Troubleshoot Cellular Gateways Using AT Commands

Introduction

This document describes the usage of AT Commands for CG522-E Modem, Sierra Wireless EM9190 which can be applied from CG522 Operating System.

What are AT Commands? 

AT commands, or Attention Commands, are a set of instructions used to control modems. The name "AT" comes from the attention prefix that must precede each command to get the modem attention. These commands are used to manage various modem functions, including dialing, hanging up, and changing communication parameters.

Why do we need to know AT Commands?

AT commands are essential for several reasons, especially when dealing with modem communication and control in various applications. Here are some key reasons why AT commands are needed:

1. Device Control: AT commands provide a standardized way to control modem functions, such as dialing numbers, sending and receiving messages, and managing network connections.
2. Configuration: They allow users to configure modem settings, including network parameters, data transmission settings, and power management. This is crucial for optimizing performance and ensuring compatibility with different networks.
3. Diagnostics and Troubleshooting: AT commands can be used to query the modem for status information, check signal quality, and retrieve error codes, which helps in diagnosing and troubleshooting connectivity issues.

Overall, AT commands are a crucial tool for developers, engineers, and technicians who need to interact with and manage modem hardware efficiently and effectively. They provide the necessary interface for a wide range of communication tasks and applications.

How to run AT Commands on CG522-E

This can be simply done by running the commands from an active CLI session to the Cellular Gateway.

CellularGateway# cellular 1 modem-at-commands
Value for '' (<string>): <Required AT Command>

cellular_modem_at_cmd: modem-at-response

Basic AT Commands

ATI, aka AT Identification command, is a command that can be used to show the modem manufacture, its model, what firmware is it running, IMEI, and Factory Serial Number.

CellularGateway# cellular 1 modem-at-commands
Value for '' (<string>): ati

cellular_modem_at_cmd: modem-at-response ati
Manufacturer: Sierra Wireless, Incorporated
Model: EM9190
Revision: SWIX55C_03.09.11.00 7bf975 jenkins 2022/06/10 20:36:01
IMEI: 111111111111
IMEI SV: 22
FSN: XXXXXXXXXXXX
+GCAP: +CGSM
OK

AT!PRIID? shows the OEM PRI Version and the available Carriers PRI options.

cellular_modem_at_cmd: modem-at-response AT!PRIID?
PRI Part Number: 9909919
Revision: 001.009
Customer: Cisco
Carrier PRI: 9999999_9909619_SWIX55C_03.09.11.00_01_ATT_030.046_001
Carrier PRI: 9999999_9911061_SWIX55C_03.09.11.00_01_BELL_030.007_001
Carrier PRI: 9999999_9909622_SWIX55C_03.09.11.00_01_DOCOMO_030.041_003
Carrier PRI: 9999999_9909621_SWIX55C_03.09.11.00_01_GENERIC_030.044_006
Carrier PRI: 9999999_9910814_SWIX55C_03.09.11.00_01_KDDI_030.025_001
Carrier PRI: 9999999_9910766_SWIX55C_03.09.11.00_01_SOFTBANK_030.031_004
Carrier PRI: 9999999_9910398_SWIX55C_03.04.03.00_01_TELSTRA_030.016_001
Carrier PRI: 9999999_9910308_SWIX55C_03.10.07.00_01_TMO_030.052_000
Carrier PRI: 9999999_9909620_SWIX55C_03.09.11.00_01_VERIZON_030.046_003
OK

AT!IMPREF? shows the used PRI firmware and Carrier along side the preferred carrier if any are configured. 

cellular_modem_at_cmd: modem-at-response AT!IMPREF?
!IMPREF:
preferred fw version: 00.00.00.00
preferred carrier name: AUTO-SIM
preferred config name: AUTO-SIM_000.000_000
preferred subpri index: 000
current fw version: 03.09.11.00
current carrier name: GENERIC
current config name: GENERIC_030.044_006
current subpri index: 000
OK

AT!CPIN? shows if the SIM is ready or require a PIN to be activated.

cellular_modem_at_cmd: modem-at-response AT+CPIN?
+CPIN: READY
OKAT+CPIN="SIM-PIN" is the command to insert a PIN to unlock the SIM.

cellular_modem_at_cmd: modem-at-response AT+CPIN="3045"
OK

However, if the Cellular Gateway or the modem are restarted, the PIN needs to be entered again.

AT+CLCK="SC",0,"SIM-PIN" can be applied to permanently unlock the SIM, hence no need to insert the PIM again post a reload.

cellular_modem_at_cmd: modem-at-response AT+CLCK="SC",0,"3045"
OK

AT+CREG? verifies the current network registration status of the modem to the circuit switched network, aka GSM networks. It is expected to return a pair of vaules.

The first value from this pair is the operation:

0 is the default and it means that the network registration needs to be checked manually.

1 refers to the result code being returned upon a change happening on the network.

2 to show registration and location information upon registration.

You do not need to change these values unless advised by TAC. The second value of this pair is the registration status and it can be interpreted.

• 0– Not registered, the device is currently not searching for new operator.
• 1– Registered to home network.
• 2– Not registered, but the device is currently searching for a new operator.
• 3– Registration denied.
• 4– Unknown. For example, out of range.
• 5– Registered, roaming. The device is registered on a foreign (national or international) network.

cellular_modem_at_cmd: modem-at-response at+creg?
+CREG: 0,1
OK

In this snippet, we can see that operation is set to 0 and registration is set to 1. 

AT+CEREG? verifies the current network registration status of the modem to the packet switched network aka Internet Access. It returns values that are the same as the previous command:

cellular_modem_at_cmd: modem-at-response at+creg?
+CREG: 0,1
OK

AT+CGREG? verifies the current network registration status of the modem to the GPRS network. It returns values that are the same as the previous command:

cellular_modem_at_cmd: modem-at-response at+cgreg?
+CGREG: 0,0
OK

AT+CIMI returns the value of the IMSI:

cellular_modem_at_cmd: modem-at-response AT+CIMI
268069668483162

AT+CCID returns the value of ICCID:

cellular_modem_at_cmd: modem-at-response AT+CCID
+CCID: 89351060001115740710

AT!UIMS? returns the slot number of the active SIM:

cellular_modem_at_cmd: modem-at-response AT!UIMS?
!UIMS: 0

AT!GSTATUS? to check connection status, system mode ENDC (NSA 5G) to check if there is an active 5G connection. If system mode is LTE, then 5G is not active. The indicated LTE band is the anchor 4G band for the ENDC connection.

The SSC (Secondary Serving Cells) bands are for the most recently used bands for carrier aggregation, but because we have an active 5G connection here, the SSC bands are inactive. The indicated NR5G band is the 5G band used for data connectivity.

cellular_modem_at_cmd: modem-at-response AT!GSTATUS?
!GSTATUS:
Current Time: 1730657 Temperature: 44
Thermal Mitigation Level: 0
Reset Counter: 2 Mode: ONLINE
System mode: ENDC PS state: Attached
LTE band: B1 LTE bw: 20 MHz
LTE Rx chan: 500 LTE Tx chan: 18500
EMM state: Registered Normal Service
RRC state: RRC Connected
IMS reg state: REGISTERED IMS mode: Normal
IMS Srv State: FULL SMS,NO VoIP
PCC RxM RSSI: --- PCC RxM RSRP: ---
PCC RxD RSSI: -59 PCC RxD RSRP: -86
PCC RxM1 RSSI: --- PCC RxM1 RSRP: ---
PCC RxD1 RSSI: --- PCC RxD1 RSRP: ---
PCC Tx Power: -20 TAC: bc7a (48250)
RSRQ (dB): -7.8 Cell ID: 00066e2b (421419)
SINR (dB): 14.2
SCC1 NR5G band: n78 SCC1 NR5G bw: 90 MHz
SCC1 NR5G Tx Power: 3 SCC1 NR5G Tx chan: 650332
SCC1 NR5G Rx chan: 650332
NR5G RSRP (dBm): -94 NR5G RSRQ (dB): -11
NR5G SINR (dB): 19.5

NR!INFO? connectivity mode NSA (non-stand alone) if there is an active 5G connection. This output shows that NR5G band is used:

cellular_modem_at_cmd: modem-at-response AT!NRINFO?
!NRINFO:
Connectivity Mode: NSA
NR5G Cell ID: 67
NR5G band: n78 NR5G Carrier ID: 0
NR5G dl bw: 90 MHz NR5G ul bw: 90 MHz
NR5G Tx Power: 3 NR5G Tx chan: 650332
NR5G Rx chan: 650332
NR5G dl MIMO: 0 NR5G ul MIMO: 1
NR5G(sub6) RxM RSSI (dBm): -60.6 NR5G(sub6) RxD RSSI (dBm): -60.8
NR5G(sub6) RxM1 RSSI (dBm): -60.1 NR5G(sub6) RxD1 RSSI (dBm): -61.8
NR5G RSRP (dBm): -94 NR5G RSRQ (dB): -11
NR5G SINR (dB): 20.0

AT+CGDCONT? checks the programed Access Point Names (APNs):

cellular_modem_at_cmd: modem-at-response AT+CGDCONT?
+CGDCONT: 1,"IPV4V6","internet","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0
+CGDCONT: 2,"IPV4V6","ims","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0

AT+CGDCONT=X clears and erases specific APN based on its index number:

cellular_modem_at_cmd: modem-at-response AT+CGDCONT?
+CGDCONT: 1,"IPV4V6","internet","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0
+CGDCONT: 2,"IPV4V6","ims","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0
OK

CellularGateway#
CellularGateway# cellular 1 modem-at-commands
Value for '' (<string>): AT+CGDCONT=2

cellular_modem_at_cmd: modem-at-response AT+CGDCONT=2
OK

CellularGateway#
CellularGateway# cellular 1 modem-at-commands
Value for '' (<string>): AT+CGDCONT?

cellular_modem_at_cmd: modem-at-response AT+CGDCONT?
+CGDCONT: 1,"IPV4V6","internet","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0
OK

AT+PCINFO? checks lower power state and modem status. If any of the LPM (Low Power Mode) voters are non-zero, that is indicating a reason the modem has been set to low power state, listing some of the most common reason.

• State: Online is desired state
• Temp: high temperature
• Volt: out of spec voltage
• User: forced by user
• W_DISABLE: forced by user
• FOTA: FOTA upgrade process

cellular_modem_at_cmd: modem-at-response AT!PCINFO?
State: Online
LPM voters - Temp:0, Volt:0, User:0, W_DISABLE:0, IMSWITCH:0, BIOS:0, LWM2M:0, OMADM:0, FOTA:0, NVCRIT:0, RFCAL:0, MMWCAL:0, RFC_INIT:0
LPM persistence - None

AT!IMAGE? lists all Firmwares and PRO images on the modem:

cellular_modem_at_cmd: modem-at-response at!image?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID BUILD_ID
FW 1 GOOD 2 0 0 ?_? 03.09.11.00_?
FW 2 GOOD 1 0 0 ?_? 03.10.07.00_?
FW 3 GOOD 1 0 0 ?_? 03.04.03.00_?
Max FW images: 3
Active FW image is at slot 1
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID BUILD_ID
PRI FF GOOD 0 0 0 030.046_001 03.09.11.00_ATT
PRI FF GOOD 0 0 0 030.007_001 03.09.11.00_BELL
PRI FF GOOD 0 0 0 030.041_003 03.09.11.00_DOCOMO
PRI FF GOOD 0 0 0 030.044_006 03.09.11.00_GENERIC
PRI FF GOOD 0 0 0 030.025_001 03.09.11.00_KDDI
PRI FF GOOD 0 0 0 030.031_004 03.09.11.00_SOFTBANK
PRI FF GOOD 0 0 0 030.016_001 03.04.03.00_TELSTRA
PRI FF GOOD 0 0 0 030.052_000 03.10.07.00_TMO
PRI FF GOOD 0 0 0 030.046_003 03.09.11.00_VERIZON
Max PRI images: 50

AT!IMAGE=<op><type><slot>  deletes a specific firmware.

• op = 0: Delete , 1: List, 
• type = 0: FW , 1: Config
• slot = Firmwate slot index, none implies all slots.

CellularGateway# cellular 1 modem-at-commands
Value for '' (<string>): at!image?

cellular_modem_at_cmd: modem-at-response at!image?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID BUILD_ID
FW 1 GOOD 2 0 0 ?_? 03.09.11.00_?
FW 2 GOOD 1 0 0 ?_? 03.10.07.00_?
FW 3 GOOD 1 0 0 ?_? 03.04.03.00_?
Max FW images: 3
Active FW image is at slot 1
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID BUILD_ID
PRI FF GOOD 0 0 0 030.046_001 03.09.11.00_ATT
PRI FF GOOD 0 0 0 030.007_001 03.09.11.00_BELL
PRI FF GOOD 0 0 0 030.041_003 03.09.11.00_DOCOMO
PRI FF GOOD 0 0 0 030.044_006 03.09.11.00_GENERIC
PRI FF GOOD 0 0 0 030.025_001 03.09.11.00_KDDI
PRI FF GOOD 0 0 0 030.031_004 03.09.11.00_SOFTBANK
PRI FF GOOD 0 0 0 030.016_001 03.04.03.00_TELSTRA
PRI FF GOOD 0 0 0 030.052_000 03.10.07.00_TMO
PRI FF GOOD 0 0 0 030.046_003 03.09.11.00_VERIZON
Max PRI images: 50
OK

CellularGateway#
CellularGateway# cellular 1 modem-at-commands
Value for '' (<string>): AT!IMAGE=0,0,3

cellular_modem_at_cmd: modem-at-response AT!IMAGE=0,0,3
OK

CellularGateway#
CellularGateway# cellular 1 modem-at-commands
Value for '' (<string>): AT!IMAGE?

cellular_modem_at_cmd: modem-at-response AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID BUILD_ID
FW 1 GOOD 2 0 0 ?_? 03.09.11.00_?
FW 2 GOOD 1 0 0 ?_? 03.10.07.00_?
FW 3 EMPTY 0 0 0

AT+COPS? returns the current selection mode, operator format, operator, and radio access technology. 

COPS: [selection mode],[operator format],[operator],[radio access technology] OK

<stat> = Network status.

• 0 = Unknown
• 1 = Available
• 2 = Current
• 3 = Forbidden

<mode> = Selection mode.

• 0 = automatic selection
• 1 = manual selection
• 2 = deregister from network

<format> = Operator format.

• 0 = long alphanumeric –  “T-Mobile USA”
• 1 = short alphanumeric - “TMO”
• 2 = numeric aka the MCC + MNC  - “310260”

<oper> = Operator identifier.

String of digits returning the operator identifier(s) in the listed <format>.

<AcT> = Radio access technology.

• 0 = GSM
• 1 = GSM Compact
• 2 = UTRAN
• 3 = GSM w/EGPRS
• 4 = UTRAN w/HSDPA
• 5 = UTRAN w/HSUPA
• 6 = UTRAN w/HSDPA and HSUPA
• 7 = E-UTRAN
• 8 = EC-GSM-IoT (A/Gb mode)
• 9 = E-UTRAN (NB-S1 mode)
• 10 = E-UTRA connected to a 5GCN.
• 11 =  NR connected to a 5GCN.
• 12 = Standalone 5G
• 13 = Non Standalone 5G

cellular_modem_at_cmd: modem-at-response AT+COPS?
+COPS: 0,0,"MEO MEO",13
OK

AT!VERINFO shows the host and modem details:

cellular_modem_at_cmd: modem-at-response AT!VERINFO
SBL: BOOT.SBL.4.1-00247
TZ: TZ.FU.5.9-00189
AOP: unknown
UEFI: SWIX55C_03.09.11.00
Mpss: SWIX55C_03.09.11.00 7bf975 jenkins 2022/06/10 20:36:01
OS: Linux version 4.14.206 Fri Jun 10 21:25:48 UTC 2022
Yocto: SWIX55C_03.09.11.00 2022 Fri Jun 10 21:25:48 UTC 2022
RootFS: SWIX55C_03.09.11.00 2022 Fri Jun 10 21:25:48 UTC 2022
Security: secure
RF_CAL_TREE: unknown

AT+CGCONTRDP shows the details of the current connection.

+CGCONTRDP: <cid>,<bearer_id>,<APN>,<IP Address>, <DNS IP Address> , <Secondary DNS IP Address>

• cid:Connection identifier.

• bearer_id: dentifier for the bearer.

• apn:Access Point Name.

cellular_modem_at_cmd: modem-at-response AT+CGCONTRDP
+CGCONTRDP: 1,5,internet,<IP Address >,,< DNS Server1 >,<DNS Server2>
OK

AT!FLOG? shows the history of firmware actions. This command is needed when suspecting a low power issue or a crash.

cellular_modem_at_cmd: modem-at-response AT!FLOG?
!FLOG:
OK
Class long:
00000,1980/01/06 00:00:40.028,SWIX55C_01.07.2,COMMENT=Log created,LOG_VERSION=1.0
00001,1980/01/06 00:02:46.543,SWIX55C_01.07.2,NV_BACKUP=START,COMMENT=index 1
00001,1980/01/06 00:02:49.981,SWIX55C_01.07.2,NV_BACKUP=COMPLETE,COMMENT=index 1,STATUS=PASS
00001,1980/01/06 00:00:00.000,SWIX55C_,BOOT_HOLD=3,
00001,1980/01/06 00:00:00.000,C3091400,BOOT_HOLD=3,
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_GENERIC.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_ATT.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_VERIZON.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_DOCOMO.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_KDDI.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_TMO.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_SOFTBANK.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_TELSTRA.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/nvup/NVUP_1104703_EM9190_Cisco.020,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,COPY_FROM_BACKUP=/swir/nvdelta/NVUP_BELL.010,STATUS=PASS
00002,1980/01/06 00:06:06.390,C3091100,NV_UPDATE=START,FILE=/nvup/NVUP_1104703_EM9190_Cisco.020
00002,198

AT!GCDUMP, crash file and traces if any modem crashes occured.

Value for '' (<string>): AT!GCDUMP

cellular_modem_at_cmd: modem-at-response AT!GCDUMP
No crash data available
OK

Conclusion

In the end, AT Commands give us the visibility that we need on he modem operations.

Cisco recommends using them wisely and not changing any parameters as they can result in a network loss.