467039,10.444151*24 LC29H(BA,CA,DA)_DR&RTK_Application_Note 26 / 31 GNSS Module Series NOTE This message is only supported by LC29H (BA) and LC29H (CA) with software versions dedicated for four-wheel vehicles. Contact Quectel Technical Support for details about the software versions. 3.2. PAIR Messages This chapter explains DR related PAIR messages (proprietary NMEA messages defined by the chipset supplier). 'P' means proprietary message, 'AIR' means the command defined by the chipset supplier. 3.2.1. Packet Type: 6010 PAIR_CUSTOM_SET_MSG_OUTPUT Enables/disables the output of $PQTMDRCAL, $PQTMIMUTYPE, $PQTMVEHMSG, $PQTMVEHMOT and $PQTMSENMSG messages. Type: Set Synopsis: $PAIR6010,,* Parameter: Field Format Unit Numeric - Numeric - Description Message type. -1 = Reset output state of all following sentence types to the default value 0 = $PQTMVEHMSG (Default: disabled) 1 = $PQTMSENMSG (Default: disabled) 2 = $PQTMDRCAL (Default: disabled) 3 = $PQTMIMUTYPE (Default: enabled) 4 = $PQTMVEHMOT (Default: disabled) Message output state. 0 = Disabled 1 = Enabled Result: Returns $PAIR001 message. See document [1] protocol specification for details. LC29H(BA,CA,DA)_DR&RTK_Application_Note 27 / 31 Example: $PAIR6010,0,1*0C $PAIR001,6010,0*0C GNSS Module Series NOTE 1. Send $PQTMSAVEPAR*5A and reset the module for $PAIR6010 to take effect. 2. The output rate of $PQTMVEHMSG and $PQTMSENMSG is always 10 Hz. The output rate of $PQTMDRCAL and $PQTMVEHMOT depends on position fix rate. $PQTMIMUTYPE is only output once after each boot-up. 3.2.2. Packet Type: 6011 PAIR_CUSTOM_GET_MSG_OUTPUT Gets whether the output of $PQTMDRCAL, $PQTMIMUTYPE, $PQTMVEHMSG, $PQTMVEHMOT and $PQTMSENMSG messages is enabled. Type: Get Synopsis: $PAIR6011,* Parameter: Field Format Unit Numeric - Description Message type. 0 = $PQTMVEHMSG 1 = $PQTMSENMSG 2 = $PQTMDRCAL 3 = $PQTMIMUTYPE 4 = $PQTMVEHMOT Result: Returns $PAIR001 message and query result. See document [1] protocol specification for details. Query result message format: $PAIR6011,,* LC29H(BA,CA,DA)_DR&RTK_Application_Note 28 / 31 Parameters included in the result: Field Format Unit Numeric - Numeric - Example: $PAIR6011,1*11 $PAIR001,6011,0*0D $PAIR6011,1,0*0D GNSS Module Series Description Message type. 0 = $PQTMVEHMSG 1 = $PQTMSENMSG 2 = $PQTMDRCAL 3 = $PQTMIMUTYPE 4 = $PQTMVEHMOT Message output state. 0 = Disabled 1 = Enabled NOTE This command is only supported by LC29H (BA) and LC29H (CA) with software versions dedicated for four-wheel vehicles. Contact Quectel Technical Support for details about the software versions. LC29H(BA,CA,DA)_DR&RTK_Application_Note 29 / 31 GNSS Module Series 4 Appendix A References Table 2: Related Document Document Name [1] Quectel_LC29H&LC79H_Series_GNSS_Protocol_Specification Table 3: Terms and Abbreviations Abbreviation ARP BDS DR GLONASS GNSS GPS IMU MSM NMEA PQTM QZSS RTCM RTK Description Antenna Reference Point BeiDou Navigation Satellite System Dead Reckoning Global Navigation Satellite System (Russian) Global Navigation Satellite System Global Positioning System Inertial Measurement Unit Multiple Signal Message NMEA (National Marine Electronics Association) 0183 Interface Standard Proprietary Protocol of Quectel Quasi-Zenith Satellite System Radio Technical Commission for Maritime Services Real-Time Kinematic LC29H(BA,CA,DA)_DR&RTK_Application_Note 30 / 31 GNSS Module Series 5 Appendix B Special Characters Table 4: Special Characters Special Character [...] {…} Underline Definition Carriage return character. Line feed character. Parameter name. Angle brackets do not appear in the message. Optional field of a message. Square brackets do not appear in the message. Repeated field of a message. Curly brackets do not appear in the message. Default setting of a parameter. LC29H(BA,CA,DA)_DR&RTK_Application_Note 31 / 31

LC26G (AB)&LC76G Series I2C Application Note GNSS Module Series Version: 1.0 Date: 2022-09-16 Status: Released GNSS Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. LC26G(AB)&LC76G_Series_I2C_Application_Note 1 / 23 GNSS Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. LC26G(AB)&LC76G_Series_I2C_Application_Note 2 / 23 GNSS Module Series About the Document Document Information Title Subtitle Document Type Document Status LC26G (AB)&LC76G Series I2C Application Note GNSS Module Series Application Note Released Revision History Revision Date - 2022-07-21 1.0 2022-09-16 Description Creation of the document First official release LC26G(AB)&LC76G_Series_I2C_Application_Note 3 / 23 GNSS Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 Figure Index ................................................................................................................................................ 6 1 Introduction ......................................................................................................................................... 7 2 NMEA Data Reading ........................................................................................................................... 8 2.1. NMEA Data Reading Flow of Master ......................................................................................... 8 3 NEMA Data Writing ........................................................................................................................... 12 3.1. NEMA Data Writing Flow of Master ......................................................................................... 12 4 Sample Code for I2C Reading/Writing Sequence.......................................................................... 16 4.1. Sample Code ........................................................................................................................... 16 5 Appendix References ....................................................................................................................... 23 LC26G(AB)&LC76G_Series_I2C_Application_Note 4 / 23 GNSS Module Series Table Index Table 1: Related Document........................................................................................................................ 23 Table 2: Terms and Abbreviations .............................................................................................................. 23 LC26G(AB)&LC76G_Series_I2C_Application_Note 5 / 23 GNSS Module Series Figure Index Figure 1: NMEA Data Reading Flow of the Master in Step 1 ...................................................................... 9 Figure 2: NMEA Data Reading Flow of Master in Step 2 .......................................................................... 10 Figure 3: NMEA Data Reading Flow of Master...........................................................................................11 Figure 4: Data Writing Flow of Master in Step 1 ........................................................................................ 13 Figure 5: Data Writing Flow of Master in Step 2 ........................................................................................ 14 Figure 6: Data Writing Flow of Master ....................................................................................................... 15 LC26G(AB)&LC76G_Series_I2C_Application_Note 6 / 23 GNSS Module Series 1 Introduction This document outlines the I2C function and its usage on Quectel LC26G (AB) and LC76G series modules. The modules always operate as slave device when communicating with the master (client-side MCU). The master can read/write any data via I2C bus. The features of the modules’ I2C interface: ⚫ Works in slave mode ⚫ Standard mode (100 kbps) and fast mode (400 kbps) ⚫ 7-bit address ⚫ Supports sending and receiving variable length messages ⚫ I2C pins: I2C_SDA and I2C_SCL In addition, this document also provides a detailed introduction as well as a flow chart and sample code to illustrate how the master reads NMEA messages and transmits/receives $PQTM or $PAIR messages via the I2C bus. LC26G(AB)&LC76G_Series_I2C_Application_Note 7 / 23 GNSS Module Series 2 NMEA Data Reading This chapter provides a detailed explanation on how the master reads NMEA data packets via the I2C bus. The length of NMEA data is not fixed, and needs to be read from the module to determine. The capacity of the slave’s I2C buffer is 4096 bytes, which means that the master can read one I2C data packet of a maximum size of 4096 bytes at a time. To read a complete NMEA packet of one second, the master needs to read several I2C data packets and then extract valid NMEA data from them. 2.1. NMEA Data Reading Flow of Master The master reads NMEA data as follows: Step 1 The master reads the NMEA data length in the slave transmit buffer. The master sends a configuration read command to the slave. ⚫ 7-bit slave address is 0x50. ⚫ The sent data is two words: 0xAA510008 and 0x00000004 (little-endian transmission). The master receives the NMEA data length from the slave transmit buffer. ⚫ 7-bit slave address is 0x54. ⚫ The master receives the NMEA data length from the slave transmit buffer. LC26G(AB)&LC76G_Series_I2C_Application_Note 8 / 23 GNSS Module Series 0xAA510008 Data (8 bytes) 0x00000004 S T MASTER A R T (0x50<<1) & 0xFE 0x08 0x00 0x51 0xAA 0x04 0x00 0x00 S 0x00 T O P SLAVE A A A A A A A A A C C C C C C C C C K K K K K K K K K DEVICE ADDRESS Length of NMEA data (4 bytes) MASTER S T A R (0x54<<1 ) | 0x01 T A C K A C K A C K S NACK T O P SLAVE A C DATA 1 K DATA 2 DATA 3 DATA 4 Figure 1: NMEA Data Reading Flow of the Master in Step 1 Step 2 The master reads the data_read_len 1) bytes of the NMEA data. The master sends configuration read command to the slave. ⚫ 7-bit slave address is 0x50. ⚫ The sent data is two words: 0xAA512000 and data_read_len (little-endian transmission). The master receives the data_read_len bytes of the NMEA data. ⚫ 7-bit slave address is 0x54. ⚫ The master receives the data_read_len bytes of the NMEA data. LC26G(AB)&LC76G_Series_I2C_Application_Note 9 / 23 GNSS Module Series Data (8 bytes) DEVICE ADDRESS 0xAA512000 data_read_len (e.g. 200 bytes) MASTER SLAVE S T A R (0x50<<1) & 0xFE T 0x00 0x20 0x51 0xAA 0xC8 0x00 0x00 S 0x00 T O P A A A A A A A A A C C C C C C C C C K K K K K K K K K DEVICE ADDRESS NMEA data (data_read_len bytes) S T MASTER A R T (0x54<<1) | 0x01 A A A C C C K K K SLAVE A C DATA 1 K DATA 2 DATA 3 A C K S NACK T O P DATA N Figure 2: NMEA Data Reading Flow of Master in Step 2 NOTE 1. 1) Unsigned int data_read_len defines the length of NMEA data that master needs to receive. The data_read_len should be less than or equal to the length read in the Step 1. 2. If user does not read the data on time, the transmitter buffer will be full and the I2C transmitter will enter sleep state. Sending any command to the module via I2C port can wake up the I2C transmitter. 3. 1 word = 4 bytes. 4. The module transmits data in little-endian format. LC26G(AB)&LC76G_Series_I2C_Application_Note 10 / 23 GNSS Module Series Master Slave Delay 1) Slave address: 0X50 Sends two words of data: 0xAA510008 and 0x00000004 Delay 1) Slave address: 0X54 Receives the length of NMEA data Delay 1) Slave address: 0X50 Sends two words of data: 0xAA512000 and data_read_len Delay 1) Slave address: 0X54 Receives NMEA data (data_read_len bytes) Figure 3: NMEA Data Reading Flow of Master NOTE 1)The time of delay is about 10 ms. LC26G(AB)&LC76G_Series_I2C_Application_Note 11 / 23 GNSS Module Series 3 NEMA Data Writing The master can send messages to the slave via I2C bus. See document [1] for detailed information on the messages. As the maximum capacity of the slave’s I2C receive buffer is 4096 bytes, each message input by the master should be 4096 bytes at most. The interval between two input messages cannot be less than 10 ms because the slave needs 10 ms to process the input data. 3.1. NEMA Data Writing Flow of Master The master writes NEMA data as following: Step 1 The master reads the free length in the slave receive buffer. a) The master sends a configuration read command to the slave. ⚫ 7-bit slave address is 0x50. ⚫ The sent data is two words: 0xAA510004 and 0x00000004 (little-endian transmission). b) The master receives the free length from the slave receive buffer. ⚫ 7-bit slave address is 0x54. ⚫ The master receives the free length in the slave receive buffer. LC26G(AB)&LC76G_Series_I2C_Application_Note 12 / 23 GNSS Module Series Data (8 bytes) DEVICE ADDRESS 0xAA510004 0x00000004 S MASTER T A R (0x50<<1) & 0xFE T 0x04 0x00 0x51 0xAA 0x04 0x00 0x00 S 0x00 T O P SLAVE A A A A A A A A A C C C C C C C C C K K K K K K K K K DEVICE ADDRESS Free Length from slave buffer (4 bytes) MASTER S T A R (0x54<<1) | 0x01 T A C K A C K A C K S NACK T O P SLAVE A C DATA 1 K DATA 2 DATA 3 DATA 4 Figure 4: Data Writing Flow of Master in Step 1 Step 2 The master writes data_written_len1) bytes of data. a) The master sends configuration write command to the slave. ⚫ 7-bit slave address is 0x50. ⚫ The sent data is two words: 0xAA531000 and data_written_len (little-endian transmission). b) The master writes data_written_len bytes of data. ⚫ 7-bit slave address is 0x58. ⚫ The master writes data_written_len bytes of data. LC26G(AB)&LC76G_Series_I2C_Application_Note 13 / 23 GNSS Module Series Data (8 bytes) DEVICE ADDRESS 0xAA531000 data_written_len (e.g.30 bytes) S MASTER T A R T (0x50<<1) & 0xFE 0x00 0x10 0x53 0xAA 0x1E 0x00 0x00 S 0x00 T O P SLAVE A A A A A A A A A C C C C C C C C C K K K K K K K K K DEVICE ADDRESS Message Data (data_written_len bytes) S T MASTER A R T (0x58<<1) & 0xFE DATA 1 DATA 2 DATA 3 SLAVE A A A A C C C C K K K K S DATA N T O P A A C C K K Figure 5: Data Writing Flow of Master in Step 2 NOTE 1. 1) Unsigned int data_written_len defines the length of NEMA data that master needs to write. 2. The free length in the salve receiver buffer is the maximum length master can write. Sent data that exceeds the free length in the slave receive buffer can not be written in by the module. 3. 1 word = 4 bytes. 4. The module transmits data in little-endian format. LC26G(AB)&LC76G_Series_I2C_Application_Note 14 / 23 GNSS Module Series Master Slave Delay 1) Slave address: 0X50 Sends two words of data: 0xAA510004 and 0x00000004 Delay 1) Slave address: 0X54 Receives the free length Delay 1) Slave address: 0X50 Sends two words of data: 0xAA531000 and data_written_len Delay 1) Slave address: 0X58 Writes data (data_written_len) Figure 6: Data Writing Flow of Master NOTE 1)The time of delay is about 10 ms. LC26G(AB)&LC76G_Series_I2C_Application_Note 15 / 23 GNSS Module Series 4 Sample Code for I2C Reading/Writing Sequence 4.1. Sample Code The sample code for reading data from and writing data to the I2C buffer is shown below. #define QUECTEL_I2C_SLAVE_CR_CMD 0xaa51 #define QUECTEL_I2C_SLAVE_CW_CMD 0xaa53 #define QUECTEL_I2C_SLAVE_CMD_LEN #define QUECTEL_I2C_SLAVE_TX_LEN_REG_OFFSET #define QUECTEL_I2C_SLAVE_TX_BUF_REG_OFFSET 8 0x08 0x2000 #define QUECTEL_I2C_SLAVE_RX_LEN_REG_OFFSET #define QUECTEL_I2C_SLAVE_RX_BUF_REG_OFFSET 0x04 0x1000 #define QUECTEL_I2C_SLAVE_ADDRESS_CR_OR_CW #define QUECTEL_I2C_SLAVE_ADDRESS_R #define QUECTEL_I2C_SLAVE_ADDRESS_W 0x50 0x54 0x58 #define MAX_ERROR_NUMBER 20 #define MAX_I2C_BUFFER 1024 typedef enum { I2C_ACK = 0, I2C_NACK = 1 }I2c_Resp_FlagStatus; typedef enum { DEV_REP_SUCCESS = 0, DEV_REP_ERROR = 1 }Dev_Resp_FlagStatus; I2c_Resp_FlagStatus I2c_Master_Receive(uint8_t addr, uint8_t *Data, uint16_t Length) LC26G(AB)&LC76G_Series_I2C_Application_Note 16 / 23 GNSS Module Series { mcu_i2c_start(); mcu_i2c_send_byte(addr|0x01); if(mcu_i2c_wait_ack() != I2C_ACK) { mcu_i2c_stop(); return I2C_NACK; } for(int i = 0; i < Length; i++) { *(Data + i) = mcu_i2c_receive_byte(); if(i != (Length - 1)) { mcu_i2c_ack(); } } mcu_i2c_no_ack(); mcu_i2c_stop(); return I2C_ACK; } I2c_Resp_FlagStatus I2c_Master_Transmit(uint8_t addr, uint8_t *Data, uint8_t Length) { uint8_t i = 0; uint8_t flag=0; mcu_i2c_start(); mcu_i2c_send_byte(addr); if(mcu_i2c_wait_ack() == I2C_NACK) { mcu_i2c_stop(); return I2C_NACK; } for(i = 0; i < Length; i++) { mcu_i2c_send_byte(*(Data+i)); if(mcu_i2c_wait_ack() == I2C_NACK) { mcu_i2c_stop(); return I2C_NACK; } } mcu_i2c_stop(); return I2C_ACK; } LC26G(AB)&LC76G_Series_I2C_Application_Note 17 / 23 GNSS Module Series Dev_Resp_FlagStatus Quectel_Dev_Receive(uint8_t* pData, uint16_t maxLength, uint16_t* pRecLength) { uint32_t request_cmd[2]; uint16_t* pRxLength = pRecLength; uint8_t* pBuff = pData; uint8_t i2c_master_receive_error_counter = 0; I2c_Resp_FlagStatus status; //step 1_a request_cmd[0] = (uint32_t)((uint32_t)(QUECTEL_I2C_SLAVE_CR_CMD << 16) | QUECTEL_I2C_SLAVE_TX_LEN_REG_OFFSET); request_cmd[1] = 4; i2c_master_receive_error_counter = 0; while(1) { delay_ms(10); status = I2c_Master_Transmit(QUECTEL_I2C_SLAVE_ADDRESS_CR_OR_CW << 1, (uint8_t *)request_cmd, QUECTEL_I2C_SLAVE_CMD_LEN); if(status == I2C_ACK) { break; } i2c_master_receive_error_counter++; if(i2c_master_receive_error_counter > MAX_ERROR_NUMBER) { return DEV_REP_ERROR; } } //step 1_b i2c_master_receive_error_counter = 0; while(1) { delay_ms(10); status = I2c_Master_Receive(QUECTEL_I2C_SLAVE_ADDRESS_R << 1, (uint8_t*)pRxLength, 4); if(status == I2C_ACK) { break; } LC26G(AB)&LC76G_Series_I2C_Application_Note 18 / 23 GNSS Module Series i2c_master_receive_error_counter++; if(i2c_master_receive_error_counter > MAX_ERROR_NUMBER) { return DEV_REP_ERROR; } } if(*pRxLength == 0) { return DEV_REP_ERROR; } if(*pRxLength > MAX_I2C_BUFFER) { *pRxLength = MAX_I2C_BUFFER; } //step 2_a request_cmd[0] = (uint32_t)(QUECTEL_I2C_SLAVE_CR_CMD << 16) | QUECTEL_I2C_SLAVE_TX_BUF_REG_OFFSET; request_cmd[1] = *pRxLength; i2c_master_receive_error_counter = 0; while(1) { delay_ms(10); status = I2c_Master_Transmit(QUECTEL_I2C_SLAVE_ADDRESS_CR_OR_CW << 1, (uint8_t *)request_cmd, QUECTEL_I2C_SLAVE_CMD_LEN); if(status == I2C_ACK) { break; } i2c_master_receive_error_counter++; if(i2c_master_receive_error_counter > MAX_ERROR_NUMBER) { *pRxLength = 0; return DEV_REP_ERROR; } } //step 2_b i2c_master_receive_error_counter = 0; while(1) { LC26G(AB)&LC76G_Series_I2C_Application_Note 19 / 23 GNSS Module Series delay_ms(10); status = I2c_Master_Receive(QUECTEL_I2C_SLAVE_ADDRESS_R << 1, pBuff, *pRxLength); if(status == I2C_ACK) { return DEV_REP_SUCCESS; } i2c_master_receive_error_counter++; if(i2c_master_receive_error_counter > MAX_ERROR_NUMBER) { *pRxLength = 0; return DEV_REP_ERROR; } } return DEV_REP_SUCCESS; } Dev_Resp_FlagStatus Quectel_Dev_Transmit(uint8_t *pData, uint16_t dataLength) { uint32_t request_cmd[2]; uint16_t rxBuffLength = 0; uint8_t i2c_master_receive_error_counter = 0; I2c_Resp_FlagStatus status; //step 1_a request_cmd[0] = (uint32_t)((QUECTEL_I2C_SLAVE_CR_CMD << 16) | QUECTEL_I2C_SLAVE_RX_LEN_REG_OFFSET); request_cmd[1] = 4; i2c_master_receive_error_counter = 0; while(1) { delay_ms(10); status = I2c_Master_Transmit(QUECTEL_I2C_SLAVE_ADDRESS_CR_OR_CW << 1, (uint8_t *)request_cmd, QUECTEL_I2C_SLAVE_CMD_LEN); if(status == I2C_ACK) { break; } LC26G(AB)&LC76G_Series_I2C_Application_Note 20 / 23 GNSS Module Series i2c_master_receive_error_counter++; if(i2c_master_receive_error_counter > MAX_ERROR_NUMBER) { return DEV_REP_ERROR; } } //step 1_b i2c_master_receive_error_counter = 0; while(1) { delay_ms(10); status = I2c_Master_Receive(QUECTEL_I2C_SLAVE_ADDRESS_R << 1, (uint8_t*)&rxBuffLength, 4); if(status == I2C_ACK) { break; } i2c_master_receive_error_counter++; if(i2c_master_receive_error_counter > MAX_ERROR_NUMBER) { return DEV_REP_ERROR; } } if(dataLength > rxBuffLength) { return DEV_REP_ERROR; } //step 2_a request_cmd[0] = (uint32_t)(QUECTEL_I2C_SLAVE_CW_CMD << 16) | QUECTEL_I2C_SLAVE_RX_BUF_REG_OFFSET; request_cmd[1] = dataLength; i2c_master_receive_error_counter = 0; while(1) { delay_ms(10); status = I2c_Master_Transmit(QUECTEL_I2C_SLAVE_ADDRESS_CR_OR_CW << 1, (uint8_t *)request_cmd, QUECTEL_I2C_SLAVE_CMD_LEN); if(status == I2C_ACK) { break; LC26G(AB)&LC76G_Series_I2C_Application_Note 21 / 23 GNSS Module Series } i2c_master_receive_error_counter++; if(i2c_master_receive_error_counter > MAX_ERROR_NUMBER) { return DEV_REP_ERROR; } } //step 2_b i2c_master_receive_error_counter = 0; while(1) { delay_ms(10); status = I2c_Master_Transmit(QUECTEL_I2C_SLAVE_ADDRESS_W << 1, pData, dataLength); if(status == I2C_ACK) { return DEV_REP_SUCCESS; } i2c_master_receive_error_counter++; if(i2c_master_receive_error_counter > MAX_ERROR_NUMBER) { return DEV_REP_ERROR; } } return DEV_REP_SUCCESS; } LC26G(AB)&LC76G_Series_I2C_Application_Note 22 / 23 GNSS Module Series 5 Appendix References Table 1: Related Document Document Name [1] Quectel_LC26G&LC76G&LC86G_Series_GNSS_Protocol_Specification Table 2: Terms and Abbreviations Abbreviation ACK GNSS I2C MCU NMEA SCL SDA Description Acknowledge Global Navigation Satellite System Inter-Integrated Circuit Microcontroller Unit National Marine Electronics Association Serial Clock Serial Data LC26G(AB)&LC76G_Series_I2C_Application_Note 23 / 23

LC29D Series&LC79D (D) AGNSS Application Note GNSS Module Series Version: 1.1 Date: 2022-09-10 Status: Released GNSS Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. LC29D_Series&LC79D(D)_AGNSS_Application_Note 1 / 18 GNSS Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. LC29D_Series&LC79D(D)_AGNSS_Application_Note 2 / 18 GNSS Module Series About the Document Document Information Title Subtitle Document Type Document Status LC29D Series&LC79D (D) AGNSS Application Note GNSS Module Series Application Note Released Revision History Version 1.0 1.1 Date 2021-08-16 2021-11-01 2022-09-10 Description Creation of the document First official release Added applicable module LC79D (D) LC29D_Series&LC79D(D)_AGNSS_Application_Note 3 / 18 GNSS Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 2 AGNSS Implementation...................................................................................................................... 7 2.1. Bream Messages for AGNSS Implementation .......................................................................... 7 2.1.1. BRM-AST-LTO (0x13 0x20) ............................................................................................ 7 2.1.2. BRM-AST-REF_LOCATION (0x13 0x40) ....................................................................... 8 2.1.3. BRM-AST-REF_TIME_UTC (0x13 0x40) ....................................................................... 9 2.2. Download LTO File from AGNSS Server ................................................................................. 10 2.3. LTO File Format ........................................................................................................................11 2.4. Send LTO Data to Modules.......................................................................................................11 3 AGNSS Testing Procedures ............................................................................................................ 13 3.1. Prerequisites ............................................................................................................................ 13 3.2. Procedures ............................................................................................................................... 13 3.3. Results ..................................................................................................................................... 17 4 Appendix References ....................................................................................................................... 18 LC29D_Series&LC79D(D)_AGNSS_Application_Note 4 / 18 GNSS Module Series Table Index Table 1: BRM-AST-LTO Message Structure ................................................................................................ 7 Table 2: BRM-AST-LTO Message Content .................................................................................................. 7 Table 3: BRM-AST-REF_LOCATION Message Structure ........................................................................... 8 Table 4: BRM-AST-REF_LOCATION Message Content ............................................................................. 8 Table 5: BRM-AST-REF_TIME_UTC Message Structure ........................................................................... 9 Table 6: BRM-AST-REF_TIME_UTC Message Content ............................................................................. 9 Table 7: Related Documents ...................................................................................................................... 18 Table 8: Terms and Abbreviations .............................................................................................................. 18 LC29D_Series&LC79D(D)_AGNSS_Application_Note 5 / 18 GNSS Module Series 1 Introduction The LC29D series and LC79D (D) GNSS modules support the AGNSS feature that significantly reduces the modules’ TTFF, especially in challenging signal scenarios. To implement the AGNSS feature, the modules should get the assistance data including the current time, rough position, and LTO data. Consult the following chapter to find out how to send the assistance data to the modules. The list of Bream messages used by the AGNSS feature is also provided for your reference. Before using the AGNSS feature, make sure to verify that everything is set up correctly. For more information on testing the modules, see Chapter 3 AGNSS Testing Procedures. LC29D_Series&LC79D(D)_AGNSS_Application_Note 6 / 18 GNSS Module Series 2 AGNSS Implementation This chapter explains AGNSS implementation on the LC29D series and LC79D (D) GNSS modules and the procedure for sending LTO data to the modules. It also includes the list of Bream messages. 2.1. Bream Messages for AGNSS Implementation The LC29D series and LC79D (D) modules can be controlled and configured through Bream input messages defined by the chipset supplier. For details, see document [1] . 2.1.1. BRM-AST-LTO (0x13 0x20) Message for injecting a six-hour Bream LTO page into the GNSS device. You can download the Bream LTO file from Quectel AGNSS server. For details, see Chapter 2.2 Download LTO File from AGNSS Server. Type: Input Table 1: BRM-AST-LTO Message Structure Header Message Group 0xB5 0x62 0x13 Message Number 0x20 Length (Bytes) Content Checksum See Table 2: BRM-AST-LTO 76 CHK1 CHK2 Message Content. Table 2: BRM-AST-LTO Message Content Byte Offset C99 0 uint8_t 1 uint8_t 2 uint8_t Scaling Name Unit - Type - - Version - - SvID - Description Message type (0x00). Message version (0x00). Satellite identifier. LC29D_Series&LC79D(D)_AGNSS_Application_Note 7 / 18 Byte Offset C99 Scaling Name Unit 3 uint8_t - GNSS_ID - 4 uint8_t - Year - 5 uint8_t - Month - 6 uint8_t - Day - 7 uint8_t - Reserved - 8 uint8_t[64] - Data - 72 uint8_t[4] - FCT s GNSS Module Series Description For details, see document [1]. GNSS identifier. For details, see document [1]. Years since 2000. Month (1–12). Day (1–31). Reserved. Assistance data. Full-cycle time (FCT). 2.1.2. BRM-AST-REF_LOCATION (0x13 0x40) Reference position assistance. The message allows the delivery of position-assistance data to the GNSS device. Type: Input Table 3: BRM-AST-REF_LOCATION Message Structure Header Message Group Message Number 0xB5 0x62 0x13 0x40 Length (Bytes) 20 Content See Table 4: BRM-AST-REF_LOCATION Message Content. Checksum CHK1 CHK2 Table 4: BRM-AST-REF_LOCATION Message Content Byte Offset C99 Scaling Name Unit 0 uint8_t - Type - 1 uint8_t - Reserved1 - 2 uint8_t[2] - Reserved2 - Description Message type (0x01). Reserved. Reserved. LC29D_Series&LC79D(D)_AGNSS_Application_Note 8 / 18 GNSS Module Series Byte Offset C99 4 int32_t 8 int32_t 12 int32_t Scaling Name 1e-7 Lat 1e-7 Lon - Alt 16 uint32_t - PosAcc Unit Degree Degree cm cm Description WGS84 latitude. WGS84 longitude. WGS84 altitude. Position accuracy (standard deviation in 3D, both horizontal and vertical). NOTE Supplying position assistance inaccurate by more than the specified position accuracy may lead to substantially degraded receiver performance. 2.1.3. BRM-AST-REF_TIME_UTC (0x13 0x40) Reference time assistance. The message allows the delivery of UTC time assistance to the GNSS device. Type: Input Table 5: BRM-AST-REF_TIME_UTC Message Structure Header 0xB5 0x62 Message Group 0x13 Message Number Length (Bytes) 0x40 24 Content Checksum See Table 6: BRM-AST-REF_TIME_UTC Message Content. CHK1 CHK2 Table 6: BRM-AST-REF_TIME_UTC Message Content Byte Offset C99 0 uint8_t 1 uint8_t 2 uint8_t Scaling Name Unit - Type - - Version - - Reserved1 - 3 int8_t - LeapSecs s Description Message type (0x10). Message version (0x00). Reserved. Number of leap seconds since 1980 (or 0x80 = –128 if unknown). LC29D_Series&LC79D(D)_AGNSS_Application_Note 9 / 18 GNSS Module Series Byte Offset C99 Scaling Name Unit 4 uint16_t - Year - 6 uint8_t - Month - 7 uint8_t - Day - 8 uint8_t - Hour - 9 uint8_t - Minute - 10 uint8_t - Second - 11 uint8_t - Reserved2 - 12 uint32_t - Nano - 16 uint16_t - TAccS s 18 uint8_t[2] - Reserved3 - 20 uint32_t - TAccNs ns Description Year. Month (1–12). Day (1–31). Hour (0–23). Minute (0–59). Seconds (0–59). Reserved. Nanoseconds (0–999,999,999). Seconds part of time accuracy. Reserved. Nanoseconds part of time accuracy (0–999,999,999). NOTE Supplying the time-assistance data surpassing the specified time accuracy may lead to substantially degraded receiver performance. 2.2. Download LTO File from AGNSS Server Before sending LTO data to the modules, the host must download the LTO file. The LTO file can be downloaded from Quectel AGNSS server, and it is valid up to 7 days. Quectel AGNSS server: ftp://agnss.queclocator.com Quectel AGNSS server supports downloading of LTO files with 2 or 7-day validity. The LTO files have the ' ltoXdv5.brm' naming structure, where the X refers to the validity period and can be either of the following options: 2 or 7. LC29D_Series&LC79D(D)_AGNSS_Application_Note 10 / 18 GNSS Module Series NOTE 1. Quectel AGNSS server is free of charge and there is no SLA while using the server. However, you must have an account to access and use the Quectel AGNSS server. Contact Quectel’s Technical Support Team (support@quectel.com) to apply for an account. 2. You must create your own server instance and download the LTO files. 2.3. LTO File Format The LTO file is composed of multiple BRM-AST-LTO messages as can be seen from the following figure. Figure 1: LTO File Format 2.4. Send LTO Data to Modules Before sending LTO data to the modules, the host must read BRM-AST-LTO messages from the LTO file, and check if the time is valid (within 3 hours before or after the current time). Once the validity of time is confirmed, the host sends successive valid BRM-AST-LTO messages to the modules, until the end of LC29D_Series&LC79D(D)_AGNSS_Application_Note 11 / 18 LTO file is reached. Sample code for checking LTO message validity: int64_t time_unix = get_unix_epoch(); int64_t time_diff = FCT+315964800 - time_unix; int64_t time_threshold = 10800; // 3 hours if((time_diff > -time_threshold) && (time_diff < time_threshold)) { // Current BRM-AST-LTO message is valid. } else { // Current BRM-AST-LTO message is not valid. } GNSS Module Series LC29D_Series&LC79D(D)_AGNSS_Application_Note 12 / 18 GNSS Module Series 3 AGNSS Testing Procedures This chapter illustrates how to test the AGNSS feature by using Quectel’s QGNSS tool. For details, see document [2]. 3.1. Prerequisites Before testing the AGNSS function, make sure that you have: 1. connected the LC29D series or LC79D (D) EVB to your computer. 2. downloaded the QGNSS tool and set the corresponding serial port number, baud rate 1), and the module’s model. 3. created the account for Quectel AGNSS server 2), and you are connected to the AGNSS server through the QGNSS tool. To make the effect of the AGNSS feature on TTFF value more noticeable, you could first get a position fix without using the AGNSS feature. After the testing procedure, you can compare the TTFF results. NOTE 1. 1) Default baud rate of the LC29D series and LC79D (D) modules is 115200 bps. 2. 2) Contact Quectel’s Technical Support Team (support@quectel.com) for information on how to get access to Quectel AGNSS server. 3.2. Procedures To test the AGNSS function in a cold start session: 1. Send BRM-STP-RESET command to the module to perform a cold start. For details, see document [1]. 2. Send BRM-AST-REF_LOCATION command to the module to inject the assistance position. 3. Send BRM-AST-REF_TIME_UTC command to the module to inject the assistance time. LC29D_Series&LC79D(D)_AGNSS_Application_Note 13 / 18 GNSS Module Series 4. Send LTO data to the module: 1) Download the LTO file from the AGNSS server. 2) Check BRM-AST-LTO message validity. 3) If messages are valid, send the BRM-AST-LTO messages to the module. Example: 1. Steps on QGNSS tool. a) Run the QGNSS tool. b) In the main interface, click 'AGNSS' -> 'Assistant GNSS Online' to enter the Download window. c) Click the 'Connect' button to connect the FTP server and select the LTO file with 2 or 7-day validity. d) Click the 'Download selected file' button to download the LTO file to your computer. e) Click the 'Select file' button to select the LTO file downloaded to your computer and then click 'Using UTC time', 'Cold start', 'Position' and 'AGNSS Data'. f) Enter latitude and longitude manually. g) Click the 'Reset and Transfer' button to send the LTO file to the module. LC29D_Series&LC79D(D)_AGNSS_Application_Note 14 / 18 GNSS Module Series 2. Detailed commands for each step. a) Host sends a cold start command. B5 62 06 04 04 00 FF FF 02 00 0E 61 // NMEA messages output from the module: $GNGNS,000001.00,,,,,NNNNNN,00,99.0,,,,,V*18 $GNRMC,000001.00,V,,,,,,,010712,,,N,V*1D $GNGNS,000001.00,,,,,NNNNNN,00,99.0,,,,,V*18 $GPGSV,1,1,01,05,,,38,1*6B $GNRMC,000001.00,V,,,,,,,010712,,,N,V*1D $GNGNS,000002.00,,,,,NNNNNN,00,99.0,,,,,V*1B $GPGSV,1,1,01,05,,,38,1*6B $GNRMC,000002.00,V,,,,,,,010712,,,N,V*1E $GNGNS,000003.00,,,,,NNNNNN,00,99.0,,,,,V*1A $GPGSV,1,1,01,05,,,41,1*65 $GNRMC,000003.00,V,,,,,,,010712,,,N,V*1F … LC29D_Series&LC79D(D)_AGNSS_Application_Note 15 / 18 GNSS Module Series b) Host injects the assistance position to the module. B5 62 13 40 14 00 01 00 00 00 8A AF F7 12 C1 5C CE 45 00 00 00 00 00 00 00 00 DA 1A c) Host injects the assistance time to the module. B5 62 13 40 18 00 10 00 00 80 E5 07 09 02 01 25 22 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 88 d) Host injects the LTO data to the module. B5 62 13 20 4C 00 00 00 02 00 15 08 1F 00 00 CC BB 00 DB 60 00 06 1F A0 78 47 DF AE 95 FD FD 18 9C FD DA 39 4D 75 2E 85 AE FD 35 85 5D FB C4 FD 86 D0 CC FF E2 9D 17 17 43 8A D1 49 0D 00 39 09 95 12 22 FC C1 B0 81 B2 E8 FF 00 40 1F D0 D0 4C 59 4E 1C E4 B5 62 13 20 4C 00 00 00 03 00 15 08 1F 00 00 CC BB 00 C0 60 00 0A 1F A0 78 87 D4 84 BB F1 A3 17 93 FB 77 B7 64 D9 FD 80 39 7C A5 08 F9 57 68 22 87 D0 0B C0 E2 1D 63 16 B3 D5 E2 C9 08 40 02 87 67 72 2F ED D5 49 43 9C EA 3F 00 40 1F 4A D0 4C 59 4E C2 DC … // NMEA messages output from the module. $GNGNS,070006.00,,,,,NNNNNN,00,99.0,,,,,V*18 $GPGSV,1,1,01,05,,,38,1*6B $GNRMC,070006.00,V,,,,,,,010921,,,N,V*13 $GNGNS,070007.00,,,,,NNNNNN,00,99.0,,,,,V*19 $GPGSV,1,1,01,05,,,40,1*64 $GNRMC,070007.00,V,,,,,,,010921,,,N,V*12 $GNGNS,070008.00,,,,,NNNNNN,00,99.0,,,,,V*16 $GPGSV,1,1,03,05,,,40,13,,,41,15,,,40,1*61 $GNRMC,070008.00,V,,,,,,,010921,,,N,V*1D $GNGNS,070009.00,,,,,NNNNNN,00,99.0,,,,,V*17 $GPGSV,1,1,04,05,,,40,13,,,41,15,,,43,18,,,40,1*68 $GNRMC,070009.00,V,,,,,,,010921,,,N,V*1C $GNGNS,070010.00,,,,,NNNNNN,00,99.0,,,,,V*1F $GPGSV,2,1,05,05,,,41,13,,,41,15,,,43,18,,,40,1*6B $GPGSV,2,2,05,23,,,37,1*64 $GNRMC,070010.00,V,,,,,,,010921,,,N,V*14 $GNGNS,070011.00,,,,,NNNNNN,00,1.6,,,,,V*29 $GPGSV,2,1,06,05,46,068,41,13,,,42,15,73,348,43,18,48,314,40,1*56 $GPGSV,2,2,06,23,25,301,38,29,27,227,38,1*6F $GNRMC,070011.00,V,,,,,,,010921,,,N,V*15 // 1st second // 2nd second // 3rd second // 4th second // 5th second // 6th second // Module gets a fix in the 7th second. $GNGNS,070012.00,3149.331528,N,11706.913889,E,AANNNN,06,1.4,63.6,-3.3,,,V*09 $GPGSV,2,1,06,05,46,068,40,13,,,42,15,73,348,43,18,48,314,40,1*57 $GPGSV,2,2,06,23,25,301,37,29,27,227,38,1*60 $GLGSV,1,1,01,78,23,082,37,1*49 $GNRMC,070012.00,A,3149.331528,N,11706.913889,E,000.0,,010921,,,E,V*1D $GNGNS,070014.80,3149.333195,N,11706.913018,E,AANNNN,06,1.4,61.8,-3.3,,,V*0B LC29D_Series&LC79D(D)_AGNSS_Application_Note 16 / 18 GNSS Module Series $GPGSV,2,1,06,05,46,068,41,13,,,42,15,73,349,43,18,48,314,41,1*56 $GPGSV,2,2,06,23,25,301,38,29,27,227,39,1*6E $GLGSV,1,1,02,78,23,081,37,70,,,25,1*49 $GNRMC,070014.80,A,3149.333195,N,11706.913018,E,001.0,190.1,010921,,,E,V*35 $GNGNS,070015.79,3149.333138,N,11706.912789,E,AANANN,07,1.1,61.6,-3.3,,,V*00 $GPGSV,2,1,06,05,46,068,41,13,,,42,15,73,349,44,18,48,314,41,1*51 $GPGSV,2,2,06,23,25,301,38,29,27,227,39,1*6E $GLGSV,1,1,01,78,23,081,36,1*4B $GBGSV,1,1,02,206,60,219,36,209,43,217,35,1*77 $GNRMC,070015.79,A,3149.333138,N,11706.912789,E,000.0,,010921,,,E,V*1D 3.3. Results When the GNSS engine is started, the module will try to get a position fix. If the AGNSS feature is not enabled, the module gets a position fix within about 30 seconds of a cold start. If the AGNSS feature is enabled, the module gets a position fix in about 10 seconds or less. LC29D_Series&LC79D(D)_AGNSS_Application_Note 17 / 18 GNSS Module Series 4 Appendix References Table 7: Related Documents Document Name [1] Quectel_LC29D_Series&LC79D(D)_GNSS_Protocol_Specification [2] Quectel_QGNSS_User_Guide Table 8: Terms and Abbreviations Abbreviation AGNSS C99 EVB FCT FTP GNSS LTO SLA TTFF UTC WGS84 Description Assisted GNSS ISO/IEC 9899:1999 - Programming languages - C Evaluation Board Full-Cycle Time File Transfer Protocol Global Navigation Satellite System Long Term Orbit Software License Agreement Time to First Fix Universal Time Coordinated World Geodetic System 1984 LC29D_Series&LC79D(D)_AGNSS_Application_Note 18 / 18

EG065K Series Secure Boot Application Note LTE-A Module Series Version: 1.0 Date: 2022-05-26 Status: Released LTE-A Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. EG065K_Series_Secure_Boot_Application_Note 1 / 15 LTE-A Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. EG065K_Series_Secure_Boot_Application_Note 2 / 15 LTE-A Module Series About the Document Revision History Version 1.0 Date 2022-05-09 2022-05-26 Author Shaun DUAN Shaun DUAN Description Creation of the document First official release EG065K_Series_Secure_Boot_Application_Note 3 / 15 LTE-A Module Series Contents About the Document ................................................................................................................................3 Contents .................................................................................................................................................... 4 Table Index ...............................................................................................................................................5 1 Introduction .......................................................................................................................................6 2 Secure Boot Overview ......................................................................................................................7 2.1. Definition ..................................................................................................................................7 2.2. Secure Boot Enabling...............................................................................................................7 2.3. Certificate Chain .......................................................................................................................8 2.4. Image Signing ..........................................................................................................................8 2.5. QFPROM Configuration ...........................................................................................................8 3 Secure Boot Related AT Commands .............................................................................................10 3.1. AT Command Syntax .............................................................................................................10 3.1.1. Definitions ....................................................................................................................10 3.1.2. AT Command Syntax...................................................................................................10 3.2. Declaration of AT Command Examples..................................................................................11 3.3. AT Commands Description.....................................................................................................11 3.3.1. AT+QSECBOOT Enable or Query Secure Boot .......................................................11 3.3.1.1. AT+QSECBOOT='status' Query Enabling Status of Secure Boot .................11 3.3.1.2. AT+QSECBOOT='serialnum' Query Unique Serial Number of Module.........12 3.3.1.3. AT+QSECBOOT='progsec' Enable Secure Boot ..........................................12 4 Development Considerations.........................................................................................................14 5 Appendix Terms and Abbreviations ..............................................................................................15 EG065K_Series_Secure_Boot_Application_Note 4 / 15 LTE-A Module Series Table Index Table 1: Types of AT Commands............................................................................................................ 10 Table 2: Terms and Abbreviations........................................................................................................... 15 EG065K_Series_Secure_Boot_Application_Note 5 / 15 LTE-A Module Series 1 Introduction Quectel LTE-A EG065K series module supports Secure Boot function. This document describes how to use AT commands to enable the Secure Boot function on EG065K series module, including an overview of Secure Boot, detailed explanations of AT commands, and precautions. EG065K_Series_Secure_Boot_Application_Note 6 / 15 LTE-A Module Series 2 Secure Boot Overview 2.1. Definition Secure Boot is defined as a boot sequence in which each firmware image to be loaded and executed is authorized using the previously authorized firmware. At each stage of the Secure Boot process, signature verification is performed to prevent any software without valid signature or maliciously modified software from running on the module. A root trusted entity is needed during the boot process. The Primary Boot Loader (PBL), embedded in the module as a firmware, is unmodifiable, and therefore can serve as the root trusted entity. 2.2. Secure Boot Enabling Secure Boot function can only be enabled with the fuse on the hardware and cannot be disabled after being enabled. The Secure Boot process comprises multiple stages, and the image in each stage performs a specific function. After the Secure Boot is enabled, the image to be executed in each stage needs to be verified by the previously verified image. If the verification fails, the entire boot process stops, and the module cannot boot up. As the root of trust (RoT), the PBL is the firmware embedded in chips and therefore cannot be modified. Therefore, it is considered as the most trusted entity in the booting process, and authenticates the image to be executed in the next boot stage. The SBL is usually verified in the second boot stage. After it is successfully authenticated by the PBL, it can be executed and used to authenticate the image in the next stage. Since the SBL has been trusted, it can be used to authenticate the image in the next stage. EG065K_Series_Secure_Boot_Application_Note 7 / 15 LTE-A Module Series 2.3. Certificate Chain Secure Boot supports 2048-bit or 4096-bit RSA private keys for signatures of the certificate and images. The format of the certificate signatures meets the PKCS #1 v1.2 standard and the SHA256 or SHA384 algorithm. The certificate chain of the module supports two-level certificate and three-level certificates. The three-level certificate is adopted by default and consists of three certificates: self-signed root certificate, attestation CA certificate and attestation certificate. 2.4. Image Signing The standard format of images is ELF. During Secure Boot, the images to be executed in each boot stage must be signed first. A binary file in the standard ELF format includes several segments indicating different types of information separately, wherein the hash table segment stores signature related information. The hash table segment also includes the hash values of each segment and the information about certificate trust chain. The images that must be signed in the Secure Boot process for the module are as follows: ⚫ sbl1.mbn ⚫ appsboot.mbn ⚫ prog_nand_firehose_9x55.mbn ⚫ rpm.mbn ⚫ tz.mbn ⚫ devcfg.mbn ⚫ qdsp6sw.mbn ⚫ mba.mbn ⚫ mcfg_sw.mbn ⚫ mcfg_hw.mbn 2.5. QFPROM Configuration The modules include one-time programmable fuses. The initial states of all fuses are 0 (Secure Boot disabled). Once a writing operation is performed on the fuse (or the fuse is blown), the state of the fuse permanently becomes 1 (Secure Boot enabled). The state cannot be changed after the fuse is blown, which means that the Secure Boot enabling is an irreversible operation. To start Secure Boot, the program tool QFPROM is required. EG065K_Series_Secure_Boot_Application_Note 8 / 15 LTE-A Module Series QFPROM is used to store, in NVROM, configurations related to chip authentication and can implement the secure environment required by Secure Boot. Configure QFPROM and then blow the fuse, to complete all security functions such as output of Debug port, JTAG, secure file system, and software version rollback prevention. EG065K_Series_Secure_Boot_Application_Note 9 / 15 LTE-A Module Series 3 Secure Boot Related AT Commands 3.1. AT Command Syntax 3.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 3.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Types of AT Commands Command Type Syntax Description Test Command Read Command Write Command Execution Command AT+=? AT+? AT+=[,[, [...]]] AT+ Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Set user-definable parameter value. Return a specific information parameter or perform a specific action. EG065K_Series_Secure_Boot_Application_Note 10 / 15 LTE-A Module Series 3.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 3.3. AT Commands Description 3.3.1. AT+QSECBOOT Enable or Query Secure Boot AT+QSECBOOT Enable or Query Secure Boot Test Command AT+QSECBOOT=? Response +QSECBOOT: 'status',(list of supported s) +QSECBOOT: 'serialnum', +QSECBOOT: 'progsec',(list of supported s) Maximum Response Time Characteristic OK Or ERROR 300 ms - 3.3.1.1. AT+QSECBOOT='status' Query Enabling Status of Secure Boot This command queries whether Secure Boot is enabled in the module. AT+QSECBOOT='status' Query Enabling Status of Secure Boot Write Command AT+QSECBOOT='status' Response +QSECBOOT: 'status', Maximum Response Time OK Or ERROR 300 ms EG065K_Series_Secure_Boot_Application_Note 11 / 15 LTE-A Module Series Characteristic - Parameter Integer type. Enabling status of Secure Boot function. 1 Enabled 0 Disabled 3.3.1.2. AT+QSECBOOT='serialnum' Query Unique Serial Number of Module This command queries the unique serial number of the module. AT+QSECBOOT='serialnum' Query Unique Serial Number of Module Write Command AT+QSECBOOT='serialnum' Response +QSECBOOT: 'serilalnum', Maximum Response Time Characteristic OK Or ERROR 300 ms / Parameter String type. Serial number of the module in hexadecimal format without double quotes. 3.3.1.3. AT+QSECBOOT='progsec' Enable Secure Boot This command enables Secure Boot function. AT+QSECBOOT='progsec' Enable Secure Boot Write Command AT+QSECBOOT='progsec'[,] Response If the optional parameter is omitted, query the current setting: +QSECBOOT: 'progsec', OK EG065K_Series_Secure_Boot_Application_Note 12 / 15 LTE-A Module Series Maximum Response Time Characteristic If the optional parameter is specified, enable Secure Boot function: OK Or ERROR 300 ms This command takes effect after the module is rebooted. The configuration is saved automatically. Parameter Integer type. Whether Secure Boot function is enabled. 1 Enabled 0 Disabled (Only valid in the query result) EG065K_Series_Secure_Boot_Application_Note 13 / 15 LTE-A Module Series 4 Development Considerations 1. Secure Boot can only be enabled with the hardware fuse and cannot be disabled after being enabled. 2. It is recommended to use AT+QSECBOOT='progsec',1 to enable the Secure Boot function, which is disabled by default. This command burns the image file in the sec partition and automatically activates Secure Boot after the module restarts. 3. After Secure Boot is enabled, it is not supported to use the firehose to downgrade the firmware to a version that does not support Secure Boot. 4. After Secure Boot is enabled, it is not supported to downgrade the firmware to a version that does not support the Secure Boot function through DFOTA, otherwise the module cannot start normally. 5. The PCIe Fuse mode also burns the image file in the sec partition, which conflicts with the enabling of Secure Boot. If Secure Boot is enabled first, the PCIe Fuse mode cannot be enabled. Thus, it’s necessary to enable Secure Boot of the module after PCIe Fuse mode is enabled. EG065K_Series_Secure_Boot_Application_Note 14 / 15 LTE-A Module Series 5 Appendix Terms and Abbreviations Table 2: Terms and Abbreviations Abbreviation DFOTA ELF MBN PBL PCIe PKCS QFPROM RPM RoT SBL SHA Description Delta Firmware Upgrade Over-The-Air Executable and Linkable Format Multi Boot Image Format Primary Boot Loader Peripheral Component Interconnect Express Public-Key Cryptography Standards Qualcomm Fuse Programmable Read Only Memory RPM Package Manager (originally Red Hat Package Manager) Root of Trust Secondary Boot Loader Secure Hash Algorithm EG065K_Series_Secure_Boot_Application_Note 15 / 15

EG060K&EG120K Series SLIC Application Note LTE-A Module Series Version: 1.0 Date: 2022-07-12 Status: Released LTE-A Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. EG060K&EG120K_Series_SLIC_Application_Note 1 / 15 LTE-A Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. EG060K&EG120K_Series_SLIC_Application_Note 2 / 15 LTE-A Module Series About the Document Revision History Version 1.0 Date Author 2022-05-23 Shaun DUAN 2022-07-12 Shaun DUAN Description Creation of the document First official release EG060K&EG120K_Series_SLIC_Application_Note 3 / 15 LTE-A Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 2 Description of AT Commands ........................................................................................................... 7 2.1. AT Command Introduction ......................................................................................................... 7 2.1.1. Definitions........................................................................................................................ 7 2.1.2. AT Command Syntax ...................................................................................................... 7 2.2. Declaration of AT Command Examples ..................................................................................... 8 2.3. AT+QSLIC Enable/Disable SLIC............................................................................................. 8 3 Design Scheme ................................................................................................................................. 10 3.1. Block Diagram .......................................................................................................................... 10 3.1.1. Modem ...........................................................................................................................11 3.1.2. AP...................................................................................................................................11 3.2. Main Functions of SLIC.............................................................................................................11 3.2.1. Voice Data Transmission and Control............................................................................11 3.2.2. Phone Control ................................................................................................................11 3.2.3. Call State Control .......................................................................................................... 12 4 SLIC Function List ............................................................................................................................ 13 5 Appendix References ....................................................................................................................... 15 EG060K&EG120K_Series_SLIC_Application_Note 4 / 15 LTE-A Module Series Table Index Table 1: Type of AT Commands ................................................................................................................... 7 Table 2: SLIC Function List ........................................................................................................................ 13 Table 3: Terms and Abbreviations .............................................................................................................. 15 EG060K&EG120K_Series_SLIC_Application_Note 5 / 15 LTE-A Module Series 1 Introduction This document introduces the SLIC function of Quectel EG060K and EG120K series modules, including AT commands, the design scheme, and the function list. EG060K&EG120K_Series_SLIC_Application_Note 6 / 15 LTE-A Module Series 2 Description of AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Type of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. EG060K&EG120K_Series_SLIC_Application_Note 7 / 15 LTE-A Module Series 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3. AT+QSLIC Enable/Disable SLIC This command enables or disables the SLIC. AT+QSLIC Enable/Disable SLIC Test Command AT+QSLIC=? Response +QSLIC: (list of supported s),(range of supported s) Read Command AT+QSLIC? OK Response +QSLIC: [,] Write Command AT+QSLIC=, OK Response OK Maximum Response Time Characteristics If there is any error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. Enable or disable SLIC. 0 Disable 1 Enable Integer type. Set SLIC type. 0 Reserved 1 LE9641 (not supported currently) EG060K&EG120K_Series_SLIC_Application_Note 8 / 15 LTE-A Module Series 2 SI32185 3 LE9643 Example AT+QSLIC=? +QSLIC: (0,1),(0-3) OK AT+QSLIC=0,3 OK AT+QSLIC=1,3 OK AT+QSLIC? +QSLIC: 1,3 OK //Test command. //Disable SLIC. //Enable SLIC and set the SLIC platform type to LE9643. //Query the current configurations. EG060K&EG120K_Series_SLIC_Application_Note 9 / 15 LTE-A Module Series 3 Design Scheme 3.1. Block Diagram The software framework design of the SLIC function of the module is shown in the following figure: VoLTE Service & CS Voice Service Audio Voice Core Services QMI SLIC App Voice Server PCM Call Manager DSCI AT AT^DSCI ATA/ ATD/ CHLD/ VTS/... Control Driver PCM SPI SLIC RJ11 Control Path Data Path Figure 1: Block Diagram SLIC Function NOTE Please refer to the AT Commands Manual of the module for details of the AT commands in this chapter. EG060K&EG120K_Series_SLIC_Application_Note 10 / 15 LTE-A Module Series 3.1.1. Modem The module provides AT commands on the Modem to implement call functions, including that for originating a call (ATD), answering an incoming call (ATA), hanging up a call (ATH), reporting call status (AT^DSCI), managing call related supplementary services (AT+CHLD), and DTMF (AT+VTS), etc. These commands directly control the Modem to implement call related services. 3.1.2. AP SLIC application and Voice Sever application are developed on the AP of the module based on AT commands mentioned above. SLIC application supports the following functions: controlling the call status of the Modem through the phone state machine and AT commands, interacting with SLIC devices through SPI, and obtaining the operation information and controlling the line status of the phone. Voice Server application supports the following functions: controlling the voice link switch and the voice data transmission, controlling the PCM clock switch, providing a local ringtone scheme, and outputting the standard busy, waiting, and end tones of different countries or regions. 3.2. Main Functions of SLIC SLIC supports three functions: voice data transmission and control, phone control, and call state control. 3.2.1. Voice Data Transmission and Control Based on VoLTE protocol stack and audio management components, the module implements the call function based on voice link and SLIC device. The module transmits the downlink voice data to SLIC chip through a sound card, the SLIC chip decodes the voice data into analog signal, and transmits the signal to the phone through RJ11. After that, the phone plays the voice through a speaker. At the same time, the voice analog signal collected by the microphone of the phone is transmitted to the SLIC chip that encodes the analog signal into digital signal, namely the voice data, and then transmits it to the voice uplink through the sound card. 3.2.2. Phone Control The operations supported by the phone include: the DTMF key, off-hook, on-hook, and the flash button. When you do the above operations on the phone, the SLIC chip obtains the phone signal through RJ11, analyses the phone actions, and writes them to the register of the SLIC chip. Then the module reads the relevant registers of the SLIC chip through SPI driver to obtain the phone operations. Besides, the module can configure the SLIC register through the SPI driver to make the SLIC chip generate a signal to the phone, and then the phone can achieve functions such as ringing and displaying caller ID. EG060K&EG120K_Series_SLIC_Application_Note 11 / 15 LTE-A Module Series 3.2.3. Call State Control Based on the VoLTE protocol stack, the Modem reports the call status to an SMD channel after AT^DSCI=1 is executed. The SLIC application on the AP obtains the call status through the SMD channel. At the same time, the SLIC application on the AP can send AT commands to the Modem through the SMD channel to realize functions such as answering an incoming call (ATA), hanging up a call (ATH), managing call-related supplementary services such as call holding and conference call (AT+CHLD). EG060K&EG120K_Series_SLIC_Application_Note 12 / 15 LTE-A Module Series 4 SLIC Function List This chapter introduces the detailed SLIC functions of the module. Table 2: SLIC Function List Function Power Management Off-Hook On-Hook Dialling Caller ID Ringing Answering a Call Originating a Call Out-of-Band DTMF Call Switching (Call on Hold) 3-Way Calling (Conference Call) Detailed Description 1. After SLIC is enabled, the phone is powered on and the its screen lights up. 2. After SLIC is disabled, the phone is powered off and its screen is turned off. In the on-hook state, if there is no incoming call, the phone plays dial tone after off-hook. 1. In a call, it hangs up the current call. 2. During dialling, it terminates the dialling and clear the dialled number. In the on-hook state, you will hear the dial tone after the off-hook until pressing the DTMF key to input the expected numbers. The call is dialed 5 seconds after you press the last number. In the on-hook state, when there is an incoming call, the incoming call number is displayed on the phone screen. In the on-hook state, the phone will ring when there is an incoming call. In the on-hook state, when there is an incoming call, the phone can be answered after off-hook. 1. After dialling, the phone starts the voice call. 2. After an incoming call is answered, the phone starts the voice call. During a voice call, the phone can send the corresponding signal after pressing the keys '0'~'9', '#', or '*'. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then when you press the flash button again, the call to B is on hold, and the phone will switch back to the call to A. By repeatedly pressing the flash button, you can switch between the calls to A and B. 1. When you converse with a party (e.g., A), press the flash button on the phone, and the call to A is on hold after about 4 seconds, and then the dial tone starts. You can call another party (e.g., B) after dialling again. Then if you press key '3' within 500 milliseconds to 2 seconds after pressing the flash button, the calls to A and B will be merged, and the 3-way calling is EG060K&EG120K_Series_SLIC_Application_Note 13 / 15 Dial Tone Busy Tone Waiting Tone End Tone LTE-A Module Series realized. 2. If you need to add more parties into the current call, perform the following steps: 1) Press the flash button again to hold the merged call to A and B, the dial tone starts again. 2) Dial the number of a third party (e.g., C) to originate a new call. After that, the flash button can be pressed to switch between the merged call to A and B and the call to C. 3) Press the flash button, and then press key '3' within 500 milliseconds to 2 seconds to merge the calls. After that, the call to A and B and that to C are merged. 3. If you need to add more parties, repeat 1) to 3) above. The module supports conference calls with up to 6 callees. In the on-hook state and there is no incoming call, after off-hook, the phone plays the dial tone. When the module originates a call and the callee rejects the call, the phone plays the busy tone (or ring tone of the operator). When the module is in a voice call, and another party calls the module, the phone plays the waiting tone (or ring tone of the operator). When the module is in a voice call, and the other party hangs up, the phone plays the end tone. EG060K&EG120K_Series_SLIC_Application_Note 14 / 15 LTE-A Module Series 5 Appendix References Table 3: Terms and Abbreviations Abbreviation AP CS DTMF PCM QMI SLIC SMD SPI TA VoLTE Description Access Point Circuit Switched Dual-Tone Multifrequency Pulse Code Modulation Qualcomm Message Interface Subscriber Line Interface Circuit Shared Memory Driver Serial Peripheral Interface Terminal Adapter Voice over Long-Term Evolution EG060K&EG120K_Series_SLIC_Application_Note 15 / 15

LG69T (AM,AQ,AS) Firmware Upgrade Guide GNSS Module Series Version: 1.0 Date: 2022-08-23 Status: Released GNSS Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 1 / 22 GNSS Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 2 / 22 GNSS Module Series About the Document Document Information Title Subtitle Document Type Document Status LG69T (AM,AQ,AS) Firmware Upgrade Guide GNSS Module Series Firmware Upgrade Guide Released Revision History Version 1.0 Date 2021-03-31 2022-08-23 Description Creation of the document Released LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 3 / 22 GNSS Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 Figure Index ................................................................................................................................................ 6 1 Introduction ......................................................................................................................................... 7 2 Firmware Upgrade Process ............................................................................................................... 8 2.1. Connect Module ......................................................................................................................... 8 2.2. Synchronize Module .................................................................................................................. 9 2.3. Firmware Upgrade Protocol ..................................................................................................... 10 2.4. Query the Bootloader Version (ClassID = 0xF0) ..................................................................... 12 2.5. Upgrade Procedure.................................................................................................................. 12 2.5.1. Send Firmware Address (MsgID = 0x01)...................................................................... 13 2.5.1.1. Host Send (MsgID = 0x01)................................................................................. 13 2.5.1.2. Module Response (MsgID = 0x00) .................................................................... 14 2.5.2. Send Firmware Information (MsgID = 0x02)................................................................. 14 2.5.2.1. Host Send (MsgID = 0x02)................................................................................. 14 2.5.2.2. Module Response (MsgID = 0x00) .................................................................... 15 2.5.3. Send Start Firmware Upgrade Command (MsgID = 0x03)........................................... 15 2.5.3.1. Host Send (MsgID = 0x03)................................................................................. 15 2.5.3.2. Module Response (MsgID = 0x00) .................................................................... 16 2.5.4. Send Firmware (MsgID = 0x04) .................................................................................... 16 2.5.4.1. Host Send (MsgID = 0x04)................................................................................. 16 2.5.4.2. Module Response (MsgID = 0x00) .................................................................... 16 3 Firmware Upgrade Example ............................................................................................................ 17 3.1. GNSS Firmware Upgrade Example ......................................................................................... 17 3.2. APP Firmware Upgrade Example ............................................................................................ 18 4 Appendix A References.................................................................................................................... 20 5 Appendix B CRC32 Calculate .......................................................................................................... 21 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 4 / 22 GNSS Module Series Table Index Table 1: Constant List................................................................................................................................... 8 Table 2: Field Description ........................................................................................................................... 10 Table 3: Messages Overview ..................................................................................................................... 10 Table 4: Response Status ...........................................................................................................................11 Table 5: GNSS Firmware Information ........................................................................................................ 14 Table 6: APP Firmware Information............................................................................................................ 15 Table 7: Terms and Abbreviations .............................................................................................................. 20 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 5 / 22 GNSS Module Series Figure Index Figure 1: Firmware Upgrade Connection..................................................................................................... 7 Figure 2: Synchronization Sequence ........................................................................................................... 9 Figure 3: Structure of Upgrade Protocol .................................................................................................... 10 Figure 4: Firmware Upgrade Procedure .................................................................................................... 13 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 6 / 22 GNSS Module Series 1 Introduction This document mainly introduces how to upgrade the firmware on Quectel LG69T (AM), LG69T (AQ) and LG69T (AS) modules. Once the module is connected to the host via UART interface, the firmware upgrade process can start. Host UART GNSS Module RESET Figure 1: Firmware Upgrade Connection LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 7 / 22 GNSS Module Series 2 Firmware Upgrade Process This chapter explains all the necessary steps in the firmware upgrade process. The following table defines all the constants used in this document. Table 1: Constant List Constant Name SYNC_WORD1 RSP_WORD1 SYNC_WORD2 RSP2_WORD2 Constant Value 0x514C1309 0xAAFC3A4D 0x1203A504 0x55FD5BA0 2.1. Connect Module Connect the module to the host via the UART interface to ensure that the host can read NMEA sentences. The parameters of UART interface should be configured as below: ⚫ Baud rate: 460800 bps ⚫ Data bit: 8 ⚫ Stop bit: 1 ⚫ Parity bit: None ⚫ Flow control: None LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 8 / 22 GNSS Module Series 2.2. Synchronize Module This step synchronizes the host and the module. Host Interval 20 ms SYNC_WORD1 SYNC_WORD1 ... Module Power on Max. 2000 ms RSP_WORD1 SYNC_WORD2 RSP_WORD2 Successful synchronization Module enter command mode. Figure 2: Synchronization Sequence Step 1: Host continuously sends the SYNC_WORD1 to the module at 20 ms intervals. If the module receives SYNC_WORD1 within 2000 ms from power up, the module will respond with RSP_WORD1 and go to step 2. Otherwise, the module continues to run the firmware already stored in Flash. Step 2: Host sends SYNC_WORD2 to the module once. The module responds with RSP_WORD2 if it receives SYNC_WORD2, which means that the host successfully synchronized with module and the module enters command mode. Otherwise, the module runs the firmware already stored in Flash. NOTE The SYNC and RSP words are transmitted in little-endian format. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 9 / 22 GNSS Module Series 2.3. Firmware Upgrade Protocol Header of the frame (Fixed at 0xAA) 1 Byte 1 Byte 2 Bytes in big-endian format Max. 5 KB Header ClassID MsgID Payload Length The range of CRC32 calculation Payload Checksum (4 Bytes) Tail of the frame (Fixed at 0x55) CRC32 Tail Figure 3: Structure of Upgrade Protocol Table 2: Field Description Field Header ClassID MsgID Payload Length Payload CRC32 Tail Description Header of the frame, fixed at 0xAA. Class ID indicates the group that the message belongs to, see Table 3: Messages Overview for more details. Message ID indicates the specific message identifier, see Table 3: Messages Overview for more details. 2-byte payload content in big-endian format. Message content. Maximum length: 5 KB. CRC32 checksum. Tail of the frame, fixed at 0x55. Table 3: Messages Overview ClassID 0xF0 0xF0 0x01 0x01 0x01 MsgID 0x01 0x00 0x01 0x02 0x03 Description Query the Bootloader version. Module response to the message whose ClassID is 0xF0. Host sends the GNSS firmware address. Host sends the GNSS firmware information. Host sends the command to start GNSS firmware upgrade. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 10 / 22 ClassID 0x01 0x01 0x02 0x02 0x02 0x02 0x02 MsgID 0x04 0x00 0x01 0x02 0x03 0x04 0x00 GNSS Module Series Description Host sends the GNSS firmware package. Module response to the message whose ClassID is 0x01. Host sends the APP firmware address. Host sends the APP firmware information. Host sends the command to start APP firmware upgrade. Host sends the APP firmware package. Module response to the message whose ClassID is 0x02. Table 4: Response Status Status (2 Bytes) 0x0000 0x0001 0x0002 0x0003 0x0004 0x0005 0x0010 0x0011 0x0012 0x0013 0x0014 0x0020 0x0021 Description Message received and executed successfully. Unknow error. CRC32 checksum error. Timeout. Unsupported message. Message package error. GNSS synchronization error. GNSS change baud rate error. GNSS Bootloader error. GNSS firmware information error. GNSS firmware upgrade error. APP firmware area erase error. APP firmware write to Flash error. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 11 / 22 GNSS Module Series 2.4. Query the Bootloader Version (ClassID = 0xF0) This chapter explains how to query the bootloader version of the module. Ensure that the module is in command mode before querying the bootloader version. Host Send (MsgID = 0x01) Header ClassID MsgID 0xAA 0xF0 0x01 Payload Payload Length Firmware Address 0x0000 0x00000000 CRC32 4 Bytes Tail 0x55 Module Response (MsgID = 0x00) Header 0xAA Payload ClassID MsgID Length 0xF0 0x00 0x0007 ClassID 0xF0 MsgID 0x01 Payload Status Major See Table 4: Response 1 Byte Status Minor 1 Byte Build 1 Byte CRC32 Tail 4 Bytes 0x55 NOTE The ClassID and MsgID contained in the Payload of the module response are the same as the ClassID and MsgID of the command sent by the host. 2.5. Upgrade Procedure This chapter outlines the module firmware upgrade procedure. There are two firmware types on the module: GNSS firmware (Class ID = 0x01) and APP firmware (Class ID = 0x02). LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 12 / 22 GNSS Module Series Host Module Send firmware address Response If there is no response in 3 s, a timeout error will be reported. Send firmware information Response Send command to upgrade firmware Response Send BIN data package 0 Response Send BIN data package 1 If there is no response in 3 s, a timeout error will be reported. If there is no response after 3 mins, a timeout error will be reported. (MCU will synchronize with the GNSS module and erase the firmware in the GNSS module) Every packet include 5 KB data except the last packet. The last packet will send the remaining data. Response Send BIN data package 2 Response ... Send BIN data package n Response Restart Figure 4: Firmware Upgrade Procedure 2.5.1. Send Firmware Address (MsgID = 0x01) Send the firmware address to module. 2.5.1.1. Host Send (MsgID = 0x01) Payload Header ClassID MsgID Payload Length Firmware Address 0xAA 1 Byte 0x01 0x0004 0x00000000 CRC32 4 Bytes Tail 0x55 NOTE Firmware Address: Fixed at 0x00000000 in big-endian format. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 13 / 22 GNSS Module Series 2.5.1.2. Module Response (MsgID = 0x00) Header 0xAA ClassID MsgID Payload Length 1 Byte 0x00 0x0004 ClassID 1 Byte Payload MsgID Status See Table 4: 0x01 Response Status CRC32 4 Bytes Tail 0x55 2.5.2. Send Firmware Information (MsgID = 0x02) 2.5.2.1. Host Send (MsgID = 0x02) Header ClassID MsgID Payload Length Payload 0xAA 1 Byte 0x02 - See Table 5: GNSS Firmware Information and Table 6: APP Firmware Information CRC32 4 Bytes Tail 0x55 When ClassID = 0x01, the host should send the GNSS firmware information, see Table 5: GNSS Firmware Information for details. The total size of GNSS firmware information field is 32 bytes (0x20). When ClassID = 0x02, the host should send the APP firmware information, see Table 6: APP Firmware Information for details. The total size of APP firmware information field is 16 bytes (0x10). Table 5: GNSS Firmware Information Name FW Size Byte 4 FW CRC32 4 DestAddr 4 EntryPoint 4 NVM Offset 4 NVM Erase Size 4 EraseNVM 1 EraseOnly 1 Description Firmware size in bytes. The CRC32 code (in little-endian format), which is calculated first based on the image file size and then over the entire firmware image payload. Firmware start address, fixed at 0x10000000 in big-endian format. Entry point, fixed at 0x00000400 in big-endian format. NVM offset, fixed at 0x00170000 in big-endian format. Erased NVM size, fixed at 0x00090000 in big-endian format. Erase NVM, fixed at as 0x01. Erase only, fixed at as 0x00. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 14 / 22 Name ProgramOnly Reversed Byte 1 5 Description Program only, fixed at as 0x00. Reserved parameter, set to 0. GNSS Module Series Table 6: APP Firmware Information Name FW Size FW CRC32 DestAddr EraseNVM Reversed Byte 4 4 4 1 3 Description Firmware size in bytes. The CRC32 code (in little-endian format), which is calculated first based on the image file size and then over the entire firmware image payload. Firmware start address, fixed at 0x00000000 in big-endian format . Erase NVM data, fixed at 0x01. Reserved parameter, set to 0. 2.5.2.2. Module Response (MsgID = 0x00) Header 0xAA ClassID MsgID Payload Length 1 Byte 0x00 0x0004 ClassID 1 Byte Payload MsgID Status See Table 4: 0x02 Response Status CRC32 4 Bytes Tail 0x55 2.5.3. Send Start Firmware Upgrade Command (MsgID = 0x03) 2.5.3.1. Host Send (MsgID = 0x03) Header ClassID MsgID Payload Length Payload 0xAA 1 Byte 0x03 0x0000 - CRC32 4 Bytes Tail 0x55 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 15 / 22 GNSS Module Series 2.5.3.2. Module Response (MsgID = 0x00) Header ClassID MsgID 0xAA 1 Byte 0x00 Payload Length 0x0004 ClassID 1 Byte Payload MsgID Status See Table 4: 0x03 Response Status CRC32 4 Bytes Tail 0x55 2.5.4. Send Firmware (MsgID = 0x04) 2.5.4.1. Host Send (MsgID = 0x04) Payload Header ClassID MsgID Length 0xAA 1 Byte 0x04 2 Bytes Payload Packet Sequence Firmware Content 4 Bytes 5 KB per packet except the last packet CRC32 4 Bytes Tail 0x55 NOTE 1. Packet Sequence starts from 0. 2. Firmware Content contains several data packets. The size of each packet is 5 KB except the last packet which contains the remaining firmware data. 2.5.4.2. Module Response (MsgID = 0x00) Header 0xAA ClassID MsgID Payload Length 1 Byte 0x00 0x0004 ClassID 1 Byte Payload MsgID Status See Table 4: 0x04 Response Status CRC32 4 Bytes Tail 0x55 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 16 / 22 GNSS Module Series 3 Firmware Upgrade Example This chapter illustrates the example of firmware upgrade procedure. 3.1. GNSS Firmware Upgrade Example //Host is continuously sending SYNC_WORD1. 09 13 4C 51 09 13 4C 51 09 13 4C 51 … 09 13 4C 51 09 13 4C 51 09 13 4C 51 09 13 4C 51 //Module responds with RSP_WORD1. 4D 3A FC AA //Host sends SYNC_WORD2. 04 A5 03 12 //Module responds with RSP_WORD2. A0 5B FD 55 //Host sends firmware address. AA 01 01 00 04 00 00 00 00 FA 7F 72 83 55 //Module responds. AA 01 00 00 04 01 01 00 00 E5 76 74 65 55 //Host sends firmware information. AA 01 02 00 20 00 0B DC A8 9E 54 21 6B 10 00 00 00 00 00 04 00 00 17 00 00 00 09 00 00 01 00 00 00 00 00 00 00 80 30 13 91 55 //Module responds. AA 01 00 00 04 01 02 00 00 E7 30 CA 3C 55 //Host sends the command to start firmware upgrade. AA 01 03 00 00 9B BE 06 20 55 //Module responds. AA 01 00 00 04 01 03 00 00 E6 F2 A0 0B 55 //Host sends firmware data packet 0. AA 01 04 14 04 00 00 00 00 42 4C 32 00 03 01 02 00 00 … //Module responds. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 17 / 22 AA 01 00 00 04 01 04 00 00 E3 BD B6 8E 55 //Host sends firmware data packet 1. AA 01 04 14 04 00 00 00 01 50 44 03 25 D4 F8 00 01 C0 … //Module responds. AA 01 00 00 04 01 04 00 00 E3 BD B6 8E 55 … //Host sends the last firmware data packet n. AA 01 04 14 04 00 00 00 97 F3 D0 38 E7 20 68 B3 EB 90 … //Module responds. AA 01 00 00 04 01 04 00 00 E3 BD B6 8E 55 //Restart module. GNSS Module Series 3.2. APP Firmware Upgrade Example //Host is continuously sending SYNC_WORD1. 09 13 4C 51 09 13 4C 51 09 13 4C 51 … 09 13 4C 51 09 13 4C 51 09 13 4C 51 09 13 4C 51 //Module responds with RSP_WORD1. 4D 3A FC AA //Host sends SYNC_WORD2. 04 A5 03 12 //Module responds with RSP_WORD2. A0 5B FD 55 //Host sends firmware address. AA 02 01 00 04 00 00 00 00 74 F0 75 60 55 //Module responds. AA 02 00 00 04 02 01 00 00 79 4C DC 68 55 //Host sends firmware information. AA 02 02 00 10 00 09 02 2C 00 62 1E 80 00 00 00 00 01 00 00 00 F7 10 AA C9 55 //Module responds. AA 02 00 00 04 02 02 00 00 7B 0A 62 31 55 //Host sends the command to start firmware upgrade. AA 02 03 00 00 89 0B A9 CE 55 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 18 / 22 //Module responds. AA 02 00 00 04 02 03 00 00 7A C8 08 06 55 //Host sends firmware data packet 0. AA 02 04 14 04 00 00 00 00 C8 A7 00 38 79 03 02 08 CD … //Module responds. AA 02 00 00 04 02 04 00 00 7F 87 1E 83 55 //Host sends firmware data packet 1. AA 02 04 14 04 00 00 00 01 83 68 8B 42 05 D0 49 1E 52 … //Module responds. AA 02 00 00 04 02 04 00 00 7F 87 1E 83 55 … //Host sends last firmware data packet n. AA 02 04 06 30 00 00 00 73 2D EA 02 08 B0 30 19 B0 1A … //Module responds. AA 02 00 00 04 02 04 00 00 7F 87 1E 83 55 //Restart module. GNSS Module Series LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 19 / 22 GNSS Module Series 4 Appendix A References Table 7: Terms and Abbreviations Abbreviation APP CRC FW GNSS NVM NMEA RSP SYNC UART Description Application Cyclic Redundancy Check Firmware Global Navigation Satellite System Non-Volatile Memory NMEA (National Marine Electronics Association) 0183 Interface Standard Respond Synchronize Universal Asynchronous Receiver/Transmitter LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 20 / 22 GNSS Module Series 5 Appendix B CRC32 Calculate Sample Code for Calculate CRC32 const uint32_t Table_CRC32[256] = { 0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988, 0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91, 0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de, 0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7, 0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec, 0x14015c4f, 0x63066cd9, 0xfa0f3d63, 0x8d080df5, 0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172, 0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b, 0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940, 0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59, 0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116, 0x21b4f4b5, 0x56b3c423, 0xcfba9599, 0xb8bda50f, 0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924, 0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d, 0x76dc4190, 0x01db7106, 0x98d220bc, 0xefd5102a, 0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433, 0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818, 0x7f6a0dbb, 0x086d3d2d, 0x91646c97, 0xe6635c01, 0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e, 0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457, 0x65b0d9c6, 0x12b7e950, 0x8bbeb8ea, 0xfcb9887c, 0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65, 0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2, 0x4adfa541, 0x3dd895d7, 0xa4d1c46d, 0xd3d6f4fb, 0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0, 0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9, 0x5005713c, 0x270241aa, 0xbe0b1010, 0xc90c2086, 0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f, 0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4, 0x59b33d17, 0x2eb40d81, 0xb7bd5c3b, 0xc0ba6cad, 0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a, 0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683, 0xe3630b12, 0x94643b84, 0x0d6d6a3e, 0x7a6a5aa8, 0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1, 0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe, 0xf762575d, 0x806567cb, 0x196c3671, 0x6e6b06e7, 0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc, 0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5, 0xd6d6a3e8, 0xa1d1937e, 0x38d8c2c4, 0x4fdff252, 0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b, 0xd80d2bda, 0xaf0a1b4c, LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 21 / 22 GNSS Module Series 0x36034af6, 0x41047a60, 0xdf60efc3, 0xa867df55, 0x316e8eef, 0x4669be79, 0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236, 0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f, 0xc5ba3bbe, 0xb2bd0b28, 0x2bb45a92, 0x5cb36a04, 0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d, 0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a, 0x9c0906a9, 0xeb0e363f, 0x72076785, 0x05005713, 0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38, 0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21, 0x86d3d2d4, 0xf1d4e242, 0x68ddb3f8, 0x1fda836e, 0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777, 0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c, 0x8f659eff, 0xf862ae69, 0x616bffd3, 0x166ccf45, 0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2, 0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db, 0xaed16a4a, 0xd9d65adc, 0x40df0b66, 0x37d83bf0, 0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9, 0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6, 0xbad03605, 0xcdd70693, 0x54de5729, 0x23d967bf, 0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94, 0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d }; uint32_t Ql_CRC32(const unsigned char *pData, const uint32_t Length) { uint32_t i = 0; uint32_t CRC_Result = 0xFFFFFFFF; if((NULL == pData) || (Length == 0)) { return 0; } for (i = 0; i < Length; i++) { CRC_Result = Table_CRC32[(CRC_Result ^ pData[i]) & 0xFF] ^ (CRC_Result >> 8); } return (CRC_Result ^ 0xFFFFFFFF); } LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 22 / 22

LG69T (AM,AQ,AS) Firmware Upgrade Guide GNSS Module Series Version: 1.0 Date: 2022-08-23 Status: Released GNSS Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 1 / 22 GNSS Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 2 / 22 GNSS Module Series About the Document Document Information Title Subtitle Document Type Document Status LG69T (AM,AQ,AS) Firmware Upgrade Guide GNSS Module Series Firmware Upgrade Guide Released Revision History Version 1.0 Date 2021-03-31 2022-08-23 Description Creation of the document Released LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 3 / 22 GNSS Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 Figure Index ................................................................................................................................................ 6 1 Introduction ......................................................................................................................................... 7 2 Firmware Upgrade Process ............................................................................................................... 8 2.1. Connect Module ......................................................................................................................... 8 2.2. Synchronize Module .................................................................................................................. 9 2.3. Firmware Upgrade Protocol ..................................................................................................... 10 2.4. Query the Bootloader Version (ClassID = 0xF0) ..................................................................... 12 2.5. Upgrade Procedure.................................................................................................................. 12 2.5.1. Send Firmware Address (MsgID = 0x01)...................................................................... 13 2.5.1.1. Host Send (MsgID = 0x01)................................................................................. 13 2.5.1.2. Module Response (MsgID = 0x00) .................................................................... 14 2.5.2. Send Firmware Information (MsgID = 0x02)................................................................. 14 2.5.2.1. Host Send (MsgID = 0x02)................................................................................. 14 2.5.2.2. Module Response (MsgID = 0x00) .................................................................... 15 2.5.3. Send Start Firmware Upgrade Command (MsgID = 0x03)........................................... 15 2.5.3.1. Host Send (MsgID = 0x03)................................................................................. 15 2.5.3.2. Module Response (MsgID = 0x00) .................................................................... 16 2.5.4. Send Firmware (MsgID = 0x04) .................................................................................... 16 2.5.4.1. Host Send (MsgID = 0x04)................................................................................. 16 2.5.4.2. Module Response (MsgID = 0x00) .................................................................... 16 3 Firmware Upgrade Example ............................................................................................................ 17 3.1. GNSS Firmware Upgrade Example ......................................................................................... 17 3.2. APP Firmware Upgrade Example ............................................................................................ 18 4 Appendix A References.................................................................................................................... 20 5 Appendix B CRC32 Calculate .......................................................................................................... 21 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 4 / 22 GNSS Module Series Table Index Table 1: Constant List................................................................................................................................... 8 Table 2: Field Description ........................................................................................................................... 10 Table 3: Messages Overview ..................................................................................................................... 10 Table 4: Response Status ...........................................................................................................................11 Table 5: GNSS Firmware Information ........................................................................................................ 14 Table 6: APP Firmware Information............................................................................................................ 15 Table 7: Terms and Abbreviations .............................................................................................................. 20 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 5 / 22 GNSS Module Series Figure Index Figure 1: Firmware Upgrade Connection..................................................................................................... 7 Figure 2: Synchronization Sequence ........................................................................................................... 9 Figure 3: Structure of Upgrade Protocol .................................................................................................... 10 Figure 4: Firmware Upgrade Procedure .................................................................................................... 13 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 6 / 22 GNSS Module Series 1 Introduction This document mainly introduces how to upgrade the firmware on Quectel LG69T (AM), LG69T (AQ) and LG69T (AS) modules. Once the module is connected to the host via UART interface, the firmware upgrade process can start. Host UART GNSS Module RESET Figure 1: Firmware Upgrade Connection LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 7 / 22 GNSS Module Series 2 Firmware Upgrade Process This chapter explains all the necessary steps in the firmware upgrade process. The following table defines all the constants used in this document. Table 1: Constant List Constant Name SYNC_WORD1 RSP_WORD1 SYNC_WORD2 RSP2_WORD2 Constant Value 0x514C1309 0xAAFC3A4D 0x1203A504 0x55FD5BA0 2.1. Connect Module Connect the module to the host via the UART interface to ensure that the host can read NMEA sentences. The parameters of UART interface should be configured as below: ⚫ Baud rate: 460800 bps ⚫ Data bit: 8 ⚫ Stop bit: 1 ⚫ Parity bit: None ⚫ Flow control: None LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 8 / 22 GNSS Module Series 2.2. Synchronize Module This step synchronizes the host and the module. Host Interval 20 ms SYNC_WORD1 SYNC_WORD1 ... Module Power on Max. 2000 ms RSP_WORD1 SYNC_WORD2 RSP_WORD2 Successful synchronization Module enter command mode. Figure 2: Synchronization Sequence Step 1: Host continuously sends the SYNC_WORD1 to the module at 20 ms intervals. If the module receives SYNC_WORD1 within 2000 ms from power up, the module will respond with RSP_WORD1 and go to step 2. Otherwise, the module continues to run the firmware already stored in Flash. Step 2: Host sends SYNC_WORD2 to the module once. The module responds with RSP_WORD2 if it receives SYNC_WORD2, which means that the host successfully synchronized with module and the module enters command mode. Otherwise, the module runs the firmware already stored in Flash. NOTE The SYNC and RSP words are transmitted in little-endian format. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 9 / 22 GNSS Module Series 2.3. Firmware Upgrade Protocol Header of the frame (Fixed at 0xAA) 1 Byte 1 Byte 2 Bytes in big-endian format Max. 5 KB Header ClassID MsgID Payload Length The range of CRC32 calculation Payload Checksum (4 Bytes) Tail of the frame (Fixed at 0x55) CRC32 Tail Figure 3: Structure of Upgrade Protocol Table 2: Field Description Field Header ClassID MsgID Payload Length Payload CRC32 Tail Description Header of the frame, fixed at 0xAA. Class ID indicates the group that the message belongs to, see Table 3: Messages Overview for more details. Message ID indicates the specific message identifier, see Table 3: Messages Overview for more details. 2-byte payload content in big-endian format. Message content. Maximum length: 5 KB. CRC32 checksum. Tail of the frame, fixed at 0x55. Table 3: Messages Overview ClassID 0xF0 0xF0 0x01 0x01 0x01 MsgID 0x01 0x00 0x01 0x02 0x03 Description Query the Bootloader version. Module response to the message whose ClassID is 0xF0. Host sends the GNSS firmware address. Host sends the GNSS firmware information. Host sends the command to start GNSS firmware upgrade. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 10 / 22 ClassID 0x01 0x01 0x02 0x02 0x02 0x02 0x02 MsgID 0x04 0x00 0x01 0x02 0x03 0x04 0x00 GNSS Module Series Description Host sends the GNSS firmware package. Module response to the message whose ClassID is 0x01. Host sends the APP firmware address. Host sends the APP firmware information. Host sends the command to start APP firmware upgrade. Host sends the APP firmware package. Module response to the message whose ClassID is 0x02. Table 4: Response Status Status (2 Bytes) 0x0000 0x0001 0x0002 0x0003 0x0004 0x0005 0x0010 0x0011 0x0012 0x0013 0x0014 0x0020 0x0021 Description Message received and executed successfully. Unknow error. CRC32 checksum error. Timeout. Unsupported message. Message package error. GNSS synchronization error. GNSS change baud rate error. GNSS Bootloader error. GNSS firmware information error. GNSS firmware upgrade error. APP firmware area erase error. APP firmware write to Flash error. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 11 / 22 GNSS Module Series 2.4. Query the Bootloader Version (ClassID = 0xF0) This chapter explains how to query the bootloader version of the module. Ensure that the module is in command mode before querying the bootloader version. Host Send (MsgID = 0x01) Header ClassID MsgID 0xAA 0xF0 0x01 Payload Payload Length Firmware Address 0x0000 0x00000000 CRC32 4 Bytes Tail 0x55 Module Response (MsgID = 0x00) Header 0xAA Payload ClassID MsgID Length 0xF0 0x00 0x0007 ClassID 0xF0 MsgID 0x01 Payload Status Major See Table 4: Response 1 Byte Status Minor 1 Byte Build 1 Byte CRC32 Tail 4 Bytes 0x55 NOTE The ClassID and MsgID contained in the Payload of the module response are the same as the ClassID and MsgID of the command sent by the host. 2.5. Upgrade Procedure This chapter outlines the module firmware upgrade procedure. There are two firmware types on the module: GNSS firmware (Class ID = 0x01) and APP firmware (Class ID = 0x02). LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 12 / 22 GNSS Module Series Host Module Send firmware address Response If there is no response in 3 s, a timeout error will be reported. Send firmware information Response Send command to upgrade firmware Response Send BIN data package 0 Response Send BIN data package 1 If there is no response in 3 s, a timeout error will be reported. If there is no response after 3 mins, a timeout error will be reported. (MCU will synchronize with the GNSS module and erase the firmware in the GNSS module) Every packet include 5 KB data except the last packet. The last packet will send the remaining data. Response Send BIN data package 2 Response ... Send BIN data package n Response Restart Figure 4: Firmware Upgrade Procedure 2.5.1. Send Firmware Address (MsgID = 0x01) Send the firmware address to module. 2.5.1.1. Host Send (MsgID = 0x01) Payload Header ClassID MsgID Payload Length Firmware Address 0xAA 1 Byte 0x01 0x0004 0x00000000 CRC32 4 Bytes Tail 0x55 NOTE Firmware Address: Fixed at 0x00000000 in big-endian format. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 13 / 22 GNSS Module Series 2.5.1.2. Module Response (MsgID = 0x00) Header 0xAA ClassID MsgID Payload Length 1 Byte 0x00 0x0004 ClassID 1 Byte Payload MsgID Status See Table 4: 0x01 Response Status CRC32 4 Bytes Tail 0x55 2.5.2. Send Firmware Information (MsgID = 0x02) 2.5.2.1. Host Send (MsgID = 0x02) Header ClassID MsgID Payload Length Payload 0xAA 1 Byte 0x02 - See Table 5: GNSS Firmware Information and Table 6: APP Firmware Information CRC32 4 Bytes Tail 0x55 When ClassID = 0x01, the host should send the GNSS firmware information, see Table 5: GNSS Firmware Information for details. The total size of GNSS firmware information field is 32 bytes (0x20). When ClassID = 0x02, the host should send the APP firmware information, see Table 6: APP Firmware Information for details. The total size of APP firmware information field is 16 bytes (0x10). Table 5: GNSS Firmware Information Name FW Size Byte 4 FW CRC32 4 DestAddr 4 EntryPoint 4 NVM Offset 4 NVM Erase Size 4 EraseNVM 1 EraseOnly 1 Description Firmware size in bytes. The CRC32 code (in little-endian format), which is calculated first based on the image file size and then over the entire firmware image payload. Firmware start address, fixed at 0x10000000 in big-endian format. Entry point, fixed at 0x00000400 in big-endian format. NVM offset, fixed at 0x00170000 in big-endian format. Erased NVM size, fixed at 0x00090000 in big-endian format. Erase NVM, fixed at as 0x01. Erase only, fixed at as 0x00. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 14 / 22 Name ProgramOnly Reversed Byte 1 5 Description Program only, fixed at as 0x00. Reserved parameter, set to 0. GNSS Module Series Table 6: APP Firmware Information Name FW Size FW CRC32 DestAddr EraseNVM Reversed Byte 4 4 4 1 3 Description Firmware size in bytes. The CRC32 code (in little-endian format), which is calculated first based on the image file size and then over the entire firmware image payload. Firmware start address, fixed at 0x00000000 in big-endian format . Erase NVM data, fixed at 0x01. Reserved parameter, set to 0. 2.5.2.2. Module Response (MsgID = 0x00) Header 0xAA ClassID MsgID Payload Length 1 Byte 0x00 0x0004 ClassID 1 Byte Payload MsgID Status See Table 4: 0x02 Response Status CRC32 4 Bytes Tail 0x55 2.5.3. Send Start Firmware Upgrade Command (MsgID = 0x03) 2.5.3.1. Host Send (MsgID = 0x03) Header ClassID MsgID Payload Length Payload 0xAA 1 Byte 0x03 0x0000 - CRC32 4 Bytes Tail 0x55 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 15 / 22 GNSS Module Series 2.5.3.2. Module Response (MsgID = 0x00) Header ClassID MsgID 0xAA 1 Byte 0x00 Payload Length 0x0004 ClassID 1 Byte Payload MsgID Status See Table 4: 0x03 Response Status CRC32 4 Bytes Tail 0x55 2.5.4. Send Firmware (MsgID = 0x04) 2.5.4.1. Host Send (MsgID = 0x04) Payload Header ClassID MsgID Length 0xAA 1 Byte 0x04 2 Bytes Payload Packet Sequence Firmware Content 4 Bytes 5 KB per packet except the last packet CRC32 4 Bytes Tail 0x55 NOTE 1. Packet Sequence starts from 0. 2. Firmware Content contains several data packets. The size of each packet is 5 KB except the last packet which contains the remaining firmware data. 2.5.4.2. Module Response (MsgID = 0x00) Header 0xAA ClassID MsgID Payload Length 1 Byte 0x00 0x0004 ClassID 1 Byte Payload MsgID Status See Table 4: 0x04 Response Status CRC32 4 Bytes Tail 0x55 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 16 / 22 GNSS Module Series 3 Firmware Upgrade Example This chapter illustrates the example of firmware upgrade procedure. 3.1. GNSS Firmware Upgrade Example //Host is continuously sending SYNC_WORD1. 09 13 4C 51 09 13 4C 51 09 13 4C 51 … 09 13 4C 51 09 13 4C 51 09 13 4C 51 09 13 4C 51 //Module responds with RSP_WORD1. 4D 3A FC AA //Host sends SYNC_WORD2. 04 A5 03 12 //Module responds with RSP_WORD2. A0 5B FD 55 //Host sends firmware address. AA 01 01 00 04 00 00 00 00 FA 7F 72 83 55 //Module responds. AA 01 00 00 04 01 01 00 00 E5 76 74 65 55 //Host sends firmware information. AA 01 02 00 20 00 0B DC A8 9E 54 21 6B 10 00 00 00 00 00 04 00 00 17 00 00 00 09 00 00 01 00 00 00 00 00 00 00 80 30 13 91 55 //Module responds. AA 01 00 00 04 01 02 00 00 E7 30 CA 3C 55 //Host sends the command to start firmware upgrade. AA 01 03 00 00 9B BE 06 20 55 //Module responds. AA 01 00 00 04 01 03 00 00 E6 F2 A0 0B 55 //Host sends firmware data packet 0. AA 01 04 14 04 00 00 00 00 42 4C 32 00 03 01 02 00 00 … //Module responds. LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 17 / 22 AA 01 00 00 04 01 04 00 00 E3 BD B6 8E 55 //Host sends firmware data packet 1. AA 01 04 14 04 00 00 00 01 50 44 03 25 D4 F8 00 01 C0 … //Module responds. AA 01 00 00 04 01 04 00 00 E3 BD B6 8E 55 … //Host sends the last firmware data packet n. AA 01 04 14 04 00 00 00 97 F3 D0 38 E7 20 68 B3 EB 90 … //Module responds. AA 01 00 00 04 01 04 00 00 E3 BD B6 8E 55 //Restart module. GNSS Module Series 3.2. APP Firmware Upgrade Example //Host is continuously sending SYNC_WORD1. 09 13 4C 51 09 13 4C 51 09 13 4C 51 … 09 13 4C 51 09 13 4C 51 09 13 4C 51 09 13 4C 51 //Module responds with RSP_WORD1. 4D 3A FC AA //Host sends SYNC_WORD2. 04 A5 03 12 //Module responds with RSP_WORD2. A0 5B FD 55 //Host sends firmware address. AA 02 01 00 04 00 00 00 00 74 F0 75 60 55 //Module responds. AA 02 00 00 04 02 01 00 00 79 4C DC 68 55 //Host sends firmware information. AA 02 02 00 10 00 09 02 2C 00 62 1E 80 00 00 00 00 01 00 00 00 F7 10 AA C9 55 //Module responds. AA 02 00 00 04 02 02 00 00 7B 0A 62 31 55 //Host sends the command to start firmware upgrade. AA 02 03 00 00 89 0B A9 CE 55 LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 18 / 22 //Module responds. AA 02 00 00 04 02 03 00 00 7A C8 08 06 55 //Host sends firmware data packet 0. AA 02 04 14 04 00 00 00 00 C8 A7 00 38 79 03 02 08 CD … //Module responds. AA 02 00 00 04 02 04 00 00 7F 87 1E 83 55 //Host sends firmware data packet 1. AA 02 04 14 04 00 00 00 01 83 68 8B 42 05 D0 49 1E 52 … //Module responds. AA 02 00 00 04 02 04 00 00 7F 87 1E 83 55 … //Host sends last firmware data packet n. AA 02 04 06 30 00 00 00 73 2D EA 02 08 B0 30 19 B0 1A … //Module responds. AA 02 00 00 04 02 04 00 00 7F 87 1E 83 55 //Restart module. GNSS Module Series LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 19 / 22 GNSS Module Series 4 Appendix A References Table 7: Terms and Abbreviations Abbreviation APP CRC FW GNSS NVM NMEA RSP SYNC UART Description Application Cyclic Redundancy Check Firmware Global Navigation Satellite System Non-Volatile Memory NMEA (National Marine Electronics Association) 0183 Interface Standard Respond Synchronize Universal Asynchronous Receiver/Transmitter LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 20 / 22 GNSS Module Series 5 Appendix B CRC32 Calculate Sample Code for Calculate CRC32 const uint32_t Table_CRC32[256] = { 0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988, 0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91, 0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de, 0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7, 0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec, 0x14015c4f, 0x63066cd9, 0xfa0f3d63, 0x8d080df5, 0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172, 0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b, 0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940, 0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59, 0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116, 0x21b4f4b5, 0x56b3c423, 0xcfba9599, 0xb8bda50f, 0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924, 0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d, 0x76dc4190, 0x01db7106, 0x98d220bc, 0xefd5102a, 0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433, 0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818, 0x7f6a0dbb, 0x086d3d2d, 0x91646c97, 0xe6635c01, 0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e, 0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457, 0x65b0d9c6, 0x12b7e950, 0x8bbeb8ea, 0xfcb9887c, 0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65, 0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2, 0x4adfa541, 0x3dd895d7, 0xa4d1c46d, 0xd3d6f4fb, 0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0, 0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9, 0x5005713c, 0x270241aa, 0xbe0b1010, 0xc90c2086, 0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f, 0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4, 0x59b33d17, 0x2eb40d81, 0xb7bd5c3b, 0xc0ba6cad, 0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a, 0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683, 0xe3630b12, 0x94643b84, 0x0d6d6a3e, 0x7a6a5aa8, 0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1, 0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe, 0xf762575d, 0x806567cb, 0x196c3671, 0x6e6b06e7, 0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc, 0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5, 0xd6d6a3e8, 0xa1d1937e, 0x38d8c2c4, 0x4fdff252, 0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b, 0xd80d2bda, 0xaf0a1b4c, LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 21 / 22 GNSS Module Series 0x36034af6, 0x41047a60, 0xdf60efc3, 0xa867df55, 0x316e8eef, 0x4669be79, 0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236, 0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f, 0xc5ba3bbe, 0xb2bd0b28, 0x2bb45a92, 0x5cb36a04, 0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d, 0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a, 0x9c0906a9, 0xeb0e363f, 0x72076785, 0x05005713, 0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38, 0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21, 0x86d3d2d4, 0xf1d4e242, 0x68ddb3f8, 0x1fda836e, 0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777, 0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c, 0x8f659eff, 0xf862ae69, 0x616bffd3, 0x166ccf45, 0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2, 0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db, 0xaed16a4a, 0xd9d65adc, 0x40df0b66, 0x37d83bf0, 0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9, 0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6, 0xbad03605, 0xcdd70693, 0x54de5729, 0x23d967bf, 0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94, 0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d }; uint32_t Ql_CRC32(const unsigned char *pData, const uint32_t Length) { uint32_t i = 0; uint32_t CRC_Result = 0xFFFFFFFF; if((NULL == pData) || (Length == 0)) { return 0; } for (i = 0; i < Length; i++) { CRC_Result = Table_CRC32[(CRC_Result ^ pData[i]) & 0xFF] ^ (CRC_Result >> 8); } return (CRC_Result ^ 0xFFFFFFFF); } LG69T(AM,AQ,AS)_Firmware_Upgrade_Guide 22 / 22

LTE-A(Q) Series GNSS Application Note LTE-A Module Series Version: 1.1 Date: 2021-11-24 Status: Released LTE-A Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. LTE-A(Q)_Series_GNSS_Application_Note 1 / 48 LTE-A Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2021. All rights reserved. LTE-A(Q)_Series_GNSS_Application_Note 2 / 48 LTE-A Module Series About the Document Revision History Version 1.0 1.1 Date 2019-10-12 2021-11-24 Author Amos ZHANG/ Leonard LI Remy SHI/ Don XU Description Initial 1. Incorporated the information of EP06, EG06, and EM06 GNSS AT commands manual into this application note 2. Added applicable modules: EG060K-EA, EG120K-EA, EM060K-GL, EM120R-GL, EM121R-GL, EM160R-GL and EG512R-EA (Chapter 1.1) 3. Updated supported NMEA sentences (Chapter 1.3) 4. Updated description of AT+QGPSCFG='glonassnmeatype' (Chapter 2.3.1.4) 5. Updated description of AT+QGPSCFG='beidounmeatype' and updated NMEA sentences corresponding to (Chapter 2.3.1.6) 6. Added the enabling of QZSS in description of in AT+QGPSCFG='gnssconfig (Chapter 2.3.1.7) 7. Added the default value of and in AT+QGPSCFG='lbsapn' (Chapter 2.3.1.12) 8. Updated the value of in AT+QGPSCFG='agnssprotocol' (Chapter 2.3.1.14) 9. Deleted AT+QGPSCFG='appidname' (Chapter 2.3.1.15) 10. Added AT+QGPSCFG='multibandconfig' (Chapter 2.3.1.15) 11. Modified the format of , and and the range of in AT+QGPSLOC (Chapter 2.3.5) 12. Deleted the Read Command in AT+QGPSSUPLCA LTE-A(Q)_Series_GNSS_Application_Note 3 / 48 LTE-A Module Series (Chapter 2.3.11) 13. Added the operation examples of AGNSS function (Chapter 3.4) LTE-A(Q)_Series_GNSS_Application_Note 4 / 48 LTE-A Module Series Contents About the Document ................................................................................................................................... 3 Contents ....................................................................................................................................................... 5 Table Index................................................................................................................................................... 7 1 Introduction .......................................................................................................................................... 8 1.1. Applicable Modules ..................................................................................................................... 8 1.2. GNSS Turning On/off Procedures .............................................................................................. 9 1.3. Supported NMEA Sentence Types............................................................................................. 9 1.4. XTRA Assistance Introduction .................................................................................................. 10 2 Description of GNSS AT Commands ............................................................................................... 12 2.1. AT Command Introduction ........................................................................................................ 12 2.1.1. Definitions....................................................................................................................... 12 2.1.2. AT Command Syntax ..................................................................................................... 12 2.2. Declaration of AT Command Examples ................................................................................... 13 2.3. AT Commands Description ....................................................................................................... 13 2.3.1. AT+QGPSCFG Configure GNSS................................................................................ 13 2.3.1.1. AT+QGPSCFG='outport' Configure Output Port of NMEA Sentences.......... 14 2.3.1.2. AT+QGPSCFG='nmeasrc' Enable/Disable Acquisition of NMEA Sentences Through AT+QGPSGNMEA................................................................................................. 15 2.3.1.3. AT+QGPSCFG='gpsnmeatype' Configure Output Type of GPS NMEA Sentences ............................................................................................................................ 16 2.3.1.4. AT+QGPSCFG='glonassnmeatype' Configure Output Type of GLONASS or GNSS Multi-constellations NMEA Sentences...................................................................... 17 2.3.1.5. AT+QGPSCFG='galileonmeatype' Configure Output Type of Galileo NMEA Sentences ............................................................................................................................ 18 2.3.1.6. AT+QGPSCFG='beidounmeatype' Configure Output Type of BeiDou and QZSS NMEA Sentences ...................................................................................................... 19 2.3.1.7. AT+QGPSCFG='gnssconfig' Configure Enabled GNSS Constellations ....... 20 2.3.1.8. AT+QGPSCFG='autogps' Enable/Disable GNSS to Run Automatically ....... 21 2.3.1.9. AT+QGPSCFG='dpoenable' Enable/Disable DPO Mode.............................. 22 2.3.1.10. AT+QGPSCFG='plane' Configure Plane Mode Used by MO AGPS Session23 2.3.1.11. AT+QGPSCFG='suplver' Configure SUPL Protocol Version ........................ 24 2.3.1.12. AT+QGPSCFG='lbsapn' Configure LBS APN ............................................... 25 2.3.1.13. AT+QGPSCFG='agpsposmode' Configure AGNSS Positioning Mode ......... 26 2.3.1.14. AT+QGPSCFG='agnssprotocol' Configure AGNSS Positioning Protocol..... 27 2.3.1.15. AT+QGPSCFG='multibandconfig' Configure GNSS Multiband ..................... 28 2.3.2. AT+QGPSDEL Delete Assistance Data...................................................................... 29 2.3.3. AT+QGPS Turn On GNSS .......................................................................................... 30 2.3.4. AT+QGPSEND Turn Off GNSS .................................................................................. 32 2.3.5. AT+QGPSLOC Acquire Positioning Information......................................................... 32 2.3.6. AT+QGPSGNMEA Acquire NMEA Sentences ........................................................... 34 LTE-A(Q)_Series_GNSS_Application_Note 5 / 48 LTE-A Module Series 2.3.7. 2.3.8. 2.3.9. 2.3.10. 2.3.11. AT+QGPSXTRA Enable/Disable XTRA Assistance ................................................... 37 AT+QGPSXTRATIME Inject XTRA Time.................................................................... 37 AT+QGPSXTRADATA Inject XTRA Data File ............................................................ 39 AT+QGPSSUPLURL Configure SUPL Server URL ................................................... 40 AT+QGPSSUPLCA Inject SUPL Certificate ............................................................... 41 3 Examples ............................................................................................................................................ 42 3.1. Turn On/off GNSS..................................................................................................................... 42 3.2. Application of GNSS ........................................................................................... 42 3.3. Operation Procedures of XTRA Assistance ............................................................................. 43 3.4. Operation Procedures of AGNSS ............................................................................................. 43 4 Summary of Error Codes .................................................................................................................. 45 5 Appendix References ........................................................................................................................ 46 LTE-A(Q)_Series_GNSS_Application_Note 6 / 48 LTE-A Module Series Table Index Table 1: Applicable Modules ........................................................................................................................ 8 Table 2: Types of AT Commands .............................................................................................................. 12 Table 3: Format of PQGSV and PQGSA Sentences................................................................................. 20 Table 4: Summary of Error Codes ............................................................................................................. 45 Table 5: Related Documents...................................................................................................................... 46 Table 6: Terms and Abbreviations ............................................................................................................. 46 LTE-A(Q)_Series_GNSS_Application_Note 7 / 48 LTE-A Module Series 1 Introduction Quectel LTE-A(Q) series modules integrate the multi-GNSS engine which supports GPS, BeiDou, QZSS, Galileo, GLONASS systems and also XTRA (that is gpsOneXTRA) assistance technology. The high-performance GNSS engine is suitable for various application scenarios with low cost and accurate positioning requirements, and supports location tracking without any network assistance. This makes Quectel LTE-A(Q) series modules widely used in the following fields such as turn-by-turn navigation, asset tracking, personnel tracking, location-aware games, as well as home and fleet management. 1.1. Applicable Modules Table 1: Applicable Modules Module Series LTE-A(Q) Module EG06 Series EM06 Series EP06 Series EG060K-EA EG120K-EA EM060K-GL EG12 Series EM12-G EG18 Series EM120R-GL EM121R-GL EM160R-GL LTE-A(Q)_Series_GNSS_Application_Note 8 / 48 EG512R-EA LTE-A Module Series 1.2. GNSS Turning On/Off Procedures The GNSS of LTE-A(Q) series modules support location calculation without any network assistance. GNSS turning on/off procedures are shown below: Step 1: Configure GNSS parameters through AT+QGPSCFG. Step 2: Turn on GNSS through AT+QGPS. Step 3: Obatin the positioning information in any of the following three ways after turning on GNSS and fixing position successfully: 1) NMEA sentences are outputted to 'usbnmea' port by default and can be obtained by reading the port. 2) Obtain positioning information such as latitude, longitude, height, GNSS positioning mode, time, number of satellites directly through AT+QGPSLOC. 3) Set AT+QGPSCFG='nmeasrc',1 to enable acquisition of specified NMEA sentences through AT+QGPSGNMEA. The specified NMEA sentences cannot be acquired through AT+QGPSGNMEA if AT+QGPSCFG='nmeasrc',0 is set. Step 4: Turn off GNSS through AT+QGPSEND. 1.3. Supported NMEA Sentence Types The default NMEA sentences of the modules are compatible with NMEA 0183 protocol, and five kinds of prefixes are available to differentiate NMEA sentences of different satellite systems, as illustrated below. GNSS Multi-constellations NMEA sentences have the prefix 'GN': ⚫ GNGSA – GNSS DOP and active satellites ⚫ GNGNS – GNSS fix data GPS NMEA sentences have the prefix 'GP': ⚫ GPGGA – Global positioning system fix data, such as time, position, etc. ⚫ GPRMC – Recommended minimum specific GNSS data ⚫ GPGSV – GNSS satellites in view, such as number of satellites in view, satellite ID numbers, etc. ⚫ GPGSA – GNSS DOP and active satellites ⚫ GPVTG – Course over ground and ground speed LTE-A(Q)_Series_GNSS_Application_Note 9 / 48 LTE-A Module Series GLONASS NMEA sentences have the prefix 'GL': ⚫ GLGSV – GNSS satellites in view, such as number of satellites in view, satellite ID numbers, etc. Galileo NMEA sentences have the prefix 'GA': ⚫ GAGGA – Global positioning system fix data, such as time, position, etc. ⚫ GARMC – Recommended minimum specific GNSS data ⚫ GAGSV – GNSS satellites in view, such as number of satellites in view, satellite ID numbers, etc. ⚫ GAGSA – GNSS DOP and active satellites ⚫ GAVTG – Course over ground and ground speed BeiDou NMEA sentences have the prefix 'PQ': ⚫ PQGSV – GNSS satellites in view, such as number of satellites in view, satellite ID numbers, etc. ⚫ PQGSA – GNSS DOP and active satellites QZSS NMEA sentences have the prefix 'PQ': ⚫ PQGSV – GNSS satellites in view, such as number of satellites in view, satellite ID numbers, etc. ⚫ PQGSA – GNSS DOP and active satellites ⚫ NOTE 1. BeiDou and QZSS NMEA sentences of LTE-A(Q) series modules have the prefix 'PQ', which is an extended sentence based on NMEA 0183 V4.10 protocol. 2. For Galileo NMEA sentences of EG06, EM06 and EP06 series modules, only GAGSV is supported. 1.4. XTRA Assistance Introduction XTRA assistance technology enhances the performance of GNSS, and provides simplified GNSS assistance delivery, including ephemeris, almanac, ionosphere, UTC, health and coarse time assistance for GNSS engine. After activating XTRA assistance, the TTFF can be reduced by 18–30 s (or more in harsh environments with weak signals). The assistance data which is obtained from one of the XTRA assistance web servers needs to be updated before expiration. Before using this function, please make sure the valid XTRA assistance data is available first. It is necessary to download a new XTRA binary file which contains the valid XTRA assistance data from one of the XTRA assistance web servers through URLs listed below. LTE-A(Q)_Series_GNSS_Application_Note 10 / 48 LTE-A Module Series ⚫ The files named with suffix 'xtra2.bin' are for GPS + GLONASS: http://xtrapath4.izatcloud.net/xtra2.bin http://xtrapath5.izatcloud.net/xtra2.bin http://xtrapath6.izatcloud.net/xtra2.bin ⚫ The files named with suffix 'xtra3grc.bin' are for GPS + GLONASS + BeiDou: http://xtrapath4.izatcloud.net/xtra3grc.bin http://xtrapath5.izatcloud.net/xtra3grc.bin http://xtrapath6.izatcloud.net/xtra3grc.bin ⚫ The files named with suffix 'xtra3grcej.bin' are for GPS + GLONASS + BeiDou + Galileo: http://xtrapath4.izatcloud.net/xtra3grcej.bin http://xtrapath5.izatcloud.net/xtra3grcej.bin http://xtrapath6.izatcloud.net/xtra3grcej.bin NOTE Not all applicable modules of this document support GPS + GLONASS + BeiDou + Galileo system data files with the suffix 'xtra3grcej.bin'. Please contact Quectel Technical Supports for details. XTRA assistance data needs to be updated regularly. The status of XTRA data files can be queried through AT+QGPSXTRADATA? before updating. The operation procedures of XTRA assistance are shown as follows: Step 1: For EM06, EG06 and EP06 series modules, XTRA assistance is disabled by default; and for other applicable modules, XTRA assistance is enabled by default. If it is disabled, enable it through AT+QGPSXTRA=1. Step 2: Query and confirm the current validity of XTRA data file through AT+QGPSXTRADATA?. If the data is invalid, perform Step 3–6; if the data is valid, turn on GNSS engine according to the procedures described in Chapter 1.2 directly. Step 3: Download file with suffix 'xtra2.bin' or 'xtra3grc.bin' or 'xtra3grcej.bin' to the module via URLs listed above. Step 4: Inject the correct XTRA time to GNSS engine through AT+QGPSXTRATIME. Step 5: Inject the valid XTRA data file to GNSS engine through AT+QGPSXTRADATA. Step 6: Turn on GNSS engine according to the procedures described in Chapter 1.2 NOTE 1. GNSS engine needs to be turned off before Step 1. 2. For more detailed information of the AT commands mentioned above, please refer to Chapters 2.3.7, 2.3.8 and 2.3.9. LTE-A(Q)_Series_GNSS_Application_Note 11 / 48 LTE-A Module Series 2 Description of GNSS AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals to its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 2: Types of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of corresponding Write Command and return information about the type, value, or range of its parameter. Check the current parameter value of a corresponding Write Command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. LTE-A(Q)_Series_GNSS_Application_Note 12 / 48 LTE-A Module Series 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about how to use the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendation or suggestions about how you should design a program flow or what status you should set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there exists a correlation among these examples and that they should be executed in a given sequence. 2.3. AT Commands Description 2.3.1. AT+QGPSCFG Configure GNSS This command queries and configures various GNSS settings, including the output port and output types of NMEA sentences, etc. AT+QGPSCFG Configure GNSS Test Command AT+QGPSCFG=? Response +QGPSCFG: 'outport',(list of supported s) +QGPSCFG: 'nmeasrc',(list of supported s) +QGPSCFG: 'gpsnmeatype',(range of supported s) +QGPSCFG: 'glonassnmeatype',(range of supported s) +QGPSCFG: 'galileonmeatype',(range of supported s) +QGPSCFG: 'beidounmeatype',(range of supported s) +QGPSCFG: 'gnssconfig',(range of supported s) +QGPSCFG: 'autogps',(list of supported s) +QGPSCFG: 'dpoenable',(range of supported s) +QGPSCFG: 'plane',(range of supported s) +QGPSCFG: 'suplver',(range of supported s) +QGPSCFG: 'lbsapn',(range of supported s),(range of supported s), +QGPSCFG: 'agpsposmode',(range of supported s) +QGPSCFG: 'agnssprotocol',(range of supported s),(range of supported s) +QGPSCFG：'multibandconfig',(range of supported s) OK NOTE Only some of the applicable modules of this document supports the configuration of GNSS multiband through AT command. Please contact Quectel Technical Supports for details. 2.3.1.1. AT+QGPSCFG='outport' Configure Output Port of NMEA Sentences This command configures the output port of NMEA sentences. AT+QGPSCFG='outport' Configure Output Port of NMEA Sentences Write Command AT+QGPSCFG='outport'[,] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'outport', OK If the optional parameter is specified, configure the output port of NMEA sentences: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved to NVRAM automatically. Parameter String type. Configure output port of NMEA sentences. 'none' Close NMEA sentence output 'usbnmea' Output through USB NMEA port LTE-A(Q)_Series_GNSS_Application_Note 14 / 48 LTE-A Module Series 'uartdebug' Output through Debug UART port The error code of operation. See Chapter 4 for details. 2.3.1.2. AT+QGPSCFG='nmeasrc' Enable/Disable Acquisition of NMEA Sentences Through AT+QGPSGNMEA This command enables/disables acquisition of NMEA sentences through AT+QGPSGNMEA. AT+QGPSCFG='nmeasrc' Enable/Disable Acquisition of NMEA Sentences Through AT+QGPSGNMEA Write Command Response AT+QGPSCFG='nmeasrc'[,] configuration: +QGPSCFG: 'nmeasrc', OK If the optional parameter is specified, configure whether to enable acquisition of NMEA sentences through AT+QGPSGNMEA: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved to NVRAM automatically. Parameter Integer type. Set whether to acquire the original NMEA sentences through AT+QGPSGNMEA. If enabled, after executing AT+QGPSGNMEA, NMEA sentences are outputted through the AT port as a return value. 0 Disable 1 Enable The error code of operation. See Chapter 4 for details. LTE-A(Q)_Series_GNSS_Application_Note 15 / 48 LTE-A Module Series 2.3.1.3. AT+QGPSCFG='gpsnmeatype' Configure Output Type of GPS NMEA Sentences This command configures the type of GPS NMEA sentences that will be outputted. AT+QGPSCFG='gpsnmeatype' Configure Output Type of GPS NMEA Sentences Write Command AT+QGPSCFG='gpsnmeatype'[,] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'gpsnmeatype', OK If the optional parameter is specified, configure the output type of GPS NMEA sentences: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved to NVRAM automatically. Parameter Integer type. Configure output type of GPS NMEA sentences by XOR operation. 0 Disable 1 GPGGA 2 GPRMC 4 GPGSV 8 GPGSA 16 GPVTG 31 All the five types of sentences The error code of operation. See Chapter 4 for details. LTE-A(Q)_Series_GNSS_Application_Note 16 / 48 LTE-A Module Series 2.3.1.4. AT+QGPSCFG='glonassnmeatype' Configure Output Type of GLONASS or GNSS Multi-constellations NMEA Sentences This command configures the output type of GLONASS or GNSS Multi-constellations NMEA sentences. AT+QGPSCFG='glonassnmeatype' Configure Output Type of GLONASS or GNSS Multi-constellations NMEA Sentences Write Command AT+QGPSCFG='glonassnmeatype'[, ] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'glonassnmeatype', OK Maximum Response Time Characteristics If the optional parameter is specified, configure the output type of GLONASS or GNSS Multi-constellations NMEA sentences: OK Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved to NVRAM automatically. Parameter Integer type. Configure output type of GLONASS or GNSS Multi-constellations NMEA sentences by XOR operation. 0 Disable 1 GLGSV 2 GNGSA 4 GNGNS The error code of operation. See Chapter 4 for details. LTE-A(Q)_Series_GNSS_Application_Note 17 / 48 LTE-A Module Series 2.3.1.5. AT+QGPSCFG='galileonmeatype' Configure Output Type of Galileo NMEA Sentences This command configures the output type of Galileo NMEA sentences. AT+QGPSCFG='galileonmeatype' Configure Output Type of Galileo NMEA Sentences Write Command AT+QGPSCFG='galileonmeatype'[,< Galileo_NMEA_type>] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'galileonmeatype', OK If the optional parameter is specified, configure the output type of Galileo NMEA sentences: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved to NVRAM automatically. Parameter Integer type. Configure output type of Galileo NMEA sentences by XOR operation. For EG06, EM06 and EP06 series modules, the supported values are as follows: 0 Disable 1 GAGSV For other applicable modules, the supported values are as follows: 0 Disable 1 GAGGA 2 GARMC 4 GAGSV 8 GAGSA 16 GAVTG The error code of operation. See Chapter 4 for details. LTE-A(Q)_Series_GNSS_Application_Note 18 / 48 LTE-A Module Series 2.3.1.6. AT+QGPSCFG='beidounmeatype' Configure Output Type of BeiDou and QZSS NMEA Sentences This command configures the output type of BeiDou and QZSS NMEA sentences. AT+QGPSCFG='beidounmeatype' Configure Output Type of BeiDou and QZSS NMEA Sentences Write Command AT+QGPSCFG='beidounmeatype'[, ] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'beidounmeatype', OK If the optional parameter is specified, configure the output type of BeiDou and QZSS NMEA sentences: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved to NVRAM automatically. Parameter Integer type. Configure output type of BeiDou and QZSS NMEA sentences by XOR operation. 0 Disable 1 PQGSA 2 PQGSV The error code of operation. See Chapter 4 for details. NOTE This command configures the output type of BeiDou and QZSS NMEA sentences synchronously. For example, AT+QGPSCFG='beidounmeatype',1 indicates to configure the output type of BeiDou and QZSS NMEA sentences as PQGSA synchronously. LTE-A(Q)_Series_GNSS_Application_Note 19 / 48 LTE-A Module Series Table 3: Format of PQGSV and PQGSA Sentences Type PQGSV PQGSA Format $PQGSV,,,,,,,,...,, ,,,,* $PQGSA,,,,…,,,,,< SysID>* Parameter Total number of sentences. Range: 1–9. Sentence number. Range: 1–9. Total number of satellites in view. Range: 0–36. Satellite ID. Elevation degrees. Maximum: 90°. Azimuth degrees. Range: 000°–359°. Signal-to-noise ratio. Range: 00–99. Unit: dB-Hz. Null if not tracked. Signal ID. 0 indicates all signals. System ID. 4 BeiDou 5 QZSS Checksum. Fix mode 1. M Manual mode, force to 2D or 3D positioning A Automatic mode, automatically switch to 2D or 3D positioning. Fix mode 2. 1 No positioning 2 2D positioning 3 3D positioning. Position dilution of precision. Horizontal dilution of precision. Vertical dilution of precision. 2.3.1.7. AT+QGPSCFG='gnssconfig' Configure Enabled GNSS Constellations This command configures the enabled GNSS constellations of the module. LTE-A(Q)_Series_GNSS_Application_Note 20 / 48 LTE-A Module Series AT+QGPSCFG='gnssconfig' Configure Enabled GNSS Constellations Write Command AT+QGPSCFG='gnssconfig'[,] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'gnssconfig', OK If the optional parameter is specified, configure the enabled GNSS constellations: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. Parameter Integer type. Configure enabled GNSS constellations. GPS is always ON. 0 GLONASS OFF/BeiDou and QZSS OFF/Galileo OFF 1 GLONASS ON/BeiDou and QZSS ON/Galileo ON 2 GLONASS ON/BeiDou and QZSS ON/Galileo OFF 3 GLONASS ON/BeiDou and QZSS OFF/Galileo ON 4 GLONASS ON/BeiDou and QZSS OFF/Galileo OFF 5 GLONASS OFF/BeiDou and QZSS ON/Galileo ON 6 GLONASS OFF/BeiDou and QZSS OFF/Galileo ON 7 GLONASS OFF/BeiDou and QZSS ON/Galileo OFF The error code of operation. See Chapter 4 for details. 2.3.1.8. AT+QGPSCFG='autogps' Enable/Disable GNSS to Run Automatically This command enable/disable the automatic running of GNSS after the module is rebooted. AT+QGPSCFG='autogps' Enable/Disable GNSS to Run Automatically Write Command Response AT+QGPSCFG='autogps'[,] If the optional parameter is omitted, query the current LTE-A(Q)_Series_GNSS_Application_Note 21 / 48 LTE-A Module Series Maximum Response Time Characteristics configuration: +QGPSCFG: 'autogps', OK If the optional parameter is specified, enable/disable automatic running of GNSS: OK Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. Parameter Integer type. Enable or disable GNSS to run automatically after the module is powered on. 0 Disable 1 Enable The error code of operation. See Chapter 4 for details. NOTE GNSS can only run automatically in standalone mode. 2.3.1.9. AT+QGPSCFG='dpoenable' Enable/Disable DPO Mode This command enables/disables the DPO mode. AT+QGPSCFG='dpoenable' Enable/Disable DPO Mode Write Command AT+QGPSCFG='dpoenable'[,] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'dpoenable', OK LTE-A(Q)_Series_GNSS_Application_Note 22 / 48 LTE-A Module Series Maximum Response Time Characteristics If the optional parameter is specified, enable/disable the DPO mode: OK Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. Parameter Integer type. Enable/disable DPO. 0 Disable DPO 1 Enable DPO with dynamic duty cycle 2 Enable DPO only when the module is not connected to an external power supply (not running on battery) The error code of operation. See Chapter 4 for details. 2.3.1.10. AT+QGPSCFG='plane' Configure Plane Mode Used by MO AGPS Session This command configures the plane mode (control plane or user plane) to be used by the Mobile-Originated (MO) AGPS session. AT+QGPSCFG='plane' Configure Plane Mode Used by MO AGPS Session Write Command AT+QGPSCFG='plane'[,] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'plane', OK If the optional parameter is specified, configure the plane mode used by MO AGPS session: OK Or ERROR LTE-A(Q)_Series_GNSS_Application_Note 23 / 48 LTE-A Module Series Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. Parameter Integer type. Plane mode used by MO AGPS session. 0 User plane without SSL 1 User plane with SSL 2 Control plane The error code of operation. See Chapter 4 for details. 2.3.1.11. AT+QGPSCFG='suplver' Configure SUPL Protocol Version This command configures the SUPL version in an SI (SET Initiated) session, and the most likely used SUPL version in an NI (Network Initiated) session. AT+QGPSCFG='suplver' Configure SUPL Protocol Version Write Command AT+QGPSCFG='suplver'[,] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'suplver', OK If the optional parameter is specified, configure the SUPL protocol version: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. LTE-A(Q)_Series_GNSS_Application_Note 24 / 48 LTE-A Module Series Parameter Integer type. SUPL protocol version. 1 SUPL V1.0 2 SUPL V2.0 3 SUPL V2.0.2 The error code of operation. See Chapter 4 for details. 2.3.1.12. AT+QGPSCFG='lbsapn' Configure LBS APN This command configures LBS APN. AT+QGPSCFG='lbsapn' Configure LBS APN Write Command AT+QGPSCFG='lbsapn'[,,,] Response If the optional parameters are omitted, query the current configuration: +QGPSCFG: 'lbsapn',,, OK If the optional parameters are specified, configure the LBS APN: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. Parameter Integer type. Configure the serving system of LBS APN by XOR operation. Range: 0–31. 0 Disable 1 CDMA 2 HDR 4 GSM 8 WCDMA LTE-A(Q)_Series_GNSS_Application_Note 25 / 48 LTE-A Module Series 16 LTE Integer type. PDP type of the LBS APN profile. 0 Disable 1 IPv4 2 IPv6 3 IPv4v6 4 PPP String type. Access point name. The error code of operation. See Chapter 4 for details. 2.3.1.13. AT+QGPSCFG='agpsposmode' Configure AGNSS Positioning Mode This command configures the AGNSS positioning mode. AT+QGPSCFG='agpsposmode' Configure AGNSS Positioning Mode Write Command AT+QGPSCFG='agpsposmode'[,] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'agpsposmode', OK If the optional parameter is specified, configure the AGNSS positioning mode: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. Parameter Integer type. AGNSS positioning mode. Each bit indicates a specified mode and see the following figure for details. Only bit 16 is relevant to enabling of autonomous fallback for SUPL-MSB. Setting bit to 1 enables the corresponding mode. Range: 0–33554431. Default value: 33488767 or 775. LTE-A(Q)_Series_GNSS_Application_Note 26 / 48 LTE-A Module Series The error code of operation. See Chapter 4 for details. NOTE When the China Unicom/China Telecom/China Mobile (U)SIM card is inserted, the default value of is 775. When any other card is inserted, the default value of is 33488767. 2.3.1.14. AT+QGPSCFG='agnssprotocol' Configure AGNSS Positioning Protocol This command configures the AGPS LPP positioning protocol and AGLONASS positioning protocol. AT+QGPSCFG='agnssprotocol' Configure AGNSS Positioning Protocol Write Command AT+QGPSCFG='agnssprotocol'[,,] Response If the optional parameters are omitted, query the current configuration: +QGPSCFG: 'agnssprotocol',, OK If the optional parameters are specified, configure AGPS LPP LTE-A(Q)_Series_GNSS_Application_Note 27 / 48 LTE-A Module Series Maximum Response Time Characteristics positioning protocol and AGLONASS positioning protocol: OK Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. Parameter Integer type. Configure the AGPS LPP positioning protocol by XOR operation. 0 Disable ALL 1 User Plane LPP 2 Control Plane LPP 3 User Plane LPP and Control Plane LPP Integer type. Configure AGLONASS positioning protocol by XOR operation. Default value: 1286. 0 Disable ALL 1 Control Plane RRLP 2 Control Plane RRC 4 Control Plane LPP 256 User Plane RRLP 1024 User Plane LPP The error code of operation. See Chapter 4 for details. 2.3.1.15. AT+QGPSCFG='multibandconfig' Configure GNSS Multiband This command configures the GNSS multiband. AT+QGPSCFG='multibandconfig' Configure GNSS Multiband Write Command AT+QGPSCFG='multibandconfig',[< multiband>] Response If the optional parameter is omitted, query the current configuration: +QGPSCFG: 'multibandconfig', OK If the optional parameter is specified, configure the GNSS LTE-A(Q)_Series_GNSS_Application_Note 28 / 48 LTE-A Module Series Maximum Response Time Characteristics multiband: OK Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved to NVRAM automatically. Parameter Integer type. GNSS multiband (in addition to L1) by XOR operation. Enable the corresponding band when bit is set to 1; disable the corresponding band when bit is set to 0. 0 Disable 1 GPS L5 2 Galileo E5a 4 Beidou B2a The error code of operation. See Chapter 4 for details. NOTE Only some of the applicable modules of this document supports the configuration of GNSS multiband through AT command. Please contact Quectel Technical Supports for details. 2.3.2. AT+QGPSDEL Delete Assistance Data This command deletes assistance data to perform cold start, hot start and warm start of GNSS. The command can only be executed when GNSS is turned off. After deleting the assistance data through this command, you can enforce the cold start of GNSS through AT+QGPS. Hot/warm start can also be performed if the corresponding conditions are satisfied. AT+QGPSDEL Delete Assistance Data Test Command AT+QGPSDEL=? Response +QGPSDEL: (range of supported s) Write Command AT+QGPSDEL= OK Response OK LTE-A(Q)_Series_GNSS_Application_Note 29 / 48 Maximum Response Time Characteristics LTE-A Module Series Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms / Parameter Integer type. The type of GNSS assistance data to be deleted. 0 Delete all assistance data. Enforce cold start after starting GNSS. 1 Do not delete any data. Perform hot start if the conditions are satisfied after starting GNSS. 2 Delete some related data. Perform warm start if the conditions are satisfied after starting GNSS. 3 Delete the XTRA assistance data injected into GNSS engine. The error code of operation. See Chapter 4 for details. 2.3.3. AT+QGPS Turn On GNSS The command turns on GNSS. AT+QGPS Turn On GNSS Test Command AT+QGPS=? Response EG06, EM06 and EP06 series modules: +QGPS: (range of supported s),(range of supported s),(range of supported s),(range of supported s),(range of supported s) OK Other applicable modules: +QGPS: (range of supported s),(range of supported s),(range of supported s),(range of supported s) Read Command Read current GNSS state OK Response +QGPS: LTE-A(Q)_Series_GNSS_Application_Note 30 / 48 LTE-A Module Series AT+QGPS? OK Write Command EG06, EM06 and EP06 series modules AT+QGPS=[,[,[,[,]]]] Response OK Or ERROR If there is any error related to ME functionality: +CME ERROR: Write Command Other applicable modules AT+QGPS=[,[,[,]]] Response OK Or ERROR If there is any error related to ME functionality: +CME ERROR: Maximum Response Time 300 ms Characteristics The command takes effect immediately. The configurations will not be saved. Parameter Integer type. GNSS state. 0 GNSS OFF 1 GNSS ON Integer type. GNSS working mode. 1 Standalone 2 MSB 3 MSA 4 Quick positioning Integer type. Maximum positioning time, which includes the response time of GNSS receiver while measuring the GNSS pseudo range and the upper time limit of GNSS satellite searching. It also includes the time for demodulating the ephemeris data and calculating the position. Range: 1–255. Default value: 30. Unit: second. Integer type. Positioning accuracy threshold. Range: 1–1000. Default value: 50. Unit: meter. Integer type. Horizontal accuracy level. 1 Low accuracy 2 Medium accuracy 3 High accuracy Integer type. Count of positioning attempts. Range: 0–1000. Default value: 0. LTE-A(Q)_Series_GNSS_Application_Note 31 / 48 LTE-A Module Series 0 indicates continuous positioning; other value indicates the actual count of positioning attempts. Integer type. Interval time between each positioning. Range: 1–65535. Default value: 1. Unit: second. Integer type. Interval time between each positioning. Range: 100–65535. Default value: 1000. Unit: ms. The error code of operation. See Chapter 4 for details. 2.3.4. AT+QGPSEND Turn Off GNSS This command turns off GNSS. AT+QGPSEND Turn Off GNSS Test Command AT+QGPSEND=? Execution Command AT+QGPSEND Response OK Response OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms / Parameter The error code of operation. See Chapter 4 for details. 2.3.5. AT+QGPSLOC Acquire Positioning Information This command acquires positioning infomration. Before executing the command, turn on GNSS through AT+QGPS. If GNSS positioning fails, +CME ERROR: is returned to indicate the corresponding situation. AT+QGPSLOC Acquire Positioning Information Test Command AT+QGPSLOC=? Response +QGPSLOC: ,,,,,(list of supported s),,,, LTE-A(Q)_Series_GNSS_Application_Note 32 / 48 Write Command AT+QGPSLOC= Maximum Response Time Characteristics LTE-A Module Series , OK Response +QGPSLOC: ,,,,,,,,,, OK Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms / Parameter Integer type. Latitude and longitude display format. 0 , format: ddmm.mmmmN/S,dddmm.mmmmE/W 1 , format: ddmm.mmmmmm,N/S,dddmm.mmmmmm,E/W 2 , format: (-)dd.ddddd,(-)ddd.ddddd UTC time. Format: hhmmss.ss. Latitude. If is 0: Format: ddmm.mmmmN/S dd Degree. Range: 00–89 mm.mmmm Minute. Range: 00.0000–59.9999 N/S North latitude/South latitude If is 1: Format: ddmm.mmmmmm,N/S dd Degree. Range: 00–89 mm.mmmmmm Minute. Range: 00.000000–59.999999 N/S North latitude/South latitude If is 2: Format: (-)dd.ddddd dd.ddddd Degree. Range: -89.99999–89.99999 - South latitude Longitude. If is 0: LTE-A(Q)_Series_GNSS_Application_Note 33 / 48 LTE-A Module Series Format: dddmm.mmmmE/W ddd Degree. Range: 000–179 mm.mmmm Minute. Range: 00.0000–59.9999 E/W East longitude/West longitude If is 1: Format: dddmm.mmmmmm,E/W ddd Degree. Range: 000–179 mm.mmmmmm Minute. Range: 00.000000–59.999999 E/W East longitude/West longitude If is 2: Format: (-)ddd.ddddd ddd.ddddd Degree. Range: -179.99999–179.99999 - West longitude Horizontal precision. Range: 0.5–99.9. Altitude of the antenna away from the sea level. Accurate to one decimal place. Unit: meter. Integer type. GNSS positioning mode. 2 2D positioning 3 3D positioning Course Over Ground based on true north. Format: x.x. Unit: degree. Range: 0.0–359.9. Speed over ground. Format: x.x. Unit: km/h. Accurate to one decimal place. Speed over ground. Format: x.x. Unit: knots. Accurate to one decimal place. UTC time when fixing position. Format: ddmmyy. dd Day mm Month yy Year Number of active satellites. Range: 00–80. Fixed as two-digit number. The error code of operation. See Chapter 4 for details. 2.3.6. AT+QGPSGNMEA Acquire NMEA Sentences This command acquires NMEA sentences. Before using this command, turn on GNSS through AT+QGPS, and set to 1 to enable acquisition of NMEA sentences through AT+QGPSGNMEA. The sentence output can be disabled through AT+QGPSCFG='gpsnmeatype',0, AT+QGPSCFG='glonassnmeatype',0, AT+QGPSCFG='galileonmeatype',0 and AT+QGPSCFG='beidounmeatype',0. If sentence output is disabled, AT+QGPSGNMEA can still be used to acquire NMEA sentences on condition that the GNSS has already acquired sentences through this command after its activation. LTE-A(Q)_Series_GNSS_Application_Note 34 / 48 LTE-A Module Series AT+QGPSGNMEA Acquire NMEA Sentences Test Command AT+QGPSGNMEA=? Response +QGPSGNMEA: (list of supported s) Write Command Query GGA sentence AT+QGPSGNMEA='GGA' OK Response [+QGPSGNMEA: ] […] OK Or ERROR Write Command Query RMC sentence AT+QGPSGNMEA='RMC' If there is any error related to ME functionality: +CME ERROR: Response [+QGPSGNMEA: ] […] OK Or ERROR Write Command Query GSV sentence AT+QGPSGNMEA='GSV' If there is any error related to ME functionality: +CME ERROR: Response [+QGPSGNMEA: ] […] OK Or ERROR Write Command Query GSA sentence AT+QGPSGNMEA='GSA' If there is any error related to ME functionality: +CME ERROR: Response [+QGPSGNMEA: ] […] OK Or ERROR LTE-A(Q)_Series_GNSS_Application_Note 35 / 48 LTE-A Module Series Write Command Query VTG sentence AT+QGPSGNMEA='VTG' Write Command Query GNS sentence AT+QGPSGNMEA='GNS' Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: Response [+QGPSGNMEA: ] […] OK Or ERROR If there is any error related to ME functionality: +CME ERROR: Response [+QGPSGNMEA: ] […] OK Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms / Parameter NMEA sentence type. 'GGA' GGA sentence 'RMC' RMC sentence 'GSV' GSV sentence 'GSA' GSA sentence 'VTG' VTG sentence 'GNS' GNS sentence GGA sentence. RMC sentence. GSV sentence. GSA sentence. VTG sentence. GNS sentence. The error code of operation. See Chapter 4 for details. LTE-A(Q)_Series_GNSS_Application_Note 36 / 48 LTE-A Module Series 2.3.7. AT+QGPSXTRA Enable/Disable XTRA Assistance This command enables/disables XTRA assistance. AT+QGPSXTRA Enable/Disable XTRA Assistance Test Command AT+QGPSXTRA=? Response +QGPSXTRA: (list of supported s) Read Command AT+QGPSXTRA? OK Response +QGPSXTRA: Write Command AT+QGPSXTRA= OK Response OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved to NVRAM automatically. Parameter Integer type. Enable/disable XTRA assistance. For EM06, EG06 and EP06 series modules, XTRA assistance is disabled by default; and for other applicable modules, XTRA assistance is enabled by default. 0 Disable 1 Enable The error code of operation. See Chapter 4 for details. 2.3.8. AT+QGPSXTRATIME Inject XTRA Time This command injects XTRA time to GNSS engine. Before using the command, enable XTRA assistance through AT+QGPSXTRA=1. After the feature is activated, the GNSS engine asks for XTRA time and assistance data file. Before injecting XTRA data file, inject XTRA time first through this command. LTE-A(Q)_Series_GNSS_Application_Note 37 / 48 LTE-A Module Series AT+QGPSXTRATIME Inject XTRA Time Test Command AT+QGPSXTRATIME=? Response EG06, EM06 and EP06 series modules: +QGPSXTRATIME: ,(list of supported s),(list of supported s), OK Other applicable modules: +QGPSXTRATIME: , OK Write Command EG06, EM06 and EP06 series modules AT+QGPSXTRATIME=,[,[,,]] Response OK Or ERROR Write Command Other applicable modules AT+QGPSXTRATIME=, If there is any error related to ME functionality: +CME ERROR: Response OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will not be saved. Parameter Integer type. Operation type. 0 Inject XTRA time String type. Time to be injected. For EG06, EM06 and EP06 series modules, the time type is defined by . For other applicable modules, the time type is UTC time. Format: 'YYYY/MM/DD,hh:mm:ss'. For example, '2019/01/05,08:30:30'. Integer type. Time type. 0 GPS time 1 UTC time LTE-A(Q)_Series_GNSS_Application_Note 38 / 48 LTE-A Module Series Integer type. Whether to force the GNSS subsystem to accept the injected time. 0 Do not force 1 Force Integer type. Uncertainty of time. It indicates the time difference between sending a request to the SNTP server and receiving a response from the SNTP server. Default value: 3500. Unit: ms. The error code of operation. See Chapter 4 for details. 2.3.9. AT+QGPSXTRADATA Inject XTRA Data File This command injects a XTRA assistance data file to GNSS engine. Before executing this command, please enable the XTRA assistance through AT+QGPSXTRA=1, then store the valid XTRA data file in UFS of the module through AT+QFUPL and inject the XTRA time to GNSS engine through AT+QGPSXTRATIME. After finishing all these operations, you can execute AT+QGPSXTRADATA to inject the XTRA assistance data file to GNSS engine. After executing this command successfully, you can delete the XTRA data file from UFS through AT+QFDEL. Whether the XTRA data file is injected successfully can be queried through AT+QGPSXTRADATA?. AT+QGPSXTRADATA Inject XTRA Data File Test Command AT+QGPSXTRADATA=? Response +QGPSXTRADATA: Read Command Query the status of XTRA data files AT+QGPSXTRADATA? OK Response +QGPSXTRADATA: , OK Or ERROR If there is any error related to ME functionality: +CME ERROR: Write Command AT+QGPSXTRADATA= Response OK Or ERROR If there is any error related to ME functionality: +CME ERROR: LTE-A(Q)_Series_GNSS_Application_Note 39 / 48 LTE-A Module Series Maximum Response Time Characteristics 1 s The command takes effect immediately. The configuration will be saved to NVRAM automatically. Parameter 'xtra2.bin' or 'xtra3grc.bin'. Integer type. Valid time of the injected XTRA data file. Unit: minute. 0 No XTRA file or the file is overdue 1440 For 1-day XTRA data file 4320 For 3-day XTRA data file 10080 For 7-day XTRA data file String type. Starting time of the validity period of the injected XTRA data file. Format: 'YYYY/MM/DD,hh:mm:ss', for example, '2016/01/03,15:34:50'. The error code of operation. See Chapter 4 for details. 2.3.10. AT+QGPSSUPLURL Configure SUPL Server URL This command configures the SUPL server URL. AT+QGPSSUPLURL Configure SUPL Server URL Test Command AT+QGPSSUPLURL=? Response +QGPSSUPLURL: Read Command Query the current SUPL server URL AT+QGPSSUPLURL? Write Command AT+QGPSSUPLURL= OK Response +QGPSSUPLURL: OK Response OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved to NVRAM automatically. LTE-A(Q)_Series_GNSS_Application_Note 40 / 48 LTE-A Module Series Parameter String type. SUPL server address. The address format is ':', where the can be omitted, for example, 'supl.server.com', '123.123.123.123' or 'supl.server.com:7275'. When the is omitted, the default value (7275) is used. The error code of operation. See Chapter 4 for details. 2.3.11. AT+QGPSSUPLCA Inject SUPL Certificate This command injects SUPL certificate. The certificate file to be injected should be put into file system by AT+QFUPL. The certificate is obtained from the operator or the server provider. AT+QGPSSUPLCA Inject SUPL Certificate Test Command AT+QGPSSUPLCA=? Response +QGPSSUPLCA: ,(range of supported s) Write Command AT+QGPSSUPLCA=[,] OK Response OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms / Parameter String type. Name of the SUPL certificate. Integer type. SUPL certificate ID. Range: 0–9. Default value: 0. The error code of operation. See Chapter 4 for details. LTE-A(Q)_Series_GNSS_Application_Note 41 / 48 LTE-A Module Series 3 Examples 3.1. Turn On/Off GNSS Default parameters are used in this example to turn on GNSS. After turning on GNSS, NMEA sentences are outputted from 'usbnmea' port by default; and GNSS can be turned off through AT+QGPSEND. AT+QGPS=1 //Set GNSS working mode to standalone and turn on GNSS. OK //After turning on GNSS, NMEA sentences are outputted from 'usbnmea' port by default. AT+QGPSLOC=0 //Obtain positioning information. +QGPSLOC: 061951.00,3150.7223N,11711.9293E,0.7,62.2,2,0.0,0.0,0.0,110513,09 OK AT+QGPSEND OK //Turn off GNSS. 3.2. Application of GNSS When GNSS is turned on and is set to 1, NMEA sentences can be acquired directly through AT+QGPSGNMEA. AT+QGPSCFG='nmeasrc',1 //Set to 1 to enable acquisition of NMEA sentences through AT+QGPSGNMEA. OK AT+QGPSGNMEA='GGA' //Obtain GGA sentence. +QGPSGNMEA: $GPGGA,103647.000,3150.721154,N,11711.925873,E,1,02,4.7,59.8,M,-2.0,M,,*77 OK AT+QGPSCFG='nmeasrc',0 //Set to 0 to disable acquisition of NMEA sentences through AT+QGPSGNMEA. OK AT+QGPSGNMEA='GGA' //Obtain GGA sentence. +CME ERROR: 507 //Because acquisition of NMEA sentences through AT+QGPSGNMEA is disabled, the GGA sentences cannot be obtained. LTE-A(Q)_Series_GNSS_Application_Note 42 / 48 LTE-A Module Series 3.3. Operation Procedures of XTRA Assistance This example shows the operation procedures of XTRA assistance. For information about FILE commands used to upload a file to UFS or delete a file from UFS, please refer to document [1]. AT+QGPSXTRA=1 //If XTRA assistance is disabled, enable it first and then perform the following procedures. OK //The XTRA assistance function is activated immediately. //If XTRA data file is valid (query through AT+QGPSXTRADATA?), turn on GNSS engine directly. //If XTRA data file is invalid (query through AT+QGPSXTRADATA?), perform the following procedures. //Users can download the XTRA data file to PC (or MCU) from URLs listed in Chapter 1.4. AT+QFUPL='UFS:xtra2.bin',59748,60 //Select a XTRA file and upload it to the module through QCOM. For more details about QCOM tool, please refer to document [2]. OK AT+QGPSXTRATIME='2019/01/05,08:30:30',3500 //Inject XTRA time to GNSS engine. The accuracy of the injected UTC time should be within 3.5 s. OK AT+QGPSXTRADATA='UFS:xtra2.bin' //Inject XTRA data file. OK //The XTRA data file is injected to GNSS engine successfully. AT+QFDEL='UFS:xtra2.bin' //Delete XTRA data file from UFS. This step is optional. OK AT+QGPS=1 //Turn on GNSS engine. OK 3.4. Operation Procedures of AGNSS This example shows the operation procedures of AGNSS. Please turn on the AGNSS function through AT+QGPSCFG='agpsposmode' before use. For information about FILE commands used to upload a file to UFS or delete a file from UFS, please refer to document [1]. AT+QGPSDEL=0 OK AT+QGPSCFG='plane',1 OK AT+CFUN=1,1 //Delete all the assistance data. //Set the plane mode used by MO AGPS session as user plane with SSL. If no certificate is needed for the service, configure the plane mode through AT+QGPSCFG='plane',0. //Restart the module. LTE-A(Q)_Series_GNSS_Application_Note 43 / 48 LTE-A Module Series OK AT+QGPSSUPLURL='supl.xxxx.com:7275' //Set the URL and port of SUPL service. The 'supl.xxxx.com' is an example which should be replaced by a real URL; and 7275 is the default port of SUPL service. OK AT+QFUPL='UFS:supl.xxxx.com.der',893 //Upload CA certificate. The 'supl.xxxx.com.der' is an example which should be replaced by a real CA certificate; and 893 is the size of 'supl.xxxx.com.der', which should be replaced by the size of the real CA certificate. This step can be omitted if the service requires no certificate. OK AT+QGPSSUPLCA='UFS:supl.xxxx.com.der' //Inject CA certificate. The 'supl.xxxx.com.der' is an example which should be replaced by a real CA certificate. OK AT+QFDEL='UFS:supl.xxxx.com.der' //Delete the certificate from UFS. This step is optional. OK AT+QGPS=2 //Turn on GNSS in MSB mode. This step needs to be performed after completing the configuration of network. After turning on GNSS, positioning can be completed in 10 seconds through the module. If there is a large time deviation, it indicates that the AGNSS does not take effect. OK LTE-A(Q)_Series_GNSS_Application_Note 44 / 48 LTE-A Module Series 4 Summary of Error Codes The indicates an error related to GNSS operation. The details about are described in the following table. Table 4: Summary of Error Codes Numeric Value 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 549 Verbose Value Invalid parameter(s) Operation not supported GNSS subsystem busy Session is ongoing Session not active Operation timeout Function not enabled Time information error XTRA not enabled XTRA file open error Bad CRC for XTRA data file Validity time is out of range Internal resource error GNSS locked End by E911 Not fixed now CMUX port is not opened Unknown error LTE-A(Q)_Series_GNSS_Application_Note 45 / 48 LTE-A Module Series 5 Appendix References Table 5: Related Documents Document Name [1] Quectel_LTE-A(Q)_Series_FILE_Application_Note [2] Quectel_QCOM_User_Guide Table 6: Terms and Abbreviations Abbreviation AGPS AGNSS APN BeiDou CDMA CMUX COG CRC DOP DPO Galileo GGA GLONASS GNS Description Assisted Global Positioning System Assisted Global Navigation Satellite System Access Point Name BeiDou Navigation Satellite System Code-Division Multiple Access Connection Multiplexing Course Over Ground Cyclic Redundancy Check Dilution of Precision Dynamic Power Optimization Galileo Satellite Navigation System Global Positioning System Fix Data Global Navigation Satellite System Global Network Service LTE-A(Q)_Series_GNSS_Application_Note 46 / 48 GNSS GPS GSA GSM GSV HDOP HDR ID IPv4 IPv6 LBS LPP LTE MCU ME MO MS MSA MSB NMEA NVRAM PC PDOP PDP PPP LTE-A Module Series Global Navigation Satellite System Global Positioning System GPS DOP and Active Satellites Global System for Mobile Communications Satellites in View Horizontal Dilution of Precision High Data Rate Identifier Internet Protocol version 4 Internet Protocol version 6 Location Based Services LTE Positioning Protocol Long-Term Evolution Micro Control Unit Mobile Equipment Mobile-Originated Mobile Station Mobile Station Assisted Mobile Station Based National Marine Electronics Association 0183 Interface Standard Non-Volatile Random Access Memory Private Computer Position Dilution of Precision Packet Data Protocol Point to Point Protocol LTE-A(Q)_Series_GNSS_Application_Note 47 / 48 RMC RRC RRLP SET SNR SNTP SSL SUPL TTFF UART UFS URL USB (U)SIM UTC VDOP VTG WCDMA XTRA LTE-A Module Series Recommended Minimum Specific GNSS Data Radio Resource Control Radio Resource Location Services Protocol SUPL Enabled Terminal Signal Noise Ratio Simple Network Time Protocol Secure Sockets Layer Secure User Plane Location Time to First Fix Universal Asynchronous Receiver & Transmitter User File System Uniform Resource Locator Universal Serial Bus (Universal) Subscriber Identity Module Universal Time Code Vertical Dilution of Precision Course Over Ground and Ground Speed Wideband Code Division Multiple Access An Auxiliary Positioning Technology Provided by Qualcomm LTE-A(Q)_Series_GNSS_Application_Note 48 / 48

L26-DR (UDR&ADRC) DR Application Note GNSS Module Series Version: 1.0 Date: 2022-06-28 Status: Released GNSS Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. L26-DR(UDR&ADRC)_DR_Application_Note 1 / 24 GNSS Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. L26-DR(UDR&ADRC)_DR_Application_Note 2 / 24 GNSS Module Series About the Document Document Information Title Subtitle Document Type Document Status L26-DR (UDR&ADRC) DR Application Note GNSS Module Series Application Note Released Revision History Version Date - 2022-04-15 1.0 2022-06-28 Description Creation of the document First official release L26-DR(UDR&ADRC)_DR_Application_Note 3 / 24 GNSS Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index .................................................................................................................................................. 5 Figure Index ................................................................................................................................................ 6 1 Introduction ......................................................................................................................................... 7 2 Configuration....................................................................................................................................... 8 2.1. Orientation .............................................................................................................................. 8 2.2. Mounting ................................................................................................................................. 9 2.3. DR Calibration ...................................................................................................................... 10 2.4. Configuration Bits ..................................................................................................................11 2.4.1. Set the Configuration Bits ..............................................................................................11 2.4.2. Get the Configuration Bits ............................................................................................. 13 3 Messages ........................................................................................................................................... 14 3.1. PQ Messages ....................................................................................................................... 14 3.1.1. PQSOL .......................................................................................................................... 14 3.1.2. PQGNSS ....................................................................................................................... 16 3.1.3. PQSNR,21..................................................................................................................... 18 3.1.4. PQSNR,23..................................................................................................................... 19 3.1.5. PQEND.......................................................................................................................... 20 3.2. PSTM Messages .................................................................................................................. 20 3.2.1. PSTMDRSENMSG ....................................................................................................... 20 3.2.1.1. IMU Temperature Message (MsgID = 24) ............................................................ 21 3.2.1.2. IMU Accelerometer Message (MsgID = 30) ......................................................... 21 3.2.1.3. IMU Gyroscope Message (MsgID = 31)............................................................... 22 3.2.2. PSTMIMUSELFTESTCMD ........................................................................................... 23 4 Appendix References ....................................................................................................................... 24 L26-DR(UDR&ADRC)_DR_Application_Note 4 / 24 GNSS Module Series Table Index Table 1: List of Configuration Bits ...............................................................................................................11 Table 2: Terms and Abbreviations .............................................................................................................. 24 L26-DR(UDR&ADRC)_DR_Application_Note 5 / 24 GNSS Module Series Figure Index Figure 1: Module Orientation........................................................................................................................ 8 Figure 2: Module and Vehicle Installation Diagram ..................................................................................... 9 L26-DR(UDR&ADRC)_DR_Application_Note 6 / 24 GNSS Module Series 1 Introduction This document describes the dead reckoning (DR) feature, including orientation, mounting, calibration, configuration bits and messages related to the Dead Reckoning functionality of the Quectel L26-DR module. Quectel offers a two DR product portfolio. The first one is ADRC which combines a 6-axis inertial sensor (3-axis gyroscope and 3-axis accelerometer) and an attached sensor like a wheel speed sensor. The L26-DR (ADRC) module is mainly used for two-wheel applications like motorcycles and scooters. Another one is UDR. The L26-DR (UDR) can be used for 4-wheel applications without the addition of the wheel speed sensor. The use of the additional wheel speed sensor allows for the dead reckoning to be maintained for longer in situations of GNSS outages than it is possible with untethered UDR where only the internal IMU is used and no additional tethering is implemented on the vehicle. L26-DR (ADRC) module is typically used in OEM cases and L26-DR (UDR) is typically used in aftermarket products. This document applies to the following variants of the L26-DR module: ⚫ L26-DR (UDR) ⚫ L26-DR (ADRC) Module L26-DR (UDR) L26-DR (ADRC) Vehicle Type Four-wheeler Two-wheeler Connect Speed or Not No Yes L26-DR(UDR&ADRC)_DR_Application_Note 7 / 24 GNSS Module Series 2 Configuration 2.1. Orientation The L26-DR module is designed to work on two-wheel or four-wheel vehicles. User must install the module embedding GNSS and motion sensor ICs steadily constrained to vehicle body. No relative movement is allowed between vehicle and device and maximum isolation from both shock and vibration must be provided. Manually holding the board is not accepted. The best way to guarantee good installation is to firmly screw the device down to the vehicle frame. Mounting location should permit easy access to power supply and GNSS antenna, and should not be exposed to excessive heat. Z Yaw Pitch X Y Roll Figure 1: Module Orientation NOTE Rigidly mount module tight to the vehicle body. Select a structurally sound location that is not prone to flexing (bending motion of the vehicle chassis). L26-DR(UDR&ADRC)_DR_Application_Note 8 / 24 GNSS Module Series 2.2. Mounting The Quectel L26-DR module can be mounted on a vehicle in any orientation, but one axis (recommend the Z axis ) must be perpendicular to the horizontal plane. The reference model is as follows: Yaw X Pitch β －β Roll γ -γ Figure 2: Module and Vehicle Installation Diagram Referring to the above installation model, there is no limit to the α angle during the installation process of the module (0° ≤ α ≤ 360°). In order to make the module work in the best state, it is recommended that the β angle and the γ angle should be less than 15 degrees (-15° ≤ β ≤ 15°, -15° ≤ γ≤ 15°). In other words, it is to ensure that the angle between the plane where the module is located and the horizontal plane should L26-DR(UDR&ADRC)_DR_Application_Note 9 / 24 be less than 15 degrees. GNSS Module Series NOTE 1. Only Yaw Angle is unlimited. 2. Module positioning performance degradation occurs when the β and γ angle exceeds 15 degrees. 2.3. DR Calibration The module needs to be calibrated before the dead reckoning functionality will be useful. The DR calibration steps are as follows: Step 1: Fix the module on the vehicle frame firmly. Any displacement, rotation or tilt of the device, however small relative to the vehicle plane may cause performance issues and/or void calibration. Step 2: Calibration should be performed under good GNSS signal and clear sky conditions. Step 3: Do not interfere with or move the device after powering on. Step 4: After the initial power on, the vehicle should be stationary between 30 seconds and 1 minute. Once driving, the vehicle needs to have one or two dynamic changes (in the case of satellite signals), such as waiting for traffic lights, acceleration and deceleration and other normal driving scenes. Step 5: The calibration process ends when the of $PQSOL message indicates a combined solution (GNSS + DR). See Chapter 3.1.1 for details about the message. After the calibration, there is no limit to driving trajectory and driving dynamics, you can perform verification tests by referring to the following scenarios: 1) Open sky area, urban main road (check good satellite signal). 2) Urban tunnels (assessment of absence of satellite signals). 3) Urban viaduct (assessment of weak satellite signals). 4) Underground vehicle park (assess the absence of satellite signal). 5) Surrounding areas with dense buildings (assessing multi-path of canyon in the city). 6) City boulevards (assessment of weak satellite signals). 7) High rise dense area (examine the serious condition of canyon multipath in the city). L26-DR(UDR&ADRC)_DR_Application_Note 10 / 24 2.4. Configuration Bits GNSS Module Series Table 1: List of Configuration Bits Bit 22, 23 24 25 26 27 28 29 30 Bitmask (32 bits) 0x000000 0x400000 0x800000 0xC00000 0x1000000 0x2000000 0x4000000 0x8000000 0x10000000 0x20000000 0x40000000 Function Fix rate control. 1 Hz (default). Fix rate control. 5 Hz. Fix rate control. 10 Hz (UART baud rate ≥ 230400 bps). Fix rate control. 20 Hz (UART baud rate ≥ 230400 bps). Enable $PQSOL message. Enable $PQGNSS message. Enable $PQSNR,21 and $PQEND messages. Enable $PQSNR,23 message. Enable $PSTMDRSENMSG message. Enable/Disable DR feature. 0 = Enable 1 = Disable Enable/Disable DR hot start feature. 0 = Disable 1 = Enable 2.4.1. Set the Configuration Bits 1) Clear the bitmask. $PSTMSETPAR,1228,,2* ⚫ If successful, the module returns: $PSTMSETPAROK,1228* ⚫ If failed, the module returns: $PSTMSETPARERROR,1228* L26-DR(UDR&ADRC)_DR_Application_Note 11 / 24 2) Set the bitmask. $PSTMSETPAR,1228,,1* ⚫ If successful, the module returns: $PSTMSETPAROK,1228* ⚫ If failed, the module returns: $PSTMSETPARERROR,1228* 3) Save the parameters. $PSTMSAVEPAR*58 ⚫ If successful, the module returns: $PSTMSAVEPAROK* ⚫ If failed, the module returns: $PSTMSAVEPARERROR* 4) Restart the module. $PSTMSRR*49 Example: 1) Set the fix rate to 5 Hz. //Clear the bitmask: $PSTMSETPAR,1228,0xC00000,2*32 $PSTMSETPAROK,1228*3A //Set the bitmask: $PSTMSETPAR,1228,0x400000,1*43 $PSTMSETPAROK,1228*3A //Save the parameter: $PSTMSAVEPAR*58 $PSTMSAVEPAROK*5C //Restart: $PSTMSRR*49 2) Disable $PQSOL message //Clear the bitmask: L26-DR(UDR&ADRC)_DR_Application_Note GNSS Module Series 12 / 24 $PSTMSETPAR,1228,0x1000000,2*75 $PSTMSETPAROK,1228*3A //Save the parameter: $PSTMSAVEPAR*58 $PSTMSAVEPAROK*5C //Restart: $PSTMSRR*49 3) Enable $PQSOL message //Set the bitmask: $PSTMSETPAR,1228,0x1000000,1*76 $PSTMSETPAROK,1228*3A //Save the parameter: $PSTMSAVEPAR*58 $PSTMSAVEPAROK*5C //Restart: $PSTMSRR*49 2.4.2. Get the Configuration Bits Command: $PSTMGETPAR,1228*2A ⚫ If successful, the module returns: $PSTMSETPAR,1228,* ⚫ If failed, the module returns: $PSTMGETPARERROR* Example: $PSTMGETPAR,1228*2A $PSTMSETPAR,1228,0x11000000*5B GNSS Module Series L26-DR(UDR&ADRC)_DR_Application_Note 13 / 24 GNSS Module Series 3 Messages 3.1. PQ Messages This chapter introduces the PQ messages (proprietary NMEA messages defined by Quectel) supported by Quectel L26-DR module. 3.1.1. PQSOL This message reports the navigation results. Type: Output Synopsis: $PQSOL,,,,,,,,,,< TOW>,,,,,,,,,,,,,,,,,,,,,,,,,,,* Parameter: Field Format Numeric Numeric Numeric Numeric Numeric Numeric Numeric Unit Description - Message Subtype ID, fixed as 1. Year Year. Month Month. Range: 1–12. Day Day. Range: 1–31. Hour Hour. Range: 0–23. Minute Minutes. Range: 0–59. Millisecond Milliseconds. Range: 0–59950 (20 Hz fix L26-DR(UDR&ADRC)_DR_Application_Note 14 / 24 Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric GNSS Module Series Millisecond rate); 0–59900 (10 Hz fix rate); 0–59800 (5 Hz fix rate); 0–59000 (1 Hz fix rate). Milliseconds since power on. 32-bit unsigned integer. Week GPS week number, including rollover. Millisecond Time of week. Navigation mode. 0 = No navigation. Bit 0: Reserved. Bit 1: GNSS-only. Bit 2: DR-only. Bit 3: Combined solution (GNSS + DR). Bit 4–8: Reserved. Bit 9: Odometer (wheel tick) in use. Bit 10, 11: Reserved. Bit 12: DGNSS (not including satellite-based correction source). Bit 13–31: Reserved. Degree Latitude, scaled by 10^7. Degree Longitude, scaled by 10^7. cm Ellipsoidal height. cm Height above mean sea level. cm/s Northward velocity. cm/s Eastward velocity. cm/s Downward velocity. cm/s Speed over ground. cm Traveled distance since power on. Degree Roll angle, scaled by 100. Degree Pitch angle, scaled by 100. Degree Heading angle, scaled by 100. - - - - Uncertainty of position in northward cm direction. L26-DR(UDR&ADRC)_DR_Application_Note 15 / 24 GNSS Module Series Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric cm cm cm/s cm/s cm/s Degree Degree Degree Degree Degree Degree Uncertainty of position in eastward direction. Uncertainty of position in downward direction. Northward velocity uncertainty. Eastward velocity uncertainty. Downward velocity uncertainty. Roll angle uncertainty, scaled by 100. Pitch angle uncertainty, scaled by 100. Yaw angle uncertainty, scaled by 100. Roll angle misalignment, scaled by 100. Pitch angle misalignment, scaled by 100. Yaw angle misalignment, scaled by 100. Example: $PQSOL,1,2021,12,21,8,25,4000,61300,2189,203121999,2,318221924,1171155060,6587,6618,-3,4,0,5 ,156,1182,331,0,0,0,3267,6444,3273,211,206,137,20,10,10,0,0,0*68 NOTE Attitude-related values (including roll, yaw and pitch) are invalid in GNSS-only mode. 3.1.2. PQGNSS This message reports GNSS-only fix information. Type: Output Synopsis: $PQGNSS,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,* L26-DR(UDR&ADRC)_DR_Application_Note 16 / 24 Parameter: Field Format Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric Numeric GNSS Module Series Unit Description - Message Subtype ID, fixed as 6. Year UTC year. Month UTC month. Day UTC day. Hour UTC hour. Minute UTC minutes. Second UTC seconds. Week GPS week number, including rollover. Millisecond Time of week. - Number of satellites in use. Degree Latitude, scaled by 10^7. Degree Longitude, scaled by 10^7. cm Ellipsoidal height. cm/s Speed over ground. Degree Heading angle, scaled by 100. cm Horizontal accuracy. cm/s Northward velocity. cm/s Eastward velocity. cm/s Downward velocity. - - - - cm Uncertainty of position in northward direction. cm Uncertainty of position in eastward direction. cm Uncertainty of position in downward direction. cm/s Northward velocity uncertainty. cm/s Eastward velocity uncertainty. L26-DR(UDR&ADRC)_DR_Application_Note 17 / 24 GNSS Module Series Numeric Numeric Numeric Numeric Numeric cm/s Second cm - Downward velocity uncertainty. Leap seconds. Height above mean sea level. - Example: $PQGNSS,6,2022,4,15,11,20,34,2205,472852000,11,318221499,1171158627,3673,5,0,2421,1,5,-1,0,0, 1580,1834,1632,272,232,285,18,0,3704,12*34 3.1.3. PQSNR,21 This message reports sensor data. Type: Output Synopsis: $PQSNR,,{,,,,,,,< Z_ACC>,,}* Parameter: Field Format Unit Description Numeric - 21 = Mixed DR sensor data. Numeric - Number of data set(s). Start of repeat block. Repeat times: . Numeric ms Milliseconds since power on. 32-bit unsigned integer. Numeric Deg/s X-axis angular velocity of gyroscope, scaled by 1000. Numeric Deg/s Y-axis angular velocity of gyroscope, scaled by 1000. Numeric Deg/s Z-axis angular velocity of gyroscope, scaled by 1000. Numeric m/s^2 X-axis acceleration of accelerometer, scaled by 1000. Numeric m/s^2 Y-axis acceleration of accelerometer, scaled by 1000. L26-DR(UDR&ADRC)_DR_Application_Note 18 / 24 GNSS Module Series Numeric Numeric Numeric End of repeat block. m/s^2 m/s - Z-axis acceleration of accelerometer, scaled by 1000. Vehicle speed, scaled by 100. Vehicle direction. 0 = Forward 1 = Reverse 8 = Unknow Example: $PQSNR,21,10,9800,449,-447,-178,566,1937,9589,0,8,9900,465,-412,-110,562,1937,9593,0,8,10000,5 21,-420,-128,567,1946,9596,0,8,10100,448,-441,-94,565,1937,9591,0,8,10200,454,-437,-118,565,1942, 9599,0,8,10300,487,-403,-129,559,1946,9603,0,8,10400,472,-461,-110,563,1940,9590,0,8,10500,443,-4 31,-121,561,1940,9587,0,8,10600,473,-416,-122,563,1943,9600,0,8,10700,474,-441,-86,564,1947,9597 ,0,8*4B 3.1.4. PQSNR,23 This message reports raw sensor data. The message only exists in NHz build. The entire block is comprised of multiple messages. Type: Output Synopsis: $PQSNR,,,,,,,,* Parameter: Field Format Numeric Numeric Numeric Numeric Numeric Numeric Unit ms Deg/s Deg/s Deg/s m/s2 Description 23 = Raw sensor data Milliseconds since power on. 32-bit unsigned integer. X-axis angular velocity of gyroscope, scaled by 1000. Y-axis angular velocity of gyroscope, scaled by 1000. Z-axis angular velocity of gyroscope, scaled by 1000. X-axis acceleration of accelerometer, scaled by 1000. L26-DR(UDR&ADRC)_DR_Application_Note 19 / 24 GNSS Module Series Numeric Numeric m/s2 m/s2 Y-axis acceleration of accelerometer, scaled by 1000. Z-axis acceleration of accelerometer, scaled by 1000. Example: $PQSNR,23,3100,399,-519,-454,466,-511,9906*5C 3.1.5. PQEND This message indicates the end of an epoch. Type: Output Synopsis: $PQEND,,* Parameter: Field Format Numeric Numeric Unit Description - Fixed as 255. - Fixed as 255. Example: $PQEND,255,255*4E 3.2. PSTM Messages 3.2.1. PSTMDRSENMSG This message outputs the IMU raw data. Type: Output Synopsis: $PSTMDRSENMSG,[,]* L26-DR(UDR&ADRC)_DR_Application_Note 20 / 24 Parameter: Field Format Unit Numeric - - - GNSS Module Series Description Message ID. 24 = IMU temperature. 30 = IMU accelerometer. 31 = IMU gyroscope. This field varies with the message type. See Chapter 3.2.1.1, 3.2.1.2, and 3.2.1.3 for details. 3.2.1.1.IMU Temperature Message (MsgID = 24) This message outputs the IMU temperature. Type: Output Synopsis: $PSTMDRSENMSG,24,,,* Parameter: Field Format Numeric Numeric Numeric Unit Description - CPU ticks count since power on. IMU temperature. - The real temperature in Celsius degree: Celsius degree = / 256 + 25.0 Validity. - 0 = Temperature is not valid. 1 = Temperature is valid. Example: $PSTMDRSENMSG,24,3248649605,-486,1*28 3.2.1.2.IMU Accelerometer Message (MsgID = 30) This message outputs the IMU accelerometer. FS = ±2g Sensitivity = 0.061mg / LSB L26-DR(UDR&ADRC)_DR_Application_Note 21 / 24 GNSS Module Series Type: Output Synopsis: $PSTMDRSENMSG,30,,,,* Parameter: Field Format Numeric Numeric Numeric Numeric Unit Description - CPU tick count since power on. Raw signed 16-bit integer X-axis acceleration data - in sensor frame. Raw signed 16-bit integer Y-axis acceleration data in sensor frame. Raw signed 16-bit integer Z-axis acceleration data in sensor frame. Example: $PSTMDRSENMSG,30,3248512115,299,-35,16514*02 $PSTMDRSENMSG,30,3248570594,302,-37,16524*09 3.2.1.3.IMU Gyroscope Message (MsgID = 31) This message outputs the IMU gyroscope. FS = ±125 dps Sensitivity = 4.375 mdps / LSB Type: Output Synopsis: $PSTMDRSENMSG,31,,,,* Parameter: Field Format Numeric Numeric Unit Description - CPU ticks count since power on. Raw signed 16-bit integer X-axis angular rate data - in sensor frame. L26-DR(UDR&ADRC)_DR_Application_Note 22 / 24 GNSS Module Series Numeric - Numeric - Raw signed 16-bit integer Y-axis angular rate data in sensor frame. Raw signed 16-bit integer Z-axis angular rate data in sensor frame. Example: $PSTMDRSENMSG,31,5855224,62,-119,-49*2A $PSTMDRSENMSG,31,5913732,68,-117,-43*25 3.2.2. PSTMIMUSELFTESTCMD The command executes the self-test procedure in IMU. Type: Command Synopsis: $PSTMIMUSELFTESTCMD,* Parameter: Field Format Numeric Unit Description IMU type. - 0 = Accelerometer 1 = Gyroscope Result: ⚫ If successful, the module returns: $PSTMIMUSELFTESTCMDOK* ⚫ In failed, the module returns: $PSTMIMUSELFTESTCMDKO* ⚫ If the self-test command is not supported by the mounted IMU or not supported by the FW (sensor layer not present in FW), the module returns: $PSTMIMUSELFTESTCMDERROR* Example: $PSTMIMUSELFTESTCMD,1*16 $PSTMIMUSELFTESTCMDOK*0F L26-DR(UDR&ADRC)_DR_Application_Note 23 / 24 GNSS Module Series 4 Appendix References Table 2: Terms and Abbreviations Abbreviation DR UDR FW GNSS IMU LSB NMEA UART UTC Description Dead Reckoning Untethered Dead Reckoning Firmware Global Navigation Satellite System Inertial Measurement Unit Least Significant Bit NMEA (National Marine Electronics Association) 0183 Interface Standard Universal Asynchronous Receiver/Transmitter Coordinated Universal Time L26-DR(UDR&ADRC)_DR_Application_Note 24 / 24

BG77xA-GL&BG95xA-GL QCFG AT Commands Manual LPWA Module Series Version: 1.0 Date: 2022-05-31 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 1 / 49 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 2 / 49 LPWA Module Series About the Document Revision History Version 1.0 Date 2021-01-29 2022-05-31 Author Igor STANCIC/ Aleksandar PAUNOVIC/ Mladen VUKOVIC Igor STANCIC/ Aleksandar PAUNOVIC/ Mladen VUKOVIC Description Creation of the document First official release BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 3 / 49 LPWA Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 6 1 Introduction ......................................................................................................................................... 7 1.1. Definitions .................................................................................................................................. 7 1.2. AT Command Syntax ................................................................................................................. 7 1.3. AT Command Responses .......................................................................................................... 8 1.4. Declaration of AT Command Examples ..................................................................................... 9 2 Description of AT+QCFG Commands............................................................................................. 10 2.1. AT+QCFG Extended Configuration Settings ........................................................................... 10 2.1.1. Network-Related AT Commands....................................................................................11 2.1.1.1. AT+QCFG='nwscanmode' Configure RAT(s) to be Searched for...................11 2.1.1.2. AT+QCFG='servicedomain' Configure Service Domain ................................ 12 2.1.1.3. AT+QCFG='nwscanseq' Configure RATs Searching Sequence .................... 13 2.1.1.4. AT+QCFG='band' Configure Frequency Band............................................... 14 2.1.1.5. AT+QCFG='iotopmode' Configure Network Category to be Searched Under LTE RAT ............................................................................................................................ 16 2.1.1.6. AT+QCFG='celevel' Query NB-IoT Coverage Enhancement Level .............. 17 2.1.1.7. AT+QCFG='psm/enter' Trigger the Module into PSM Immediately ............... 18 2.1.1.8. AT+QCFG='psm/urc' Enable/Disable PSM Entering Indication..................... 19 2.1.1.9. AT+QCFG='lapiconf' Set LAPI Value (Low Access Priority Indicator) ........... 20 2.1.2. Platform-Related AT Commands .................................................................................. 21 2.1.2.1. AT+QCFG='urc/ri/ring' Configure MAIN_RI Behavior in Case of RING URC 21 2.1.2.2. AT+QCFG='urc/ri/smsincoming' Configure MAIN_RI Behavior in Case of Incoming SMS URCs ........................................................................................................... 22 2.1.2.3. AT+QCFG='urc/ri/other' Configure MAIN_RI Behavior in Case of Other URCs23 2.1.2.4. AT+QCFG='risignaltype' Configure MAIN_RI Signal Output Carrier ............. 24 2.1.2.5. AT+QCFG='urc/delay' Configure URC Output Time ...................................... 25 2.1.2.6. AT+QCFG='gpio' Configure GPIO Status ...................................................... 26 2.1.2.7. AT+QCFG='airplanecontrol' Enable/Disable Airplane Mode Control via W_DISABLE# ....................................................................................................................... 28 2.1.2.8. AT+QCFG='emux/urcport' Configure URC Output Port in EMUX Mode ....... 30 2.1.2.9. AT+QCFG='apready'* Configure AP_READY* Behavior............................... 30 2.1.2.10. AT+QCFG='apn/display' Enable/Disable Showing APN ................................ 32 2.1.2.11. AT+QCFG='lwm2m' Enable/Disable LwM2M ................................................ 33 2.1.2.12. AT+QCFG='nwoper' Configure Network Operator Mode of the Modem ....... 33 2.1.2.13. AT+QCFG='ps_dev_mob_type' Configure Device Mobility Type Flag .......... 34 2.1.2.14. AT+QCFG='netupd' Enable/Disable Network Override for Specified LTE Parameters ........................................................................................................................... 35 2.1.2.15. AT+QCFG='edrxusimact' Activate/Deactivate (U)SIM in eDRX Mode .......... 37 BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 4 / 49 LPWA Module Series 2.1.2.16. AT+QCFG='setcfg' Set Configuration Field to the NV memory ..................... 38 2.1.2.17. AT+QCFG='setsyscfg' Set Value(s) to System Configuration Files............... 39 2.1.2.18. AT+QCFG='uartmapping' Show Port and Function Mapping ........................ 40 2.1.2.19. AT+QCFG='uartmapping/profile' Read/Write Port Profile Mapping Configuration ........................................................................................................................ 41 2.1.2.20. AT+QCFG='usb' Activate/Deactivate USB Interface ..................................... 42 2.1.2.21. AT+QCFG='usb/urcport' Configure URC Output Port in USB Interface Mode43 2.1.2.22. AT+QCFG='lte/bandprior' Configure Band Scan Priority under LTE ............. 44 2.1.2.23. AT+QCFG='stored/cell' Delete Stored Cell Acquisition DB ........................... 45 3 Summary of +CME ERROR Codes.................................................................................................. 46 4 Appendix References ....................................................................................................................... 48 BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 5 / 49 LPWA Module Series Table Index Table 1: Types of AT Commands ................................................................................................................. 8 Table 2: Summary of +CME ERROR Codes ............................................................................................. 46 Table 3: Related Document........................................................................................................................ 48 Table 4: Terms and Abbreviations .............................................................................................................. 48 BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 6 / 49 LPWA Module Series 1 Introduction This document describes the AT+QCFG commands supported on Quectel BG770A-GL, BG772A-GL, BG950A-GL, BG951A-GL, BG952A-GL and BG955A-GL modules. 1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. AT+QCFG commands implemented by the module are in 'Extended' syntax, as illustrated below. ⚫ Extended Extended commands can be executed in several modes, as shown in the following table: BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 7 / 49 LPWA Module Series Table 1: Types of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. Multiple commands can be placed on a single line using a semi-colon (;) between commands. In such cases, only the first command should have AT prefix. Commands can be in upper or lower case. Spaces should be ignored when you enter AT commands, except in the following cases: ⚫ Within quoted strings, where spaces are preserved; ⚫ Within an unquoted string or a numeric parameter; ⚫ Within an IP address; ⚫ Within the AT command name up to and including a =, ? or =?. On input, at least a carriage return is required. A newline character is ignored so it is permissible to use carriage return/line feed pairs on the input. If no command is entered after the AT token, OK will be returned. If an invalid command is entered, ERROR will be returned. Optional parameters, unless explicitly stated, need to be provided up to the last entered parameter. 1.3. AT Command Responses When the AT command processor has finished processing a line, it will output OK, ERROR or +CME ERROR: to indicate that it is ready to accept a new command. Solicited information responses are sent before the final OK, ERROR or +CME ERROR: . Responses will be in the format of: +CMD1: OK BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 8 / 49 LPWA Module Series 1.4. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 9 / 49 LPWA Module Series 2 Description of AT+QCFG Commands 2.1. AT+QCFG Extended Configuration Settings The following Test Command shows the supported extended configuration settings of the module. AT+QCFG Extended Configuration Settings Test Command AT+QCFG=? Response +QCFG: 'nwscanmode',(list of supported s),(list of supported s) +QCFG: 'servicedomain',(list of supported s) +QCFG: 'nwscanseq',(range of supported s),(list of supported s) +QCFG: 'band',(range of supported s),(range of supported s),(list of supported s) +QCFG: 'iotopmode',(range of supported s),(list of supported s) +QCFG: 'celevel',(range of supported s) +QCFG: 'urc/ri/ring',(list of supported s),(range of supported s),(range of supported s),(range of supported s),(list of supported s),(range of supported s) +QCFG: 'urc/ri/smsincoming',(list of supported s),(range of supported s),(range of supported s) +QCFG: 'urc/ri/other',(list of supported s),(range of supported s),(range of supported s) +QCFG: 'risignaltype',(list of supported s) +QCFG: 'urc/delay',(list of supported s) +QCFG: 'ledmode',(list of supported s) +QCFG: 'gpio',(range of supported s),(list of supported s),(list of supported s),(range of supported s),(list of supported s),(list of supported s),(list of supported s) +QCFG: 'airplanecontrol',(list of supported BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 10 / 49 Maximum Response Time LPWA Module Series s) +QCFG: 'emux/urcport',(range of supported s) +QCFG: 'apready',(list of supported s),(list of supported s),(range of supported s) +QCFG: 'psm/enter',(list of supported s) +QCFG: 'psm/urc',(list of supported s) +QCFG: 'apn/display',(list of supported s) +QCFG: 'lwm2m',(list of supported s) +QCFG: 'nwoper',(list of supported s) +QCFG: 'ps_dev_mob_type',(list of supported s) +QCFG: 'netupd',(list of supported s) ,(list of supported s) +QCFG: 'edrxusimact',(range of supported s) +QCFG: 'setcfg',(list of supported s),(list of supported s) +QCFG: 'setsyscfg',(list of supported s),(range of supported s),(list of supported s),(range of supported s),(range of supported s),(range of supported s) +QCFG: 'uartmapping' +QCFG: 'usb',(list of supported s) +QCFG: 'usb/urcport',(range of supported s) OK 300 ms 2.1.1. Network-Related AT Commands 2.1.1.1. AT+QCFG='nwscanmode' Configure RAT(s) to be Searched for The command queries and configures the RAT(s) to be searched for. AT+QCFG='nwscanmode' Configure RAT(s) to be Searched for Write Command AT+QCFG='nwscanmo'[,[,]] Response If the optional parameter is omitted, query the current settings: +QCFG: 'nwscanmode', OK If any of the optional parameter is specified, configure the RAT(s) to be searched for: OK BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 11 / 49 LPWA Module Series Maximum Response Time Characteristics If there is an error related to ME functionality: +CME ERROR: If there is any other error: ERROR 300 ms determines when the command will take effect. The configurations are saved automatically. Parameter Integer type. RAT(s) to be searched for. 0 Automatic (GSM and LTE) 1 GSM only 3 LTE only Integer type. When to take effect. 0 Take effect after rebooting 1 Take effect immediately Error code. See Chapter 3 for more information. NOTE This command is valid only on BG955A-GL module. 2.1.1.2. AT+QCFG='servicedomain' Configure Service Domain The command queries and configures the service domain to be registered. AT+QCFG='servicedomain' Configure Service Domain Write Command Response AT+QCFG='servicedomain'[,] +QCFG: 'servicedomain', OK If the optional parameter is specified, configure the service domain to be registered: OK If there is an error related to ME functionality: BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 12 / 49 Maximum Response Time Characteristics LPWA Module Series +CME ERROR: If there is any other error: ERROR 300 ms The configurations are saved automatically. Parameter Integer type. Service domain. 1 PS only Integer type. Error code. See Chapter 3 for more information. 2.1.1.3. AT+QCFG='nwscanseq' Configure RATs Searching Sequence The command queries and configures RATs searching sequence. AT+QCFG='nwscanseq' Configure RATs Searching Sequence Write Command Response AT+QCFG='nwscanseq'[,[ If optional parameters are omitted, query the current settings: ,effect]] +QCFG: 'nwscanseq', OK If any of the optional parameters is specified, configure RATs searching sequence: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms determines when the command takes effect. The configurations are saved automatically. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 13 / 49 LPWA Module Series Parameter Integer type. RATs searching sequence. (e.g.: 020301 stands for eMTC → NB-IoT → GSM) 00 Automatic (eMTC → NB-IoT) 01 GSM 02 eMTC 03 NB-IoT Integer type. Determines when the command takes effect. 0 Take effect after the module reboots 1 Take effect immediately Integer type. Error code. See Chapter 3 for more information. 2.1.1.4. AT+QCFG='band' Configure Frequency Band The command queries and configures the frequency bands to be searched. AT+QCFG='band' Configure Frequency Band Write Command AT+QCFG='band'[,, ,[ ,]] Response If optional parameters are omitted, query the current settings: +QCFG: 'band',,, OK If any of the optional parameters is specified, configure the frequency bands to be searched. OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 4500 ms determines when the command takes effect. The configurations are saved automatically. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 14 / 49 LPWA Module Series Parameter A hexadecimal value that specifies the GSM frequency band (e.g.: 0xa = 0x2(DCS1800) + 0x8(PCS1900)). If it is set to 0, it means not to change GSM frequency band. 0 No change 0x1 EGSM900 0x2 DCS1800 0x4 GSM850 0x8 PCS1900 0Xf All of the supported bands above A hexadecimal value that specifies the eMTC frequency band (e.g.: 0x15 = 0x01(LTE B1) + 0x04(LTE B3) + 0x10(LTE B5)). If it is set to 0, the eMTC frequency band will not be changed. By default, all bands are set. 0 No change 0x1 (BAND_PREF_LTE_BAND1) LTE B1 0x2 (BAND_PREF_LTE_BAND2) LTE B2 0x4 (BAND_PREF_LTE_BAND3) LTE B3 0x8 (BAND_PREF_LTE_BAND4) LTE B4 0x10 (BAND_PREF_LTE_BAND5) LTE B5 0x80 (BAND_PREF_LTE_BAND8) LTE B8 0x800 (BAND_PREF_LTE_BAND12) LTE B12 0x1000 (BAND_PREF_LTE_BAND13) LTE B13 0x20000 (BAND_PREF_LTE_BAND18) LTE B18 0x40000 (BAND_PREF_LTE_BAND19) LTE B19 0x80000 (BAND_PREF_LTE_BAND20) LTE B20 0x1000000 (BAND_PREF_LTE_BAND25) LTE B25 0x2000000 (BAND_PREF_LTE_BAND26) LTE B26 0x4000000 (BAND_PREF_LTE_BAND27) LTE B27 0x8000000 (BAND_PREF_LTE_BAND28) LTE B28 0x20000000000000000 (BAND_PREF_LTE_BAND66) LTE B66 A hexadecimal value that specifies the NB-IoT frequency band (e.g.: 0x15 = 0x01(LTE B1) + 0x04(LTE B3) + 0x10(LTE B5)). If it is set to 0, the NB-IoT frequency band will not be changed. By default, all bands are set. 0 No change 0x1 (BAND_PREF_LTE_BAND1) LTE B1 0x2 (BAND_PREF_LTE_BAND2) LTE B2 0x4 (BAND_PREF_LTE_BAND3) LTE B3 0x8 (BAND_PREF_LTE_BAND4) LTE B4 0x10 (BAND_PREF_LTE_BAND5) LTE B5 0x80 (BAND_PREF_LTE_BAND8) LTE B8 0x800 (BAND_PREF_LTE_BAND12) LTE B12 0x1000 (BAND_PREF_LTE_BAND13) LTE B13 BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 15 / 49 LPWA Module Series 0x10000 (BAND_PREF_LTE_BAND17) LTE B17 0x20000 (BAND_PREF_LTE_BAND18) LTE B18 0x40000 (BAND_PREF_LTE_BAND19) LTE B19 0x80000 (BAND_PREF_LTE_BAND20) LTE B20 0x1000000 (BAND_PREF_LTE_BAND25) LTE B25 0x8000000 (BAND_PREF_LTE_BAND28) LTE B28 0x20000000000000000 (BAND_PREF_LTE_BAND66) LTE B66 Integer type. Determines when the command takes effect. 0 Take effect after the module reboots 1 Take effect immediately Integer type. Error code. See Chapter 3 for more information. NOTE is valid only on BG955A-GL module. 2.1.1.5. AT+QCFG='iotopmode' Configure Network Category to be Searched Under LTE RAT The command queries and configures the network category to be searched under LTE RAT. AT+QCFG='iotopmode' Configure Network Category to be Searched Under LTE RAT Write Command Response AT+QCFG='iotopmode'[,[,]] settings: +QCFG: 'iotopmode', OK If any of the optional parameters is specified, configure the network category to be searched under LTE RAT: OK Maximum Response Time Characteristics If there is an error related to ME functionality: +CME ERROR: If there is any other error: ERROR 4500 ms determines when the command takes effect. The configurations are saved automatically. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 16 / 49 LPWA Module Series Parameter Integer type. Network category to be searched under LTE RAT. 0 eMTC 1 NB-IoT 2 eMTC and NB-IoT Integer type. Determines when the command takes effect. 0 Take effect after the module reboots 1 Take effect immediately Integer type. Error code. See Chapter 3 for more information. 2.1.1.6. AT+QCFG='celevel' Query NB-IoT Coverage Enhancement Level The command queries the NB-IoT coverage enhancement (CE) level. AT+QCFG='celevel' Query NB-IoT Coverage Enhancement Level Write Command AT+QCFG='celevel' Response: +QCFG: 'celevel', OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms / Parameter Integer type. NB-IoT coverage enhancement level. 0 CE level 0 1 CE level 1 2 CE level 2 Integer type. Error code. See Chapter 3 for more information. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 17 / 49 LPWA Module Series 2.1.1.7. AT+QCFG='psm/enter' Trigger the Module into PSM Immediately The command queries the current settings or sets whether to trigger the module into the Power Saving Mode (PSM) immediately after the RRC connection release is received. When =1, the module skips the active timer (T3324) and enters PSM immediately after the RRC connection release is received. AT+QCFG='psm/enter' Trigger the Module into PSM Immediately Write Command AT+QCFG='psm/enter'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'psm/enter', OK If the optional parameter is specified, set whether to trigger the module into PSM immediately after the RRC connection release is received: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is not saved. Parameter Integer type. Sets whether to trigger the module into PSM. 0 Enter PSM after T3324 expires 1 Enter PSM immediately after the RRC connection release is received. Integer type. Error code. See Chapter 3 for more information. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 18 / 49 LPWA Module Series 2.1.1.8. AT+QCFG='psm/urc' Enable/Disable PSM Entering Indication The command queries the current settings and enables/disables the output of URC +QPSMTIMER: ,, which indicates the TAU duration and active time duration of the module’s PSM. When the PSM function is enabled and the RRC connection release is received, the active timer (T3324) is started, and the indication URC is reported. AT+QCFG='psm/urc' Enable/Disable PSM Entering Indication Write Command AT+QCFG='psm/urc'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'psm/urc', OK If the optional parameter is specified, set whether to enable PSM entering indication. OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. Enable/disable the output of URC +QPSMTIMER: , . If enabled, the URC will be reported when the RRC connection release is received. 0 Disable 1 Enable Integer type. Error code. See Chapter 3 for more information. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 19 / 49 LPWA Module Series NOTE When AT+QCFG='psm/urc',1 and AT+QCFG='psm/enter',1 are executed at the same time, it is possible that the URC +QPSMTIMER cannot be outputted because the module enters PSM right away. 2.1.1.9. AT+QCFG='lapiconf' Set LAPI Value (Low Access Priority Indicator) The command queries the current settings or configures the Low Access Priority Indicator. AT+QCFG='lapiconf' Set LAPI Value (Low Access Priority Indicator) Write Command AT+QCFG='lapiconf'[,][,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'lapiconf',[,] OK If the optional parameter is specified, configure the URC output port in USB Interface mode: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The configuration is saved automatically. Parameter Integer type. Whether to enable low access priority indication feature 0 Disable. Forced to disable 1 Enable. Forced to enable 2 Auto. Determined by EFS file Integer type. 0 Disable 1 Enable Integer type. Error code. See Chapter 3 for more information. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 20 / 49 LPWA Module Series 2.1.2. Platform-Related AT Commands Among the following AT commands, AT+QCFG='urc/ri/ring', AT+QCFG='urc/ri/smsincoming' and AT+QCFG='urc/ri/other' commands control the behavior of the MAIN_RI pin when a URC is reported. The MAIN_RI pin is active low. 2.1.2.1. AT+QCFG='urc/ri/ring' Configure MAIN_RI Behavior in Case of RING URC The command queries and configures the behavior of MAIN_RI pin when RING URC is reported to indicate an incoming call. The sum of and and determines the interval of RING indications when a call is coming. AT+QCFG='urc/ri/ring' Configure MAIN_RI Behavior in Case of RING URC Write Command AT+QCFG='urc/ri/ring'[,[,[,[,[,[,]]]]]] Response If optional parameters are omitted, query the current settings: +QCFG: 'urc/ri/ring',,,,,, OK If any of the optional parameters is specified, configure the behavior of MAIN_RI pin when RING URC is reported. OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter String type. MAIN_RI behavior when RING URCs are reported. 'off' No change. MAIN_RI pin stays inactive (high). 'pulse' Pulse. Pulse width is determined by . BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 21 / 49 LPWA Module Series 'always' Change to active. MAIN_RI behavior can be restored to inactive with AT+QRIR (see document [1] for more information). 'auto' When RING URC is reported to indicate an incoming call, MAIN_RI pin changes to active and remains active. Answering or hanging up the incoming call changes MAIN_RI pin state to inactive. 'wave' When RING URC is reported to indicate an incoming call, MAIN_RI pin outputs a square wave. Both and are used to set the square wave. Answering or hanging up the incoming call changes the MAIN_RI pin to inactive. Integer type. Pulse width. Range: 1–2000. Default: 120. Unit: ms. Parameter is valid only when ='pulse'. Integer type. Active duration of the square wave. Range: 1–10000. Default: 1000. Unit: ms. Parameter is valid only when ='wave'. Integer type. Inactive duration of the square wave. Range: 1–10000. Default: 5000. Unit: ms. Parameter is valid only when ='wave'. String type. Set whether the MAIN_RI pin behavior could be disturbed. Parameter is valid only when ='auto' or 'wave'. For example, when ='wave', if the square wave will not be interrupted by other URCs (including SMS-related URCs), then should be set to 'on'. 'off' MAIN_RI pin behavior can be changed by other URCs when an incoming call is ringing. 'on' MAIN_RI behavior cannot be changed by other URCs when an incoming call is ringing. Integer type. Pulse count. Parameter is valid only when ='pulse'. Range: 1–5. Default: 1. Interval between two pulses is equal to . Integer type. Error code. See Chapter 3 for more information. 2.1.2.2. AT+QCFG='urc/ri/smsincoming' Configure MAIN_RI Behavior in Case of Incoming SMS URCs The command queries and configures the behavior of the MAIN_RI pin when there are incoming SMS URCs. Incoming SMS URCs include +CMTI, +CMT, +CDS, and +CBM (see document [1] for details). AT+QCFG='urc/ri/smsincoming' Configure MAIN_RI Behavior in Case of Incoming SMS URCs Write Command Response AT+QCFG='urc/ri/smsincoming'[,[,[,]]] +QCFG: 'urc/ri/smsincoming',,, OK If any of the optional parameters is specified, configure the MAIN_RI behavior when there are incoming SMS URCs: OK If there is an error related to ME functionality: +CME ERROR: If there is any other error: ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter String type. MAIN_RI behavior when there are incoming SMS URCs. 'off' No change. MAIN_RI pin stays inactive (high). 'pulse' Pulse. Pulse width is determined by . 'always' Change to active. MAIN_RI behavior can be restored to inactive with AT+QRIR (see document [1] for more information). Integer type. Pulse width. Range: 1–2000. Default: 120. Unit: ms. Parameter is valid only when ='pulse'. Integer type. Pulse count. Parameter is valid only when ='pulse'. Range: 1–5. Default: 1. Interval between two pulses is equal to . Integer type. Error code. See Chapter 3 for more information. 2.1.2.3. AT+QCFG='urc/ri/other' Configure MAIN_RI Behavior in Case of Other URCs The command queries and configures the behavior of the MAIN_RI pin when there are other URCs. AT+QCFG='urc/ri/other' Configure MAIN_RI Behavior in Case of Other URCs Write Command AT+QCFG='urc/ri/other'[,[,[,]]] Response If optional parameters are omitted, query the current settings: +QCFG: 'urc/ri/other',,, BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 23 / 49 LPWA Module Series Maximum Response Time Characteristics OK If any of the optional parameters is specified, configure the MAIN_RI behavior when there are other URCs. OK If there is an error related to ME functionality: +CME ERROR: If there is any other error: ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter String type. MAIN_RI behavior when there are other URCs. 'off' No change. MAIN_RI pin stays inactive (high). 'pulse' Pulse. Pulse width determined by . Integer type. Pulse width. Range: 1–2000. Default: 120. Unit: ms. Parameter is valid only when = 'pulse'. Integer type. Pulse count. Parameter is valid only when ='pulse'. Range: 1–5. Default: 1. Interval between two pulses is equal to . Integer type. Error code. See Chapter 3 for more information. 2.1.2.4. AT+QCFG='risignaltype' Configure MAIN_RI Signal Output Carrier The command queries and configures the output carrier of the MAIN_RI signal. AT+QCFG='risignaltype' Configure Main_RI Signal Output Carrier Write Command AT+QCFG='risignaltype'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'risignaltype', OK If the optional parameter is specified, configure the output carrier of the MAIN_RI signal. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 24 / 49 LPWA Module Series Maximum Response Time Characteristics OK If there is an error related to the ME functionality: +CME ERROR: If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter String type. MAIN_RI signal output carrier. 'respective' Causes MAIN_RI behavior on the port where a URC is presented. For example, if a URC is presented on the UART port, it is a physical ring indication signal. AT+QURCCFG='urcport' can get the port on which a URC is presented (see document [1] for more information). 'physical' No matter on which port the URC is presented, it only causes the behavior of physical ring indication signal. Integer type. Error code. See Chapter 3 for more information. 2.1.2.5. AT+QCFG='urc/delay' Configure URC Output Time The command queries and configures URC output time. AT+QCFG='urc/delay' Configure URC Output Time Write Command AT+QCFG='urc/delay'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'urc/delay', OK If the optional parameter is specified, configure URC output time: OK If there is an error related to ME functionality: +CME ERROR: BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 25 / 49 LPWA Module Series Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. URC output time. 0 Output URC when ring indication pulse starts. 1 Output URC when ring indication pulse ends (effective only when ='pulse'. See AT+QCFG='urc/ri/ring', AT+QCFG='urc/ri/smsincoming' and AT+QCFG='urc/ri/other' for more information). Integer type. Error code. See Chapter 3 for more information. 2.1.2.6. AT+QCFG='gpio' Configure GPIO Status The command queries and configures the GPIO status. AT+QCFG='gpio' Configure GPIO Status Write Command Query the formats of the command AT+QCFG='gpio' Response +QCFG: 'gpio',,[,[,,]/[][,]] Write Command AT+QCFG='gpio',,[,[,,]/[][,]] OK Response If =2, then all optional parameters should be omitted. +QCFG: 'gpio', OK If =1, then should be omitted. OK If =3, then , and should be omitted. OK Maximum Response Time If there is an error related to ME functionality: +CME ERROR: 300 ms BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 26 / 49 LPWA Module Series Characteristics The command takes effect immediately. determines whether the configuration will be saved. When =1, the configurations are saved and remain valid after the module reboots. Parameter Integer type. Command mode. 1 Initialize GPIO status 2 Query GPIO status 3 Configure GPIO status Integer type. GPIO pin number. BG770A module supports the following pin numbers: Pin No. Pin Name 1 GPIO1 8 GPIO2 9 GPIO3 33 GPIO4 40 GPIO5 57 GPIO6 63 GPIO7 BG950A-GL, BG951A-GL and BG955A-GL modules support the following pin numbers: Pin No. Pin Name 25 GPIO1 26 GPIO2 64 GPIO3 65 GPIO4 66 GPIO5 85 GPIO6 86 GPIO7 87 GPIO8 88 GPIO9 Integer type. GPIO pin direction. 0 Input 1 Output Integer type. GPIO pin pull type. 0 No pull 1 Pull the GPIO down 2 Keep the GPIO as it is 3 Pull the GPIO up Integer type. GPIO pin drive strength. 0 2 mA 1 4 mA 3 8 mA BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 27 / 49 LPWA Module Series 5 12 mA Integer type. Value read from or written to a GPIO. 0 Low level 1 High level Integer type. Determines whether to save the configurations. 0 Do not save 1 Save Integer type. Error code. See Chapter 3 for more information. NOTE 1. Command AT+QCFG='gpio' cannot be used on BG772A-GL and BG952A-GL modules. 2. is valid only when is 1 or 3. 3. For the value of , see corresponding hardware design for details. 2.1.2.7. AT+QCFG='airplanecontrol' Enable/Disable Airplane Mode Control via W_DISABLE# The command enables/disables airplane mode control via the W_DISABLE# pin and queries the current settings. If the function is enabled, the module enters the airplane mode when the pin is pulled down, or the normal mode when the pin is pulled up. In addition, the command outputs a related URC before the module enters or exits airplane mode. AT+QCFG='airplanecontrol' W_DISABLE# Enable/Disable Airplane Mode Control via Write Command Response AT+QCFG='airplanecontrol'[,] settings: +QCFG: 'airplanecontrol',, OK Maximum Response Time Characteristics If the optional parameter is specified, configure whether to enable airplane mode control via W_DISABLE# pin: OK Or ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 28 / 49 LPWA Module Series Parameter Integer type. Enable/disable airplane mode control via W_DISABLE# pin. 0 Disable 1 Enable Integer type. Current status. 0 In normal mode 1 ln airplane mode NOTE The status of the W_DISABLE# pin may affect the validity of AT+CFUN (see document [1] for more information). When the airplane mode control via W_DISABLE# is enabled and the pin is pulled down, the module enters the airplane mode regardless of the status of AT+CFUN. In addition, the module functionality level cannot be switched with AT+CFUN. Example AT+QCFG='airplanecontrol',1 OK //Pull down W_DISABLE# pin +QIND: 'airplanestatus',1 //Enable airplane mode control via W_DISABLE#. //URC indicating that the module enters airplane mode. AT+QCFG='airplanecontrol' //Query whether airplane mode control via W_DISABLE# is enabled and the current status of the module. +QCFG: 'airplanecontrol',1,1 //Airplane mode control via W_DISABLE# is enabled and the module is currently in airplane mode. OK //Pull up W_DISABLE# pin +QIND: 'airplanestatus',0 //URC indicating that the module exits airplane mode. AT+QCFG='airplanecontrol' +QCFG: 'airplanecontrol',1,0 //Query whether airplane mode control via W_DISABLE# is enabled and the current status of the module. //Airplane mode control via W_DISABLE# is enabled and the module is currently in normal mode. OK BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 29 / 49 LPWA Module Series 2.1.2.8. AT+QCFG='emux/urcport' Configure URC Output Port in EMUX Mode The command queries and configures the URC output port in EMUX mode. AT+QCFG='emux/urcport' Configure URC Output Port in EMUX Mode Write Command AT+QCFG='emux/urcport'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'emux/urcport', OK If the optional parameter is specified, configure the URC output port in EMUX mode: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. URC output port in EMUX mode. 0 All ports 1 Virtual port 1 2 Virtual port 2 3 Virtual port 3 Integer type. Error code. See Chapter 3 for more information. 2.1.2.9. AT+QCFG='apready'* Configure AP_READY* Behavior The command queries and configures the behavior of the AP_READY pin. An external MCU can change AP_READY pin level as needed. When there is a URC to be reported, if the AP_READY pin level is invalid, the URC is buffered first, and the AP_READY pin level will be detected periodically within the configured detection period. The URC will BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 30 / 49 LPWA Module Series be output when the AP_READY pin level becomes valid. The pulse signal generated on the MAIN_RI pin can still be output according to the configured mode, and will not be buffered. AT+QCFG='apready'* Configure AP_READY Behavior Write Command AT+QCFG='apready'[,[,[,]]] Response If the optional parameters are omitted, query the current settings: +QCFG: 'apready',,, OK If any of the optional parameters is specified, configure the AP_READY behavior: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter Integer type. Enable/disable the AP_READY pin for AP sleep state detection. 0 Disable 1 Enable Integer type. Valid level of AP_READY pin. Parameter is valid only when the AP_READY detection function is enabled. 0 Low level 1 High level Integer type. Detection interval. Range: 100–3000. Default: 500. Unit: ms. Parameter is valid only when the AP_READY detection function is enabled. Integer type. Error code. See Chapter 3 for more information. NOTE 1. Up to 15 URCs can be buffered. When the number of URCs exceeds 15, the oldest one in the buffer will be cleared to store a new URC. 2. The RING URC is buffered only once for each call process. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 31 / 49 LPWA Module Series 2.1.2.10. AT+QCFG='apn/display' Enable/Disable Showing APN The command enables/disables showing of allocated point name (APN) and queries the current settings. When =1, the APN is shown in the response of AT+CGDCONT? (see document [1] for more information). AT+QCFG='apn/display' Enable/Disable Showing APN Write Command AT+QCFG='apn/display'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'apn/display', OK If the optional parameter is specified, set whether to enable showing APN. OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is not saved. Parameter Integer type. Enable/disable showing APN. 0 Disable 1 Enable Integer type. Error code. Refer to Chapter 3 for more information. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 32 / 49 LPWA Module Series 2.1.2.11. AT+QCFG='lwm2m' Enable/Disable LwM2M The command enables/disables LwM2M and queries the current settings. AT+QCFG='lwm2m' Enable/Disable LwM2M Write Command AT+QCFG='lwm2m'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'lwm2m', OK If the optional parameter is specified, set whether to enable LwM2M. OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect after the module reboots. The configuration is saved automatically. Parameter Integer type. 0 Disable 1 Enable Integer type. Error code. See Chapter 3 for more information. 2.1.2.12. AT+QCFG='nwoper' Configure Network Operator Mode of the Modem The command queries and configures network operator mode of the modem. This mode setting supports network operator specific requirements defined on top of 3GPP requirements. ='DEFAULT' means default 3GPP compliant behavior of the modem. The list of operators is not limited. Use Test Command (AT+QCFG=?) to retrieve the list of currently supported operators. Any attempt to set unknown operator name will return ERROR. In the 'AUTO' mode, when a new operator is identified, the configurations are set by the modem similar to BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 33 / 49 LPWA Module Series AT+QCFG='nwoper', operation. This means all operator configuration files will be restored to the new selected operator default values. AT+QCFG='nwoper' Configure Network Operator Mode of the Modem Write Command AT+QCFG='nwoper'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'nwoper',[,mode] OK If the optional parameter is specified, set network operator mode: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter String type. Network operator mode of the modem. 'DEFAULT' Default 3GPP compliant mode 'VZW' Verizon 'ATT' AT&T … String type. Optional parameter, indicates that 'AUTO' mode is currently configured. 'AUTO' Network operator mode is selected in accordance with IMSI value of the currently used (U)SIM Integer type. Error code. See Chapter 3 for more information. 2.1.2.13. AT+QCFG='ps_dev_mob_type' Configure Device Mobility Type Flag The command queries and configures device mobility type flag. It gets configuration from JSON configuration file. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 34 / 49 LPWA Module Series AT+QCFG='ps_dev_mob_type' Configure Device Mobility Type Flag Write Command AT+QCFG='ps_dev_mob_type'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'ps_dev_mob_type', OK If the optional parameter is specified, set device mobility type flag: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. Device mobility type flag. 1 mobile 2 static Integer type. Error code. See Chapter 3 for more information. Example AT+QCFG='ps_dev_mob_type',1 OK //Set the flag to mobile. 2.1.2.14. AT+QCFG='netupd' Enable/Disable Network Override for Specified LTE Parameters The command queries the current settings and enables/disables network override for specified LTE parameters (i.e., by EMM messages). BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 35 / 49 LPWA Module Series AT+QCFG='netupd' Enable/Disable Network Override for Specified LTE Parame ters Write Command Response AT+QCFG='netupd',[, If the optional parameter is omitted, query the current ] settings: +QCFG: 'netupd',, OK If the optional parameter is specified, enable/disable network override for specified LTE parameters: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configurations are not saved. Parameter String type. 'NWNAME' Sets the behavior of network name supplied by AT+COPS?. Integer type. For 'NWNAME': 0 AT+COPS? show the most updated full network name as required by the 27.007 standard. 1 Prohibit override of network name by EMM message (i.e. shown in AT+COPS?, etc.) even if the EMM information message indicates another full network name. Integer type. Error code. See Chapter 3 for more information. Example AT+QCFG='netupd','nwname',1 OK //Set 'nwname' to mode 1. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 36 / 49 LPWA Module Series 2.1.2.15. AT+QCFG='edrxusimact' Activate/Deactivate (U)SIM in eDRX Mode This command activates/deactivates (U)SIM in eDRX mode regardless of (U)SIM EF_AD settings. AT+QCFG='edrxusimact' Activate/Deactivate (U)SIM in eDRX Mode Write Command AT+QCFG='edrxusimact'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'edrxusimact', OK If the optional parameter is specified, activate/deactivate (U)SIM in eDRX mode regardless of (U)SIM EF_AD settings: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is not saved. Parameter Integer type. (U)SIM activation policy. 0 Apply default (U)SIM activation policy as per (U)SIM EF_AD settings in eDRX mode 1 Activate (U)SIM in eDRX mode regardless of (U)SIM EF_AD settings 2 Deactivate (U)SIM in eDRX mode regardless of (U)SIM EF_AD settings Integer type. Error code. See Chapter 3 for more information. Example AT+QCFG='edrxusimact' +QCFG: 'edrxusimact',0 OK //Query the current (U)SIM activation policy. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 37 / 49 LPWA Module Series 2.1.2.16. AT+QCFG='setcfg' Set Configuration Field to the NV memory This command sets configuration field to the NV memory. AT+QCFG='setcfg' Set Configuration Field to the NV memory Write Command AT+QCFG='setcfg',[,] Response If the optional parameter is omitted, query the current settings: +QCFG: , OK If the optional parameter is specified, activate/deactivate USB interface: OK Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter String type. 'sim_dual_config' Enable the dual SIM feature (between plastic and embedded SIM only) 'sim_init_select_policy' SIM policy options 'data_inactivity_dis' Integer type. For 'sim_dual_config': Enable/Disable inactivity timer 0 SW default 1 Single SIM 2 Dual SIM For 'sim_init_select_policy': 0 N/A, Single SIM 1 SIM1 only 2 Reserved 3 Reserved 4 Reserved 5 iUICC only option (no fallback available) For 'data_inactivity_dis': BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 38 / 49 0 Inactivity timer is enabled 1 inactivity timer is disabled LPWA Module Series Example AT+QCFG='setcfg',' sim_init_select_policy ',5 OK // set to iSIM only 2.1.2.17. AT+QCFG='setsyscfg' Set Value(s) to System Configuration Files This command sets value(s) to system configuration files. AT+QCFG='setsyscfg' Set Value(s) to System Configuration Files Write Command AT+QCFG='setsyscfg',,,,,, Response OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter String type. 'ant_cfg' Antenna tuning configuration file. Integer type. Antenna characterization stage. Range: 1–56. Integer type. 0 Enable corresponding stage 1 Disable corresponding stage Integer type. Lower frequency of corresponding bandwidth, given in MHz multiplied by 10. Range: 4000–38000. Integer type. Upper frequency of corresponding bandwidth, given in MHz multiplied by 10. Range: 4000–38000. Integer type. Truth table combination of two different states of GRFC1 and GRFC2 pins respectively. Range: 0–3. Integer type. Error code. See Chapter 3 for more information. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 39 / 49 LPWA Module Series Example AT+QCFG='setsyscfg','ant_cfg',1,1,8031,9600,2 OK // 803.1-960MHz NOTE Overlapping between frequency ranges is forbidden. 2.1.2.18. AT+QCFG='uartmapping' Show Port and Function Mapping The command is used to present port (physical and virtual) mapping, i.e., to present the function performed by each port. AT+QCFG='uartmapping' Show Port and Function Mapping Write Command AT+QCFG='uartmapping' Response :, … : OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 500 ms The command takes effect immediately. Parameter String type. DBG MAIN AUX MCU EMUX0 EMUX1 EMUX2 Physical port, DBG UART Physical port, MAIN UART Physical port, AUX UART Internal port, Reserved (BG772A-GL, BG952A-GL) Virtual port 0, EMUX function Virtual port 1, EMUX function Virtual port 2, EMUX function BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 40 / 49 LPWA Module Series EMUX3 Virtual port 3, EMUX function ACM0 Virtual port 0, USB interface ACM1 Virtual port 1, USB interface ACM2 Virtual port 2, USB interface ACM3 Virtual port 3, USB interface String type. AT_PPP AT client 0 / PPP data transfer AT_1 AT client 1 AT_2 AT client 2 GNSS_NMEA GNSS NMEA output SFP_LOGGER FW log messages, Debug mode FW_LOG LTE log messages, Debug mode MAC_VIA_MAP LTE log messages, Debug mode ALTCOM Internal function, Reserved (BG772A-GL, BG952A-GL) None No function is allocated to Integer type. Error code. See Chapter 3 for more information. 2.1.2.19. AT+QCFG='uartmapping/profile' Read/Write Port Profile Mapping Configuration This command reads or writes the value of parameters in port profile mapping configurations. The current mapping configuration of the selected port profile can be queried with AT+QCFG='uartmapping'. AT+QCFG='uartmapping/profile' Read/Write Port Profile Mapping Configuration Write Command AT+QCFG='uartmapping/profile'[,] Response If the optional parameter is omitted, query the current configuration: +QCFG: ' uartmapping/profile', OK If the optional parameter is specified, set the port profile mapping configuration OK If there is an error related to ME functionality: ERROR If there is any other error: Maximum Response Time Characteristics 300 ms The command takes effect immediately. The configurations are saved automatically. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 41 / 49 LPWA Module Series Parameter String type. 0 Default port profile Delta change in relation to Default port profile Mode USB+DEBUG DBG None MAIN AT1 AUX None ACM0 AT/PPP ACM3 GNSS 1 Port profile #1 Mode DBG MAIN AUX ACM0 ACM3 USB+DEBUG GNSS_NMEA AT/PPP AT1 None None 2.1.2.20. AT+QCFG='usb' Activate/Deactivate USB Interface This command activates/deactivates USB Interface. To use USB interface, the module should be connected via USB cable to the host computer. Following the boot process, the module exposes 3 other ports. AT+QCFG='usb' Activate/Deactivate USB Interface Write Command AT+QCFG='usb'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'usb', OK If the optional parameter is specified, activate/deactivate USB interface: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 1500 ms The command takes effect after the module reboots. BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 42 / 49 LPWA Module Series The configuration is saved automatically. Parameter Integer type. Activates/deactivates USB Interface. 0 Deactivate 1 Activate Integer type. Error code. See Chapter 3 for more information. 2.1.2.21. AT+QCFG='usb/urcport' Configure URC Output Port in USB Interface Mode The command queries and configures the URC output port in USB interface mode. AT+QCFG='usb/urcport' Configure URC Output Port in USB Interface Mode Write Command AT+QCFG='usb/urcport'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: 'usb/urcport', OK If the optional parameter is specified, configure the URC output port in USB Interface mode: OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. URC output port in USB Interface mode. 0 All ports 1 Virtual port 1 2 Virtual port 2 3 Virtual port 3 BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 43 / 49 LPWA Module Series Integer type. Error code. See Chapter 3 for more information. 2.1.2.22. AT+QCFG='lte/bandprior' Configure Band Scan Priority under LTE The command queries and configures the band scan priority. AT+QCFG='lte/bandprior' Configure Band Scan Priority under LTE Write Command AT+QCFG='lte/bandprior'[,] Response If the optional parameter is omitted, query the current settings: +QCFG: ' lte/bandprior', OK If the optional parameter is specified, configure the URC output port in USB Interface mode: OK Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The configuration is saved automatically. Parameter < band_value > LTE Cat.M1 band value 01 Band 1 02 Band 2 03 Band 3 04 Band 4 05 Band 5 07 Band 7 08 Band 8 Example AT+QCFG='lte/bandprior' //Configure Band Scan Priority under LTE +QCFG='lte/bandprior',1,5,7……….//Configured Band1, Band5 and Band7. OK //Search priority: 1 -> 5 -> 7 BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 44 / 49 LPWA Module Series 2.1.2.23. AT+QCFG='stored/cell' Delete Stored Cell Acquisition DB The command deletes stored cell acquisition DB AT+QCFG='stored/cell' Delete Stored Cell Acquisition DB Write Command AT+QCFG='stored/cell'[,< value>] Response If the optional parameter is omitted, query the current settings: +QCFG: 'stored/cell', OK Maximum Response Time Characteristics If there is any other error: ERROR 300 ms The configuration is saved automatically. Parameter Integer value. 1 Delete acquisition DB BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 45 / 49 LPWA Module Series 3 Summary of +CME ERROR Codes Final result code +CME ERROR: indicates an error related to mobile equipment or network. The operation is similar to the ERROR result code. values are mostly used by common message commands. The following table lists most of general and GPRS related ERROR codes. For some GSM protocol failure causes described in GSM specifications, the corresponding ERROR codes are not included. Table 2: Summary of +CME ERROR Codes Numeric Value 0 1 2 3 4 5 6 7 10 11 12 13 14 15 Verbose Value phone failure no connection to phone phone-adaptor link reserved operation not allowed operation not supported PH-SIM PIN required PH-FSIM PIN required PH-FSIM PUK required SIM not inserted SIM PIN required SIM PUK required SIM failure SIM busy SIM wrong BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 46 / 49 LPWA Module Series 16 incorrect password 17 SIM PIN2 required 18 SIM PUK2 required 20 memory full 21 invalid index 22 not found 23 memory failure 24 text string too long 25 invalid characters in text string 26 dial string too long 27 invalid characters in dial string 30 no network service 31 network timeout 32 network not allowed - emergency calls only 40 network personalization PIN required 41 network personalization PUK required 42 network subset personalization PIN required 43 network subset personalization PUK required 44 service provider personalization PIN required 45 service provider personalization PUK required 46 corporate personalization PIN required 47 corporate personalization PUK required BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 47 / 49 LPWA Module Series 4 Appendix References Table 3: Related Document Document Name [1] Quectel_BG77xA-GL&BG95xA-GL_AT_Commands_Manual Table 4: Terms and Abbreviations Abbreviation AP APN CDS CE eDRX EMM EMUX eMTC GPIO GSM IMSI JSON LED LTE LwM2M Description Application Processor Access Point Name Common Data Service Coverage Enhancement Extended Discontinuous Reception EPS Mobility Management Multiplexing Enhanced Machine-Type Communication General-Purpose Input/Output Global System for Mobile Communications International Mobile Subscriber Identity JavaScript Object Notation Light Emitting Diode Long-Term Evolution Lightweight M2M BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 48 / 49 ME NB-IoT PIN PS PSM PUK RAT RRC SMS TA TAU URC (U)SIM Mobile Equipment Narrowband Internet of Things Personal Identification Number Packet Switched Power Saving Mode PIN Unlock Key Radio Access Technology Radio Resource Control Short Message Service Terminal Adapter Tracking Area Update Unsolicited Result Code (Universal) Subscriber Identity Module LPWA Module Series BG77xA-GL&BG95xA-GL_QCFG_AT_Commands_Manual 49 / 49

EC2x&EG2x&EG9x&EM05 Series QCFG AT Commands Manual LTE Standard Module Series Version: 1.0 Date: 2022-05-30 Status: Released LTE Standard Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 1 / 136 LTE Standard Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 2 / 136 LTE Standard Module Series About the Document Revision History Version 1.0 Date 2021-04-15 2022-05-30 Author Wythe WANG/ Alessa TANG/ Colin CUI Wythe WANG/ Alessa TANG/ Colin CUI Description Creation of the document First official release EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 3 / 136 LTE Standard Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 8 1 Introduction ......................................................................................................................................... 9 1.1. Applicable Modules .................................................................................................................... 9 1.2. Definitions ................................................................................................................................ 10 1.3. AT Command Syntax ............................................................................................................... 10 1.4. AT Command Responses........................................................................................................ 11 1.5. Declaration of AT Command Examples .................................................................................. 11 2 Test Command .................................................................................................................................. 12 2.1. AT+QCFG Extended Configuration Settings ........................................................................ 12 3 General Commands .......................................................................................................................... 17 3.1. AT+QCFG='apready' Set AP_Ready Behavior ................................................................... 17 3.2. AT+QCFG='sleepind/level' Configure the Output Level of the SLEEP_IND Pin................. 18 3.3. AT+QCFG='wakeupin/level' Configure Whether to Wake up the Module Through WAKEUP_IN Pin................................................................................................................................. 19 3.4. AT+QCFG='urc/ri/ring' Set RI Behavior When RING URC is Presented ............................ 20 3.5. AT+QCFG='urc/ri/smsincoming' Set RI Behavior When Incoming SMS URCs are Presented 22 3.6. AT+QCFG='urc/ri/other' Set RI Behavior When Other URCs are Presented...................... 23 3.7. AT+QCFG='risignaltype' RI Signal Output Carrier .............................................................. 24 3.8. AT+QCFG='urc/delay' Delay URC Indication Output .......................................................... 25 3.9. AT+QCFG='urc/cache' Enable/Disable URC Cache ........................................................... 26 3.10. AT+QCFG='urc/poweron' Set Output URC of Power-on..................................................... 27 3.11. AT+QCFG='divctl' Configure Primary and Rx-diversity under LTE/WCDMA...................... 29 3.12. AT+QCFG='bootup' Enable/Disable Services in Linux........................................................ 30 3.13. AT+QCFG='ppp/sleep_ri' Enable/Disable Waking up the Module through the RI Pin Indication after PPP Establishment .................................................................................................... 31 3.14. AT+QCFG='thermal/txpwrlmt' Configure Temperature Protection Strategy ....................... 32 3.15. AT+QCFG='thermal/modem' Configure Thermal Threshold ............................................... 33 3.16. AT+QCFG='urc/ri/pin' Configure UART Pins Corresponding to RI ..................................... 34 3.17. AT+QCFG='icf' Configure Main UART................................................................................. 34 3.18. AT+QCFG='thermal/limit_rates' Enable/Disable the Rate Limit .......................................... 36 3.19. AT+QCFG='urcdelay' Configure URC Delay ....................................................................... 36 3.20. AT+QCFG='sarcfg' Set SAR Transmission Power for LTE/WCDMA/GSM ........................ 38 3.21. AT+QCFG='fast/poweroff' Enable/Disable Fast Power-Off ................................................. 41 3.22. AT+QCFG='sleep/datactrl' Configure Data Cache Mode .................................................... 42 3.23. AT+QCFG='rf/tuner_cfg' Set the Mapping between RF Tuner and RF Bands ................... 43 3.24. AT+QCFG='mms_rec_control' Save/Discard the MMS....................................................... 45 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 4 / 136 LTE Standard Module Series 4 Audio Commands ............................................................................................................................. 46 4.1. AT+QCFG='tone/incoming' Enable Ring Tone .................................................................... 46 4.2. AT+QCFG='pcmclk' Configure PCM_CLK .......................................................................... 47 4.3. AT+QCFG='codec/powsave' Set PSM for ALC5616 Codec ............................................... 48 5 Network Commands ......................................................................................................................... 50 5.1. AT+QCFG='gprsattach' Configure GPRS Attach Mode ...................................................... 50 5.2. AT+QCFG='nwscanmode' Configure Network Search Mode ............................................. 51 5.3. AT+QCFG='servicedomain' Configure Service Domain ...................................................... 52 5.4. AT+QCFG='band' Configure Band ...................................................................................... 53 5.5. AT+QCFG='rrc' Configure RRC Release Version ............................................................... 54 5.6. AT+QCFG='msc' Configure MSC Release Version ............................................................ 55 5.7. AT+QCFG='sgsn' Configure UE SGSN Release Version ................................................... 56 5.8. AT+QCFG='hsdpacat' Configure HSDPA Category ............................................................ 57 5.9. AT+QCFG='hsupacat' Configure HSUPA Category ............................................................ 58 5.10. AT+QCFG='PDP/duplicatechk' Establish Multi-PDN with Same APN ................................ 59 5.11. AT+QCFG='disable_backoff_lte' Disable Backoff LTE........................................................ 60 5.12. AT+QCFG='airplanecontrol' Enter/Exit Airplane Mode via W_DISABLE# Pin.................... 60 5.13. AT+QCFG='epcflag' Set EPC Capability Value in Attach Request ..................................... 62 5.14. AT+QCFG='lte/bandprior' Set Searching Priority of LTE Band ........................................... 63 5.15. AT+QCFG='plmn/addinfbdn' Add Current PLMN to FPLMN............................................... 64 5.16. AT+QCFG='cops_no_mode_change' Enable/Disable the Switch under AT+COPS=1 ...... 65 5.17. AT+QCFG='hplmn/search_timer' Configure HPLMN Search Interval................................. 66 5.18. AT+QCFG='tdd/config' Get the LTE-TDD Configuration ..................................................... 67 5.19. AT+QCFG='urc_cause_support' Report Rejection Cause .................................................. 67 5.20. AT+QCFG='dhcppktfltr' Filter DHCP Package .................................................................... 68 5.21. AT+QCFG='oostimer' Set Mode for OOS Network Searching ............................................ 69 5.22. AT+QCFG='apn/blocked' Configure APN Block Mode........................................................ 70 5.23. AT+QCFG='redir/3gtolte' Configure Redirection Mode ....................................................... 71 5.24. AT+QCFG='rssi' Configure Delta Threshold of RSSI Change ............................................ 72 5.25. AT+QCFG='roamservice' Configure Roaming Service ....................................................... 73 5.26. AT+QCFG='fast_dormancy' Dynamically Control the RRC Connection ............................. 74 5.27. AT+QCFG='airplane' Configure Airplane Mode................................................................... 74 5.28. AT+QCFG='rrc/control' Configure the Feature of RRC Connection Control ....................... 75 5.29. AT+QCFG='nwscanmodeex' Configure Network Searching Mode..................................... 77 5.30. AT+QCFG='assign_plmn_in_limit_search' Specify Operator for Camping on a Cell with Limited Service ................................................................................................................................... 78 5.31. AT+QCFG='iprulectl' Configure the Gateway Address Generation Rule ............................ 79 5.32. AT+QCFG='disrplmn' Configure RPLMN and RPLMNACT for Network Searching ........... 80 5.33. AT+QCFG='lte/preferfre' Set Preferred Frequency ............................................................. 81 5.34. AT+QCFG='cops_control' Enable/Disable Configurations of AT+COPS ............................ 82 5.35. AT+QCFG='map_rej_cause7_to_cause14' Enable/Disable Network Rejection Cause Mapping .............................................................................................................................................. 83 5.36. AT+QCFG='netmaskset' Enable/Disable Customized Netmask ......................................... 84 5.37. AT+QCFG='pingdiscard' Configure Whether to Discard Ping Packet................................. 85 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 5 / 136 LTE Standard Module Series 5.38. AT+QCFG='urc/ri/restart' Configure RI Pulse Timer ........................................................... 86 5.39. AT+QCFG='ping/ri' Configure Ping Detection Function ...................................................... 87 5.40. AT+QCFG='defaultdns' Configure Default DNS for PDP Context....................................... 88 5.41. AT+QCFG='lpm/dataind' Configure Wake-up Mechanism .................................................. 90 5.42. AT+QCFG='roamserviceex' Control Relevant Functions in Roaming State ....................... 91 6 PS Commands................................................................................................................................... 93 6.1. AT+QCFG='ntp' Specify the Maximum Re-transmission Counts and the Interval for NTP 93 6.2. AT+QCFG='TCP/SendMode' Configure TCP Sending Mode ............................................. 94 6.3. AT+QCFG='tcp/windowsize' Configure TCP Window Available Size ................................. 95 7 CS Commands................................................................................................................................... 96 7.1. AT+QCFG='amrcodec' Configure AMR Codec ................................................................... 96 7.2. AT+QCFG='frhrcodec' Configure GSM EFR/HR/FR Codec................................................ 97 7.3. AT+QCFG='bip/auth' Configure PDP Authentication Type in BIP Process ........................ 98 7.4. AT+QCFG='SMS/ListMsgMap' List Message Map.............................................................. 99 7.5. AT+QCFG='ims/ut' Enable/Disable IMS/UT Function ....................................................... 100 7.6. AT+QCFG='ims' Configure IMS Function .......................................................................... 102 7.7. AT+QCFG='ltesms/format' Set SMS Format in LTE Mode ............................................... 103 7.8. AT+QCFG='volte_disable' Enable/Disable VoLTE ............................................................ 104 7.9. AT+QCFG='sms/omadm' Set OMADM Message Parsing Mode ...................................... 105 7.10. AT+QCFG='imsreg/iptype' Configure the IP Type for IMS Registration ........................... 106 7.11. AT+QCFG='sim/recovery' Configure (U)SIM Card Hot-plug ............................................. 107 7.12. AT+QCFG='siminvalirecovery' Enable/Disable Re-attach Request .................................. 108 7.13. AT+QCFG='roaming/voicecall' Enable/Disable Voice Call in Roaming Mode .................. 109 7.14. AT+QCFG='voice_busytone' Control Busy Tone Playback .............................................. 110 7.15. T+QCFG=''call_control'' Enable/Disable Module Voice Call Feature ................................. 111 8 PPP Command ................................................................................................................................ 113 8.1. AT+QCFG='ppp/termframe' Enable/Disable the PPP TERM Frame Sending ............... 113 9 USB Commands .............................................................................................................................. 115 9.1. AT+QCFG='usbnet' Configure the Network Card Type Interface ..................................... 115 9.2. AT+QCFG='usbcfg' Configure VID, PID and Porting Settings .......................................... 116 9.3. AT+QCFG='usbee' Control the USB Device Loading ....................................................... 117 9.4. AT+QCFG='usbmode' Get USB Mode .............................................................................. 118 9.5. AT+QCFG='spi/set' Configure SPI or UART Driver........................................................... 119 9.6. AT+QCFG='usbenum/seoctl' Enable Optimization of USB Enumeration Failure ............. 120 10 CDMA Commands........................................................................................................................... 122 10.1. AT+QCFG='cdma/pppauth' Enable/Disable PPP Authentication Optimization under CDMA122 10.2. AT+QCFG='ehrpd' Configure CDMA Mode....................................................................... 123 10.3. AT+QCFG='cdmasms/cmtformat' Set CMT Format of CDMA SMS PDU......................... 124 11 SMS Commands.............................................................................................................................. 126 11.1. AT+QCFG='urcport/sms' Set URC Output Port of Short Message...................................... 126 11.2. AT+QCFG=''sms_retry'' Configure SMS Retry Period and Interval.................................... 127 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 6 / 136 LTE Standard Module Series 11.3. AT+QCFG='sms_control' Enable/Disable Delivering or Submitting SMS ......................... 129 12 Appendix A References.................................................................................................................. 131 13 Appendix B Summary of ...................................................................................................... 134 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 7 / 136 LTE Standard Module Series Table Index Table 1: Applicable Modules ........................................................................................................................ 9 Table 2: Types of AT Commands .............................................................................................................. 10 Table 3: Related Document ..................................................................................................................... 131 Table 4: Terms and Abbreviations ........................................................................................................... 131 Table 5: Different Coding Schemes of +CME ERROR: ................................................................. 134 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 8 / 136 LTE Standard Module Series 1 Introduction This document introduces Quectel QCFG commands applicable for EC2x series, EG9x series, EG2x-G and EM05 series modules to query and configure UE settings. 1.1. Applicable Modules Table 1: Applicable Modules Module Series EC2x EG9x EG2x-G EM05 Module EC25 series EC21 series EC20-CE EG95 series EG91 series EG25-G EG21-G EM05 series NOTE The actual support of the specific AT+QCFG commands is subject to the result of executing AT+QCFG=? by using the corresponding firmware version. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 9 / 136 LTE Standard Module Series 1.2. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 1.3. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. AT+QCFG implemented by EC2x series, EG9x series, EG2x-G and EM05 series modules is in 'Extended' syntax, as illustrated below. ⚫ Extended Extended commands can be executed in several types, as shown in the following table: Table 2: Types of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 10 / 136 LTE Standard Module Series Multiple commands can be placed on a single line using a semi-colon (;) between commands. In such cases, only the first command should have AT prefix. Commands can be in upper or lower case. Spaces should be ignored when you enter AT commands, except in the following cases: ⚫ Within quoted strings, where spaces are preserved; ⚫ Within an unquoted string or numeric parameter; ⚫ Within an IP address; ⚫ Within the AT command name up to and including a =, ? or =?. On input, at least a carriage return is required. A newline character is ignored so it is permissible to use carriage return/line feed pairs on the input. If no command is entered after the AT token, OK will be returned. If an invalid command is entered, ERROR will be returned. Optional parameters, unless explicitly stated, need to be provided up to the last parameter being entered. 1.4. AT Command Responses When the AT command processor has finished processing a line, it will output OK, ERROR or +CME ERROR: to indicate that it is ready to accept a new command. Solicited information responses are sent before the final OK, ERROR or +CME ERROR: . Responses will be in the format of: +CMD1: OK 1.5. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 11 / 136 LTE Standard Module Series 2 Test Command 2.1. AT+QCFG Extended Configuration Settings AT+QCFG Extended Configuration Settings Test Command AT+QCFG=? Response … +QCFG: 'apready',(list of supported s),(list of supported s),(range of supported s) +QCFG: 'sleepind/level',(list of supported s) +QCFG: 'wakeupin/level',(list of supported s) +QCFG: 'urc/ri/ring',(list of supported s),(range of supported s),(range of supported s), (range of supported s),(list of supported s),(range of supported s) +QCFG: 'urc/ri/smsincoming',(list of supported s),(list of supported s),(range of supported s) +QCFG: 'urc/ri/other',(list of supported s),(range of supported s),(range of supported s) +QCFG: 'risignaltype',(list of supported s) +QCFG: 'urc/delay',(list of supported s) +QCFG: 'urc/cache',(list of supported s) +QCFG: 'urc/poweron',(list of supported s) +QCFG: 'divct',(list of supported s),(range of supported s) +QCFG: 'bootup',,(list of supported s) +QCFG: 'ppp/sleep_ri',(list of supported s),(ran ge of supported s) +QCFG: 'thermal/txpwrlmt'[,,,,,,] +QCFG: 'thermal/modem'[,,,] EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 12 / 136 LTE Standard Module Series +QCFG: 'urc/ri/pin',(list of supported s) +QCFG: 'icf',(range of supported s),(range of supported s),(range of supported s) +QCFG: 'thermal/limit_rates',[,] +QCFG: 'urcdelay',(list of supported s),(range of supported s) +QCFG: 'sarcfg',(list of supported s),max_powe r,row_grads,column_grads,[band] +QCFG: 'fast/poweroff',(list of supported s) +QCFG: 'sleep/datactrl',(range of supported s),(range of supported s),(list of supported s) +QCFG: 'rf/tuner_cfg',,,[,] +QCFG: 'mms_rec_control',(list of supported s) +QCFG: 'tone/incoming',(range of supported s) +QCFG: 'pcmclk',(list of supported s) +QCFG: 'codec/powsave',(list of supported s) +QCFG: 'gprsattach',(list of supported s) +QCFG: 'nwscanmode',(range of supported s),(list of supported s) +QCFG: 'servicedomain',(list of supported s),(list of supported s) +QCFG: 'band',(range of supported s),(range of supported s),(range of supported s),(list of supported s) +QCFG: 'rrc',(range of supported s) +QCFG: 'msc',(range of supported s) +QCFG: 'sgsn',(range of supported s) +QCFG: 'hsdpacat',(list of supported s) +QCFG: 'hsupacat',(list of supported ) +QCFG: 'pdp/duplicatechk',(list of supported s) +QCFG: 'disable_backoff_lte',(list of supported s) +QCFG: 'airplanecontrol',(range of supported s) +QCFG: 'epcflag',(list of supported s) +QCFG: 'lte/bandprior',(range of supported s),(range of supported s),(range of supported s) +QCFG: 'plmn/addinfbdn',(list of supported s) +QCFG: 'cops_no_mode_change',(list of supported s) EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 13 / 136 LTE Standard Module Series +QCFG: 'hplmn/search_timer',(range of supported s) +QCFG: 'tdd/config',(range of supported s),(range of supported s) +QCFG: 'urc_cause_support',(range of supported s) +QCFG: 'dhcppktfltr',(list of supported s) +QCFG: 'oostimer',,, +QCFG: 'apn/blocked',(list of supported s),(list of supported s) +QCFG: 'redir/3gtolte',(list of supported s),(list of supported s),list of supported s) +QCFG: 'rssi',(range of supported s) +QCFG: 'roamservice',(list of supported s),(list of supported s) +QCFG: 'fast_dormancy',(list of supported s),(range of supported s) +QCFG: 'airplane',(range of supported s) +QCFG: 'rrc/control',(list of supported s),(range of supported s),(range of supported s),(range of supported s),(list of supported s),(range of supported s) +QCFG: 'nwscanmodeex',(range of supported s) +QCFG: 'assign_plmn_in_limit_search',(list of supported s), +QCFG: 'iprulectl',(list of supported s) +QCFG: 'disrplmn',(list of supported s),(list of supported s) +QCFG: 'lte/preferfre',(list of supported s),(range of supported s),(list of supported s),,,, +QCFG: 'cops_control',(list of supported s) +QCFG: 'map_rej_cause7_to_cause14',(list of supported s) +QCFG: 'band/keep',(list of supported s) +QCFG: 'netmaskset',(list of supported s), +QCFG: 'pingdiscard',(list of supported s) +QCFG: 'urc/ri/restart',(list of supported s) +QCFG: 'ping/ri',(list of supported s),(list of supported s) +QCFG: 'defaultdns',(list of supported s),, +QCFG: 'lpm/dataind',(list of supported s), +QCFG: 'roamserviceex',(range of supported s) +QCFG: 'ntp',(range of supported s),(range of supported s) +QCFG: 'TCP/SendMode',(range of supported s) +QCFG: 'tcp/windowsize',(list of supported s),(range of supported s) +QCFG: 'amrcodec',(list of supported s) +QCFG: 'frhrcodec',(list of supported s) +QCFG: 'bip/auth',(range of supported s) +QCFG: 'sms/listmsgmap',(list of supported s) +QCFG: 'ims/ut',(list of supported s) +QCFG: 'ims',(range of supported s) +QCFG: 'ltesms/format',(list of supported s) +QCFG: 'mwictl',(list of supported s) +QCFG: 'sms/omadm',(list of supported s) +QCFG: 'volte_disable',(list of supported s) +QCFG: 'imsreg/iptype',(list of supported s) +QCFG: 'sim/recovery',(range of supported s),(list of supported s),(list of supported s) +QCFG: 'siminvalirecovery',(list of supported s),(list of supported s),(list of supported s) +QCFG: 'roaming/voicecall',(list of supported s) +QCFG: 'voice_busytone',(list of supported s) +QCFG: 'call_control',(list of supported s), (list of supported s) +QCFG: 'ppp/termframe',(list of supported s) +QCFG: 'usbnet',(range of supported s) +QCFG: 'usbcfg',,,,,, ,,, +QCFG: 'usbee', +QCFG: 'usbmode',(list of supported s) +QCFG: 'spi/set',(range of supported s) +QCFG: 'usbenum/seoctl',(list of supported s) +QCFG: 'cdma/pppauth',(list of supported s) +QCFG: 'ehrpd',(list of supported s) +QCFG: 'cdmasms/cmtformat'[,(list of supported s)] EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 15 / 136 Maximum Response Time Characteristics LTE Standard Module Series +QCFG: 'urcport/sms',(list of supported s) +QCFG: 'sms_retry',(range of supported s),(range of supported s) +QCFG: 'sms_control',(list of supported s),(list of supporteds) … OK 300 ms / NOTE The above only shows an example for the command response. The response of the command varies according to the module used. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 16 / 136 LTE Standard Module Series 3 General Commands 3.1. AT+QCFG='apready' Set AP_Ready Behavior The command queries and configures the behavior of AP_READY pin. An external MCU can change the AP_READY pin level as needed. When there is a URC to be reported, if the AP_READY pin level is invalid, the URC is buffered first, and the AP_READY pin level will be detected periodically with the configured detection period. The URC will be output when the AP_READY pin level becomes valid. The pulse signal generated on the MAIN_RI pin can still be output according to the configured mode, and the pulse signal will not be buffered. AT+QCFG='apready' Set AP_Ready Behavior Write Command AT+QCFG='apready'[,,,[< interval>]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'apready',,, OK Maximum Response Time Characteristics If the optional parameters are specified, set the AP_Ready behavior: OK Or ERROR 300 ms this command takes effect immediately. The configuration will not be saved Parameter Integer type. Enable/disable AP_Ready behavior. 0 Disable 1 Enable Integer type. Valid level of Indicator pin. This parameter only takes effect when the EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 17 / 136 LTE Standard Module Series AP_READY detection function is enabled, and determines the default level of AP_READY. 0 Low level 1 High level Integer type. Detection period. Unit: ms. Range:100–3000. Default value: 500. This parameter only takes effect when AP_READY detection function is enabled. When AP_READY level is invalid and a URC is reported, this parameter is used as detection interval to check whether the indicator pin level is valid. NOTE 1. Maximally 15 URCs can be buffered. When the number of URC exceeds 15, the oldest one in the buffer will be cleared to store the new URC. 2. The RING URC is buffered only once for each call process. Example AT+QCFG='apready',1,0,800 OK AT+QCFG='apready' +QCFG: 'apready',1,0,800 OK 3.2. AT+QCFG='sleepind/level' Configure the Output Level of the SLEEP_IND Pin This command configures the output level of the SLEEP_IND pin when the module is in sleep mode. AT+QCFG ='sleepind/level' Configure the Output Level of the SLEEP_IND Pin Write Command AT+QCFG='sleepind/level'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'sleepind/level', OK If the optional parameter is specified, set the output level of the SLEEP_IND pin: OK Or ERROR EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 18 / 136 LTE Standard Module Series Maximum Response Time Characteristics 300 ms This command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. It indicates the output level after the module enters sleep mode. 0 When the module enters sleep mode, SLEEP_IND pin outputs high level. 1 When the module enters sleep mode, SLEEP_IND pin outputs low level. Example AT+QCFG='sleepind/level',0 OK AT+QCFG='sleepind/level' +QCFG: 'sleepind/level',0 //SLEEP_IND pin outputs high level. //Query the current setting. OK 3.3. AT+QCFG='wakeupin/level' Configure Whether to Wake up the Module Through WAKEUP_IN Pin This command configures whether to wake up the module through WAKEUP_IN pin. AT+QCFG ='wakeupin/level' Configure Whether to Wake up the Module Through WAKEUP_IN Pin Write Command Response AT+QCFG='wakeupin/level'[, If the optional parameters are omitted, query the current [,]] setting: +QCFG: 'wakeupin/level',, OK Maximum Response Time If the optional parameters are specified, configure whether to wake up the module through WAKEUP_IN pin: OK Or ERROR 300 ms EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 19 / 136 LTE Standard Module Series Characteristics This command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. Set WAKEUP_IN pin to low or high level to wake up the module. 0 Set WAKEUP_IN pin to low level 1 Set WAKEUP_IN pin to high level Integer type. Enable or disable whether to wake up the module through WAKEUP_IN pin. 0 Disable 1 Enable Example AT+QCFG='wakeupin/level',0 OK AT+QCFG='wakeupin/level' +QCFG: 'wakeupin/level',0,0 //Set WAKEUP_IN pin to low level to wake up the module. //Query the current setting. OK 3.4. AT+QCFG='urc/ri/ring' Set RI Behavior When RING URC is Presented AT+QCFG='urc/ri/ring', AT+QCFG='urc/ri/smsincoming'(Chapter 3.5) and AT+QCFG='urc/ri/other' (Chapter 3.6) control the RI (ring indicator) behavior when a URC is reported. These configurations will be stored into NV automatically. The ring indicator is active low. AT+QCFG='urc/ri/ring' specifies the RI behavior when URC RING is presented to indicate an incoming call. The sum of and determines the interval time of RING indications when a call is coming. AT+QCFG='urc/ri/ring' Set RI Behavior When RING URC is Presented Write Command AT+QCFG='urc/ri/ring'[,[,[,[,[, [,]]]]]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'urc/ri/ring',,,,,,< EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 20 / 136 LTE Standard Module Series Maximum Response Time Characteristics pulse_count> OK If the optional parameters are specified, set the RI behavior when RING URC is presented: OK Or ERROR If there is any error related to ME functionality: +CME ERROR: 300 ms This command takes effect immediately. The configuration will be saved automatically. Parameter String type. RI behavior when URCs are presented. 'off' No change. Ring indicator keeps inactive. 'pulse' Pulse. Pulse width is determined by . 'always' Change to active. RI behavior can be restored to inactive by AT+QRIR. See document [1] for details about the command. 'auto' When 'RING' is presented to indicate an incoming call, the ring indicator changes to and keeps active. When ring of the incoming call ends, either answering or hanging up the incoming call, the ring indicator will change to inactive. 'wave' When RING is presented to indicate an incoming call. The ring indicator outputs a square wave. Both and are used to set parameters of the square wave. When the ring of incoming call ends, either answering or hanging up the incoming call, the ring indicator will change to inactive. Integer type. Set the pulse width. Range: 1–2000. Default value: 120. Unit: ms. This parameter is only valid when is 'pulse'. If this parameter is not needed, it can be set as null. Integer type. The active duration of the square wave. Range: 1–10000. Default value: 1000. Unit: ms. This parameter is only valid when is 'wave'. Integer type. Set the inactive duration of the square wave. Range: 1–10000. Default value: 5000. Unit: ms. This parameter is only valid when is 'wave'. String type. Set whether the ring indicator behavior could be disturbed. This EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 21 / 136 LTE Standard Module Series parameter is only valid when is configured to 'auto' or 'wave'. For example, when is 'wave', if the square wave does not need to be disturbed by other URCs (including SMS related URCs), then should be set to 'on'. 'off' RI behavior can be disturbed by other URCs when the behavior is caused by an incoming call ringing. 'on' RI behavior cannot be disturbed by other URCs when the behavior is caused by an incoming call ringing. Integer type. The count of pulse. This parameter is only valid when is 'pulse'. Range: 1–5. Default value: 1. The interval time between two pulses is equal to . Error code. See Chapter 13. 3.5. AT+QCFG='urc/ri/smsincoming' Set RI Behavior When Incoming SMS URCs are Presented This command specifies the RI (ring indicator) behavior when related incoming message URCs are presented. Related incoming message URCs list: +CMTI, +CMT, +CDS and +CBM. AT+QCFG='urc/ri/smsincoming' Set RI Behavior When Incoming SMS URCs are Presented Write Command Response AT+QCFG='urc/ri/smsincoming'[,[,[,]]] +QCFG: 'urc/ri/smsincoming',,, OK If the optional parameters are specified, set the RI behavior when incoming SMS URCs are presented: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms This command takes effect immediately. The configuration will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 22 / 136 Parameter LTE Standard Module Series String type. RI behavior when URCs are presented. 'off' No change. Ring indicator keeps inactive. 'pulse' Pulse. Pulse width is determined by . 'always' Change to active. RI behavior can be restored to inactive by AT+QRIR. Integer type. Set the width of pulse. Range: 1–2000. Default value: 120. Unit: ms. This parameter is only valid when is 'pulse'. Integer type. The count of pulse. This parameter is only valid when is 'pulse'. Range: 1–5. Default value: 1. The interval time between two pulses is equal to . Error code. See Chapter 13. 3.6. AT+QCFG='urc/ri/other' Set RI Behavior When Other URCs are Presented This command specifies the RI (ring indicator) behavior when other URCs are presented. AT+QCFG='urc/ri/other' Set RI Behavior When Other URCs are Presented Write Command AT+QCFG='urc/ri/other'[,[,[,]]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'urc/ri/other',,, OK If the optional parameters are specified, set the RI behavior when other URCs are presented: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms This command takes effect immediately. The configuration will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 23 / 136 LTE Standard Module Series Parameter String type. RI behavior when URCs are presented。 'off' No change. Ring indicator keeps inactive. 'pulse' Pulse. Pulse width is determined by . Integer type. Set the width of pulse. Range: 1–2000. Default value: 120. Unit: ms. This parameter is effect only when is 'pulse'. Integer type. The count of pulse. This parameter is only valid when is 'pulse'. Range: 1–5. Default value: 1. The interval time between two pulses is equal to . Error code. See Chapter 13. 3.7. AT+QCFG='risignaltype' RI Signal Output Carrier This command specifies the RI (ring indicator) signal output carrier. AT+QCFG='risignaltype' RI Signal Output Carrier Write Command AT+QCFG='risignaltype',[] Response If the optional parameter is omitted, query the current setting: +QCFG: 'risignaltype', OK If the optional parameter is specified, set the RI signal output carrier: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms This command takes effect immediately. The configuration will be saved automatically. Parameter String type. RI signal output carrier. 'respective' The ring indicator behaves on the port where URC is presented, and the port can be obtained by AT+QURCCFG='urcport'. See EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 24 / 136 LTE Standard Module Series document [1] for details about the command. If URC is presented on UART port, it is physical ring line. If URC is presented on USB modem port, it is virtual ring line. If URC is presented on USB AT port, no ring line for USB AT port which does not support ring line. 'physical' No matter which port URC is presented on, the RI pin will have a ring jump. Error code. See Chapter 13. Example AT+QCFG='risignaltype' +QCFG: 'risignaltype','respective' OK AT+QCFG='risignaltype','physical' OK AT+QCFG='risignaltype' +QCFG: 'risignaltype','physical' OK 3.8. AT+QCFG='urc/delay' Delay URC Indication Output This command delays the output of URC indication until ring indicator pulse ends. AT+QCFG='urc/delay' Delay URC Indication Output Write Command AT+QCFG='urc/delay'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'urc/delay', OK If the optional parameter is specified, set when the URC indication is outputted: OK Or ERROR If there is any error related to ME functionality: +CME ERROR: EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 25 / 136 LTE Standard Module Series Maximum Response Time Characteristics 300 ms This command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. 0 URC indication will be outputted when ring indicator pulse starts. 1 URC indication will be outputted when ring indicator pulse ends (only effective when the type of ring indicator is 'pulse'. See AT+QCFG='urc/ri/ring', AT+QCFG='urc/ri/smsincoming' or AT+QCFG='urc/ri/other' for details). Error code. See Chapter 13. 3.9. AT+QCFG='urc/cache' Enable/Disable URC Cache AT+QCFG='urc/cache' Enable/Disable URC Cache Write Command AT+QCFG='urc/cache'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'urc/cache', OK If the optional parameter is specified, enable/disable URC cache: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms This command takes effect immediately. The configuration will not be saved. Parameter Integer type. Enable/disable URC cache. 0 Disable 1 Enable EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 26 / 136 Error code. See Chapter 13. Example AT+QCFG='urc/cache' +QCFG: 'urc/cache',0 //Disable URC cache. OK AT+QCFG='urc/cache',1 OK AT+QCFG='urc/cache' +QCFG: 'urc/cache',1 //Enable URC cache. OK //Make a call and send two messages to the module. AT+QCFG='urc/cache',0 //Disable URC cache. OK LTE Standard Module Series 3.10. AT+QCFG='urc/poweron' Set Output URC of Power-on AT+QCFG='urc/poweron' Set Output URC of Power-on Write Command AT+QCFG='urc/poweron'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'urc/poweron', OK Maximum Response Time Characteristics If the optional parameter is specified, set output URC of power-on: OK Or ERROR 300 ms This command takes effect after rebooting. The configuration will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 27 / 136 LTE Standard Module Series Parameter Integer type. Enable/disable URC output of power-on. 0 Enable 1 Disable Example AT+QCFG='urc/poweron' +QCFG: 'urc/poweron',0 OK AT+CFUN=0 OK AT+CFUN=1 OK +CPIN: READY +QUSIM: 1 +QIND: SMS DONE +QIND: PB DONE AT+QCFG='urc/poweron',1 OK AT+CFUN=0 OK AT+CFUN=1 OK //No URC output. AT+QCFG='urc/poweron' +QCFG: 'urc/poweron',1 OK //Query the current configuration of URC output. //Disable URC output. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 28 / 136 LTE Standard Module Series 3.11. AT+QCFG='divctl' Configure Primary and Rx-diversity under LTE/WCDMA AT+QCFG='divctl' Configure Primary and Diversity under LTE/WCDMA Write Command AT+QCFG='divctl',[,] Response If the optional parameter is omitted, query the current setting: +QCFG:'divctl',, OK Maximum Response Time If the optional parameter is specified, configure primary and Rx-diversity under LTE/WCDMA: OK Or ERROR 300 ms Characteristics / Parameter String type. Network mode. 'lte' LTE 'wcdma' WCDMA Integer type. Rx-diversity chain information. 0 Enable Rx-diversity chains 0 and 1 (PRX and DRX respectively) 1 Signal information is available on Rx-diversity chain 0 (PRX). 2 Signal information is available on Rx-diversity chain 1 (DRX). Example AT+QCFG='divctl','lte' +QCFG: 'divctl','lte',0 OK AT+QCFG='divctl','lte',1 //Query the current configuration under LTE. //Open LTE PRX, and close DRX. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 29 / 136 LTE Standard Module Series OK 3.12. AT+QCFG='bootup' Enable/Disable Services in Linux This command enables/disables the services in Linux, such as the web services. AT+QCFG='bootup' Enable/Disable Services in Linux Write Command AT+QCFG='bootup'[,,] Response If the optional parameter is omitted, list the range supported by : +QCFG: 'bootup', OK Maximum Response Time Characteristics If the optional parameter is specified, enable/disable services in Linux: OK Or ERROR 300 ms This command takes effect after rebooting. The configuration will be saved automatically. Parameter String type. Service name. sfe Shortcut forward engine web-services WEB service wlan-services WLAN service Integer type. Set/query the services status. 0 Disable the services status 1 Enable the services status 2 Query the services status Example AT+QCFG='bootup' +QCFG: 'bootup', OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 30 / 136 AT+QCFG='bootup',web-services,0 OK LTE Standard Module Series 3.13. AT+QCFG='ppp/sleep_ri' Enable/Disable Waking up the Module through the RI Pin Indication after PPP Establishment AT+QCFG='ppp/sleep_ri' Enable/Ddisable Waking up the Module through the RI Pin Indication after PPP Establishment Write Command Response AT+QCFG='ppp/sleep_ri'[,,< If the optional parameters are omitted, query the current RI_interval>] setting: +QCFG: 'ppp/sleep_ri',, OK Maximum Response Time Characteristics If the optional parameters are specified, enable or disable waking up the module through the RI pin after PPP establishment: OK Or ERROR 300 ms This command takes effect immediately. The configuration will not be saved. Parameter Integer type. Enable/Disable waking up the module through the RI pin when receiving data after PPP establishment. 0 Disable 1 Enable Integer type. RI level jump interval. Unit: ms. Range: 500–50000. Default value: 1000. NOTE Under PPP, when the module is awakened from the sleep, the RI pin always changes from high level to low level. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 31 / 136 LTE Standard Module Series 3.14. AT+QCFG='thermal/txpwrlmt' Configure Temperature Protection Strategy This command configures temperature protection strategy to restrict the maximum transmission power of the module. AT+QCFG='thermal/txpwrlmt' Configure Temperature Protection Strategy Write command AT+QCFG='thermal/txpwrlmt'[,,,,,,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'thermal/txpwrlmt',,,,,, OK Maximum Response Time Characteristics If the optional parameters are temperature protection strategy: OK Or ERROR specified, configure 300 ms This command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. Enable/disable the restriction for the maximum transmission power when a specified sensor reaches the temperature threshold. 1 Disable 0 Enable Integer type. Sensor ID. Range: 0–7. 2 Modem temperature sensor 5 PA temperature senso 7 XO temperature sensors Integer type. Temperature threshold. Range: -150~150. Unit: ºC. Default value: 105. Integer type. Detect period. Range: 1000–360000. Unit: ms. Default value: 1000. Integer type. Trigger counter. Range: 1–10000. Default value: 3. Integer type. Clear counter. Range: 1–10000. Default value: 10. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 32 / 136 LTE Standard Module Series 3.15. AT+QCFG='thermal/modem' Configure Thermal Threshold This command configures the thermal threshold to trigger the UL/DL rate descending. AT+QCFG='thermal/modem' Configure Thermal Threshold Write Command AT+QCFG='thermal/modem'[, ,,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'thermal/modem', 1,, +QCFG: 'thermal/modem', 2,, +QCFG: 'thermal/modem', 3,, OK Maximum Response Time Characteristics If the optional parameters are specified, set the thermal threshold to trigger the UL/DL rate descending. OK Or ERROR 300 ms This command takes effect after rebooting. The configuration will be saved automatically. Parameter Integer type. Working condition of module under thermal threshold. 1 Descending UL rate. 2 Descending DL and UL rate. 3 Service state limitation Integer type. Triggering threshold. Integer type. Clearing threshold. NOTE ⚫ When =1, =100000 and =95000 by default. If the trigger threshold is higher than 100 degrees, the module enters Level1 to lower UL rate; If the clearing threshold is lower than 95 degrees, the module exits from Level 1. ⚫ When =2, =105000 and =100000 by default. If the trigger threshold is higher than 105 degrees, the module enters level 2 to lower UL and DL rate; If the clearing threshold is lower than 100 degrees, the module exits from level 2. ⚫ When =3, =115000 and =105000 by default. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 33 / 136 LTE Standard Module Series If the trigger threshold is higher than 115 degrees, the module enters limitation service state; If the clearing threshold is lower than 100 degrees, the module exits from level 3. 3.16. AT+QCFG='urc/ri/pin' Configure UART Pins Corresponding to RI AT+QCFG='urc/ri/pin' Configure UART Pins Corresponding to RI Write Command AT+QCFG='urc/ri/pin'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'urc/ri/pin', OK Maximum Response Time Characteristics If the optional parameter is specified, configure UART pins corresponding to RI: OK Or ERROR 300 ms This command takes effect immediately. The configuration will be saved automatically. Parameter String type. UART pin name. 'uart_ri' 'uart_dcd' 3.17. AT+QCFG='icf' Configure Main UART This command configures the data bit, stop bit, parity bit of main UART. AT+QCFG='icf' Configure Main UART Write Command AT+QCFG='icf'[,,,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'icf',,, EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 34 / 136 LTE Standard Module Series Maximum Response Time Characteristics OK If the optional parameters are specified, set the Main UART: OK Or ERROR 300 ms This command takes effect after rebooting. The configuration will be saved automatically. Parameter Integer type. The supported data bit per char. 0 5 data bits per char 1 6 data bits per char 2 7 data bits per char 3 8 data bits per char Integer type. The supported stop bit. 0 0.5 stop bit 1 1 stop bit 2 1.5 stop bits 3 2 stop bits Integer type. The supported parity mode. 0 NO_PARITY 1 ODD_PARITY 2 EVEN_PARITY 3 SPACE_PARITY Example AT+QCFG='icf' +QCFG: 'icf',3,1,0 OK AT+QCFG='icf',2,1,1 OK //Default UART configuration: 8 data bits per char, 1 stop bits, NO_PARITY. //Configure main UART: 7 data bits per char, 1 stop bits, ODD_PARITY. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 35 / 136 LTE Standard Module Series 3.18. AT+QCFG='thermal/limit_rates' Enable/Disable the Rate Limit This command enables/disables the rate limit under high temperature. AT+QCFG='thermal/limit_rates' Enable/Disable the Rate Limit Write Command AT+QCFG='thermal/limit_rates'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'thermal/limit_rates', OK Maximum Response Time Characteristics If the optional parameter is specified, enable/disable the rate limit: OK Or ERROR 300 ms This command takes effect after rebooting. The configuration will be saved automatically. Parameter Integer type. Enable/Disable the rate limit. 0 Disable 1 Enable Example AT+QCFG='thermal/limit_rates' +QCFG: 'thermal/limit_rates',0 OK AT+QCFG='thermal/limit_rates',1 OK 3.19. AT+QCFG='urcdelay' Configure URC Delay This command enables/disables URC delay report and URC delay time. When this feature is enabled, URC will be reported after the delay time. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 36 / 136 LTE Standard Module Series AT+QCFG='urcdelay' Configure URC Delay Write Command AT+QCFG='urcdelay'[,,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'urcdelay',, OK If the optional parameters are specified, configure URC delay: OK Or ERROR Maximum Response Time Characteristics If error is related to ME functionality: +CME ERROR: 300 ms This command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. Disable/enable URC delay feature. 0 Disable 1 Enable Integer type. URC delay time. Range: 0–10000. Unit: ms. Default value: 100. Example AT+QCFG='urcdelay' +QCFG: 'urcdelay',0,0 //URC delay is disabled by default. OK AT+QCFG='urcdelay',1,3000 //Enable URC delay feature and delay URC for 3 s. OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 37 / 136 LTE Standard Module Series 3.20. AT+QCFG='sarcfg' Set SAR Transmission Power for LTE/WCDMA/GSM This command sets the specific transmission power corresponding to the SAR power level for LTE/WCDMA/GSM. AT+QCFG='sarcfg' Set SAR Transmission Power for LTE/WCDMA/GSM Write Command AT+QCFG='sarcfg'[,[,,,[,]]] Response If , , , and are omitted, query the current configuratio n: +QCFG: 'sarcfg',,< max_power>,,[,band] OK If , , and are omitted, return the power for the network mode specified by : +QCFG: 'sarcfg',,< max_power>,, OK If , and are omitted, return the power for the band under the network mode specified by : +QCFG: 'sarcfg',,< max_power>,,[,band] OK Maximum Response Time Characteristics If all the optional parameters are specified, set SAR transmission power for LTE/WCDMA/GSM: OK Or ERROR 300 ms / EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 38 / 136 LTE Standard Module Series Parameter String type. Network mode. 'lte_wcdma' LTE&WCDMA 'gsm' GSM only 'lte' LTE only 'wcdma' WCDMA only Integer type. The transmission power corresponding to the maximum SAR level. When is 'gsm', the range is 600–3000. Unit: 0.01 db. When is not 'gsm', the range is 600–3000. Unit: 0.01 db. Integer type. Transmission power difference between adjacent SAR levels. The value is less than configured in this command. Unit: 0.01 db. Integer type. The transmission power difference between adjacent slot levels. Range: 600–3000. Unit: 0.01db. The value is less than configured in this command. This parameter is only valid when is 'gsm'. When is not 'gsm', must be set to 0. When is 'lte' or 'wcdma', a single band can be specified with . If is omitted, configure all the bands under LTE or WCDMA. LTE: 0 LTE B1 1 LTE B2 2 LTE B3 3 LTE B4 4 LTE B5 5 LTE B6 6 LTE B7 7 LTE B8 8 LTE B9 9 LTE B10 10 LTE B11 11 LTE B12 12 LTE B13 13 LTE B14 14 LTE B17 15 LTE B18 16 LTE B19 17 LTE B20 18 LTE B21 19 LTE B23 20 LTE B24 21 LTE B25 22 LTE B26 23 LTE B27 24 LTE B28 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 39 / 136 25 LTE B30 26 LTE B31 27 LTE B33 28 LTE B34 29 LTE B38 30 LTE B39 31 LTE B40 32 LTE B41 33 LTE B42 43 LTE B43 45 LTE B45 66 LTE B66 71 LTE B71 WCDMA: 35 WCDMA B1 36 WCDMA B2 37 WCDMA B4 38 WCDMA B5 39 WCDMA B8 40 WCDMA B9 41 WCDMA B11 WCDMA2100 WCDMA1900 WCDMA1700 WCDMA850 WCDMA900 WCDMA1700 WCDMA1500 LTE Standard Module Series NOTE 1. When - × SARlevel(n) < 0, transmission power of the SARlevel(n) equals that of SARlevel(n-1). 2. In LTE and WCDMA, by default, the transmission power of SARlevel(1) to SARlevel(8) corresponds to 23 dBm to 16 dBm respectively. = 230 (23 dBm), = 10 (1 dBm). 3. In GSM, each SAR level is subdivided into 5 slots, and the power difference between each slot is determined by . For example, when = 100, it means that the power difference of the slot is 100/100 = 1 dBm. The power difference between each SAR level is determined by . For example, when =100, it means that the power difference of the SAR level is 100/100=1 dBm, that is, the transmission power of SARlevel(1) to SARlevel(8) corresponds to 28 dBm to 12 dBm respectively. The default values are: = 2800 (28 dBm), = 100 (1 dBm). = 100 (1 dBm). Example AT+QCFG='sarcfg' //Query the current setting. +QCFG: 'sarcfg',('lte_wcdma','gsm','lte','wcdma'),max_power,row_grads,column_grads,[ban d] OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 40 / 136 AT+QCFG='sarcfg','lte_wcdma' +QCFG: 'sarcfg','lte_wcdma',230,10,0 OK AT+QCFG='sarcfg','lte',5 +QCFG: 'sarcfg','lte',230,10,0 OK AT+QCFG='sarcfg','lte_wcdma',230,10,0 OK AT+QCFG='sarcfg','lte',230,10,0,5 OK LTE Standard Module Series 3.21. AT+QCFG='fast/poweroff' Enable/Disable Fast Power-Off AT+QCFG='fast/poweroff' Enable/Disable Fast Power-Off Write Command AT+QCFG='fast/poweroff'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'fast/poweroff', OK Maximum Response Time Characteristics If the optional parameter is specified, enable/disable fast power-off: OK Or ERROR 300 ms This command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. Enable/disable fast power-off. 0 Disable 1 Enable Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 41 / 136 Example AT+QCFG='fast/poweroff' +QCFG: 'fast/poweroff',0 OK AT+QCFG='fast/poweroff',1 OK AT+QCFG='fast/poweroff' +QCFG: 'fast/poweroff',1 OK //Query the current setting. //Enable fast power-off. //Fast power-off is enabled. LTE Standard Module Series 3.22. AT+QCFG='sleep/datactrl' Configure Data Cache Mode This command configures data cache mode when the module is in sleep mode. AT+QCFG='sleep/datactrl' Configure Data Cache Mode Write Command AT+QCFG='sleep/datactrl'[,[,[,]]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'sleep/datactrl',,, OK Maximum Response Time Characteristics If the optional parameters are specified, set the data cache mode when the module is in sleep mode: OK Or ERROR 300 ms This command takes effect immediately. The configuration will not be saved. Parameter Integer type. The type of the device to be cached. (e.g. 5 = 1 + 4, indicates caching the data that from UART1 and USB AT port when the module is in sleep mode.) 0 No device. Disable data cache. 1 UART1 2 USB modem port (Not supported currently) EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 42 / 136 LTE Standard Module Series 4 USB AT port (Not supported currently) Integer type. The maximum time to cache the data that from the specified output port. If time reaches the set time, the data will be output. Default value: 300. Unit: ms. Integer type. The flag of automatic sending data when USB status changes (not supported currently). 0 When the USB changes to the normal state, the data sending will not be triggered. 1 When USB changes from DISCONNECT or SUSPEND to CONFIGURED, the module will send the cached data immediately. Error code. See Chapter 13. NOTE When all the following conditions are met, the module judges that the host is in the sleep mode. ⚫ DTR condition: DTR sleep control is enabled with high level. If DTR sleep control is disabled, this condition can be ignored. ⚫ USB condition: the status of USB is DISCONNECT or SUSPEND. ⚫ AT+QSCLK is configured to 1. Example AT+QCFG='sleep/datactrl',1,800,0 //Enable data caching when the module is in sleep mode. The caching port is UART1. Timeout is 800 ms. OK AT+QCFG='sleep/datactrl' +QCFG: 'sleep/datactrl',0,300,1 //Query the current setting, which is disabled. OK 3.23. AT+QCFG='rf/tuner_cfg' Set the Mapping between RF Tuner and RF Bands AT+QCFG='rf/tuner_cfg' Set the Mapping between RF Tuner and RF Bands Write Command AT+QCFG='rf/tuner_cfg'[,,,,] Response If the optional parameters are omitted, query the current setting: 'rf/tuner_cfg',,,, OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 43 / 136 LTE Standard Module Series Maximum Response Time Characteristics If the optional parameters are specified, set the mapping between RF tuner and RF bands: OK Or ERROR 300 ms This command takes effect after rebooting. The configuration will be saved automatically. Parameter Integer type. Pin level status. Range: 0–3. 0 Pin 144 at low level, pin 143 at low level 1 Pin 144 at low level, pin 143 at high level 2 Pin 144 at high level, pin 143 at low level 3 Pin 144 at high level, pin 143 at high level String type. LTE bands, and the separator is comma. E.g., '1,3,5', etc. String type. WCDMA bands, and the separator is comma. E.g., '1,3,5', etc. String type. GSM bands, and the separator is comma. E.g., '1,3,5', etc. Example AT+QCFG='rf/tuner_cfg' //Query the current setting. +QCFG: 'rf/tuner_cfg',0,'1,2,3,4,8,25,39','1,2,4,8','8,3,2' 'rf/tuner_cfg',1,'5,18,19,20,26','5,6,19','5' 'rf/tuner_cfg',2,'12,13,28' 'rf/tuner_cfg',3,'7,38,40,41' OK //Set the LTE bands, i.e., pin 144 at high level and pin 143 at low level. AT+QCFG='rf/tuner_cfg',2,'2,12,13, 25,28','5, 8' OK AT+QCFG='rf/tuner_cfg' //Query the current setting. +QCFG: 'rf/tuner_cfg', 0,'1, 3, 4, 8, 39','1, 2','8, 3, 2' 'rf/tuner_cfg',1,'5,18,19,20,26','5,6,19','5' 'rf/tuner_cfg',2,'2,12,13, 25,28','5,8' 'rf/tuner_cfg',3,'7,38,40,41' OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 44 / 136 LTE Standard Module Series 3.24. AT+QCFG='mms_rec_control' Save/Discard the MMS AT+QCFG='mms_rec_control' Save/Discard the MMS Write Command AT+QCFG='mms_rec_control'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'mms_rec_control', OK Maximum Response Time Characteristics If the optional parameter is specified, set whether to discard the MMS: OK Or ERROR 300 ms The command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. Whether to discard the MMS. 0 Save the MMS 1 Discard the received MMS Example AT+QCFG='mms_rec_control',1 OK AT+QCFG='mms_rec_control' +QCFG: 'mms_rec_control',1 OK //Discard the received MMS. //Query the current setting. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 45 / 136 LTE Standard Module Series 4 Audio Commands 4.1. AT+QCFG='tone/incoming' Enable Ring Tone AT+QCFG='tone/incoming' Enable Ring Tone Write Command AT+QCFG='tone/incoming'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'tone/incoming', OK If the optional parameter is specified, enable ring tone: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. Enable/disable the ring tone. 0 Disable ring tone 1 Enable Nokia ring tone 2 Enable ring tone Error code. See Chapter 13. Example AT+QCFG='tone/incoming' +QCFG: 'tone/incoming',0 //Ring tone is disabled. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 46 / 136 OK AT+QCFG='tone/incoming',1 OK AT+QCFG='tone/incoming' +QCFG: 'tone/incoming',1 OK //Enable the ring tone. //Ring tone is enabled. LTE Standard Module Series 4.2. AT+QCFG='pcmclk' Configure PCM_CLK This command enables or disables PCM_CLK. AT+QCFG='pcmclk' Configure PCM_CLK Write Command AT+QCFG='pcmclk'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'pcmclk', OK If the optional parameter is specified, configure PCM_CLK: OK Or ERROR Maximum Response Time Characteristics If error is related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will not be saved. Parameter Integer type. Enable/disable PCM_CLK. 0 Disable PCM_CLK. In decimal, the value is 0; In hexadecimal, the value is 0x0. 1 Enable PCM_CLK. In decimal, the value is 1; In hexadecimal, the value is 0x1. Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 47 / 136 LTE Standard Module Series NOTE The output frequency depends on of AT+QDAI. If enabled, PCM_CLK will be able to output square wave, and the frequency is 2048 KHz; the PCM_SYNC will be able to output pulse shape, and the frequency is 8 KHz. See document [1] for the details of the command. 4.3. AT+QCFG='codec/powsave' Set PSM for ALC5616 Codec The command enables/disables the PSM (power saving mode) for ALC5616 Codec. AT+QCFG='codec/powsave' Set PSM for ALC5616 Codec Write Command Response AT+QCFG='codec/powsave'[,] +QCFG: 'codec/powsave', OK If the optional parameter is specified, enable/disable PSM for ALC5616 Codec: OK Or ERROR Maximum Response Time Characteristics If error is related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will not be saved. Parameter Integer type. Enable/disable the PSM. 0 Disable 1 Enable Error code. See Chapter 13. NOTE The configuration will take effect during the next calling. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 48 / 136 Example AT+QCFG='codec/powsave',1 OK AT+QCFG='codec/powsave' +QCFG: 'codec/powsave',1 OK LTE Standard Module Series //Enable the PSM for ALC5616 Codec. //Query the current power saving mode. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 49 / 136 LTE Standard Module Series 5 Network Commands 5.1. AT+QCFG='gprsattach' Configure GPRS Attach Mode This command specifies the mode to attach GPRS when UE is powered on. This configuration is valid only after the module is restarted. AT+QCFG='gprsattach' Configure GPRS Attach Mode Write Command AT+QCFG='gprsattach'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'gprsattach', OK If the optional parameter is specified, set the GPRS attach mode: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. The mode to attach GRPS when UE is powered on. 0 Attach manually 1 Attach automatically Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 50 / 136 LTE Standard Module Series 5.2. AT+QCFG='nwscanmode' Configure Network Search Mode This command specifies the network mode to be searched. AT+QCFG='nwscanmode' Configure Network Search Mode Write Command AT+QCFG='nwscanmode'[,[,]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'nwscanmode', OK If the optional parameters are specified, set the network mode to be searched: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms determines when will the command take effect. The configuration will be saved automatically. Parameter Integer type. RAT. 0 AUTO 1 GSM only 2 WCDMA only 3 LTE only 4 TD-SCDMA only 5 UMTS only 6 CDMA only 7 HDR only 8 CDMA and HDR only Integer type. When the command to take effect. 0 Take effect after UE is rebooted 1 Take effect immediately Error code. See Chapter 13 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 51 / 136 LTE Standard Module Series 5.3. AT+QCFG='servicedomain' Configure Service Domain This command queries and configures the registered service domain. AT+QCFG='servicedomain' Configure Service Domain Write Command AT+QCFG='servicedomain'[,[,]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'servicedomain', OK If the optional parameters are specified, set the service domain of UE: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms determines when will the command take effect. The configuration will be saved automatically. Parameter Integer type. Service domain of UE. 0 CS only 1 PS only 2 CS & PS Integer type. When to take effect. 0 Take effect after UE is rebooted 1 Take effect immediately Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 52 / 136 LTE Standard Module Series 5.4. AT+QCFG='band' Configure Band This command specifies the preferred frequency bands to be searched of UE. AT+QCFG='band' Configure Band Write Command AT+QCFG='band'[,,,[,]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'band',,, OK If the optional parameters are specified, set the band: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms determines when will the command take effect. The configuration will be saved automatically. Parameter A hexadecimal value that specifies the GSM and WCDMA frequency bands. e.g. 00000013 = 00000001 (GSM 900) + 00000002 (GSM 1800) + 00000010 (WCDMA 2100) 00000000 No change 00000001 GSM 900 MHz 00000002 GSM 1800 MHz 00000004 GSM 850 MHz 00000008 GSM 1900 MHz 00000010 WCDMA 2100 MHz 00000020 WCDMA 1900 MHz 00000040 WCDMA 850 MHz 00000080 WCDMA 900 MHz 00000100 WCDMA 800 MHz 00000200 WCDMA 1700 MHz 0000FFFF Any frequency band A hexadecimal value that specifies the LTE frequency band. If it is set to 0 or 0x40000000, it means not to change LTE frequency band. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 53 / 136 LTE Standard Module Series (e.g.: 0x15 = 0x1 (LTE B1) + 0x4 (LTE B3) + 0x10 (LTE B5) 0x1 (CM_BAND_PREF_LTE_EUTRAN_BAND1) LTE B1 0x4 (CM_BAND_PREF_LTE_EUTRAN_BAND3) LTE B3 0x10 (CM_BAND_PREF_LTE_EUTRAN_BAND5) LTE B5 0x40 (CM_BAND_PREF_LTE_EUTRAN_BAND7) LTE B7 0x80 (CM_BAND_PREF_LTE_EUTRAN_BAND8) LTE B8 0x80000(CM_BAND_PREF_LTE_EUTRAN_BAND20) LTE B20 0x7FFFFFFFFFFFFFFF(CM_BAND_PREF_ANY) Any frequency band A hexadecimal value that specifies the TD-SCDMA frequency band. If it is set to 0 or 0x40000000, it means not to change TD-SCDMA frequency band. e.g.: 0x21 = 0x1 (TDS BCA) + 0x20 (TDS BCF) 0x1 (CM_BAND_PREF_TDS_BANDA) TDS BCA 0x2 (CM_BAND_PREF_TDS_BANDB) TDS BCB 0x4 (CM_BAND_PREF_TDS_BANDC) TDS BCC 0x8 (CM_BAND_PREF_TDS_BANDD) TDS BCD 0x10 (CM_BAND_PREF_TDS_BANDE) TDS BCE 0x20 (CM_BAND_PREF_TDS_BANDF) TDS BCF Integer type. When to take effect 0 Take effect after UE is rebooted 1 Take effect immediately Error code. See Chapter 13. 5.5. AT+QCFG='rrc' Configure RRC Release Version This command specifies the RRC release version. AT+QCFG='rrc' Configure RRC Release Version Write Command AT+QCFG='rrc'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'rrc', OK If the optional parameter is specified, set the RRC release version: OK Or ERROR If there is any error related to ME functionality: EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 54 / 136 LTE Standard Module Series +CME ERROR: Maximum Response Time Characteristics 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. RRC release version. 0 R99 1 R5 2 R6 3 R7 4 R8 5 R9 Error code. See Chapter 13. 5.6. AT+QCFG='msc' Configure MSC Release Version This command specifies the UE MSC release version. AT+QCFG='msc' Configure MSC Release Version Write Command AT+QCFG='msc'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'msc', OK If the optional parameter is specified, set the MSC release version: OK Or ERROR Maximum Response Time If there is an error related to ME functionality: +CME ERROR: 300 ms EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 55 / 136 LTE Standard Module Series Characteristics The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. MSC release version. 0 Forces the UE to always behave as an R97/R98 mobile 1 Forces the UE to always behave as an R99 mobile 2 Causes the UE’s behavior to be dynamic Error code. See Chapter 13. 5.7. AT+QCFG='sgsn' Configure UE SGSN Release Version This command specifies the UE SGSN release version. This configuration is valid only after the module is restarted. AT+QCFG='sgsn' Configure UE SGSN Release Version Write Command AT+QCFG='sgsn'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'sgsn', OK If the optional parameter is not omitted, set the SGSN release version: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. SGSN release version. 0 Forces the UE to always behave as an R97/R98 mobile EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 56 / 136 LTE Standard Module Series 1 Forces the UE to always behave as an R99 mobile 2 Causes the UE’s behavior to be dynamic Error code. See Chapter 13. 5.8. AT+QCFG='hsdpacat' Configure HSDPA Category This command specifies the HSDPA category. AT+QCFG='hsdpacat' Configure HSDPA Category Write Command AT+QCFG='hsdpacat'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'hsdpacat', OK If the optional parameter is not omitted, set the HSDPA category: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. HSDPA category. 6 Category 6 8 Category 8 10 Category 10 12 Category 12 14 Category 14 18 Category 18 20 Category 20 24 Category 24 Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 57 / 136 LTE Standard Module Series 5.9. AT+QCFG='hsupacat' Configure HSUPA Category This command specifies the HSUPA category. This configuration is valid only after the module is restarted. AT+QCFG='hsupacat' Configure HSUPA Category Write Command AT+QCFG='hsupacat'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'hsupacat', OK If the optional parameter is not omitted, set the HSUPA category: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. HSUPA category. 5 Category 5 6 Category 6 Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 58 / 136 LTE Standard Module Series 5.10. AT+QCFG='PDP/duplicatechk' Establish Multi-PDN with Same APN This command allows/refuses establishing multi-PDN with the same APN profile. AT+QCFG='pdp/duplicatechk' Establish Multi-PDN with Same APN Write Command AT+QCFG='pdp/duplicatechk'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'pdp/duplicatechk', OK If the optional parameter is not omitted, allow/refuse establishing multi-PDN with the same APN profile: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300ms The command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. 0 Refuse to establish multi-PDN with the same APN profile 1 Allowed to establish multi-PDN with the same APN profile Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 59 / 136 LTE Standard Module Series 5.11. AT+QCFG='disable_backoff_lte' Disable Backoff LTE This command configures whether to disable backoff LTE when Voice/SMS is not available because of the unavailable SRLTE. AT+QCFG='disable_backoff_lte' Disable Backoff LTE Write Command AT+QCFG='disable_backoff_lte'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'disable_backoff_lte', OK Maximum Response Time Characteristics If the optional parameter is specified, disable backoff LTE: OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. Enable/disable backoff LTE. 1 Enable 0 Disable 5.12. AT+QCFG='airplanecontrol' Enter/Exit Airplane Mode via W_DISABLE# Pin This command enters or exits airplane mode via the W_DISABLE# pin and queries the current setting. If the airplane mode is enabled, the module enters the airplane mode when the pin is pulled down and enters normal mode when the pin is pulled up. Also, URC +QIND: airplanestatus, is outputted before module entering or exiting the airplane mode. AT+QCFG='airplanecontrol' Enter/Exit Airplane Mode via W_DISABLE# Pin Write Command AT+QCFG='airplanecontrol'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'airplanecontrol',, EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 60 / 136 LTE Standard Module Series Maximum Response Time Characteristics OK If the optional parameter is specified, module enters/exits airplane mode via W_DISABLE# pin: OK Or ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter Integer type. Whether to enable airplane mode. 0 Disable airplane mode 1 Enable airplane mode. Enter airplane mode when W_DISABLE# pin changes to active and exits airplane mode when W_DISABLE# pin changes to inactive. URC +QIND: airplanestatus, is reported when W_DISABLE# pin status changes. It is not allowed to exit airplane mode by AT+CFUN=1 when W_DISABLE# pin is active. 2 Enable airplane mode. Enter airplane mode when W_DISABLE# pin changes to active and exit airplane mode when W_DISABLE# pin changes to inactive. URC +QIND: airplanestatus, is reported when W_DISABLE# pin status changes. It is not allowed to exit airplane mode by AT+CFUN=1 or QMI when W_DISABLE# pin is active. Integer type. Enter/exit airplane mode. 0 Exit 1 Enter NOTE See the corresponding hardware design of each module for more information about W_DISABLE# pin. Example AT+QCFG='airplanecontrol' +QCFG: 'airplanecontrol',0,0 //Query the current setting. OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 61 / 136 LTE Standard Module Series //Pull down W_DISABLE# pin. AT+QCFG='airplanecontrol',1 OK //Enable airplane mode. +QIND: airplanestatus,1 //Enter airplane mode because W_DISABLE# pin is pulled down. AT+CFUN? +CFUN: 4 //In airplane mode. OK //Pull up W_DISABLE# pin. +QIND: airplanestatus,0 //Exit airplane mode. AT+CFUN? +CFUN: 1 //In normal mode. OK //Reboot the modem. AT+QCFG='airplanecontrol' +QCFG: 'ariplanecontrol',1,0 //Query the current setting. This setting still takes effect after reboot. OK //Pull down W_DISABLE# pin. +QIND: airplanestatus,1 //Enter airplane mode. AT+CFUN? +CFUN: 4 //In airplane mode. OK 5.13. AT+QCFG='epcflag' Set EPC Capability Value in Attach Request AT+QCFG='epcflag' Set EPC Capability Value in Attach Request Write Command AT+QCFG='epcflag'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'epcflag', OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 62 / 136 LTE Standard Module Series Maximum Response Time Characteristics If the optional parameter specified, set EPC capability value in attach request: OK Or ERROR 300 ms The command takes effect immediately. The configurations are saved automatically. Parameter Integer type. Value of EPC capability. 0 In LTE mode, set value of EPC capability in attach request information to 0. 1 In LTE mode, set value of EPC capability in attach request information to 1. Example AT+QCFG='epcflag' +QCFG: 'epcflag',1 OK AT+QCFG='epcflag',0 OK AT+QCFG='epcflag' +QCFG: 'epcflag',0 OK //Query the value of EPC capability. //Set value of EPC capability to 0. //Query the value of EPC capability. 5.14. AT+QCFG='lte/bandprior' Set Searching Priority of LTE Band AT+QCFG='lte/bandprior' Set Searching Priority of LTE Band Write Command AT+QCFG='lte/bandprior'[,][ ,][,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'lte/bandprior',[,][,] OK If the optional parameters are specified, set the searching priority of LTE band: EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 63 / 136 LTE Standard Module Series Maximum Response Time Characteristics OK Or ERROR If error is related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. Band ID of the first preferred LTE band. Range: 1–43. Integer type. Band ID of the second preferred LTE band. Range: 1–43. Integer type. Band ID of the third preferred LTE band. Range: 1–43. Error code. See Chapter 13. Example AT+QCFG='lte/bandprior',7,5,41 OK //Reboot the module. AT+QCFG='lte/bandprior' +QCFG: 'lte/bandprior',07,05,41 OK //Set searching order priority of LTE band. //Read searching priority of LTE band. 5.15. AT+QCFG='plmn/addinfbdn' Add Current PLMN to FPLMN AT+QCFG =AT+QCFG='plmn/addinfbdn' Add Current PLMN to FPLMN Write Command AT+QCFG='plmn/addinfbdn'[, ] Response If the optional parameter is omitted, query the current setting: +QCFG: 'plmn/addinfbdn', OK If the optional parameter is specified, add the current PLMN to FPLMN: OK Or EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 64 / 136 LTE Standard Module Series Maximum Response Time Characteristics ERROR 300 ms The command takes effect immediately. The configurations will not be saved. Parameter Integer type. Configure whether to add the current PLMN into FPLMN event if it is in the EHPLMN. 0 Do not add 1 Add Example AT+QCFG='plmn/addinfbdn' +QCFG: 'plmn/addinfbdn',0 //Query the current value. OK AT+QCFG='plmn/addinfbdn',1 OK AT+QCFG='plmn/addinfbdn' +QCFG: 'plmn/addinfbdn',1 //Add the current PLMN to FPLMN event. //Query the current value. OK 5.16. AT+QCFG='cops_no_mode_change' Enable/Disable the Switch under AT+COPS=1 AT+QCFG='cops_no_mode_change' Enable/Disable the Switch under AT+COPS=1 Write Command AT+QCFG='cops_no_mode_change' [,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'cops_no_mode_change', OK If the optional parameter is specified, enable/disable the switch under AT+COPS=1: OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 65 / 136 LTE Standard Module Series Maximum Response Time Characteristics Or ERROR 300 ms The command takes effect immediately. The configurations will be saved automatically. Parameter Integer type. Enable/disable the switch under automatic mode in AT+COPS=1 (See document [1] for details about the command). 1 Disable 0 Enable 5.17. AT+QCFG='hplmn/search_timer' Configure HPLMN Search Interval AT+QCFG='hplmn/search_timer' Configure HPLMN Search Interval Write Command AT+QCFG='hplmn/search_timer'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'hplmn/search_timer', OK Maximum Response Time Characteristics If the optional parameter is specified, set HPLMN search interval: OK Or ERROR 300 ms The command takes effect immediately. The configurations will not be saved. Parameter Integer type. HLPMN search interval. Range: 1–71582. Unit: minute. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 66 / 136 LTE Standard Module Series NOTE The HPLMN search timer is started if the PLMN registered by the UE is different from HPLMN and EHPLMN. 5.18. AT+QCFG='tdd/config' Get the LTE-TDD Configuration This command gets the LTE-TDD configuration. AT+QCFG='tdd/config' Get the LTE-TDD Configuration Write Command AT+QCFG='tdd/config' Response +QCFG: 'tdd/config',, Maximum Response Time Characteristics OK 300 ms / Parameter Integer type. LTE-TDD subframe assignment. Range: 0–6. Integer type. LTE-TDD special subframe pattern. Range: 0–8. 5.19. AT+QCFG='urc_cause_support' Report Rejection Cause This command controls whether to report the URC of the cause (ESM/EMM/CP) when the network rejects the module. AT+QCFG='urc_cause_support' Report Rejection Cause Write Command AT+QCFG='urc_cause_support'[,] Response If the optional parameter is omitted, query the current setting: +QCFG='urc_cause_support', OK If the optional parameter is specified, report the rejection code: OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 67 / 136 Maximum Response Time Characteristics Or ERROR 300 ms / LTE Standard Module Series Parameter Hex format. Indicate the value of the setting. Range: 0–31. 0 Do not report network rejection code. Bit 0: 0x01 namely value 1. Support ESM cause report. Bit 1: 0x02 namely value 2. Support EMM cause report. Bit 2: 0x04 namely value 4. Support CP cause report. Bit 3: 0x08 namely value 8. Support GMM cause report. Bit 4: 0x10 namely value 16. Support MM cause report. Certain reports above-mentioned can be freely combined. 5.20. AT+QCFG='dhcppktfltr' Filter DHCP Package This command configures whether DHCP package is filtered. AT+QCFG='dhcppktfltr' Filter DHCP Package Write Command AT+QCFG='dhcppktfltr'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'dhcppktfltr', OK Maximum Response Time Characteristics If the optional parameter is specified, filter DHCP package: OK Or ERROR 300 ms The command takes effect immediately. The configuration will not be saved. Parameter Integer type. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 68 / 136 LTE Standard Module Series 0 The UDP DHCP package is parsed by local stack after the module gets IP address. 1 The UDP DHCP package is shipped to the external network after the module gets IP address. Example AT+QCFG='dhcppktfltr' +QCFG: 'dhcppktfltr',0 OK AT+QCFG='dhcppktfltr',1 OK AT+QCFG='dhcppktfltr' +QCFG: 'dhcppktfltr',1 OK //Query the current value. //Ship the UDP DHCP package to the external network after the module gets IP address. //Current value is changed to 1. 5.21. AT+QCFG='oostimer' Set Mode for OOS Network Searching AT+QCFG='oostimer' Set Mode for OOS Network Searching Write Command AT+QCFG='oostimer'[,,,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'oostimer',,, OK Maximum Response Time Characteristics If the optional parameters are specified, set the mode for OOS network searching: OK Or ERROR 300 ms The command takes effect immediately. The configuration will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 69 / 136 LTE Standard Module Series Parameter Integer type. In OOS state, search the network 10 times with as a cycle first. Default value: 30. Unit: second. Integer type. If the network cannot be found within , search the network 10 times with as a cycle. Default value: 45. Unit: second. Integer type. If the network cannot be found within , keep searching the network with as a cycle. Default value: 60. Unit: second. Example AT+QCFG='oostimer',5,5,5 OK 5.22. AT+QCFG='apn/blocked' Configure APN Block Mode AT+QCFG='apn/blocked' Configure APN Block Mode Write Command AT+QCFG='apn/blocked'[,[,]] Response If the optional parameters are omitted, query the current setting: +QCFG:'apn/blocked',, OK Maximum Response Time Characteristics If the optional parameters are specified, configure APN block mode: OK Or ERROR 300 ms The command takes effect immediately. The configurations will be saved automatically. Parameter Integer type. Configure whether all the APNs blocked by the network is allowed to be written to NV. 0 Allowed 1 Not allowed Integer type. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 70 / 136 LTE Standard Module Series 0 Query all APNs that are blocked 1 Delete all APNs that are blocked Example AT+QCFG='apn/blocked' +QCFG: 'apn/blocked',0,0 //Query the current setting. OK AT+QCFG='apn/blocked',0,1 OK //All the APNs blocked by the network are allowed to be written to NV, and delete them. 5.23. AT+QCFG='redir/3gtolte' Configure Redirection Mode AT+QCFG='redir/3gtolte' Configure Redirection Mode Write Command AT+QCFG='redir/3gtolte'[,[,,]] Response If the optional parameter is omitted, query the current setting: +QCFG:'redir/3gtolte',,, OK Maximum Response Time Characteristics If the optional parameter is specified, set redirection mode: OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. Configure the redirection mode. 0 Do not allow the module to redirect LTE from 3G once it is rejected by the network when try to register LTE 1 Allow the module to redirect LTE from 3G if it is rejected by the network when it tries to register to LTE Integer type. EPS storage supported flag. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 71 / 136 LTE Standard Module Series 0 Not get EPS storage supported value from NV 1 Get EPS storage supported value from NV Integer type. Indicate whether to support EPS storage. 0 Not support 1 Support Example AT+QCFG='redir/3gtolte' +QCFG: 'redir/3gtolte',0,0,0 OK AT+QCFG='redir/3gtolte',1 OK //Query the current setting. //Allow the module to redirect LTE from 3G. 5.24. AT+QCFG='rssi' Configure Delta Threshold of RSSI Change AT+QCFG='rssi' Configure Delta Threshold of RSSI Change Write Command AT+QCFG='rssi'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'rssi', OK Maximum Response Time Characteristics If the optional parameter is specified, configure delta threshold of RSSI change: OK Or ERROR 300 ms The command takes effect immediately. The configurations will not be saved. Parameter Integer type. The delta threshold of RSSI change. Range: 0–20. Default value: 5. Unit: dBm. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 72 / 136 LTE Standard Module Series 5.25. AT+QCFG='roamservice' Configure Roaming Service This command enables or disables the roaming service. AT+QCFG='roamservice' Configure Roaming Service Write Command AT+QCFG='roamservice'[,[,]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'roamservice', OK If the optional parameters are specified, set the roaming service: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms determines when will the command take effect. The configuration will be saved automatically. Parameter Integer type. The roaming service mode. 1 Disable roaming service 2 Enable roaming service 255 Auto mode Integer type. When the command take effect. 0 Take effect after UE reboots 1 Take effect immediately Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 73 / 136 LTE Standard Module Series 5.26. AT+QCFG='fast_dormancy' Dynamically Control the RRC Connection This command dynamically controls the RRC connection under WCDMA network. AT+QCFG='fast_dormancy' Dynamically Control the RRC Connection Write Command AT+QCFG='fast_dormancy'[,[,]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'fast_dormancy',[,] OK Maximum Response Time Characteristics If the optional parameters are specified, dynamically control the RRC connection: OK Or ERROR 300 ms The command takes effect immediately; Whether to save the parameter configuration is determined by . Parameter Integer type. 0 Disable the feature of fast dormancy. 1 Query whether there is data in the period of ; If not, disconnect RRC automatically. 2 Disconnect RRC immediately 3 If the network support T323 timer, query if there is data in the period of T323 timer; If not, disconnect RRC automatically. Integer type. Only valid when is 1. Range: 1–65535. Default value: 5. Unit: second. 5.27. AT+QCFG='airplane' Configure Airplane Mode AT+QCFG='airplane' Configure Airplane Mode Write Command AT+QCFG='airplane', Response If the optional parameter is omitted, query the current setting: EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 74 / 136 LTE Standard Module Series Maximum Response Time Characteristics +QCFG: 'ariplane', OK If the optional parameter is specified, set the airplane mode: OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. Airplane mode. 0 Use default setting at EFS file 1 Force to enter airplane mode 2 Force to exit airplane mode Example AT+QCFG='airplane' +QCFG: 'airplane',0 OK AT+QCFG='airplane',1 OK //Reboot the modem. AT+QCFG='airplane' +QCFG: 'ariplane',1 OK //Query the current setting. //Force to enter airplane mode. //It is forced to enter airplane mode. 5.28. AT+QCFG='rrc/control' Configure the Feature of RRC Connection Control AT+QCFG='rrc/control' Configure the Feature of RRC Connection Control Write Command Response AT+QCFG='rrc/control'[,,,,,,] setting: +QCFG: 'rrc/control',,,,,, OK Maximum Response Time Characteristics If the optional parameters are specified, set the feature of RRC connection control: OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. Enable/disable RRC connection control. 0 Disable 1 Enable Integer type. Counter to track number of RRC connection failures. Range: 0–60. Default value: 0. Integer type. Amount of time the serving cell is barred after occurs. Range: 0–60. Default value: 0. Integer type. The waiting time to add the cell blacklist after RRC failure. Range: 0–300. Default value: 0. Integer type. Enable/disable barring optimization. 0 Disable 1 Enable Integer type. The delay time to start a new RRC connection establishment procedure. Range: 0-60. Default value: 0. NOTE The cause of the random-access failure reported by the RRC to the NAS layer is fixed into LTE RRC CONN_EST_FAILURE_CONN_REJECT when the barring optimization is enabled with the remaining time. Remaining time = - elapsed time from the first RRC connection failure, unless it is configured with by the OEM. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 76 / 136 LTE Standard Module Series 5.29. AT+QCFG='nwscanmodeex' Configure Network Searching Mode AT+QCFG='nwscanmodeex' Configure Network Searching Mode Write Command AT+QCFG='nwscanmodeex'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'nwscanmodeex', OK Maximum Response Time Characteristics If the optional parameter is specified, set the network searching mode: OK Or ERROR 300 ms The command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. Network searching mode. Range: 0–63. Default value: 63. NOTE When Bit 0 to Bit 5 are all set to 1, it corresponds to =0 in AT+QCFG='nwscanmode'. Bit 0: CDMA2000 1X Bit 1: CDMA2000 HRPD (1xEVDO) Bit 2: GSM Bit 3: WCDMA Bit 4: LTE Bit 5: TD-SCDMA For example, to configure network searching mode to LTE only, it indicates to set to 16, corresponding to 0001 0000 in hex. Example AT+QCFG='nwscanmodeex',28 //In hex, 28 is 0001 1100. Configure network searching mode to GSM, WCDMA, LTE. OK AT+QCFG='nwscanmodeex' //Query the current setting. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 77 / 136 +QCFG: 'nwscanmode',28 OK LTE Standard Module Series 5.30. AT+QCFG='assign_plmn_in_limit_search' Specify Operator for Camping on a Cell with Limited Service The command specifies an operator for the module to camp on a cell with limited service when no (U)SIM card is inserted. AT+QCFG='assign_plmn_in_limit_search' Specify Operator for Camping on a Cell with Limited Service Write Command Response AT+QCFG='assign_plmn_in_limit_se If the optional parameters are omitted, query the current arch'[,[,]] setting: +QCFG: 'assign_plmn_in_limit_search',, OK Maximum Response Time Characteristic If the optional parameters are specified, enable/disable specifying an operator for the module to camp on a cell with limit service when no (U)SIM card is inserted: OK Or ERROR 300 ms The command takes effect after the module is rebooted or AT+CFUN=0/1. The configurations will be saved automatically. Parameter Integer type. Enable/disable the feature of specifying an operator for the module to camp on a cell with limit service when no (U)SIM card is inserted. 0 Disable 1 Enable String type. Operator code. For example, '46000' indicates China Mobile. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 78 / 136 LTE Standard Module Series Example AT+QCFG='assign_plmn_in_limit_search',1,'46000' //Specify China Mobile. OK AT+QCFG='assign_plmn_in_limit_search' //Query current setting. +QCFG: 'assign_plmn_in_limit_search',1,46000 OK AT+QCFG='assign_plmn_in_limit_search',0 OK //Disable the feature of specifying an operator for the module to camp on a cell with limit service when no (U)SIM card is inserted. 5.31. AT+QCFG='iprulectl' Configure the Gateway Address Generation Rule The command configures the gateway address generation rule when the module is used as a network card. AT+QCFG='iprulectl' Configure the Gateway Address Generation Rule Write Command AT+QCFG='iprulectl'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'iprulectl', OK Maximum Response Time Characteristic If the optional parameter is specified, set the gateway address generation rule: OK Or ERROR 300 ms The command takes effect immediately (The client needs re-connecting). The configurations will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 79 / 136 LTE Standard Module Series Parameter Integer type. Gateway address generation rule. 0 If the IP address is an odd integer, the gateway address is IP address plus 1. If the IP address is an even integer, the gateway address is IP address minus 1. 1 The gateway address is equal to IP address minus 1. Example AT+QCFG='iprulectl' +QCFG: 'iprulectl',0 OK AT+QCFG='iprulectl',1 OK 5.32. AT+QCFG='disrplmn' Configure RPLMN and RPLMNACT for Network Searching This command configures whether to use RPLMN and RPLMNACT when searching network. If RPLMN is used when searching network, RPLMNACT must be used too. AT+QCFG='disrplmn' Configure RPLMN and RPLMNACT for Network Searching Write Command AT+QCFG='disrplmn'[,,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'disrplmn',, OK If the optional parameters are specified, set whether to use RPLMN and RPLMNACT when searching network: OK Or ERROR Maximum Response Time Characteristic If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after the module is rebooted. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 80 / 136 LTE Standard Module Series The configuration will be saved automatically. Parameter Integer type. Whether to use RPLMN when searching network. 0 Do not use 1 Use Integer type. Whether to use RPLMNACT when searching network. 0 Do not use 1 Use Error code. See Chapter 13. NOTE 1. can be set only if =0. 2. The combination of =0 and =0 is invalid. 5.33. AT+QCFG='lte/preferfre' Set Preferred Frequency This command sets preferred frequency for searching network. AT+QCFG='lte/preferfre' Set Preferred Frequency Write Command AT+QCFG='lte/preferfre'[,,,,,,,] Response If the optional parameters are omitted, query the current setting: [+QCFG: 'lte/preferfre',,,,,,] OK Maximum Response Time Characteristic If the optional parameters are specified, set preferred frequency for searching network: OK Or ERROR 250 ms The command takes effect after the module is rebooted. The configurations will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 81 / 136 LTE Standard Module Series Parameter Integer type. Operation type. 0 Add a preferred frequency 1 Delete a preferred frequency Integer type. Preferred frequency index. Range: 1–10. Integer type. Band index. Range: 0–41, 60–62. 0 Band 1 1 Band 2 2 Band 3 … 41 Band 42 60 Band 125 61 Band 126 62 Band 127 Integer type. Reserved. Always be 101. Integer type. Frequency point. Integer type. Mobile country code. Integer type. Mobile network code. Example AT+QCFG='lte/preferfre',1,1,6,101,2452,460,03 //Delete the preferred frequency with index 1. OK AT+QCFG='lte/preferfre' OK 5.34. AT+QCFG='cops_control' Enable/Disable Configurations of AT+COPS This command enables or disables the configurations of AT+COPS. AT+QCFG='cops_control' Enable/Disable Configurations of AT+COPS Write Command AT+QCFG='cops_control'[, ] Response If the optional parameter is omitted, query the current setting: +QCFG: 'cops_control', OK If the optional parameter is specified, enable/disable the EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 82 / 136 LTE Standard Module Series Maximum Response Time Characteristic configurations of AT+COPS: OK Or ERROR 300 ms This command takes effect immediately. The configurations will not be saved into NVRAM. Parameter Integer type. Enable/disable the configurations of AT+COPS. 0 Disable 1 Enable Examples AT+QCFG='cops_control',1 OK AT+QCFG='cops_control' +QCFG: 'cops_control',1 //Enable the configurations of AT+COPS. OK 5.35. AT+QCFG='map_rej_cause7_to_cause14' Enable/Disable Network Rejection Cause Mapping This command enables or disables network rejection cause mapping. When using roaming card, GPRS NOT ALLOWED is returned under the roaming network. After receiving the rejection code, the module marks the roaming card as PS INVALID, and stops searching PLMN. This command controls whether to modify REJECT CAUSE 7 to REJECT CAUSE 14 to make the module search PLMN continuously after receiving the rejection code. AT+QCFG='map_rej_cause7_to_cause14' Enable/Disable Network Rejection Cause Mapping Read command AT+QCFG='map_rej_cause7_to_cau se14'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'map_rej_cause7_to_cause14', OK If the optional parameter is specified, enable/disable network EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 83 / 136 LTE Standard Module Series Maximum Response Time Characteristic rejection cause mapping: OK Or ERROR 250 ms The command takes effect after the module is rebooted. The configurations will be saved automatically. Parameter Integer type. Enable/Disable network rejection cause mapping. 0 Disable 1 Enable Example AT+QCFG='map_rej_cause7_to_cause14' +QCFG: 'map_rej_cause7_to_cause14',0 //Query the current setting. OK AT+QCFG='map_rej_cause7_to_cause14',1 OK //Enable network rejection cause mapping. 5.36. AT+QCFG='netmaskset' Enable/Disable Customized Netmask This command enables or disables customer to set the netmask. AT+QCFG='netmaskset' Enable/Disable Customized Netmask Write Command AT+QCFG='netmaskset'[,[,]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'netmaskset', OK Maximum Response Time If any of the optional parameters is specified, enable or disable customized netmask: OK Or ERROR 300 ms EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 84 / 136 LTE Standard Module Series Characteristic This command takes effect after reconnecting the network card. The configurations will be saved automatically. Parameter Integer type. Enable/ disable customized netmask. 0 Disable. Netmask is set by the rule inside the module. 1 Enable. Netmask is set by . String type. Customized netmask. Only valid when =1. For example: '255.255.255.0'. Example AT+QCFG='netmaskset' +QCFG: 'netmaskset',0 //Query whether customized netmask is enabled. //Customized netmask is disabled OK AT+QCFG='netmaskset',1, '255.255.255.0' OK AT+QCFG='netmaskset' +QCFG: 'netmaskset',1 //Enable customized netmask and set netmask. OK AT+QCFG='netmaskset',0 OK //Disable customized netmask and set netmask. 5.37. AT+QCFG='pingdiscard' Configure Whether to Discard Ping Packet This command configures whether to discard the Ping packet. AT+QCFG='pingdiscard' Configure Whether to Discard Ping Packet Write Command AT+QCFG='pingdiscard'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'pingdiscard', OK If the optional parameter is specified, configure whether to discard the Ping packet: EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 85 / 136 LTE Standard Module Series Maximum Response Time Characteristic OK Or ERROR 300 ms This command takes effect immediately. The configurations will not be saved. Parameter Integer type. Whether to discard Ping packet. 0 Do not discard 1 Discard Ping echo request packet sent from network 5.38. AT+QCFG='urc/ri/restart' Configure RI Pulse Timer This command enables or disables restarting RI pulse timer when a new URC is reported but the last URC RI pulse is finished. AT+QCFG='urc/ri/restart' Configure RI Pulse Timer Write Command AT+QCFG='urc/ri/restart'[,] Response If the optional parameter is omitted, query the current setting: +QCFG:'urc/ri/restart', OK Maximum Response Time Characteristic If the optional parameter is specified, configure RI pulse timer: OK Or ERROR 300 ms The command takes effect immediately. The configuration will not be saved. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 86 / 136 LTE Standard Module Series Parameter Integer type. Enable/disable restarting RI pulse timer when a new URC is reported but the last URC RI pulse is finished. 0 Disable 1 Enable Example AT+QCFG='urc/ri/restart' +QCFG:'urc/ri/restart',1 OK AT+QCFG='urc/ri/restart',1 OK //Query the current setting. //Enable restarting RI pulse timer when a new URC is reported but the last URC RI pulse is finished. 5.39. AT+QCFG='ping/ri' Configure Ping Detection Function This command configures Ping detection function. AT+QCFG='ping/ri' Configure Ping Detection Function Writer Command AT+QCFG='ping/ri'[,[, ] Response If the optional parameters are omitted, query the current setting: +QCFG: 'ping/ri',, OK Maximum Response Time Characteristic If the optional parameters are specified, configure Ping detection function: OK Or ERROR 300 ms The command takes effect immediately. The configurations will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 87 / 136 LTE Standard Module Series Parameter Integer type. Enable/disable Ping detection function. The value occupies one byte. 0 Disable 1 Enable Integer type. Reporting mode if Ping packet is detected. The value occupies one byte. 0 Report URC ping/ri 1 Pull RI pin without reporting URC Example AT+QCFG='ping/ri' +QCFG: 'ping/ri',0,0 //Query the current setting. OK AT+QCFG='ping/ri',1,0 //Enable Ping detection and set reporting URC if Ping packet is detected. OK AT+QCFG='ping/ri' +QCFG: 'ping/ri',1,0 OK 5.40. AT+QCFG='defaultdns' Configure Default DNS for PDP Context This command configures the default DNS for PDP context. AT+QCFG='defaultdns' Configure Default DNS for PDP Context Write Command AT+QCFG='defaultdns'[,[,< dns1>[,]]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'defaultdns',,, OK If is specified to 0, disable configuring default DNS for PDP context: OK If is specified to 1 and other optional parameters are omitted, set primary DNS to '8.8.8.8' and ignore secondary DNS: OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 88 / 136 LTE Standard Module Series Maximum Response Time Characteristic If only and are specified, configure primary DNS, and set the secondary DNS to '8.8.8.8': OK If the optional parameters are specified, set default DNS for PDP context: OK Or ERROR 300 ms The command takes effect immediately. The configurations will not be saved. Parameter Integer type. Enable/disable configuring default DNS for PDP context. 0 Disable 1 Enable String type. Customized primary DNS. For example: '8.8.8.8'. String type. Customized secondary DNS. For example: '114.114.114.114'. Example AT+QCFG='defaultdns' +QCFG: 'defaultdns',0,'0.0.0.0','0.0.0.0' OK AT+QCFG='defaultdns',1 OK AT+QCFG='defaultdns' +QCFG: 'defaultdns',1,'8.8.8.8','0.0.0.0' OK AT+QCFG='defaultdns',1, '114.114.114.114' OK AT+QCFG='defaultdns' +QCFG: 'defaultdns',1,'114.114.114.114','8.8.8.8' OK AT+QCFG='defaultdns',1,'8.8.4.4','114.114.114.114' OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 89 / 136 AT+QCFG='defaultdns' +QCFG: 'defaultdns',1,'8.8.4.4','114.114.114.114' OK AT+QCFG='defaultdns',0 OK LTE Standard Module Series 5.41. AT+QCFG='lpm/dataind' Configure Wake-up Mechanism This command configures wake-up mechanism. AT+QCFG='lpm/dataind' Configure Wake-up Mechanism Write Command AT+QCFG='lpm/dataind'[,,< mask>] Response If the optional parameters are enabled, query the current setting: +QCFG: 'lpm/dataind',, OK Maximum Response Time Characteristic If the optional parameters are specified, configure wake-up mechanism: OK Or ERROR 300 ms The command takes effect immediately. The configurations will be saved automatically. Parameter Integer type. Enable/disable the wake-up mechanism. The value occupies one byte. 0 Disable 1 Enable Integer type. Wake-up trigger mask. The value occupies one byte. If the corresponding bit is set to 1, the module is woken up when SCLK/DTR/USB receives data. Bit0 1 indicates detecting SLCK. If it is TRUE, wakes up the module 0 indicates ignoring SLCK. Bit1 1 indicates detecting DTR. If it is TRUE, wakes up the module 0 indicates ignoring DTR. Bit2 1 indicates detecting USB. If it is TRUE, wakes up the module 0 indicates ignoring USB Bit3–Bit7 Reserved. Always be 0. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 90 / 136 Example AT+QCFG='lpm/dataind' +QCFG: 'lpm/dataind',0,0 OK AT+QCFG='lpm/dataind',1,0 OK AT+QCFG='lpm/dataind' +QCFG: 'lpm/dataind',1,0 OK LTE Standard Module Series 5.42. AT+QCFG='roamserviceex' Control Relevant Functions in Roaming State AT+QCFG='roamserviceex' Control Relevant Functions in Roaming State Write Command AT+QCFG='roamserviceex'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'roamserviceex', OK Maximum Response Time Characteristic If the optional parameter is specified, control the relevant functions in roaming state: OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configurations will be saved automatically. Parameter Integer type. Each bit corresponds to a feature. Set the bit to 1 indicates disabling the corresponding function. Range: 0–3. Default value: 0. Bit 1 Disable dial-up internet access function when UE is in roaming state Bit 2 Disable voice call function when UE is in roaming state EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 91 / 136 LTE Standard Module Series Example AT+QCFG='roamserviceex',1 OK AT+QCFG='roamserviceex' +QCFG: 'roamserviceex',1 //Disable dial-up internet access when UE is in roaming mode. OK AT+QCFG='roamserviceex',2 OK AT+QCFG='roamserviceex' +QCFG: 'roamserviceex',2 //Disable voice call when UE is in roaming mode. OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 92 / 136 LTE Standard Module Series 6 PS Commands 6.1. AT+QCFG='ntp' Specify the Maximum Re-transmission Counts and the Interval for NTP The command specifies the maximum re-transmission times and the interval of NTP. AT+QCFG='ntp' Specify the Maximum Re-transmission Counts and the Interval for NTP Write Command AT+QCFG='ntp'[,,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'ntp',, OK Maximum Response Time Characteristic If the optional parameters are not omitted, specify the maximum re-transmission counts and the interval for NTP: OK Or ERROR 300 ms The command takes effect immediately. The configurations will be saved automatically. Parameter Integer type. NTP re-transmission counts. Range: 1–10. Default value: 3. Integer type. NTP re-transmissions interval. Range: 5–60. Default value: 15. Example AT+QCFG='ntp' +QCFG: 'ntp',3,15 //Query the current setting. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 93 / 136 LTE Standard Module Series OK AT+QCFG='ntp',5,20 OK AT+QCFG='ntp' +QCFG: 'ntp',5,20 //Set NTP re-transmission counts and interval. //Query the current setting. OK 6.2. AT+QCFG='TCP/SendMode' Configure TCP Sending Mode This command configures TCP sending mode. AT+QCFG='TCP/SendMode' Configure TCP Sending Mode Write Command AT+QCFG='TCP/SendMode'[,] Response If optional parameter is omitted, query the current setting: +QCFG: 'TCP/SendMode', OK If the optional parameter is specified, configure TCP sending mode: OK Or ERROR Maximum Response Time Characteristic If error is related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will not be saved. Parameter Integer type. Determine when to send SEND OK. 0 SEND OK is sent immediately after TCP socket sends data from serial port. 1 SEND OK is sent after receiving an ACK from the remote TCP socket. 2 ,SEND OK is sent after receiving an ACK from the remote TCP socket. Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 94 / 136 Example AT+QCFG='TCP/SendMode' +QCFG: 'TCP/SendMode',0 OK AT+QCFG='TCP/SendMode',1 OK LTE Standard Module Series 6.3. AT+QCFG='tcp/windowsize' Configure TCP Window Available Size This command configures the available size of TCP window when sending/receiving data. AT+QCFG='tcp/windowsize' Configure TCP Window Available Size Write Command AT+QCFG='tcp/windowsize',[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'tcp/windowsize',, OK Maximum Response Time Characteristic If the optional parameter is specified, configure TCP window available size: OK Or ERROR 300 ms The command takes effect immediately. The configuration will not be saved. Parameter Integer type. Set the receiving and sending buffer sizes. 0 Receiving buffer size 1 Sending buffer size Integer type. TCP window available size. Range: 16–100. Default value: 16. Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 95 / 136 LTE Standard Module Series 7 CS Commands 7.1. AT+QCFG='amrcodec' Configure AMR Codec This command configures the bandwidth, rate, and byte alignment of the voice codec AMR in different network states. Parameter can be multi-selected (calculate incoming parameters with &). AT+QCFG='amrcodec' Configure AMR Codec Write Command AT+QCFG='amrcodec'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'amrcodec', OK Maximum Response Time Characteristic If the optional parameter is specified, configure AMR codec: OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. Parameter Integer type. Configure AMR codec in ORed. e.g. 7 = 1 + 2 + 4 means GSM AMR NB & GSM AMR WB & GSM HR AMR. 0 No AMR configuration 1 GSM AMR NB 2 GSM AMR WB 4 GSM HR AMR 8 WCDMA AMR WB 16 IMS AMR WB (Mode Set) 32 IMS AMR WB (Octet aligned mode) 63 All above six AMR configurations 64 Reserved 128 Reserved EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 96 / 136 Example AT+QCFG='AMRCODEC' +QCFG: 'amrcodec',5 OK AT+QCFG='amrcodec',63 OK AT+QCFG='amrcodec' +QCFG: 'amrcodec',63 OK LTE Standard Module Series NOTE The default value of varies between different modules. 7.2. AT+QCFG='frhrcodec' Configure GSM EFR/HR/FR Codec This command configures GSM EFR/HR/FR codec. AT+QCFG='frhrcodec' Configure GSM EFR/HR/FR Codec Write Command AT+QCFG='frhrcodec'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'frhrcodec', OK Maximum Response Time Characteristic If the optional parameter is specified, configure GSM EFR/HR/FR codec: OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configuration will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 97 / 136 LTE Standard Module Series Parameter Integer type. Configure GSM EFR/HR/FR codec in ORed. e.g. 7 = 1 + 2 + 4, means GSM EFR/HR/FR are selected. Default value: 7. 0 No codec configuration 1 GSM FR 2 GSM HR 4 GSM EFR Example AT+QCFG='frhrcodec' +QCFG: 'frhrcodec',7 OK AT+QCFG='frhrcodec',3 OK AT+QCFG='frhrcodec' +QCFG: 'frhrcodec',3 OK 7.3. AT+QCFG='bip/auth' Configure PDP Authentication Type in BIP Process This command configures PDP authentication type in BIP data transmission process. AT+QCFG= bip/auth' Configure PDP Authentication Type in BIP Process Write Command AT+QCFG='bip/auth'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'bip/auth', OK Maximum Response Time If the optional parameter is specified, set the type of PDP authentication in the BIP process: OK Or ERROR 300 ms EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 98 / 136 LTE Standard Module Series Characteristic This command takes effect immediately. The configuration will be saved automatically. Parameter Integer type. PDP authentication type. 0 No PDP authentication 1 PAP 2 CHAP NOTE 1. PDP in BIP process generally does not require authentication. 2. Currently this command is only supported for IDEMIA operator. Example AT+QCFG='bip/auth' +QCFG: 'bip/auth',0 OK AT+QCFG='bip/auth',1 OK AT+QCFG='bip/auth' +QCFG: 'bip/auth',1 //Set PDP authentication type as PAP in the BIP process. OK 7.4. AT+QCFG='SMS/ListMsgMap' List Message Map This command lists the message map with in the storage specified by AT+CPMS. See document [1] for details about the command. AT+QCFG='SMS/ListMsgMap' List Message Map Write Command AT+QCFG='SMS/ListMsgMap', Response +QCFG: 'SMS/ListMsgMap',, OK Or ERROR If error is related to ME functionality: EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 99 / 136 Maximum Response Time Characteristic LTE Standard Module Series +CME ERROR: 300 ms / Parameter String type. Message type. 'REC UNREAD' Received unread messages 'REC READ' Received read messages 'STO UNSENT' Stored unsent messages 'STO SENT' Stored sent messages String type. Bit map of total messages in the storage specified by of AT+CPMS. If the bit is 1, it means the message is on the type specified by . If the bit is 0, it means the message is not on the type specified by ; The position of the bit in bit map specified by indicates the message index in the storage specified by of AT+CPMS. Error code. See Chapter 13. Example AT+CPMS? +CPMS: 24,40,24,40,24,40 OK AT+QCFG='sms/listmsgmap','REC UNREAD' //List the received unread message map. +QCFG: 'sms/listmsgmap','REC UNREAD','000F5B0000' OK 7.5. AT+QCFG='ims/ut' Enable/Disable IMS/UT Function This command configures IMS/UT function. AT+QCFG='ims/ut' Enable/Disable IMS/UT Function Write Command AT+QCFG='ims/ut'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'ims/ut',,, OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 100 / 136 LTE Standard Module Series Maximum Response Time Characteristic If the optional parameter is specified, enable/disable the IMS/UT Function: OK or ERROR If error is related to ME functionality: +CME ERROR: 300 ms This command takes effect after the module is rebooted. The configurations will be saved automatically. Parameter Integer type. Enable/disable IMS/UT function. 0 Disable 1 Enable Integer type. Supplementary service over LTE state is available or not. 0 Unavailable 1 Available Integer type. USSD over LTE state is available or not. 0 Unavailable 1 Available Error code. See Chapter 13. NOTE 1. UT is a sub function of IMS function. UT is running over IMS, and IMS is running over LTE. 2. If IMS/UT function is disabled, MUST be 0 and supplementary service (eg: CCFC/CCWA) over LTE is unavailable and use CSFB instead. Example AT+QCFG='ims/ut' +QCFG: 'ims/ut',1,1,0 OK AT+QCFG='ims/ut',0 OK AT+QCFG='ims/ut' +QCFG: 'ims/ut',0,0,0 //UT is enabled, Supplementary service over LTE is available, and USSD over LTE is unavailable //Disable IMS/UT function and supplementary service uses CSFB. OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 101 / 136 LTE Standard Module Series 7.6. AT+QCFG='ims' Configure IMS Function This command configures IMS function. AT+QCFG='ims' Configure IMS Function Write Command AT+QCFG='ims'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'ims',, OK If the optional parameter is specified, configure IMS function: OK Or ERROR Maximum Response Time Characteristic If error is related to ME functionality: +CME ERROR: 300 ms This command takes effect after the module is rebooted. The configurations will be saved automatically. Parameter Integer type. Configure IMS function. 0 Do not configure IMS. The default setting at MBN file is used. 1 Forcedly enable IMS function 2 Forcedly disable IMS function Integer type. Enabled/disable VoLTE. 0 Disable 1 Enable Example AT+QCFG='ims' +QCFG: 'ims',0,0 OK AT+QCFG='ims',1 OK AT+QCFG='ims' +QCFG: 'ims',1,1 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 102 / 136 LTE Standard Module Series OK 7.7. AT+QCFG='ltesms/format' Set SMS Format in LTE Mode This command sets the SMS format in LTE mode. AT+QCFG='ltesms/format' Set SMS Format in LTE Mode Write Command AT+QCFG='ltesms/format'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'ltesms/format', OK If the optional parameter is specified, set SMS format in LTE mode: OK Or ERROR Maximum Response Time Characteristic If error is related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately. The configuration will not be saved. Parameter Integer type. SMS format in LTE mode. For EC21-V and EC25-V modules, the default value is 0; for other modules, the default value is 1. 0 CDMA format 1 GSM format Error code. See Chapter 13. Example AT+CMGF=1 OK AT+QCFG='ltesms/format',0 OK AT+CMGS='15021012496' > This is a test from Quectel //Set CDMA format for SMS in LTE mode. //Send CDMA format SMS in LTE mode. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 103 / 136 +CMGS: 24 OK AT+QCFG='ltesms/format',1 OK AT+CMGS='15021012496' > This is a test from Quectel +CMGS: 25 OK LTE Standard Module Series //Set GSM format for SMS in LTE mode. //Send GSM format SMS in LTE mode. 7.8. AT+QCFG='volte_disable' Enable/Disable VoLTE This command enables or disables VoLTE. AT+QCFG='volte_disable' Enable/Disable VoLTE Write Command AT+QCFG='volte_disable'[,] Response If the optional parameter is omitted, query the current setting: +QCFG='volte_disable', OK Maximum Response Time Characteristic If the optional parameter is specified, enable/disable VoLTE function: OK Or ERROR 300 ms This command takes effect after the module is rebooted. The configurations will be saved automatically. Parameter Integer type. Enable/disable VoLTE. 0 Enable 1 Disable Example AT+QCFG='volte_disable' +QCFG: 'volte_disable',0 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 104 / 136 OK AT+QCFG='volte_disable',1 OK //VoLTE is disabled. LTE Standard Module Series 7.9. AT+QCFG='sms/omadm' Set OMADM Message Parsing Mode This command sets OMADM message parsing mode. AT+QCFG='sms/omadm' Set OMADM Message Parsing Mode Write Command AT+QCFG='sms/omadm'[,] Response If the optional parameter is omitted, query the current setting: +QCFG='sms/omadm', OK Maximum Response Time Characteristic If the optional parameter is specified, set the OMADM massage parsing mode: OK Or ERROR 300 ms This command takes effect after the module is rebooted. The configurations will be saved automatically. Parameter Integer type. OMADM message parsing mode. 0 OMADM short message is parsed 1 OMADM short message is not parsed Example AT+QCFG='sms/omadm' +QCFG: 'sms/omadm',0 OK AT+QCFG='sms/omadm',1 OK AT+QCFG='sms/omadm' +QCFG: 'sms/omadm',0 //Query the current setting. //Set the value of OMADM SMS to 1. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 105 / 136 LTE Standard Module Series OK 7.10. AT+QCFG='imsreg/iptype' Configure the IP Type for IMS Registration This command configures the IP type for IMS registration. AT+QCFG='imsreg/iptype' Configure the IP Type for IMS Registration Write Command AT+QCFG='imsreg/iptype'[,] Response If the optional parameters are omitted, query the current configuration: +QCFG='imsreg/iptype', OK Maximum Response Time Characteristics If the optional parameters are specified, set the IP type for IMS registration: OK Or ERROR 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. Configure IP type for IMS registration. 0 IPv4 1 IPv6 Example AT+QCFG='imsreg/iptype' +QCFG: 'imsreg/iptype',0 //The current configuration is IPv4. OK AT+QCFG='imsreg/iptype',1 OK //Configure the IP type when IMS registering to IPv6. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 106 / 136 AT+QCFG='imsreg/iptype' +QCFG: 'imsreg/iptype',1 OK LTE Standard Module Series 7.11. AT+QCFG='sim/recovery' Configure (U)SIM Card Hot-plug This command configures (U)SIM card hot-plug. AT+QCFG='sim/recovery' Configure (U)SIM Card Hot-plug Write Command AT+QCFG='sim/recovery'[,,,] Response If the optional parameters are omitted, query the current configuration: +QCFG: 'sim/recovery',,, OK If the optional parameters are specified, configure (U)SIM card hot-plug: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. The number of times to resend an APDU immediately after sending an APDU to receive an error response. Integer type. Automatic detection cycle. Unit: second. Integer type. The number of times of automatic detection. Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 107 / 136 LTE Standard Module Series NOTE This command is a software hot-plug implementation, which corresponds to the hardware hot-plug implementation through AT+QSIMDET. Example AT+QCFG='sim/recovery' +QCFG: 'sim/recovery',3,0,0 OK //The feature of software hot-plug is disabled. 7.12. AT+QCFG='siminvalirecovery' Enable/Disable Re-attach Request This command enables/disables re-attach request after (U)SIM card attachment failure. AT+QCFG='siminvalirecovery' Enable/Disable Re-attach Request Write Command AT+QCFG='siminvalirecovery'[,,,] Response If the optional parameters are omitted, query the current configuration: +QCFG: 'siminvalirecovery',,, OK Maximum Response Time Characteristics If the optional parameters are specified, enable/disable re-attach request after (U)SIM card attachment failure: OK Or ERROR 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. Enable/disable re-attach request. 1 Enable 0 Disable Integer type. Time interval between two attach requests. Unit: s. Range: 1–60. Default EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 108 / 136 LTE Standard Module Series value: 5. This parameter is only valid when =1. Integer type. The maximum number of attaching request. Range: 1–255. Default value: 5. When the value is 255, it indicates unlimited number of attaching requests. NOTE An invalid (U)SIM card is required when testing this command. Example AT+QCFG='siminvalirecovery' +QCFG: 'siminvalirecovery',208,0,72 OK 7.13. AT+QCFG='roaming/voicecall' Enable/Disable Voice Call in Roaming Mode This command enables/disables the feature of voice call in roaming mode. AT+QCFG='roaming/voicecall' Enable/Disable Voice Call in Roaming Mode Write Command AT+QCFG='roaming/voicecall'[,] Response If the optional parameter is omitted, query the current configuration: +QCFG: 'roaming/voicecall', OK Maximum Response Time Characteristics If the optional parameter is specified, enable/disable the feature of voice call in roaming mode: OK Or ERROR 300 ms The command takes effect after rebooting; The configuration will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 109 / 136 LTE Standard Module Series Parameter Integer type. Enable/disable the feature of Voice Call when UE is in the roaming mode. 0 Enable 1 Disable 7.14. AT+QCFG='voice_busytone' Control Busy Tone Playback When the module registers on the MCC/MNC (311/480) network, and initiates a call to peer, but the peer hangs up the call caused by on call, busy tone will appear. This command controls busy tone playback. AT+QCFG='voice_busytone' Control Busy Tone Playback Write Command AT+QCFG='voice_busytone'[,] Response If the optional parameter is omitted, query the current configuration: +QCFG: 'voice_busytone', OK Or ERROR Maximum Response Time Characteristics If the optional parameter is specified, control busy tone playback: OK Or ERROR 250 ms The command takes effect immediately; the configuration will be saved automatically. Parameter Integer type. Enable/disable busy tone playback. 0 Disable 1 Enable EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 110 / 136 LTE Standard Module Series NOTE 1. Busy tone control is enabled by default if the module registers on the MCC/MNC (311/480) network. Disable this function through AT+QCFG='voice_busytone',0. 2. If this function has not been configured by the module through Write Command before, ERROR will be returned by Read Command. Example AT+QCFG=? … +QCFG: 'voice_busytone',(0,1) … OK AT+QCFG='voice_busytone' +QCFG: 'voice_busytone',0 OK AT+QCFG='voice_busytone',1 OK //Return the supported parameter range. //Query the current setting. //Enable busy tone playback. 7.15. T+QCFG=''call_control'' Enable/Disable Module Voice Call Feature This command enables/disables MO and MT voice call feature of the module. AT+QCFG='call_control' Enable/Disable Module Voice Call Feature Write Command AT+QCFG=''call_control'[,,] Response If the optional parameters are omitted, query the current configuration: +QCFG: ''call_control'',, OK Maximum Response Time If the optional parameter is specified, enable/disable MO and MT voice call feature of the module: OK Or ERROR 300 ms EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 111 / 136 LTE Standard Module Series Characteristics The command takes effect immediately; the configuration will be saved automatically. Parameter Integer type. Indicate whether to disable MO voice call feature. 0 Do not disable 1 Disable Integer type. Indicate whether to disable MT voice call feature. 0 Do not disable 1 Disable Example AT+QCFG=? … +QCFG: ''call_control'',(0,1),(0,1) … OK AT+QCFG='call_control' +QCFG: ''call_control'',0,0 OK ATD10086; OK //Make a MO voice call. ATH OK AT+QCFG='call_control',1,0 OK ATD10086; ERROR //Failed to make a MO voice call. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 112 / 136 LTE Standard Module Series 8 PPP Command 8.1. AT+QCFG='ppp/termframe' Enable/Disable the PPP TERM Frame Sending This command enables/disables the PPP TERM frame sending when PPP is hung up by module itself. AT+QCFG='ppp/termframe' Enable/Disable the PPP TERM Frame Sending Write Command AT+QCFG='ppp/termframe'[,] Response If the optional parameter is omitted, query the current configuration: +QCFG: 'ppp/termframe', OK If the configuration parameter is specified, enable/disable the PPP TERM frame sending: OK Or ERROR Maximum Response Time Characteristics If error is related to ME functionality: +CME ERROR: 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. Enable/disable TERM frame sending when hang up PPP by module itself. 0 Disable 1 Enable Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 113 / 136 LTE Standard Module Series NOTE If AT+QPPPDROP hangs up PPP with TERM frame, module will send TERM frame to MCU no matter whether is 0 or 1. Example AT+QCFG='ppp/termframe',1 OK AT+QCFG='ppp/termframe' +QCFG: 'ppp/termframe',1 OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 114 / 136 LTE Standard Module Series 9 USB Commands 9.1. AT+QCFG='usbnet' Configure the Network Card Type Interface This command configures the network card type interface. AT+QCFG ='usbnet' Configure the Network Card Type Interface Write Command AT+QCFG='usbnet'[,] Response If the optional parameter is omitted, query the current configuration: +QCFG: 'usbnet', OK If the configuration parameter is specified, set the network card type interface: OK Or ERROR Maximum Response Time Characteristics If error is related to ME functionality: +CME ERROR: 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. Network card type interface. 0 RmNet interface 1 ECM interface 2 MBIM interface 3 RNIDS interface Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 115 / 136 LTE Standard Module Series 9.2. AT+QCFG='usbcfg' Configure VID, PID and Porting Settings The command configures VID, PID and porting settings for the module. AT+QCFG='usbcfg' Configure VID, PID and Porting Settings Write Command AT+QCFG='usbcfg'[,,,,,,,,,] Response If the optional parameters are omitted, query the current setting: +QCFG:'usbcfg',,,,,,< modem>,,, OK Maximum Response Time Characteristics If the optional parameters are specified, configure VID, PID and porting settings: OK Or ERROR 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. Vendor ID of USB device. The maximum value is 65535. Integer type. Product ID of USB device. The maximum value is 65535. Integer type. Status of USB DIAG port. 0 Disable 1 Enable Integer type. Status of USB NMEA port. 0 Disable 1 Enable Integer type. Status of USB AT port. 0 Disable 1 Enable Integer type. Status of USB Modem port. 0 Disable 1 Enable Integer type. Status of USB net device. 0 Disable 1 Enable Integer type. Status of USB ADB device. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 116 / 136 0 Disable 1 Enable Integer type. UAC status. 0 Disable 1 Enable Example AT+QCFG='usbcfg',0x2C7C,0x0125,1,1,1,1,1,0,0 OK AT+QCFG='usbcfg' +QCFG: 'usbcfg',0x2C7C,0x125,1,1,1,1,1,0,0 OK LTE Standard Module Series 9.3. AT+QCFG='usbee' Control the USB Device Loading The command controls whether USB device loading needs to wait for modem to start. AT+QCFG='usbee' Control the USB Device Loading Write Command AT+QCFG= 'usbee'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'usbee', OK Maximum Response Time Characteristics If the optional parameter is specified, control whether USB device loading needs to wait for modem to start: OK Or ERROR 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. 0 The USB device loading not need to wait for Modem to start 1 The USB device loading need to wait for Modem to start EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 117 / 136 LTE Standard Module Series 9.4. AT+QCFG='usbmode' Get USB Mode This command queries USB mode or enables/disables the module to automatically report URCs about bus mode change. AT+QCFG=usbmode' Get USB Mode Write Command AT+QCFG='usbmode'[,] Response If the optional parameter is omitted, query the current setting: +QCFG:'usbmode',, OK Maximum Response Time Characteristics If the optional parameter is specified, query USB mode: OK Or ERROR 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. Enable/disable to automatically report URCs about USB mode change. 0 Disable 1 Enable String type. Indicate the USB mode. 'SUSPEND' 'CONFIGURED' 'DISCONNECTED' 'CONNECTED' 'UNKNOWN' NOTE 1. When =1, URCs can be reported to UART1. 2. Only when ='CONFIGURED', data can be transferred via USB. 3. Only when VBUS of USB PHY is connected (such as charger), can be switched to 'CONNECTED'. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 118 / 136 Example AT+QCFG='usbmode' +QCFG:'usbmode',0,'SUSPEND' OK AT+QCFG='usbmode',1 OK +QCFG:'usbmode',1,'CONFIGURED' LTE Standard Module Series //Set to 1 for report URCs about bus mode change. //The URC about USB mode 'CONFIGURED'. 9.5. AT+QCFG='spi/set' Configure SPI or UART Driver AT+QCFG='spi/set' Configure SPI or UART Driver Read command AT+QCFG='spi/set'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'spi/set', OK Maximum Response Time Characteristics If the optional parameter is specified, set SPI or UART driver: OK Or ERROR 250 ms This command takes effect after rebooting. The configuration will be saved automatically. Parameter Integer type. Configure pin feature. 0 Configure pin as general GPIO 1 Initialize pin as uart6 2 initialize pin as spi6 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 119 / 136 Example AT+QCFG=? …. +QCFG: 'spi/set',(0-2) OK AT+QCFG='spi/set',1 OK AT+QCFG='spi/set' +QCFG: 'spi/set',1 OK LTE Standard Module Series //Query the range of this command. //Initialized pins as uart6. //Query the current setting. 9.6. AT+QCFG='usbenum/seoctl' Enable Optimization of USB Enumeration Failure AT+QCFG='usbenum/seoctl' Enable Optimization of USB Enumeration Failure Write Command AT+QCFG='usbenum/seoctl'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'usbenum/seoctl', OK Maximum Response Time Characteristics If the optional parameter is specified, enable optimization of USB enumeration failure: OK Or ERROR 300 ms This command will take effect after rebooting. The configuration will be saved automatically. Parameter Integer type. Indicate whether to enable optimizing USB enumeration failure. 0 Disable 1 Enable EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 120 / 136 LTE Standard Module Series Example AT+QCFG=? … +QCFG: 'usbenum/seoctl',(0,1) … OK AT+QCFG='usbenum/seoctl',1 OK AT+QCFG='usbenum/seoctl' +QCFG: 'usbenum/seoctl',1 OK //Test command. //Enable optimizing USB enumeration failure. //Query the current setting. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 121 / 136 LTE Standard Module Series 10 CDMA Commands 10.1. AT+QCFG='cdma/pppauth' Enable/Disable PPP Authentication Optimization under CDMA This command enables/disables the PPP authentication optimization under CDMA. AT+QCFG='cdma/pppauth' Enable/Disable PPP Authentication Optimization under CDMA Write Command Response AT+QCFG='cdma/pppauth'[,] If the optional parameter is omitted, query the current setting: +QCFG: 'cdma/pppauth', OK If the optional parameter is specified, enable/disable the PPP authentication optimization under CDMA: OK Or ERROR Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: 300 ms The command takes effect immediately; The configuration will not be saved. Parameter Integer type. Whether to enable the PPP authentication optimization under CDMA. 0 Disable 1 Enable Error code. See Chapter 13. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 122 / 136 LTE Standard Module Series Example AT+QCFG='cdma/pppauth' +QCFG: 'cdma/pppauth',0 //The PPP authentication optimization is disabled by default. OK AT+QCFG='cdma/pppauth',1 OK AT+QCFG='cdma/pppauth' +QCFG: 'cdma/pppauth',1 //Enable the PPP authentication optimization under CDMA. OK 10.2. AT+QCFG='ehrpd' Configure CDMA Mode This command configures the CDMA network mode which the module expects to use. AT+QCFG='ehrpd' Configure CDMA Mode Write Command AT+QCFG='ehrpd'[,] Response If the optional parameter is omitted, query the current setting: +QCFG:'ehrpd', OK Maximum Response Time Characteristics If the optional parameter is specified, set the CDMA mode: OK Or ERROR 300 ms The command takes effect after rebooting; The configuration will be saved automatically. Parameter Integer type. Configure the network mode. 0 HDRSCP_REV0_PROTOCOLS_ONLY 1 HDRSCP_REVA_PROTOCOLS_WITH_MFPA 2 HDRSCP_REVA_PROTOCOLS_WITH_MFPA_AND_EMPA 3 HDRSCP_REVB_PROTOCOLS_WITH_MMPA 4 HDRSCP_REVA_PROTOCOLS_WITH_EHRPD 5 HDRSCP_REVB_PROTOCOLS_WITH_EHRPD 6 HDRSCP_REVA_PROTOCOLS_WITH_EHRPD_AND_IRAT EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 123 / 136 LTE Standard Module Series 7 HDRSCP_REVB_PROTOCOLS_WITH_EHRPD_AND_IRAT NOTE If this NV is not set, the module will use HDRSCP_REVA_PROTOCOLS_WITH_MFPA by default. Example AT+QCFG='ehrpd' +QCFG: 'ehrpd',2 OK AT+QCFG='ehrpd',2 OK //Query the current network mode. //Configure the network mode. 10.3. AT+QCFG='cdmasms/cmtformat' Set CMT Format of CDMA SMS PDU This command sets CMT format of CDMA SMS PDU. AT+QCFG ='cdmasms/cmtformat' Set CMT Format of CDMA SMS PDU Write Command AT+QCFG='cdmasms/cmtformat'[,< n>] Response If the optional parameter is omitted, query the current setting: +QCFG: 'cdmasms/cmtformat', OK If the optional parameter is specified, set CMT format of CDMA SMS PDU: OK Or ERROR Maximum Response Time Characteristics If error is related to ME functionality: +CME ERROR: 300 ms The command takes effect after rebooting; The configuration will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 124 / 136 LTE Standard Module Series Parameter Integer type. CMT format of CDMA SMS PDU. 0 CDMA 1 GSM Error code. See Chapter 13. Example AT+CMGF=0 OK AT+CNMI=2,2 OK AT+QCFG='cdmasms/cmtformat',0 OK //Show CDMA SMS content directly and not store it. //Set CDMA format. //Receive a new CDMA SMS ^HCMT: ,46 0000021002020702C6155968C69C0601FC081B00031D2B8001061022E831258003061610102128230 801000A0100 AT+QCFG='cdmasms/cmtformat',1 //Set GSM format. OK //Receive a new CDMA SMS. +CMT: ,24 00000B818155563001F700006101011282320004AE207109 EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 125 / 136 LTE Standard Module Series 11 SMS Commands 11.1. AT+QCFG='urcport/sms' Set URC Output Port of Short Message This command sets URC output port of short message. AT+QCFG='urcport/sms' Set URC Output Port of Short Message Write Command AT+QCFG='urcport/sms'[,] Response If the optional parameter is omitted, query the current setting: +QCFG: 'urcport/sms'' OK Maximum Response Time Characteristics If the optional parameter is specified, set URC output port of short message: OK Or ERROR 300 ms The command takes effect immediately; The configuration will be saved automatically. Parameter Integer type. URC output port of short message. 0 Using default URC output port 1 Set URC output port of short message as 'uart2' NOTE Use AT+QDIAGPORT=1 to configure debug UART port as AT port and restart module. See document [1] for details about the command. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 126 / 136 LTE Standard Module Series Example AT+QDIAGPORT=1 OK //Configure debug UART port as AT port. //Restart module AT+QURCCFG='urcport','uart1' //Configuration of URC output port is 'uart1'. OK AT+QCFG='urcport/sms' +QCFG: 'urcport/sms',0 //Query URC output port of short message. OK AT+QCFG='urcport/sms',1 OK AT+QCFG='urcport/sms' +QCFG: 'urcport/sms',1 //Set URC output port of short message as 'uart2'. //Query URC output port of short message as 'uart2'. OK 11.2. AT+QCFG=''sms_retry'' Configure SMS Retry Period and Interval This command configures SMS retry period and interval. AT+QCFG=''sms_retry'' Configure SMS Retry Period and Interval Write Command AT+QCFG=''sms_retry''[,[,< period>]] Response If the optional parameters are omitted, query the current setting: +QCFG: 'sms_retry',, OK Maximum Response Time Characteristics If any of the optional parameters is specified, configure SMS retry period and interval: OK Or ERROR 300 ms The command takes effect after rebooting; The configuration will be saved automatically. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 127 / 136 Parameter LTE Standard Module Series Integer type. SMS retry interval. Range: 0–255. Unit: second. Integer type. SMS retry period. Range: 0–255. Unit: second. NOTE If is set to 0, SMS will not retry when an error occurs. Example AT+QCFG=? … +QCFG: 'sms_retry',(0-255),(0-255) … OK AT+QCFG=''sms_retry'' +QCFG: 'sms_retry',45,180 OK AT+QCFG=''sms_retry'',5 OK AT+QCFG=''sms_retry'' +QCFG: 'sms_retry',5,180 OK AT+QCFG=''sms_retry'',5,30 OK AT+QCFG=''sms_retry'' +QCFG: 'sms_retry',5,30 OK EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 128 / 136 LTE Standard Module Series 11.3. AT+QCFG='sms_control' Enable/Disable Delivering or Submitting SMS This command enables/disables delivering or submitting SMS. AT+QCFG='sms_control' Enable/Disable Delivering or Submitting SMS Write Command AT+QCFG='sms_control'[, ,] Response If the optional parameters are omitted, query the current setting: +QCFG: 'sms_control',, OK Maximum Response Time Characteristics If the optional parameters are specified, enable/disable delivering or submitting SMS. OK Or ERROR 300 ms The command takes effect immediately; The configuration will be saved automatically. Parameter Integer Type. Enable/disable submitting SMS. 0 Disable 1 Enable Integer Type. Enable/disable delivering SMS. 0 Disable 1 Enable NOTE 1. After disabling sending SMS, AT+CMGS/AT+CMSS will return an error. See document [1] for details about the two commands. 2. This command takes effect in both 3GPP and 3GPP2 messages. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 129 / 136 Example AT+QCFG='sms_control' +QCFG: 'sms_control',1,1 OK AT+QCFG='sms_control',0,1 OK AT+CMGS='17301836745' +CMS ERROR: 302 AT+QCFG='sms_control',0,0 OK LTE Standard Module Series //Query SMS control configuration. //Disable submitting SMS. //The operation is not allowed. //Disable sending and receiving SMS. EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 130 / 136 LTE Standard Module Series 12 Appendix A References Table 3: Related Document Document Name [1] Quectel_EC2x&EG9x&EG2x-G&EM05_Series_AT_Commands_Manual Table 4: Terms and Abbreviations Abbreviation 3GPP AP AMR APDU APN BIP CDMA CHAP CS CSFB CP DHCP EFR EPC Description 3rd Generation Partnership Project Application Processor Adaptive Multi-Rate Application Protocol Data Unit Access Point Name Bearer Independent Protocol Code Division Multiple Access Challenge-Handshake Authentication Protocol Circuit Switching Circuit Switched Fallback Control Plane Dynamic Host Configuration Protocol Enhanced Full Rate Speed Encoding Evoloved Packet Core EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 131 / 136 ETWS ESM EFS FPLMN GPRS GSM HSDPA HSUPA HPLMN LTE MCC/MNC ME MNC MS MSC MO MT NTP NVRAM OEM OMADM PAP PS PDN PDP LTE Standard Module Series Earthquake and Tsunami Warning System EPS Session Management Embedded File System Forbidden Public Land Mobile Network General Packet Radio Service Global System for Mobile Communications High Speed Downlink Packet Access High Speed Uplink Packet Access Home Public Land Mobile Network Long-Term Evolution Mobile Country Code Mobile Equipment Mobile Network Code Mobile Station Microsoft Snap-In Control Mobile Originated Mobile Terminated Network Time Protocol Non-Volatile Random Access Memory Original Equipment Manufacturer Open Mobile Alliance Device Management Password Authentication Protocol Packet Switching Packet Data Network Packet Data Protocol EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 132 / 136 PLMN PPP RRC PCM PDU QMI RX SAR SGSN SMS SRLTE TA TDD TCP UE UMTS URC UDP USB (U)SIM VoLTE VID WCDMA LTE Standard Module Series Public Land Mobile Network Point to Point Protocol Radio Resource Control Pulse Code Modulation Packet Data Unit Qualcomm Message Interface Receive Specific Absorption Rate Serving GPRS Support Node Short Message Service Single Radio LTE Terminal Adapter Time Division Duplex Transmission Control Protocol User Equipment Universal Mobile Telecommunications System Unsolicited Result Code User Datagram Protocol Universal Serial Bus (Universal) Subscriber Identity Module Voice (voice calls) over LTE Vendor ID Wideband Code Division Multiple Access EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 133 / 136 LTE Standard Module Series 13 Appendix B Summary of Code Final result code +CME ERROR: indicates an error related to mobile equipment or network. The operation is similar to ERROR result code. None of the following commands in the same command line is executed. Neither ERROR nor OK result code shall be returned. values are mostly used by common message commands. The following table lists most of general and GRPS related ERROR codes. For some GSM protocol failure cause described in GSM specifications, the corresponding ERROR codes are not included. Table 5: Different Coding Schemes of +CME ERROR: Code of 0 1 2 3 4 5 6 7 10 11 12 13 14 Meaning Phone failure No connection to phone Phone-adaptor link reserved Operation not allowed Operation not supported PH-SIM PIN required PH-FSIM PIN required PH-FSIM PUK required SIM not inserted SIM PIN required SIM PUK required SIM failure SIM busy EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 134 / 136 LTE Standard Module Series 15 SIM wrong 16 Incorrect password 17 SIM PIN2 required 18 SIM PUK2 required 20 Memory full 21 Invalid index 22 Not found 23 Memory failure 24 Text string too long 25 Invalid characters in text string 26 Dial string too long 27 Invalid characters in dial string 30 No network service 31 Network timeout 32 Network not allowed - emergency calls only 40 Network personalization PIN required 41 Network personalization PUK required 42 Network subset personalization PIN required 43 Network subset personalization PUK required 44 Service provider personalization PIN required 45 Service provider personalization PUK required 46 Corporate personalization PIN required 47 Corporate personalization PUK required 901 Audio unknown error 902 Audio invalid parameters EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 135 / 136 LTE Standard Module Series 903 Audio operation not supported 904 Audio device busy EC2x&EG2x&EG9x&EM05_Series_QCFG_AT_Commands_Manual 136 / 136

L89 R2.0&LC29H&LC79H AGNSS Application Note GNSS Module Series Version: 1.0 Date: 2022-05-19 Status: Released GNSS Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 1 / 44 GNSS Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 2 / 44 GNSS Module Series About the Document Document Information Title L89 R2.0&LC29H&LC79H AGNSS Application Note Subtitle GNSS Module Series Document Type Application Note Document Status Released Revision History Version 1.0 Date 2021-10-14 2022-05-19 Description Creation of the document First official release L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 3 / 44 GNSS Module Series Contents About the Document ................................................................................................................................... 3 Contents ....................................................................................................................................................... 4 Table Index................................................................................................................................................... 6 Figure Index ................................................................................................................................................. 7 1 Introduction .......................................................................................................................................... 8 1.1. Differences Between Host EPO and Flash EPO....................................................................... 8 1.2. AGNSS Requirements............................................................................................................... 9 2 Download EPO Files .......................................................................................................................... 10 2.1. Get EPO Files from Server...................................................................................................... 10 2.2. EPO File Format ...................................................................................................................... 11 2.2.1. EPO File Format – GPS Only ........................................................................................ 12 2.2.2. EPO File Format – BDS/Galileo Only ............................................................................ 13 2.2.3. EPO File Format – GPS + GLONASS ........................................................................... 15 2.3. EPO File Types ........................................................................................................................ 15 2.4. Recommended Download Procedures of EPO Files .............................................................. 16 2.5. EPO File Validity Period .......................................................................................................... 17 3 AGNSS Implementation..................................................................................................................... 19 3.1. AGNSS with Flash EPO .......................................................................................................... 19 3.1.1. Binary Protocol ............................................................................................................... 19 3.1.2. EPO Data Transfer Protocol .......................................................................................... 21 3.1.2.1 Pseudo Code for EPO Data Transfer Protocol........................................................ 21 3.1.3. AGNSS Procedure with Flash EPO ............................................................................... 25 3.2. AGNSS with Host EPO............................................................................................................ 26 3.2.1. Recommended Sequence for Host EPO ....................................................................... 26 3.2.2. Sample Code to Send EPO ........................................................................................... 27 4 AGNSS Related Messages ................................................................................................................ 30 4.1. PAIR001 PAIR_ACK ................................................................................................................ 30 4.2. PAIR010 PAIR_REQUEST_AIDING ....................................................................................... 31 4.3. PAIR470 PAIR_EPO_GET_STATUS ...................................................................................... 32 4.4. PAIR471 PAIR_EPO_SET_DATA ........................................................................................... 33 4.5. PAIR472 PAIR_EPO_ERASE_FLASH_DATA ........................................................................ 34 4.6. PAIR590 PAIR_TIME_SET_REF_UTC ................................................................................... 35 4.7. PAIR600 PAIR_LOC_SET_REF.............................................................................................. 36 5 Download EPO Data with QGNSS .................................................................................................... 38 5.1. Download Flash EPO with QGNSS......................................................................................... 38 5.2. Download Host EPO with QGNSS .......................................................................................... 39 6 AGNSS Implementation Example..................................................................................................... 41 6.1. Flash EPO Implementation...................................................................................................... 41 6.2. Host EPO Implementation ....................................................................................................... 42 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 4 / 44 GNSS Module Series 7 Appendix References ........................................................................................................................ 44 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 5 / 44 GNSS Module Series Table Index Table 1: Differences between Flash EPO and Host EPO ............................................................................ 8 Table 2: AGNSS Related Commands .......................................................................................................... 9 Table 3: Download URL of EPO Files ........................................................................................................ 10 Table 4: EPO Data SVID Range .................................................................................................................11 Table 5: EPO File Types............................................................................................................................. 15 Table 6: Description of Binary Protocol Fields ........................................................................................... 20 Table 7: Start of EPO Binary Format .......................................................................................................... 20 Table 8: EPO Data Binary Format.............................................................................................................. 20 Table 9: End of EPO Binary Format ........................................................................................................... 20 Table 10: Terms and Abbreviations ............................................................................................................ 44 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 6 / 44 GNSS Module Series Figure Index Figure 1: EPO File Format – GPS Only ..................................................................................................... 12 Figure 2: Format of Several Segments of EPO Files................................................................................. 12 Figure 3: EPO File Format – BDS/Galileo Only......................................................................................... 13 Figure 4: Galileo EPO Header ................................................................................................................... 14 Figure 5: BDS EPO Header ....................................................................................................................... 14 Figure 6: EPO File Format – GPS + GLONASS........................................................................................ 15 Figure 7: Recommended Download Procedures of EPO Files ................................................................. 16 Figure 8: Binary Protocol Structure ............................................................................................................ 19 Figure 9: AGNSS Procedure with Flash EPO ............................................................................................ 25 Figure 10: Suggested Sequence for Host EPO ......................................................................................... 27 Figure 11: QGNSS Interface for Setting Flash EPO .................................................................................. 38 Figure 12: Download Flash EPO File......................................................................................................... 39 Figure 13: QGNSS Interface for Setting Host EPO ................................................................................... 40 Figure 14: Download Host EPO File .......................................................................................................... 40 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 7 / 44 GNSS Module Series 1 Introduction EPO (Extended Prediction Orbit) is an AGNSS feature implemented by the chipset supplier, which improves the sensitivity of the GNSS receiver and therefore shortens its TTFF. This document mainly describes EPO file downloading, AGNSS implementation, EPO related PAIR commands and how to download EPO data through the QGNSS tool. 1.1. Differences Between Host EPO and Flash EPO Both Flash EPO and Host EPO allow the GNSS receiver to achieve a shorter TTFF, but their differences make each of them suitable for different applications. Host EPO (also called Real Time AGNSS) allows the receiver to store in RAM up to 6 hours of assistance data, which are sent to the receiver through NMEA PAIR commands listed in Chapter 4. For Host EPO, there is no data retention after the GNSS receiver reboots and the data should be re-downloaded. Flash EPO, on the other hand, allows the receiver to store in flash 3-, 7- or 14-day assistance data, which are sent to the receiver through the Binary Protocol defined by the chipset supplier. Flash EPO enables the receiver to reuse all assistance information stored in flash before the information expires. See Chapter 2.5 for the validity period of EPO files. Table 1: Differences between Flash EPO and Host EPO Item Storage Space Storage Capacity Protocol Flash EPO Flash 3, 7 or 14 day assistance data Binary Host EPO RAM 6-hour assistance data NMEA NOTE The maximum flash memory EPO data retention period is 14 days for GPS-only and GPS + GLONASS EPO files, 7 days for Galileo EPO files and 3 days for BDS EPO files. If 30-day GPS-only or GPS + GLONASS EPO files are sent, only the first 14 days of EPO data will be stored. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 8 / 44 GNSS Module Series 1.2. AGNSS Requirements The host needs to provide the Reference Time, Reference Position and EPO data to the GNSS receiver. The information provided by the host must meet the following requirements so that the GNSS receiver can make better use of EPO: ⚫ The Reference Time should be accurate within 3 seconds and must be specified in UTC time. ⚫ The Reference Position should be accurate within 30 km from the receiver’s actual position. Keep in mind that if the receiver’s view of the sky is limited, the accuracy of the Reference Position needs to be increased. ⚫ The EPO data should be valid. The receiver can benefit from any of the assistance data to improve the TTFF. All assistance data (Reference Time, Reference Position and EPO data) are useful but none of them are mandatory. If some of them are not available or have expired, it is recommended to avoid using them. The host can send the Reference Time, Reference Position and EPO data to the GNSS receiver through the messages listed in the following table. See Chapter 4 for a detailed description of these messages. Table 2: AGNSS Related Commands Packet Type $PAIR471 $PAIR590 $PAIR600 Data Content GPS/GLONASS/Galileo/BDS EPO data for a single satellite. Reference UTC Time. Reference Position. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 9 / 44 GNSS Module Series 2 Download EPO Files Quectel does not provide any Service Level Agreement for EPO files. Download EPO data to your own server and send them to devices to ensure EPO data availability. 2.1. Get EPO Files from Server Table 3: Download URL of EPO Files EPO Type Unified QEPO Unified QEPO Unified QEPO Unified QEPO EPO EPO EPO EPO GNSS Type EPO File URL File Name GPS only GPS + GLONASS BDS only Galileo only GPS only GPS + GLONASS BDS only Galileo only http://wpepodownload.mediatek.co m/QGPS.DAT?vendorinfo http://wpepodownload.mediatek.co m/QG_R.DAT?vendorinfo http://wpepodownload.mediatek.co m/QBD2.DAT?vendorinfo http://wpepodownload.mediatek.co m/QGA.DAT?vendorinfo http://wpepodownload.mediatek.co m/EPO_GPS_3_X.DAT?vendorinfo http://wpepodownload.mediatek.co m/EPO_GR_3_X.DAT?vendorinfo http://wpepodownload.mediatek.co m/EPO_BDS_3.DAT?vendorinfo http://wpepodownload.mediatek.co m/EPO_GAL_X.DAT?vendorinfo Single name: QGPS.DAT Single name: QG_R.DAT Single name: QBD2.DAT Single name: QGA.DAT X = 1–10 EPO_GPS_3_1.DAT to EPO_GPS_3_10.DAT X = 1–10 EPO_GR_3_1.DAT to EPO_GR_3_10.DAT EPO_BDS_3.DAT X = 3 or 7 EPO_GAL_3.DAT or EPO_GAL_7.DAT The following is a complete URL sample: http://wpepodownload.mediatek.com/QGPS.DAT?vendor=AAA&project=BBB&device_id=CCC ⚫ The query string starts with '?' and is separated by '&'. ⚫ The values of 'vendor' and 'project' (AAA and BBB in the example) are issued by Quectel. Contact L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 10 / 44 GNSS Module Series Quectel Technical Support to get the value. The value of 'device_id' (CCC in the example) contains two parts – one is assigned by Quectel and the other by the customer. For example: if CCC = XXX_YYY, the value XXX is provided by Quectel and you can contact Quectel Technical Support to get the value, while YYY can be assigned by yourself and it must be a unique value, such as IMEI. Each device must have a unique ID. NOTE There will be up to 10 files as the GPS-only or GPS + GLONASS EPO files may include a maximum of 30 days of predictions. Slices of 30-day EPO: _1 for days 1 to 3, _2 for days 4 to 6, ... _10 for days 28 to 30. 2.2. EPO File Format This part mainly illustrates the format of EPO files. The SVID numbers of EPO files for different constellations are shown below. Table 4: EPO Data SVID Range GNSS Type GPS GLONASS Galileo BDS PRN 1–32 1–24 1–36 1–54, 55–63 EPO Data SVID 1–32 65–88 101–136 201–254, 190–198 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 11 / 44 2.2.1. EPO File Format – GPS Only GNSS Module Series Day1 Day2 ... Day7 ... Day29 Day30 EPO Format (1 day) Segment UTC Segment1 0:00-6:00 Segment2 6:00-12:00 Segment3 12:00-18:00 Segment4 18:00-24:00 EPO Format (1 Segment) SV1 SV2 ... SV31 SV32 EPO Format (1 SV) Data GPS_Hour SVID Byte offset 0[LSB]~2[MSB] 3 Data ... Byte offset ... ... 4~7 ... 64~67 ... 8~11 CheckSum 68~71 Figure 1: EPO File Format – GPS Only GPS_Secs = GPS_Hour * 3600 GPS_Week Number = GPS_Secs / 604800 GPS TOW = GPS_Secs % 604800 An EPO file contains GPS Time (GPS_Week, GPS_Hour and GPS_Secs). The maximum unit in GPS Time is GPS week which starts at approximately midnight of January 5th to 6th, 1980. The following figure illustrates the format of several segments of EPO files. SAT data SAT data 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 EPO SET 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 EPO SET 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 EPO SET Figure 2: Format of Several Segments of EPO Files L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 12 / 44 GNSS Module Series The basic unit of an EPO file is SAT Data and the size of each SAT Data is 72 bytes. One EPO SET contains 32 SAT Data, so the data size of an EPO SET is 2304 bytes. Each EPO file contains several EPO SETs and thus the file size must be a multiple of 2304 bytes. An EPO SET is valid for 6 hours. Therefore, there will be 4 EPO SETs for one day. 2.2.2. EPO File Format – BDS/Galileo Only Galileo EPO data consist of the 72-byte header and 3- or 7- day fundamental EPO data. BDS EPO data consist of the 72-byte header and 3-day EPO data only. The EPO format for both has no fixed size. Header 72 bytes Day1 Day2 Day3 ... Day7 EPO Format (1 day) Segment UTC Segment1 0:00-6:00 Segment2 6:00-12:00 Segment3 12:00-18:00 Segment4 18:00-24:00 EPO Format (1 Segment) SV SV ... SV SV EPO Format (1 SV) Data GPS_Hour SVID Byte offset 0[LSB]~2[MSB] 3 Data ... Byte offset ... ... 4~7 ... 64~67 ... 8~11 CheckSum 68~71 Figure 3: EPO File Format – BDS/Galileo Only The 72-byte header contains the SV available bitmask that can be used for calculating the available satellite ID. When the SV available bitmask position is 1, it indicates that the satellite is available, and the number of bits indicates the satellite ID. For example, you can parse the data from Figure 4: Galileo EPO Header as follows. ⚫ SVID is FE for Galileo. ⚫ SV available bitmask: 09 67 94 5D DF. ⚫ Total available SVs: 22. ⚫ Available SVs: 1, 2, 3, 4, 5, 7, 8, 9, 11, 12, 13, 15, 19, 21, 24, 25, 26, 27, 30, 31, 33, 36. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 13 / 44 GNSS Module Series Data *** Byte offset 0~2 Example SVID 3 SV available bitmask(Lbytes) 4[LSB]~7[MSB] FE DF 5D 94 67 Data SV available bitmask(Hbytes) Byte offset 16[LSB]~19[MSB] Example 09 00 00 00 *** 20~23 *** 8~11 *** 24~27 *** 12~15 *** 18~31 Figure 4: Galileo EPO Header You can parse the data from Figure 5: BDS EPO Header as follows. ⚫ SVID is FF for BDS. ⚫ SV available bitmask: 3F FF BF FC 3F FF. ⚫ Total available SVs: 41. ⚫ Available SVs: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46. Data *** Byte offset 0~2 Example SVID 3 SV available bitmask(Lbytes) 4[LSB]~7[MSB] FF FF 3F FC BF Data SV available bitmask(Hbytes) Byte offset 16[LSB]~19[MSB] Example FF 3F 00 00 *** 20~23 *** 8~11 *** 24~27 Figure 5: BDS EPO Header *** 12~15 *** 18~31 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 14 / 44 2.2.3. EPO File Format – GPS + GLONASS GNSS Module Series SAT data SAT data 1 2 1 2 31 32 65 66 31 32 65 66 87 88 87 88 1 2 31 32 65 66 87 88 GPS EPO SET GLONASS EPO SET Figure 6: EPO File Format – GPS + GLONASS The basic unit of an EPO file is SAT Data, and the size of SAT Data is 72 bytes. In GPS + GLONASS EPO files, one EPO SET contains 56 SAT Data, so the EPO SET data size is 4032 bytes. Each EPO file contains several EPO SETs. The file size must be a multiple of 4032 bytes. An EPO SET is valid for 6 hours. Therefore, there will be 4 EPO SETs for one day. 2.3. EPO File Types The EPO data can be downloaded in the form of files. You can select the most suitable file type to download based on the availability of a data connection and storage space of your application. See Table 3: Download URL of EPO Files and Table 5: EPO File to decide on the file type to be downloaded. Table 5: EPO File Types EPO Type EPO EPO GNSS Type GPS only Galileo only Description 3–14 days of prediction orbit (ephemeris). Split into 5 files, each containing 3-day information. 3- or 7-day prediction orbit (ephemeris). L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 15 / 44 GNSS Module Series EPO EPO Unified QEPO Unified QEPO Unified QEPO BDS only 3-day prediction orbit (ephemeris). GPS + GLONASS GPS only GPS + GLONASS BDS/Galileo only 3–14 days of prediction orbit (ephemeris). Split into 5 files, each containing 3-day information. 6-hour prediction orbit (ephemeris). Single file containing the latest available GPS EPO data. 6-hour prediction orbit (ephemeris). Single file containing the latest available GPS + GLONASS EPO data. 6-hour prediction orbit (ephemeris). Single file containing the latest available BDS/Galileo EPO data. 2.4. Recommended Download Procedures of EPO Files Set daily timer to check EPO effectiveness Daily timer expires Power on GNSS receiver Will EPO files expire today?1) Yes Download 3-day EPO files for backup Verify downloaded data2) Do you have valid EPO files?3) Yes No Download unified QEPO files EPO aiding with backup file Verify downloaded data Position fixed Back up prepared EPO files Position fixed Figure 7: Recommended Download Procedures of EPO Files NOTE 1. 1) Users must know the current UTC time to download the valid EPO files. 2. 2) Send $PAIR470 to check if the data are correct. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 16 / 44 GNSS Module Series 3. 3) If the device is powered-off for a long time, EPO files stored in flash may expire. 2.5. EPO File Validity Period EPO file validity period is related to the current UTC time. The EPO file validity period can be obtained from the last segment of the EPO file. See Figure 1: EPO File Format – GPS Only or the sample of how to calculate EPO file validity period (GPS_Hour + 6). It is necessary to download the EPO file 12 hours in advance. The following codes show the conversion between UTC time and GPS time. void utc_to_gpstime(kal_uint32 year, //Input year kal_uint8 mon, //Input month: 1~12 kal_uint8 day, //Input day: 1~31 kal_uint8 hour, //Input hour: 0~23 kal_uint8 min, //Input minute: 0~59 kal_uint8 sec, //Input second: 0~59 kal_int32* wn, //Output GPS week number double* tow) //Output GPS time of week { kal_int32 iYearsElapsed; //Elapsed years since 1980 kal_int32 iDaysElapsed; //Elapsed days since Jan 5/Jan 6, 1980 kal_int32 iLeapDays; //Leap days since Jan 5/Jan 6, 1980 kal_int32 i; //Number of days at the start of each month (ignore leap years). kal_uint16 doy[12] = {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334}; iYearsElapsed = year - 1980; i = 0; iLeapDays = 0; while (i <= iYearsElapsed) { if ((i % 100) == 20) { if ((i % 400) == 20) { iLeapDays++; } } else if ((i % 4) == 0) { iLeapDays++; } i++; } /* iLeapDays = iYearsElapsed / 4 + 1; */. if ((iYearsElapsed % 100) == 20) { if (((iYearsElapsed % 400) == 20) && (mon <= 2)) { iLeapDays--; } L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 17 / 44 GNSS Module Series } else if (((iYearsElapsed % 4) == 0) && (mon <= 2)) { iLeapDays--; } iDaysElapsed = iYearsElapsed * 365 + doy[mon - 1] + day + iLeapDays - 6; //Convert time to GPS weeks and seconds. *wn = iDaysElapsed / 7; *tow = (double)(iDaysElapsed % 7) * 86400 + hour * 3600 + min * 60 + sec; } L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 18 / 44 GNSS Module Series 3 AGNSS Implementation This chapter describes two AGNSS implementation methods: Host EPO and Flash EPO. ⚫ Implement AGNSS with Host EPO The host sends EPO data to the GNSS receiver through NMEA PAIR commands, such as $PAIR471. ⚫ Implement AGNSS with Flash EPO The EPO data are downloaded to the flash of GNSS receiver through Binary Protocol. Flash EPO retains data longer than Host EPO. 3.1. AGNSS with Flash EPO Flash EPO can store up to 14 days of EPO assistance data in flash, which enables the receiver to use the available data since boot time. The communication protocol of Flash EPO is Binary Protocol. Thus, you need to download assistance data to the GNSS receiver in the binary format specified in this document. See Chapter 3.1.2 and Chapter 3.1.3 for details. 3.1.1. Binary Protocol Frame preamble fixed as 0x04 0x24 2-byte Message ID 2-byte Message Preamble MsgID Length Payload Range for checksum calculation 1-byte Frame tail fixed as Checksum 0xAA 0x44 Checksum Tail Figure 8: Binary Protocol Structure L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 19 / 44 GNSS Module Series Table 6: Description of Binary Protocol Fields Field Preamble MsgID Length Payload Checksum Tail Length (Byte) 2 2 2 Variable 1 2 Description Fixed as 0x2404. Little-endian. Message ID. Payload length. Unit: byte. Default packet size: 72 bytes. Little-endian. Payload data to be transferred. The checksum is the 8-bit exclusive OR of all bytes in the message between (but not including) the Preamble and the Checksum. Fixed as 0x44AA. Little-endian. The EPO binary format is divided into start message, EPO data message and end message. Table 7: Start of EPO Binary Format Preamble MsgID Length 0x04 0x24 0xB0 0x04 1 2 Bytes 2 Bytes 2 Bytes Payload ‘G’ – GPS ‘R’ – GLONASS ‘E’ – Galileo ‘C’ – BDS 2 Bytes Checksum 0x** 1 Byte Tail 0xAA 0x44 2 Bytes Table 8: EPO Data Binary Format Preamble 0x04 0x24 2 Bytes MsgID 0xB1 0x04 2 Bytes Length 72 2 Bytes Payload EPO Data 72 Bytes Checksum 0x** 1 Byte Tail 0xAA 0x44 2 Bytes Table 9: End of EPO Binary Format Preamble MsgID Length 0x04 0x24 0xB2 0x04 1 Payload ‘G’ – GPS ‘R’ – GLONASS Checksum 0x** Tail 0xAA 0x44 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 20 / 44 2 Bytes 2 Bytes 2 Bytes ‘E’ – Galileo ‘C’ – BDS 2 Bytes GNSS Module Series 1 Byte 2 Bytes 3.1.2. EPO Data Transfer Protocol When transmitting assistance data, the host first sends the start message packet, then splits the EPO data into data packets and sends them, and finally sends the end message packet. The host should follow the EPO Data Transfer Protocol when transferring EPO data to the GNSS receiver. 3.1.2.1 Pseudo Code for EPO Data Transfer Protocol Pseudo code for the EPO data transfer procedure of GPS + GLONASS, for reference only: #define GNSS_APP_BINARY_BINARY_PREAMBLE1 #define GNSS_APP_BINARY_BINARY_PREAMBLE2 #define GNSS_APP_BINARY_BINARY_ENDWORD1 #define GNSS_APP_BINARY_BINARY_ENDWORD2 (0x04) (0x24) (0xAA) (0x44) #define GNSS_APP_BINARY_BINARY_PREAMBLE_SIZE (2) #define GNSS_APP_BINARY_BINARY_CHECKSUM_SIZE (1) #define GNSS_APP_BINARY_BINARY_ENDWORD_SIZE (2) #define GNSS_APP_BINARY_BINARY_CONTROL_SIZE (GNSS_APP_BINARY_BINARY_PREAMBLE_SIZE + GNSS_APP_BINARY_BINARY_CHECKSUM_SIZE + GNSS_APP_BINARY_BINARY_ENDWORD_SIZE) #define GNSS_APP_BINARY_BINARY_MESSAGE_ID_SIZE (2) #define GNSS_APP_BINARY_BINARY_PAYLOAD_LENGTH_SIZE (2) #define GNSS_APP_BINARY_BINARY_PAYLOAD_HEADER_SIZE (GNSS_APP_BINARY_BINARY_MESSAGE_ID_SIZE + GNSS_APP_BINARY_BINARY_PAYLOAD_LENGTH_SIZE) #define GNSS_APP_BINARY_BINARY_MAX_DATA_SIZE (512) #define GNSS_APP_BINARY_BINARY_MAX_PAYLOAD_DATA_SIZE (GNSS_APP_BINARY_BINARY_MAX_DATA_SIZE - GNSS_APP_BINARY_BINARY_CONTROL_SIZE - GNSS_APP_BINARY_BINARY_PAYLOAD_HEADER_SIZE) typedef enum gnss_app_binary_binary_decode_results { GNSS_APP_BINARY_BINARY_DECODE_SUCCESS = 0, GNSS_APP_BINARY_BINARY_DECODE_WRONG_PARAMETER = -1, L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 21 / 44 GNSS Module Series GNSS_APP_BINARY_BINARY_DECODE_WRONG_PREAMBLE = -2, GNSS_APP_BINARY_BINARY_DECODE_WRONG_CHECKSUM = -3, GNSS_APP_BINARY_BINARY_DECODE_WRONG_ENDWORD = -4, }gnss_app_binary_binary_decode_results_t; typedef struct gnss_app_binary_binary_payload { uint16_t message_id; uint16_t data_size; /* actual size of data in payload data buffer */ uint8_t data[GNSS_APP_BINARY_BINARY_MAX_PAYLOAD_DATA_SIZE]; }gnss_app_binary_binary_payload_t; uint8_t gnss_app_binary_calculate_binary_checksum(const gnss_app_binary_binary_payload_t* const payload) { uint8_t checksum = 0; uint8_t* pheader = NULL; uint8_t* pdata = NULL; uint16_t i; if (NULL == payload) { return 0; } /* The checksum is the 8-bit exclusive OR of all bytes in the payload. */ pheader = (uint8_t*)payload; for (i = 0; i < GNSS_APP_BINARY_BINARY_PAYLOAD_HEADER_SIZE; i++) { checksum ^= *pheader; pheader++; } pdata = (uint8_t*)payload->data; for (i = 0; i < payload->data_size; i++) { checksum ^= *pdata; pdata++; } return checksum; } int16_t gnss_app_binary_encode_binary_packet(uint8_t* const buffer, uint16_t max_buffer_size, const gnss_app_binary_binary_payload_t* const payload) { uint8_t* pbyte; uint16_t required_length; if (NULL == buffer || payload == NULL) { return -1; } required_length = payload->data_size + GNSS_APP_BINARY_BINARY_CONTROL_SIZE + GNSS_APP_BINARY_BINARY_PAYLOAD_HEADER_SIZE; L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 22 / 44 GNSS Module Series if (max_buffer_size < required_length) { return -1; } memset((void*)buffer, 0, max_buffer_size); buffer[0] = GNSS_APP_BINARY_BINARY_PREAMBLE1; buffer[1] = GNSS_APP_BINARY_BINARY_PREAMBLE2; pbyte = &buffer[2]; memcpy(pbyte, payload, GNSS_APP_BINARY_BINARY_PAYLOAD_HEADER_SIZE); pbyte += GNSS_APP_BINARY_BINARY_PAYLOAD_HEADER_SIZE; memcpy(pbyte, payload->data, payload->data_size); pbyte += payload->data_size; *pbyte++ = gnss_app_binary_calculate_binary_checksum(payload); *pbyte++ = GNSS_APP_BINARY_BINARY_ENDWORD1; *pbyte = GNSS_APP_BINARY_BINARY_ENDWORD2; return required_length; } FILE* gnss_epo_file = NULL; #define GNSS_MAX_EPO_NUMBER (37) #define GNSS_MAX_RECORD_SIZE (72) static uint32_t gnss_epo_sv_buf[(GNSS_MAX_EPO_NUMBER * GNSS_MAX_RECORD_SIZE) / sizeof(uint32_t)]; int16_t gnss_epo_encode_binary(uint16_t msg_id, char* buffer, uint16_t buffer_size, char* data_input, int32_t data_length) { gnss_app_binary_binary_payload_t payload; int16_t binary_message_length; memset((void*)&payload, 0, sizeof(gnss_app_binary_binary_payload_t)); payload.message_id = msg_id; payload.data_size = (uint16_t)data_length; memcpy(payload.data, data_input, sizeof(uint8_t) * data_length); binary_message_length = gnss_app_binary_encode_binary_packet(buffer, buffer_size, &payload); return binary_message_length; } void gnss_epo_binary_demo() { gnss_app_binary_data_t data; gnss_app_binary_data_result_t result = { 0 }; uint32_t* epobuf; int32_t i; char buffer[500]; uint16_t length = 0; int32_t buffer_size = 0; uint8_t segment = 0; L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 23 / 44 GNSS Module Series uint8_t curr_sys_type = 'G'; //type is the GPS gnss_epo_file = fopen('EPO_GR_3_1.DAT', 'rb'); length = gnss_epo_encode_binary(1200, buffer, 512, &curr_sys_type, 1); gnss_app_uart_send_data(buffer, length); memset(&gnss_epo_sv_buf, 0, sizeof(gnss_epo_sv_buf)); while (gnss_epo_read_data(&gnss_epo_sv_buf, 32 * GNSS_MAX_RECORD_SIZE, segment * (32 + 24) * GNSS_MAX_RECORD_SIZE)) { segment++; for (i = 0; i < 32; i++) { epobuf = (uint32_t*)(gnss_epo_sv_buf + ((i * GNSS_MAX_RECORD_SIZE) / 4)); length = gnss_epo_encode_binary(1201, buffer, 512, (char*)epobuf, GNSS_MAX_RECORD_SIZE); gnss_app_uart_send_data(buffer, length); } memset(&gnss_epo_sv_buf, 0, sizeof(gnss_epo_sv_buf)); } length = gnss_epo_encode_binary(1202, buffer, 512, &curr_sys_type, 1); gnss_app_uart_send_data(buffer, length); curr_sys_type = 'R'; //type is the GLONASS length = gnss_epo_encode_binary(1200, buffer, 512, &curr_sys_type, 1); gnss_app_uart_send_data(&data, &result); memset(&gnss_epo_sv_buf, 0, sizeof(gnss_epo_sv_buf)); segment = 0; while (gnss_epo_read_data(&gnss_epo_sv_buf, 37 * GNSS_MAX_RECORD_SIZE, (segment * (32 + 24) * GNSS_MAX_RECORD_SIZE) + (32 * GNSS_MAX_RECORD_SIZE))) { segment++; for (i = 0; i < 24; i++) { epobuf = (uint32_t*)(gnss_epo_sv_buf + ((i * GNSS_MAX_RECORD_SIZE) / 4)); length = gnss_epo_encode_binary(1201, buffer, 512, (char*)epobuf, GNSS_MAX_RECORD_SIZE); gnss_app_uart_send_data(buffer, length); } memset(&gnss_epo_sv_buf, 0, sizeof(gnss_epo_sv_buf)); } length = gnss_epo_encode_binary(1202, buffer, 512, &curr_sys_type, 1); gnss_app_uart_send_data(buffer, length); fclose(gnss_epo_file); } L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 24 / 44 3.1.3. AGNSS Procedure with Flash EPO Power on GNSS GNSS Module Series Do you have an EPO file? NO YES Has EPO file expired? YES Erase EPO file NO Send Reference Time Download EPO files with Binary Protocol Verify downloaded data Restart GNSS Send Reference Position Position fixed Figure 9: AGNSS Procedure with Flash EPO 1. Power on the GNSS module. 2. Check if there are EPO data in the GNSS module flash memory with $PAIR470. 3. If the flash memory contains EPO data, go to the next step to check data validity. Otherwise, download EPO data to the GNSS module and verify the downloaded data, then restart the GNSS module and go to Step 5. 4. Check whether the EPO file in the GNSS module flash memory has expired. 5. If the EPO file is still valid, go to Step 6. Otherwise, erase the expired EPO file with $PAIR472 and download a new EPO file. 6. Send reference time to the GNSS module with $PAIR590. 7. Send reference position to GNSS module with $PAIR600. 8. Wait for the GNSS module to fix position. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 25 / 44 GNSS Module Series 3.2. AGNSS with Host EPO Host EPO allows for a simpler text-based implementation that enables the receiver to perform a fast start-up where assistance data must be sent to the receiver each time it boots. When using Host EPO, the receiver can only receive one block of assistance data valid for 6 hours. Implementing Host EPO only requires a few PAIR sentences and the whole data transfer can be performed in NMEA mode. See Chapter 4 for detailed description of $PAIR471, $PAIR590 and $PAIR600. 3.2.1. Recommended Sequence for Host EPO After the module is powered on, it sends an aiding request to notify the expiration of the stored GNSS assistance data when both assistance data and ephemeris are invalid. Therefore, if the module does not report an aiding request, it is recommended to determine whether the assistance data have expired by sending $PAIR470 after the host receives the system startup message. The host sends the assistance data in the sequence shown in Figure 10: Suggested Sequence for Host EPO. Host EPO procedure: 1. GNSS module starts up; 2. Host sends Reference Time; 3. Host sends Reference Position; 4. Host sends EPO data. The supplied Reference Time, Reference Position and EPO data must comply with the requirements listed in Chapter 1.2. NOTE In the current implementation, the host needs to wait for a $PAIR001 packet to be returned before sending another segment of EPO data. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 26 / 44 GNSS Receiver Host EPO Sequence GNSS Module Powers Up Start up message Assistance Data (Time) PAIR001 (ACK) Assistance Data (Position) PAIR001 (ACK) Loop [Repeats until all EPO data are sent] EPO Assistance Data Segment 001 PAIR001 (ACK) EPO Assistance Data Segment 002 PAIR001 (ACK) Host needs to wait for ACK packages GNSS Module Series Host Figure 10: Suggested Sequence for Host EPO 3.2.2. Sample Code to Send EPO The following is the reference code to send one segment of EPO data to GNSS chip. It indicates how to construct PAIR messages for GNSS receiver. PAIR messages for Reference Time and Reference Position are not included in this example. #define GNSS_GLONASS_EPO_BASE_ID (64) #define GNSS_GALILEO_EPO_BASE_ID (100) #define GNSS_BDS_EPO_BASE_ID (200) #define MNL_SERVICE_MAX_COMMAND_LEN (352) #define EPO_DEMO_RECORD_SIZE (72) typedef enum{ EPO_DEMO_MODE_GPS, L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 27 / 44 GNSS Module Series EPO_DEMO_MODE_GLONASS, EPO_DEMO_MODE_GALILEO, EPO_DEMO_MODE_BEIDOU }epo_demo_mode_t; int32_t epo_demo_get_sv_prn(int32_t type, uint8_t *data) { int32_t sv_id, sv_prn = 0; sv_id = data[3]; switch(type) { case EPO_DEMO_MODE_GPS: sv_prn = sv_id; break; case EPO_DEMO_MODE_GLONASS: sv_prn = sv_id - GNSS_GLONASS_EPO_BASE_ID; break; case EPO_DEMO_MODE_GALILEO: if(sv_id == 255) { sv_prn = 255; } else { sv_prn = sv_id - GNSS_GALILEO_EPO_BASE_ID; } break; case EPO_DEMO_MODE_BDS: if(sv_id == 255) { sv_prn = 255; } else { sv_prn = sv_id - GNSS_BDS_EPO_BASE_ID; } break; default: sv_prn = 0; } return sv_prn; } void epo_demo_send_data(epo_demo_epo_data_t *data_p, int32_t data_num, int32_t type){ char temp_buffer[MNL_SERVICE_MAX_COMMAND_LEN] = {0}; uint8_t data_buffer[EPO_DEMO_RECORD_SIZE] = {0}; int32_t i; int32_t sv_prn = 0; L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 28 / 44 GNSS Module Series for(i = 0; i < data_num; i++) { unsigned int *epobuf = (unsigned int *)data_buffer; epo_demo_epo_fread(data_p, data_buffer, EPO_DEMO_RECORD_SIZE); sv_prn = epo_demo_get_sv_prn(type, data_buffer); sprintf((char *) temp_buffer, '471,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X,%X', (unsigned int)type, (unsigned int)sv_prn, epobuf[0], epobuf[1], epobuf[2], epobuf[3], epobuf[4], epobuf[5], epobuf[6], epobuf[7], epobuf[8], epobuf[9], epobuf[10], epobuf[11], epobuf[12], epobuf[13], epobuf[14], epobuf[15], epobuf[16], epobuf[17]); gnss_app_send_command_ex(temp_buffer); memset(temp_buffer, 0, MNL_SERVICE_MAX_COMMAND_LEN); } } L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 29 / 44 GNSS Module Series 4 AGNSS Related Messages 4.1. PAIR001 PAIR_ACK Acknowledges a PAIR command. An acknowledgement packet $PAIR001 is returned to inform the sender that the receiver has received the packet. Type: Output Synopsis: $PAIR001,,* Parameter: Field Format Unit Description Numeric - Numeric - Type of command to be acknowledged. 0 = Command has been successfully sent. 1 = Command is being processed. Please wait for the result. 2 = Command sending failed. 3 = is not supported. 4 = Command parameter error. Out of range/some parameters were lost/checksum error. 5 = MNL service is busy. Example: $PAIR001,0,3*38 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 30 / 44 GNSS Module Series 4.2. PAIR010 PAIR_REQUEST_AIDING Notifies the expiration of GNSS assistance data stored in the module. This message is automatically output when the module powers up. Type: Output Synopsis: $PAIR010,,,,* Parameter: Field Format Unit Numeric - Numeric - Numeric Numeric Week Second Description Type of data to be updated. 0 = EPO data 1 = Time 2 = Position Type of GNSS data needed. 0 = GPS data 1 = GLONASS data 2 = Galileo data 3 = BDS data Week Number (accommodating roll-over). Time of Week. Example: //Send GPS EPO data when this sentence is received: $PAIR010,0,0,2044,369413*33 //Send reference time when this sentence is received: $PAIR010,1,-1*16 //Send reference position when this sentence is received: $PAIR010,2,-1*15 NOTE 1. The GNSS system sends this command automatically. Do not send it to the GNSS system. 2. The L89 R2.0 module does not support reporting the expiration of GLONASS and BDS data. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 31 / 44 GNSS Module Series 4.3. PAIR470 PAIR_EPO_GET_STATUS Queries the status of EPO data stored on the GNSS chip. Type: Query Synopsis: $PAIR470,* Parameter: Field Format Unit Numeric - Description GNSS system ID. 0 = GPS 1 = GLONASS 2 = Galileo 3 = BDS Result: Returns a $PAIR001 message and the query result. Query result message format: $PAIR470,,,,,,,,,,* Parameters in the result: Field Format Unit Description Numeric - GNSS system ID. 0 = GPS 1 = GLONASS 2 = Galileo 3 = BDS Numeric - Total number of EPO data sets stored in GNSS chip. Numeric - GPS week number of the first set of EPO data stored in flash. Numeric - GPS TOW of the first set of EPO data stored in flash. Numeric - GPS week number of the last set of EPO data stored in flash. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 32 / 44 GNSS Module Series Numeric Numeric Numeric Numeric Numeric - GPS TOW of the last set of EPO data stored in flash. GPS week number of the first set of EPO data that are currently being used. GPS TOW of the first set of EPO data that are currently being used. GPS week number of the last set of EPO data that are currently being used. GPS TOW of the last set of EPO data that are currently being used. Example: $PAIR470,0*25 $PAIR001,470,0*38 $PAIR470,0,1,2098,194400,2098,216000,2098,194400,2098,216000*38 NOTE The L89 R2.0 module does not support the reporting of GLONASS and BDS data. 4.4. PAIR471 PAIR_EPO_SET_DATA Sends the packet containing EPO data for a single satellite. Type: Input Synopsis: $PAIR471,,,,...,* Parameter: Field Format Numeric Hexadecimal Unit Description GNSS system ID. 0 = GPS - 1 = GLONASS 2 = Galileo 3 = BDS - Satellite PRN number used in EPO data. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 33 / 44 GNSS Module Series - GPS Range: 1–32. GLONASS Range: 1–24. Galileo Range: 1–30. BDS Range: 1–37. Special 255: BDS IONO data. Special 254: Galileo IONO data. 18 words (LSB-first) of one EPO segment data (total 72 bytes). Result: Returns a $PAIR001 message. Example: $PAIR471,1,16,56056272,F2BC0244,4F19AE34,F95C534D,FAE67014,4F19AF6B,F96749BD,9F341F2 D,6F4EA9F,77DB4710,66ADAC2,9ADF3B01,8CC8B19C,29D2D20C,FC5B2E94,1000001C,11005000,7 48B45F4*0A $PAIR001,471,0*39 NOTE The L89 R2.0 module does not support the reporting of GLONASS and BDS data. 4.5. PAIR472 PAIR_EPO_ERASE_FLASH_DATA Erases the EPO data stored in the flash memory. Type: Command Synopsis: $PAIR472* Parameter: None Result: Returns a $PAIR001 message. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 34 / 44 Example: $PAIR472*3B $PAIR001,472,0*3A GNSS Module Series 4.6. PAIR590 PAIR_TIME_SET_REF_UTC Sends reference UTC time to GNSS chip for faster TTFF. Local time should be avoided due to time-zone offset. To achieve a faster TTFF, the reference time should be accurate within 3 seconds and must be specified in UTC time. Type: Set Synopsis: $PAIR590,,,,,,* Parameter: Field Format Numeric Numeric Numeric Numeric Numeric Numeric Unit Year Month Day Hour Minute Second Description UTC year. Minimum value: 1980. UTC month. Range: 1–12. UTC day. Range: 1–31. UTC hours. Range: 0–23. UTC minutes. Range: 0–59. UTC seconds. Range: 0–59. Result: Returns a $PAIR001 message. Example: $PAIR590,2019,2,10,9,0,58*0B $PAIR001,590,0*37 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 35 / 44 GNSS Module Series 4.7. PAIR600 PAIR_LOC_SET_REF Sends reference position to GNSS chip for faster TTFF. Type: Set Synopsis: $PAIR600,,,,,,,* Parameter: Field Format Numeric Numeric Numeric Numeric Numeric Numeric Numeric Unit Degrees Degrees Meter Meter Meter Degrees Meter Description Reference latitude. Range: -90 to 90. Minus: south; plus: north. It is recommended to express this value in floating point with 6 decimal points. Reference longitude. Range: -180 to 180. Minus: west; plus: east. It is recommended to express this value in floating point with 6 decimal points. Reference height. Semi-major RMS accuracy. Semi-minor RMS accuracy. Bearing. Vertical RMS accuracy. Result: Returns a $PAIR001 message. Example: $PAIR600,24.772816,121.022636,175.0,50.0,50.0,0.0,100.0*06 $PAIR001,600,0*3D L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 36 / 44 NOTE This command needs to be sent every time after GNSS module reboots. GNSS Module Series L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 37 / 44 GNSS Module Series 5 Download EPO Data with QGNSS This chapter describes how to download EPO data through QGNSS. Contact Quectel Technical Support for details on QGNSS. 5.1. Download Flash EPO with QGNSS Steps to download Flash EPO with the QGNSS tool: 1. Run the QGNSS tool. 2. In the main interface, click 'AGNSS' → 'Assistant GNSS Offline' as shown below. Figure 11: QGNSS Interface for Setting Flash EPO 3. Download EPO file to the module. a) Click the 'Connect' button to connect to the FTP server. b) Select EPO file. c) Click the 'Download selected file' button to download the EPO file to computer. d) Select Satellites type. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 38 / 44 e) Click the '…' button to select EPO file. f) Click the 'Download' button to download the EPO file to module. GNSS Module Series Figure 12: Download Flash EPO File 5.2. Download Host EPO with QGNSS Steps to download Host EPO with the QGNSS tool: 1. Run the QGNSS tool. 2. In the main interface, click 'AGNSS' → 'Assistant GNSS Online' as shown below. L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 39 / 44 GNSS Module Series Figure 13: QGNSS Interface for Setting Host EPO 3. Configure parameters: a) Check 'Use Current Position' to use current position. b) Check 'Use Current UTC' to use current time. c) Click 'Transfer' to download host EPO file. Figure 14: Download Host EPO File L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 40 / 44 GNSS Module Series 6 AGNSS Implementation Example This chapter gives examples of how to download EPO files to the module. 6.1. Flash EPO Implementation Blue: Sent data Red: ACK information //Host sends $PAIR472*3B to erase the EPO data stored in the flash memory: $PAIR472*3B //Module returns a $PAIR001 message: $PAIR001,472,0*3A //Host sends EPO start message in hexadecimal format: 04 24 B0 04 01 00 52 E7 AA 44 //Module returns an ACK message: 04 24 E8 03 04 00 B0 04 00 00 5B AA 44 //Host sends EPO data in hexadecimal format: 04 24 B1 04 48 00 BF 96 05 41 6E 3A 74 05 C3 21…….AA 44 //Module returns an ACK message: 04 24 E8 03 04 00 B1 04 00 00 5A AA 44 //Host sends EPO data in hexadecimal format: 04 24 B1 04 48 00 BF 96 05 42 09 3A 74 0C CA 77……. AA 44 //Module returns an ACK message: 04 24 E8 03 04 00 B1 04 00 00 5A AA 44 …… //Host sends EPO end data in hexadecimal format: 04 24 B2 04 01 00 52 E5 AA 44 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 41 / 44 //Module returns an ACK message: 04 24 E8 03 04 00 B2 04 00 00 59 AA 44 //Host queries the EPO data status stored in the GNSS chip: $PAIR470,0*25 //Module returns $PAIR001 and $PAIR470 messages: $PAIR001,470,0*38 $PAIR470,0,1,2098,194400,2098,216000,2098,194400,2098,216000*38 GNSS Module Series 6.2. Host EPO Implementation Blue: Sent data Red: ACK information //Host sends the power-on GNSS system command $PAIR002: $PAIR002*38 //Module returns a $PAIR001 message: $PAIR001,002,0*39 //Module outputs $PAIR010 messages automatically: $PAIR010,1,-1*16 $PAIR010,2,-1*15 //Host sends reference UTC time command $PAIR590: $PAIR590,2021,10,18,08,59,00*3B //Module returns a $PAIR001 message: $PAIR001,590,0*37 //Host sends reference position information command $PAIR600: $PAIR600,31.822203,117.115219,175.0,50.0,50.0,0.0,100.0*0F //Module returns a $PAIR001 message: $PAIR001,600,0*3D //Host sends EPO data: $PAIR471,0,1,10596C0,A174051A,1B2EDE67,9F0BB6,17C37A4,1B2EDE22,F85B368E,845FB0C9,6F1 8C40,23557111,2A4CBD5,A60348AB,FEF7E24,2F236B88,2439FDC6,1000001C,0,4860BF93*44 //Module returns a $PAIR001 message: L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 42 / 44 GNSS Module Series $PAIR001,471,0*39 //Host sends EPO data: $PAIR471,0,2,20596C0,F0740341,1B2EEE36,5F3FAA,17E07E6,1B2E1100,F8C1048F,84A50985,6F1B D33,29192005,D651ED6,A600506D,256C95F,20430E67,C36C910D,1000001C,0,FAC0DA552A 33 43 0D 0A*3C //Module returns a $PAIR001 message: $PAIR001,471,0*39 …… //Host sends EPO data: $PAIR471,0,7,70596C0,377403C2,1B2E41F1,F757006,C57EB,1B2EBF14,F89F543F,8986E880,6F1E6 93,DC3908E,DA7BB7,A603A757,8FBA37BF,21C8A8F0,A2247EAD,1000001C,22000000,DDACBBB6*0 B //Module returns a $PAIR001 message: $PAIR001,471,0*39 L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 43 / 44 GNSS Module Series 7 Appendix References Table 10: Terms and Abbreviations Abbreviation ACK AGNSS EPO GLONASS GNSS GPS IMEI IONO MNL RAM SV SVID TOW TTFF UART UTC URL Description Acknowledgement Assisted GNSS (Global Navigation Satellite System) Extended Prediction Orbit Global Navigation Satellite System (Russia) Global Navigation Satellite System Global Positioning System International Mobile Equipment Identity Ionospheric MTK Navigation Lib Random Access Memory Space Vehicle Space Vehicle Identification Time of Week Time to First Fix Universal Asynchronous Receiver/Transmitter Coordinated Universal Time Uniform Resource Locator L89_R2.0&LC29H&LC79H_AGNSS_Application_Note 44 / 44

BG95&BG77&BG600L Series Network Searching Scheme Introduction LPWA Module Series Version: 2.0 Date: 2022-04-24 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 1 / 41 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 2 / 41 LPWA Module Series About the Document Revision History Revision Date Author Description 1.0 2020-01-13 Elvis SUN Initial 1. Added the applicable module BG600L-M3. 2. Updated the frequency bands of BG95 series and BG77: deleted the eMTC band B14 and NB-IoT B26 (Chapters 2.1 and 2.2). 3. Updated the RAT/PLMN selection procedure figure (Figure 2). 2.0 2022-04-24 Forest WANG 4. Updated notes of network searching AT commands (Chapter 5). 5. Updated the default setting of in AT+QCFG='iotopmode' (Chapter 5.3). 6. Added some typical problems and corresponding cause analysis (Chapters 7.3, 7.4 and 7.5). 7. Added the FAQ chapter (Chapter 8). BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 3 / 41 LPWA Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 Figure Index ................................................................................................................................................ 6 1 Introduction ......................................................................................................................................... 7 1.1. Applicable Modules .................................................................................................................... 7 2 Supported RATs and Bands .............................................................................................................. 8 2.1. Supported RATs and Bands of BG95 Series ............................................................................. 8 2.2. Supported RATs and Bands of BG77 ........................................................................................ 8 2.3. Supported RATs and Bands of BG600L-M3 .............................................................................. 9 3 Network Searching/Registration Processes .................................................................................. 10 4 Factors Influencing Network Registration Speed ......................................................................... 13 4.1. RAT/PLMN Selection ............................................................................................................... 13 4.2. LTE EARFCN Scan.................................................................................................................. 14 5 Network Searching Related AT Commands................................................................................... 16 5.1. AT+QCFG='nwscanseq' Configure RAT Searching Sequence ........................................... 16 5.2. AT+QCFG='nwscanmode' Configure RAT(s) to be Searched for........................................ 17 5.3. AT+QCFG='iotopmode' Configure Network Category to be Searched for under LTE RAT 18 5.4. AT+QCFG='band' Configure Frequency Band .................................................................... 19 6 Solutions to Speed up Network Searching .................................................................................... 23 6.1. Overview of NB-IoT Network Searching Time ......................................................................... 23 6.2. Solutions to Speed up Network Searching .............................................................................. 24 6.2.1. Disable NB-IoT and Enable Required RAT(s) .............................................................. 24 6.2.2. Enable NB-IoT Bands Supported by Current Operator Only........................................ 24 7 Typical Problems and Root Cause Analysis.................................................................................. 26 7.1. Network Searching Sequence Determined by (U)SIM Card Files .......................................... 26 7.2. Network Searching Sequence Determined by RPLMN/RPLMNACT Stored on Module Flash27 7.3. Long Network Registration Time in Roaming State ................................................................. 28 7.4. Network Registration Request Rejected by Network .............................................................. 30 7.5. Long Network Registration Time if AT Commands are Executed Frequently ......................... 34 8 FAQ..................................................................................................................................................... 35 9 Summary of CME ERROR Codes .................................................................................................... 37 10 Appendix References ....................................................................................................................... 39 BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 4 / 41 LPWA Module Series Table Index Table 1: Applicable Modules......................................................................................................................... 7 Table 2: Frequency Bands of BG95 Series Module..................................................................................... 8 Table 3: Frequency Bands of BG77 Module ................................................................................................ 9 Table 4: Frequency Bands of BG600L-M3 Module...................................................................................... 9 Table 5: Network Searching Time of NB-IoT Bands with Different SNR ................................................... 14 Table 6: eMTC/NB-IoT Band Deployment over the World (For Reference Only)...................................... 15 Table 7: Solutions to Speed up Network Searching (Disable NB-IoT)....................................................... 24 Table 8: Solutions to Speed up Network Searching (Enable NB-IoT Bands Supported) .......................... 24 Table 9: Related Documents ...................................................................................................................... 39 Table 10: Terms and Abbreviations ............................................................................................................ 39 BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 5 / 41 LPWA Module Series Figure Index Figure 1: Network Searching and Registration Process............................................................................ 10 Figure 2: RAT/PLMN Selection .................................................................................................................. 13 Figure 3: RAT Searching Sequence Determined by (U)SIM Card Files.................................................... 26 Figure 4: RAT Searching Sequence Determined by RPLMN/RPLMNACT Stored on Module Flash ....... 27 Figure 5: Behaviour of the Module if (U)SIM is Card in Roaming State .................................................... 28 Figure 6: GMM Cause Information Element .............................................................................................. 31 Figure 7: EMM Cause Information Element............................................................................................... 32 Figure 8: Module Received Reject Cause Code........................................................................................ 33 Figure 9: Module Initiated T3247 Timer and Tried to Register Another Available Network ....................... 33 Figure 10: Restore the Network Information .............................................................................................. 35 BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 6 / 41 LPWA Module Series 1 Introduction This document outlines the supported RATs and frequency bands of Quectel BG95 series, BG77 and BG600L-M3 modules, and describes the network searching scheme by illustrating network searching/registration processes and related AT commands to help users understand the network searching mechanism of the modules. Furthermore, the document describes some problems observed in the process of network searching, and provides the corresponding root cause analysis. 1.1. Applicable Modules Table 1: Applicable Modules Module Series BG95 BG77 BG600L Model BG95-M1 BG95-M2 BG95-M3 BG95-M4 BG95-M5 BG95-M6 BG95-MF BG77 BG600L-M3 Description Cat M1 only Cat M1/Cat NB2 Cat M1/Cat NB2/EGPRS Cat M1/Cat NB2, 450 MHz Supported Cat M1/Cat NB2/EGPRS, Power Class 3 Cat M1/Cat NB2, Power Class 3 Cat M1/Cat NB2, Wi-Fi Positioning Cat M1/Cat NB2 Cat M1/Cat NB2/EGPRS BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 7 / 41 LPWA Module Series 2 Supported RATs and Bands 2.1. Supported RATs and Bands of BG95 Series Quectel BG95 series module supports three RATs: eMTC, NB-IoT and EGPRS. ⚫ Default RATs: eMTC, NB-IoT and EGPRS ⚫ Default searching sequence: eMTC → NB-IoT → EGPRS ⚫ If the three RATs need to be supported synchronously or other searching sequences are needed, set the relevant configuration values via AT commands. The details of AT commands are provided in Chapter 5. The following table lists the supported frequency bands of BG95 series module. Table 2: Frequency Bands of BG95 Series Module RAT Frequency Band eMTC B1/B2/B3/B4/B5/B8/B12/B13/B18/B19/B20/B25/B26/B27/B28/B31/B66/B72/B73/B85 NB-IoT B1/B2/B3/B4/B5/B8/B12/B13/B18/B19/B20/B25/B28/B31/B66/B71/B72/B73/B85 EGPRS GSM850, EGSM900, DCS1800, PCS1900 NOTE Quectel BG95 series includes multiple models with different RATs and frequency bands. For detailed information, see document [1]. 2.2. Supported RATs and Bands of BG77 Quectel BG77 module supports two RATs: eMTC and NB-IoT. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 8 / 41 LPWA Module Series ⚫ Default RATs: eMTC and NB-IoT ⚫ Default searching sequence: eMTC → NB-IoT ⚫ If the two RATs need to be supported synchronously or other searching sequences are needed, set the relevant configuration values via AT commands. The details of AT commands are provided in Chapter 5. The following table lists the supported frequency bands of BG77. Table 3: Frequency Bands of BG77 Module RAT eMTC NB-IoT Frequency Band B1/B2/B3/B4/B5/B8/B12/B13/B18/B19/B20/B25/B26/B27/B28/B66/B85* B1/B2/B3/B4/B5/B8/B12/B13/B18/B19/B20/B25/B28/B66/B71/B85* 2.3. Supported RATs and Bands of BG600L-M3 Quectel BG600L-M3 module supports three RATs: eMTC, NB-IoT and EGPRS. ⚫ Default RATs: eMTC, NB-IoT and EGPRS ⚫ Default searching sequence: eMTC → NB-IoT → EGPRS ⚫ If the three RATs need to be supported synchronously or other searching sequences are needed, set the relevant configuration values via AT commands. The details of AT commands are provided in Chapter 5. The following table lists the supported frequency bands of BG600L-M3 module. Table 4: Frequency Bands of BG600L-M3 Module RAT Frequency Band eMTC B1/B2/B3/B4/B5/B8/B12/B13/B18/B19/B20/B25/B26/B27/B28/B66/B85 NB-IoT B1/B2/B3/B4/B5/B8/B12/B13/B18/B19/B20/B25/B28/B66/B71/B85 EGPRS GSM850, EGSM900, DCS1800, PCS1900 BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 9 / 41 LPWA Module Series 3 Network Searching/Registration Processes The network searching/registration processes of BG95 series, BG77 and BG600L-M3 modules are illustrated below: See 3GPP TS 24.301 Power On UE Initialization RAT/PLMN Selection (E)ARFCN Scan Cell Searching System Information Analysis Cell Selection Cell Camping Attach Request Random Access RRC Connection Request RRC Connection Setup Attach Accepted Attach Complete See 3GPP TS 31.102 See 3GPP TS 23.122 See 3GPP TS 36.211 See 3GPP TS 36.331 See 3GPP TS 36.304 See 3GPP TS 36.300 Figure 1: Network Searching and Registration Process BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 10 / 41 LPWA Module Series 1. UE Initialization UE initialization includes (U)SIM card recognition and reading of NVM related to network searching. 2. RAT/PLMM Selection ⚫ Set the RAT searching sequence and the RAT(s) allowed to be searched according to network searching related NVM and related (U)SIM EF files. ⚫ PLMN selection can be performed in either automatic or manual modes. ⚫ For more information, see Chapter 4.1. 3. (E)ARFCN Scan ⚫ LTE EARFCN scan includes system scan and band scan. ⚫ EGPRS ARFCN scan refers to power scan. ⚫ For more information, see Chapter 4.2. 4. Cell Searching Cell searching refers to cell recognition and downlink synchronization. 5. System Information Analysis This step includes reading and analyzing MIB and SIB information. For detailed definition of system information, see 3GPP TS 36.331 [5.2]. ⚫ MIB information: the number of antennas, downlink bandwidth, cell ID and registered (E)ARFCN. ⚫ SIB information: PLMN, cell ID, etc. 6. Cell Selection If the acquired band satisfies the signal strength requirement of UE, the UE will perform the next step (cell camping), otherwise it will continue (E)ARFCN scanning. 7. Cell Camping Cell camping is started after successful cell selection. 8. Attach Request/Location Update Request After the cell is camped, the UE will send the attach request/location update request. 9. Random Access UE performs uplink synchronization (random access) after sending attach request/location update request. 10. RRC Connection Request 11. RRC Connection Setup BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 11 / 41 12. Attach Accepted/Location Updating Accepted LPWA Module Series BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 12 / 41 LPWA Module Series 4 Factors Influencing Network Registration Speed Network registration speed is affected by RAT/PLMN selection and LTE EARFCN scan. The details about the two processes are provided below. 4.1. RAT/PLMN Selection This chapter describes the steps involved in RAT/PLMN selection. The following figure illustrates the overall processes of RAT/PLMN selection in automatic mode. As shown below, the search order during RAT/PLMN selection is determined not only by the module settings but also by some files on the (U)SIM card. By default, the files on the (U)SIM card have a higher priority. EF/NV/EFS In itia liza tion Auto Network Selecti on Mode Check RAT pr iority list (rat_acq_o rder) Yes PLMN = HPLMN Is EF L RP LMNSI set? No Check NVRPLMNACT RAT search orde r = EF HP LMNwACT Yes PLMN = RPLMN RAT search orde r = NV RP LMNACT LTE No RPLMN from EF EPS LOCI Is RPLMN valid? GERAN Check domain pr ef If domain prefere nce = CS only or CS +PS RPLMN from EF LOCI If domain prefere nce = PS onl y RPLMN from EF PS LO CI Figure 2: RAT/PLMN Selection BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 13 / 41 LPWA Module Series 4.2. LTE EARFCN Scan This chapter describes the effect of LTE EARFCN scan on the speed of network registration. LTE EARFCN scan includes system scan and band scan. When the module shuts down, it will store the current network registration information (e.g., EARFCN, PCI and so on). When the module powers on next time for network registration, UE will try to acquire the stored network registration information. This procedure is called system scan. This procedure will speed up the network registration process. If the network information acquisition failed in system scan, UE will attempt to scan all supported bands, which process constitutes the band scan. According to statistics, the scan for all bands under eMTC and EGPRS takes about tens of seconds. However, EARFCN scan will take longer under NB-IoT, due to the characteristics of NB-IoT network (especially the weak signal feature). The following table shows the test results of some of the NB-IoT bands, which displays the EARFCN scan time required in each band. Table 5: Network Searching Time of NB-IoT Bands with Different SNR Band B1 Band Width (MHz) 60 Searching Time with SNR 0 (Unit: s) 25 Searching Time with SNR 1 (Unit: s) 139 Searching Time with SNR 2 (Unit: s) 313 B2 60 26 132 310 B3 75 32 164 386 B4 45 20 104 229 B5 25 11 69 132 B8 35 15 77 185 B12 17 7 38 90 B13 10 4 21 49 B18 15 7 36 78 B19 15 6 39 77 B20 40 13 67 157 B25 65 15 86 183 B28 45 20 104 238 BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 14 / 41 LPWA Module Series As BG95 series, BG77 and BG600L-M3 modules support dozens of bands under NB-IoT, it is recommended to enable only the bands supported by the service operator. Table 6: eMTC/NB-IoT Band Deployment over the World (For Reference Only) Band B1 DL Freq. (MHz) 2100 Applicability as per 3GPP U.S. TS36.1.0.1 eMTC/NB-IoT China The Middle East Japan Korea Europe Australia ■ ■ B2 1900 eMTC/NB-IoT ■ B3 1800 eMTC/NB-IoT ■ ■ ■ ■ ■ B4 1700 eMTC ■ B5 850 eMTC/NB-IoT ■ ■ B8 900 eMTC/NB-IoT ■ ■ ■ ■ B12 700 eMTC/NB-IoT ■ B13 700 eMTC/NB-IoT ■ B18 800 eMTC/NB-IoT ■ B19 800 eMTC/NB-IoT ■ B20 800 eMTC/NB-IoT ■ B26 850 eMTC/NB-IoT ■ B28 700 eMTC/NB-IoT ■ ■ BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 15 / 41 LPWA Module Series 5 Network Searching Related AT Commands In order to optimize network searching/registration time, related AT commands can be used to set the RAT searching sequence, RAT(s) to be searched, network category to be searched under LTE RAT, and preferred bands to be searched. 5.1. AT+QCFG='nwscanseq' Configure RAT Searching Sequence This Write Command configures the searching sequence of RATs or queries the current setting. AT+QCFG='nwscanseq' Configure RAT Searching Sequence Write Command AT+QCFG='nwscanseq'[,[, ]] Response If the optional parameters are omitted, query the current setting. +QCFG: 'nwscanseq', OK If any of the optional parameters is specified, configure the RAT searching sequence. OK If there is an error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms determines when the command will take effect. The configurations will be saved automatically. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 16 / 41 Parameter LPWA Module Series Integer type. RAT searching sequence. (e.g.: 020301 stands for eMTC → NB-IoT → GSM) 00 Automatic (eMTC → NB-IoT → GSM) 01 GSM 02 eMTC 03 NB-IoT Integer type. When to take effect. 0 Take effect after UE reboots 1 Take effect immediately Integer type. Error code. See Chapter 9 for details. NOTE 1. This command is invalid on BG95-M1 module. 2. GSM RAT (=01) is valid only on BG95-M3, BG95-M5 and BG600L-M3 modules. 3. NB-IoT is disabled by default. 4. Don’t repeatedly select one RAT while specifying (for example '020202'), to prevent unexpected situations. 5.2. AT+QCFG='nwscanmode' Configure RAT(s) to be Searched for This Write Command configures the RAT(s) to be searched for or queries the current setting AT+QCFG='nwscanmode' Configure RAT(s) to be Searched for Write Command AT+QCFG='nwscanmode'[,[,]] Response If the optional parameters are omitted, query the current setting. +QCFG: 'nwscanmode', OK If any of the optional parameters is specified, configure the RAT(s) to be searched for: OK If there is an error related to ME functionality: +CME ERROR: If there is any other error: BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 17 / 41 LPWA Module Series Maximum Response Time Characteristics ERROR 300 ms determines when the command will take effect. The configurations will be saved automatically. Parameter Integer type. RAT(s) to be searched for. 0 Automatic (GSM and LTE) 1 GSM only 3 LTE only Integer type. When to take effect. 0 Take effect after UE reboots 1 Take effect immediately Integer type. Error code. See Chapter 9 for details. NOTE This command is valid only on BG95-M3, BG95-M5 and BG600L-M3 modules. 5.3. AT+QCFG='iotopmode' Configure Network Category to be Searched for under LTE RAT This Write Command configures the network category to be searched for under LTE RAT or queries the current setting. AT+QCFG='iotopmode' Configure Network Category to be Searched for under LTE RAT Write Command Response AT+QCFG='iotopmode'[,[,]] setting. +QCFG: 'iotopmode', OK If any of the optional parameters is specified, configure the network category to be searched for under LTE RAT: OK BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 18 / 41 LPWA Module Series Maximum Response Time Characteristics If there is an error related to ME functionality: +CME ERROR: If there is any other error: ERROR 300 ms determines when the command will take effect. The configurations will be saved automatically. Parameter Integer type. Network category to be searched for under LTE RAT. 0 eMTC 1 NB-IoT 2 eMTC and NB-IoT Integer type. When to take effect. 0 Take effect after UE reboots 1 Take effect immediately Integer type. Error code. See Chapter 9 for details. NOTE This command is invalid on BG95-M1 module. 5.4. AT+QCFG='band' Configure Frequency Band This Write Command configures the frequency bands to be searched for or queries the current setting. AT+QCFG='band' Configure Frequency Band Write Command AT+QCFG='band'[,, ,[ ,]] Response If the optional parameters are omitted, query the current setting. +QCFG: 'band',,, OK If any of the optional parameters is specified, configure the BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 19 / 41 LPWA Module Series Maximum Response Time Characteristics frequency bands to be searched for. OK If there is an error related to ME functionality: +CME ERROR: If there is any other error: ERROR 300 ms determines when the command will take effect. The configurations will be saved automatically. Parameter A hexadecimal value that specifies the GSM frequency band (e.g.: 0xa = 0x2(DCS1800) + 0x8(PCS1900)). If it is set to 0, it means not to change GSM frequency band. 0 No change 0x1 EGSM900 0x2 DCS1800 0x4 GSM850 0x8 PCS1900 0xF All of the supported bands above A hexadecimal value that specifies the eMTC frequency band (e.g.: 0x15 = 0x1(LTE B1) + 0x4(LTE B3) + 0x10(LTE B5)). If it is set to 0, it means not to change the eMTC frequency band. 0 No change 0x1 (BAND_PREF_LTE_BAND1) LTE B1 0x2 (BAND_PREF_LTE_BAND2) LTE B2 0x4 (BAND_PREF_LTE_BAND3) LTE B3 0x8 (BAND_PREF_LTE_BAND4) LTE B4 0x10 (BAND_PREF_LTE_BAND5) LTE B5 0x80 (BAND_PREF_LTE_BAND8) LTE B8 0x800 (BAND_PREF_LTE_BAND12) LTE B12 0x1000 (BAND_PREF_LTE_BAND13) LTE B13 0x20000 (BAND_PREF_LTE_BAND18) LTE B18 0x40000 (BAND_PREF_LTE_BAND19) LTE B19 0x80000 (BAND_PREF_LTE_BAND20) LTE B20 0x1000000 (BAND_PREF_LTE_BAND25) LTE B25 0x2000000 (BAND_PREF_LTE_BAND26) LTE B26 0x4000000 (BAND_PREF_LTE_BAND27) LTE B27 0x8000000 (BAND_PREF_LTE_BAND28) LTE B28 0x40000000 (BAND_PREF_LTE_BAND31) LTE B31 BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 20 / 41 LPWA Module Series 0x20000000000000000 (BAND_PREF_LTE_BAND66) LTE B66 0x800000000000000000 (BAND_PREF_LTE_BAND72 LTE B72 0x1000000000000000000 (BAND_PREF_LTE_BAND73) LTE B73 0x1000000000000000000000 (BAND_PREF_LTE_BAND85) LTE B85 A hexadecimal value that specifies the NB-IoT frequency band (e.g.: 0x15 = 0x1(LTE B1) + 0x4(LTE B3) + 0x10(LTE B5)). If it is set to 0, it means not to change the NB-IoT frequency band. 0 No change 0x1 (BAND_PREF_LTE_BAND1) LTE B1 0x2 (BAND_PREF_LTE_BAND2) LTE B2 0x4 (BAND_PREF_LTE_BAND3) LTE B3 0x8 (BAND_PREF_LTE_BAND4) LTE B4 0x10 (BAND_PREF_LTE_BAND5) LTE B5 0x80 (BAND_PREF_LTE_BAND8) LTE B8 0x800 (BAND_PREF_LTE_BAND12) LTE B12 0x1000 (BAND_PREF_LTE_BAND13) LTE B13 0x20000 (BAND_PREF_LTE_BAND18) LTE B18 0x40000 (BAND_PREF_LTE_BAND19) LTE B19 0x80000 (BAND_PREF_LTE_BAND20) LTE B20 0x1000000 (BAND_PREF_LTE_BAND25) LTE B25 0x8000000 (BAND_PREF_LTE_BAND28) LTE B28 0x40000000 (BAND_PREF_LTE_BAND31) LTE B31 0x20000000000000000 (BAND_PREF_LTE_BAND66) LTE B66 0x400000000000000000 (BAND_PREF_LTE_BAND71) LTE B71 0x800000000000000000 (BAND_PREF_LTE_BAND72) LTE B72 0x1000000000000000000 (BAND_PREF_LTE_BAND73) LTE B73 0x1000000000000000000000 (BAND_PREF_LTE_BAND85) LTE B85 Integer type. When to take effect. 0 Take effect after UE reboots 1 Take effect immediately Integer type. Error code. See Chapter 9 for details. NOTE 1. For the specific bands supported by each model, see corresponding specifications of the modules. ⚫ is valid only on BG95-M3, BG95-M5 and BG600L-M3 modules. ⚫ is invalid on BG95-M1 module. ⚫ LTE B31/B72/B73 is valid on BG95-M4 module only. 2. The value setting of when all eMTC bands are intended to be searched for: ⚫ 0x100182000000004F0E189F for BG95-M4 ⚫ 0x100002000000000F0E189F for BG77, BG600L-M3 and other BG95 series modules 3. The value setting of when all NB-IoT bands are intended to be searched for: ⚫ 0x10018200000000490E189F for BG95-M4 BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 21 / 41 LPWA Module Series ⚫ 0x10004200000000090E189F for BG77, BG600L-M3 and other BG95 series modules BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 22 / 41 LPWA Module Series 6 Solutions to Speed up Network Searching 6.1. Overview of NB-IoT Network Searching Time As per 3GPP specifications, NB-IoT is expected to be deployed in a much lower coverage area. Expected Maximum Coupling Loss for NB-IoT is 164 dB, whereas it is only around 155 dB for eMTC. This pushes the device to accommodate more SNR range to detect a possible NB-IoT cell deployment. In addition, eMTC has a 1.4 MHz bandwidth, whereas NB-IoT has a 200 KHz bandwidth. This means NB-IoT has much more candidates to scan and detect in a given LTE deployed area, which leads to much longer searching time for NB-IoT than eMTC. BG95 series, BG77 and BG600L-M3 modules divide the search process into three levels according to NB-IoT signal characteristics: ⚫ Frequency scan level 0 (SNR level 0): SNR value > 0 dB. This takes only few milliseconds for each raster. ⚫ Frequency scan level 1 (SNR level 1): SNR value ranges from 0 to -9 dB. This takes about 100 msec for each raster. ⚫ Frequency scan level 2 (SNR level 2): typical SNR value is about -12 dB. This takes about 400 to 500 msec for each raster. According to the test results in Table 5, NB-IoT network was searched for a long period of time. This, coupled with the dozens of bands supported by the modules, makes the total network searching time very long. ⚫ Under SNR level 0, searching the network takes only tens of seconds. ⚫ Under SNR level 1, the time for network searching is five to six times as long as the time for searching under SNR level 0. ⚫ Under SNR level 2, the time for network searching is ten to fifteen times as long as the time for searching under SNR level 0. To avoid the long network searching time, either of the following solutions should be used to optimize the network searching scheme of modules. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 23 / 41 LPWA Module Series 6.2. Solutions to Speed up Network Searching 6.2.1. Disable NB-IoT and Enable Required RAT(s) Network searching can be sped up by disabling NB-IoT and enabling only the required RAT(s). Table 7: Solutions to Speed up Network Searching (Disable NB-IoT) Solutions Disable NB-IoT Enable Required RAT(s) Enable EGPRS only Enable eMTC only Enable eMTC and EGPRS both Related AT Commands Default configuration AT+QCFG='nwscanmode',1 AT+QCFG='iotopmode',0 AT+QCFG='nwscanmode',3 AT+QCFG='iotopmode',0 AT+QCFG='nwscanmode',0 6.2.2. Enable NB-IoT Bands Supported by Current Operator Only When NB-IoT is necessary, it is recommended to enable only the bands supported by the current service operator. Table 8: Solutions to Speed up Network Searching (Enable NB-IoT Bands Supported) Regions Solutions Related AT Commands U.S Europe Korea Enable the three RATs synchronously. Set B2, B4, B12 and B13 as the bands to be searched. Enable the three RATs synchronously. Set B3, B8 and B20 as the bands to be searched. Enable the three RATs synchronously. Set B3 and B5 as the bands to AT+QCFG='band',F,180A,180A AT+QCFG='iotopmode',2 AT+QCFG='nwscanseq',020301 AT+QCFG='nwscanmode',0 AT+QCFG='nwscanmode',3 (set only when EGPRS is not needed) AT+QCFG='band',F,80084,80084 AT+QCFG='iotopmode',2 AT+QCFG='nwscanseq',020301 AT+QCFG='nwscanmode',0 AT+QCFG='nwscanmode',3 (set only when EGPRS is not needed) AT+QCFG='band',F,14,14 AT+QCFG='iotopmode',2 AT+QCFG='nwscanseq',020301 BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 24 / 41 LPWA Module Series Australia The Middle East Japan China be searched. Enable the three RATs synchronously. Set B3 and B28 as the bands to be searched. Enable the three RATs synchronously. Set B3, B5 and B28 as the bands to be searched. Enable the three RATs synchronously. Set B1, B8, B18 and B19 as the bands to be searched. Enable the three RATs synchronously. Set B1, B3, B5, B8 and B26 as the bands to be searched. AT+QCFG='nwscanmode',0 AT+QCFG='nwscanmode',3 (set only when EGPRS is not needed) AT+QCFG='band',F,8000004,8000004 AT+QCFG='iotopmode',2 AT+QCFG='nwscanseq',020301 AT+QCFG='nwscanmode',0 AT+QCFG='nwscanmode',3 (set only when EGPRS is not needed) AT+QCFG='band',F,8000084,8000084 AT+QCFG='iotopmode',2 AT+QCFG='nwscanseq',020301 AT+QCFG='nwscanmode',0 AT+QCFG='nwscanmode',3 (set only when EGPRS is not needed) AT+QCFG='band',F,60081,60081 AT+QCFG='iotopmode',2 AT+QCFG='nwscanseq',020301 AT+QCFG='nwscanmode',0 AT+QCFG='nwscanmode',3 (set only when EGPRS is not needed) AT+QCFG='band',F,2000095,2000095 AT+QCFG='iotopmode',2 AT+QCFG='nwscanseq',020301 AT+QCFG='nwscanmode',0 AT+QCFG='nwscanmode',3 (set only when EGPRS is not needed) BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 25 / 41 LPWA Module Series 7 Typical Problems and Root Cause Analysis This chapter describes some typical problems and corresponding root cause analysis. 7.1. Network Searching Sequence Determined by (U)SIM Card Files Problem Description: The RAT searching sequence does not comply with the setting of AT+QCFG='nwscanseq'. Root Cause Analysis: The sequence is determined by some files in (U)SIM card, as illustrated in the example below. Figure 3: RAT Searching Sequence Determined by (U)SIM Card Files BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 26 / 41 LPWA Module Series 7.2. Network Searching Sequence Determined by RPLMN/RPLMNACT Stored on Module Flash Problem Description: The RAT searching sequence does not comply with the setting of AT+QCFG='nwscanseq'. Root Cause Analysis: In the example shown below, EFLRPLMNSI (0x6FDC, this file is optional in 3GPP protocol) does not exist on the (U)SIM card. The module thus searches RPLMN/RPLMNACT stored inside. Figure 4: RAT Searching Sequence Determined by RPLMN/RPLMNACT Stored on Module Flash BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 27 / 41 LPWA Module Series 7.3. Long Network Registration Time in Roaming State Problem Description: When the module is in roaming state, the network registration time becomes longer, especially when the module powers on for the first time in roaming state or when the module registers to NB-IoT network. Roaming State Introduction: When the PLMN of the module’s registered network is not consistent with the HPLMN or EHPLMN of (U)SIM card, the module is in the roaming state. In this case, returned by executing AT+CREG?/AT+CGREG?/AT+CEREG? is 5, which also indicates that the module is in the roaming state. The behaviour of the module if the (U)SIM card is in roaming state is described in the figure below: Power Up Registered Network NO Current PLMN is VPLMN YES HPLMN Search YES Start HPLMN Enable Search Timer NO IRAT Search Enable NO END YES Start IRAT Search Timer Figure 5: Behaviour of the Module if (U)SIM is Card in Roaming State BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 28 / 41 LPWA Module Series Root Cause Analysis: When the module is powered on for the first time with a roaming (U)SIM card, there is no RPLMN information on the (U)SIM card, thus the module needs to scan for high priority PLMN (HPLMN, EHPLMN and so on). It means that the module needs to scan all supported RATs and bands to confirm whether there is any available HPLMN around the cells first. Therefore, the network registration time of the module is always longer when powering on for the first time with a roaming (U)SIM card. Due to the NB-IoT network characteristics (200 kHz bandwidth), network scanning is much slower (For more details, see Chapter 6.1). For non-initial network registration, the last registered RPLMN information is saved on the (U)SIM card and the last registered network frequency information is saved in the module. It means that the module can find the target network as fast as possible. Therefore, the network registration time of the module is faster for non-initial network registration of a roaming (U)SIM card. According to 3GPP specification (3GPP TS 23.122 subclause 4.4.3.3), the module should attempt to access the HPLMN, EHPLMN or another high priority PLMN (hereinafter referred to as ''HPLMN search'') with HPLMN search timer when the module is in the roaming state. For BG95 series, BG77 or BG600L-M3 module, when the module is locked to one RAT, HPLMN search process is imperceptible for users, and the ongoing operation will not be affected. The module needs to scan all supported RATs and bands with HPLMN when there is no RPLMN information saved on the roaming (U)SIM card. The registered RPLMN information saved on the (U)SIM card and the network frequency information saved in the module can shorten registration time for an roaming (U)SIM card. Recommendation: ⚫ Lock as few as possible RATs and bands to shorten the network searching time. ⚫ Use normal power-down methods (such as executing AT+QPOWD=1, see document [2] for details) to power off the module, to make sure the network registration information is saved on the (U)SIM card and the module flash. It is not recommended to disconnect the power supply of the module directly. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 29 / 41 LPWA Module Series 7.4. Network Registration Request Rejected by Network Problem Description: The module’s network registration request was rejected. Reject Cause Information Element Introduction: The purpose of the reject cause information element is to indicate the reason why a GMM/EMM request from the UE was rejected by the network. The GMM cause information element is defined in 3GPP TS 24.008, and the EMM cause information element is defined in 3GPP 24.301. The reject cause is a type 3 information element with the length of 2 octets (see Figure 6 for GMM cause value and Figure 7 for EMM cause value). When the module receives a reject cause code, it means that the module has searched the network, but the registration request was rejected by the network. The network searching sequence of the module complies with the 3GPP specification when the module receives a reject cause code, and the module will always try to search for available networks even if it receives a reject cause code from a certain network. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 30 / 41 LPWA Module Series Figure 6: GMM Cause Information Element BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 31 / 41 LPWA Module Series Figure 7: EMM Cause Information Element Example Analysis: When the module receives a reject cause code from the network, it means that the module has searched the network and initiated an attach request. Then the module starts the T3247 timer, which is a random value ranging from 30 minutes to 60 minutes. After the timer expires, the module initiates network registration again on the PLMN, as illustrated in the figure below. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 32 / 41 LPWA Module Series The module selects PLMN 46011 to send attach request. Attach request is rejected and the reject cause code is 14, then the module sets T3247 timer and the timer value is random from 30 to 60 minutes. The module uses another available PLMN 24601 to send attach request and set T3410 timer, the timer value is 10 seconds. If the attach request is still rejected, it will be sent again every 10 seconds, 4 times to retry, and 5 attempts in total. Figure 8: Module Received Reject Cause Code According to 3GPP, the module initiates T3247 timer after receiving reject cause code #14. The module tries to search and register another available network. Figure 9: Module Initiated T3247 Timer and Tried to Register Another Available Network BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 33 / 41 LPWA Module Series 7.5. Long Network Registration Time if AT Commands are Executed Frequently Problem Description: During the network searching progress, the network registration time becomes longer if some network-searching commands are executed frequently. Root Cause Analysis: Executing a network-searching command (see Chapter 5 for more information) immediately triggers a one-time network search even if network searching is already in progress. Therefore, frequent executing of network-searching commands may cause longer network registration time. Recommendation: Before executing any network-searching command, it is recommended to check whether the current network configuration of the module is the desired one. If it is, there is no need to reset the network configuration. Example AT+QCFG='nwscanmode' +QCFG: 'nwscanmode',3 //Query the current RAT(s) allowed to be searched for. //The module only searches for LTE bands. OK AT+QCFG='nwscanmode',1 OK //Change the network configuration if it is not the desired one. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 34 / 41 LPWA Module Series 8 FAQ 1. Q: How does the module search for the network in OOS (Out of Service) state? A: When the module is in OOS (Out of Service) state, it will always periodically try to search for available networks, as shown in the figure below. Figure 10: Restore the Network Information Phase 1 a) Sleep for 30 seconds i. Attempt acquisition of full service and then limited service on the GSM and LTE acquisition list. ii. Go back to step a. and repeat 10 times. b) Sleep for 45 seconds i. Attempt acquisition of full service and then limited service on the GSM and LTE acquisition list. ii. Go back to step b. and repeat 10 times. Phase 2 c) Sleep for 60 seconds i. Attempt acquisition of full service and then limited service on the GSM and LTE acquisition list. ii. Go back to step c. and repeats continuously until a service is found. 2. Q: How to clear the registration information history of the module? A: a) If you want to clear the historical frequency information stored in the module, you can execute the following commands: ⚫ AT+QNVFD='/nv/item_files/modem/geran/grr/acq_db' under GSM. ⚫ AT+QNVFD='/nv/reg_files/modem/lte/rrc/csp/acq_db' under LTE (eMTC and NB-IoT). ⚫ AT+QNVFD='/nv/reg_files/modem/nb1/rrc/csp/acq_db' under NB-IoT. b) If you want to clear RPLMN information stored on (U)SIM card, you can execute the following commands: BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 35 / 41 LPWA Module Series ⚫ AT+CRSM=214,28542,0,0,11,'FFFFFFFFFFFFFFFFFFFFFF' to clear LOCI (including RPLMN). ⚫ AT+CRSM=214,28531,0,0,14,'FFFFFFFFFFFFFFFFFFFFFFFFFFFF' to clear PSLOCI. ⚫ AT+CRSM=214,28643,0,0,18,'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF' to clear EPSLOCI. BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 36 / 41 LPWA Module Series 9 Summary of CME ERROR Codes Final result code +CME ERROR: indicates an error related to mobile equipment or network. The operation is similar to ERROR result code. values are mostly used by common message commands. The following table lists most of general and GPRS related ERROR codes. For some GSM protocol failure causes described in GSM specifications, the corresponding ERROR codes are not included. Table 1: Summary of CME ERROR Codes 0 1 2 3 4 5 6 7 10 11 12 13 14 15 Meaning Phone failure No connection to phone Phone-adaptor link reserved Operation not allowed Operation not supported PH-SIM PIN required PH-FSIM PIN required PH-FSIM PUK required (U)SIM not inserted (U)SIM PIN required (U)SIM PUK required (U)SIM failure (U)SIM busy (U)SIM wrong BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 37 / 41 LPWA Module Series 16 Incorrect password 17 (U)SIM PIN2 required 18 (U)SIM PUK2 required 20 Memory full 21 Invalid index 22 Not found 23 Memory failure 24 Text string too long 25 Invalid characters in text string 26 Dial string too long 27 Invalid characters in dial string 30 No network service 31 Network timeout 32 Network not allowed - emergency calls only 40 Network personalization PIN required 41 Network personalization PUK required 42 Network subset personalization PIN required 43 Network subset personalization PUK required 44 Service provider personalization PIN required 45 Service provider personalization PUK required 46 Corporate personalization PIN required 47 Corporate personalization PUK required BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 38 / 41 LPWA Module Series 10 Appendix References Table 9: Related Documents Document Name [1] Quectel_BG95_LPWA_Specification [2] Quectel_BG95&BG77&BG600L_Series_AT_Commands_Manual [3] Quectel_BG95&BG77&BG600L_Series_QCFG_AT_Commands_Manual Table 10: Terms and Abbreviations Abbreviation (U)SIM 3GPP ARFCN CS CSG EARFCN EF EFS EGPRS EHPLMN EMM eMTC EPS Description (Universal) Subscriber Identity Module 3rd Generation Partnership Project Absolute Radio Frequency Channel Number Circuit Switching Domain Closed Subscriber Group E-UTRA Absolute Radio Frequency Channel Number Elementary File Encrypt File System Enhanced General Packet Radio Service Equivalent Home PLMN EPS Mobility Management Enhanced Machine Type Communication Evolved Packet System BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 39 / 41 EPSLOCI ESM GMM GPRS GSM HLR HPLMN HSS IE IMEI IMSI IRAT LOCI LTE MAC ME MIB MS MSC NB-IoT NV NVM PCI PDP PLMN PS PSLOCI EPS Location Information EPS Session Management GPRS Mobility Management General Packet Radio Service Global System for Mobile Communications Home Location Register Home Public Land Mobile Network Home Subscriber Server Information Element International Mobile Equipment Identity International Mobile Subscriber Identity Inter-RAT Location Information Long Term Evolution Medium Access Control Mobile Equipment Master Information Block Mobile Station Mobile Switching Center Narrow Band Internet of Things Non-volatile Flash Memory Non-Volatile Memory Peripheral Component Interconnect Packet Data Protocol Public Land Mobile Network Packet Switching Domain Packet Switch Location Information LPWA Module Series BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 40 / 41 RAT RPLMN RRC SIB SNR UE VPLMN Radio Access Technology Registered Public Land Mobile Network Radio Resource Control System Information Block Signal Noise Ratio User Equipment Visiting Public Land Mobile Network LPWA Module Series BG95&BG77&BG600L_Series_Network_Searching_Scheme_Introduction 41 / 41

BG770A-GL&BG95xA-GL FILE Application Note LPWA Module Series Version: 1.0 Date: 2022-05-05 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG770A-GL&BG95xA-GL_FILE_Application_Note 1 / 29 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG770A-GL&BG95xA-GL_FILE_Application_Note 2 / 29 LPWA Module Series About the Document Revision History Version Date Author - 2021-02-04 Damir KLICKOVIC 1.0 2022-05-05 Damir KLICKOVIC Description Creation of the document First official release BG770A-GL&BG95xA-GL_FILE_Application_Note 3 / 29 LPWA Module Series Contents About the Document ................................................................................................................................... 3 Contents ....................................................................................................................................................... 4 Table Index................................................................................................................................................... 5 1 Introduction .......................................................................................................................................... 6 1.1. Using FILE AT Commands.......................................................................................................... 6 1.2. Description of Data Mode ........................................................................................................... 7 2 Description of FILE AT Commands ................................................................................................... 8 2.1. AT Command Introduction .......................................................................................................... 8 2.1.1. Definitions......................................................................................................................... 8 2.1.2. AT Command Syntax ....................................................................................................... 8 2.2. Declaration of AT Command Examples ...................................................................................... 9 2.3. AT Command Description ........................................................................................................... 9 2.3.1. AT+QFLDS Get the Space Information of Storage Medium ......................................... 9 2.3.2. AT+QFLST List File Information in the Storage Medium ............................................ 10 2.3.3. AT+QFDEL Delete File(s) in the Storage Medium ...................................................... 12 2.3.4. AT+QFUPL Upload a File to the Storage Medium ...................................................... 13 2.3.5. AT+QFDWL Download a File from the Storage Medium ............................................ 15 2.3.6. AT+QFOPEN Open a File ........................................................................................... 16 2.3.7. AT+QFREAD Read a File............................................................................................ 17 2.3.8. AT+QFWRITE Write to a File ...................................................................................... 18 2.3.9. AT+QFSEEK Set File Pointer to a Position................................................................. 19 2.3.10. AT+QFPOSITION Get the Offset of a File Pointer...................................................... 20 2.3.11. AT+QFTUCAT Truncate a File from the File Pointer................................................... 20 2.3.12. AT+QFCLOSE Close a File......................................................................................... 21 2.3.13. AT+QFCRC Calculate the CRC of a Specified UFS File ............................................ 21 2.3.14. AT+QFCPY Make a Copy of a Specified File ............................................................. 22 3 Examples ............................................................................................................................................ 24 3.1. Upload and Download Files ...................................................................................................... 24 3.1.1. Upload a File .................................................................................................................. 24 3.1.2. Download a File ............................................................................................................. 25 3.2. Write to and Read Files ............................................................................................................ 25 3.2.1. Write to and Read a UFS File ........................................................................................ 25 3.2.2. Write to and Read an EUFS File.................................................................................... 25 4 Summary of Result Codes ................................................................................................................ 27 5 Appendix Reference .......................................................................................................................... 29 BG770A-GL&BG95xA-GL_FILE_Application_Note 4 / 29 LPWA Module Series Table Index Table 1: Types of AT Commands ................................................................................................................. 8 Table 2: Summary of Result Codes ........................................................................................................... 27 Table 3: Terms and Abbreviations .............................................................................................................. 29 BG770A-GL&BG95xA-GL_FILE_Application_Note 5 / 29 LPWA Module Series 1 Introduction Quectel BG770A-GL, BG950A-GL and BG951A-GL modules support AT commands for the operation of files on different physical storage mediums. This document is an application note to these commands. The supported storage mediums are: ⚫ UFS: User File Storage directory on the modem side; it is a special directory in the flash file system. ⚫ EUFS: Extended User File Storage on the application side. The file name indicates storage location. A file name beginning with the prefix 'UFS:' or without any prefix indicates that the file is in the UFS, while the one beginning with the prefix 'EUFS:' indicates that it is in the EUFS. 1.1. Using FILE AT Commands The general procedure for uploading/downloading, opening/creating, reading and writing to a file in the storage: Step 1: Upload a file to the storage with AT+QFUPL. If necessary, download the file with AT+QFDWL to verify its content, data integrity, etc. Step 2: Open the file with AT+QFOPEN. When the file is opened, you can write to it or read from it any time and from any location until the file is closed with AT+QFCLOSE. When opening a file with AT+QFOPEN, you can, for example, set the file into overwrite mode or read-only mode with parameter (see Chapter 2.3.6 for detailed information). After the file is opened, a is assigned to it, so that various file operations can be carried out. Step 3: After the file is opened, you can write to it with AT+QFWRITE or read the data content from the current file pointer position with AT+QFREAD. ⚫ You can set the file pointer position with AT+QFSEEK or query the current position with AT+QFPOSITION. ⚫ AT+QFTUCAT will truncate the file from the current position to the end of the file. Step 4: Close the file with AT+QFCLOSE, after which the becomes invalid. BG770A-GL&BG95xA-GL_FILE_Application_Note 6 / 29 Commonly used commands to manage files in the storage: 1) AT+QFLDS: Get storage space information. 2) AT+QFLST: List the file information in the specified storage. 3) AT+QFDEL: Delete the file(s) in the specified storage. LPWA Module Series 1.2. Description of Data Mode The COM port of the BG770A-GL, BG950A-GL and BG951A-GL modules has two working modes: AT command mode and data mode. In the AT command mode, the data inputted via the COM port are viewed as AT commands, whereas in the data mode, they are treated as data. ⚫ Enter Data Mode Execute AT+QFUPL, AT+QFDWL, AT+QFREAD or AT+QFWRITE to enter the data mode. If you input +++ or pull the MAIN_DTR pin up to make the port exit the data mode, the execution of these commands will be interrupted before the response is returned. In such a case, the COM port cannot re-enter the data mode if you execute ATO. ⚫ Exit Data Mode Input +++ or pull the MAIN_DTR pin up to make the COM port exit the data mode. To prevent the +++ from being misinterpreted as data, the following sequence should be followed: 1) Do not input any character for at least 1 second before and after inputting +++. 2) Input +++ within 1 second, and wait until OK is returned. Once OK is returned, the COM port exits the data mode and switches to AT command mode. If you are exiting the data mode by pulling the MAIN_DTR pin up, make sure to set AT&D1 first. BG770A-GL&BG95xA-GL_FILE_Application_Note 7 / 29 LPWA Module Series 2 Description of FILE AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Types of AT Commands Command Type Test Command Read Command Write Command Syntax Description AT+=? AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. AT+=[,[,[...]]] Set user-definable parameter value. BG770A-GL&BG95xA-GL_FILE_Application_Note 8 / 29 Execution Command AT+ LPWA Module Series Return a specific information parameter or perform a specific action. 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3. AT Command Description 2.3.1. AT+QFLDS Get Space Information of Storage Medium This command gets the space information of the specified storage medium. AT+QFLDS Get Space Information of Storage Medium Test Command AT+QFLDS=? Write Command AT+QFLDS= Response OK Response +QFLDS: , Execution Command AT+QFLDS Characteristics OK If there is an error related to the ME functionality: +CME ERROR: Response +QFLDS: , OK If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. BG770A-GL&BG95xA-GL_FILE_Application_Note 9 / 29 LPWA Module Series Parameter String type. Storage medium type. 'UFS' UFS on modem side 'EUFS' Extended UFS on application side Integer type. Free space size of . Unit: byte. Integer type. Total size of . Unit: byte. Integer type. Size of all files in UFS. Unit: byte Integer type. Number of files in UFS. Integer type. Error code. See Chapter 4 for possible values. Example AT+QFLDS='UFS' +QFLDS: 1249984,1562624 OK AT+QFLST='*' +QFLST: 'Test1.txt',10 +QFLST: 'Test2.txt',16 +QFLST: 'Test3.txt',150 +QFLST: 'Test4.txt',2056 +QFLST: 'Test5.txt',98 OK AT+QFLDS +QFLDS: 2330,5 OK //Query the space information of UFS on modem side. //Query the size and number of all files in UFS. 2.3.2. AT+QFLST List File Information on Storage Medium This command lists the information of a single file or all files on a specified storage medium. AT+QFLST List File Information on Storage Medium Test Command AT+QFLST=? Write Command AT+QFLST= Response OK Response +QFLST: , [+QFLST: , […]] OK BG770A-GL&BG95xA-GL_FILE_Application_Note 10 / 29 LPWA Module Series Execution Command AT+QFLST Characteristics If there is any error: +CME ERROR: Response Return the information of UFS files: +QFLST: , [+QFLST: , […]] OK If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter String type. File to be listed. '*' All files in UFS 'UFS:*' All files in UFS 'EUFS:/ufs/*' All files in the ufs directory of EUFS 'EUFS:/datatx/*' All files in the datatx directory of EUFS 'EUFS:*' All files in the ufs directory of EUFS '' A specified file in UFS 'UFS:' A specified file in UFS 'EUFS:' A specified file in ufs directory of EUFS 'EUFS:/ufs/' A specified file in ufs directory of EUFS 'EUFS:/datatx/' A specified file in datatx directory of EUFS String type. Exact name of file. Maximum length: 28 bytes. Integer type. File size. Unit: byte. Integer type. Error code. See Chapter 4 for possible values. Example AT+QFLST='*' +QFLST: 'F_M12-1.bmp',562554 +QFLST: 'F_M12-10.bmp',562554 +QFLST: 'F_M12-11.bmp',562554 OK AT+QFLST='Test1.txt' //List all files in UFS. //List a specified file 'Test1.txt' in UFS. BG770A-GL&BG95xA-GL_FILE_Application_Note 11 / 29 +QFLST: 'Test1.txt',2 OK AT+QFLST='EUFS:/ufs/*' +QFLST: 'EUFS:test.txt',10 +QFLST: 'EUFS:test2.txt',20 OK AT+QFLST='EUFS:test.txt' +QFLST: 'EUFS:test.txt',10 OK LPWA Module Series //List all files in ufs directory of EUFS . //List a specified file 'test.txt' in ufs directory of EUFS. 2.3.3. AT+QFDEL Delete File(s) on Storage Medium This command deletes a specified file or all files from a storage medium. AT+QFDEL Delete File(s) on Storage Medium Test Command AT+QFDEL=? Response +QFDEL: Write Command AT+QFDEL= OK Response OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter String type. Name of the file to be deleted. Maximum length: 28 bytes. '*' All files in UFS 'UFS:*' All files in UFS 'EUFS:/ufs/*' Delete all files in the ufs directory of EUFS (ufs directory remains) 'EUFS:/datatx/*' Delete all files in the datatx directory of EUFS (datatx directory remains) 'EUFS:*' Delete all files in the ufs directory of EUFS (ufs directory remains) 'UFS:' A specified file in UFS 'EUFS:' Delete a specified file in ufs directory of EUFS BG770A-GL&BG95xA-GL_FILE_Application_Note 12 / 29 LPWA Module Series 'EUFS:/ufs/' Delete a specified file in ufs directory of EUFS 'EUFS:/datatx/' Delete a specified file in datatx directory of EUFS String type. Exact name of file. Integer type. Error code. See Chapter 4 for possible values. Example AT+QFDEL='*' OK AT+QFDEL='Test1.txt' OK 2.3.4. AT+QFUPL Upload File to Storage Medium This command uploads a file to a storage medium. If any file on the storage medium has the same name as the uploaded file, an error will be reported. After the Write Command is executed and CONNECT is returned, the module will switch to the data mode. When the uploaded data reach , or if no other data are inputted when is reached, the module exits the data mode automatically. During data transmission, you can send +++ or pull the MAIN_DTR pin high to make the module exit the data mode. For more information, see Chapter 1.2. AT+QFUPL Upload File to Storage Medium Test Command AT+QFUPL=? Response +QFUPL: [,(1-)[,(range of supported s)[,(list of supported s)]]] Write Command AT+QFUPL=[,[, [,]]] OK Response CONNECT The TA switches to the data mode (transparent transmission mode), so the binary data of the file can be inputted. When the total size of the inputted data reaches or TA receives +++, TA will return to the command mode and report the following code: +QFUPL: , OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; BG770A-GL&BG95xA-GL_FILE_Application_Note 13 / 29 LPWA Module Series The configurations will not be saved. Parameter Integer type. Free space size of . See AT+QFLDS for more information about . String type. Name of the file to be uploaded. Maximum length: 28 bytes. '' Upload the file to UFS 'UFS:' Upload the file to UFS 'EUFS:' Upload the file to ufs directory of EUFS 'EUFS:/ufs/' Upload the file to ufs directory of EUFS 'EUFS:/datatx/' Upload the file to datatx directory of EUFS String type. The exact name of the file. Integer type. File size expected to be uploaded. Default value: 10240. Unit: byte. Maximum length is not greater than . Integer type. Actual size of uploaded data. Unit: byte. Integer type. Waiting time for inputting data to UART and USB. Range: 1–65535. Default value: 5. Unit: s. Integer type. Determines whether to use the ACK mode. 0 Turn ACK mode off. 1 Turn ACK mode on. Integer type. Checksum of uploaded data. Integer type. Error code. See Chapter 4 for possible values. NOTE 1. It is strongly recommended to use DOS 8.3 file name format for . 2. is a 16-bit checksum based on bitwise XOR. When the number of characters is odd, the last character is set as the high 8 bit, and the low 8 bit as 0, and then an XOR operator is used to calculate the checksum. Inputting +++ will make the TA end the data transmission and switch to the command mode. However, the previously uploaded data will be preserved in the file. 3. When executing the command, the data must be entered after CONNECT is returned. 4. The ACK mode is a safeguard against data loss when uploading a large file, if hardware flow control does not work. The ACK mode works as follows: 1) Run AT+QFUPL=,,,1 to enable the ACK mode. 2) The module outputs CONNECT. 3) The MCU sends 1 K bytes of data, to which the modules respond with an A. 4) The MCU receives the A and then sends the next 1 K bytes of data. 5) Steps 3 and 4 are repeated until the transfer is completed. For an example of ACK mode use, see Chapter 3.1.1.2 BG770A-GL&BG95xA-GL_FILE_Application_Note 14 / 29 LPWA Module Series 5. Due to the physical limitations of the platform, i.e., write speed to the NOR flash memory, the upload feature has 2 operational modes to guarantee that the entire file will be written without data loss. Two modes are: 1) without activated HW flow control 2) with activated HW flow control. 1) When the HW flow control is not activated, the maximum file size is limited to 200000 bytes. Attempting to send files larger than that will result in an error. Writing time can significantly vary depending on file size, content, and area of the flash where the file is being written. 2) When HW flow control is activated, by executing AT+IFC=2,2, there is no file size limitation other than the available disk space. To ensure safe file transfer in this mode, on the client side, RTS and CTS must be switched on before sending the file. Transmission time can be longer than in the mode without activated HW flow control. 2.3.5. AT+QFDWL Download File from Storage Medium This command downloads a specified file from a storage medium. AT+QFDWL Download File from Storage Medium Test Command AT+QFDWL=? Response +QFDWL: Write Command AT+QFDWL= OK Response CONNECT The TA switches to the data mode, so the binary data of the file can be outputted. When the content of the file is read or the TA receives +++, the TA will return to the command mode and report the following code:: +QFDWL: , OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter String type. Name of the file to be downloaded. Maximum length: 28 bytes. '' Download the file from UFS 'UFS:' Download the file from UFS 'EUFS: Download the file from the ufs directory of EUFS 'EUFS:/ufs/' Download the file from the ufs directory of EUFS 'EUFS:/datatx/' Download the file from the datatx directory of EUFS BG770A-GL&BG95xA-GL_FILE_Application_Note 15 / 29 LPWA Module Series String type. The exact name of the file. Integer type. Size of downloaded data. Unit: byte. Integer type. Checksum of downloaded data. Integer type. Error code. See Chapter 4 for possible values. NOTE 1. Inputting +++ causes the TA to end the data transmission and switch to the command mode. 2. is a 16-bit checksum based on bitwise XOR. 2.3.6. AT+QFOPEN Open a File This command opens a file and gets the file handle to be used in commands such as AT+QFREAD, AT+QFWRITE, AT+QFSEEK, AT+QFPOSITION, AT+QFTUCAT and AT+QFCLOSE. AT+QFOPEN Open a File Test Command AT+QFOPEN=? Response +QFOPEN: [,(range of supported s)] Read Command AT+QFOPEN? OK Response +QFOPEN: ,, [+QFOPEN: ,, […]] Write Command AT+QFOPEN=[,] OK Response +QFOPEN: OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter String type. Name of the file to be opened. Maximum length: 28 bytes. '' Open the file in UFS 'UFS:' Open the file in UFS 'EUFS:' Open the file of the ufs directory of EUFS. BG770A-GL&BG95xA-GL_FILE_Application_Note 16 / 29 LPWA Module Series 'EUFS:/ufs/' Open the file of the ufs directory of EUFS 'EUFS:/datatx/' Open the file of the datatx directory of EUFS String type. The exact name of the file. Integer type. Handle of the file to be used. Integer type. File opening mode. 0 If the file does not exist, it is created. If the file exists, it is opened directly. In both cases, the file can be read and written to. 1 If the file does not exist, it is created. If the file exists, it is overwritten. In both cases, the file can be read and written to. 2 If the file exists, it is opened directly as a read-only file. Otherwise, an error is returned. 3 If the file does not exist, it is created. If the file exists, data are appended at the end of the file. In both cases, the file can be read and written to. Integer type. Error code. See Chapter 4 for possible values. NOTE starts form 0 in UFS, whereas it starts from 20000 in EUFS. 2.3.7. AT+QFREAD Read a File This command reads the data of a file specified by the file handle. The data start from the current position of the file pointer that belongs to the file handle. AT+QFREAD Read a File Test Command AT+QFREAD=? Response +QFREAD: [] Write Command AT+QFREAD=[] OK Response CONNECT The TA switches to the data mode. When the total size of the data reaches (unit: byte), the TA will go back to the command mode, display the result and report the following code: OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. BG770A-GL&BG95xA-GL_FILE_Application_Note 17 / 29 LPWA Module Series Parameter Integer type. Handle of the file to be read. Integer type. Length of the file to be read. Default value: file length. Unit: byte. Integer type. Actual read length. Unit: byte. Integer type. Error code. See Chapter 4 for possible values. 2.3.8. AT+QFWRITE Write to a File This command writes data into a file. The data start from the current position of the file pointer that belongs to the file handle. AT+QFWRITE Write to a File Test Command AT+QFWRITE=? Response +QFWRITE: [[,]] Write Command AT+QFWRITE=[[,]] OK Response CONNECT The TA switches to the data mode. When the total size of the written data reaches (unit: byte) or the time reaches , the TA will go back to the command mode and report the following code: +QFWRITE: , OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter Integer type. Handle of the file to be written to. Integer type. Length of the file to be written to. Maximum value of this parameter is determined by of AT+QFUPL. Default value: 10240. Unit: byte. Integer type. Waiting time for inputting data to USB/UART. Range: 1–65535. Default value: 5. Unit: s. Integer type. Actual written length. Unit: byte. Integer type. Total file length. Unit: byte. Integer type. Error code. See Chapter 4 for possible values. BG770A-GL&BG95xA-GL_FILE_Application_Note 18 / 29 LPWA Module Series NOTE 1. Due to the physical limitations of the platform, i.e., write speed to the NOR flash memory, write feature has 2 operational modes to guarantee that the entire file will be written without data loss. Two modes are: 1) without activated HW flow control 2) with activated HW flow control. 1) If the HW flow control is not activated, the maximum file size is limited to 200000 bytes. Attempting to send files larger than that will result in an error. Writing time can vary significantly depending on file size, content, and area of the flash where the file is being written. 2) When HW flow is activated, by executing AT+IFC=2,2, there is no file size limitation other than the available disk space. To ensure safe file transfer in this mode, on the client side, the RTS and CTS must be switched on before sending the file. Transmission time can be longer than in the mode without activated HW flow control. 2.3.9. AT+QFSEEK Set File Pointer to a Position This command sets a file pointer to a specified position. This will decide the starting position of commands such as AT+QFREAD, AT+QFWRITE, AT+QFPOSITION and AT+QFTUCAT. AT+QFSEEK Set File Pointer to a Position Test Command AT+QFSEEK=? Response +QFSEEK: ,[,] Write Command AT+QFSEEK=,[,< position>] Characteristics OK Response OK If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter Integer type. Handle of the file for which a pointer is set. Integer type. Number of bytes of the file pointer movement. Integer type. Pointer movement mode. 0 Move forward from the beginning of the file. 1 Move forward from the current position of the pointer. 2 Move backward from the end of the file. Integer type. Error code. See Chapter 4 for possible values. BG770A-GL&BG95xA-GL_FILE_Application_Note 19 / 29 LPWA Module Series NOTE 1. If =0/2 and exceed the file size, the command returns ERROR. 2. If =1 and the total size of and the current position of the pointer exceeds the file size, the command returns ERROR. 2.3.10. AT+QFPOSITION Get Offset of File Pointer This command gets the offset of a file pointer from the beginning of the file. AT+QFPOSITION Get Offset of File Pointer Test Command AT+QFPOSITION=? Response +QFPOSITION: Write Command AT+QFPOSITION= OK Response +QFPOSITION: OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter Integer type. Handle of the file for which the offset of file pointer is to be gotten. Integer type. Offset from the beginning of the file. Integer type. Error code. See Chapter 4 for possible values. 2.3.11. AT+QFTUCAT Truncate File from File Pointer This command truncates the file from the current pointer position to the end of the file. AT+QFTUCAT Truncate File from File Pointer Test Command AT+QFTUCAT=? Response +QFTUCAT: Write Command AT+QFTUCAT= OK Response OK BG770A-GL&BG95xA-GL_FILE_Application_Note 20 / 29 LPWA Module Series Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter Integer type. Handle of the file to be truncated. Integer type. Error code. See Chapter 4 for possible values. 2.3.12. AT+QFCLOSE Close a File This command closes a file and ends all file operations. After that, the file handle is released and should not be used again, unless the file is re-opened with AT+QFOPEN. AT+QFCLOSE Close a File Test Command AT+QFCLOSE=? Response +QFCLOSE: Write Command AT+QFCLOSE= OK Response OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter Integer type. Handle of the file to be closed. Integer type. Error code. See Chapter 4 for possible values. 2.3.13. AT+QFCRC Calculate CRC of a Specified UFS File This command calculates the CRC16, CRC16_CCITT and CRC32 checksums of a specified UFS file. AT+QFCRC Calculate CRC of a Specified UFS File Test Command AT+QFCRC=? Response +QFCRC: BG770A-GL&BG95xA-GL_FILE_Application_Note 21 / 29 LPWA Module Series Write Command AT+QFCRC= Characteristics OK Response When the specified file exists, the command returns 32-bit CRC, 16-bit CRC values and 16-bit CRC CCITT: +QFCRC: ,, OK When the file exists but has no bytes: +QFCRC: 0,0,0 If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter String type. Input format: 'UFS:filename'. 'UFS:' can be omitted. 32-bit CRC value. 16-bit CRC value. 16-bit CRC CCITT value. Integer type. Error code. See Chapter 4 for possible values. NOTE This command applies to UFS files only. 2.3.14. AT+QFCPY Make a Copy of a Specified File This command copies the whole content of a source file to a destination file. ⚫ If the destination file already exists, the command returns an ERROR unless =1. ⚫ If the destination file has the same name as the source file, the command returns an ERROR. ⚫ If the remaining space of the file system is smaller than the file size to be copied, the command also returns an ERROR. AT+QFCPY Make a Copy of a Specified File Test Command AT+QFCPY=? Response +QFCPY: ,[,] BG770A-GL&BG95xA-GL_FILE_Application_Note 22 / 29 LPWA Module Series OK Write Command AT+QFCPY=,[,] Response OK Characteristics If there is any error: +CME ERROR: The command takes effect immediately; The configurations will not be saved. Parameter String type. Source file name. Input format: 'UFS:filename'. 'UFS:' can be omitted. String type. Destination file name. Input format: 'UFS:filename'. 'UFS:' can be omitted. Integer type. Determines whether to overwrite the existing file that has the same name as the destination file. 0 Disable 1 Enable Integer type. Error code. See Chapter 4 for possible values. NOTE This command applies to UFS files only. BG770A-GL&BG95xA-GL_FILE_Application_Note 23 / 29 LPWA Module Series 3 Examples 3.1. Upload and Download Files 3.1.1. Upload a File 3.1.1.1. Non-ACK Mode AT+QFUPL='test1.txt',10 CONNECT +QFUPL: 10,3938 OK AT+QFUPL='EUFS:test.txt',4 CONNECT +QFUPL: 4,6a05s OK //Upload the text file 'test1.txt' to UFS. //Upload the text file 'test.txt' to ufs directory of EUFS. 3.1.1.2. ACK Mode The ACK mode can make data transmission more reliable. When transmitting a large file without hardware flow control, the ACK mode is recommended to prevent the data loss. For more information about the ACK mode, see AT+QFUPL. AT+QFUPL='test.txt',3000,5,1 CONNECT A A //Upload the text file 'test.txt' to UFS. //After receiving 1024 bytes of data, the module returns A. Then the next 1024 bytes of data can be inputted. BG770A-GL&BG95xA-GL_FILE_Application_Note 24 / 29 +QFUPL: 3000,B34A OK 3.1.2. Download a File AT+QFDWL='test.txt' CONNECT +QFDWL: 10,613e OK LPWA Module Series //Download the text file 'test.txt' from UFS. //Size and checksum value of the downloaded data are returned. 3.2. Write to and Read Files 3.2.1. Write to and Read a UFS File AT+QFOPEN='test',0 +QFOPEN: 0 //Open the file to get the file handle. OK AT+QFWRITE=0,10 CONNECT +QFWRITE: 10,10 //Write 10 bytes to the file. //The actual written bytes and the size of the file are returned. OK AT+QFSEEK=0,0,0 OK AT+QFREAD=0,10 CONNECT 10 //Set the file pointer to the beginning of the file. //Read 10 bytes from the file. OK AT+QFCLOSE=0 OK //Close the file. 3.2.2. Write to and Read an EUFS File AT+QFLDS='EUFS' +QFLDS: 1388544,2435072 //Query the space information of EUFS. BG770A-GL&BG95xA-GL_FILE_Application_Note 25 / 29 OK AT+QFOPEN='EUFS:test',0 +QFOPEN: 20000 OK AT+QFWRITE=20000,10 CONNECT +QFWRITE: 10,10 OK AT+QFSEEK=20000,0,0 OK AT+QFREAD=20000,10 CONNECT 10 OK AT+QFCLOSE=20000 OK LPWA Module Series //Open the file to get the file handle. //Write 10 bytes to the file. //The actual written bytes and the size of the file are returned. //Set the file pointer to the beginning of the file. //Read 10 bytes from the file. //Close the file. BG770A-GL&BG95xA-GL_FILE_Application_Note 26 / 29 LPWA Module Series 4 Summary of Error Codes The error code indicates an error related to mobile equipment. The detailed information about is presented in the following table, which includes only the error codes related to the file operation of the module. Table 2: Summary of Error Codes 400 401 402 403 405 406 407 409 410 411 413 414 416 417 418 419 Meaning Invalid input value Larger than the size of the file Zero-byte read Drive full File not found Invalid file name File already exists Failed to write to the file Failed to open the file Failed to read the file Reached the max. number of files allowed to be opened The read-only file Invalid file descriptor Failed to list the file Failed to delete the file Failed to get disk info BG770A-GL&BG95xA-GL_FILE_Application_Note 27 / 29 LPWA Module Series 420 No space 421 Time-out 423 File too large 425 Invalid parameter 426 File already opened 427 Failed to allocate memory. If the file size is >200KB, IFC: 2,2 must be used 428 Maximum allowed number of files on the drive exceeded BG770A-GL&BG95xA-GL_FILE_Application_Note 28 / 29 LPWA Module Series 5 Appendix Reference Table 3: Terms and Abbreviations Abbreviation ACK COM CRC DOS EUFS MCU ME TA UART UFS USB XOR Description Acknowledgement Communication Port Cyclic Redundancy Check Disk Operating System Extended User File Storage Microprogrammed Control Unit Mobile Equipment Terminal Adapter Universal Asynchronous Receiver/Transmitter User File Storage Universal Serial Bus Exclusive OR BG770A-GL&BG95xA-GL_FILE_Application_Note 29 / 29

BG77xA-GL&BG95xA-GL Positioning over LTE Application Note LPWA Module Series Version: 1.0 Date: 2022-03-11 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal nonexclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 1 / 33 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any thirdparty intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 2 / 33 LPWA Module Series About the Document Revision History Version 1.0 Date 2020-10-29 2022-03-11 Author Mladen VUKOVIC Mladen VUKOVIC Description Creation of the document First official release BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 3 / 33 LPWA Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 1.1. Special Mark .............................................................................................................................. 7 2 Polte AT Commands........................................................................................................................... 8 2.1. AT Command Introduction ......................................................................................................... 8 2.1.1. Definitions........................................................................................................................ 8 2.1.2. AT Command Syntax ...................................................................................................... 8 2.2 Declaration of AT Command Examples .................................................................................... 9 2.3 Description of Polte AT Commands........................................................................................... 9 2.3.1 AT+QPOLTECFG Configure Parameters of Polte SR Feature ................................... 9 2.3.1.1 AT+QPOLTECFG='service' Enable/Disable Polte SR Service ....................... 9 2.3.1.2 AT+QPOLTECFG='polteev' Enable/Disable Polte SR URCs........................ 10 2.3.1.3 AT+QPOLTECFG='register' Initiate Registration to Polte Server.................. 12 2.3.1.4 AT+QPOLTECFG='serverauth' Provide UE with Authentication Parameters13 2.3.1.5 AT+QPOLTECFG='mqttconfig' Set MQTT Configuration.............................. 13 2.3.2 AT+QPOLTE Trigger Polte SR Functionality ............................................................. 14 2.3.2.1 AT+QPOLTE='aux' Update Compressed Binary Auxiliary Data.................... 15 2.3.2.2 AT+QPOLTE='crs' Capture and Save CRS Symbols.................................... 16 2.3.2.3 AT+QPOLTE='compress' Capture, Compress and Save CRS Symbols ...... 17 2.3.2.4 AT+QPOLTE='ver' Request Version.............................................................. 18 2.3.2.5 AT+QPOLTE='report' Send Report................................................................ 19 2.3.2.6 AT+QPOLTE='locate' Capture, Compress and Send CRS Symbols ............ 20 2.3.2.7 AT+QPOLTE='getreg' Get Registration Parameters ..................................... 21 2.3.3 AT+QPOLTECRCFG Configure Parameters of Polte CR Feature............................ 22 2.3.4 AT+QPOLTECR Send Polte CR Location Request................................................... 23 3 Description of URCs ......................................................................................................................... 24 3.1. +QPOLTEEVU: 'CRS' Notify CRS Symbol Capture Event.................................................. 24 3.2. +QPOLTEEVU: 'COMPRESS' Notify CRS Data Compression Event ................................ 25 3.3. +QPOLTEEVU: 'REGISTER' Notify Polte Server Registration Event ................................. 25 3.4. +QPOLTEEVU: 'LOCATION' Notify Result of SR Location Reception from Polte Server .. 26 3.5. +QPOLTEEVU: 'ALLOWSTAT' Notify Change in Applicability of Polte Service ................. 27 3.6. +QPOLTECR Notify Result of CR Location Reception from Polte Server ........................... 27 4 Examples ........................................................................................................................................... 29 4.1 Polte SR Example .................................................................................................................... 29 4.2 Polte CR Example.................................................................................................................... 31 5 Appendix References ....................................................................................................................... 32 BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 4 / 33 LPWA Module Series Table Index Table 1: Applicable Modules ........................................................................................................................ 6 Table 2: Special Mark................................................................................................................................... 7 Table 3: Types of AT Commands ................................................................................................................ 8 Table 4: Related Documents...................................................................................................................... 32 Table 5: Terms and Abbreviations ............................................................................................................. 32 BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 5 / 33 LPWA Module Series 1 Introduction This document describes AT commands associated with the Positioning Over LTE (Polte) feature of Quectel LPWA modules. Polte Compression Engine (CE) embedded in the cellular modem leverages the Cell-specific Reference Signals (CRS) to offer the highest level of location accuracy. The device itself does not do any computing. It sends a sample of the LTE signals to the Polte cloud, and then the location is calculated by the server. Polte offers two location positioning services, Polte SuperRes (SR) and Polte CoreRes (CR) depending on the configuration and capability of the device. Polte SR provides higher level of accuracy than that of Polte CR, but it can only be utilized when eMTC (Cat M1) is in use. On the other hand, Polte CR is available on both radio access technologies (eMTC and NB-IoT). Internally, Quectel's implementations of Polte SR and Polte CR differ in how they send data to Polte server. Polte SR uses MQTT protocol while Polte CR utilizes HTTP. The AT commands are grouped into two categories, one supporting the SuperRes and the other supporting CoreRes. AT commands AT+QPOLTECFG and AT+QPOLTE (Chapter 2.3.1 and Chapter 2.3.2) support Polte SR, while AT+QPOLTECRCFG and AT+QPOLTECR (Chapter 2.3.3 and Chapter 2.3.4) support Polte CR. Table 1: Applicable Modules Module Series BG77xA-GL BG95xA-GL Model BG770A-GL BG772A-GL BG950A-GL BG951A-GL BG952A-GL* BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 6 / 33 1.1. Special Mark LPWA Module Series Table 2: Special Mark Mark * Definition Unless otherwise specified, when an asterisk (*) is used after a function, feature, interface, pin name, AT command, or argument, it indicates that the function, feature, interface, pin, AT command, or argument is under development and currently not supported; and the asterisk (*) after a model indicates that the sample of the model is currently unavailable. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 7 / 33 LPWA Module Series 2 Polte AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 3: Types of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 8 / 33 LPWA Module Series 2.2 Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3 Description of Polte AT Commands 2.3.1 AT+QPOLTECFG Configure Parameters of Polte SR Feature This command configures parameters for using Polte SR service. In addition, it enables SR URCs and configures MQTT settings. AT+QPOLTECFG Configure Parameters of Polte SR Feature Test Command AT+QPOLTECFG=? Response +QPOLTECFG: 'service',(list of supported s) +QPOLTECFG: 'polteev',(list of supported s),(list of supported s) +QPOLTECFG: 'register' +QPOLTECFG: 'serverauth' +QPOLTECFG: 'mqttconfig',,(list of supported s) Maximum Response Time OK 300 ms 2.3.1.1 AT+QPOLTECFG='service' Enable/Disable Polte SR Service This command enables or disables Polte SR service. AT+QPOLTECFG='service' Enable/Disable Polte SR Service Write Command Response AT+QPOLTECFG='service'[,] +QPOLTECFG: 'service', OK BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 9 / 33 LPWA Module Series Maximum Response Time Characteristics If the optional parameter is specified, configure Polte service. OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configuration is saved automatically. Parameter Integer type. 0 Disable Polte SR service 1 Enable Polte SR service Example AT+QPOLTECFG='service' +QPOLTECFG: 'service',1 //Query if Polte SR is activated. OK AT+QPOLTECFG='service',0 OK //Disable Polte SR service. 2.3.1.2 AT+QPOLTECFG='polteev' Enable/Disable Polte SR URCs This command enables or disables Polte SR related unsolicited result codes. The URCs are used to notify the host of the information from Polte SR application. The value 'ALL' of activates or deactivates all events. AT+QPOLTECFG='polteev' Enable/Disable Polte SR URCs Write Command AT+QPOLTECFG='polteev'[,,] Response If the optional parameters are omitted, query the current settings for all events. +QPOLTECFG: 'polteev': 'CRS',,'COMPRESS ',,'REGISTER',,'LOCATION',,'ALLOWSTAT', OK If the optional parameters are specified, configure Polte BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 10 / 33 LPWA Module Series Maximum Response Time Characteristics URCs. OK Or ERROR 300 ms The command takes effect immediately. The configuration is not saved. Parameter String type. Indicates Polte SR URCs beginning with +QPOLTEEVU:. For details of the URCs, see Chapter 3. 'ALL' Enables or disables all events 'CRS' Event reported for an attempt to capture CRS symbols, triggered by AT+QPOLTE='crs', AT+QPOLTE='compress' or AT+QPOLTE='locate' 'COMPRESS' Event reported for an attempt to compress CRS data, triggered by AT+QPOLTE='compress' or AT+QPOLTE='locate' 'REGISTER' Event reported for an attempt to register to Polte server, triggered by AT+QPOLTE='register' 'LOCATION' Event reported for result of location reception from Polte server, triggered by AT+QPOLTE='report' or AT+QPOLTE='locate' 'ALLOWSTAT' Event reported for a change in applicability of Polte SR service Integer type. 0 Disable URC 1 Enable URC Example AT+QPOLTECFG='polteev' //Query URC configuration, i.e., shows which URCs are enabled. +QPOLTECFG: 'polteev': 'CRS',0,'COMPRESS',0,'REGISTER',0,'LOCATION',0,'ALLOWSTA T',0 OK AT+QPOLTECFG='polteev','all',1 OK //Enable all URCs. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 11 / 33 LPWA Module Series 2.3.1.3 AT+QPOLTECFG='register' Initiate Registration to Polte Server This command initiates registration to the Polte server using UE parameters. AT+QPOLTECFG='register' Initiate Registration to Polte Server Write Command AT+QPOLTECFG='register' Response +QPOLTECFG: 'REGISTER', Maximum Response Time Characteristics OK Or ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. 0 Success 1 No response from server 12 Operation failure Example AT+QPOLTECFG='register' +QPOLTECFG: 'REGISTER',0 OK //In order to get following URC, corresponding event must be enabled. +QPOLTEEVU: 'REGISTER',0,'PhFRuPUIlnh','xkfgGgmesCK' NOTE 1. Registration to the Polte server (AT+QPOLTECFG='register') is executed only once when Polte SR feature is used for the first time. 2. If the registration was successful, the URC +QPOLTEEVU: 'REGISTER' will be received along with MQTT credentials that are used for further server authorization. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 12 / 33 LPWA Module Series 2.3.1.4 AT+QPOLTECFG='serverauth' Provide UE with Authentication Parameters This command provides the UE with authentication parameters required for successful sending of the compressed binary data to the Polte server. The command is used for renewing server authorization after the module reboots or wakes up from PSM and e-I-DRX modes. Before using the command for the first time, it is necessary to register the device with AT+QPOLTECFG='register'. AT+QPOLTECFG='serverauth' Provide UE with Authentication Parameters Write Command AT+QPOLTECFG='serverauth' Response OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. The configuration is not saved. Example AT+QPOLTECFG='serverauth' OK NOTE 1. Registration to the Polte server (AT+QPOLTECFG='register') is done only once when Polte SR feature is used for the first time, while server authorization (AT+QPOLTECFG='serverauth') is necessary each time the module reboots or wakes up from PSM and e-I-DRX modes. 2. In case of unsuccessful authorization or an error, it is necessary to execute AT+QPOLTECFG='register' again in order to renew MQTT credentials used for authorization. 2.3.1.5 AT+QPOLTECFG='mqttconfig' Set MQTT Configuration This command configures MQTT parameters. AT+QPOLTECFG='mqttconfig' Set MQTT Configuration Write Command AT+QPOLTECFG='mqttconfig',, Response OK Or ERROR BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 13 / 33 LPWA Module Series Maximum Response Time Characteristics 300 ms The command takes effect immediately. The configuration is not saved. Parameter Integer type. Duration of a timer to allow MQTT session before clearing Polte client session parameters. Range: 5–60. Default value: 25. Unit: s. Integer type. 0 Do not disconnect from MQTT server if timer expires 1 Disconnect from MQTT server if timer expires 2.3.2 AT+QPOLTE Trigger Polte SR Functionality This command triggers Polte SR functionality. AT+QPOLTE Trigger Polte SR Functionality Test Command AT+QPOLTE=? Response +QPOLTE: 'aux' +QPOLTE: 'crs',(range of supported ),(list of supported s) +QPOLTE: 'compress',(range of supported ), (list of supported s) +QPOLTE: 'ver' +QPOLTE: 'report', (list of supported s), +QPOLTE: 'locate',(range of supported ),(list of supported s) +QPOLTE: 'getreg' Maximum Response Time Characteristics OK 300 ms The command takes effect immediately. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 14 / 33 LPWA Module Series 2.3.2.1 AT+QPOLTE='aux' Update Compressed Binary Auxiliary Data This command gets auxiliary data (including RTTD field) and updates it into compressed binary data. The command is applied when sending data to Polte server in ways other than using AT+QPOLTE='report', and has to be executed in RRC connected state. When sending data to the server through AT+QPOLTE='report', RTTD value is added to Polte compressed data and sent along with it to the server automatically. When sending data to the server by other means, you can execute AT+QPOLTE='aux' to connect to the network to get RTTD value and send the resultant data to the server immediately; or you can send the data without RTTD value with degraded accuracy. AT+QPOLTE='aux' Update Compressed Binary Auxiliary Data Write Command AT+QPOLTE='aux' Response +QPOLTE: 'AUX', Maximum Response Time Characteristics OK Or ERROR 300 ms The command takes effect immediately. Parameter Integer type. 0 Success. Serving cell remains unchanged 1 Success. Serving cell has changed 2 No compressed file 3 RTTD is unavailable 4 Not enough memory 5 Error in file reading 6 Error in writing into file 7 Error in getting auxiliary data 8 RTTD is already present in auxiliary data Example AT+QPOLTE='aux' +QPOLTE: 'AUX',0 OK BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 15 / 33 LPWA Module Series 2.3.2.2 AT+QPOLTE='crs' Capture and Save CRS Symbols This command captures CRS symbols and saves the results to the file system. It’s for debugging purpose and is not supposed to be sent to the Polte server. AT+QPOLTE='crs' Capture and Save CRS Symbols Write Command AT+QPOLTE='crs',, Response +QPOLTE: 'CRS', OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Parameter Integer type. Number of frames for capturing CRS symbols. 0 Cancel CRS capture 1 Capture CRS symbols of 1 frame 2 Capture CRS symbols of 2 contiguous frames Integer type. 0 Save CRS symbols without waiting for RRC connected state 1 Wait for RRC connected state and get RTTD value before saving CRS symbols to file system Integer type. 0 Success 1 Invalid modem state 2 Wrong number of frames to capture 3 Not enough memory 4 Pending response from modem 5 Retrying capture attempt (previously buffered by application). It will try 3 times before it fails 7 Device ID unavailable 8 Capture attempt delayed due to ongoing paging 9 Flash read/write failure 12 A preceding operation has failed 13 Invalid RAT in use BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 16 / 33 LPWA Module Series Example AT+QPOLTE='crs',2,1 +QPOLTE: 'CRS',0 OK //To get the following URC, the corresponding event must be enabled +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,109,'b:/Polte/ polte-unpack' 2.3.2.3 AT+QPOLTE='compress' Capture, Compress and Save CRS Symbols This command captures CRS symbols, compresses them using the Compression-Engine (CE) and saves the results to the file system. AT+QPOLTE='compress' Capture, Compress and Save CRS Symbols Write Command AT+QPOLTE='compress',[,] Response +QPOLTE: 'COMPRESS', OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Parameter Integer type. Number of frames for capturing CRS symbols. 0 Cancel CRS capture 1 Capture CRS symbols of 1 frame 2 Capture CRS symbols of 2 contiguous frames Integer type. 0 Save CRS symbols without waiting for RRC connected state 1 Wait for RRC connected state and get RTTD value before saving CRS symbols to file system Integer type. 0 Success 1 Invalid modem state 2 Wrong number of frames to capture BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 17 / 33 LPWA Module Series 3 Not enough memory 4 Pending response from modem 5 Retrying capture attempt (previously buffered by application). It will try 3 times before it fails 7 Device ID unavailable 8 Capture attempt delayed due to ongoing paging 9 Flash read/write failure 12 A preceding operation has failed 13 Invalid RAT in use Example AT+QPOLTE='compress',2,0 +QPOLTE: 'COMPRESS',0 OK // To get the following URCs, corresponding events must be enabled +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,652 +QPOLTEEVU: 'COMPRESS',0,1652,'b:/Polte/polte-compress' NOTE RTTD value is added by default when using AT+QPOLTE='report' and AT+QPOLTE='aux', thus there is no need to wait for RRC connected state when executing AT+QPOLTE='compress'. 2.3.2.4 AT+QPOLTE='ver' Request Version This command requests the versions of the Polte application and CE. AT+QPOLTE='ver' Write Command AT+QPOLTE='ver' Request Version Response +QPOLTE: 'VER',, Maximum Response Time Characteristics OK Or ERROR 300 ms The command takes effect immediately. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 18 / 33 Parameter String type. Polte application version. String type. CE version. Example AT+QPOLTE='ver' +QPOLTE: 'VER','1.0.0','1.1.13' OK LPWA Module Series 2.3.2.5 AT+QPOLTE='report' Send Report This command sends a report including compressed binary data and RTTD value to the Polte server. AT+QPOLTE='report' Send Report Write Command AT+QPOLTE='report',[,] Response OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Parameter Integer type. 0 URC +QPOLTEEVU: 'LOCATION' is not expected, client shall disconnect from server immediately after data are sent. 1 URC +QPOLTEEVU: 'LOCATION' is expected, client shall not disconnect from server until the URC is received. String type. Optional path for sending file. By default, compressed binary data is stored at the directory b:/Polte/polte-compress (which is a path to store data after executing AT+QPOLTE='compress'), which will be used as a default file path for AT+QPOLTE='report'. In other cases, if user wants to send a file which is located at other locations on the disk, then the file path of other locations should be given accordingly. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 19 / 33 LPWA Module Series Example AT+QPOLTE='report',1 OK //To get the following URC, the corresponding event must be enabled +QPOLTEEVU: 'LOCATION',0,'44.823246574123395','20.413992050537633','1642512945','200' 2.3.2.6 AT+QPOLTE='locate' Capture, Compress and Send CRS Symbols This command combines the functions of AT+QPOLTE='compress' and AT+QPOLTE='report' into one action, which can reduce the need to save compressed data (i.e., the output of AT+QPOLTE='compress') to flash and read them before sending them to server. The command captures CRS symbols, compresses them and sends the results to server. AT+QPOLTE='locate' Capture, Compress and Send CRS Symbols Write Command AT+QPOLTE='locate',, Response +QPOLTE: 'LOCATE', OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Parameter Integer type. Number of frames for capturing CRS symbols. 0 Cancel CRS capture 1 Capture CRS symbols of 1 frame 2 Capture CRS symbols of 2 contiguous frames Integer type. 0 Don't request to get location back 1 Request to get location back to the device after it has been generated by the server Integer type. 0 Success 1 Invalid modem state 2 Wrong number of frames to capture 3 Not enough memory BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 20 / 33 LPWA Module Series 4 Pending response from modem 5 Retrying capture attempt (previously buffered by application). It will try 3 times before it fails 7 Device ID unavailable 8 Capture attempt delayed because of ongoing paging 9 Flash read/write failure 10 Successful positioning during PSM 11 Unsuccessful positioning during PSM 12 A preceding operation failure 13 Invalid RAT in use Example AT+QPOLTE='locate',2,1 +QPOLTE: 'LOCATE',0 OK //To get the following URCs, corresponding events must be enabled. +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,133 +QPOLTEEVU: 'COMPRESS',0,906 +QPOLTEEVU: 'LOCATION',0,'44.82272508613134','20.414680280163452','1642512945', '149.60' 2.3.2.7 AT+QPOLTE='getreg' Get Registration Parameters This command provides UE with specific parameters needed to register the UE to the Polte server. AT+QPOLTE='getreg' Get Registration Parameters Write Command AT+QPOLTE='getreg' Response +QPOLTE: 'GETREG',,, , Maximum Response Time Characteristics OK Or ERROR 300 ms The command takes effect immediately. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 21 / 33 LPWA Module Series Parameter String type. Manufacturer token. Maximum size: 20 characters. String type. Model token. Maximum size: 20 characters. String type. Decimal format indicating device IMEI number. String type. Unique modem token. Maximum size: 256 characters. Example AT+QPOLTE='getreg' +QPOLTE: GETREG','a3de2b6e510','dc6a91c7883','863593050015320','ALT12508B9933A0C6 4505BE3FFE553B5FA3EFB3' OK 2.3.3 AT+QPOLTECRCFG Configure Parameters of Polte CR Feature This command configures parameters for using Polte CR service. Data is sent to the Polte server by using HTTP protocol in Polte CR service. Thus, it needs parameters such as Customer ID and API Token for setting HTTP URL and HTTP authorization process. The Customer ID and API Token can be acquired from Polte company upon registration, see Chapter 4.2 for details. AT+QPOLTECRCFG Configure Parameters of Polte CR Feature Write Command AT+QPOLTECRCFG= , Response OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. The configuration is saved. Parameter String type. Customer ID used for setting HTTP URL. String type. API token used for HTTP authorization. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 22 / 33 LPWA Module Series Example AT+QPOLTECRCFG='5fff4ee770e961101864cb1a','8d5d837a97f27f7da84264e5ad1ac24644c2a6 68256fa38a41a1ebf29a09eba34' OK 2.3.4 AT+QPOLTECR Send Polte CR Location Request This command sends Polte CR location request to Polte server. Internally, this command is executed in two phases. Firstly, it collects cell related data. After gathering all necessary data, it assembles payload which is then sent to Polte server using HTTP, then the location will be returned by the URC +QPOLTECR. AT+QPOLTECR Send Polte CR Location Request Write Command AT+QPOLTECR Response OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Example AT+QPOLTECR OK +QPOLTECR:0,'44.826452','20.40706','1646213056','194' BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 23 / 33 LPWA Module Series 3 Description of URCs Polte URCs begin with +QPOLTEEVU: and they are mainly used to notify the host of the information from the Polte application. For detailed information about enabling Polte URCs, see Chapter 2.3.1.2. 3.1. +QPOLTEEVU: 'CRS' Notify CRS Symbol Capture Event The URC notifies the host of a CRS symbol capture event. +QPOLTEEVU: 'CRS' Notify CRS Symbol Capture Event +QPOLTEEVU: 'CRS',[,,,,,,,,,,[,]] Event reported for an attempt to capture CRS symbols, triggered by AT+QPOLTE='crs', AT+QPOLTE='compress' or AT+QPOLTE='locate'. Parameter Integer type. 0 Success 1 Invalid modem state 2 Not enough memory 12 Operation failure String type. Device IMEI number. String type. Two-byte tacking area code in hexadecimal format. Integer type. Three-digit value indicating mobile country code. Integer type. Three-digit value indicating mobile network code. String type. Four-byte E-UTRAN cell ID in hexadecimal format. Integer type. Physical cell ID value. Integer type. Stands for E-UTRA Absolute Radio Frequency Channel Number of the modem at the time of data capture. Integer type. Enumeration of E-UTRA bandwidths for serving cell. Unit of bandwidth: MHz. 0 0.18 1 1.4 2 3 BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 24 / 33 LPWA Module Series 3 5 4 10 5 15 6 20 Integer type. Number of captured contiguous OFDM symbols. Range: 0–80. Integer type. System frame number (SFN) of the first CRS data block. String type. File system path to the captured CRS data. 3.2. +QPOLTEEVU: 'COMPRESS' Notify CRS Data Compression Event This URC notifies the host of a CRS data compression event. +QPOLTEEVU: 'COMPRESS' Notify CRS Data Compression Event Event reported for an attempt to compress CRS data, +QPOLTEEVU: 'COMPRESS', triggered by AT+QPOLTE='compress' or [,[,]] AT+QPOLTE='locate'. Parameter Integer type. 0 Success 1 Invalid modem state 2 Not enough memory 12 Operation failure Integer type. Length of the compressed file. Range: 0–3000. Unit: byte. String type. File system path to save the compressed binary data. 3.3. +QPOLTEEVU: 'REGISTER' Notify Polte Server Registration Event This URC notifies the host of a Polte server registration event. +QPOLTEEVU: 'REGISTER' Notify Polte Server Registration Event +QPOLTEEVU: 'REGISTER',[, Event reported for an attempt to register to Polte server, ,] triggered by AT+QPOLTECFG='register'. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 25 / 33 Parameter LPWA Module Series Integer type. 0 Success 1 No response from server 12 Preceding operation failure String type. Username to the Polte server. Maximum size: 20 characters. String type. Password to the Polte server. Maximum size: 20 characters. 3.4. +QPOLTEEVU: 'LOCATION' Reception from Polte Server Notify Result of SR Location This URC notifies the host of the result of location reception from Polte server. +QPOLTEEVU: 'LOCATION' Notify Result of Location Reception from Polte Server +QPOLTEEVU: 'LOCATION', Event reported for result of location reception from Polte [,,,,] AT+QPOLTE='locate'. Parameter Integer type. 0 Success 1 No response from server 2 Operation failure String type. Contains floating value in quotes. Latitude is defined and returned by NMEA message GGA. Positive values represent 'North' and negative values represent 'South'. String type. Contains floating value in quotes. Longitude is defined and returned by NMEA message GGA. Positive values represent 'East' and negative values represent 'West'. Integer type. UTC timestamp of the position counted since January 1, 1970. Unit: ms. String type. Contains floating value in quotes. Confidence level as reported by Polte and represents certainty of fix in meters. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 26 / 33 LPWA Module Series 3.5. +QPOLTEEVU: 'ALLOWSTAT' Notify Change in Applicability of Polte Service This URC notifies the host of a change in applicability of Polte service. +QPOLTEEVU: 'ALLOWSTAT' Notify Change in Applicability of Polte Service +QPOLTEEVU: ALLOWSTAT', Event reported for a change in applicability of Polte service. Parameter Integer type. 0 Polte service is disabled, the modem cannot receive Polte-related AT commands 1 Polte service is enabled, the modem can receive Polte-related AT commands 3.6. +QPOLTECR Notify Result of CR Location Reception from Polte Server This URC notifies the host of the result of CR location reception from Polte server. +QPOLTECR Notify Result of CR Location Reception from Polte Server +QPOLTECR: [,,,,] server, triggered by AT+QPOLTECR. Parameter Integer type. 0 Success 1 No response from server 2 Operation failure String type. Contains floating value in quotes. Latitude is defined and returned by NMEA message GGA. Positive values represent 'North' and negative values represent 'South'. String type. Contains floating value in quotes. Longitude is defined and returned by NMEA message GGA. Positive values represent 'East' and BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 27 / 33 LPWA Module Series negative values represent 'West'. Integer type. UTC timestamp of the position counted since January 1, 1970. Unit: ms. String type. Contains floating value in quotes. Confidence level as reported by Polte and represents certainty of fix in meters. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 28 / 33 LPWA Module Series 4 Examples Examples of how to configure and use Polte features are presented in this chapter. 4.1. Polte SR Example To use Polte SR, the user has to register to https://polte.io. After log-in, the user should: ⚫ Add new device: User Equipment → BULK CLAIM ⚫ Choose 'IMEI' for 'Identifier Type' ⚫ Choose 'AT2' for 'Product Definition' ⚫ Download claimUeSample.csv file ⚫ Append the IMEI number at the bottom of the claimUeSample.csv file and reupload the file (click 'cloud' button) ⚫ Click on 'SUBMIT' Polte service has to be enabled (module reboot is required after this command in order to activate Polte): AT+QPOLTECFG='service',1 OK When using the Polte feature for the first time, device registration is necessary. If the registration is successful, the URC +QPOLTEEVU: 'REGISTER' will be received from the server along with MQTT credentials. Those credentials are necessary for further server authorization (AT+QPOLTECFG='serverauth'). AT+QPOLTECFG='polteev','register',1 OK AT+QPOLTECFG='register' +QPOLTECFG: 'REGISTER',0 OK +QPOLTEEVU: 'REGISTER',0,'mqtt_username','mqtt_password' Using Polte requires server authorization after each reboot: AT+QPOLTECFG='serverauth' OK BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 29 / 33 LPWA Module Series NOTE 1. Before first authorization, registration must be done (AT+QPOLTECFG='register'). 2. In case AT+QPOLTECFG='serverauth' returns ERROR or the authentication is unsuccessful for any reason, try to execute AT+QPOLTECFG='register' one more time to renew MQTT credentials used by AT+QPOLTECFG='serverauth'. To report device location, the users must: ⚫ Enable all +QPOLTEEVU URCs ⚫ Capture two frames: AT+QPOLTE='compress',2,0 ⚫ Report data to the cloud AT+QPOLTECFG='polteev','all',1 OK AT+QPOLTE='compress',2,0 +QPOLTE: 'COMPRESS',0 OK +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,652 +QPOLTEEVU: 'COMPRESS',0,1652,'b:/Polte/polte-compress' AT+QPOLTE='report',1 OK +QPOLTEEVU: 'LOCATION',0,'44.823246574123395','20.413992050537633','1642512945', '200' It is also possible to combine AT+QPOLTE='compress' and AT+QPOLTE='report' by using AT+QPOLTE='locate'. It is noted that AT+QPOLTE='locate' is not power optimized. Recommended flow is to use AT+QPOLTE='compress' and then AT+QPOLTE='report'. AT+QPOLTE='locate',2,1 +QPOLTE: 'LOCATE',0 OK +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,133 +QPOLTEEVU: 'COMPRESS',0,906 +QPOLTEEVU: 'LOCATION',0,'44.82272508613134','20.414680280163452','1642512945', '149.60' BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 30 / 33 LPWA Module Series 4.2. Polte CR Example To use Polte CR, the user must register to https://polte.io and acquire Customer ID and API Token. Customer ID can be found under 'Customer Profile' setting (upper right-hand corner), while API Token is created in the 'API Tokens' section (top of the window). When using Polte CR feature for the first time, the user must configure necessary parameters (Customer ID and API Token): AT+QPOLTECRCFG= '5fff4ee770e961101864cb1a','8d5d837a97f27f7da84264e5ad1ac24644c2a6 68256fa38a41a1ebf29a09eba34' OK Then you can send location request: AT+QPOLTECR OK +QPOLTECR:0,'44.826452','20.40706','1646213056','194' After successful locating, an URC carrying location information will be received. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 31 / 33 LPWA Module Series 5 Appendix References Table 4: Related Documents Document Name [1] Quectel_BG77xA-GL&BG95xA-GL_GNSS_Application_Note [2] Quectel_BG77xA-GL&BG95xA-GL_QuecLocator_Application_Note [3] Quectel_BG77xA-GL&BG95xA-GL_AT_Commands_Manual Table 5: Terms and Abbreviations Abbreviation CE CR CRS E-UTRA E-UTRAN GGA ID IMEI LTE MQTT NMEA OFDM Description Compression Engine CoreRes Cell Specific Reference Signal Evolved Universal Terrestrial Radio Access Evolved Universal Terrestrial Radio Access Network Global Positioning System Fix Data Identifier International Mobile Equipment Identity Long-Term Evolution Message Queuing Telemetry Transport National Marine Electronics Association Orthogonal Frequency-Division Multiplexing BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 32 / 33 Polte RRC RTTD SFN SR UE URC UTC Positioning Over LTE Radio Resource Control Receive Transmit Time Difference System Frame Number SuperRes User Equipment Unsolicited Result Code Coordinated Universal Time LPWA Module Series BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 33 / 33

BG77xA-GL&BG95xA-GL Positioning over LTE Application Note LPWA Module Series Version: 1.0 Date: 2022-03-11 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal nonexclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 1 / 33 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any thirdparty intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 2 / 33 LPWA Module Series About the Document Revision History Version 1.0 Date 2020-10-29 2022-03-11 Author Mladen VUKOVIC Mladen VUKOVIC Description Creation of the document First official release BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 3 / 33 LPWA Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 1.1. Special Mark .............................................................................................................................. 7 2 Polte AT Commands........................................................................................................................... 8 2.1. AT Command Introduction ......................................................................................................... 8 2.1.1. Definitions........................................................................................................................ 8 2.1.2. AT Command Syntax ...................................................................................................... 8 2.2 Declaration of AT Command Examples .................................................................................... 9 2.3 Description of Polte AT Commands........................................................................................... 9 2.3.1 AT+QPOLTECFG Configure Parameters of Polte SR Feature ................................... 9 2.3.1.1 AT+QPOLTECFG='service' Enable/Disable Polte SR Service ....................... 9 2.3.1.2 AT+QPOLTECFG='polteev' Enable/Disable Polte SR URCs........................ 10 2.3.1.3 AT+QPOLTECFG='register' Initiate Registration to Polte Server.................. 12 2.3.1.4 AT+QPOLTECFG='serverauth' Provide UE with Authentication Parameters13 2.3.1.5 AT+QPOLTECFG='mqttconfig' Set MQTT Configuration.............................. 13 2.3.2 AT+QPOLTE Trigger Polte SR Functionality ............................................................. 14 2.3.2.1 AT+QPOLTE='aux' Update Compressed Binary Auxiliary Data.................... 15 2.3.2.2 AT+QPOLTE='crs' Capture and Save CRS Symbols.................................... 16 2.3.2.3 AT+QPOLTE='compress' Capture, Compress and Save CRS Symbols ...... 17 2.3.2.4 AT+QPOLTE='ver' Request Version.............................................................. 18 2.3.2.5 AT+QPOLTE='report' Send Report................................................................ 19 2.3.2.6 AT+QPOLTE='locate' Capture, Compress and Send CRS Symbols ............ 20 2.3.2.7 AT+QPOLTE='getreg' Get Registration Parameters ..................................... 21 2.3.3 AT+QPOLTECRCFG Configure Parameters of Polte CR Feature............................ 22 2.3.4 AT+QPOLTECR Send Polte CR Location Request................................................... 23 3 Description of URCs ......................................................................................................................... 24 3.1. +QPOLTEEVU: 'CRS' Notify CRS Symbol Capture Event.................................................. 24 3.2. +QPOLTEEVU: 'COMPRESS' Notify CRS Data Compression Event ................................ 25 3.3. +QPOLTEEVU: 'REGISTER' Notify Polte Server Registration Event ................................. 25 3.4. +QPOLTEEVU: 'LOCATION' Notify Result of SR Location Reception from Polte Server .. 26 3.5. +QPOLTEEVU: 'ALLOWSTAT' Notify Change in Applicability of Polte Service ................. 27 3.6. +QPOLTECR Notify Result of CR Location Reception from Polte Server ........................... 27 4 Examples ........................................................................................................................................... 29 4.1 Polte SR Example .................................................................................................................... 29 4.2 Polte CR Example.................................................................................................................... 31 5 Appendix References ....................................................................................................................... 32 BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 4 / 33 LPWA Module Series Table Index Table 1: Applicable Modules ........................................................................................................................ 6 Table 2: Special Mark................................................................................................................................... 7 Table 3: Types of AT Commands ................................................................................................................ 8 Table 4: Related Documents...................................................................................................................... 32 Table 5: Terms and Abbreviations ............................................................................................................. 32 BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 5 / 33 LPWA Module Series 1 Introduction This document describes AT commands associated with the Positioning Over LTE (Polte) feature of Quectel LPWA modules. Polte Compression Engine (CE) embedded in the cellular modem leverages the Cell-specific Reference Signals (CRS) to offer the highest level of location accuracy. The device itself does not do any computing. It sends a sample of the LTE signals to the Polte cloud, and then the location is calculated by the server. Polte offers two location positioning services, Polte SuperRes (SR) and Polte CoreRes (CR) depending on the configuration and capability of the device. Polte SR provides higher level of accuracy than that of Polte CR, but it can only be utilized when eMTC (Cat M1) is in use. On the other hand, Polte CR is available on both radio access technologies (eMTC and NB-IoT). Internally, Quectel's implementations of Polte SR and Polte CR differ in how they send data to Polte server. Polte SR uses MQTT protocol while Polte CR utilizes HTTP. The AT commands are grouped into two categories, one supporting the SuperRes and the other supporting CoreRes. AT commands AT+QPOLTECFG and AT+QPOLTE (Chapter 2.3.1 and Chapter 2.3.2) support Polte SR, while AT+QPOLTECRCFG and AT+QPOLTECR (Chapter 2.3.3 and Chapter 2.3.4) support Polte CR. Table 1: Applicable Modules Module Series BG77xA-GL BG95xA-GL Model BG770A-GL BG772A-GL BG950A-GL BG951A-GL BG952A-GL* BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 6 / 33 1.1. Special Mark LPWA Module Series Table 2: Special Mark Mark * Definition Unless otherwise specified, when an asterisk (*) is used after a function, feature, interface, pin name, AT command, or argument, it indicates that the function, feature, interface, pin, AT command, or argument is under development and currently not supported; and the asterisk (*) after a model indicates that the sample of the model is currently unavailable. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 7 / 33 LPWA Module Series 2 Polte AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 3: Types of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 8 / 33 LPWA Module Series 2.2 Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3 Description of Polte AT Commands 2.3.1 AT+QPOLTECFG Configure Parameters of Polte SR Feature This command configures parameters for using Polte SR service. In addition, it enables SR URCs and configures MQTT settings. AT+QPOLTECFG Configure Parameters of Polte SR Feature Test Command AT+QPOLTECFG=? Response +QPOLTECFG: 'service',(list of supported s) +QPOLTECFG: 'polteev',(list of supported s),(list of supported s) +QPOLTECFG: 'register' +QPOLTECFG: 'serverauth' +QPOLTECFG: 'mqttconfig',,(list of supported s) Maximum Response Time OK 300 ms 2.3.1.1 AT+QPOLTECFG='service' Enable/Disable Polte SR Service This command enables or disables Polte SR service. AT+QPOLTECFG='service' Enable/Disable Polte SR Service Write Command Response AT+QPOLTECFG='service'[,] +QPOLTECFG: 'service', OK BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 9 / 33 LPWA Module Series Maximum Response Time Characteristics If the optional parameter is specified, configure Polte service. OK Or ERROR 300 ms The command takes effect after the module is rebooted. The configuration is saved automatically. Parameter Integer type. 0 Disable Polte SR service 1 Enable Polte SR service Example AT+QPOLTECFG='service' +QPOLTECFG: 'service',1 //Query if Polte SR is activated. OK AT+QPOLTECFG='service',0 OK //Disable Polte SR service. 2.3.1.2 AT+QPOLTECFG='polteev' Enable/Disable Polte SR URCs This command enables or disables Polte SR related unsolicited result codes. The URCs are used to notify the host of the information from Polte SR application. The value 'ALL' of activates or deactivates all events. AT+QPOLTECFG='polteev' Enable/Disable Polte SR URCs Write Command AT+QPOLTECFG='polteev'[,,] Response If the optional parameters are omitted, query the current settings for all events. +QPOLTECFG: 'polteev': 'CRS',,'COMPRESS ',,'REGISTER',,'LOCATION',,'ALLOWSTAT', OK If the optional parameters are specified, configure Polte BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 10 / 33 LPWA Module Series Maximum Response Time Characteristics URCs. OK Or ERROR 300 ms The command takes effect immediately. The configuration is not saved. Parameter String type. Indicates Polte SR URCs beginning with +QPOLTEEVU:. For details of the URCs, see Chapter 3. 'ALL' Enables or disables all events 'CRS' Event reported for an attempt to capture CRS symbols, triggered by AT+QPOLTE='crs', AT+QPOLTE='compress' or AT+QPOLTE='locate' 'COMPRESS' Event reported for an attempt to compress CRS data, triggered by AT+QPOLTE='compress' or AT+QPOLTE='locate' 'REGISTER' Event reported for an attempt to register to Polte server, triggered by AT+QPOLTE='register' 'LOCATION' Event reported for result of location reception from Polte server, triggered by AT+QPOLTE='report' or AT+QPOLTE='locate' 'ALLOWSTAT' Event reported for a change in applicability of Polte SR service Integer type. 0 Disable URC 1 Enable URC Example AT+QPOLTECFG='polteev' //Query URC configuration, i.e., shows which URCs are enabled. +QPOLTECFG: 'polteev': 'CRS',0,'COMPRESS',0,'REGISTER',0,'LOCATION',0,'ALLOWSTA T',0 OK AT+QPOLTECFG='polteev','all',1 OK //Enable all URCs. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 11 / 33 LPWA Module Series 2.3.1.3 AT+QPOLTECFG='register' Initiate Registration to Polte Server This command initiates registration to the Polte server using UE parameters. AT+QPOLTECFG='register' Initiate Registration to Polte Server Write Command AT+QPOLTECFG='register' Response +QPOLTECFG: 'REGISTER', Maximum Response Time Characteristics OK Or ERROR 300 ms The command takes effect immediately. The configuration is saved automatically. Parameter Integer type. 0 Success 1 No response from server 12 Operation failure Example AT+QPOLTECFG='register' +QPOLTECFG: 'REGISTER',0 OK //In order to get following URC, corresponding event must be enabled. +QPOLTEEVU: 'REGISTER',0,'PhFRuPUIlnh','xkfgGgmesCK' NOTE 1. Registration to the Polte server (AT+QPOLTECFG='register') is executed only once when Polte SR feature is used for the first time. 2. If the registration was successful, the URC +QPOLTEEVU: 'REGISTER' will be received along with MQTT credentials that are used for further server authorization. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 12 / 33 LPWA Module Series 2.3.1.4 AT+QPOLTECFG='serverauth' Provide UE with Authentication Parameters This command provides the UE with authentication parameters required for successful sending of the compressed binary data to the Polte server. The command is used for renewing server authorization after the module reboots or wakes up from PSM and e-I-DRX modes. Before using the command for the first time, it is necessary to register the device with AT+QPOLTECFG='register'. AT+QPOLTECFG='serverauth' Provide UE with Authentication Parameters Write Command AT+QPOLTECFG='serverauth' Response OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. The configuration is not saved. Example AT+QPOLTECFG='serverauth' OK NOTE 1. Registration to the Polte server (AT+QPOLTECFG='register') is done only once when Polte SR feature is used for the first time, while server authorization (AT+QPOLTECFG='serverauth') is necessary each time the module reboots or wakes up from PSM and e-I-DRX modes. 2. In case of unsuccessful authorization or an error, it is necessary to execute AT+QPOLTECFG='register' again in order to renew MQTT credentials used for authorization. 2.3.1.5 AT+QPOLTECFG='mqttconfig' Set MQTT Configuration This command configures MQTT parameters. AT+QPOLTECFG='mqttconfig' Set MQTT Configuration Write Command AT+QPOLTECFG='mqttconfig',, Response OK Or ERROR BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 13 / 33 LPWA Module Series Maximum Response Time Characteristics 300 ms The command takes effect immediately. The configuration is not saved. Parameter Integer type. Duration of a timer to allow MQTT session before clearing Polte client session parameters. Range: 5–60. Default value: 25. Unit: s. Integer type. 0 Do not disconnect from MQTT server if timer expires 1 Disconnect from MQTT server if timer expires 2.3.2 AT+QPOLTE Trigger Polte SR Functionality This command triggers Polte SR functionality. AT+QPOLTE Trigger Polte SR Functionality Test Command AT+QPOLTE=? Response +QPOLTE: 'aux' +QPOLTE: 'crs',(range of supported ),(list of supported s) +QPOLTE: 'compress',(range of supported ), (list of supported s) +QPOLTE: 'ver' +QPOLTE: 'report', (list of supported s), +QPOLTE: 'locate',(range of supported ),(list of supported s) +QPOLTE: 'getreg' Maximum Response Time Characteristics OK 300 ms The command takes effect immediately. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 14 / 33 LPWA Module Series 2.3.2.1 AT+QPOLTE='aux' Update Compressed Binary Auxiliary Data This command gets auxiliary data (including RTTD field) and updates it into compressed binary data. The command is applied when sending data to Polte server in ways other than using AT+QPOLTE='report', and has to be executed in RRC connected state. When sending data to the server through AT+QPOLTE='report', RTTD value is added to Polte compressed data and sent along with it to the server automatically. When sending data to the server by other means, you can execute AT+QPOLTE='aux' to connect to the network to get RTTD value and send the resultant data to the server immediately; or you can send the data without RTTD value with degraded accuracy. AT+QPOLTE='aux' Update Compressed Binary Auxiliary Data Write Command AT+QPOLTE='aux' Response +QPOLTE: 'AUX', Maximum Response Time Characteristics OK Or ERROR 300 ms The command takes effect immediately. Parameter Integer type. 0 Success. Serving cell remains unchanged 1 Success. Serving cell has changed 2 No compressed file 3 RTTD is unavailable 4 Not enough memory 5 Error in file reading 6 Error in writing into file 7 Error in getting auxiliary data 8 RTTD is already present in auxiliary data Example AT+QPOLTE='aux' +QPOLTE: 'AUX',0 OK BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 15 / 33 LPWA Module Series 2.3.2.2 AT+QPOLTE='crs' Capture and Save CRS Symbols This command captures CRS symbols and saves the results to the file system. It’s for debugging purpose and is not supposed to be sent to the Polte server. AT+QPOLTE='crs' Capture and Save CRS Symbols Write Command AT+QPOLTE='crs',, Response +QPOLTE: 'CRS', OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Parameter Integer type. Number of frames for capturing CRS symbols. 0 Cancel CRS capture 1 Capture CRS symbols of 1 frame 2 Capture CRS symbols of 2 contiguous frames Integer type. 0 Save CRS symbols without waiting for RRC connected state 1 Wait for RRC connected state and get RTTD value before saving CRS symbols to file system Integer type. 0 Success 1 Invalid modem state 2 Wrong number of frames to capture 3 Not enough memory 4 Pending response from modem 5 Retrying capture attempt (previously buffered by application). It will try 3 times before it fails 7 Device ID unavailable 8 Capture attempt delayed due to ongoing paging 9 Flash read/write failure 12 A preceding operation has failed 13 Invalid RAT in use BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 16 / 33 LPWA Module Series Example AT+QPOLTE='crs',2,1 +QPOLTE: 'CRS',0 OK //To get the following URC, the corresponding event must be enabled +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,109,'b:/Polte/ polte-unpack' 2.3.2.3 AT+QPOLTE='compress' Capture, Compress and Save CRS Symbols This command captures CRS symbols, compresses them using the Compression-Engine (CE) and saves the results to the file system. AT+QPOLTE='compress' Capture, Compress and Save CRS Symbols Write Command AT+QPOLTE='compress',[,] Response +QPOLTE: 'COMPRESS', OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Parameter Integer type. Number of frames for capturing CRS symbols. 0 Cancel CRS capture 1 Capture CRS symbols of 1 frame 2 Capture CRS symbols of 2 contiguous frames Integer type. 0 Save CRS symbols without waiting for RRC connected state 1 Wait for RRC connected state and get RTTD value before saving CRS symbols to file system Integer type. 0 Success 1 Invalid modem state 2 Wrong number of frames to capture BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 17 / 33 LPWA Module Series 3 Not enough memory 4 Pending response from modem 5 Retrying capture attempt (previously buffered by application). It will try 3 times before it fails 7 Device ID unavailable 8 Capture attempt delayed due to ongoing paging 9 Flash read/write failure 12 A preceding operation has failed 13 Invalid RAT in use Example AT+QPOLTE='compress',2,0 +QPOLTE: 'COMPRESS',0 OK // To get the following URCs, corresponding events must be enabled +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,652 +QPOLTEEVU: 'COMPRESS',0,1652,'b:/Polte/polte-compress' NOTE RTTD value is added by default when using AT+QPOLTE='report' and AT+QPOLTE='aux', thus there is no need to wait for RRC connected state when executing AT+QPOLTE='compress'. 2.3.2.4 AT+QPOLTE='ver' Request Version This command requests the versions of the Polte application and CE. AT+QPOLTE='ver' Write Command AT+QPOLTE='ver' Request Version Response +QPOLTE: 'VER',, Maximum Response Time Characteristics OK Or ERROR 300 ms The command takes effect immediately. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 18 / 33 Parameter String type. Polte application version. String type. CE version. Example AT+QPOLTE='ver' +QPOLTE: 'VER','1.0.0','1.1.13' OK LPWA Module Series 2.3.2.5 AT+QPOLTE='report' Send Report This command sends a report including compressed binary data and RTTD value to the Polte server. AT+QPOLTE='report' Send Report Write Command AT+QPOLTE='report',[,] Response OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Parameter Integer type. 0 URC +QPOLTEEVU: 'LOCATION' is not expected, client shall disconnect from server immediately after data are sent. 1 URC +QPOLTEEVU: 'LOCATION' is expected, client shall not disconnect from server until the URC is received. String type. Optional path for sending file. By default, compressed binary data is stored at the directory b:/Polte/polte-compress (which is a path to store data after executing AT+QPOLTE='compress'), which will be used as a default file path for AT+QPOLTE='report'. In other cases, if user wants to send a file which is located at other locations on the disk, then the file path of other locations should be given accordingly. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 19 / 33 LPWA Module Series Example AT+QPOLTE='report',1 OK //To get the following URC, the corresponding event must be enabled +QPOLTEEVU: 'LOCATION',0,'44.823246574123395','20.413992050537633','1642512945','200' 2.3.2.6 AT+QPOLTE='locate' Capture, Compress and Send CRS Symbols This command combines the functions of AT+QPOLTE='compress' and AT+QPOLTE='report' into one action, which can reduce the need to save compressed data (i.e., the output of AT+QPOLTE='compress') to flash and read them before sending them to server. The command captures CRS symbols, compresses them and sends the results to server. AT+QPOLTE='locate' Capture, Compress and Send CRS Symbols Write Command AT+QPOLTE='locate',, Response +QPOLTE: 'LOCATE', OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Parameter Integer type. Number of frames for capturing CRS symbols. 0 Cancel CRS capture 1 Capture CRS symbols of 1 frame 2 Capture CRS symbols of 2 contiguous frames Integer type. 0 Don't request to get location back 1 Request to get location back to the device after it has been generated by the server Integer type. 0 Success 1 Invalid modem state 2 Wrong number of frames to capture 3 Not enough memory BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 20 / 33 LPWA Module Series 4 Pending response from modem 5 Retrying capture attempt (previously buffered by application). It will try 3 times before it fails 7 Device ID unavailable 8 Capture attempt delayed because of ongoing paging 9 Flash read/write failure 10 Successful positioning during PSM 11 Unsuccessful positioning during PSM 12 A preceding operation failure 13 Invalid RAT in use Example AT+QPOLTE='locate',2,1 +QPOLTE: 'LOCATE',0 OK //To get the following URCs, corresponding events must be enabled. +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,133 +QPOLTEEVU: 'COMPRESS',0,906 +QPOLTEEVU: 'LOCATION',0,'44.82272508613134','20.414680280163452','1642512945', '149.60' 2.3.2.7 AT+QPOLTE='getreg' Get Registration Parameters This command provides UE with specific parameters needed to register the UE to the Polte server. AT+QPOLTE='getreg' Get Registration Parameters Write Command AT+QPOLTE='getreg' Response +QPOLTE: 'GETREG',,, , Maximum Response Time Characteristics OK Or ERROR 300 ms The command takes effect immediately. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 21 / 33 LPWA Module Series Parameter String type. Manufacturer token. Maximum size: 20 characters. String type. Model token. Maximum size: 20 characters. String type. Decimal format indicating device IMEI number. String type. Unique modem token. Maximum size: 256 characters. Example AT+QPOLTE='getreg' +QPOLTE: GETREG','a3de2b6e510','dc6a91c7883','863593050015320','ALT12508B9933A0C6 4505BE3FFE553B5FA3EFB3' OK 2.3.3 AT+QPOLTECRCFG Configure Parameters of Polte CR Feature This command configures parameters for using Polte CR service. Data is sent to the Polte server by using HTTP protocol in Polte CR service. Thus, it needs parameters such as Customer ID and API Token for setting HTTP URL and HTTP authorization process. The Customer ID and API Token can be acquired from Polte company upon registration, see Chapter 4.2 for details. AT+QPOLTECRCFG Configure Parameters of Polte CR Feature Write Command AT+QPOLTECRCFG= , Response OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. The configuration is saved. Parameter String type. Customer ID used for setting HTTP URL. String type. API token used for HTTP authorization. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 22 / 33 LPWA Module Series Example AT+QPOLTECRCFG='5fff4ee770e961101864cb1a','8d5d837a97f27f7da84264e5ad1ac24644c2a6 68256fa38a41a1ebf29a09eba34' OK 2.3.4 AT+QPOLTECR Send Polte CR Location Request This command sends Polte CR location request to Polte server. Internally, this command is executed in two phases. Firstly, it collects cell related data. After gathering all necessary data, it assembles payload which is then sent to Polte server using HTTP, then the location will be returned by the URC +QPOLTECR. AT+QPOLTECR Send Polte CR Location Request Write Command AT+QPOLTECR Response OK Or ERROR Maximum Response Time 300 ms Characteristics The command takes effect immediately. Example AT+QPOLTECR OK +QPOLTECR:0,'44.826452','20.40706','1646213056','194' BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 23 / 33 LPWA Module Series 3 Description of URCs Polte URCs begin with +QPOLTEEVU: and they are mainly used to notify the host of the information from the Polte application. For detailed information about enabling Polte URCs, see Chapter 2.3.1.2. 3.1. +QPOLTEEVU: 'CRS' Notify CRS Symbol Capture Event The URC notifies the host of a CRS symbol capture event. +QPOLTEEVU: 'CRS' Notify CRS Symbol Capture Event +QPOLTEEVU: 'CRS',[,,,,,,,,,,[,]] Event reported for an attempt to capture CRS symbols, triggered by AT+QPOLTE='crs', AT+QPOLTE='compress' or AT+QPOLTE='locate'. Parameter Integer type. 0 Success 1 Invalid modem state 2 Not enough memory 12 Operation failure String type. Device IMEI number. String type. Two-byte tacking area code in hexadecimal format. Integer type. Three-digit value indicating mobile country code. Integer type. Three-digit value indicating mobile network code. String type. Four-byte E-UTRAN cell ID in hexadecimal format. Integer type. Physical cell ID value. Integer type. Stands for E-UTRA Absolute Radio Frequency Channel Number of the modem at the time of data capture. Integer type. Enumeration of E-UTRA bandwidths for serving cell. Unit of bandwidth: MHz. 0 0.18 1 1.4 2 3 BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 24 / 33 LPWA Module Series 3 5 4 10 5 15 6 20 Integer type. Number of captured contiguous OFDM symbols. Range: 0–80. Integer type. System frame number (SFN) of the first CRS data block. String type. File system path to the captured CRS data. 3.2. +QPOLTEEVU: 'COMPRESS' Notify CRS Data Compression Event This URC notifies the host of a CRS data compression event. +QPOLTEEVU: 'COMPRESS' Notify CRS Data Compression Event Event reported for an attempt to compress CRS data, +QPOLTEEVU: 'COMPRESS', triggered by AT+QPOLTE='compress' or [,[,]] AT+QPOLTE='locate'. Parameter Integer type. 0 Success 1 Invalid modem state 2 Not enough memory 12 Operation failure Integer type. Length of the compressed file. Range: 0–3000. Unit: byte. String type. File system path to save the compressed binary data. 3.3. +QPOLTEEVU: 'REGISTER' Notify Polte Server Registration Event This URC notifies the host of a Polte server registration event. +QPOLTEEVU: 'REGISTER' Notify Polte Server Registration Event +QPOLTEEVU: 'REGISTER',[, Event reported for an attempt to register to Polte server, ,] triggered by AT+QPOLTECFG='register'. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 25 / 33 Parameter LPWA Module Series Integer type. 0 Success 1 No response from server 12 Preceding operation failure String type. Username to the Polte server. Maximum size: 20 characters. String type. Password to the Polte server. Maximum size: 20 characters. 3.4. +QPOLTEEVU: 'LOCATION' Reception from Polte Server Notify Result of SR Location This URC notifies the host of the result of location reception from Polte server. +QPOLTEEVU: 'LOCATION' Notify Result of Location Reception from Polte Server +QPOLTEEVU: 'LOCATION', Event reported for result of location reception from Polte [,,,,] AT+QPOLTE='locate'. Parameter Integer type. 0 Success 1 No response from server 2 Operation failure String type. Contains floating value in quotes. Latitude is defined and returned by NMEA message GGA. Positive values represent 'North' and negative values represent 'South'. String type. Contains floating value in quotes. Longitude is defined and returned by NMEA message GGA. Positive values represent 'East' and negative values represent 'West'. Integer type. UTC timestamp of the position counted since January 1, 1970. Unit: ms. String type. Contains floating value in quotes. Confidence level as reported by Polte and represents certainty of fix in meters. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 26 / 33 LPWA Module Series 3.5. +QPOLTEEVU: 'ALLOWSTAT' Notify Change in Applicability of Polte Service This URC notifies the host of a change in applicability of Polte service. +QPOLTEEVU: 'ALLOWSTAT' Notify Change in Applicability of Polte Service +QPOLTEEVU: ALLOWSTAT', Event reported for a change in applicability of Polte service. Parameter Integer type. 0 Polte service is disabled, the modem cannot receive Polte-related AT commands 1 Polte service is enabled, the modem can receive Polte-related AT commands 3.6. +QPOLTECR Notify Result of CR Location Reception from Polte Server This URC notifies the host of the result of CR location reception from Polte server. +QPOLTECR Notify Result of CR Location Reception from Polte Server +QPOLTECR: [,,,,] server, triggered by AT+QPOLTECR. Parameter Integer type. 0 Success 1 No response from server 2 Operation failure String type. Contains floating value in quotes. Latitude is defined and returned by NMEA message GGA. Positive values represent 'North' and negative values represent 'South'. String type. Contains floating value in quotes. Longitude is defined and returned by NMEA message GGA. Positive values represent 'East' and BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 27 / 33 LPWA Module Series negative values represent 'West'. Integer type. UTC timestamp of the position counted since January 1, 1970. Unit: ms. String type. Contains floating value in quotes. Confidence level as reported by Polte and represents certainty of fix in meters. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 28 / 33 LPWA Module Series 4 Examples Examples of how to configure and use Polte features are presented in this chapter. 4.1. Polte SR Example To use Polte SR, the user has to register to https://polte.io. After log-in, the user should: ⚫ Add new device: User Equipment → BULK CLAIM ⚫ Choose 'IMEI' for 'Identifier Type' ⚫ Choose 'AT2' for 'Product Definition' ⚫ Download claimUeSample.csv file ⚫ Append the IMEI number at the bottom of the claimUeSample.csv file and reupload the file (click 'cloud' button) ⚫ Click on 'SUBMIT' Polte service has to be enabled (module reboot is required after this command in order to activate Polte): AT+QPOLTECFG='service',1 OK When using the Polte feature for the first time, device registration is necessary. If the registration is successful, the URC +QPOLTEEVU: 'REGISTER' will be received from the server along with MQTT credentials. Those credentials are necessary for further server authorization (AT+QPOLTECFG='serverauth'). AT+QPOLTECFG='polteev','register',1 OK AT+QPOLTECFG='register' +QPOLTECFG: 'REGISTER',0 OK +QPOLTEEVU: 'REGISTER',0,'mqtt_username','mqtt_password' Using Polte requires server authorization after each reboot: AT+QPOLTECFG='serverauth' OK BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 29 / 33 LPWA Module Series NOTE 1. Before first authorization, registration must be done (AT+QPOLTECFG='register'). 2. In case AT+QPOLTECFG='serverauth' returns ERROR or the authentication is unsuccessful for any reason, try to execute AT+QPOLTECFG='register' one more time to renew MQTT credentials used by AT+QPOLTECFG='serverauth'. To report device location, the users must: ⚫ Enable all +QPOLTEEVU URCs ⚫ Capture two frames: AT+QPOLTE='compress',2,0 ⚫ Report data to the cloud AT+QPOLTECFG='polteev','all',1 OK AT+QPOLTE='compress',2,0 +QPOLTE: 'COMPRESS',0 OK +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,652 +QPOLTEEVU: 'COMPRESS',0,1652,'b:/Polte/polte-compress' AT+QPOLTE='report',1 OK +QPOLTEEVU: 'LOCATION',0,'44.823246574123395','20.413992050537633','1642512945', '200' It is also possible to combine AT+QPOLTE='compress' and AT+QPOLTE='report' by using AT+QPOLTE='locate'. It is noted that AT+QPOLTE='locate' is not power optimized. Recommended flow is to use AT+QPOLTE='compress' and then AT+QPOLTE='report'. AT+QPOLTE='locate',2,1 +QPOLTE: 'LOCATE',0 OK +QPOLTEEVU: 'CRS',0,'863593050015320','0x10',544,5,'0x20f0d',395,6400,4,80,133 +QPOLTEEVU: 'COMPRESS',0,906 +QPOLTEEVU: 'LOCATION',0,'44.82272508613134','20.414680280163452','1642512945', '149.60' BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 30 / 33 LPWA Module Series 4.2. Polte CR Example To use Polte CR, the user must register to https://polte.io and acquire Customer ID and API Token. Customer ID can be found under 'Customer Profile' setting (upper right-hand corner), while API Token is created in the 'API Tokens' section (top of the window). When using Polte CR feature for the first time, the user must configure necessary parameters (Customer ID and API Token): AT+QPOLTECRCFG= '5fff4ee770e961101864cb1a','8d5d837a97f27f7da84264e5ad1ac24644c2a6 68256fa38a41a1ebf29a09eba34' OK Then you can send location request: AT+QPOLTECR OK +QPOLTECR:0,'44.826452','20.40706','1646213056','194' After successful locating, an URC carrying location information will be received. BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 31 / 33 LPWA Module Series 5 Appendix References Table 4: Related Documents Document Name [1] Quectel_BG77xA-GL&BG95xA-GL_GNSS_Application_Note [2] Quectel_BG77xA-GL&BG95xA-GL_QuecLocator_Application_Note [3] Quectel_BG77xA-GL&BG95xA-GL_AT_Commands_Manual Table 5: Terms and Abbreviations Abbreviation CE CR CRS E-UTRA E-UTRAN GGA ID IMEI LTE MQTT NMEA OFDM Description Compression Engine CoreRes Cell Specific Reference Signal Evolved Universal Terrestrial Radio Access Evolved Universal Terrestrial Radio Access Network Global Positioning System Fix Data Identifier International Mobile Equipment Identity Long-Term Evolution Message Queuing Telemetry Transport National Marine Electronics Association Orthogonal Frequency-Division Multiplexing BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 32 / 33 Polte RRC RTTD SFN SR UE URC UTC Positioning Over LTE Radio Resource Control Receive Transmit Time Difference System Frame Number SuperRes User Equipment Unsolicited Result Code Coordinated Universal Time LPWA Module Series BG77xA-GL&BG95xA-GL_Positioning_Over_LTE_Application_Note 33 / 33

BG95&BG77&BG600L Series GNSS Jamming Detection Application Note LPWA Module Series Version: 1.0 Date: 2022-02-25 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 1 / 13 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 2 / 13 LPWA Module Series About the Document Revision History Version 1.0 Date 2021-12-31 2022-02-25 Author Matt YE/ Kayn SHAO Matt YE/ Kayn SHAO Description Creation of the document First official release BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 3 / 13 LPWA Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 1.1. Applicable Modules .................................................................................................................... 6 1.2. GNSS Jamming Indicator .......................................................................................................... 6 1.3. Reference Noise Level (RNL) .................................................................................................... 7 1.4. Limitations .................................................................................................................................. 7 2 AT Command Description.................................................................................................................. 8 2.1. AT Command Introduction ......................................................................................................... 8 2.1.1. Definitions........................................................................................................................ 8 2.1.2. AT Command Syntax ...................................................................................................... 8 2.2. Declaration of AT Command Examples ..................................................................................... 9 2.3. Jamming Detection Related AT Command................................................................................ 9 2.3.1. AT+QGPSCFG='agnssjamming' Enable/Disable GNSS Jamming Detection ............ 9 3 Summary of Error Codes ................................................................................................................. 12 4 Appendix Reference ......................................................................................................................... 13 BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 4 / 13 LPWA Module Series Table Index Table 1: Applicable Modules......................................................................................................................... 6 Table 2: Summary of Error Codes.............................................................................................................. 12 Table 3: Terms and Abbreviations .............................................................................................................. 13 BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 5 / 13 LPWA Module Series 1 Introduction This document describes how to implement GNSS jamming detection for Quectel BG95 series, BG77 and BG600L-M3 modules via AT commands. 1.1. Applicable Modules Table 1: Applicable Modules Module Series BG95 BG77 BG600L Model BG95-M1 BG95-M2 BG95-M3 BG95-M4 BG95-M5 BG95-M6 BG95-MF BG77 BG600L-M3 Description Cat M1 only Cat M1/Cat NB2 Cat M1/Cat NB2/EGPRS Cat M1/Cat NB2, 450 MHz Supported Cat M1/Cat NB2/EGPRS, Power Class 3 Cat M1/Cat NB2, Power Class 3 Cat M1/Cat NB2, Wi-Fi Positioning Cat M1/Cat NB2 Cat M1/Cat NB2/EGPRS 1.2. GNSS Jamming Indicator GNSS jamming indicator is a metric that is linearly proportional to the sum of jammer and noise power at the GNSS antenna port. The jamming indicator can be used to measure the relative increase in the current noise floor, including jammer, versus the observed reference noise level (RNL) — both measured at the GNSS receiver input. In an interference environment, the measured value of the GNSS jamming indicator will increase. BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 6 / 13 LPWA Module Series Interference to the signal received by the module is assessed based on the comparison between the measured value of the GNSS jamming indicator and RNL. 1.3. Reference Noise Level (RNL) To detect jamming events, BG95 series, BG77 and BG600L-M3 modules use a relative measure of the noise level (i.e., RNL) at the input of the GNSS receiver. RNL value is unavailable by default. It will be automatically calculated and updated, once the following conditions are met. a. Jamming detection is enabled (See Chapter 2.3.1). b. GNSS is turned on and the module has been successfully positioned. c. Positioning accuracy is less than 20 m and lasts for 20 s. Therefore, the RNL is changing and automatically adapts to the environment. To avoid too frequent saving of the RNL value to NVRAM, RNL is saved to NVRAM only once at the first update after the module is powered on. The modules support setting an estimated RNL with AT+QGPSCFG='agnssjamming', which is otherwise not recommended, because the modules can update RNL automatically when jamming detection is enabled and the modules work properly. 1.4. Limitations GNSS jamming indicator is a relative measure, therefore there are certain limitations associated with it. Limitations on the use of GNSS jamming detection feature: a. When detecting jammers at the beginning of a GNSS tracking session, the jamming indicator assumes that the antenna input signal conditions are similar to those of a previous GNSS tracking session, i.e., the surrounding environment and the location of the device did not change dramatically. b. When GNSS signals are strong, it is possible to get a good GNSS position fix in the presence of jammers. Jammers can cause RNL bias by several dB, thus impacting RNL reliability in detecting them. c. 'Moderately' and 'severely' jammed conditions as well as their associated thresholds assume open sky and strong GNSS signal conditions. When the GNSS signals are weaker, jammer impact is more pronounced. For example, in challenging GNSS signal conditions, a 5 dB jammer may severely impact GNSS performance. d. Jamming detection cannot be supported when an active antenna is used for GNSS signal reception. BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 7 / 13 LPWA Module Series 2 AT Command Description 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Types of AT Commands Command Type Syntax Description Test Command AT+=? Read Command AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Write Command AT+=[,[,[...]]] Set user-definable parameter value. Execution Command AT+ Return a specific information parameter or perform a specific action. BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 8 / 13 LPWA Module Series 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3. Jamming Detection Related AT Command 2.3.1. AT+QGPSCFG='agnssjamming' Enable/Disable GNSS Jamming Detection This command enables or disables GNSS jamming detection. AT+QGPSCFG='agnssjamming' Enable/Disable GNSS Jamming Detection Test Command AT+QGPSCFG=? Response: … +QGPSCFG: 'agnssjamming',(range of s),(range of supported s) ... supported Write Command AT+QGPSCFG='agnssjamming' [,[,]] OK Response If the optional parameters are omitted, query the current setting. +QGPSCFG: 'agnssjamming',,,[/], OK If any of the optional parameters is specified, enable/disable jamming detection and/or set the estimated RNL value. OK Maximum Response Time Characteristics If there is any error related to the ME functionality: +CME ERROR: 300 ms This command takes effect immediately. The configuration will be not saved. The configuration will be saved automatically. BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 9 / 13 Parameter LPWA Module Series Integer type. Enable/disable GNSS jamming detection and configure URC reporting mode. 0 Disable jamming detection function 1 Enable jamming detection function and report URC every second 2 Enable jamming detection and report URC when the jamming state changes URC is presented below: +QGPSURC: 'jamming_ind',,, Integer type. Estimated Reference Noise Level. Range: 0–105. It is recommended NOT to set this value. Integer type. Jamming state. 0 Jamming does not exist 1 Jamming exists Integer type. Reference Noise Level. NULL means there is no valid RNL. Range: 0–105. Integer type. Jamming metric measured in real time. Unit: dB. Integer type. Error code. See Chapter 3 for more information. NOTE If has not been specified, the RNL returned by AT+QGPSCFG='agnssjamming' is the actual RNL, and NULL means there is no valid RNL. If has been specified, the RNL returned by AT+QGPSCFG='agnssjamming' is the estimated RNL, and it will be updated into the actual RNL after the RNL is available. Example AT+QGPSCFG='agnssjamming',1 OK AT+QGPS=1 OK //Enable jamming detection function and reporting URC every second. //Start GNSS, and wait until GNSS gets position fix and RNL is updated. AT+QGPSCFG='agnssjamming' +QGPSCFG: 'agnssjamming',1,1,55,55 //Query the current jamming detection and URC state. OK //When jammer is detected, the module reports GNSS jamming detection URCs +QGPSURC: 'jamming_ind',1,55,67 +QGPSURC: 'jamming_ind',1,55,67 BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 10 / 13 +QGPSURC: 'jamming_ind',1,55,67 AT+QGPSCFG='agnssjamming',0 OK LPWA Module Series //Disable jamming detection function BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 11 / 13 LPWA Module Series 3 Summary of Error Codes The indicates an error related to the GNSS operation. The details about are presented in the following table. Table 2: Summary of Error Codes 501 502 503 Meaning Invalid parameter Operation not supported GNSS subsystem busy 504 Active session 505 Inactive session 506 Operation timeout 549 Unknown error BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 12 / 13 LPWA Module Series 4 Appendix Reference Table 3: Terms and Abbreviations Abbreviation EGPRS GNSS GPS LPWA NVRAM RNL URC Wi-Fi Description Enhanced General Packet Radio Service Global Navigation Satellite System Global Positioning System Low Power Wide Area Non-Volatile Random Access Memory Reference Noise Level Unsolicited Result Code Wireless Fidelity BG95&BG77&BG600L_Series_GNSS_Jamming_Detection_Application_Note 13 / 13

BG96 Secure Boot Application Note LPWA Module Series Version: 1.0 Date: 2022-02-18 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG96_Secure_Boot_Application_Note 1 / 14 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG96_Secure_Boot_Application_Note 2 / 14 LPWA Module Series About the Document Revision History Version 1.0 Date 2021-12-22 2022-02-18 Author Justice HAN Justice HAN Description Creation of the document First Official Release BG96_Secure_Boot_Application_Note 3 / 14 LPWA Module Series Contents About the Document ................................................................................................................................3 Contents .................................................................................................................................................... 4 Table Index ...............................................................................................................................................5 1 Introduction .......................................................................................................................................6 2 Secure Boot Overview ......................................................................................................................7 2.1. Definition ..................................................................................................................................7 2.2. Secure Boot Process................................................................................................................7 2.3. Certificate Chain .......................................................................................................................8 2.4. Image Signing ..........................................................................................................................8 2.5. Hardware Foundation ...............................................................................................................8 2.6. Secure Boot Toolkit...................................................................................................................9 2.7. sec.dat....................................................................................................................................10 3 Enable Secure Boot ........................................................................................................................11 3.1. Procedure ............................................................................................................................... 11 3.1.1. Preparation .................................................................................................................. 11 3.1.2. Generate Certificates and Public Key Hash Value ....................................................... 11 3.1.3. Fill in Environment Variables........................................................................................ 11 3.1.4. Sign Images and Generate a Firmware Package ........................................................ 11 3.1.5. Flash Firmware ............................................................................................................12 3.2. Verification..............................................................................................................................12 3.2.1. AT+QSECBOOTSTAT Query Secure Boot Status.....................................................12 4 Appendix References .....................................................................................................................14 BG96_Secure_Boot_Application_Note 4 / 14 LPWA Module Series Table Index Table 1: Related Documents ................................................................................................................... 14 Table 2: Terms and Abbreviations............................................................................................................ 14 BG96_Secure_Boot_Application_Note 5 / 14 LPWA Module Series 1 Introduction This document describes Secure Boot details and how to enable Secure Boot on Quectel BG96 module. BG96_Secure_Boot_Application_Note 6 / 14 LPWA Module Series 2 Secure Boot Overview 2.1. Definition Secure Boot is defined as a boot sequence in which each firmware image to be loaded and executed is authorized using the previously authorized firmware. At each stage of the Secure Boot process, signature verification is performed to prevent any software without valid signature or maliciously modified software from running on the module. A root trusted entity is needed during the boot process. The Primary Boot Loader (PBL), embedded in the module as a firmware, is unmodifiable, and therefore can serve as the root trusted entity. 2.2. Secure Boot Process The Secure Boot process comprises multiple stages, and the image in each stage performs a specific function. After the Secure Boot is enabled, the image to be executed in each stage needs to be verified by the previously verified image. If the verification fails, the entire boot process stops, and the module cannot boot up. Quectel BG96 module follows the verification sequence of Primary Boot Loader (PBL) → Secondary Boot Loader (SBL) → ARM® TrustZone. ⚫ As the root of trust (RoT), the PBL is the firmware embedded in chips and cannot be modified. Therefore, it is considered as the most trusted entity in the boot process, and authenticates the image to be executed in the next boot stage. ⚫ The SBL is usually verified in the second boot stage. After it is successfully authenticated by the PBL, it can be executed and used to authenticate the image in the next stage. ⚫NOTE Secure Boot is disabled by default. For details on how to enable Secure Boot, see Chapter 3. BG96_Secure_Boot_Application_Note 7 / 14 LPWA Module Series 2.3. Certificate Chain Secure Boot supports 2048-bit RSA public keys with exponent 3 or F4 (= 65537) for signatures of the certificates and images. The format of the certificate signatures meets the PKCS #1 v1.2 standard and the SHA256 or SHA384 algorithm. The certificate chain of the module supports two-level certificate chain which includes attestation certificate and self-signed root certificate. The X.509 v1, v2 and v3 certificate formats are all supported. 2.4. Image Signing During Secure Boot, the images to be executed in each boot stage must be signed first. Quectel firmware images use the standard MBN format, and each image includes several segments indicating different types of information separately, wherein the hash table segment stores signature related information. The hash table segment also includes the hash values of each segment and the information about certificate trust chain. The images listed below must be signed in the Secure Boot process for Quectel BG96 modules. ⚫ apps.mbn ⚫ mba.mbn ⚫ qdsp6sw.mbn ⚫ ENPRG9x06.mbn ⚫ NPRG9x06.mbn ⚫ rpm.mbn ⚫ sbl1.mbn ⚫ tz.mbn 2.5. Hardware Foundation Quectel BG96 module includes a one-time programmable fuse. The initial state of the fuse is 0 (Secure Boot disabled). Once a writing operation is performed on the fuse (or the fuse is blown), the state of the fuse permanently becomes 1 (Secure Boot enabled). The state cannot be changed after the fuse is blown, which means that the Secure Boot enabling is an irreversible operation. BG96_Secure_Boot_Application_Note 8 / 14 LPWA Module Series 2.6. Secure Boot Toolkit Quectel provides a Secure Boot toolkit (Quectel SecBootTools) to generate related certificates and the sec.dat file, and to sign firmware images. The following document introduces the directory structure of Quectel SecBootTools in Windows system. Figure 1: Quectel SecBootTools Directory Structure Table 1: Quectel SecBootTools Directory Structure SN File/Folder 1 common 2 doc 3 firmwares 4 fw_orig 5 fw_signed 6 fw_signature.bat 7 gencerts.bat 8 contents.xml 9 README.txt 10 Release_History.txt Description Contains the toolchain for signature. Contains all reference documents on Secure Boot. Stores firmware packages to be signed and secure firehose configuration files. An intermediary for creating signed firmware packages. Stores signed firmware packages and intermediate files. Makes a signed firmware package. Generates the root certificate (qpsa_rootca.cer) and the attestation certificate (qpsa_attestca.cer) as well as the hash values. A configuration file used during signature. It cannot be modified. For more details about the above files or folders, refer to README.txt. Stores the release history of the tool. BG96_Secure_Boot_Application_Note 9 / 14 LPWA Module Series NOTE Contact Quectel Technical Support (support@quectel.com) to acquire the Secure Boot toolkit. 2.7. sec.dat The sec.dat file is vital for enabling Secure Boot, as it includes the configuration parameters for the following functions,. 1. Secure Boot enabling 2. JTAG access disabling 3. Anti-rollback enabling 4. Read/Write permissions disabling/enabling for fuses 5. Fuse blowing The sec.dat file is generated during the image signing procedure. See Chapter 3.1.4 for details. BG96_Secure_Boot_Application_Note 10 / 14 LPWA Module Series 3 Enable Secure Boot 3.1. Procedure 3.1.1. Preparation Store the original firmware package to be signed under fw_orig. Then, install Python and OpenSSL and check if paths of Python and OpenSSL defined in /common/scripts/env.bat are the same as the actual paths. 3.1.2. Generate Certificates and Public Key Hash Value Run gencerts.bat in the Secure Boot toolkit to generate a root certificate and an attestation certificate, as well as a public key hash value of the root certificate. The generated certificates are automatically stored in /fw_signed/output/certs, and they are used to sign images; and the hash value is used to verify the signed images. If any image does not pass verification, the loading of the image will fail. 3.1.3. Fill in Environment Variables Open fw_signature.bat and fill in the environment variables defined in fw_signature.bat with the firmware version to be signed. 3.1.4. Sign Images and Generate a Firmware Package Run fw_signature.bat in the toolkit to sign the necessary image files and generate a new firmware package. For the list of necessary images, see Chapter 2.4. The whole process includes: 1) Double click fw_signature.bat and then fw_signature.bat runs automatically to enter Stage 1. In Stage 1, sec.dat which contains the hash of the root CA is automatically generated and stored in /fw_signed/output/sec_dat. 2) Press any key to proceed to Stage 2, during which the necessary image files are signed one by one. Signed files are automatically stored in /fw_signed/output/9206tx. 3) Press any key to proceed to Stage 3, during which a new firmware package is automatically created BG96_Secure_Boot_Application_Note 11 / 14 LPWA Module Series in fw_signed and replaces the original image files with the signed image files of the same names. 4) Press any key to proceed to Stage 4, during which the firehose configuration file rawprogram_nand_p2K_b128K_update.xml in the new firmware package is replaced with a secure firehose configuration file rawprogram_nand_p2K_b128K_sec.xml, and partition_nand.xml is replaced with a secure-exclusive one. 3.1.5. Flash Firmware Flash the firmware with the signed package created in Chapter 3.1.4. For details about how to flash firmware, see document [1]. 3.2. Verification After firmware updating, send AT+QSECBOOTSTAT? to query whether Secure Boot is enabled on the module. 3.2.1. AT+QSECBOOTSTAT Query Secure Boot Status This command queries the current status of Secure Boot. AT+QSECBOOTSTAT Query Secure Boot Status Read Command AT+QSECBOOTSTAT? Response +QSECBOOTSTAT: OK Maximum Response Time Characteristics If there is any error related to ME functionality: ERROR 300 ms - Parameter Integer type. Secure Boot status. 0 Disabled 1 Enabled Example AT+QSECBOOTSTAT? //Query whether Secure Boot is enabled on the module. BG96_Secure_Boot_Application_Note 12 / 14 +QSECBOOTSTAT: 1 OK //Secure Boot is enabled. LPWA Module Series BG96_Secure_Boot_Application_Note 13 / 14 LPWA Module Series 4 Appendix References Table 2: Related Documents Document Name [1] Quectel_QFlash_User_Guide Table 3: Terms and Abbreviations Abbreviation ARM CA JTAG PBL PKCS RoT RSA SBL SHA Description Advanced RISC Machine Certificate Authority Joint Test Action Group Primary Boot Loader Public-Key Cryptography Standards Root of Trust Algorithm invented by Rivest, Adleman and Shamir Secondary Boot Loader Secure Hash Algorithm BG96_Secure_Boot_Application_Note 14 / 14

BG96 RF FTM Application Note LPWA Module Series Version: 1.0 Date: 2022-02-18 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal non-exclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG96_RF_FTM_Application_Note 1 / 20 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any third-party intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG96_RF_FTM_Application_Note 2 / 20 LPWA Module Series About the Document Revision History Version Date Author - 2021-12-06 Hyman DING 1.0 2022-02-18 Hyman DING Description Creation of the document First official release BG96_RF_FTM_Application_Note 3 / 20 LPWA Module Series Contents About the Document ................................................................................................................................3 Contents .................................................................................................................................................... 4 Table Index ...............................................................................................................................................5 1 Introduction .......................................................................................................................................6 2 FTM AT Commands ..........................................................................................................................7 2.1. AT Command Introduction ........................................................................................................7 2.1.1. Definitions ......................................................................................................................7 2.1.2. AT Command Syntax .....................................................................................................7 2.2. Declaration of AT Command Examples ....................................................................................8 2.3. Description of AT Commands ...................................................................................................8 2.3.1. AT+QRFTESTMODE Enter/Exit FTM .........................................................................8 2.3.2. AT+QRFTEST Transmit in FTM ..................................................................................9 2.3.3. AT+QRXFTM Receive in FTM...................................................................................12 3 Examples .........................................................................................................................................15 3.1. Set the Module into FTM ........................................................................................................15 3.2. Transmit in FTM .....................................................................................................................15 3.3. Receive in FTM ......................................................................................................................18 4 Summary of CME ERROR Codes...................................................................................................19 5 Appendix References .....................................................................................................................20 BG96_RF_FTM_Application_Note 4 / 20 LPWA Module Series Table Index Table 1: Type of AT Commands and Responses ....................................................................................... 7 Table 2: Related CME ERROR Codes .................................................................................................... 19 Table 3: Terms and Abbreviations............................................................................................................ 20 BG96_RF_FTM_Application_Note 5 / 20 LPWA Module Series 1 Introduction The document describes the AT commands used to test the receiving and transmitting performance of Quectel BG96 module under FTM (Factory Test Mode), to facilitate RF calibration. BG96_RF_FTM_Application_Note 6 / 20 LPWA Module Series 2 FTM AT Commands 2.1. AT Command Introduction 2.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 2.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Type of AT Commands and Responses Command Type Syntax Description Test Command Read Command Write Command Execution Command AT+=? AT+? AT + < c m d > = < p 1 > [ , < p 2 > [ , < p 3 > [...]]] AT+ Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. Set user-definable parameter value. Return a specific information parameter or perform a specific action. BG96_RF_FTM_Application_Note 7 / 20 LPWA Module Series 2.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 2.3. Description of AT Commands 2.3.1. AT+QRFTESTMODE Enter/Exit FTM This command makes the module enter/exit FTM. AT+QRFTEST (see Chapter 2.3.2) and AT+QRXFTM (see Chapter 2.3.3) are available only when the module enters FTM with this command. AT+QRFTESTMODE Enter/Exit FTM Test Command AT+QRFTESTMODE=? Response +QRFTESTMODE: (list of supported s) Read Command AT+QRFTESTMODE? OK Response +QRFTESTMODE: Write Command AT+QRFTESTMODE= OK Response OK Maximum Response Time Characteristics If there is any error related to ME functionality: +CME ERROR: If there is any other error: ERROR 300 ms This command takes effect after rebooting. The configuration will be saved automatically. BG96_RF_FTM_Application_Note 8 / 20 Parameter Integer type. Enter/exit FTM. 0 Exit 1 Enter See Chapter 4. LPWA Module Series 2.3.2. AT+QRFTEST Transmit in FTM This command forces the module to transmit in FTM. AT+QRFTEST Transmit in FTM Test Command Currently only returns the parameters supported by the Write Command in GSM AT+QRFTEST=? Response +QRFTEST: ,,,, OK Write Command In GSM: AT+QRFTEST=,,, , Response ALL ON OK Or ALL OFF OK If there is any error related to ME functionality: +CME ERROR: If there is any other error: ERROR Write Command In LTE-M: AT+QRFTEST=,,, , Response ALL ON OK Or ALL OFF OK If there is any error related to ME functionality: +CME ERROR: BG96_RF_FTM_Application_Note 9 / 20 LPWA Module Series If there is any other error: ERROR Write Command In NB-IoT: AT+QRFTEST=,,, ,,,,,, Response ALL ON OK Or ALL OFF OK If there is any error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 300 ms This command takes effect immediately. The configurations will not be saved. Parameter String type. The supported bands in GSM/LTE. The possible values are: For GSM: 'GSM850' 'GSM900' 'GSM1800' 'GSM1900' For LTE: 'LTE BAND1' 'LTE BAND2' 'LTE BAND3' 'LTE BAND4' 'LTE BAND5' 'LTE BAND8' 'LTE BAND12' 'LTE BAND13' 'LTE BAND18' 'LTE BAND19' 'LTE BAND20' 'LTE BAND25' 'LTE BAND26' 'LTE BAND28' Integer type. The supported uplink channels in GSM/LTE. The corresponding channels BG96_RF_FTM_Application_Note 10 / 20 LPWA Module Series for different bands in GSM/LTE are as follows: Uplink Channels GSM band 128–251 GSM850 1–124, 975–1023 GSM900 512–885 GSM1800 512–810 GSM1900 Uplink Channels LTE band 18000–18599 LTE BAND1 18600–19199 LTE BAND2 19200–19949 LTE BAND3 19950-20399 LTE BAND4 20400–20649 LTE BAND5 21450–21799 LTE BAND8 23010–23179 LTE BAND12 23180–23279 LTE BAND13 23850–23999 LTE BAND18 24000–24149 LTE BAND19 24150–24449 LTE BAND20 26040–26689 LTE BAND25 26690–27039 LTE BAND26 27210–27659 LTE BAND28 String type. Enable/disable RF TX. 'ON' Enable 'OFF' Disable Integer type. 0 Continuous TX mode Integer type. GSM power level (GSM power in dBm × 100). Range: 0–3300. Recommended value: not to exceed 3100. Integer type. LTE power level. Range: 0–100. Recommended value: not to exceed 75. Integer type. 1 LTE modulated TX mode Integer type. Uplink carrier frequency offset. Range: -128 to 127. Integer type. Modulation type. 0 BPSK 1 QPSK Integer type. TX power in dBm. Range: -128 to 127. Integer type. Uplink tone bandwidth. 0 Single-tone, 3.75 kHz 1 Single-tone, 15 kHz 2 Multi-tone, 3 × 15 kHz 3 Multi-tone, 6 × 15 kHz 4 Multi-tone, 12 × 15 kHz Integer type. Tone start index. Range: 0–255. See Chapter 4. BG96_RF_FTM_Application_Note 11 / 20 LPWA Module Series NOTE 1. Please refer to Section 5.7.3F Carrier frequency and EARFCN for category NB1 and NB2 in 3GPP TS 36.101, to calculate the specific uplink carrier frequency offset, namely, the value of . 2. For LTE-M, the default bandwidth is 10 MHz currently. 2.3.3. AT+QRXFTM Receive in FTM This command forces the module to receive in FTM. AT+QRXFTM Receive in FTM Test Command AT+QRXFTM=? Response +QRXFTM: ,,,,, Read Command AT+QRXFTM? Write Command AT+QRXFTM=,,[,[,[,]]] OK Response OK Response +QRXFTM: , OK If there is any error related to ME functionality: +CME ERROR: Maximum Response Time Characteristics If there is any other error: ERROR 3000 ms The command takes effect immediately. The configurations will not be saved. Parameter Integer type. 1 LTE RX test String type. The supported bands in GSM/LTE. The possible values are: For GSM: 'GSM850' 'GSM900' 'GSM1800' 'GSM1900' BG96_RF_FTM_Application_Note 12 / 20 LPWA Module Series For LTE: 'LTE BAND1' 'LTE BAND2' 'LTE BAND3' 'LTE BAND4' 'LTE BAND5' 'LTE BAND8' 'LTE BAND12' 'LTE BAND13' 'LTE BAND18' 'LTE BAND19' 'LTE BAND20' 'LTE BAND26' 'LTE BAND28' Integer type. The supported downlink channels in GSM/LTE. The corresponding channels for different bands in GSM/LTE are as follows: Downlink Channels GSM band 128–251 GSM850 1–124, 975–1023 GSM900 512–885 GSM1800 512–810 GSM1900 Downlink Channels LTE band 0–599 LTE BAND1 600-1199 LTE BAND2 1200–1949 LTE BAND3 1950–2399 LTE BAND4 2400–2649 LTE BAND5 3450–3799 LTE BAND8 5010–5179 LTE BAND12 5180–5279 LTE BAND13 5850–5999 LTE BAND18 6000–6149 LTE BAND19 6150–6449 LTE BAND20 8690–9039 LTE BAND26 9210–9659 LTE BAND28 Integer type. 0 Main antenna path. Integer type. Gain stage. Range: 0–5. Default value: 0. Integer type. Bandwidth. Range: 0–5. This parameter is only valid for LTE RAT (i.e., not applicable for GSM RAT). 0 1.4 MHz 1 3 MHz 2 5 MHz 3 10 MHz BG96_RF_FTM_Application_Note 13 / 20 LPWA Module Series 4 15 MHz 5 20 MHz Integer type. The value of the received power. Integer type. Received power level in dBm converted from . See Chapter 4. NOTE 1. The responses of AT+QRXFTM=,,[,[,[,]]] are instantaneous values. 2. Currently, this command only supports LTE RX in FTM. 3. In LTE RAT, the value of is equal to the value of /10. BG96_RF_FTM_Application_Note 14 / 20 LPWA Module Series 3 Examples 3.1. Set the Module into FTM AT+QRFTESTMODE=? +QRFTESTMODE: (0,1) OK AT+QRFTESTMODE=1 OK //After the module reboots AT+QRFTESTMODE? +QRFTESTMODE: 1 OK AT+QRFTESTMODE=0 OK //After the module reboots AT+QRFTESTMODE? +QRFTESTMODE: 0 OK //Test command //Enter FTM //Query the current FTM state of the module //Exit FTM //Query the current FTM state of the module 3.2. Transmit in FTM AT+QRFTESTMODE=1 OK //After the module reboots //In GSM RAT AT+QRFTEST='GSM900',122,'ON',0,100 ALL ON //Enter FTM //Enable RF TX on 122 channel of GSM900 BG96_RF_FTM_Application_Note 15 / 20 LPWA Module Series OK AT+QRFTEST='GSM900',122,'OFF',0,100 ALL OFF //Disable RF TX on 122 channel of GSM900 OK //In LTE-M RAT AT+QRFTEST='LTE BAND1',18300,'ON',50,1 ALL ON //Enable RF TX on 18300 channel of LTE B1 OK AT+QRFTEST='LTE BAND1',18300,'OFF',50,1 ALL OFF //Disable RF TX on 18300 channel of LTE B1 OK AT+QRFTEST='LTE BAND2',18900,'ON',50,1 ALL ON //Enable RF TX on 18900 channel of LTE B2 OK AT+QRFTEST='LTE BAND2',18900,'OFF',50,1 ALL OFF //Disable RF TX on 18900 channel of LTE B2 OK AT+QRFTEST='LTE BAND12',23095,'ON',50,1 ALL ON //Enable RF TX on 23095 channel of LTE B12 OK AT+QRFTEST='LTE BAND12',23095,'OFF',50,1 ALL OFF //Disable RF TX on 23095 channel of LTE B12 OK AT+QRFTEST='LTE BAND20',24300,'ON',50,1 ALL ON //Enable RF TX on 24300 channel of LTE B20 OK AT+QRFTEST='LTE BAND20',24300,'OFF',50,1 ALL OFF //Disable RF TX on 24300 channel of LTE B20 OK AT+QRFTEST='LTE BAND28',27435,'ON',50,1 ALL ON //Enable RF TX on 27435 channel of LTE B28 OK AT+QRFTEST='LTE BAND28',27435,'OFF',50,1 //Disable RF TX on 27435 channel of LTE B28 BG96_RF_FTM_Application_Note 16 / 20 LPWA Module Series ALL OFF OK //In NB-IoT RAT AT+QRFTEST='LTE BAND1',18300,'ON',50,1,100,0,50,4,0 ALL ON //Enable RF TX on 18300 channel of LTE B1 OK AT+QRFTEST='LTE BAND1',18300,'OFF',50,1,100,0,50,4,0 ALL OFF //Disable RF TX on 18300 channel of LTE B1 OK AT+QRFTEST='LTE BAND2',18900,'ON',50,1,100,0,50,4,0 ALL ON //Enable RF TX on 18900 channel of LTE B2 OK AT+QRFTEST='LTE BAND2',18900,'OFF',50,1,100,0,50,4,0 ALL OFF //Disable RF TX on 18900 channel of LTE B2 OK AT+QRFTEST='LTE BAND20',24300,'ON',50,1,100,0,50,4,0 ALL ON //Enable RF TX on 24300 channel of LTE B20 OK AT+QRFTEST='LTE BAND20',24300,'OFF',50,1,100,0,50,4,0 ALL OFF //Disable RF TX on 24300 channel of LTE B20 OK AT+QRFTEST='LTE BAND28',27435,'ON',50,1,100,0,50,4,0 ALL ON //Enable RF TX on 27435 channel of LTE B28 OK AT+QRFTEST='LTE BAND28',27435,'OFF',50,1,100,0,50,4,0 ALL OFF //Disable RF TX on 27435 channel of LTE B28 BG96_RF_FTM_Application_Note 17 / 20 OK AT+QRFTESTMODE=0 OK //Reboot the module LPWA Module Series //Exit FTM 3.3. Receive in FTM AT+QRFTESTMODE=1 OK //Enter FTM //After the module reboots //In LTE RAT AT+QRXFTM=1,'LTE BAND1',300,0,0,0 +QRXFTM: -1100,-110 //Enable RF RX on 300 channel of LTE B1 OK AT+QRXFTM=1,'LTE BAND2',900,0,0,0 +QRXFTM: -1100,-110 //Enable RF RX on 900 channel of LTE B2 OK AT+QRXFTM=1,'LTE BAND12',5095,0,0,0 +QRXFTM: -1100,-110 //Enable RF RX on 5095 channel of LTE B12 OK AT+QRXFTM=1,'LTE BAND20',6300,0,0,0 +QRXFTM: -1100, -110 //Enable RF RX on 6300 channel of LTE B20 OK AT+QRXFTM=1,'LTE BAND28',9435,0,0,0 +QRXFTM: -1100,-110 //Enable RF RX on 9435 channel of LTE B28 OK AT+QRFTESTMODE=0 OK //Reboot the module //Exit FTM BG96_RF_FTM_Application_Note 18 / 20 LPWA Module Series 4 Summary of CME ERROR Codes The CME ERROR code indicates an error related to mobile equipment or network. The details about are described in the following table. Table 2: Related CME ERROR Codes Meaning 4 Incorrect AT command name or parameter -15 Invalid input parameter. BG96_RF_FTM_Application_Note 19 / 20 LPWA Module Series 5 Appendix References Table 3: Terms and Abbreviations Abbreviation BPSK LTE-M FTM GSM LNA LPWA LTE NB-IoT QPSK RAT RF RX TX Description Binary Phase Shift Keying LTE-MTC (Machine Type Communication) Factory Test Mode Global System for Mobile Communications Low Noise Amplifier Low-Power Wide-Area Long Term Evolution Narrowband Internet of Things Quadrature Phase Shift Keying Radio Access Technology Radio Frequency Receive Transmit BG96_RF_FTM_Application_Note 20 / 20

BG770A-GL&BG95xA-GL MQTT Application Note LPWA Module Series Version: 1.0 Date: 2022-01-21 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We offer information as a service to you. The provided information is based on your requirements and we make every effort to ensure its quality. You agree that you are responsible for using independent analysis and evaluation in designing intended products, and we provide reference designs for illustrative purposes only. Before using any hardware, software or service guided by this document, please read this notice carefully. Even though we employ commercially reasonable efforts to provide the best possible experience, you hereby acknowledge and agree that this document and related services hereunder are provided to you on an 'as available' basis. We may revise or restate this document from time to time at our sole discretion without any prior notice to you. Use and Disclosure Restrictions License Agreements Documents and information provided by us shall be kept confidential, unless specific permission is granted. They shall not be accessed or used for any purpose except as expressly provided herein. Copyright Our and third-party products hereunder may contain copyrighted material. Such copyrighted material shall not be copied, reproduced, distributed, merged, published, translated, or modified without prior written consent. We and the third party have exclusive rights over copyrighted material. No license shall be granted or conveyed under any patents, copyrights, trademarks, or service mark rights. To avoid ambiguities, purchasing in any form cannot be deemed as granting a license other than the normal nonexclusive, royalty-free license to use the material. We reserve the right to take legal action for noncompliance with abovementioned requirements, unauthorized use, or other illegal or malicious use of the material. BG770A-GL&BG95xA-GL_MQTT_Application_Note 1 / 31 LPWA Module Series Trademarks Except as otherwise set forth herein, nothing in this document shall be construed as conferring any rights to use any trademark, trade name or name, abbreviation, or counterfeit product thereof owned by Quectel or any third party in advertising, publicity, or other aspects. Third-Party Rights This document may refer to hardware, software and/or documentation owned by one or more third parties ('third-party materials'). Use of such third-party materials shall be governed by all restrictions and obligations applicable thereto. We make no warranty or representation, either express or implied, regarding the third-party materials, including but not limited to any implied or statutory, warranties of merchantability or fitness for a particular purpose, quiet enjoyment, system integration, information accuracy, and non-infringement of any thirdparty intellectual property rights with regard to the licensed technology or use thereof. Nothing herein constitutes a representation or warranty by us to either develop, enhance, modify, distribute, market, sell, offer for sale, or otherwise maintain production of any our products or any other hardware, software, device, tool, information, or product. We moreover disclaim any and all warranties arising from the course of dealing or usage of trade. Privacy Policy To implement module functionality, certain device data are uploaded to Quectel’s or third-party’s servers, including carriers, chipset suppliers or customer-designated servers. Quectel, strictly abiding by the relevant laws and regulations, shall retain, use, disclose or otherwise process relevant data for the purpose of performing the service only or as permitted by applicable laws. Before data interaction with third parties, please be informed of their privacy and data security policy. Disclaimer a) We acknowledge no liability for any injury or damage arising from the reliance upon the information. b) We shall bear no liability resulting from any inaccuracies or omissions, or from the use of the information contained herein. c) While we have made every effort to ensure that the functions and features under development are free from errors, it is possible that they could contain errors, inaccuracies, and omissions. Unless otherwise provided by valid agreement, we make no warranties of any kind, either implied or express, and exclude all liability for any loss or damage suffered in connection with the use of features and functions under development, to the maximum extent permitted by law, regardless of whether such loss or damage may have been foreseeable. d) We are not responsible for the accessibility, safety, accuracy, availability, legality, or completeness of information, advertising, commercial offers, products, services, and materials on third-party websites and third-party resources. Copyright © Quectel Wireless Solutions Co., Ltd. 2022. All rights reserved. BG770A-GL&BG95xA-GL_MQTT_Application_Note 2 / 31 LPWA Module Series About the Document Revision History Version Date Author Description - 2021-05-18 Vladan RAKIC Creation of the document 1.0 2022-01-21 Vladan RAKIC First official release BG770A-GL&BG95xA-GL_MQTT_Application_Note 3 / 31 LPWA Module Series Contents About the Document .................................................................................................................................. 3 Contents ...................................................................................................................................................... 4 Table Index.................................................................................................................................................. 5 1 Introduction ......................................................................................................................................... 6 2 MQTT Data Interaction........................................................................................................................ 7 3 MQTT AT Commands ......................................................................................................................... 8 3.1. AT Command Introduction ......................................................................................................... 8 3.1.1. Definitions........................................................................................................................ 8 3.1.2. AT Command Syntax ...................................................................................................... 8 3.2. Declaration of AT Command Examples ..................................................................................... 9 3.3. Description of MQTT AT Commands ......................................................................................... 9 3.3.1. AT+QMTCFG Configure Optional Parameters of MQTT ............................................. 9 3.3.2. AT+QMTOPEN Open a Network Connection for MQTT Client ................................. 14 3.3.3. AT+QMTCLOSE Close a Network Connection for MQTT Client ............................... 15 3.3.4. AT+QMTCONN Connect a Client to MQTT Server.................................................... 15 3.3.5. AT+QMTDISC Disconnect a Client from MQTT Server ............................................. 17 3.3.6. AT+QMTSUB Subscribe to Topics ............................................................................. 18 3.3.7. AT+QMTUNS Unsubscribe from Topics ..................................................................... 19 3.3.8. AT+QMTPUB Publish Messages (Data Mode) .......................................................... 20 3.3.9. AT+QMTPUBEX Publish Messages (Command Mode) ............................................ 22 3.3.10. AT+QMTRECV Read Messages from Buffer ............................................................. 23 4 MQTT URCs ....................................................................................................................................... 25 4.1. +QMTSTAT: URC to Indicate State Change in MQTT Link Layer ........................................ 25 4.2. +QMTRECV: URC to Inform the Host to Read MQTT Packet Data..................................... 26 5 Examples ........................................................................................................................................... 27 5.1. Example of MQTT Operation without SSL .............................................................................. 27 5.2. Example of MQTT Operation with SSL.................................................................................... 29 6 Appendix References ....................................................................................................................... 31 BG770A-GL&BG95xA-GL_MQTT_Application_Note 4 / 31 LPWA Module Series Table Index Table 1: Error Codes of +QMTSTAT: URC................................................................................................. 25 Table 2: Related Documents ...................................................................................................................... 31 Table 3: Terms and Abbreviations .............................................................................................................. 31 BG770A-GL&BG95xA-GL_MQTT_Application_Note 5 / 31 LPWA Module Series 1 Introduction Message Queuing Telemetry Transport (MQTT) is a broker-based publish/subscribe messaging protocol designed to be open, simple, lightweight, and easy to implement. It is designed for connections with remote locations where a 'small code footprint' is required, or the network bandwidth is limited. This document explains how to use the MQTT function of Quectel BG770A-GL, BG950A-GL and BG951A-GL modules through AT commands. BG770A-GL&BG95xA-GL_MQTT_Application_Note 6 / 31 LPWA Module Series 2 MQTT Data Interaction This chapter illustrates the data interaction mechanism of the MQTT function. MCU Modem Link layer MQTT Server AT+QMTCFG='will',, AT+QMTCFG='timeout',, AT+QMTOPEN=,, OK TCP-REQ +QMTOPEN: , AT+QMTCONN AT+QMTCONN=,, OK +QMTCONN: ,[,] TCP established CONN-REQ Start timer T1, T2 CONN ACK-IND Stop T1 or handle Excep1 AT+QMTSUB AT+QMTSUB=,,, , OK SUB-REQ () Start timer T1 +QMTSUB: ,,[,] SUB ACK-IND () Stop T1 or handle Excep2 AT+QMTUNS AT+QMTUNS=,,, UNS-REQ () OK Start timer T1 +QMTUNS: ,, UNS ACK-IND () Stop T1 or handle Excep2 AT+QMTPUB=,,=0,, OK PUB-REQ AT+QMTPUB (=1) AT+QMTPUB=,,=1,, OK PUB-REQ () Start timer T1 +QMTPUB: ,,[,] PUB ACK-IND () Stop T1 or handle Excep2 AT+QMTPUB (=2) AT+QMTPUB=,,=2,, OK +QMTPUB: ,,[,] PUB-REQ () Start timer T1 PUB REC-IND () Stop T1 or handle Excep2 PUB REL-REQ () Start timer T1 PUB COMP-IND () Stop T1 or handle Excep2 TCP SYN TCP SYN+ACK TCP ACK Send connect packet Receive connect ACK packet Send subscribe packet Receive subscribe ACK packet Send unsubscribe packet Receive unsubscribe ACK packet Send publish packet Send publish packet Receive publish ACK packet Send publish packet Receive publish receive packet Send publish release packet Receive publish complete packet T1 is packet transmission timeout. T2 is keep alive timer. In the absence of a data-related message during the T2 time period, the client will send PINGREQ packet. Excep1: Disconnect the TCP connection. Excep2: Resend packets unless maximum retry times is reached. Retry times is set with AT+QMTCFG. Whether the timeout information is reported can be configured with AT+QMTCFG. Receive PUBLISH Receive message in the form of URC. +QMTRECV: ,, [,], AT+QMTDISC= OK +QMTDISC: , AT+QMTCLOSE= OK +QMTCLOSE: , PUB-IND () PUB ACK/REC-REQ () Reply accor.d..ing to DISC-REQ Receive publish packet Send publish reply packet Send disconnect packet TCP-REQ TCP disconnected TCP discon.n..ect request Note: refers to optional parameters. For more details about optional parameters, please refer to the description of corresponding AT command in Chapter 3.3. Figure 1: MQTT Data Interaction Diagram BG770A-GL&BG95xA-GL_MQTT_Application_Note 7 / 31 LPWA Module Series 3 MQTT AT Commands The AT commands for using the MQTT function are presented in this chapter. 3.1. AT Command Introduction 3.1.1. Definitions ⚫ Carriage return character. ⚫ Line feed character. ⚫ Parameter name. Angle brackets do not appear on the command line. ⚫ [...] Optional parameter of a command or an optional part of TA information response. Square brackets do not appear on the command line. When an optional parameter is not given in a command, the new value equals its previous value or the default settings, unless otherwise specified. ⚫ Underline Default setting of a parameter. 3.1.2. AT Command Syntax All command lines must start with AT or at and end with . Information responses and result codes always start and end with a carriage return character and a line feed character: . In tables presenting commands and responses throughout this document, only the commands and responses are presented, and and are deliberately omitted. Table 1: Types of AT Commands Command Type Test Command Read Command Write Command Syntax Description AT+=? AT+? Test the existence of the corresponding command and return information about the type, value, or range of its parameter. Check the current parameter value of the corresponding command. AT+=[,[,[...]]] Set user-definable parameter value. BG770A-GL&BG95xA-GL_MQTT_Application_Note 8 / 31 Execution Command AT+ LPWA Module Series Return a specific information parameter or perform a specific action. 3.2. Declaration of AT Command Examples The AT command examples in this document are provided to help you learn about the use of the AT commands introduced herein. The examples, however, should not be taken as Quectel’s recommendations or suggestions about how to design a program flow or what status to set the module into. Sometimes multiple examples may be provided for one AT command. However, this does not mean that there is a correlation among these examples, or that they should be executed in a given sequence. 3.3. Description of MQTT AT Commands 3.3.1. AT+QMTCFG Configure Optional Parameters of MQTT This command configures optional parameters of MQTT. AT+QMTCFG Configure Optional Parameters of MQTT Test Command AT+QMTCFG=? Response +QMTCFG: 'version',(range of supported s),(list of supported s) +QMTCFG: 'pdpcid',(range of supported s),(range of supported s) +QMTCFG: 'ssl',(range of supported s),( list of supported s),(range of supported s) +QMTCFG: 'keepalive',(range of supported s),(range of supported s) +QMTCFG: 'session',(range of supported s),(list of supported s) +QMTCFG: 'timeout',(range of supported s),(range of supported s),(range of supported s),(list of supported s) +QMTCFG: 'will',(range of supported s),(list of supported s),(range of supported s),(list of supported s),, +QMTCFG: 'recv/mode',(range of supported s),(list of supported s),(list of supported s) +QMTCFG: 'aliauth',(range of supported s),,, BG770A-GL&BG95xA-GL_MQTT_Application_Note 9 / 31 LPWA Module Series Write Command Query/set the MQTT protocol version AT+QMTCFG='version',[,] OK Response If the optional parameter is omitted, query the MQTT protocol version: +QMTCFG: 'version', OK If the optional parameter is specified, set the MQTT protocol version: OK Write Command Query/set the PDP to be used by the MQTT client AT+QMTCFG='pdpcid',[,] If there is any error: ERROR Response If the optional parameter is omitted, query the PDP used by the MQTT client: +QMTCFG: 'pdpcid', OK If the optional parameter is specified, set the PDP to be used by the MQTT client: OK Write Command Query/set the MQTT SSL mode and SSL context index AT+QMTCFG='ssl',[,[,]] If there is any error: ERROR Response If the optional parameters are omitted, query the MQTT SSL mode and SSL context index: +QMTCFG: 'ssl',[,] OK If any of the optional parameters is specified, set the MQTT SSL mode and SSL context index: OK Write Command Query/set the keep-alive time AT+QMTCFG='keepalive',< client_idx>[,] If there is any error: ERROR Response If the optional parameter is omitted, query the keep-alive time: +QMTCFG: 'keepalive', OK BG770A-GL&BG95xA-GL_MQTT_Application_Note 10 / 31 LPWA Module Series If the optional parameter is specified, set the keep-alive time: OK Write Command Query/set the session type AT+QMTCFG='session',[, ] If there is any error: ERROR Response If the optional parameter is omitted, query the session type: +QMTCFG: 'session', OK If the optional parameter is specified, set the session type: OK Write Command Query/set the message delivery timeout AT+QMTCFG='timeout',[,[,< retry_times>][,]] If there is any error: ERROR Response If the optional parameters are omitted, query the message delivery timeout: +QMTCFG: 'timeout',,, OK If any of the optional parameters is specified, set the message delivery timeout: OK Write Command Query/set the Will information AT+QMTCFG='will',[,[,,, ,]] If there is any error: ERROR Response If the optional parameters are omitted, query the Will information: +QMTCFG: 'will',[,,,, ] OK If any of the optional parameters is specified, set the Will information: OK Write Command Query/set the MQTT If there is any error: ERROR Response If the optional parameters are omitted, query the MQTT message BG770A-GL&BG95xA-GL_MQTT_Application_Note 11 / 31 LPWA Module Series message receiving mode when the data are received from server AT+QMTCFG='recv/mode', [,[,]] receiving mode. +QMTCFG: 'recv/mode',[,] OK If any of the optional parameters is specified, set the MQTT message receiving mode: OK Write Command Query/set Alibaba device information for AliCloud AT+QMTCFG='aliauth',[,,< device_name>,] If there is any error: ERROR Response If the optional parameters are omitted, query the device information: [+QMTCFG: 'aliauth',,,] OK If the optional parameters are specified, set the device information: OK Maximum Response Time Characteristics If there is any error: ERROR Determined by the network. The command takes effect immediately. The configurations will not be saved. Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. MQTT protocol version. 3 MQTT v3.1 4 MQTT v3.1.1 Integer type. PDP to be used by the MQTT client. Range: 1–5. Default value: 1 Integer type. Whether to configure the Will flag. 0 Ignore the Will flag configuration 1 Require the Will flag configuration Integer type. QoS level of message delivery. 0 At most once 1 At least once 2 Exactly once Integer type. Will Retain flag is only used for PUBLISH messages. BG770A-GL&BG95xA-GL_MQTT_Application_Note 12 / 31 LPWA Module Series 0 When a client sends a PUBLISH message to a server, the server will not retain the message after it has been delivered to the current subscribers. 1 When a client sends a PUBLISH message to a server, the server should retain the message after it has been delivered to the current subscribers. String type. Will topic. Maximum length: 255 bytes. String type. The Will message defines the content of the message published on the Will topic if the client is unexpectedly disconnected. It can be a zero-length message. Maximum length: 255 bytes. Integer type. Packet delivery timeout. Range: 1–60. Default value: 5. Unit: second. Integer type. Retry times when packet delivery times out. Range: 0–10. Default value: 3. Integer type. Whether to report timeout message when transmitting a packet. 0 Do not report 1 Report Integer type. Configures the session type. 0 The server must store the subscriptions of the client after it disconnects. 1 The server must discard any previously maintained information about the client after it disconnects and treat the connection as 'clean'. Integer type. Keep-alive time. Range: 0–3600. Default value: 120. Unit: second. It defines the maximum interval between messages received from a client. If the server does not receive a message from the client within 1.5 times of the keep-alive time value, it disconnects the client as if the client sent a DISCONNECT message. If the keep-alive time is 0, this means that the server is not required to disconnect the client on the grounds of inactivity. Integer type. MQTT SSL mode. 0 Use normal TCP connection for MQTT 1 Use SSL TCP secure connection for MQTT Integer type. SSL context index. Range: 0–5. Integer type. MQTT message receiving mode. 0 MQTT message received from server will be contained in URC 1 MQTT message received from server will not be contained in URC Integer type. 0 Length of MQTT message received from server will not be contained in URC 1 Length of MQTT message received from server will be contained in URC Product key issued by AliCloud. Device name issued by AliCloud. Device secret key issued by AliCloud. NOTE 1. If =1, then , , and must be specified. Otherwise, they are omitted. 2. =0 is only effective when the server supports the operation. BG770A-GL&BG95xA-GL_MQTT_Application_Note 13 / 31 LPWA Module Series 3. If MQTT connection is configured to SSL mode, must be specified, and AT+QSSLCFG must be used to configure the SSL version, cipher suite, secure level, CA certificate, client certificate, client key and ignorance of RTC time, which will be used in MQTT SSL handshake procedure. For more information on AT+QSSLCFG, see document [3]. 4. Care must be taken to ensure that message delivery does not time out while the sending process is in progress. 5. AT+QMTCFG='aliauth' is only used for AliCloud. If it is configured, and can be omitted in AT+QMTCONN. Once set, a specified session can only be used for AliCloud until reboot. 3.3.2. AT+QMTOPEN Open a Network Connection for MQTT Client This command opens a network connection for an MQTT client. AT+QMTOPEN Open a Network Connection for MQTT Client Test Command AT+QMTOPEN=? Response +QMTOPEN: (range of supported s),,(range of supported s) Read Command AT+QMTOPEN? OK Response [+QMTOPEN: ,,] Write Command AT+QMTOPEN=,, OK Response OK +QMTOPEN: , Maximum Response Time Characteristics If there is any error: ERROR Determined by the network / Parameter Integer type. MQTT client identifier. Range: 0–5. String type. Server address. It could be an IP address or a domain name. Maximum size: 128 bytes. Integer type. Server port number. Range: 0–65535. Integer type. Command execution result. -1 Failed to open a network BG770A-GL&BG95xA-GL_MQTT_Application_Note 14 / 31 0 Network opened successfully 1 Wrong parameter 2 MQTT client identifier is occupied 3 Failed to activate PDP 4 Failed to parse domain name 5 Network connection error LPWA Module Series 3.3.3. AT+QMTCLOSE Close a Network Connection for MQTT Client This command closes a network connection for an MQTT client. AT+QMTCLOSE Close a Network Connection for MQTT Client Test Command AT+QMTCLOSE=? Response +QMTCLOSE: (range of supported s) Write Command AT+QMTCLOSE= OK Response OK +QMTCLOSE: , Maximum Response Time Characteristics If there is any error: ERROR Determined by network / Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Command execution result. -1 Failed to close the network 0 Network closed successfully 3.3.4. AT+QMTCONN Connect a Client to MQTT Server This command is used when a client requests a connection to the MQTT server. When a TCP/IP socket connection is established between a client and a server, a protocol level session must be created using a CONNECT flow. BG770A-GL&BG95xA-GL_MQTT_Application_Note 15 / 31 LPWA Module Series AT+QMTCONN Connect a Client to MQTT Server Test Command AT+QMTCONN=? Response +QMTCONN: (range of supported s),,, Read Command AT+QMTCONN? OK Response [+QMTCONN: ,] Write Command AT+QMTCONN=,[,[,]] OK Response OK +QMTCONN: ,[,] Maximum Response Time Characteristics If there is any error: ERROR (default 5 s), determined by the network / Parameter Integer type. MQTT client identifier. Range: 0–5. Client identifier string. String type. Client username. It can be used for authentication. String type. The password corresponding to the client username. It can be used for authentication. Integer type. Command execution result. 0 Packet sent successfully and ACK received from the server 1 Packet retransmission 2 Failed to send the packet Integer type. MQTT connection state. 1 MQTT is initializing 2 MQTT is connecting 3 MQTT is connected 4 MQTT is disconnecting Integer type. Connection status return code. 0 Connection Accepted 1 Connection Refused: Unacceptable Protocol Version 2 Connection Refused: Identifier Rejected 3 Connection Refused: Server Unavailable BG770A-GL&BG95xA-GL_MQTT_Application_Note 16 / 31 LPWA Module Series 4 Connection Refused: Bad Username or Password 5 Connection Refused: Not Authorized Integer type. Packet delivery timeout. Range: 1–60. Default value: 5. Unit: second. NOTE 1. If a client with the same Client ID is already connected to the server, the 'older' client must be disconnected by the server before completing the CONNECT flow of the new client. 2. AT+QMTCFG='aliauth' is only used for AliCloud. If it is configured, then and in AT+QMTCONN can be omitted. 3.3.5. AT+QMTDISC Disconnect a Client from MQTT Server This command requests a disconnection from MQTT server by a client. A DISCONNECT message is sent from the client to the server to indicate that it is about to close its TCP/IP connection. AT+QMTDISC Disconnect a Client from MQTT Server Test Command AT+QMTDISC=? Response +QMTDISC: (range of supported s) Write Command AT+QMTDISC= OK Response OK +QMTDISC: , Maximum Response Time Characteristics If there is any error: ERROR Determined by the network / Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Command execution result. -1 Failed to close the connection 0 Connection closed successfully BG770A-GL&BG95xA-GL_MQTT_Application_Note 17 / 31 LPWA Module Series NOTE Disconnecting a client closes the socket. 3.3.6. AT+QMTSUB Subscribe to Topics This command subscribes to one or more topics. A SUBSCRIBE message is sent to the server by a client to register interest in one or more topic names. Messages published on these topics are delivered from the server to the client as PUBLISH messages. AT+QMTSUB Subscribe to Topics Test Command AT+QMTSUB=? Response +QMTSUB: (range of supported s),(range of supported s),,(range of supported s) Write Command AT+QMTSUB=,,,[,,…] OK Response OK +QMTSUB: ,,[,] Maximum Response Time Characteristics If there is any error: ERROR × (default 15 s), determined by network The command takes effect immediately. The configurations will not be saved. Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Message identifier of a packet. Range: 1–65535. String type. Topic that the client wants to subscribe to or unsubscribe from. Integer type. QoS level at which the client wants to publish messages. 0 At most once 1 At least once 2 Exactly once Integer type. Command execution result. 0 Packet sent successfully and ACK received from the server 1 Packet retransmission 2 Failed to send a packet If is 0, it is a vector of granted QoS levels. BG770A-GL&BG95xA-GL_MQTT_Application_Note 18 / 31 LPWA Module Series If is 1, it is the number of times the packet has been retransmitted. If is 2, it will not be presented. Integer type. Packet delivery timeout. Range: 1–60. Default value: 5. Unit: second. Integer type. Retry times when packet delivery times out. Range: 0–10. Default value: 3. NOTE The is only present in messages where the QoS bits in the fixed header indicate QoS levels 1 or 2. It must be unique among the set of 'inflight' messages in a particular communication direction. It typically increases by 1 from one message to the next. 3.3.7. AT+QMTUNS Unsubscribe from Topics This command unsubscribes from one or more topics. An UNSUBSCRIBE message is sent by the client to the server to unsubscribe from the named topics. AT+QMTUNS Unsubscribe from Topics Test Command AT+QMTUNS=? Response +QMTUNS: (range of supported s),(range of supported s), Write Command AT+QMTUNS=,,[,…] OK Response OK +QMTUNS: ,, Maximum Response Time Characteristics If there is any error: ERROR × (default 15 s), determined by network The command takes effect immediately. The configurations will not be saved. Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Message identifier of a packet. Range: 1–65535. String type. Topic that the client wants to subscribe to or unsubscribe from. Integer type. Command execution result. 0 Packet sent successfully and ACK received from the server BG770A-GL&BG95xA-GL_MQTT_Application_Note 19 / 31 LPWA Module Series 1 Packet retransmission 2 Failed to send a packet Integer type. Packet delivery timeout. Range: 1–60. Default value: 5. Unit: second. Integer type. Retry times when packet delivery times out. Range: 0–10. Default value: 3. 3.3.8. AT+QMTPUB Publish Messages (Data Mode) This command publishes messages by a client to a server for distribution to interested subscribers. Each PUBLISH message is associated with a topic name. If a client subscribes to one or more topics, any message published on those topics is sent by the server to the client as a PUBLISH message. AT+QMTPUB Publish Messages (Data Mode) Test Command AT+QMTPUB=? Response +QMTPUB: (range of supported s),(range of supported s),(range of supported s),(list of supported s),,(range of supported s) Write Command Publish variable-length messages AT+QMTPUB=,, ,, OK Response > After > is reported, input the data to be sent. Press Ctrl+Z to send the data, or Esc to cancel the operation. OK +QMTPUB: ,,[,] Write Command Publish fixed-length messages AT+QMTPUB=,, ,,, If there is any error: ERROR Response > After > is responded, input the data to be sent. The number of bytes of input data must equal . OK +QMTPUB: ,,[,] Maximum Response Time If there is any error: ERROR × (default 15 s), determined by the network BG770A-GL&BG95xA-GL_MQTT_Application_Note 20 / 31 LPWA Module Series Characteristics / Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Message identifier of a packet. Range: 0–65535. It will be 0 only when =0. Integer type. QoS level at which the client wants to publish messages. 0 At most once 1 At least once 2 Exactly once Integer type. Determines whether the server will retain the message after it has been delivered to the current subscribers. 0 The server will not retain the message after it has been delivered to the current subscribers 1 The server will retain the message after it has been delivered to the current subscribers String type. Topic that needs to be published. Integer type. Length of the message to be published. Range: 1–4096. Unit: byte. Integer type. Command execution result. 0 Packet sent successfully and ACK received from the server (message that is published when =0 does not require ACK) 1 Packet retransmission 2 Failed to send a packet If is 1, it means the number of times a packet has been retransmitted. If is 0 or 2, it will not be presented. Integer type. Packet delivery timeout. Range: 1–60. Default value: 5. Unit: second. Integer type. Retry times when packet delivery times out. Range: 0–10. Default value: 3. NOTE 1. If this command is executed successfully and OK is reported, the client can continue to publish new packets. The maximum quantity of the packet to be transmitted should not be greater than that of inflight windows (5). 2. After executing this command, the client will be ready to send data as a payload. The maximum length of data input at a time is 4096 bytes. To send the data, remember to press Ctrl+Z. 3. PUBLISH messages can be sent either from a publisher to the server, or from the server to a subscriber. When a server publishes messages to a subscriber, the following URC will be returned to notify the host to read the received data reported by the MQTT server: +QMTRECV: ,,[,], For more information on the URC description, see Chapter 4.2. BG770A-GL&BG95xA-GL_MQTT_Application_Note 21 / 31 LPWA Module Series 3.3.9. AT+QMTPUBEX Publish Messages (Command Mode) This command publishes messages. It provides the same functions as AT+QMTPUB, except that the format is different. AT+QMTPUBEX Publish Messages (Command Mode) Test Command AT+QMTPUBEX=? Response +QMTPUBEX: (range of supported s),( range of supported s),(range of supported s),(list of supported s),, Write Command AT+QMTPUBEX=,,,,, Maximum Response Time Characteristics OK Response OK +QMTPUB: ,,[,] If there is any error: ERROR × (default 15 s), determined by the network / Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Message identifier of a packet. Range: 0–65535. It will be 0 only when =0. Integer type. QoS level at which the client wants to publish messages. 0 At most once 1 At least once 2 Exactly once Integer type. Determines whether the server will retain the message after it has been delivered to the current subscribers. 0 The server will not retain the message after it has been delivered to the current subscribers 1 The server will retain the message after it has been delivered to the current subscribers String type. Topic that needs to be published. String type. Message to be published. Maximum length: 560 bytes. Integer type. Command execution result. 0 Packet sent successfully and ACK received from the server (message that is published when =0 does not require ACK) 1 Packet retransmission BG770A-GL&BG95xA-GL_MQTT_Application_Note 22 / 31 LPWA Module Series 2 Failed to send a packet If is 1, it means the number of times a packet has been retransmitted. If is 0 or 2, it will not be presented. Integer type. Packet delivery timeout. Range: 1–60. Default value: 5. Unit: second. Integer type. Retry times when packet delivery times out. Range: 0–10. Default value: 3. NOTE The response flow of AT+QMTPUBEX will be the same as the response flow of AT+QMTPUB. 3.3.10. AT+QMTRECV Read Messages from Buffer This command reads messages from the storage buffer where the messages are stored after being reported by the server. AT+QMTRECV Read Messages from Buffer Test Command AT+QMTRECV=? Read Command AT+QMTRECV? Response OK Response +QMTRECV: ,,,,, OK Write Command AT+QMTRECV=[,] If there is no MQTT connection: OK Response List of (+QMTRECV: ,,,[,])s OK If no message has been received: OK Maximum Response Time If there is no MQTT connection: ERROR Determined by the network. BG770A-GL&BG95xA-GL_MQTT_Application_Note 23 / 31 LPWA Module Series Characteristics / Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Indicates if a message is stored in the buffer. As there can be maximum 5 messages in a buffer, the URC can report at most 5 messages simultaneously. 0 No stored messages 1 There are stored messages (up to 5) Integer type. Serial number of a received message. Range: 0–4. All buffer data will be read if this parameter is not specified. Integer type. Message identifier of the packet. Range: 0–65535. It will be 0 only when =0. String type. Topic that needs to be published. Integer type. Payload length. Unit: Byte. String type. Payload relating to topic name. BG770A-GL&BG95xA-GL_MQTT_Application_Note 24 / 31 LPWA Module Series 4 MQTT URCs This chapter describes the MQTT URCs. 4.1. +QMTSTAT: URC to Indicate State Change in MQTT Link Layer The URC that begins with +QMTSTAT will be reported when the state of an MQTT link layer is changed. +QMTSTAT: URC to Indicate State Change in MQTT Link Layer When the state of an MQTT link layer is changed, the client +QMTSTAT: , will close the MQTT connection and report the URC. Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Error code. Refer to the table below for more information. Table 1: Error Codes of +QMTSTAT: URC 1 2 3 4 Description Solution Connection is closed or reset by a peer. Sending PINGREQ packet timed out or failed. Sending CONNECT packet timed out or failed. Receiving CONNACK packet timed out or failed. Execute AT+QMTOPEN command to reopen the MQTT connection. First, deactivate and activate the PDP. Then, reopen the MQTT connection. 1. Check whether the inputted username and password are correct. 2. Make sure the client ID is not used. 3. Reopen the MQTT connection and try to send CONNECT packet to the server again. 1. Check whether the inputted username and password are correct. 2. Make sure the client ID is not used. 3. Reopen the MQTT connection and try to send CONNECT packet to the server again. BG770A-GL&BG95xA-GL_MQTT_Application_Note 25 / 31 5 6 7 8–255 LPWA Module Series The client sends DISCONNECT packet to the sever and the server starts closing the MQTT connection. The client takes the initiative to close the MQTT connection due to constant packet sending failure. The link is not alive, or the server is unavailable. This is a normal process. 1. Make sure that the data are correct. 2. Try to reopen the MQTT connection since there may be a network congestion or an error. Make sure that the link is alive, or the server is currently available. Reserved for future uses. NOTE Error codes 5, 6 and 7 are currently not supported. 4.2. +QMTRECV: URC to Inform the Host to Read MQTT Packet Data The URC that begins with +QMTRECV: is mainly used to inform the host to read the received MQTT packet reported from the MQTT server. +QMTRECV: URC to Inform the Host to Read MQTT Packet Data +QMTRECV: ,,< topic>[,], +QMTRECV: ,[,] Notify the host to read the received data reported from the MQTT server. Notify that the message received from the MQTT server has been stored in a buffer. Parameter Integer type. MQTT client identifier. Range: 0–5. Integer type. Message identifier of the packet. String type. Topic that has been received from the MQTT server. Integer type. Payload length. Unit: byte. String type. Payload relating to topic name. Integer type. Serial number of a received message. Range: 0–4. BG770A-GL&BG95xA-GL_MQTT_Application_Note 26 / 31 LPWA Module Series 5 Examples This chapter provides some examples that explain how to use the MQTT AT commands. 5.1. Example of MQTT Operation without SSL AT+QMTCFG='aliauth',0,'oyjtmPl5a5j','MQTT_TEST','wN9Y6pZSIIy7Exa5qVzcmigEGO4kAazZ' //Configure Alibaba device information for AliCloud. OK AT+QMTOPEN=? +QMTOPEN: (0-5),,(0-65535) OK AT+QMTOPEN=0,'iot-as-mqtt.cn-shanghai.aliyuncs.com',1883 //Open a network for MQTT client. OK +QMTOPEN: 0,0 //The MQTT client network opened successfully. AT+QMTOPEN? +QMTOPEN: 0,'iot-as-mqtt.cn-shanghai.aliyuncs.com',1883 OK AT+QMTCONN=? +QMTCONN: (0-5),,, OK //Connect a client to the MQTT server. //If AliCloud is connected, AT+QMTCFG='aliauth' can be used to configure the device information in advance. There is no need to provide the username/password from now on. AT+QMTCONN=0,'clientExample' OK +QMTCONN: 0,0,0 //The client has successfully connected to the MQTT server. AT+QMTSUB=? +QMTSUB: (0-5),(1-65535),,(0-2) BG770A-GL&BG95xA-GL_MQTT_Application_Note 27 / 31 LPWA Module Series OK //Subscribe to topics. AT+QMTSUB=0,1,'topic/example',2 OK +QMTSUB: 0,1,0,2 AT+QMTSUB=0,1,'topic/pub',0 OK +QMTSUB: 0,1,0,0 //If a client subscribed to a topic and other devices publish the same topic to the server, the module will report the following information. +QMTRECV: 0,0,'topic/example','This is the payload related to topic' //Unsubscribe from topics. AT+QMTUNS=0,1,'topic/example' OK +QMTUNS: 0,2,0 AT+QMTPUB=? +QMTPUB : (0-5),(0-65535),(0-2),(0,1),,(1-4096) OK //Publish messages. AT+QMTPUB=0,0,0,0,'topic/pub' >These are test data, hello MQTT. OK //After receiving >, input data These are test data, hello MQTT. and then send it. The maximum length of the data to be sent is 4096 bytes. All the data beyond 4096 bytes will be omitted. After inputting data, press Ctrl+Z to send them. +QMTPUB: 0,0,0 //If a client subscribed to a topic named 'topic/pub' and other devices publish the same topic to the server, the module will report the following information. +QMTRECV: 0,0,'topic/pub','These are test data, hello MQTT.' AT+QMTDISC=0 //Disconnect a client from the MQTT server. OK +QMTDISC: 0,0 //The connection closed successfully. BG770A-GL&BG95xA-GL_MQTT_Application_Note 28 / 31 LPWA Module Series 5.2. Example of MQTT Operation with SSL //Configure the MQTT session into SSL mode. AT+QMTCFG='ssl',0,1,2 OK //If SSL authentication mode is intended to be set as 'manage server and client authentication if requested by the remote server' (=2 in AT+QSSLCFG), upload a server root CA certificate, a client certificate, and a client private key to UFS. AT+QFUPL='cacert.pem',1758,100 //Upload a CA certificate to UFS. CONNECT +QFUPL: 1758,384a OK AT+QFUPL='client.pem',1220,100 //Upload a client certificate to UFS. CONNECT +QFUPL: 1220,2d53 OK AT+QFUPL='user_key.pem',1679,100 //Upload a client private key to UFS. CONNECT +QFUPL: 1679,335f OK //Configure the path of the CA certificate for SSL context 2. AT+QSSLCFG='cacert',2,'cacert.pem' OK //Configure the path of the client certificate for SSL context 2. AT+QSSLCFG='clientcert',2,'client.pem' OK //Configure the path of the client private key for SSL context 2. AT+QSSLCFG='clientkey',2,'user_key.pem' OK //Configure the authentication mode for SSL context 2. AT+QSSLCFG='seclevel',2,2 //SSL authentication mode: server and client authentication if requested by the remote server. BG770A-GL&BG95xA-GL_MQTT_Application_Note 29 / 31 LPWA Module Series OK AT+QSSLCFG='sslversion',2,4 OK AT+QSSLCFG='ciphersuite',2,0XFFFF OK AT+QSSLCFG='ignorelocaltime',2,1 OK //SSL authentication version //Cipher suite //Ignore the authentication time. //Start the MQTT SSL connection. AT+QMTOPEN=0,'a1zgnxur10j8ux.iot.us-east-1.amazonaws.com',8883 OK +QMTOPEN: 0,0 //Connect to the MQTT server. AT+QMTCONN=0,'MQTT-1' OK +QMTCONN: 0,0,0 //Subscribe to topics. AT+QMTSUB=0,1,'$aws/things/ MQTT-1/shadow/update/accepted',1 OK +QMTSUB: 0,1,0,1 //Publish messages. AT+QMTPUB=0,1,1,0,'$aws/things/MQTT-1/shadow/update/accepted' >These are published data from client OK +QMTPUB: 0,1,0 //If a client subscribed to a topic named '$aws/things/MQTT-1/shadow/update/accepted' and other devices publish the same topic to the server, the module will report the following information. +QMTRECV: 0,1,'$aws/things/MQTT-1/shadow/update/accepted','These are published data from client' //Disconnect a client from the MQTT server. AT+QMTDISC=0 OK +QMTDISC: 0,0 BG770A-GL&BG95xA-GL_MQTT_Application_Note 30 / 31 LPWA Module Series 6 Appendix References Table 2: Related Documents Document Name [1] MQTT V3.1 Protocol Specification [2] MQTT V3.1.1 Protocol Specification [3] Quectel_BG770A-GL&BG95×A-GL_SSL_Application_Note Table 3: Terms and Abbreviations Abbreviation ACK CA IP MQTT PDP QoS SSL TCP UFS URC Description Acknowledgement Certificate Authority Internet Protocol Message Queuing Telemetry Transport Packet Data Protocol Quality of Service Secure Sockets Layer Transmission Control Protocol User File System Unsolicited Result Code BG770A-GL&BG95xA-GL_MQTT_Application_Note 31 / 31

BG770A-GL&BG95xA-GL MQTT Application Note LPWA Module Series Version: 1.0 Date: 2022-01-21 Status: Released LPWA Module Series At Quectel, our aim is to provide timely and comprehensive services to our customers. If you require any assistance, please contact our headquarters: Quectel Wireless Solutions Co., Ltd. Building 5, Shanghai Business Park Phase III (Area B), No.1016 Tianlin Road, Minhang District, Shanghai 200233, China Tel: +86 21 5108 6236 Email: info@quectel.com Or our local offices. For more information, please visit: http://www.quectel.com/support/sales.htm. For technical support, or to report documentation errors, please visit: http://www.quectel.com/support/technical.htm. Or email us at: support@quectel.com. Legal Notices We