AT Commands Reference Guide

Transcript

1 AT Commands Reference Guide GE863-QUAD, GE863-PY, GE863-GPS, GM862-QUAD, GM862-QUAD-PY, GE862-GPS, GE864-QUAD, GE864-PY, GC864-QUAD and GC864-PY 80000ST10025a Rev. 0 - 04/08/06

2 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Contents 1 INTRODUC TION...5 1.1 .5 Scope Of Document ... APPLICABLE DO CUMENTS ...5 2 AT COMM AND ...6 3 3.1 Definitions ... ... 6 3.2 AT Command Syntax ... 7 String Type Pa rameters... ...8 3.2.1 3.2.2 Lines... ...8 Command +CME ERROR: - ME Error Result Code ...9 3.2.2.1 3.2.2.2 +CMS ERROR - Message Servic e Failure Resu lt Code... 11 3.2.3 And Result Codes... 12 Information Responses Time-O ut ... 1 3 3.2.4 Command Response Command Issuin g Timi 3.2.5 ... 15 ng ... 3.2.6 Factory Profile A nd User Pr ofiles ... ... 15 3.2.7 AT Command Ava ilability Table... ... 17 3.3 Backward Compatibility ... 24 #SELINT - Select Interface Style ... 3.3.1 ... 25 3.4 Repeating A Command Line... 26 3.4.1 Last Command Automati c Repetition ... 26 3.5 SELINT 0 ... ... 27 3.5.1 Hayes Compliant AT Commands ... 27 ... 27 rol... m Cont Generic Mode 3.5.1.1 3.5.1.2 ace Control... 3 4 DTE - Modem Interf rol ... ... 42 3.5.1.3 Call Cont Modulation Control... 3.5.1.4 ... 46 3.5.1.5 Compression Contro l ... ... 47 3.5.1.6 Break Control ... ... 48 3.5.1.7 S Parameters ... ... 49 3.5.2 ETSI GSM 07.07 AT Commands... 55 3.5.2.1 General ... ... 55 3.5.2.2 Call Cont rol ... ... 57 3.5.2.3 Network Servic e Handling ... .. 62 .. 82 3.5.2.4 Mobile Equipm ent Cont rol ... 3.5.2.5 ent Errors ... . 102 Mobile Equipm ontrol ... ... 103 3.5.2.6 Voice C Commands Fo r GPRS 3.5.2.7 05 ... 1 3.5.2.8 Commands For Batte ry Char ger... 114 3.5.3 ETSI GSM 07.05 AT Comm ands for SMS and CBS ... 116 3.5.3.1 iguration... ... 116 General Conf 3.5.3.2 Message Conf iguration... .. 119 3.5.3.3 Message Receivi ng And R eading... 123 3.5.3.4 Message Sending And Writ ing ... 134 FAX Class 1 AT Commands... 139 3.5.4 ... 139 iguration... General Conf 3.5.4.1 page 2 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

3 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.4.2 Transmission/Recept ion Cont rol... 140 Serial Port Control ... ... 142 3.5.4.3 Custom AT Commands ... 3.5.5 .. 143 n AT Comm ands ... 143 3.5.5.1 General Configuratio FTP AT Commands ... . 171 3.5.5.2 3.5.5.3 ension AT Co mmands... 176 Enhanced Easy GPRS® Ext Easy Camera® Managem mmands ... 191 3.5.5.4 ent AT Co E-mail Management AT Commands ... 198 3.5.5.5 Easy Scan® Extensi on AT Commands ... 204 3.5.5.6 3.5.5.7 Jammed Detect & Repo rt AT Co mmands ... 214 Easy Script® Extension - Python Interpreter, AT Commands... 216 3.5.5.8 3.5.5.9 GPS AT Comm ands Set ... 22 0 3.6 ... 228 SELINT 1 ... AT Commands ... 228 3.6.1 Hayes Compliant Generic Mode m Cont rol... . 228 3.6.1.1 3.6.1.2 ace Cont rol... 235 DTE - Modem Interf 3.6.1.3 Call Cont rol ... ... 243 3.6.1.4 Modulation Control... ... 247 3.6.1.5 Contro l ... ... 248 Compression Break Control ... ... 249 3.6.1.6 3.6.1.7 S Parameters ... ... 250 3.6.2 ETSI GSM 07.07 AT Commands... 255 3.6.2.1 General ... ... 255 3.6.2.2 Call Cont rol ... ... 257 262 e Handling ... Network Servic 3.6.2.3 3.6.2.4 ent Cont rol ... 282 Mobile Equipm ent Errors ... . 302 3.6.2.5 Mobile Equipm Voice C ontrol ... ... 303 3.6.2.6 3.6.2.7 r GPRS ... 3 04 Commands Fo Commands For Batte ry Char ger... 312 3.6.2.8 3.6.3 ETSI GSM 07.05 AT Comm ands for SMS and CBS ... 314 3.6.3.1 iguration... ... 314 General Conf 3.6.3.2 Message Conf iguration... .. 317 3.6.3.3 Message Receivi ng And R eading... 322 3.6.3.4 Message Sending And Writ ing ... 332 3.6.4 FAX Class 1 AT Commands... 337 ... 337 3.6.4.1 General Conf iguration... 3.6.4.2 ion Cont rol... 338 Transmission/Recept Serial Port ... 340 3.6.4.3 Control ... Custom AT Commands ... .. 341 3.6.5 General Configuratio n AT Comm 3.6.5.1 ands ... 341 3.6.5.2 FTP AT Commands ... . 370 3.6.5.3 Enhanced Easy GPRS® Ext ension AT Co mmands... 375 3.6.5.4 Easy Camera® Managem ent AT Co mmands ... 390 3.6.5.5 AT Commands ... 397 E-mail Management on AT Commands ... 403 3.6.5.6 Easy Scan® Extensi 3.6.5.7 Jammed Detect & Repo rt AT Co mmands ... 413 3.6.5.8 Easy Script® Extension - Python Interpreter, AT Commands... 415 3.6.5.9 GPS AT Comm ands Set ... 41 9 3.7 SELINT 2 ... ... 427 AT Commands ... 427 3.7.1 Hayes Compliant page 3 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

4 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.1 m Cont rol... . 427 Generic Mode DTE - Modem Interf ace Cont rol... 434 3.7.1.2 Call Cont rol ... ... 442 3.7.1.3 3.7.1.4 Modulation Control... ... 446 Contro l ... ... 447 3.7.1.5 Compression 3.7.1.6 ... 448 Break Control ... 3.7.1.7 S Parameters ... ... 449 3.7.2 ETSI GSM 07.07 AT Commands... 454 3.7.2.1 ... 454 General ... rol ... ... 457 3.7.2.2 Call Cont Network Servic e Handling ... 3.7.2.3 462 3.7.2.4 Mobile Equipm ent Cont rol ... 478 3.7.2.5 Mobile Equipm ent Errors ... . 496 3.7.2.6 Voice C ontrol ... ... 497 3.7.2.7 Commands Fo r GPRS ... 4 98 3.7.2.8 Commands For Batte ry Char ger... 506 ETSI GSM 07.05 AT Commands for SMS and CB services ... 507 3.7.3 iguration... General Conf ... 507 3.7.3.1 3.7.3.2 iguration... .. 510 Message Conf ng And R eading... 514 3.7.3.3 Message Receivi Message Sending And Writ 3.7.3.4 ing ... 522 3.7.4 FAX Class 1 AT Commands... 527 3.7.4.1 General Conf iguration... ... 527 3.7.4.2 ion Cont rol... 528 Transmission/Recept 3.7.4.3 Serial Port Control ... ... 530 3.7.5 Custom AT Commands ... .. 532 3.7.5.1 General Configuratio n AT Comm ands ... 532 3.7.5.2 FTP AT Commands ... . 556 3.7.5.3 ension AT Co mmands... 561 Enhanced Easy GPRS® Ext ent AT Co mmands ... 573 3.7.5.4 Easy Camera® Managem Email Management 3.7.5.5 AT Commands... 578 3.7.5.6 Easy Scan® Extensi on AT Commands ... 584 3.7.5.7 Jammed Detect & Repo rt AT Co mmands ... 594 3.7.5.8 Easy Script® Extension - Python interpreter, AT Commands ... 596 3.7.5.9 GPS AT Comm ands Set ... 60 1 3.7.5.10 SAP AT Command s Set ... 609 4 List of acr onyms ...612 nge Log ...614 5 Document Cha page 4 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

5 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 1 INTRODUCTION 1.1 Scope Of Document To describe all AT commands implemented on the following Telit wireless modules: Model P/N GM862-QUAD-PY 3990250656 GM862-QUAD 3990250655 GE863-QUAD 3990250653 GE863-PY 3990250654 GM862-QUAD-PY 3990250658 GM862-QUAD 3990250659 GM862-GPS 3990250657 3990250662 GE863-QUAD GE863-PY 3990250661 GE863-GPS 3990250660 GE864-QUAD 3990250648 3990250650 GE864-PY GC864-QUAD 3990250675 GC864-PY 3990250676 e r y l t c i r t s s i t n e m u c o d s i h T : E T O N ’ t I . s t c u d o r p e v o b a e h t o t d e r r e f y l h g i h s r y l t c i r t s s i t n e m u c o d s i h T : E T O N ’ t I . s t c u d o r p e v o b a e h t o t d e r r e f e y l h g i h s e r y l t c i r t s s i t n e m u c o d s i h T : E T O N s ’ t I . s t c u d o r p e v o b a e h t o t d e r r e f y l h g i h e h c e l b u o d o t d e d n e m m o c e r 3 6 8 M G r o 2 6 8 M G r u o y f o N / P e h t k c , t c u d o r p e h c e l b u o d o t d e d n e m m o c e r 3 6 8 M G r o 2 6 8 M G r u o y f o N / P e h t k c , t c u d o r p e h c e l b u o d o t d e d n e m m o c e r 3 6 8 M G r o 2 6 8 M G r u o y f o N / P e h t k c , t c u d o r p t n o i t a i c o s s a y n a e r o f e b s e c n e r e f f i d e r a e r e h t e c n i s , t n e m u c o d s i h t o t n o i t a i c o s s a y n a e r o f e b s e c n e r e f f i d e r a e r e h t e c n i s , t n e m u c o d s i h t o o t n o i t a i c o s s a y n a e r o f e b s e c n e r e f f i d e r a e r e h t e c n i s , t n e m u c o d s i h t i t i d d a . s e ( N / P n e e w t e b ) P A S d n a X U M C e k i l s n o i t c n u f l a n o . t i d d a . s e ( N / P n e e w t e b ) P A S d n a X U M C e k i l s n o i t c n u f l a n o i . i t i d d a . s e ( N / P n e e w t e b . ) P A S d n a X U M C e k i l s n o i t c n u f l a n o 2 APPLICABLE DOCUMENTS ETSI GSM 07.07 specification and rules a) b) ETSI GSM 07.05 specification and rules c) Hayes standard AT command set Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 5 of 614

6 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3 AT COMMAND The Telit wireless module family can be driven via the serial interface using the standard AT 1 commands . The Telit wireless module family is compliant with: 1. Hayes standard AT command set, in order to maintain the compatibility with existing SW programs. 2. ETSI GSM 07.07 specific AT command and GPRS specific commands. 3. ETSI GSM 07.05 specific AT commands for SMS (Short Message Service) and CBS (Cell Broadcast Service) 4. FAX Class 1 compatible commands Moreover Telit wireless module family supports al so Telit proprietary AT commands for special purposes. In the following is described how to use the AT commands with the Telit wireless module family. 3.1 Definitions The following syntactical definitions apply: , is the command line and result code terminator character, which Carriage return character S3 value, in decimal ASCII between 0 and 255,is specified within parameter . The default value is 13. , is the character recognised as line feed character. Its value, in decimal Linefeed character ASCII between 0 and 255, is specified within parameter S4 . The default value is 10. The line feed character is output after carriage return character if verbose result codes are used ( V1 option used) it will not V0 option used ) otherwise, if numeric format result codes are used ( appear in the result codes. Name enclosed in angle brackets is a syntactical element. They do not appear in the command <...> line. [...] Optional subparameter of a command or an optional part of TA information response is enclosed in square brackets. Brackets themselves do not appear in the command line. When subparameter is not given in AT commands which have a Read command, new value equals to its previous value. In AT commands which do not store the values of any of their subparameters, and so have not a Read command, which are called action type commands, action should be done on the basis of the recommended default setting of the subparameter. 1 The ATTENTION command and is used as a prefix to other parameters in a string. The AT is an AT command combined with other parameters can be set up in the communications package or typed in manually as a command line instruction. page 6 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

7 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.2 AT Command Syntax The syntax rules followed by Telit implementati on of either Hayes AT commands, GSM commands and FAX commands are very similar to those of standard basic and extended AT commands. A #SELINT , see §3.3.1) has been introduced in order to have an AT interface very special command ( close to the standard one. There are two types of extended command: - Parameter type commands . This type of commands may be “set” (to store a value or values for later use), “read” (to determine the current value or values stored), or “tested” (to determine ranges of values supported). Each of them has a test command (trailing =? ) to give information ) to check the about the type of its subparameters; they also have a Read command (trailing ? current values of subparameters. - Action type commands . This type of command may be “executed” or “tested”. • “executed“ to invoke a particular function of the equipment, which generally involves more than the simple storage of a value for later use • “tested” to determine: or #SELINT=0 #SELINT=1 has been issued, see §3.3.1) (if the command if subparameters are associated with the action, the ranges of subparameters values that are supported; if the command has no subparameters, issuing the correspondent Test ) raises the result code “ ERROR ”. =? command (trailing Note: issuing the Read command (trailing ? ) causes the command to be executed. #SELINT=2 has been issued, see §3.3.1) (if the command Action Command (in this case issuing the whether or not the equipment implements the correspondent Test command - trailing =? - returns the OK result code), and, if subparameters are associated with the action, the ranges of subparameters values that are supported. Action commands don’t store the values of any of their possible subparameters. Moreover: • (for #SELINT=0 or #SELINT=1 only) An enhanced test command (trailing =?? ) has been introduced to maintain backward compatibility for those commands whose subparameters changed the range of possible values from version to version. • (for #SELINT=2 only) ) may be changed in the future by Telit to The response to the Test Command (trailing =? allow the description of new values/functionalities #SELINT=2 (for • only) page 7 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

8 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 If all the subparameters of a parameter type command +CMD #CMD or $CMD ) are (or AT+CMD= optional, issuing AT#CMD= or AT$CMD= ) causes the OK (or result code to be returned and the previous values of the omitted subparameters to be retained. 3.2.1 String Type Parameters A string, either enclosed between quotes or not, is considered to be a valid string type parameter input. According to V25.ter space characters are ignored on the command line and may be used freely for formatting purposes, unless they are embedded in numeric or quoted string constants; therefore a string containing a space character has to be enclosed between quotes to be considered a valid string type parameter (e.g. typing AT+COPS=1,0,”A1” AT+COPS=1,0,A1 ; typing is the same as typing is different from typing AT+COPS=1,0,”A BB” ). AT+COPS=1,0,A BB When #SELINT=0 (or 1) mode is selected, a string not enclosed between quotes is changed in upper case (e.g. mickey become MICKEY ), while a string enclosed between quotes is case sensitive. When mode is selected, a string enclosed between quotes is case sensitive. #SELINT=2 A small set of commands requires always to write the input string parameters within quotes: this is explicitly reported in the specific descriptions. 3.2.2 Command Lines . prefix , the body and the termination character A command line is made up of three elements: the at ” or “ AT consists of the characters “ ”, or, to repeat the execution of the The command line prefix previous command line, the characters “ a/ ”. ” or “ A/ termination character may be selected by a user option (parameter S3), the default being . The The basic structures of the command line are: where ATCMD1 AT • is the command line prefix, CMD1 is the body of a basic command (nb: the name of the command never begins with the character “ + ”) and is the command line terminator character where 10 is a subparameter • ATCMD2=10 AT+CMD1;+CMD2=, ,10 These are two examples of extended commands (nb: the name • 2 ). They are delimited with semicolon. In the ” + of the command always begins with the character “ second command the subparameter is omitted. • +CMD1? This is a Read command for checking current subparameter values • +CMD1=? This is a test command for chec king possible subparameter values 2 The set of proprietary AT commands differentiates from the standard one because the ” or “*”. Proprietary AT commands $ name of each of them begins with either “ @ ”, “ # ”, “ follow the same syntax rules as extended commands page 8 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

9 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 These commands might be performed in a single command line as shown below: ATCMD1 CMD2=10+CMD1;+CMD2=, ,10;+CMD1?;+CMD1=? anyway it is always preferable to separate into different command lines the basic commands and the extended commands; furthermore it is suggested to avoid placing several action commands in the same command line, because if one of them fails, then an error message is received but it is not possible to argue which one of them has failed the execution. If command V1 is enabled (verbose responses codes) and all commands in a command line has been performed successfully, result code is sent from the TA to the TE, if OK subparameter values of a command are not accepted by the TA or command itself is invalid, or command cannot be performed for some reason, result code ERROR is sent and no subsequent commands in the command line are processed. If command V0 is enabled (numeric responses codes), and all commands in a command line has been performed successfully, result code 0 is sent from the TA to the TE, if sub-parameter values of a command are not accepted by the TA or command itself is invalid, or command cannot be performed for some reason, result code 4 and no subsequent commands in the command line are processed. ERROR +CME ) response may be replaced by 4 (or In case of errors depending on ME operation, ERROR: or +CMS ERROR: . Note: The command line buffer accepts a maximum of 80 characters. If this number is exceeded none of the commands will be executed and TA returns ERROR . 3.2.2.1 +CME ERROR: - ME Error Result Code This is NOT a command, it is the error response to + Cxxx GSM 07.07 commands. Syntax: AT+CME ERROR: Parameter: - error code can be either numeric or verbose.The possible values of are reported in the table: Verbose Format Numeric Format 0 phone failure 1 No connection to phone 2 phone-adaptor link reserved 3 operation not allowed 4 operation not supported 5 PH-SIM PIN required 10 SIM not inserted 11 SIM PIN required 12 SIM PUK required 13 SIM failure 14 SIM busy SIM wrong 15 16 incorrect password SIM PIN2 required 17 page 9 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

10 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Verbose Format Numeric Format SIM PUK2 required 18 20 memory full invalid index 21 22 not found 23 memory failure text string too long 24 invalid characters in text string 25 dial string too long 26 27 invalid characters in dial string no network service 30 31 network timeout 32 network not allowed - emergency calls only network personalization PIN required 40 41 network personalization PUK required 42 network subset personalization PIN required 43 network subset personalization PUK required 44 service provider personalization PIN required 45 service provider personalization PUK required 46 corporate personalization PIN required corporate personalization PUK required 47 Easy CAMERA® related errors: 50 Camera not found Camera Initialization Error 51 52 Camera not Supported 53 No Photo Taken 54 NET BUSY...Camera TimeOut 55 Camera Error General purpose error: unknown 100 GPRS related errors to a fa ilure to perform an Attach: 103 Illegal MS (#3)* 106 Illegal ME (#6)* 107 GPRS service not allowed (#7)* 111 PLMN not allowed (#11)* 112 Location area not allowed (#12)* 113 Roaming not allowed in this location area (#13)* GPRS related errors to a failure to Activate a Context and others: 132 service option not supported (#32)* requested service option not subscribed (#33)* 133 134 service option temporarily out of order (#34)* 148 unspecified GPRS error 149 PDP authentication failure 150 invalid mobile class Network survey errors: Network survey error (No Carrier)* 257 258 Network survey error (Busy)* 259 Network survey error (Wrong request)* 260 Network survey error (Aborted)* Easy GPRS® related errors: 400 generic undocumented error 401 wrong state 402 wrong mode context already activated 403 404 stack already active page 10 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

11 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Numeric Format Verbose Format 405 activation failed 406 context not opened 407 cannot setup socket 408 cannot resolve DN timeout in opening socket 409 410 cannot open socket 411 remote disconnected or timeout 412 connection failed 413 tx error 414 already listening FTP related errors: 420 ok 421 connect 422 disconnect 423 error 424 wrong state can not activate 425 426 can not resolve name 427 can not allocate control socket 428 can not connect control socket 429 bad or no response from server 430 not connected 431 already connected 432 context down 433 no photo available 434 can not send photo *(values in parentheses are GSM 04.08 cause codes) 3.2.2.2 +CMS ERROR - Message Service Failure Result Code This is NOT a command, it is the error response to +Cxxx GSM 07.05 commands Syntax: AT+CMS ERROR: Parameter: - error code can be either numeric or verbose. The values are reported in the table: Numeric Format Verbose Format 0...127 GSM 04.11 Annex E-2 values 128...255 GSM 03.40 sub clause 9.2.3.22 values 300 ME failure 301 SMS service of ME reserved 302 operation not allowed 303 operation not supported 304 invalid PDU mode parameter 305 invalid text mode parameter 310 SIM not inserted SIM PIN required 311 PH-SIM PIN required 312 313 SIM failure SIM busy 314 page 11 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

12 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 SIM wrong 315 SIM PUK required 316 317 SIM PIN2 required 318 SIM PUK2 required 320 memory failure invalid memory index 321 memory full 322 330 SMSC address unknown 331 no network service 332 network timeout 340 no +CNMA acknowledgement expected 500 unknown error 3.2.3 Information Responses And Result Codes The TA response, in case of verbose response fo rmat enabled, for the previous examples command line could be as shown below: • information response to +CMD1? +CMD1:2,1,10 +CMD1=? +CMD1(0-2),(0,1),(0-15) information response to • OK final result code • Moreover there are other two types of result codes: • result code s that inform about progress of TA operation (e.g. connection establishment CONNECT ) s that indicate occurrence of an event not directly associated with issuance of a • result code command from TE (e.g. ring indication RING ). Here the basic result codes according to ITU-T V25Ter recommendation Result Codes Numeric form Verbose form 0 OK 1 CONNECT 2 RING 3 NO CARRIER ERROR 4 6 NO DIALTONE BUSY 7 8 NO ANSWER page 12 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

13 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.2.4 Command Response Time-Out Every command issued to the Telit modules return s a result response if response codes are enabled (default). The time needed to process the given command and return the response varies from command to command and may depend also from the network on which the command may interact. As a result every command is provided with a proper timeout time, if this time elapses without any response can be reported as if the operation was not result from the operation, then an ERROR successful and the operation is anyway terminated. The timeout time is quite short for commands that imply only internal set up commands, but may be very long for command that interact with the network (or even a set of Networks). The default timeout is 100 ms for all the commands that have no interaction with the network or upper software layers. 100 ms and their In the table below are listed all the commands whose timeout differs from the default effective timeout is reported: Command Time-Out (Seconds) +CBST 0.2 +CR 0.2 0.2 +CRC 0.2 +CRLP +CSCS 0.2 5 +CEER 5 +CGMI +CGMM 5 +CGMR 5 +CGSN 20 20 +CIMI +CNUM 20 +CREG 5 +COPS 180 +CLCK 180 180 @CLCK +CPWD 180 +CLIP 180 +CLIR 180 +CCFC 180 +CCWA 20 +CHLD 20 +CUSD 180 +CAOC 20 +CSSN 20 +CLCC 20 +CPAS 5 20 +CPIN 5 +CSQ +CPBS 5 page 13 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

14 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Command Time-Out (Seconds) +CPBR 20 +CPBF 20 +CPBW 20 +CALM 5 5 +CRSL +CLVL 5 +CMUT 5 +CACM 20 +CAMM 20 20 +CPUC +CMEE 5 +VTS 20 +GMI 5 +GMM 5 +GMR 5 +GSN 20 5 I3 I4 5 5 I5 5 +CSMS +CPMS 5 +CMGF 5 +CSCA 20 5 +CSMP +CSDH 5 +CSAS 5 +CRES 5 +CNMI 5 +CMGS 180 / 5 for prompt”>” +CMSS 180 +CMGW 5 / 5 for prompt”>” +CMGD 5 +CMGR 5 +CMGL 5 #CAP 10 #SRS 10 #SRP 10 #STM 10 #PCT 10 #SHDN 10 #QTEMP 10 #SGPO 10 10 #GGPI 10 #MONI #CGMI 5 page 14 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

15 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Command Time-Out (Seconds) #CGMM 5 #CGMR 5 20 #CGSN #CIMI 5 180 +CGACT 180 +CGATT +CGDATA 20 +CGDCONT 20 +CGPADDR 20 +CGQMIN 20 +CGQREQ 20 3.2.5 Command Issuing Timing The chain Command -> Response shall always be respected and a new command must not be issued before the module has terminated all the sending of its response result code (whatever it may be). text and therefore may send the next This applies especially to applications that “sense” the OK is sent by the module. OK command before the complete code It is advisable anyway to wait for at least 20ms between the end of the reception of the response and the issue of the next AT command. If the response codes are disabled and therefore the module does not report any response to the command, then at least the 20ms pause time shall be respected. During command mode, due to hardware limitations, under severe CPU load the serial port can loose some characters if placed in autobauding at high speeds. Therefore if you encounter this problem fix +IPR command. the baud rate with 3.2.6 Factory Profile And User Profiles The Telit wireless modules stores the values set by several commands as profiles in the internal non volatile memory (NVM), allowing to remember this setting even after power off. There are two user customizable profiles and one factory profile in the NVM of the device: by default the device will start with user profile 0 equal to factory profile. base section For backward compatibility each profile is divided into two sections, one which was extended section historically the one that was saved and restored in early releases of code, and the which includes all the remaining values. The command is used to save the actual values of both sections of profiles into the NVM user &W profile. Commands &Y and &P are both used to set the profile to be loaded at start-up. &Y instructs the device to load at start-up only the base section . &P instructs the device to load at start-up the full base + extended sections profile: . command resets to factory profile values only the command of the base section of profile, &F The resets to factory profile values the full set of base + extended section commands. &F1 while the page 15 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

16 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 The values set by some other particular commands are stored in NVM outside the profile, either #ESAV ; they have &W / &Y / &P / &F issues, or through custom commands #SKTSAV and without any only one saved value, always restored at start-up. The values set by following commands are stored in the profile base section: GSM DATA MODE: +CBST AUTOBAUD: +IPR COMMAND ECHO: E RESULT MESSAGES: Q VERBOSE MESSAGES: V EXTENDED MESSAGES: X FLOW CONTROL OPTIONS: &K, +IFC CTS (C106) OPTIONS: &B &S DSR (C107) OPTIONS: &D DTR (C108) OPTIONS: &C DCD (C109) OPTIONS: RI (C125) OPTIONS: \R +CFUN POWER SAVING: DEFAULT PROFILE: &Y0 S REGISTERS: S0;S1;S2;S3;S4;S5;S7;S12;S25;S30;S38 +ICF CHARACTER FORMAT: The values set by following commands are stored in the profile extended section: +CRC, +FCLASS, +DR, +ILRR, +CR, +CSNS, +CRLP, +CNMI, +CMEE, +CSMP, +CSDH, +CSCB, +CSSN, +CUSD, +CALM, +CRSL, +CMUT, +CAOC, +CREG, +CLIP, +CLIR, +CMGF, +CCWA, +CLVL, #QSS, #ACAL, #SMOV, #CAP, #HFMICG, #HSMICG, #CODEC #SHFEC, #SRS, #STM, #SHFSD, #SRP #I2S1 #NITZ, #SKIPESC The values set by following commands are always stored in NVM, independently from the profile (unique values): #SELINT, +COPS, +CGCLASS, +CGDCONT, +CGQMIN, +CGQREQ, #BND, #COPSMODE, #DIALMODE The values set by following commands are stored in NVM on demand, independently from the profile: #USERID, #PASSW, #PKTSZ, #DSTO, #SKTTO, #SKTSET #SKTCT saved with #SKTSAV command and reset with #SKTRST command. #ESMTP, #EADDR, #EUSER, #EPASSW saved with #ESAV command and reset with #ERST command. page 16 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

17 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.2.7 AT Command Availability Table The following table show the AT command set and the applicability/backward compatibility matrix on the Telit wireless module family. GC864- GE864- SEL SEL SEL GM862- QUAD PY GE863- GE863- GM862- & & QUAD- GE863- GM862- 1 0 2 COMMAND Function QUAD-PY QUAD QUAD GPS GPS GC864- GE864- PY Page Page Page PY QUAD Backward Compatibility #SELINT 25 25 25 Select Interface Style • • • • • • • • Repeating A Command Line A/ Last Command Automatic Repetition 26 26 26 • • • • • • • • Hayes AT Commands - Generic Modem Control &F Set To Factory-Defined Configuration 27 228 427 • • • • • • • • Z Soft Reset 27 228 427 • • • • • • • • Select Active Service Class 28 229 428 +FCLASS • • • • • • • • &Y Designate A Default Reset Basic Profile 28 229 428 • • • • • • • • &P Designate A Default Reset Full Profile 29 229 428 • • • • • • • • &W Store Current Configuration 29 230 429 • • • • • • • • Store Telephone Number In The Module &Z 429 29 230 • • • • • • • • Internal Phonebook &N 430 231 30 Display Internal Phonebook Stored Numbers • • • • • • • • Manufacturer Identification 30 231 430 +GMI • • • • • • • • 430 231 +GMM 30 Model Identification • • • • • • • • +GMR Revision Identification 30 231 430 • • • • • • • • +GCAP 430 231 31 Capabilities List • • • • • • • • +GSN Serial Number 31 232 431 • • • • • • • • Display Current Configuration & Profile 31 232 431 &V • • • • • • • • &V0 Display Current Configuration & Profile 31 232 431 • • • • • • • • &V1 Display S Registers Values 32 232 431 • • • • • • • • 432 233 32 Display S Registers Values &V3 • • • • • • • • Display Last Connection Statistics &V2 432 233 32 • • • • • • • • Single Line Connect Message 32 233 432 \V • • • • • • • • +GCI 432 233 33 Country Of Installation • • • • • • • • 433 234 %L 33 Line Signal Level • • • • • • • • Line Quality 33 234 433 %Q • • • • • • • • L Speaker Loudness 33 234 433 • • • • • • • • M Speaker Mode 33 234 433 • • • • • • • • Hayes AT Commands - DTE-Modem Interface Control E Command Echo 34 235 434 • • • • • • • • Q Quiet Result Codes 34 235 434 • • • • • • • • Response Format 35 236 435 V • • • • • • • • X Extended Result Codes 35 236 435 • • • • • • • • I Identification Information 36 237 436 • • • • • • • • Data Carrier Detect (DCD) Control 36 237 436 &C • • • • • • • • &D Data Terminal Ready (DTR) Control 37 238 437 • • • • • • • • \Q Standard Flow Control 37 238 437 • • • • • • • • &K Flow Control 37 239 438 • • • • • • • • &S 438 239 38 Data Set Ready (DSR) Control • • • • • • • • \R Ring (RI) Control 39 240 438 • • • • • • • • +IPR Fixed DTE Interface Rate 39 240 439 • • • • • • • • +IFC DTE-Modem Local Flow Control 40 241 440 • • • • • • • • 442 241 40 DTE-Modem Local Rate Reporting +ILRR • • • • • • • • 40 DTE-Modem Character Framing +ICF 444 242 • • • • • • • • Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 17 of 614

18 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 GE864- GC864- SEL SEL SEL QUAD GM862- PY GE863- GM862- GE863- GM862- QUAD- & GE863- & 2 COMMAND 0 Function 1 QUAD QUAD QUAD-PY GE864- GC864- GPS GPS PY Page Page Page PY QUAD Hayes AT Commands - Call Control D Dial 42 243 444 • • • • • • • • T Tone Dial 44 245 444 • • • • • • • • P 444 245 44 Pulse Dial • • • • • • • • A Answer 44 245 445 • • • • • • • • Disconnect 45 246 445 H • • • • • • • • O Return To On Line Mode 45 246 445 • • • • • • • • &G Guard Tone 45 246 442 • • • • • • • • &Q Sync/Async Mode 45 246 444 • • • • • • • • Hayes AT Commands - Modulation Control 247 46 446 +MS Modulation Selection • • • • • • • • Line Quality Monitor And Auto Retrain Or 446 247 46 %E • • • • • • • • Fallback/Fallforward Hayes AT Commands - Compression Control +DS Data Compression 47 248 447 • • • • • • • • +DR Data Compression Reporting 47 248 447 • • • • • • • • Hayes AT Commands - Break Control Transmit Break To Remote 48 249 448 \B • • • • • • • • \K 448 249 48 Break Handling • • • • • • • • 448 249 48 Operating Mode \N • • • • • • • • Hayes AT Commands - S Parameters 250 449 49 Number Of Rings To Auto Answer S0 • • • • • • • • S1 251 50 Ring Counter 449 • • • • • • • • Escape Character 450 S2 251 50 • • • • • • • • 450 S3 251 50 Command Line Termination Character • • • • • • • • 450 252 51 Response Formatting Character S4 • • • • • • • • 252 451 Command Line Editing Character S5 51 • • • • • • • • S7 Connection Completion Time-Out 52 253 451 • • • • • • • • Escape Prompt Delay 52 253 452 S12 • • • • • • • • S25 Delay To DTR Off 52 253 452 • • • • • • • • Disconnect Inactivity Timer 53 254 452 S30 • • • • • • • • Delay Before Forced Hang Up 53 254 453 S38 • • • • • • • • ETSI GSM 07.07 - General +CGMI Request Manufacturer Identification 55 255 454 • • • • • • • • +CGMM Request Model Identification 55 255 454 • • • • • • • • +CGMR Request Revision Identification 55 255 454 • • • • • • • • +CGSN 454 255 55 Request Product Serial Number Identification • • • • • • • • +CSCS Select TE Character Set 56 256 455 • • • • • • • • Request International Mobile Subscriber +CIMI 56 256 455 • • • • • • • • Identity (IMSI) 3 +CMUX 455 NA NA Multiplexing Mode • • • • • • • • ETSI GSM 07.07 - Call Control 457 +CHUP Hang Up Call 57 257 • • • • • • • • 257 457 +CBST 57 Select Bearer Service Type • • • • • • • • 458 +CRLP 258 58 Radio Link Protocol • • • • • • • • 458 259 59 Service Reporting Control +CR • • • • • • • • 459 Extended Error Report 59 +CEER 259 • • • • • • • • +CRC Cellular Result Codes 60 260 460 • • • • • • • • +CSNS Single Numbering Scheme 61 261 460 • • • • • • • • +CVHU Voice Hang Up Control 61 261 461 • • • • • • • • ETSI GSM 07.07 - Network Service Handling +CNUM 262 62 Subscriber Number 462 • • • • • • • • 462 Read Operator Names 262 62 +COPN • • • • • • • • 3 NA: Not Available page 18 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

19 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 GE864- GC864- SEL SEL SEL GM862- QUAD PY GM862- GE863- GE863- QUAD- GM862- GE863- & & Function 0 COMMAND 1 2 QUAD QUAD QUAD-PY GPS GC864- GPS GE864- PY Page Page Page PY QUAD +CREG Network Registration Report 62 262 462 • • • • • • • • Operator Selection 64 264 464 +COPS • • • • • • • • +CLCK Facility Lock/ Unlock 66 266 465 • • • • • • • • NA @CLCK Facility Lock/ Unlock 68 268 • • • • • • • • Change Facility Password 69 269 466 +CPWD • • • • • • • • +CLIP Calling Line Identification Presentation 70 270 467 • • • • • • • • Calling Line Identification Restriction 71 271 468 +CLIR • • • • • • • • +CCFC Call Forwarding Number And Conditions 72 272 469 • • • • • • • • +CCWA Call Waiting 73 273 470 • • • • • • • • Call Holding Services 75 275 472 +CHLD • • • • • • • • +CUSD Unstructured Supplementary Service Data 76 276 472 • • • • • • • • Advice Of Charge 77 277 474 +CAOC • • • • • • • • +CLCC List Current Calls 78 278 474 • • • • • • • • +CSSN SS Notification 79 279 475 • • • • • • • • upplementary Service Closed User Group S 280 80 +CCUG 476 • • • • • • • • Control ETSI GSM 07.07 - Mobile Equipment Control +CPAS Phone Activity Status 82 282 478 • • • • • • • • +CFUN 478 282 82 Set Phone Functionality • • • • • • • • 283 83 Enter PIN +CPIN 479 • • • • • • • • Signal Quality 86 286 482 +CSQ • • • • • • • • Indicator Control 87 287 483 +CIND • • • • • • • • 89 289 485 Mobile Equipment Event Reporting +CMER • • • • • • • • Select Phonebook Memory Storage 90 290 486 +CPBS • • • • • • • • Read Phonebook Entries 91 291 486 +CPBR • • • • • • • • Find Phonebook Entries 92 292 487 +CPBF • • • • • • • • 488 292 92 +CPBW Write Phonebook Entry • • • • • • • • +CCLK Clock Management 93 293 489 • • • • • • • • Alarm Management 94 294 489 +CALA • • • • • • • • Restricted SIM Access 96 296 491 +CRSM • • • • • • • • +CALM Alert Sound Mode 97 297 492 • • • • • • • • Ringer Sound Level 98 298 492 +CRSL • • • • • • • • Loudspeaker Volume Level 98 298 493 +CLVL • • • • • • • • Microphone Mute Control 99 299 493 +CMUT • • • • • • • • 494 +CACM Accumulated Call Meter 99 299 • • • • • • • • +CAMM Accumulated Call Meter Maximum 100 300 494 • • • • • • • • +CPUC Price Per Unit And Currency Table 100 300 495 • • • • • • • • Available AT commands NA NA 495 +CLAC • • • • • • • • Read ICCID (Integrated Circuit Card +CCID NA 101 301 • • • • • • • • Identification) ETSI GSM 07.07 - Mobile Equipment Errors 496 +CMEE 302 102 Report Mobile Equipment Error • • • • • • • • ETSI GSM 07.07 - Voice Control +VTS 497 303 103 DTMF Tones Transmission • • • • • • • • +VTD 497 303 103 Tone Duration • • • • • • • • ETSI GSM 07.07 - Commands For GPRS +CGCLASS GPRS Mobile Station Class 105 304 503 • • • • • • • • +CGATT GPRS Attach Or Detach 105 304 498 • • • • • • • • GPRS Network Registration Status 106 305 504 +CGREG • • • • • • • • +CGDCONT Define PDP Context 107 306 500 • • • • • • • • Quality Of Service Profile (Minimum +CGQMIN 107 307 504 • • • • • • • • Acceptable) +CGQREQ Quality Of Service Profile (Requested) 109 308 498 • • • • • • • • +CGACT 498 309 110 PDP Context Activate Or Deactivate • • • • • • • • 111 Show PDP Address +CGPADDR 501 310 • • • • • • • • Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 19 of 614

20 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 GC864- GE864- SEL SEL SEL QUAD GM862- PY GM862- GE863- GE863- & GM862- GE863- & QUAD- 2 1 Function 0 COMMAND QUAD QUAD QUAD-PY GE864- GPS GPS PY GC864- Page Page Page QUAD PY +CGDATA Enter Data State 111 311 502 • • • • • • • • ETSI GSM 07.07 - Commands For Battery Charger 506 +CBC Battery Charge 114 312 • • • • • • • • ETSI GSM 07.05 - General Configuration +CSMS 507 314 116 Select Message Service • • • • • • • • Preferred Message Storage 508 315 117 +CPMS • • • • • • • • +CMGF Message Format 118 316 509 • • • • • • • • ETSI GSM 07.05 - Message Configuration +CSCA Service Center Address 119 317 510 • • • • • • • • +CSMP Set Text Mode Parameters 119 318 510 • • • • • • • • 511 318 120 Show Text Mode Parameters +CSDH • • • • • • • • 319 121 Select Cell Broadcast Message Types +CSCB 511 • • • • • • • • +CSAS Save Settings 122 320 512 • • • • • • • • +CRES Restore Settings 122 320 513 • • • • • • • • ETSI GSM 07.05 - Message Receiving And Reading New Message Indications To Terminal 322 +CNMI 514 123 • • • • • • • • Equipment 517 +CMGL 325 126 List Messages • • • • • • • • NA @CMGL List Messages 128 327 • • • • • • • • Read Message 519 +CMGR 328 130 • • • • • • • • NA @CMGR Read Message 131 330 • • • • • • • • ETSI GSM 07.05 - Message Sending And Writing 522 +CMGS 332 134 Send Message • • • • • • • • +CMSS 523 Send Message From Storage 135 333 • • • • • • • • +CMGW Write Message To Memory 136 334 524 • • • • • • • • +CMGD Delete Message 137 335 526 • • • • • • • • FAX AT Commands - General Configuration 337 527 Manufacturer ID +FMI 139 • • • • • • • • +FMM Model ID 139 337 527 • • • • • • • • Revision ID 139 337 527 +FMR • • • • • • • • FAX AT Commands - Transmission/Reception Control +FTS Stop Transmission And Pause 140 338 528 • • • • • • • • Wait For Receive Silence 140 338 528 +FRS • • • • • • • • Transmit Data Modulation 140 338 528 +FTM • • • • • • • • +FRM Receive Data Modulation 141 339 529 • • • • • • • • +FTH Transmit Data With HDLC Framing 141 339 529 • • • • • • • • Receive Data With HDLC Framing 141 339 529 +FRH • • • • • • • • FAX AT Commands - Serial Port Control +FLO 530 340 142 Select Flow Control Specified By Type • • • • • • • • +FPR Select Serial Port Rate 142 340 530 • • • • • • • • Double Escape Character Replacement 142 +FDD 530 340 • • • • • • • • Control Custom AT Commands - General Configuration Manufacturer Identification 143 341 532 #CGMI • • • • • • • • #CGMM 532 341 143 Model Identification • • • • • • • • #CGMR 532 341 143 Revision Identification • • • • • • • • #CGSN Product Serial Number Identification 143 341 532 • • • • • • • • International Mobile Subscriber Identity 532 341 143 #CIMI • • • • • • • • (IMSI) Read ICCID (Integrated Circuit Card #CCID NA NA 533 • • • • • • • • Identification) #CAP Change Audio Path 144 342 533 • • • • • • • • #SRS Select Ringer Sound 144 342 533 • • • • • • • • #SRP Select Ringer Path 145 343 534 • • • • • • • • 535 344 146 Signaling Tones Mode #STM • • • • • • • • 146 Display PIN Counter 535 #PCT 345 • • • • • • • • page 20 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

21 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 GC864- GE864- SEL SEL SEL PY QUAD GM862- GM862- GE863- GE863- GM862- & & GE863- QUAD- COMMAND Function 0 1 2 QUAD QUAD-PY QUAD PY GPS GC864- GPS GE864- Page Page Page PY QUAD #SHDN Software Shut Down 147 345 536 • • • • • • • • #WAKE 536 Wake From Alarm Mode 147 345 • • • • • • • • #QTEMP Query Temperature Overflow 148 346 537 • • • • • • • • #SGPO NA 347 148 Set General Purpose Output • • • • • • • • 149 #GGPI 347 NA General Purpose Input • • • • • • • • #GPIO General Purpose Input/Output Pin Control 150 348 537 • • • • • • • • #I2S1 539 Set PCM Output For Channel 1 151 350 • • 539 #E2SMSRI SMS Ring Indicator 152 350 • • • • • • • • 540 #ADC 351 Analog/Digital Converter Input 153 • • • • • • • • #DAC Digital/Analog Converter Control 153 352 541 • • • • • 541 #VAUX Auxiliary Voltage Pin Output 154 353 • • • • • #CBC 542 353 155 Battery and Charger Status • • • • • • • • 354 155 #AUTOATT 543 Auto-Attach Property • • • • • • • • #MSCLASS 543 354 156 Multislot Class Control • • • • • • • • 543 355 #MONI 157 Cell Monitor • • • • • • • • #SERVINFO 545 357 158 Serving Call Information • • • • • • • • #COPSMODE +COPS Mode 159 358 NA • • • • • • • • #QSS Query SIM Status 160 358 546 • • • • • • • • #DIALMODE 546 359 161 ATD Dialing Mode • • • • • • • • 547 360 161 #ACAL Automatic Call • • • • • • • • #ECAM 548 Extended Call Monitoring 162 360 • • • • • • • • 361 #SMOV 549 SMS Overflow 163 • • • • • • • • 549 #CODEC Audio Codec 163 362 • • • • • • • • 363 164 #SHFEC 550 Handsfree Echo Canceller • • • • • • • • #HFMICG Handsfree Microphone Gain 165 363 550 • • • • • • • • #HSMICG 551 Handset Microphone Gain 165 364 • • • • • • • • #SHFSD 551 364 166 Set Headset Sidetone • • • • • • • • 166 365 551 #/ Repeat Last Command • • • • • • • • #NITZ Network Timezone 166 365 552 • • • • • • • • Select Band 167 366 552 #BND • • • • • • • • Automatic Band Selection 168 366 553 #AUTOBND • • • • • • • • Skip Escape Sequence 168 367 553 #SKIPESC • • • • • • • • Escape Sequence Guard Time 169 368 554 #E2ESC • • • • • • • • PPP-GPRS Connection Authentication Type 170 368 554 #GAUTH • • • • • • • • #RTCSTAT RTC Status 170 369 555 • • • • • • • • Custom AT Commands - FTP #FTPTO FTP Time-Out 171 370 556 • • • • • • • • FTP Open 171 370 556 #FTPOPEN • • • • • • • • #FTPCLOSE FTP Close 171 370 556 • • • • • • • • #FTPPUT 557 371 172 FTP Put • • • • • • • • 557 371 #FTPPUTPH 172 FTP Put Photo • • • • • • • • #FTPGET FTP Get 173 372 558 • • • • • • • • #FTPTYPE FTP Type 173 372 558 • • • • • • • • FTP Read Message 174 373 559 #FTPMSG • • • • • • • • #FTPDELE FTP Delete 174 373 559 • • • • • • • • #FTPPWD FTP Print Working Directory 174 373 559 • • • • • • • • #FTPCWD FTP Change Working Directory 174 373 559 • • • • • • • • #FTPLIST FTP List 175 374 560 • • • • • • • • Custom AT Commands - Enhanced Easy GPRS ® Extension Authentication User ID 176 375 561 #USERID • • • • • • • • #PASSW Authentication Password 176 375 561 • • • • • • • • #PKTSZ Packet Size 177 376 562 • • • • • • • • #DSTO Data Sending Time-Out 177 376 562 • • • • • • • • 563 377 178 Socket Inactivity Time-Out #SKTTO • • • • • • • • 563 378 179 #SKTSET Socket Definition • • • • • • • • page 21 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

22 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 GE864- GC864- SEL SEL SEL QUAD PY GM862- GE863- GE863- GM862- & GE863- QUAD- GM862- & Function COMMAND 1 0 2 QUAD-PY QUAD QUAD GE864- PY GPS GC864- GPS Page Page Page PY QUAD #SKTOP 564 Socket Open 180 379 • • • • • • • • 565 #QDNS Query DNS 180 379 • • • • • • • • 181 #SKTCT 380 565 Socket TCP Connection Time-Out • • • • • • • • 566 #SKTSAV 380 181 Socket Parameters Save • • • • • • • • #SKTRST 381 566 182 Socket Parameters Reset • • • • • • • • #GPRS 567 381 182 GPRS Context Activation • • • • • • • • 382 #SKTD 568 Socket Dial 183 • • • • • • • • 384 185 #SKTL 569 Socket Listen • • • • • • • • NA @SKTL Socket Listen 187 386 • • • • • • • • #E2SLRI 571 Socket Listen Ring Indicator 189 388 • • • • • • • • 571 #FRWL 388 Firewall Setup 189 • • • • • • • • ® Management Custom AT Commands - Easy Camera NA 390 #CAMON Camera ON 191 • • • • • • • • NA 390 #CAMOFF 191 Camera OFF • • • • • • • • #CAMEN Camera ON/OFF 191 390 573 • • • • • • • • 573 391 192 Camera Model #SELCAM • • • • • • • • #CAMRES 574 391 192 Camera Resolution • • • • • • • • #CAMCOL 392 574 193 Camera Colour Mode • • • • • • • • 392 193 574 #CAMQUA Camera Photo Quality • • • • • • • • #CMODE Camera Exposure 194 393 575 • • • • • • • • Camera Zoom 194 393 575 #CAMZOOM • • • • • • • • Camera Time/Date Overprint 195 394 575 #CAMTXT • • • • • • • • #TPHOTO Camera Take Photo 195 394 576 • • • • • • • • #RPHOTO 576 395 196 Camera Read Photo • • • • • • • • 576 395 #OBJL 196 Object List • • • • • • • • #OBJR 577 Object Read 197 396 • • • • • • • • Custom AT Commands - E-Mail Management E-mail SMTP Server 198 397 578 #ESMTP • • • • • • • • #EADDR 578 397 198 E-mail Sender Address • • • • • • • • #EUSER 579 398 199 E-mail Authentication User Name • • • • • • • • #EPASSW E-mail Authentication Password 200 399 579 • • • • • • • • E-mail Sending With GPRS Context #SEMAIL 580 200 399 • • • • • • • • Activation 581 400 201 E-mail GPRS Context Activation #EMAILACT • • • • • • • • E-mail Sending 582 #EMAILD 401 202 • • • • • • • • #ESAV Email Parameters Save 203 402 583 • • • • • • • • #ERST E-mail Parameters Reset 203 402 583 • • • • • • • • SMTP Read Message 203 402 583 #EMAILMSG • • • • • • • • ® Custom AT Commands - Easy Scan Extension #CSURV 584 403 204 Network Survey • • • • • • • • #CSURVC Network Survey (Numeric Format) 206 405 587 • • • • • • • • #CSURVU Network Survey Of User Defined Channels 209 408 590 • • • • • • • • Network Survey Of User Defined Channels #CSURVUC 591 210 409 • • • • • • • • (Numeric Format) BCCH Network Survey 211 410 591 #CSURVB • • • • • • • • #CSURVBC BCCH Network Survey (Numeric Format) 211 410 592 • • • • • • • • #CSURVF Network Survey Format 212 411 592 • • • • • • • • Removing On Easy Scan® 593 411 212 #CSURVNLF • • • • • • • • Commands Family 593 #CSURVEXT Extended Network Survey 213 412 • • • • • • • • Jammed Detect & Report AT commands 594 #JDR Jammed Detect & Report 214 413 • • • • • • • • 4 Extension - Python Interpreter Custom AT Commands - Easy Script ® 4 Python is a registered trademark of the Python Software Foundation. page 22 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

23 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 GC864- GE864- SEL SEL SEL GM862- QUAD PY GM862- GE863- GE863- GM862- QUAD- GE863- & & Function 0 2 COMMAND 1 QUAD QUAD-PY QUAD GPS GE864- GC864- PY GPS Page Page Page QUAD PY #WSCRIPT Write Script 216 415 596 • • • • • 217 597 416 Select Active Script #ESCRIPT • • • • • Read Script 218 417 597 #RSCRIPT • • • • • #LSCRIPT List Script Names 218 417 598 • • • • • #DSCRIPT 599 418 219 Delete Script • • • • • #REBOOT 599 418 219 Reboot • • • • • 599 NA NA CMUX Script Enable #CMUXSCR • • • • • Custom AT Commands - GPS Application $GPSP GPS Controller power management 220 419 601 • • 601 419 220 GPS Reset $GPSR • • 602 420 221 GPS Device Type Set $GPSD • • 420 221 GPS Software Version $GPSSW 602 • • 420 221 GPS Antenna Type Definition 602 $GPSAT • • 222 421 GPS Antenna Supply Voltage Readout 603 $GPSAV • • $GPSAI 603 421 GPS Antenna Current Readout 222 • • 604 422 223 GPS Antenna Protection $GPSAP • • 605 422 224 Unsolicited GPS NMEA Data Configuration $GPSNMUN • • 225 $GPSACP 424 606 GPS Actual Position Information • • $GPSSAV Save GPS Parameters Configuration 226 425 607 • • 608 426 227 Restore Default GPS Parameters $GPSRST • • Custom AT Commands - SAP #RSEN NA NA Remote SIM Enable 609 • • • • • • • • Remote SIM Message (Unsolicited) 609 NA #RSM: NA • • • • • • • • NA 610 NA Remote SIM Message Command #RSM • • • • • • • • Remote SIM Status Command #RSS NA 611 NA • • • • • • • • written authorization - All Right reserved page 23 of 614 Reproduction forbidden without Telit Communications S.p.A.

24 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.3 Backward Compatibility There are some slight modifications amongst the AT interfaces of Telit products. In order to keep backward compatibility and on the same time to give the opportunity to the customer to get competitor compatibility, Telit modules offer the specific command #SELINT to switch the behavior of the device and its AT command interface. It is up to the user to select the AT interface he prefers. The following table shows which AT commands interface can be applied and is default for the specific product: Product #SELINT=1 #SELINT=2 #SELINT=0 GM862-QUAD • (default) • (3990250655) GM862-QUAD-PY • • (default) (3990250656) GE863-QUAD • • (default) (3990250653&) GE863-PY • • (default) (3990250654) GM862-QUAD • (default) • • (3990250659) GM862-QUAD-PY (default) • • • (3990250658) GM862-GPS • • • (default) (3990250657) GE863-QUAD • • (default) • (3990250662) GE863-PY • • (default) • (3990250661) GE863-GPS • (default) • • (3990250660) GE864-QUAD • • • (default) (3990250648) GE864-PY • (default) • • (3990250650) GC864-QUAD • (default) • • (3990250675) GC864-PY (default) • • • (3990250676) written authorization - All Right reserved page 24 of 614 Reproduction forbidden without Telit Communications S.p.A.

25 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.3.1 #SELINT - Select Interface Style #SELINT - Select Interface Style Set command sets the AT command interface style depending on AT#SELINT[=] parameter . Parameter: - AT command interface 0 - switches the AT command interface of the products, to the GM862- GSM and GM862-GPRS interface style 1 - switches the AT command interface of the products, to the GM862- PCS, PYTHON, QUAD-PY, TRIZIUM and GE863-QUAD, PY interface style 2 - switches the AT command interface style of the product, to the new 5 products like GE864, GC864 and the GPS products Note: If parameter is omitted then the behavior of Set command is the same as read command Read command reports the current interface style. AT#SELINT? Test command reports the available range of values for parameter . AT#SELINT=? setting. Note It’s suggested to reboot the module after every #SELINT 5 Under the #SELINT=2, all the new functionalities like CMUX, SAP are available. Moreover, all the AT commands have been improved according to the ETSI specifications. page 25 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

26 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.4 Repeating A Command Line 3.4.1 Last Command Automatic Repetition A/ - Last Command Automatic Repetition If the prefix “A/” or “a/” is issued, the MODULE immediately execute once A/ again the body of the preceding command line. No editing is possible and no termination character is necessary. A command line may be repeated multiple times through this mechanism, if desired. If “A/” is issued before any command line has been executed, the preceding command line is assumed to have been empty (that results in an OK result code). This command works only at fixed IPR. Note: issuing the custom command AT#/ causes the last command to be executed again too; moreover it doesn’t need a fixed IPR. Reference V25ter Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 26 of 614

27 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5 SELINT 0 3.5.1 Hayes Compliant AT Commands 3.5.1.1 Generic Modem Control 3.5.1.1.1 &F - Set To Fact ory-Defined Configuration &F - Set To Factory-Defined Configuration Execution command sets the configuration parameters to default values AT&F[] specified by manufacturer; it takes in consideration hardware configuration switches and other manufacturer-defined criteria. Parameter: : 0 - just the factory profile base section parameters are considered. 1 - either the factory profile base section and the extended section are considered (full factory profile). is omitted, the command has the same behavior Note: if parameter as AT&F0 Reference V25ter. 3.5.1.1.2 Z - Soft Reset Z - Soft Reset Execution command loads the base section of the specified user profile and ATZ[] the extended section of the default factory profile. Parameter: 0..1 - user profile number Note: any call in progress will be terminated. Note: if parameter is omitted, the command has the same behaviour as ATZ0 . Reference V25ter. page 27 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

28 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.1.3 +FCLASS - Select Active Service Class +FCLASS - Select Active Service Class Set command sets the wireless module in specified connection mode (data, AT+FCLASS= fax, voice), hence all the calls done afterwards will be data or voice. Parameter: 0 - data 1 - fax class 1 8 - voice Read command returns the current configuration value of the parameter AT+FCLASS? . . Test command returns all supported values of the parameters AT+FCLASS=? Reference GSM 07.07 3.5.1.1.4 &Y - Designate A Default Reset Basic Profile &Y - Designate A Default Reset Basic Profile Execution command defines the basic profiles which will be loaded on AT&Y[] startup. Parameter: 0..1 - profile (default is 0): the wireless module is able to store 2 complete ). configurations (see command &W , which loads just once the desired Z Note: differently from command &Y will be loaded on every profile, the one chosen through command startup. Note: if parameter is omitted, the command has the same behaviour as AT&Y0 page 28 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

29 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Default Reset Full Profile 3.5.1.1.5 &P - Designate A &P - Designate A Default Reset Full Profile Execution command defines which full profile will be loaded on startup. AT&P[] Parameter: 0..1 – profile number: the wireless module is able to store 2 full configurations (see command ). &W Note: differently from command Z , which loads just once the desired will be loaded on every &P profile, the one chosen through command startup. Note: if parameter is omitted, the command has the same behaviour as AT&P0 Reference Telit Specifications 3.5.1.1.6 &W - Store Current Configuration &W - Store Current Configuration Execution command stores on profile the complete configuration of the AT&W[] device. Parameter: 0..1 - profile Note: if parameter is omitted, the command has the same behaviour of . AT&W0 3.5.1.1.7 &Z - Store Telephone Number In The Module Internal Phonebook &Z - Store Telephone Number In The Wireless Module Internal Phonebook Execution command stores in the record . the telephone number AT&Z= The records cannot be overwritten, they must be cleared before rewriting. Parameters: - phonebook record - telephone number (string type) Note: the wireless module has a built in non volatile memory in which 10 telephone numbers of a maximum 24 digits can be stored page 29 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

30 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 &Z - Store Telephone Number In The Wireless Module Internal Phonebook AT&Z= Note: to delete the record must be the command issued. Note: the records in the module memory can be viewed with the command , while the telephone number stored in the record n can be dialed by AT&N giving the command ATDS= . Phonebook Stored Numbers 3.5.1.1.8 &N - Display Internal &N - Display Internal Phonebook Stored Numbers Execution command returns the telephone number stored at the AT&N[] position in the internal memory. Parameter: - phonebook record number Note: if parameter is omitted then all the internal records are shown. 3.5.1.1.9 +GMI - Manufacturer Identification +GMI - Manufacturer Identification Execution command returns the manufacturer identification. AT+GMI Note: this is one of the commands whose output differs depending on the last #SELINT setting. Reference V.25ter 3.5.1.1.10 +GMM - Model Identification +GMM - Model Identification Execution command returns the model identification. AT+GMM Reference V.25ter +GMR - Revision Identification 3.5.1.1.11 +GMR - Revision Identification Execution command returns the software revision identification. AT+GMR Reference V.25ter page 30 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

31 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.1.12 +GCAP - Capabilities List +GCAP - Capabilities List Execution command returns the equipment supported command set list. AT+GCAP Where: +CGSM : GSM ETSI command set +FCLASS : Fax command set +DS : Data Service common modem command set : Mobile Specific command set +MS Reference V.25ter 3.5.1.1.13 +GSN - Serial Number +GSN - Serial Number Execution command returns the device board serial number. AT+GSN Note: The number returned is not the IMSI, it is only the board number Reference V.25ter 3.5.1.1.14 &V - Display Cu rrent Configuration & Profile &V - Display Current Configuration & Profile Execution command returns some of the base configuration AT&V parameters settings. Note: this is one of the commands whose output differs depending on the setting. last #SELINT 3.5.1.1.15 &V0 - Display Curr ent Configuration & Profile &V0 - Display Current Configuration & Profile Execution command returns all the configuration parameters settings. AT&V0 , it is included only for backwards Note: this command is the same as &V compatibility. Note: this is one of the commands whose output differs depending on the last setting. #SELINT page 31 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

32 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.1.16 &V1 - Display S Registers Values &V1 - Display S Registers Values Execution command returns the value of the S registers in decimal and AT&V1 hexadecimal value in the format: HEX REG DEC ... where - S - current value in decimal notation - current value in hexadecimal notation ay S Registers Values 3.5.1.1.17 &V3 - Displ &V3 - Display S Registers Values Execution command returns the value of the S registers in decimal and AT&V3 hexadecimal value in the format: REG DEC HEX ... where - register number (0..38) S > - current value in decimal notation - current value in hexadecimal notation &V2 - Display La st Connection Statistics 3.5.1.1.18 &V2 - Display Last Connection Statistics Execution command returns the last connection statistics & connection AT&V2 failure reason. 3.5.1.1.19 \V - Single Line Connect Message \V - Single Line Connect Message Execution command set single line connect message. AT\V Parameter: 0 - off 1 - on page 32 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

33 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.1.20 +GCI - Country Of Installation +GCI - Country Of Installation Set command selects the installation country code according to AT+GCI= ITU-T.35 Annex A. Parameter: 59 - it currently supports only the Italy country code Read command reports the currently selected country code. AT+GCI? Test command reports the supported country codes. AT+GCI=? Reference V25ter. 3.5.1.1.21 %L - Line Signal Level %L - Line Signal Level It has no effect and is included only for backward compatibility with landline AT%L modems 3.5.1.1.22 %Q - Line Quality %Q - Line Quality It has no effect and is included only for backward compatibility with landline AT%Q modems L - Speaker Loudness 3.5.1.1.23 L - Speaker Loudness It has no effect and is included only for backward compatibility with landline ATL modems 3.5.1.1.24 M - Speaker Mode M - Speaker Mode It has no effect and is included only for backward compatibility with landline ATM modems page 33 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

34 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.2 DTE - Modem Interface Control 3.5.1.2.1 E - Command Echo E - Command Echo Set command enables/disables the command echo. ATE[] Parameter: 0 - disables command echo 1 - enables command echo (factory default) , hence command sent to the device are echoed back to the DTE before the response is given. Note: if parameter is omitted, the command has the same behaviour of ATE0 Reference V25ter 3.5.1.2.2 Q - Quiet Result Codes Q - Quiet Result Codes Set command enables or disables the result codes. ATQ[] Parameter: 0 - enables result codes (factory default) 1 - every result code is replaced with a 2 - disables result codes ATQ2 every information text transmitted or Note: After issuing either ATQ1 in response to commands is not affected Note: if parameter is omitted, the command has the same behaviour as ATQ0 After issuing ATQ1 Example AT+CGACT=? +CGACT: (0-1) a ends the response After issuing ATQ2 AT+CGACT=? +CGACT: (0-1) nothing is appended to the response Reference V25ter page 34 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

35 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.2.3 V - Response Format V - Response Format Set command determines the contents of the header and trailer transmitted ATV[] with result codes and information responses. It also determines if result codes are transmitted in a numeric form or an alphanumeric form (see [§3.2.3 Information Responses And Result Codes] for the table of result codes). Parameter: 0 - limited headers and trailers and numeric format of result codes information responses result codes 1 - full headers and trailers and verbose format of result codes (factory default) information responses result codes Note: the portion of information responses is not affected by this setting. Note: if parameter is omitted, the command has the same behaviour of ATV0 Reference V25ter 3.5.1.2.4 X - Extended Result Codes X - Extended Result Codes Set command selects the result code messages subset used by the modem ATX[] to inform the DTE of the result of the commands. Parameter: 0 - send onl NO NO CARRIER , ERROR , y OK , CONNECT , RING , page 35 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

36 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 results. Busy tones reporting is disabled. ANSWER 1..4 - reports all messages (factory default is 1) Note: If parameter is omitted, the command has the same behaviour as ATX0 response message see also +DR Note For complete control on CONNECT command. Reference V25ter 3.5.1.2.5 I - Identification Information I - Identification Information Execution command returns one or more lines of information text followed ATI[] by a result code. Parameter: 0 - numerical identifier. 1 - module checksum 2 - checksum check result 3 - manufacturer 4 - product name 5 - DOB version Note: this is one of the commands whose output differs depending on the setting. last #SELINT Note: if parameter is omitted, the command has the same behaviour as ATI0 Reference V25ter 3.5.1.2.6 &C - Data Carrier Detect (DCD) Control &C - Data Carrier Detect (DCD) Control DCD output behaviour. Set command controls the RS232 AT&C[] Parameter: 0 - DCD remains high always. DCD 1 - follows the Carrier detect status: if carrier is detected DCD is high, otherwise DCD is low. (factory default) 2 - off while disconnecting DCD Note: if parameter is omitted, the command has the same behaviour as AT&C0 page 36 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

37 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Reference V25ter al Ready (DTR) Control 3.5.1.2.7 &D - Data Termin &D - Data Terminal Ready (DTR) Control Set command controls the Module behaviour to the RS232 DTR transitions. AT&D[] Parameter: 0 - transitions are ignored. (factory default) DTR 1 - when the MODULE is connected, the high to low transition of DTR pin sets the device in command mode, the current connection is NOT closed. 2 - when the MODULE is connected , the high to low transition of DTR pin sets the device in command mode and the current connection is closed. . power saving mode transitions are considered only in DTR 3 - C108/1 operation is disabled 4 - 5 - C108/1 operation is enabled Note: if AT&D2 has been issued and the DTR has been tied low , autoanswering is inhibited and it is possible to answer only issuing command ATA. Note: if parameter is omitted, the command has the same behaviour as AT&D0 Reference V25ter 3.5.1.2.8 \Q - Standard Flow Control \Q - Standard Flow Control Set command controls the RS232 flow control behaviour. AT\Q[] Parameter: 0 - no flow control 1 - software bi-directional with filtering ( XON/XOFF ) 2 - hardware mono-directional flow control (only CTS active) active) (factory RTS/CTS 3 - hardware bi-directional flow control (both default) Note: if parameter is omitted, the command has the same behaviour as AT\Q0 page 37 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

38 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 \Q - Standard Flow Control Note: \Q’s settings are functionally a subset of &K’s ones. Reference V25ter 3.5.1.2.9 &K - Flow Control &K - Flow Control Set command controls the RS232 flow control behaviour. AT&K[] Parameter: 0 - no flow control active) 1 - hardware mono-directional flow control (only CTS 2 - software mono-directional flow control ( XON/XOFF ) 3 - hardware bi-directional flow control (both RTS/CTS active) (factory default) 4 - software bi-directional with filtering ( XON/XOFF ) ) XON/XOFF 5 - pass through: software bi-directional without filtering ( 6 - both hardware bi-directional flow control (both active) and RTS/CTS software bi-directional flow control ( ) with filtering XON/XOFF Note: if parameter is omitted, the command has the same behaviour as AT&K0 Note: &K has no Read Command. To verify the current setting of &K , simply check the settings of the active profile with AT&V . 3.5.1.2.10 &S - Data Set Ready (DSR) Control &S - Data Set Ready (DSR) Control Set command controls the RS232 pin behaviour. DSR AT&S[] Parameter: ON 0 - always 1 - follows the GSM traffic channel indication. 2 - ON when connected 3 - ON when device is ready to receive commands (factory default). Note: if option 1 is selected then is tied up when the device receives DSR from the network the GSM traffic channel indication. Note: if parameter is omitted, the command has the same behaviour as AT&S0 page 38 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

39 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.2.11 \R - Ring (RI) Control \R - Ring (RI) Control RING output pin behaviour. Set command controls the AT\R[] Parameter: 0 - RING on during ringing and further connection 1 - RING on during ringing (factory default) 2 - RING follows the ring signal Note: to check the ring option status use the &V command. Note: if parameter is omitted, the command has the same behaviour as AT\R0 3.5.1.2.12 +IPR - Fixe d DTE Interface Rate +IPR - Fixed DTE Interface Rate Set command specifies the speed at which the device accepts DTE AT+IPR= commands during command mode operations; it may be used to fix the DTE-DCE interface speed. Parameter: 0 ..300 1200 2400 4800 9600 19200 38400 57600 115200 is set to 0, then automatic speed detection is enabled and also If ) is set to auto-detect. (default) character format (see +ICF If DTE-DCE is specified and not 0, speed is fixed at that speed, hence no speed auto-detection (autobauding) is enabled. Read command returns the current value of parameter. +IPR AT+IPR? Test command returns the supported serial port speed list. AT+IPR=? Reference V25ter page 39 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

40 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.2.13 +IFC - DTE-Modem Local Flow Control +IFC - DTE-Modem Local Flow Control Set command selects the flow control behaviour of the serial port in both AT+IFC=, DTE to directions: from DTE to modem ( option) and from modem ) ( Parameter: - flow control option for the data received by DTE 0 - flow control None 1 - filtered XON/XOFF 2 - C105 (RTS) (factory default) XON/XOFF 3 - not filtered - flow control option for the data sent by modem 0 - flow control None 1 - XON/XOFF (factory default) C106 (CTS) 2 - command. Note: This command is equivalent to &K Read command returns active flow control settings. AT+IFC? Test command returns all supported values of the parameters AT+IFC=? and . Reference V25ter 3.5.1.2.14 +ILRR - DTE-Mo dem Local Rate Reporting +ILRR - DTE-Modem Local Rate Reporting Set command controls whether or not the +ILRR: information text is AT+ILRR= to the transmitted from the modem DTE . Parameter: 0 - local port speed rate reporting disabled (factory default) 1 - local port speed rate reporting enabled Note: this information if enabled is sent upon connection. Read command returns active setting of . AT+ILRR? . Test command returns all supported values of the parameter AT+ILRR=? Reference V25ter 3.5.1.2.15 +ICF - DTE-Modem Character Framing +ICF - DTE-Modem Character Framing Set command defines the asynchronous character framing to be used when AT+ICF= autobauding is disabled. [,] page 40 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

41 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Parameters: - determines the number of bits in the data bits, the presence of a parity bit, and the number of stop bits in the start-stop frame. 0 - autodetection 1 - 8 Data, 2 Stop 2 - 8 Data, 1 Parity, 1 Stop 3 - 8 Data, 1 Stop 4 - 7 Data, 2 Stop 5 - 7 Data, 1 Parity, 1 Stop - determines how the parity bit is generated and checked, if present 0 - Odd 1 - Even Read command returns current settings for subparameters and AT+ICF? . Test command returns the ranges of values for the parameters AT+ICF=? and Reference V25ter AT+ICF = 0 - auto detect Example AT+ICF = 1 - 8N2 AT+ICF = 2,0 - 8O1 AT+ICF = 2,1 - 8E1 AT+ICF = 3 - 8N1 (default) AT+ICF = 5,0 - 7O1 AT+ICF = 5,1 - 7E1 page 41 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

42 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.3 Call Control 3.5.1.3.1 D - Dial D - Dial Execution command starts a call to the phone number given as parameter. ATD[;] If “;” is present, a VOICE call to the given number is performed, regardless command. +FCLASS of the current value of the connection mode set by Parameter: - phone number to be dialed Note: type of call (data, fax or voice) depends on last +FCLASS setting. Note: the numbers accepted are 0-9 and *,#,”A”, ”B”, ”C”, ”D”,”+”. Note: for backwards compatibility with landline modems modifiers “T”, ”P”, ”R”, ”,”, ”W”, “!”, “@” are accepted but have no effect. Issues a call to phone number which corresponding alphanumeric field is ATD>[;] ; all available memories will be searched for the correct entry. voice ” is present a call is performed. ; If “ Parameter: - alphanumeric field corresponding to phone number; it must be enclosed in quotation marks. Note: used character set should be the one selected with either command +CSCS @CSCS . Select TE character set or > [;] > ATD> (available memories may be queried with AT+CPBS=? ). call is performed. If “ ; ” is present a voice Parameters: - phonebook memory storage; it must not be enclosed in quotation marks. SM - SIM phonebook FD - SIM fixed dialling-phonebook LD - SIM last-dialling-phonebook MC - device missed (unanswered received) calls list RC - ME received calls list - entry location; it should be in the range of locations available in the memory used. in entr location y of the active ATD> < n > [;] Issues a call to p hone numbe r page 42 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

43 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 D - Dial phonebook memory storage (see +CPBS ). call is performed. voice If “;” is present a Parameter: - active phonebook memory storage entry location; it should be in the range of locations available in the active phonebook memory storage. Issues a call to the last number dialed. ATDL Issues a call to the number stored in the MODULE internal phonebook ATDS=[;] position number . If “;” is present a VOICE call is performed. Parameter: - internal phonebook position to be called (See commands &N and &Z ) Issues a call overwriting the CLIR supplementary service subscription ATDI[;] default value for this call ATDi[;] If “;” is present a VOICE call is performed. I - invocation, restrict CLI presentation i - suppression, allow CLI presentation Issues a call checking the CUG supplementary service information for the ATDG[;] current call. Refer to command. +CCUG ATDg[;] If “;” is present a VOICE call is performed. This command is specific of GPRS functionality and causes the MT to ATD* perform whatever actions are necessary to establish communication [*][*[] between the TE and the external PDN. [*[]]]]# Parameters: - GPRS Service Code, a digit string (value 99) which identifies a request to use the GPRS - string that identifies the called party in the address space applicable to the PDP. - a string which indicates the layer 2 protocol to be used (see +CGDATA command). For communications software that does not support arbitrary characters in the dial string, the following numeric equivalents shall be used: 1 - PPP Other values are reserved and will result in an ERROR response to the Set command. - a digit which specifies a particular PDP context definition (see +CGDCONT command). Example To dial a number in SIM phonebook entry 6: ATD>SM6 page 43 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

44 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 D - Dial OK h entry of active To have a voice call to the 6- t phonebook: ATD>6; OK : “Name” To call the entry with alphanumeric field ATD>”Name”; OK Reference V25ter. 3.5.1.3.2 T - Tone Dial T - Tone Dial Set command has no effect is included only for backward compatibility with ATT landline modems. Reference V25ter. 3.5.1.3.3 P - Pulse Dial P - Pulse Dial Set command has no effect is included only for backward compatibility with ATP landline modems. Reference V25ter. 3.5.1.3.4 A - Answer A - Answer Execution command is used to answer to an incoming call if automatic ATA answer is disabled. Note: This command MUST be the last in the command line and must be character. followed immediately by a Reference V25ter. page 44 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

45 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.3.5 H - Disconnect H - Disconnect Execution command is used to close the current conversation (voice, data ATH or fax). Note: this command can be issued only in command mode; when a data conversation is active the device is in on-line mode (commands are not sensed and characters are sent to the other party), hence escape sequence (see register S2 ) is required before issuing this command, otherwise if &D1 option is active, DTR pin has to be tied low to return in command mode. Reference V25ter. 3.5.1.3.6 O - Return To On Line Mode O - Return To On Line Mode Execution command is used to return to on-line mode from command mode. ATO If there's no active connection it returns ERROR . Note: After issuing this command, if the device is in conversation, to send other commands to the device you must return to command mode by ) or tying low &D1 pin if issuing the escape sequence (see register S2 DTR option is active. Reference V25ter. 3.5.1.3.7 &G - Guard Tone &G - Guard Tone Set command has no effect is included only for backward compatibility with AT&G landline modems. 3.5.1.3.8 &Q - Sync/Async Mode &Q - Sync/Async Mode Set command has no effect is included only for backward compatibility with AT&Q landline modems. page 45 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

46 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.4 Modulation Control 3.5.1.4.1 +MS - Modulation Selection +MS - Modulation Selection Set command has no effect is included only for backward compatibility with AT+MS= landline modems. [, [, Parameter: [, - a string which specifies the preferred modem carrier to use in ]]] originating or answering a connection V21 V22 V22B V23C V32 V34 - it enables/disables automatic modulation negotiation. 0 - disabled 1 - enabled. It has effect only if it is defined for the associated modulation. may establish a DCE - it specifies the lowest value at which the connection. 0 - unspecified - it specifies the highest value at which the DCE may establish a connection. 0 - unspecified 300..14400 - rate in bps command. Note: to change modulation requested use +CBST , , Read command returns the current value of AT+MS? , parameters. , , Test command returns all supported values of the AT+MS=? , parameters. 3.5.1.4.2 %E - Line Quality Monitor A nd Auto Retrain Or Fallback/Fallforward %E - Line Quality Monitor And Auto Retrain Or Fallback/Fallforward Execution command has no effect and is included only for backward AT%E compatibility with landline modems. page 46 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

47 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.5 Compression Control 3.5.1.5.1 +DS - Data Compression +DS - Data Compression Set command sets the V42 compression parameter. AT+DS= Parameter: 0 - no compression, it is currently the only supported value Read command returns current value of the data compression parameter. AT+DS? Test command returns all supported values of the parameter AT+DS=? Reference V25ter 3.5.1.5.2 +DR - Data Compression Reporting +DR - Data Compression Reporting Set command enables/disables the data compression reporting upon AT+DR= connection. Parameter: 0 - data compression reporting disabled; 1 - data compression reporting enabled upon connection. Note: if enabled, the following intermediate result code is transmitted before the final result code: +DR: (the only supported value for is “NONE”) . Read command returns current value of AT+DR? Test command returns all supported values of the parameter AT+DR=? V25ter Reference page 47 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

48 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.6 Break Control 3.5.1.6.1 \B - Transmit Break To Remote \B - Transmit Break To Remote Execution command has no effect and is included only for backward AT\B compatibility with landline modems 3.5.1.6.2 \K - Break Handling \K - Break Handling Execution command has no effect and is included only for backward AT\K compatibility with landline modems Parameter: 1..5 3.5.1.6.3 \N - Operating Mode \N - Operating Mode Execution command has no effect and is included only for backward AT\N compatibility with landline modems page 48 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

49 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.7 S Parameters ” are known as “ S-Parameters ”. The number following Basic commands that begin with the letter “ S ” indicates the “parameter number” being referenced. If the number is not recognized as a valid S the “ parameter number, an ERROR result code is issued. S-Parameter , an ERROR If no value is given for the subparameter of an result code will be issued and the stored value left unchanged. Note: what follows is a special way to select and set an S-parameter : ATS n selects 1. as current parameter number. If the value of n is in the range (0, 2, n 3, 4, 5, 7, 12, 25, 30, 38), this command establishes S n as last selected parameter. Every value out of this range and less than 256 can be used but has no meaning and is maintained only for backward compatibility with landline modems. or AT= S-parameter set the contents of the selected 2. ATS= Example: S7 ATS7 establishes as last selected parameter. AT=40 sets the content of S7 to 40 S7 to 15. ATS=15 sets the content of 3.5.1.7.1 S0 - Number Of Rings To Auto Answer S0 - Number Of Rings To Auto Answer Set command sets the number of rings required before device automatically ATS0[=] answers an incoming call. Parameter: - number of rings 0 - auto answer disabled (factory default) 1..255 - number of rings required before automatic answer. Read command returns the current value of S0 parameter. ATS0? without command echo and Test command returns the range for ATS0=? parenthesis. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s Reference V25ter page 49 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

50 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.7.2 S1 - Ring Counter S1 - Ring Counter S1 is incremented each time the device detects the ring signal of an ATS1 incoming call. S1 is cleared as soon as no ring occur. has no effect. ATS1 Note: the form Read command returns the value of S1 ring counter. ATS1? Test command returns the range of values for S1 ring counter without ATS1=? command echo and parenthesis. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s 3.5.1.7.3 S2 - Escape Character S2 - Escape Character Set command sets the ASCII character to be used as escape character. ATS2[=] Parameter: - escape character decimal ASCII 0..255 - factory default value is 43 (+). Note: the escape sequence consists of three escape characters preceded n ms of idle (see S12 to set n ). and followed by parameter. S2 Read command returns the current value of ATS2? without command echo and Test command returns the range for ATS2=? parenthesis Note For either Read and Test command the format of the numbers in output is always 3 digits, left-filled with 0s 3.5.1.7.4 S3 - Command Li ne Termination Character S3 - Command Line Termination Character Set command sets the value of the character either recognized by the ATS3[=] device as command line terminator and generated by the device as part of the header, trailer, and terminator for result codes and information text, along with S4 parameter. Parameter: - command line termination character (decimal ASCII) 0..127 - factory default value is 13 (ASCII CR ) Note: the “previous” value of S3 is used to determine the command line termination character for enterin S3 the g g the command line containin page 50 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

51 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 setting command. However the result code issued shall use the “new” value (as set during the processing of the command line). of S3 S3 Read command returns the current value of parameter. ATS3? Test command returns the range for without command echo and ATS3=? parenthesis. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s Reference V25ter 3.5.1.7.5 S4 - Response Formatting Character S4 - Response Formatting Character Set command sets the value of the character generated by the device as ATS4[=] part of the header, trailer, and terminator for result codes and information parameter. text, along with the S3 Parameter: - response formatting character (decimal ASCII) ) LF 0..127 - factory default value is 10 (ASCII Note: if the value of S4 is changed in a command line the result code issued in response of that command line will use the new value of S4 . Read command returns the current value of parameter. S4 ATS4? Test command returns the range for without command echo and ATS4=? parenthesis Note For either Read and Test command the format of the numbers in output is always 3 digits, left-filled with 0s Reference V25ter 3.5.1.7.6 S5 - Command Line Editing Character S5 - Command Line Editing Character Set command sets the value of the character recognized by the device as a ATS5[=] request to delete from the command line the immediately preceding character. Parameter: - command line editing character (decimal ASCII) ). 0..127 - factory default value is 8 (ASCII BS Read command returns the current value of S5 parameter. ATS5? Test command returns the range for without command echo and ATS5=? parenthesis. Note For either Read and Test command the format of the numbers in output is always 3 digits, left-filled with 0s Reference V25ter page 51 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

52 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.1.7.7 S7 - Connection Completion Time-Out S7 - Connection Completion Time-Out Set command sets the amount of time, in seconds, that the device shall ATS7[=] allow between either answering a call (automatically or by A command) or completion of signalling of call addressing information to network (dialling), and establishment of a connection with the remote device. Parameter: - number of seconds 1..255 - factory default value is 60. Read command returns the current value of S7 parameter. ATS7? without command echo and Test command returns the range for ATS7=? parenthesis. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s Reference V25ter 3.5.1.7.8 S12 - Escape Prompt Delay S12 - Escape Prompt Delay Set command sets the period, before and after an escape sequence, during ATS12[=

53 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Note: the delay is effective only if its value is greater than 5. Read command returns the current value of S25 parameter. ATS25?

54 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 without Test command returns the range of supported values for ATS38=? command echo and parenthesis. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s page 54 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

55 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2 ETSI GSM 07.07 AT Commands 3.5.2.1 General 3.5.2.1.1 +CGMI - Request Manufacturer Identification +CGMI - Request Manufacturer Identification Execution command returns the device manufacturer identification code AT+CGMI without command echo. The output depends on the choice made through #SELINT command. Read command has the same behaviour as Execution command AT+CGMI? Reference GSM 07.07 Model Identification 3.5.2.1.2 +CGMM - Request +CGMM - Request Model Identification Execution command returns the device model identification code without AT+CGMM command echo. Reference GSM 07.07 Revision Identification 3.5.2.1.3 +CGMR - Request +CGMR - Request Revision Identification Execution command returns device software revision number without AT+CGMR command echo. Read command has the same behaviour as Execution command AT+CGMR? Reference GSM 07.07 Serial Number Identification 3.5.2.1.4 +CGSN - Request Product +CGSN - Request Product Serial Number Identification Execution command returns the product serial number, identified as the AT+CGSN IMEI of the mobile, without command echo. Read command has the same behaviour as Execution command AT+CGSN? Reference GSM 07.07 page 55 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

56 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.1.5 +CSCS - Select TE Character Set +CSCS - Select TE Character Set Set command sets the current character set used by the device. AT+CSCS [=] Parameter: - character set “IRA” - ITU-T.50 ”8859-1” - ISO 8859 Latin 1 ”PCCP437” - PC character set Code Page 437. ”UCS2” - 16-bit universal multiple-octet coded character set (ISO/IEC10646) Note: If parameter is omitted then the behaviour of Set command is the same as Read command. Read command returns the current value of the active character set. AT+CSCS? Test command returns the supported values of the parameter . AT+CSCS=? For compatibility with previous versions, Test command returns +CSCS: (“IRA”) An enhanced version of Test command has been defined: AT+CSCS=?? , . that provides the complete range of values for Enhanced test command returns the supported values of the parameter AT+CSCS=?? Reference GSM 07.07 3.5.2.1.6 +CIMI - Request International Mobile Subscriber Identity (IMSI) +CIMI - Request International Mobile Subscriber Identify (IMSI) Execution command returns the value of the Internal Mobile Subscriber AT+CIMI Identity stored in the SIM without command echo. Note: a SIM card must be present in the SIM card housing, otherwise the . ERROR command returns Read command has the same behaviour as Execution command AT+CIMI? Reference GSM 07.07 page 56 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

57 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.2 Call Control 3.5.2.2.1 +CHUP - Hang Up Call +CHUP - Hang Up Call Execution command cancels all active and held calls, also if a multi-party AT+CHUP session is running. result code Test command returns the OK AT+CHUP=? Reference GSM 07.07 3.5.2.2.2 +CBST - Select Bearer Service Type +CBST - Select Bearer Service Type , and with data rate Set command sets the bearer service AT+CBST the connection element to be used when data calls are originated. [= Values may also be used during mobile terminated data call setup, [, ). +CSNS especially in case of single numbering scheme calls (refer [,]]] Parameters: The default values of the subparameters are manufacturer specific since they depend on the purpose of the device and data services provided by it. Not all combinations of these subparameters are supported. The supported values are: 0 - autobauding (automatic selection of the speed, factory default) 1 - 300 bps (V.21) 2 - 1200 bps (V.22) 3 - 1200/75 bps (V.23) 4 - 2400 bps (V.22bis) 6 - 4800 bps (V.32) 7 - 9600 bps (V.32) 14 - 14400 bps (V.34) 65 - 300 bps (V.110) 66 - 1200 bps (V.110) 68 - 2400 bps (V.110 or X.31 flag stuffing) 70 - 4800 bps (V.110 or X.31 flag stuffing) 71 - 9600 bps (V.110 or X.31 flag stuffing) 75 - 14400 bps (V110 or X.31 flag stuffing) 0 - data circuit asynchronous (factory default) 0 - transparent 1 - non transparent (default) written authorization - All Right reserved page 57 of 614 Reproduction forbidden without Telit Communications S.p.A.

58 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CBST - Select Bearer Service Type Note: the settings AT+CBST=0,0,0 AT+CBST=14,0,0 AT+CBST=75,0,0 are not supported. Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. , Read command returns current value of the parameters AT+CBST? and Test command returns the supported range of values for the parameters. AT+CBST=? Reference GSM 07.07 3.5.2.2.3 +CRLP - Radio Link Protocol +CRLP - Radio Link Protocol Set command sets Radio Link Protocol (RLP) parameters used when non- AT+CRLP= transparent data calls are originated [,[, [,[,]]]] Parameters: - IWF window Dimension 1..61 - factory default value is 61 - MS window Dimension 1..61 - default value is 61 - acknowledge timer (10 ms units). 39..255 - default value is 78 - retransmission attempts 1..255 - default value is 6 - protocol version 0 Read command returns the current value of the RLP protocol parameters. AT+CRLP? Test command returns supported range of values of the RLP protocol AT+CRLP=? parameters. Reference GSM 07.07 page 58 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

59 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 ce Reporting Control 3.5.2.2.4 +CR - Servi +CR - Service Reporting Control Set command controls whether or not intermediate result code AT+CR= +CR: TA , where to the is returned from the TE ASYNC - asynchronous transparent SYNC - synchronous transparent REL ASYNC - asynchronous non-transparent REL SYNC - synchronous non-transparent If enabled, the intermediate result code is transmitted at the point during connect negotiation at which the has determined which speed and TA quality of service will be used, before any error control or data compression CONNECT reports are transmitted, and before the intermediate result code is transmitted. Parameter: 0 - disables intermediate result code report (factory default) 1 - enables intermediate result code report. This command replaces V.25ter [14] command Modulation Reporting Control +MR , which is not appropriate for use with a GSM terminal. Read command returns current intermediate report setting AT+CR? Test command returns the supported range of values of parameter AT+CR=? . Reference GSM 07.07 3.5.2.2.5 +CEER - Extended Error Report +CEER - Extended Error Report Execution command returns one or more lines of information text AT+CEER in the format: +CEER: This report regards some error condition that may occur: - the failure in the last unsuccessful call setup (originating or answering) - the last call release - the last unsuccessful GPRS attach or unsuccessful PDP context activation, page 59 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

60 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CEER - Extended Error Report - the last GPRS detach or PDP context deactivation. Note: if none of this condition has occurred since power up then No Error condition is reported Read command reports a information text regarding some error condition AT+CEER? that may occur result code. Test command returns OK AT+CEER=? Reference GSM 07.07 3.5.2.2.6 +CRC - Cellular Result Codes +CRC - Cellular Result Codes Set command controls whether or not the extended format of incoming call AT+CRC= indication is used. Parameter: 0 - disables extended format reporting (factory default) 1 - enables extended format reporting When enabled, an incoming call is indicated to the TE with unsolicited result code: +CRING: . instead of the normal RING where - call type: DATA FAX - facsimile (TS 62) VOICE - normal voice (TS 11) . Read command returns current value of the parameter AT+CRC? . Test command returns supported values of the parameter AT+CRC=? Reference GSM 07.07 page 60 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

61 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 le Numbering Scheme 3.5.2.2.7 +CSNS - Sing +CSNS - Single Numbering Scheme Set command selects the bearer or teleservice to be used when mobile AT+CSNS= terminated single numbering scheme call is established. Parameter values equals to a data set with +CBST command shall be used when service. Parameter: 0 - voice (factory default) 2 - fax (TS 62) 4 - data Note: if +CBST parameter is set to a value that is not applicable to single numbering calls, ME/TA shall map the value to the closest valid one. E.g. if user has set =71 , =0 and =1 (non-trasparent asynchronous 9600 bps V.110 ISDN connection) for mobile originated calls, ME/TA shall map the values into non-trasparent asynchronous 9600 bps V.32 modem connection when single num bering scheme call is answered. . Read command returns current value of the parameter AT+CSNS? . Test command returns supported values of the parameter AT+CSNS=? Reference GSM 07.07 3.5.2.2.8 +CVHU - Vo ice Hang Up Control +CVHU - Voice Hang Up Control drop DTR or “ " shall cause a voice ATH Set command selects whether AT+CVHU[= connection to be disconnected or not. ] Parameter: 0 - " Drop DTR " ignored but OK result code given. ATH disconnects. result code given. OK 1 - " ignored but Drop DTR " and ATH 2 - " Drop DTR " behaviour according to &D setting. ATH disconnects (factory default). Note: if parameter is omitted the behaviour of Set command is the same as Read command. parameter, Read command reports the current value of the AT+CVHU? +CVHU: Test command reports the range of supported values for parameter AT+CVHU=? page 61 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

62 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Network Service Handling 3.5.2.3 3.5.2.3.1 +CNUM - Subscriber Number +CNUM - Subscriber Number Execution command returns the subscriber number i.e. the phone number AT+CNUM of the device that is stored in the SIM card. Note: the returned number format is: +CNUM: , where - string containing the phone number in the format - type of number: 129 - national numbering scheme 145 - international numbering scheme (contains the character "+"). Reference GSM 07.07 3.5.2.3.2 +COPN - Read Operator Names +COPN - Read Operator Names . The Execution command returns the list of operator names from the ME AT+COPN #SELINT command. output depends on the choice made through Reference GSM 07.07 3.5.2.3.3 +CREG - Netw ork Registration Report +CREG - Network Registration Report Set command enables/disables network registration reports depending on AT+CREG[= . the parameter []] Parameter: 0 - disable network registration unsolicited result code (factory default) 1 - enable network registration unsolicited result code 2 - enable network registration unsolicited result code with network Cell identification data =1 If , network registration result code reports: +CREG: where page 62 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

63 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CREG - Network Registration Report 0 - not registered, ME is not currently searching a new operator to register to 1 - registered, home network 2 - not registered, but ME is currently searching a new operator to register to 3 - registration denied 4 -unknown 5 - registered, roaming If =2 , network registration result code reports: +CREG: [,,] where: - Local Area Code for the currently registered on cell - Cell Id for the currently registered on cell =2 and the mobile is Note: and are reported only if registered on some network cell. Note: issuing is the same as issuing the Read command. AT+CREG AT+CREG= is the same as issuing the command Note: issuing AT+CREG=0 . parameter values in the Read command reports the and AT+CREG? format: +CREG: ,[,,] and the mobile is are reported only if =2 Note: and registered on some network cell. Test command returns the range of supported AT+CREG=? AT Example OK at+creg? +CREG: 0,2 (the MODULE is in network searching state) OK at+creg? +CREG: 0,2 OK at+creg? +CREG: 0,2 OK at+creg? page 63 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

64 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CREG - Network Registration Report +CREG: 0,2 OK at+creg? +CREG: 0,1 (the MODULE is registered ) OK at+creg? +CREG: 0,1 OK Reference GSM 07.07 3.5.2.3.4 +COPS - Operator Selection +COPS - Operator Selection Set command forces an attempt to select and register the GSM network AT+COPS[= operator. [ parameter defines whether the operator selection is done [, . automatically or it is forced by this command to operator [,]]]] . shall be given in format The operator The behaviour of +COPS command depends on the last #COPSMODE setting. (#COPSMODE=0) Parameters: 0 - automatic choice (the parameter will be ignored) (factory default) 1 - manual choice unlocked (network is kept as long as available, then it can be changed with some other suited networks to guarantee the service) 2 - deregister from GSM network; the MODULE is kept unregistered until a =0, 1, 4 +COPS is issued 5 or with will be ignored) 3 - set only parameter (the parameter 4 - manual/automatic ( field shall be present); if manual selection fails, automatic mode (=0 ) is entered 5 - manual choice locked (network is kept fixed, if the chosen network is not available, then the mobile has no service) 0 - alphanumeric long form (max length 16 digits) 1 - alphanumeric short form 2 - Numeric 5 digits [country code (3) + network code (2)] Reproduction forbidden without Telit Communications S.p.A. page 64 of 614 written authorization - All Right reserved

65 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +COPS - Operator Selection : network operator in format defined by parameter. (#COPSMODE=1) Parameters: 0 - automatic choice (the parameter will be ignored) (default) 1 - manual choice > field shall be present) (=0, 1 or 4 is issued +COPS 3 - set only parameter (the parameter will be ignored) 4 - manual/automatic ( field shall be present); if manual selection fails, automatic mode (=0 ) is entered 0 - alphanumeric long form (max length 16 digits) 2 - numeric 5 digits [country code (3) + network code (2)] parameter. : network operator in format defined by parameter setting is stored in NVM and available at next Note: reboot. If =1 or 4 , the selected network is stored in NVM too and is available at next reboot (this will happen even with a new SIM inserted) Note: issuing AT+COPS is the same as issuing the Read command. Note: issuing AT+COPS= is the same as issuing the command . AT+COPS=0 Read command returns current value of in and , AT+COPS? are format ; if no operator is selected, and omitted +COPS: [, , ] Test command returns a list of quadruplets, each representing an operator AT+COPS=? present in the network. #COPSMODE setting. The behaviour of Test command depends on the last (#COPSMODE=0) The command outputs as many rows as the number of quadruplets, each of them in the format: +COPS: ( ,=0)>,””, =2)>) page 65 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

66 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +COPS - Operator Selection where - operator availability 0 - unknown 1 - available 2 - current 3 - forbidden (#COPSMODE=1) The quadruplets in the list are separated by commas: +COPS: [list of supported ( ,=0)>,, =2)> )s][,,(list of supported s), (list of supporteds)] where - operator availability 0 - unknown 1 - available 2 - current 3 - forbidden Note: since with this command a network scan is done, this command may require some seconds before the output is given. (in =0 ) is the same as the Note: The value of parameter former GM862 family products. Reference GSM 07.07 3.5.2.3.5 +CLCK - Facility Lock/ Unlock +CLCK - Facility Lock/Unlock Execution command is used to lock or unlock a ME o a network facility. AT+CLCK= , Parameters: [, - facility [,]] "SC" - SIM (PIN request) (device asks SIM password at power-up and when this lock command issued) "AO"- BAOC (Barr All Outgoing Calls) "OI" - BOIC (Barr Outgoing International Calls) "OX" - BOIC-exHC (Barr Outgoing International Calls except to Home Country) "AI" - BAIC (Barr All Incoming Calls) "IR" - BIC-Roam g Calls when Roamin g outside the home Barr Incomin ( page 66 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

67 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLCK - Facility Lock/Unlock country) "AB" - All Barring services (applicable only for ) =0 "AG" - All outGoing barring services (applicable only for =0 ) "AC" - All inComing barring services (applicable only for =0 ) "FD" - SIM fixed dialling memory feature (if PIN2 authentication has no t been done during the current session, PIN2 is required as ) "PN" - network Personalisation "PU" - network subset Personalisation - defines the operation to be done on the facility 0 - unlock facility 1 - lock facility 2 - query status - shall be the same as password specified for the facility from the DTE user interface or with command Change Password +CPWD - represents the class of information of the facility as sum of bits (default is 7) 1- voice (telephony) 2 - data (refers to all bearer services) 4 - fax (facsimile services) 8 - short message service 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access =2 and command successful, it returns: Note: when +CLCK: where - current status of the facility 0 - not active 1 - active Test command reports all the facility supported by the device. AT+CLCK=? Reference GSM 07.07 Note @CLCK The improving command has been defined. page 67 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

68 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.3.6 @CLCK - Facility Lock/ Unlock @CLCK - Facility Lock/Unlock o a network facility. ME Execution command is used to lock or unlock a [email protected]= , Parameters: [, - facility [,]] "SC" - SIM (PIN request) (device asks SIM password at power-up and when this lock command issued) "AO"- BAOC (Barr All Outgoing Calls) "OI" - BOIC (Barr Outgoing International Calls) "OX" - BOIC-exHC (Barr Outgoing International Calls except to Home Country) "AI" - BAIC (Barr All Incoming Calls) "IR" - BIC-Roam (Barr Incoming Calls when Roaming outside the home country) "AB" - All Barring services (applicable only for =0 ) =0 ) "AG" - All outGoing barring services (applicable only for =0 "AC" - All inComing barring services (applicable only for ) "FD" - SIM fixed dialling memory feature (if PIN2 authentication has no t been done during the current session, PIN2 is required as ) "PN" - network Personalisation "PU" - network subset Personalisation - defines the operation to be done on the facility 0 - unlock facility 1 - lock facility 2 - query status - shall be the same as password specified for the facility from the DTE user interface or with command Change Password +CPWD - represents the class of information of the facility as sum of bits (default is 7) 1- voice (telephony) 2 - data (refers to all bearer services) 4 - fax (facsimile services) 8 - short message service 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access =2 Note: when and command successful, it returns: @CLCK: [, [@CLCK: ,[...]] page 68 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

69 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @CLCK - Facility Lock/Unlock where - the current status of the facility 0 - not active 1 - active - class of information of the facility lities supported by the device. Test command reports all the faci [email protected]=? Reference GSM 07.07 Example Querying such a facility returns an output on three rows, the first for voice, the second for data, th e third for fax: [email protected] =”AO”,2 @CLCK: ,1 @CLCK: ,2 @CLCK: ,4 OK 3.5.2.3.7 +CPWD - Change Facility Password +CPWD - Change Facility Password Execution command changes the password for the facility lock function AT+CPWD=, . defined by command Facility Lock +CLCK , Parameters: - facility “SC” - SIM (PIN request) “AB” - All barring services “P2” - SIM PIN2 - string type, it shall be the same as password specified for the facility from the ME user interface or with command . +CPWD - string type, it is the new password is the ne Note: parameter is the old password while w one. which presents ) Test command returns a list of pairs ( , AT+CPWD=? the available facilities and the maximum length of their password ( ) Reference GSM 07.07 page 69 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

70 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.3.8 +CLIP - Calling Line Identification Presentation +CLIP - Calling Line Identification Presentation AT+CLIP[=[]] Set command enables/disables the presentation of the CLI (Calling Line Identity) at the . This command refers to the GSM supplementary service TE CLIP (Calling Line Identification Presentation) that enables a called subscriber to get the CLI of the calling party when receiving a mobile terminated call. Parameters: 0 - disables CLI indication (factory default) 1 - enables CLI indication If enabled the device reports after each RING the response: +CLIP:,,,, , where: - calling line number - type of address octet in integer format 145 - international numbering scheme (contains the character "+") 129 - national numbering scheme - string type subaddress of format specified by - type of subaddress octet in integer format - string type; alphanumeric representation of corresponding to the entry found in phonebook; used character set should be the one selected either with command Select TE or . @CSCS +CSCS character set 0 - CLI valid 1 - CLI has been withheld by the originator. 2 - CLI is not available due to interworking problems or limitation or originating network. is the same as issuing the Read command. AT+CLIP Note: issuing Note: issuing AT+CLIP= is the same as issuing the command . AT+CLIP=0 Read command returns the presentation status of the CLI in the format: AT+CLIP? +CLIP: , where: 0 - CLI presentation disabled page 70 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

71 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLIP - Calling Line Identification Presentation 1 - CLI presentation enabled - status of the CLIP service on the GSM network 0 - CLIP not provisioned 1 - CLIP provisioned 2 - unknown (e.g. no network is present ) Note: This command issues a status request to the network, hence it may take a few seconds to give the answer due to the time needed to exchange data with it. Test command returns the supported values of the parameter AT+CLIP=? Reference GSM 07.07 Note The command changes only the report behaviour of the device, it does not change CLI supplementary service setting on the network. Identification Restriction 3.5.2.3.9 +CLIR - Calling Line +CLIR - Calling Line Identification Restriction Set command overrides the CLIR subscription when temporary mode is AT+CLIR[=[]] provisioned as a default adjustment for all following outgoing calls. This adjustment can be revoked by using the opposite command. This command refers to CLIR-service (GSM 02.81) that allows a calling subscriber to enable or disable the presentation of the CLI to the called party when originating a call. Parameter: - facility status on the Mobile 0 - CLIR facility according to CLIR service network status 1 - CLIR facility active (CLI not sent) 2 - CLIR facility not active (CLI sent) Note: issuing AT+CLIR is the same as issuing the Read command. Note: issuing AT+CLIR= is the same as issuing the command . AT+CLIR=0 ) and ( Read command gives the default adjustment for all outgoing calls AT+CLIR? also triggers an interrogation of the provision status of the CLIR service ), where ( - facility status on the Mobile 0 - CLIR facility according to CLIR service network status 1 - CLIR facility active (CLI not sent) 2 - CLIR facility not active (CLI sent) page 71 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

72 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLIR - Calling Line Identification Restriction - facility status on the Network 0 - CLIR service not provisioned 1 - CLIR service provisioned permanently 2 - unknown (e.g. no network present, etc.) 3 - CLI temporary mode presentation restricted 4 - CLI temporary mode presentation allowed Test command reports the supported values of parameter . AT+CLIR=? Reference GSM 07.07 Note This command sets the default behaviour of the device in outgoing calls. +CCFC - Call Forwar ding Number And Conditions 3.5.2.3.10 +CCFC - Call Forwarding Number And Condition Execution command controls the call forwarding supplementary service. AT+CCFC= Registration, erasure, activation, deactivation, and status query are , supported. [,[, [, Parameters: [,,,

73 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCFC - Call Forwarding Number And Condition 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access - the time in seconds after which the call is diverted if "no reply"

74 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCWA - Call Waiting 2 - data 4 - fax (facsimile services) 8 - short message service 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access Note: the response to the query command is in the format: +CCWA:, where represents the status of the service: 0 - inactive 1 - active - class of calls the service status refers to. is in the Note: the unsolicited result code enabled by parameter format: +CCWA: ,,,, where - string type phone number of calling address in format specified by - type of address in integer format - see before - string type; alphanumeric representation of corresponding to the entry found in phonebook; used character . set should be the one selected with either +CSCS or @CSCS 0 - CLI valid 1 - CLI has been withheld by the originator 2 - CLI is not available due to in terworking problems or limitations of originating network Note: if parameter is omitted then network is not interrogated. Note: in the query command the class parameter must not be issued. Note: the difference between call waiting report disabling ( AT+CCWA = AT+CCWA = 0,0,7 ) is that in the 0,1,7 ) and call waiting service disabling ( first case the call waiting indication is sent to the device by network but this ; instead in the second case the call DTE last one does not report it to the page 74 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

75 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCWA - Call Waiting waiting indication is not generated by the network. Hence the device nd st results busy to the third party in the 2 case while in the 1 case a ringing indication is sent to the third party. has no effect a non sense and must Note: The command AT+CCWA=1,0 not be issued. Note: issuing AT+CCWA is the same as issuing the Read command. is the same as issuing the command AT+CCWA= Note: issuing . AT+CCWA=0 Read command reports the current value of the parameter . AT+CCWA? Test command reports the supported values for the parameter . AT+CCWA=? Reference GSM 07.07 3.5.2.3.12 +CHLD - Call Holding Services +CHLD - Call Holding Services Execution command controls the network call hold service. With this service AT+CHLD= it is possible to disconnect temporarily a call and keep it suspended while it is retained by the network, contemporary it is possible to connect another party or make a multiparty connection. Parameter: 0 - releases all held calls, or sets the UDUB (User Determined User Busy) indication for a waiting call. 1 - releases all active calls (if any exist), and accepts the other (held or waiting) call 1X - releases a specific active call X 2 - places all active calls (if any exist) on hold and accepts the other (held or waiting) call. 2X - places all active calls on hold except call X with which communication shall be supported 3 - adds an held call to the conversation Note: "X" is the numbering (starting with 1) of the call given by the sequence of setting up or receiving the calls (active, held or waiting) as seen by the served subscriber. Calls hold their num ber until they are released. New calls take the lowest available number. Note: where both a held and a waiting call exist, the above procedures apply to the waiting call (i.e. not to the held call) in conflicting situation. s . Test command returns the list of supported AT+CHLD=? page 75 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

76 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CHLD: (0,1,2,3) Note: consider what has been written about the Set command relating the actions on a specific call (X). Reference GSM 07.07 Note ONLY for VOICE calls Supplementary Service Data 3.5.2.3.13 +CUSD - Unstructured +CUSD - Unstructured Supplementary Service Data Set command allows control of the Unstructured Supplementary Service AT+CUSD[= Data (USSD [GSM 02.90]). [[, [,]]]] Parameters: - is used to disable/enable the presentation of an unsolicited result code. 0 - disable the result code presentation in the DTA 1 - enable the result code presentation in the DTA - USSD-string (when parameter is not given, network is not interrogated) - If indicates that GSM338 default alphabet is used ME/TA converts GSM alphabet into current TE character set (see +CSCS ) - If indicates that 8-bit data coding scheme is used: ME/TA converts each 8-bit octet into two IRA character long hexadecimal as two TE number; e.g. octet with integer value 42 is presented to characters 2A (IRA 50 and 65). - GSM 3.38 Cell Broadcast Data Coding Scheme in integer format (default is 0). is in the Note: the unsolicited result code enabled by parameter format: TE +CUSD: [,,] to the where: : 0 - no further user action required (network initiated USSD-Notify, or no further information needed after mobile initiated operation). 1 - further user action required (network initiated USSD-Request, or further information needed after mobile initiated operation) 2 - USSD terminated by the network 3 - other local client has responded 4 - operation not supported 5 - network time out page 76 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

77 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CUSD - Unstructured Supplementary Service Data Note: in case of successful mobile initiated operation, DTA waits the USSD response from the network and sends it to the before the final result DTE code. This will block the AT command interface for the period of the operation. AT+CUSD Note: issuing is the same as issuing the Read command. Note: issuing AT+CUSD= is the same as issuing the command AT+CUSD=0 . Read command reports the current value of the parameter AT+CUSD? Test command reports the supported values for the parameter AT+CUSD=? Reference GSM 07.07 Note Only mobile initiated operations are supported 3.5.2.3.14 +CAOC - Advice Of Charge +CAOC - Advice Of Charge Set command refers to the Advice of Charge supplementary service; the AT+CAOC[= command also includes the possibility to enable an unsolicited event []] reporting of the CCM (Call Cost Meter) information. Parameter: 0 - query CCM value 1 - disables unsolicited CCM reporting 2 - enables unsolicited CCM reporting is in the Note: the unsolicited result code enabled by parameter format: +CCCM: where: - call cost meter value hexadecimal representation (3 bytes) +CCCM is issued when the CCM value Note: the unsolicited result code changes, but not more than every 10 seconds. AT+CAOC is the same as issuing the Read command. Note: issuing page 77 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

78 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CAOC - Advice Of Charge AT+CAOC= is the same as issuing the command Note: issuing AT+CAOC=0 . in the format: Read command reports the value of parameter AT+CAOC? +CAOC: Test command reports the supported values for parameter. AT+CAOC=? Note: the representation format doesn’t match the v.25ter§5.7.3 “Information text formats for test commands”. The output is: +CAOC: 0, 1, 2 Reference GSM 07.07 Note +CAOC command uses the CCM of the device internal memory, not the CCM stored in the SIM. The difference is that the internal memory CCM is reset at power up, while the SIM CCM is reset only on user request. Advice of Charge values stored in the SIM (ACM, ACMmax, PUCT) can be +CAMM , . +CPUC and accessed with commands +CACM 3.5.2.3.15 +CLCC - List Current Calls +CLCC - List Current Calls Execution command returns the list of current calls and their characteristics AT+CLCC in the format: [+CLCC:,

,,,,, [+CLCC:,,,,,,[...]]] where: n > - call direction 0 - mobile originated call 1 - mobile terminated call - state of the call 0 - active 1 - held 2 - dialing ( MO call) 3 - alerting ( MO call) MT call) 4 - incoming ( call) MT 5 - waiting ( page 78 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

79 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLCC - List Current Calls - call type 0 - voice 1 - data 2 - fax 9 - unknown - multiparty call flag 0 - call is not one of multiparty (conference) call parties - phone number in format specified by - type of phone number byte in integer format 129 - national numbering scheme 145 - international numbering scheme (contains the character "+") message is sent. This command is Note: If no call is active then only OK useful in conjunction with command to know the various call status +CHLD for call holding. Reference GSM 07.07 3.5.2.3.16 +CSSN - SS Notification +CSSN - SS Notification It refers to supplementary service related network initiated notifications. AT+CSSN[= Set command enables/disables the presentation of notification result codes [[,]]] from TA to TE . Parameters: - sets the +CSSI result code presentation status 0 - disable 1 - enable - sets the +CSSU result code presentation status 0 - disable 1 - enable When =1 and a supplementary service notification is received after a mobile originated call setup, an unsolicited code: +CSSI: is sent to TE call setup result codes, where: MO before any other page 79 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

80 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSSN - SS Notification : 1 - some of the conditional call forwardings are active 2 - call has been forwarded 3 - call is waiting 5 - outgoing calls are barred 6 - incoming calls are barred When =1 and a supplementary service notification is received during a mobile terminated call setup or during a call, an unsolicited result code +CSSU: is sent to TE , where: : call setup) MT 0 - this is a forwarded call ( 2 - call has been put on hold (during a voice call) 3 - call has been retrieved (during a voice call) AT+CSSN is the same as issuing the Read command. Note: issuing Note: issuing is the same as issuing the command AT+CSSN= AT+CSSN=0 . Read command reports the current value of the parameters. AT+CSSN? Test command reports the supported range of values for parameters , AT+CSSN=? . Reference GSM 07.07 3.5.2.3.17 +CCUG - Closed User Gr oup Supplementary Service Control +CCUG - Closed User Group Supplementary Service Control Set command allows control of the Closed User Group supplementary AT+CCUG[= service [GSM 02.85]. [[, [,]]]] Parameters: 0 - disable CUG temporary mode (factory default). 1 - enable CUG temporary mode: it enables to control the CUG information on the air interface as a default adjustment for all following outgoing calls. 0..9 - CUG index 10 - no index (preferential CUG taken from subscriber data) (default) page 80 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

81 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 0 - no information (default) 1 - suppress Outgoing Access (OA) 2 - suppress preferential CUG 3 - suppress OA and preferential CUG AT+CCUG is the same as issuing the Read command. Note: issuing Note: issuing AT+CCUG= is the same as issuing the command AT+CCUG=0 . Read command reports the current value of the parameters AT+CCUG? Test command reports the supported range of values for the parameters AT+CCUG=? , , Reference GSM 07.07 page 81 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

82 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.4 Mobile Equipment Control 3.5.2.4.1 +CPAS - Phon e Activity Status +CPAS - Phone Activity Status Execution command reports the device status in the form: AT+CPAS +CPAS: Where: - phone activity status TA/TE ) 0 - ready (device allows commands from 1 - unavailable (device does not allow commands from TA/TE ) 2 - unknown (device is not guaranteed to respond to instructions) 3 - ringing (device is ready for commands from , but the ringer is TA/TE active) 4 - call in progress (device is ready for commands from TA/TE , but a call is in progress) Read command has the same effect as Execution command. AT+CPAS? Test command reports the supported range of values for . AT+CPAS=? +CPAS Note: although is an execution command, ETSI 07.07 requires the Test command to be defined. Example ATD03282131321; OK AT+CPAS +CPAS: 3 the called phone is ringing OK AT+CPAS +CPAS: 4 the called phone has answered to your call OK ATH OK Reference GSM 07.07 3.5.2.4.2 +CFUN - Set Phone Functionality +CFUN - Set Phone Functionality . ME Set command selects the level of functionality in the AT+CFUN= Parameter: - is the power saving function mode 0 - minimum functionality, NON-CYCL IC SLEEP mode: in this mode, the ou have set y level , once A T interface is not accessible. Conse q uentl y page 82 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

83 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 0, do not send further characters. Otherwise these characters remain in the input buffer and may delay the output of an unsolicited result code. The first wake-up event stops power saving and takes the ME back to full functionality level =1 . 1 - mobile full functionality with power saving disabled (factory default) 2 - disable TX 4 - disable either TX and RX 5 - mobile full functionality with power saving enabled Note: if power saving enabled, it reduces the power consumption during the idle time, thus allowing a longer standby time with a given battery capacity. Note: to place the telephone in power saving mode, set the parameter at value = 5 and the line DTR (RS232) must be set to OFF . Once OFF in power saving, the CTS line switch to the status to signal that the telephone is really in power saving condition. During the power saving condition, before sending any AT command on the serial line, the DTR must be enabled and it must be waited for the CTS (RS232) line to go in ON status. Until the line is , the telephone will not return back in the power ON DTR saving condition. Note: the power saving function does not affect the network behavior of the MODULE, even during the power save condition the module remains registered on the network and reachable for incoming calls or SMS. If a call arrives during the power save, then the module will wake up and proceed normally with the unsolicited incoming call code Read command reports the current level of functionality. AT+CFUN? Test command returns the list of supported values for AT+CFUN=? For compatibility with previous versions, Test command returns +CFUN: (1, 5) An enhanced version of Test command has been defined: AT+CFUN=?? , that provides the complete range of values for . Enhanced test command returns the list of supported values for AT+CFUN=?? Reference GSM 07.07 3.5.2.4.3 +CPIN - Enter PIN +CPIN - Enter PIN sends to the device a password which is necessary before it Set command AT+CPIN[= can be operated (SIM PIN, SIM PUK, PH-SIM PIN, etc.). [,]] If the PIN required is SIM PUK or SIM PUK2, the is required. This second pin, ,will replace the old pin in the SIM. The command may be used to change the SIM PIN by sending it with both p ; if no PIN g endin uest is p arameters < p in> and when PIN re q page 83 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

84 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN request is pending the command will return an error code and to change the PIN the command must be used instead. +CPWD Parameters: - string type value - string type value. To check the status of the PIN request use the command AT+CPIN? Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. Read command reports the PIN/PUK/PUK2 request status of the device in AT+CPIN? the form: +CPIN: where: - PIN/PUK/PUK2 request status code READY - ME is not pending for any password SIM PIN - ME is waiting SIM PIN to be given SIM PUK - ME is waiting SIM PUK to be given PH-SIM PIN - ME is waiting phone-to-SIM card password to be given PH-FSIM PIN - ME is waiting phone-to-very first SIM card password to be given PH-FSIM PUK - ME is waiting phone-to-very first SIM card unblocking password to be given SIM PIN2 - ME is waiting SIM PIN2 to be given; this is returned only when the last executed command resulted in PIN2 ) authentication failure (i.e. +CME ERROR: 17 SIM PUK2 - ME is waiting SIM PUK2 to be given; this is returned only when the last executed command resulted in PUK2 authentication failure (i.e. +CME ERROR: 18 ) PH-NET PIN - ME is waiting network personalization password to be given PH-NET PUK - ME is waiting network personalization unblocking password to be given PH-NETSUB PIN - ME is waiting network subset personalization password to be given PH-NETSUB PIN - ME is waiting network subset personalization unblocking password to be given PH-SP PIN - ME is waiting service provider personalization password to be given ice provider personalization unblocking PH-SP PUK - ME is waiting serv password to be given PH-CORP PIN - ME is waiting corporate personalization password to be given PH-CORP PUK - ME is waiting corporate personalization unblocking password to be given page 84 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

85 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN Note: Pin pending status at startup depends on PIN facility setting, to change or query the default power up setting use either the AT+CLCK=SC,, command or the [email protected]=SC,, command. AT+CMEE=1 Example OK AT+CPIN? +CME ERROR: 10 error: you have to insert the SIM AT+CPIN? y ou inserted the SIM and device is not +CPIN: READY waiting for PIN to be given OK Note What follows is a list of the commands which are accepted when ME is pending SIM PIN or SIM PUK A #SRP #CAMOFF +IPR #CAP #CAMEN +ICF D #CODEC #TPHOTO +IFC H O #CBC #RPHOTO +CMUX E #SELCAM +CNMI #I2S1 I #STM #CAMQUA +CPAS L #SHFEC #CMODE +CCLK +CALA M #SHFSD #CAMRES #CAMTXT #HFMICG P +CRSM Q #HSMICG #CAMZOOM +CLIP #CAMCOL #GPIO +DR S #OBJL +DS T #SGPO #OBJR +MS #GGPI V #ADC #COPSMODE +GCAP X #QTEMP +GCI #DIALMODE Z #DAC #SEMAIL +ILRR &C #F26M #EMAILD +CALM &D #EUSER #RTCSTAT +CHUP &F &K #ACAL +FCLASS #EPASSW #PCT +FMI &N #ESMTP #WAKE #EADDR &P +FMM &S #SHDN #EMAILMSG +FMR &V #JDR #ESAV +FTS &W #ERST +FRS #CSURV &Y #CSURVC #QSS +FTM &Z #CSURVU #SSCTRACE +FRM +CFUN %E #CSURVUC +FRH %L +FTH +CGMI #CSURVF page 85 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

86 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN %Q #CSURVNLF +CGMM +FLO \K #CSURVB +CGMR +FPR +FDD \Q #CSURVBC +GMI \R +GMM +CSNS #PASSW \V #PKTSZ +GMR +CRLP #BND #SKTSAV +CGSN +CR #AUTOBND #SKTSET +GSN +CREG #CGMI #SKTOP +CRC +CGREG #CGMM #SKTTO +CMEE +COPS +CBC #CGMR #USERID +CPIN +CIND +CSQ #DSTO #CGSN #MONI #SKTCT +CSDH +CMER #SERVINFO #SKTRST +CRSL #SELINT +CLVL #FTPPUTPH #SRS #CAMON +CMUT All the above commands, but the ones in the grayed cells, can be issued even if the SIM card is not inserted yet. Reference GSM 07.07 3.5.2.4.4 +CSQ - Signal Quality +CSQ - Signal Quality Execution command reports received signal quality indicators in the form: AT+CSQ +CSQ:, where - received signal strength indication 0 - (-113) dBm or less 1 - (-111) dBm 2..30 - (-109)dBm..(-53)dBm / 2 dBm per step 31 - (-51)dBm or greater 99 - not known or not detectable - bit error rate (in percent) 0 - less than 0.2% 1 - 0.2% to 0.4% 2 - 0.4% to 0.8% 3 - 0.8% to 1.6% 4 - 1.6% to 3.2% 5 - 3.2% to 6.4% 6 - 6.4% to 12.8% 7 - more than 12.8% page 86 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

87 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSQ - Signal Quality 99 - not known or not detectable Note: this command should be used instead of the %Q and %L commands, since GSM relevant parameters are the radio link ones and no line is and have no meaning. %Q %L present, hence Read command has the same effect as Execution command. AT+CSQ? Test command returns the supported range of values of the parameters AT+CSQ=? and . Note: although +CSQ is an execution command, ETSI 07.07 requires the Test command to be defined. Reference GSM 07.07 3.5.2.4.5 +CIND - Indicator Control +CIND - Indicator Control Set command is used to control the registration / deregistration of ME AT+CIND[= , whenever the +CIEV URC indicators, in order to automatically send the [ value of the associated indicator changes. The supported indicators [,[,...]]]] ( ) and their order appear from test command AT+CIND=? Parameter: - registration / deregistration state 0 - the indicator is deregistered; it cannot be presented as unsolicited result code ( +CIEV URC ), but can be directly queried with AT+CIND? 1 - indicator is registered: indicator event report is allowed; this is the factory default for every indicator Note: issuing AT+CIND causes the read command to be executed Note: issuing AT+CIND= causes all the indicators to be registered, as the command AT+CIND=1,1,1,1,1,1,1,1,1 was issued. Read command returns the current value status of ME indicators, in the AT+CIND? format: +CIND: [,[,...]] Note: the order of the values s is the same as that in which appear the supported indicators from test command AT+CIND=? returns pairs, where string value is a description Test command AT+CIND=? (max. 16 chars) of the indicator and compound value is the supported values for the indicator, in the format: +CIND: (, (list of supported s))[,(, (list of supported s))[,...]] Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 87 of 614

88 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 where: - indicator names as follows (along with their ranges) “battchg” - battery charge level - battery charge level indicator range 0..5 99 - not measurable “signal” - signal quality - signal quality indicator range 0..7 99 - not measurable “service” - service availability - service availability indicator range 0 - not registered to any network 1 - registered to home network “sounder” - sounder activity - sounder activity indicator range 0 - there’s no any sound activity 1 - there’s some sound activity “message” - message received - message received indicator range 0 - there is no unread short message at memory location “SM” 1 - unread short message at memory location “SM” “call” - call in progress - call in progress indicator range 0 - there’s no calls in progress 1 - at least a call has been established “roam” - roaming - roaming indicator range 0 - registered to home network or not registered 1 - registered to other network “smsfull” - a short message memory storage in the MT has become full (1), or memory locations are available (0) - short message memory storage indicator range 0 - memory locations are available 1 - a short message memory storage in the MT has become full. “rssi” - received signal (field) strength - received signal strength level indicator range 0 - signal strength 112 dBm ≤ page 88 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

89 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 1..4 - signal strength in 15 dBm steps ≥ 51 dBm 5 - signal strength 99 - not measurable Next command causes all the indicators to be registered Example AT+CIND=1,1,1,1,1,1,1,1,1 Next command causes all the indicators to be de- registered AT+CIND=0,0,0,0,0,0,0,0,0 Next command to query the current value of all indicators AT+CIND? CIND: 4,0,1,0,0,0,0,0,2 OK Note See command +CMER Reference GSM 07.07 3.5.2.4.6 +CMER - Mobile Equipment Event Reporting +CMER - Mobile Equipment Event Reporting Set command enables/disables sending of unsolicited result codes from AT+CMER[= TA to TE in the case of indicator state changes (n.b.: sending of URCs in [ the case of key pressings or display changes are currently not [, implemented). [, [, Parameters: [,]]]]]] - controls the processing of unsolicited result codes 0 - discard +CIEV Unsolicited Result Codes . 1 - discard +CIEV Unsolicited Result Codes when TA-TE link is reserved (e.g. on-line data mode); otherwise forward them directly to the TE. 2 - buffer +CIEV Unsolicited Result Codes in the TA when TA-TE link is reserved (e.g. on-line data mode) and flush them to the TE after reservation; otherwise forward them directly to the TE. +CIEV Unsolicited Result Codes 3 - forward directly to the TE; when TA (100 Break is replaced with a is in on-line data mode each +CIEV URC ms), and is stored in a buffer; onche the ME goes into command mode +++ was entered), all URCs stored in the buffer will be output. (after - keypad event reporting 0 - no keypad event reporting - display event reporting 0 - no display event reporting - indicator event reporting 0 - no indicator event reporting 1 - indicator event reporting page 89 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

90 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMER - Mobile Equipment Event Reporting Note: issuing AT+CMER causes the read command to be executed Note: issuing AT+CMER= causes the command AT+CMER=0,0,0,0,0 to be issued. Read command returns the current setting of parameters, in the format: AT+CMER? +CMER: ,,,, Test command returns the range of supported values for parameters AT+CMER=? , , , , , in the format: +CMER: (list of supported s),(list of supported s), (list of supported s),(list of supported s),(list of supported s) Reference GSM 07.07 Phonebook Memory Storage 3.5.2.4.7 +CPBS - Select +CPBS - Select Phonebook Memory Storage Set command selects phonebook memory storage , which will be AT+CPBS used by other phonebook commands. [=] Parameter: "SM" - SIM phonebook "FD" - SIM fixed dialling-phonebook (only phase 2/2+ SIM) "LD" - SIM last-dialling-phonebook ( +CPBW and +CPBF are not applicable for this storage) "MC" - device missed (unanswered received) calls list (+CPBW and +CPBF are not applicable for this storage) +CPBW +CPBF are not applicable for "RC" - ME received calls list ( and this storage) Note: If parameter is omitted then Set command has the same behaviour as Read command. Read command returns the actual values of the parameter , the AT+CPBS? and the maximum index number number of occupied records , in the format: +CPBS: ,, Note: For =”MC” : if there are more than one missed calls from the same number the read command will return only the last call Test command returns the supported range of values for the parameters AT+CPBS=? . page 90 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

91 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Note: the presentation format of the Test command output is the set of available values for , each of them enclosed in parenthesis: +CPBS: ("SM"),("FD"),("LD"),("MC"),("RC") Reference GSM 07.07 3.5.2.4.8 +CPBR - Read Phonebook Entries +CPBR - Read Phonebook Entries Execution command returns phonebook entries in location number range AT+CPBR= .. from the current phonebook memory storage selected +CPBS is omitted, only location is returned. with . If [,] Parameters: - integer type value in the range of location numbers of phonebook memory - integer type value in the range of location numbers of phonebook memory The response format is: +CPBR: ,,, where: - the current position number of the PB index (to see the range of values use +CPBR=? ) - the phone number stored in the format - type of phone number byte in integer format 129 - national numbering scheme 145 - international numbering scheme (contains the character "+") - the alphanumeric text associated to the number; used character set should be the one selected with either command +CSCS or @CSCS . Note: If all queried locations are empty (but available), no information text lines will be returned, while if listing fails in an ME error, +CME ERROR: is returned. Test command returns the supported range of values of the parameters in AT+CPBR=? the form: +CPBR: ( - ),, where: - the minimum number, integer type number, integer type - the maximum - maximum field length, integer type page 91 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

92 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - maximum field length, integer type Note command before issuing Remember to select the PB storage with +CPBS PB commands. Reference GSM 07.07 3.5.2.4.9 +CPBF - Find Phonebook Entries +CPBF - Find Phonebook Entries Execution command issues a search for the phonebook records that have AT+CPBF= the sub-string at the start of the field Parameter: - string type, it is NOT case sensitive; used character set should +CSCS or @CSCS . be the one selected with either command The command returns a report in the form: +CPBF: ,,,[[...] +CPBF: ,,,] > have the same meaning , and where as in the command +CPBR report. ERROR message Note: if no PB records satisfy the search criteria then an is reported. Test command reports the maximum lengths of fields and AT+CPBF=? in the PB entry in the form: +CPBF: [],[] Note Remember to select the PB storage with +CPBS command before issuing PB commands. Reference GSM 07.07 3.5.2.4.10 Write Phonebook Entry +CPBW - +CPBW - Write Phonebook Entry a phonebook record Execution command stores at the position AT+CPBW= defined by and parameters , [] [, Parameters: [, - record position [,]]] - string type, phone number in the format page 92 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

93 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - the type of number 129 - national numbering scheme 145 - international numbering scheme (contains the character "+") - the text associated to the number, string type; used character set should be the one selected with either command +CSCS or @CSCS . Note: If record number already exists, it will be overwritten. is given, the record number Note: if only is deleted. Note: if is omitted, the number is stored in the first free phonebook location. result code. ERROR Note: omission of all the subparameters causes an returns location range supported by the current storage as Test command AT+CPBW=? field supported a compound value, the maximum length of number format of the storage and maximum length of field. The format is: +CPBW: (list of supported s),[], (list of supported s),[] where: - integer type value indicating the maximum length of field - integer type value indicating the maximum length of field Reference GSM 07.07 Note Remember to select the PB storage with +CPBS command before issuing PB commands. 3.5.2.4.11 +CCLK - Clock Management +CCLK - Clock Management Set command sets the real-time clock of the ME. AT+CCLK [=

94 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 ss - seconds (two last digits are mandatory), range is 00..59 ±zz - time zone (indicates the difference, expressed in quarter of an hour, between the local time and GMT; two last digits are mandatory), range is -47..+48 Note: If the parameter is omitted the behaviour of Set command is the same as Read command. Read command returns the current setting of the real-time clock, in the AT+CCLK? .

95 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CALA - Alarm Management The device keeps on sending the unsolicited code every 3s until a or #WAKE command is received or a 90s timeout occurs. If the #SHDN device is in "alarm mode" and it does not receive the #WAKE command within 90s then it shuts down. (default) 3 - the MODULE wakes up in "alarm mode" if at the alarm time it was off, otherwise it remains fully operative. In both cases the MODULE starts playing the alarm tone on the selected path for the ringer (see command #SRP ) #SHDN or The device keeps on playing the alarm tone until a #WAKE ccurs. If the device is in "alarm command is received or a 90s timeout o mode" and it does not receive the #WAKE command within 90s then it shuts down. 4 - the MODULE wakes up in "alarm mode" if at the alarm time it was off, otherwise it remains fully operative. In both cases the MODULE brings the pin GPIO6 high, provided its has been set to alarm #WAKE or #SHDN command is output, and keeps it in this state until a received or a 90s timeout occurs. If the device is in "alarm mode" and it does not receive the #WAKE command within 90s then it shuts down. and 5 - the MODULE will make both the actions as for =2 . =3 =2 and 6 - the MODULE will make both the actions as for =4 . 7 - the MODULE will make both the actions as for =3 and =4 . - unsolicited alarm code text string. It has meaning only if is equal to 2 or 5 or 6. CTS to the ON status Note: The "alarm mode" is indicated by hardware pin and DSR to the OFF status, while the "power saving" status is indicated by a CTS - OFF and DSR - OFF status. The normal operating status is indicated by DSR - ON . During the "alarm mode" the device will not make any network scan and will not register to any network and therefore is not able to dial or receive any call or SMS, the only commands that can be issued to the MODULE in this state are the #WAKE and #SHDN , every other command must not be issued during this state. Note: If the parameter is omitted the behaviour of Set command is the same as Read command. Read command reports the current alarm time stored in the internal Real AT+CALA? Time Clock, if present, in the format: +CALA:

96 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CALA - Alarm Management s , and maximum length AT+CALA="02/09/07,23:30:00+00" Example OK Reference GSM 07.07 3.5.2.4.13 +CRSM - Restricted SIM Access +CRSM - Restricted SIM Access AT+CRSM= and the SIM ME Execution command transmits to the interface its required parameters. ME handles internally all SIM-ME [, es. As response to the command, ME locking and file selection routin [,,, sends the actual SIM informati on parameters and response data. [,]]] Parameters: - command passed on by the ME to the SIM 176 - READ BINARY 178 - READ RECORD 192 - GET RESPONSE 214 - UPDATE BINARY 220 - UPDATE RECORD 242 - STATUS - identifier of an elementary datafile on SIM. Mandatory for every command except STATUS. - parameter passed on by the to the SIM; they ME , , are mandatory for ever y command except GET RESPONSE and STATUS 0..255 - information to be read/written to the SIM (hexadecimal character format). The response of the command is in the format: +CRSM: ,[,] where: - information from the SIM , about the execution of the actual command either on successful or on failed Reproduction forbidden without Telit Communications S.p.A. page 96 of 614 written authorization - All Right reserved

97 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CRSM - Restricted SIM Access execution. - on a successful completion of the command previously issued it gives the reques ted data (hexadecimal character format). It’s not returned after a successful UPDATE BINARY or UPDATE RECORD command. Note: this command requires PIN authentication. However commands READ BINARY and READ RECORD can be issued before PIN he SIM is blocked (after three failed PIN authentication and if t authentication attempts) to access the contents of the Elementary Files. Note: use only decimal numbers for parameters , . , , and Test command returns the result code OK AT+CRSM=? GSM 07.07, GSM 11.11 Reference 3.5.2.4.14 +CALM - Alert Sound Mode +CALM - Alert Sound Mode Set command is used to select the general alert sound mode of the device. AT+CALM[= ] Parameter: 0 - normal mode 1 - silent mode; no sound will be generated by the device, except for alarm sound 2 - stealth mode; no sound will be generated by the device Note: if silent mode is selected then incoming calls will not produce alerting sounds but only the unsolicited messages RING . +CRING or Note: If parameter is omitted then the behaviour of Set command is the same as Read command. Read command returns the current value of parameter . AT+CALM? Test command returns the supported values for the parameter as AT+CALM=? compound value. For compatibility with previous versions, Test command returns +CALM: (0,1) AT+CALM=?? , An enhanced version of Test command has been defined: . that provides the complete range of values for page 97 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

98 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Enhanced test command returns the complete range of values for the AT+CALM=?? as compound value: parameter +CALM: (0-2) Reference GSM 07.07 3.5.2.4.15 +CRSL - Ringer Sound Level +CRSL - Ringer Sound Level Set command is used to select the incoming call ringer sound level of the AT+CRSL[= device. ] Parameter: - ringer sound level 0 - Off 1 - low 2 - middle 3 - high 4 - progressive Note: if parameter is omitted then the behaviour of Set command is the same as Read command Read command reports the current setting of the call ringer in the AT+CRSL? format: +CRSL: Test command reports supported values as compound value. AT+CRSL=? For compatibility with previous versions, Test command returns +CRSL: (0-3) AT+CRSL=?? , An enhanced version of Test command has been defined: that provides the complete range of values for . Enhanced Test command returns the complete range of supported values AT+CRSL=?? : for the parameter +CRSL: (0-4) Reference GSM 07.07 +CLVL - Loudspeaker Volume Level 3.5.2.4.16 +CLVL - Loudspeaker Volume Level Set command is used to select the volume of the internal louds eaker audio p AT+CLVL[= page 98 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

99 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 output of the device. ] Parameter: - loudspeaker volume max 0.. can be read by issuing the Test command max - the value of AT+CLVL=? Note: If the parameter is omitted the behavior of Set command is the same as Read command. Read command reports the current setting of the loudspeaker AT+CLVL? volume in the format: +CLVL: Test command reports supported values range in the format: AT+CLVL=? +CLVL: (0- ) max Reference GSM 07.07 3.5.2.4.17 +CMUT - Microphone Mute Control +CMUT - Microphone Mute Control Set command enables/disables the muting of the microphone audio line AT+CMUT[=[]] during a voice call. Parameter: 0 - mute off, microphone active (factory default) 1 - mute on, microphone muted. Note: this command mutes/activates both microphone audio paths, internal mic and external mic. is the same as issuing the Read command. AT+CMUT Note: issuing Note: issuing AT+CMUT= is the same as issuing the command AT+CMUT=0 . Read command reports whether the muting of the microphone audio line AT+CMUT? during a voice call is enabled or not, in the format: +CMUT: Test command reports the supported values for parameter. AT+CMUT=? Reference GSM 07.07 cumulated Call Meter 3.5.2.4.18 +CACM - Ac page 99 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

100 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CACM - Accumulated Call Meter Set command resets the Advice of Charge related Accumulated Call Meter AT+CACM[= in SIM (ACM). Internal memory CCM remains unchanged. ] Parameter: - to access this command PIN2 password is required Note: If the parameter is omitted the behavior of Set command is the same as Read command. Read command reports the current value of the SIM ACM in the format: AT+CACM? +CACM: Note: the value is in units whose price and currency is defined with +CPUC command Reference GSM 07.07 3.5.2.4.19 +CAMM - Accumu lated Call Meter Maximum +CAMM - Accumulated Call Meter Maximum Set command sets the Advice of Charge related Accumulated Call Meter AT+CAMM[= command). This value +CACM ACM maximum value in SIM (see also , represents the maximum number of home units allowed to be consumed by ] value further calls are the subscriber. When ACM reaches prohibited. SIM PIN2 is required to set the value. Parameter: - maximum number of units allowed to be consumed - PIN2 password =0 value disables the feature. Note: The Note: if the parameters are omitted the behavior of Set command is the same as Read command. Read command reports the maximum value of ACM stored in SIM in the AT+CAMM? format: +CAMM : Reference GSM 07.07 r Unit and Currency Table 3.5.2.4.20 +CPUC - Price pe +CPUC - Price Per Unit And Currency Table Set command sets the values of Advice of Charge related price per unit and AT+CPUC[= page 100 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

101 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 currency table in SIM. The price per unit currency table information can be , used to convert the home units (as used in commands +CAOC , +CACM ,] and +CAMM ) into currency units. Parameters: - string type; three-character currency code (e.g. LIT, USD, DEM etc..); used character set should be the one selected or +CSCS with either command . @CSCS - price per unit string (dot is used as decimal separator) e.g. 1989.27 - SIM PIN2 is usually required to set the values Note: if the parameters are omitted the behavior of Set command is the same as Read command. and Read command reports the current values of AT+CPUC? parameters in the format: +CACM : , Reference GSM 07.07 3.5.2.4.21 +CCID - Read ICCID (Integ rated Circuit Card Identification) +CCID - Read ICCID (Integrated Circuit Card Identification) Execution command reads on SIM the ICCID (card identification number AT+CCID that provides a unique identification number for the SIM) Read command has the same effect as Execution command. AT+ CCID? . OK Test command reports AT+CCID=? page 101 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

102 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.5 Mobile Equipment Errors 3.5.2.5.1 +CMEE - Report Mobile Equipment Error +CMEE - Report Mobile Equipment Error Set command enables/disables the report of result code: AT+CMEE[=[]] +CME ERROR: as an indication of an error relating to the +Cxxx commands issued. When enabled, device related errors cause the final result +CME ERROR: code instead of the default ERROR final result code. ERROR is anyway returned normally when the error message is related to syntax, invalid parameters, or DTE functionality. Parameter: - enable flag ERROR reports, use only +CME ERROR: 0 - disable report. in numeric format +CME ERROR: reports, with 1 - enable +CME ERROR: 2 - enable reports, with in verbose format is the same as issuing the Read command. AT+CMEE Note: issuing Note: issuing AT+CMEE= is the same as issuing the command AT+CMEE=0 . Read command returns the current value of subparameter AT+CMEE? +CMEE: Test command returns the range of values for subparameter in the format: AT+CMEE=? +CMEE: 0, 1, 2 Note: the representation format of the Test command output is not included in parenthesis. Reference GSM 07.07 page 102 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

103 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.6 Voice Control 3.5.2.6.1 +VTS - DTMF Tones Transmission +VTS - DTMF Tones Transmission Execution command allows the transmission of DTMF tones. AT+VTS= Parameters: [,duration] (0-9), i.e. ASCII characters in the set s, - string of #,*,(A-D) ; it allows the user to send a sequence of DTMF tones, each of them with a duration that was defined through +VTD command. - duration of a tone in 1/100 sec.; this parameter can be specified only if the length of first parameter is just one ASCII character 0 - a single DTMF tone will be transmitted for a duration depending on the setting is. network, no matter what the current +VTD 1..255 - a single DTMF tone will be transmitted for a time (in setting is. +VTD 10 ms multiples), no matter what the current +FCLASS Note: this commands operates in voice mode only (see ). For compatibility with previous versions, Test command returns AT+VTS=? +VTS: (),(),() An enhanced version of Test command has been defined: AT+VTS=?? , that provides the correct range of values for . Test command provides the list of supported s and the list of AT+VTS=?? supported s in the format: (list of supported s)[,(list of supported s)] Reference GSM 07.07 and TIA IS-101 3.5.2.6.2 +VTD - Tone Duration +VTD - Tone Duration Set command sets the length of tones transmitted with +VTS command. AT+VTD[= ] Parameter: - duration of a tone 0 - the duration of every single tone is dependent on the network (factory default) 1..255 - duration of every single tone in 1/10 sec. Note: If parameter is omitted the behaviour of Set command is the same as Read command. Read command reports the current Tone Duration, in the format: AT+VTD? Test command provides the list of supported in the format: s AT+VTD=? page 103 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

104 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 (list of supported s) GSM 07.07 and TIA IS-101 Reference page 104 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

105 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.7 Commands For GPRS Mobile Station Class 3.5.2.7.1 +CGCLASS - GPRS +CGCLASS - GPRS Mobile Station Class Set command sets the GPRS class according to parameter. AT+CGCLASS [=] Parameter: - GPRS class “B” - GSM/GPRS (factory default) “CG” - class C in GPRS only mode (GPRS only) “CC” - class C in circuit switched only mode (GSM only) Note: the setting is saved in NVM (and available on following reboot). Note: if parameter is omitted, then the behaviour of Set command is the same as Read command. Read command returns the current value of the GPRS class in the format: AT+CGCLASS? +CGLASS: Test command reports the range for the parameter AT+CGCLASS=? 3.5.2.7.2 +CGATT - GPRS Attach Or Detach +CGATT - GPRS Attach Or Detach Execution command is used to attach the terminal to, or detach the terminal AT+CGATT[= . from, the GPRS service depending on the parameter ] Parameter: - state of GPRS attachment 0 - detached 1 - attached Note: If the parameter is omitted the behaviour of Execution command is the same as Read command. Read command returns the current GPRS service state. AT+CGATT? Test command requests information on the supported GPRS service states. AT+CGATT=? Example AT+CGATT? +CGATT: 0 OK AT+CGATT=? +CGATT: (0,1) OK AT+CGATT=1 page 105 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

106 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGATT - GPRS Attach Or Detach OK Reference GSM 07.07 3.5.2.7.3 +CGREG - GPRS Network Registration Status +CGREG - GPRS Network Registration Status Set command controls the presentation of an unsolicited result code AT+CGREG[= : (see format below). +CGREG []] Parameter: - result code presentation mode 0 - disable network registration unsolicited result code 1 - enable network registration unsolicited result code; if there is a change in the terminal GPRS network registration status, it is issued the unsolicited result code: +CGREG: where: - registration status 0 - not registered, terminal is not currently searching a new operator to register to 1 - registered, home network 2 - not registered, but terminal is currently searching a new operator to register to 3 - registration denied 4 - unknown 5 - registered, roaming 2 - enable network registration and location information unsolicited result code; if there is a change of the network cell, it is issued the unsolicited result code: +CGREG: [,,] where: - registration status (see above for values) - location area code in hexadecimal format (e.g. "00C3" equals 195 in decimal) - cell ID in hexadecimal format Note: issuing AT+CGREG is the same as issuing the Read command. AT+CGREG= the command g is the same as issuin g Note: issuin page 106 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

107 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGREG - GPRS Network Registration Status AT+CGREG=0 . and Read command returns the status of result code presentation mode AT+CGREG? the integer which shows whether the network has currently indicated the registration of the terminal in the format: . +CGREG:, Test command returns supported values for parameter AT+CGREG=? Reference GSM 07.07 3.5.2.7.4 +CGDCONT - Define PDP Context +CGDCONT - Define PDP Context Set command specifies PDP context parameter values for a PDP context AT+CGDCONT[= identified by the (local) context identification parameter, [ [, Parameters: [, - (PDP Context Identifier) numeric parameter which specifies a [, particular PDP context definition. [, - where the value of max 1.. max is returned by the Test command [, - (Packet Data Protocol type) a string parameter which [, specifies the type of packet data protocol [,...[,pdN]]]]]]]]]] "IP" - Internet Protocol "PPP" - Point to Point Protocol - (Access Point Name) a string parameter which is a logical name that is used to select the GGSN or the external packet data network. If the value is null or omitted, then the subscription value will be requested. - a string parameter that identifies the terminal in the address space applicable to the PDP. The allocated address may be +CGPADDR command. read using the - numeric parameter that controls PDP data compression 0 - off (default if value is omitted) 1 - on - numeric parameter that controls PDP header compression 0 - off (default if value is omitted) 1 - on , ..., - zero to N string parameters whose meanings are specific to the , causes the Note: a special form of the Set command, +CGDCONT= values for context number to become undefined. Note: issuing is the same as issuing the Read AT+CGDCONT command. Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 107 of 614

108 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGDCONT - Define PDP Context returns the result code. AT+CGDCONT= Note: issuing OK Read command returns the current settings for each defined context in the AT+CGDCONT? format: +CGDCONT: , ,,,, [,[,...[,pdN]]][+CGDCONT: ,,,,, [,[,...[,pdN]]][...]] Test command returns values supported as a compound value AT+CGDCONT=? AT+CGDCONT=1,”IP”, ”APN” ,”10.10.10.10”,0,0 Example OK AT+CGDCONT? +CGDCONT: 1,”IP”,“ ,”10.10.10.10”,0,0 APN” OK AT+CGDCONT=? +CGDCONT: (1-5),”IP”,,,(0-1),(0-1) OK Reference GSM 07.07 3.5.2.7.5 +CGQMIN - Quality Of Serv ice Profile (Minimum Acceptable) +CGQMIN - Quality Of Service Profile (Minimum Acceptable) Set command allows to specify a minimum acceptable profile which is AT+CGQMIN[= checked by the terminal against the negotiated profile returned in the [ Activate PDP Context Accept message. [, [, Parameters: [, command). - PDP context identification (see +CGDCONT [, - precedence class [,]]]]]]] - delay class - reliability class - peak throughput class - mean throughput class If a value is omitted for a particular class then this class is not checked. Note: a special form of the Set command, +CGQMIN= causes the to become undefined. requested profile for context number Note: issuing AT+CGQMIN is the same as issuing the Read command. page 108 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

109 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGQMIN - Quality Of Service Profile (Minimum Acceptable) result code. OK Note: issuing AT+CGQMIN= returns the Read command returns the current settings for each defined context in the AT+CGQMIN? format: +CGQMIN: ,,,,, [+CGQMIN: ,, ,,,[...]] If no PDP context has been defined, it has no effect and result code is OK returned. Test command returns as a compound value the type of the current PDP AT+CGQMIN=? context and the supported values for the subparameters in the format: +CGQMIN: ,(list of supported s), (list of supported s),(list of supported s), (list of supported s),(list of supported s) Note: only the “IP” PDP_Type is currently supported. Example AT+CGQMIN=1,0,0,3,0,0 OK AT+CGQMIN? +CGQMIN: 1,0,0,5,0,0 OK AT+CGQMIN=? +CGQMIN: “IP”,(0-3),(0-4),(0-5),(0-9),(0-19,31) OK GSM 07.07; GSM 03.60 Reference 3.5.2.7.6 +CGQREQ - Quality Of Service Profile (Requested) +CGQREQ - Quality Of Service Profile (Requested) Set command allows to specify a Quality of Service Profile that is used AT+CGQREQ[= when the terminal sends an Activate PDP Context Request message to the [ network. It specifies a profile for the context identified by the (local) context [, . identification parameter, [, [, Parameters: [, - PDP context identification (see command). +CGDCONT [,]]]]]]] - precedence class - delay class - reliability class - peak throughput class - mean throughput class page 109 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

110 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGQREQ - Quality Of Service Profile (Requested) If a value is omitted for a particular class then this class is not checked. +CGQREQ= Note: a special form of the Set command, causes the requested profile for context number to become undefined. is the same as issuing the Read Note: issuing AT+CGQREQ command. Note: issuing AT+CGQREQ= returns the OK result code. Read command returns the current settings for each defined context in the AT+CGQREQ? format: +CGQREQ: ,,,,, [+CGQREQ: ,, ,,,[...]] If no PDP context has been defined, it has no effect and OK result code is returned. Test command returns as a compound value the type of the current PDP AT+CGQREQ=? context and the supported values for the subparameters in the format: +CGQREQ: ,(list of supported s), (list of supported s),(list of supported s), (list of supported s),(list of supported s) Note: only the “IP” PDP_Type is currently supported. Example AT+CGQREQ? +CGQREQ: 1,0,0,3,0,0 OK AT+CGQREQ=1,0,0,3,0,0 OK AT+CGQREQ=? +CGQREQ: ”IP”,(0-3),(0-4),(0-5),(0-9),(0-19,31) OK Reference GSM 07.07; GSM 03.60 3.5.2.7.7 +CGACT - PDP Context Activate Or Deactivate +CGACT - PDP Context Activate Or Deactivate Execution command is used to activate or deactivate the specified PDP AT+CGACT[= context(s) [[, [,[,...]]]]] page 110 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

111 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Parameters: - indicates the state of PDP context activation 0 - deactivated 1 - activated - a numeric parameter which specifies a particular PDP context definition (see +CGDCONT command) Note: if no s are specified the activation/deactivation form of the command activates/deactivates all defined contexts. Note: issuing AT+CGACT is the same as issuing the Read command. Note: issuing returns the AT+CGACT= result code. OK Read command returns the current activation state for all the defined PDP AT+CGACT? contexts in the format: +CGACT: ,[+CGACT: ,[...]] Test command reports information on the supported PDP context activation AT+CGACT=? states parameters in the format: +CGACT: (0-1) Example AT+CGACT? +CGACT: 1,1 OK AT+CGACT=1,1 OK Reference GSM 07.07 3.5.2.7.8 +CGPADDR - Show PDP Address +CGPADDR - Show PDP Address Execution command returns a list of PDP addresses for the specified AT+CGPADDR= context identifiers in the format: [[, [,...]]] +CGPADDR: ,[ +CGPADDR: ,[...]] Parameters: - a numeric parameter which specifies a particular PDP context is specified, the +CGDCONT command). If no definition (see addresses for all defined contexts are returned. - a string that identifies the terminal in the address space applicable to the PDP. The address may be static or dynamic. For a static address, it will be the one set by the page 111 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

112 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGPADDR - Show PDP Address command when the context was defined. For a +CGDCONT dynamic address it will be the one assigned during the last PDP context activation that used the context definition referred to by ; is omitted if none is available s. Test command returns a list of defined AT+CGPADDR=? Example AT#GPRS=1 +IP: xxx.yyy.zzz.www OK AT+CGPADDR=1 +CGPADDR: 1,”xxx.yyy.zzz.www” OK AT+CGPADDR=? +CGPADDR: (1) OK Reference GSM 07.07 3.5.2.7.9 +CGDATA - Enter Data State +CGDATA - Enter Data State Execution command causes to perform whatever actions are necessary to AT+CGDATA= establish a communication with the network using one or more GPRS PDP [,[ types. [,[,...]]]] Parameters: - string parameter that indicates the layer 2 protocol to be used "PPP" - PPP Point-to-point protocol - numeric parameter which specifies a particular PDP context definition (see +CGDCONT command). Note: if parameter is omitted, the layer 2 protocol is unspecified Test command reports information on the supported layer 2 protocols. AT+CGDATA=? Note: the representation format of the Test command output is not included in parenthesis AT+CGDATA=? Example +CGDATA: ”PPP” OK AT+CGDATA=”PPP”,1 OK page 112 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

113 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGDATA - Enter Data State Reference GSM 07.07 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 113 of 614

114 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.2.8 Commands For Battery Charger 3.5.2.8.1 +CBC - Battery Charge +CBC - Battery Charge Execution command returns the current Battery Charge status in the format: AT+CBC +CBC: , where: - battery charge status 0 - ME is powered by the battery 1 - ME has a battery connected, and charger pin is being powered 2 - ME does not have a battery connected 3 - Recognized power fault, calls inhibited - battery charge level 0 - battery is exhausted, or ME does not have a battery connected 25 - battery charge remained is estimated to be 25% 50 - battery charge remained is estimated to be 50% 75 - battery charge remained is estimated to be 75% 100 - battery is fully charged. indicates that the battery charger supply is inserted and the =1 Note: battery is being recharged if necessary with it. Supply for operations is ME taken anyway from VBATT pins. Note: without battery/power connected on VBATT pins or during a power fault the unit is not working, therefore values =2 and =3 will never appear. Read command has the same effect as Execution command. AT+CBC? Test command returns parameter values supported as a compound value. AT+CBC=? For compatibility with previous versions, Test command returns +CBC: (0-2),(0-100) AT+CBC=?? An enhanced version of Test command has been defined: , that provides the complete range of values for and . is an execution command, ETSI 07.07 requires the +CBC Note: although Test command to be defined. Enhanced test command returns the complete range of values for AT+CBC=?? : and +CBC: (0-3),(0-100) AT+CBC Example +CBC: 0,75 page 114 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

115 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CBC - Battery Charge OK Note The ME does not make differences between being powered by a battery or by a power supply on the VBATT pins, so it is not possible to distinguish between these two cases. Reference GSM 07.07 page 115 of 614 written authorization - All Right reserved Reproduction forbidden without Telit Communications S.p.A.

116 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.3 ETSI GSM 07.05 AT Commands for SMS and CBS 3.5.3.1 General Configuration ct Message Service 3.5.3.1.1 +CSMS - Sele +CSMS - Select Message Service . It returns the types of Set command selects messaging service AT+CSMS ME : messages supported by the [=] Parameter: 0 - The syntax of SMS AT commands is compatible with GSM 07.05 Phase 2 version 4.7.0 (factory default) 1 - The syntax of SMS AT commands is compatible with GSM 07.05 Phase 2+. Set command returns current service setting along with the types of messages supported by the ME: +CSMS: ,,, where: - mobile terminated messages support 0 - type not supported 1 - type supported - mobile originated messages support 0 - type not supported 1 - type supported - broadcast type messages support 0 - type not supported 1 - type supported Note: If parameter is omitted then the behavior of Set command is the same as Read command. Read command reports current service setting along with supported AT+CSMS? message types in the format: +CSMS: ,,, where: - messaging service (see above) - mobile terminated messages support (see above) - mobile originated messages support (see above) - broadcast type messages support (see above) Test command re orted b pp the device. the y p orts a list of all services su AT+CSMS=? page 116 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

117 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSMS - Select Message Service supported value of the parameter . Reference GSM 07.05; GSM 03.40; GSM 03.41 3.5.3.1.2 +CPMS - Preferred Message Storage +CPMS - Preferred Message Storage and , Set command selects memory storages AT+CPMS[= to be used for reading, writing, sending and storing SMs. [, Parameters: [,]]] - memory from which messages are read and deleted "SM" - SIM SMS memory storage "ME" - ME internal storage (read only, no delete) - memory to which writing and sending operations are made "SM" - SIM SMS memory storage - memory to which received SMs are preferred to be stored "SM" - SIM SMS memory storage The command returns the memory storage status in the format: +CPMS: ,,,,, where - number of SMs stored into - max number of SMs that can contain - number of SMs stored into max number of SMs that can contain - number of SMs stored into can contain - max number of SMS that Note: The only supported memory storage for writing and sending SMs is . the SIM internal memory "SM", so =="SM" Note: the received class 0 SMS are stored in the "ME" memory regardless the setting and they are automatically deleted at power off. Note: If all parameters are omitted the behavior of Set command is the same as Read command. Read command reports the message storage status in the format: AT+CPMS? +CPMS: ,,,,,, ,, page 117 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

118 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPMS - Preferred Message Storage , where are the selected storage memories and for reading, writing and storing respectively. , Test command reports the supported values for parameters AT+CPMS=? and Example AT+CPMS? +CPMS: "SM",5,10,"SM",5,10,"SM",5,10 you have 5 out of 10 SMS SIM positions occupied OK Reference GSM 07.05 3.5.3.1.3 +CMGF - Message Format +CMGF - Message Format Set command selects the format of messages used with send, list, read and AT+CMGF[= write commands. []] Parameter: 0 - PDU mode, as defined in GSM 3.40 and GSM 3.41 (factory default) 1 - text mode Note: issuing AT+CMGF is the same as issuing the Read command. Note: issuing AT+CMGF= is the same as issuing the command AT+CMGF=0 . . Read command reports the current value of the parameter AT+CMGF? parameter. Test command reports the supported value of AT+CMGF=? Reference GSM 07.05 page 118 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

119 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.3.2 Message Configuration 3.5.3.2.1 +CSCA - Service Center Address +CSCA - Service Center Address Set command sets the Service Center Address to be used for mobile AT+CSCA[= originated SMS transmissions. [ [,]]] Parameter: - SC phone number in the format defined by - the type of number 129 - national numbering scheme 145 - international numbering scheme (contains the character "+") Note: to use the SM service, is mandatory to set a Service Center Address at which service requests will be directed. Note: in Text mode, this setting is used by send and write commands; in PDU mode, setting is used by the same commands, but only when the parameter equals zero. length of the SMSC address coded into the is the same as issuing the Read command. AT+CSCA Note: issuing AT+CSCA= causes an OK result code to be issued. Note: issuing Read command reports the current value of the SCA in the format: AT+CSCA? +CSCA: , Note: if SCA is not present the device reports an error message. Test command returns the OK result code. AT+ CSCA=? Reference GSM 07.05 3.5.3.2.2 +CSMP - Set T ext Mode Parameters +CSMP - Set Text Mode Parameters Set command is used to select values for additional parameters for storing AT+CSMP[= (+CMGF=1 and sending SMs when the text mode is used ) [ [, Parameters: [, - depending on the command or result code: [,]]]]] first octet of GSM 03.40 SMS-DELIVER, SMS-SUBMIT (default 17), SMS-STATUS-REPORT, or SMS-COMMAND (default 2) in integer format. - depending on SMS-SUBMIT setting: page 119 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

120 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSMP - Set Text Mode Parameters GSM 03.40 TP-Validity-Period either in integer format (default 167) or in quoted time-string format - GSM 03.40 TP-Protocol-Identifier in integer format. - depending on the command or result code: GSM 03.38 SMS Data Coding Scheme (default 0), or Cell Broadcast Data Coding Scheme is the same as issuing the Read command. Note: issuing AT+CSMP Note: issuing is the same as issuing the command AT+CSMP= AT+CSMP=0 . Read command reports the current setting in the format: AT+CSMP? +CSMP: < fo>,,, , , Test command reports the supported range of values for AT+CSMP=? parameters. and Set the parameters for an outgoing message with 24 hours Example of validity period and default properties: AT+CSMP=17,167,0,0 OK Reference GSM 07.05; GSM 03.40; GSM 03.38 3.5.3.2.3 +CSDH - Show Text Mode Parameters +CSDH - Show Text Mode Parameters Set command controls whether detailed header information is shown in text AT+CSDH[= mode (+CMGF=1 ) result codes. []] Parameter: 0 - do not show header values defined in commands +CSCA and +CSMP ( , , , , and ) nor , result codes for SMS-DELIVERs +CMGR +CMT or , in +CMGL , and SMS-SUBMITs in text m ode. For SMS-COMMANDs in +CMGR , result code do not show , , or , 1 - show the values in result codes is the same as issuing the Read command. Note: issuing AT+CSDH AT+CSDH= is the same as issuing the command Note: issuing . AT+CSDH=0 Read command reports the current setting in the format: AT+CSDH? page 120 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

121 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSDH - Show Text Mode Parameters +CSDH: Test command reports the supported range of values for parameter AT+CSDH=? Reference GSM 07.05 3.5.3.2.4 +CSCB - Select Cell Broadcast Message Types +CSCB -Select Cell Broadcast Message Types Set command selects which types of Cell Broadcast Messages are to be AT+CSCB[= received by the device. [ [, Parameter: [,]]]] 0 - the message types defined by and are accepted (factory default) and are rejected 1 - the message types defined by - Message Identifiers, string type: all different possible combinations of the CBM message identifiers; default is empty string (“”). - Data Coding Schemes, string type: all different possible combinations of CBM data coding schemes; default is empty string (“”). Note: issuing AT+CSCB is the same as issuing the Read command. Note: issuing AT+CSCB= is the same as issuing the command AT+CSCB=0 . , Read command reports the current value of parameters AT+CSCB? and . Test command returns the range of values for parameter . AT+CSCB=? AT+CSCB? Example +CSCB: 1,"","" OK (all CBMs are accepted, none is rejected) AT+CSCB=0,"0,1,300-315,450","0-3" OK GSM 07.05, GSM 03.41, GSM 03.38. Reference page 121 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

122 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.3.2.5 +CSAS - Save Settings +CSAS - Save Settings Execution command saves settings +CSC which have been made by the A AT+CSAS commands in local non volatile memory. +CSMP and +CSCB [=] Parameter: 0 - it saves the settings to NVM (factory default). 1..n - SIM profile number; the value of n depends on the SIM and its max is 3. Note: certain settings may not be supported by the SIM and therefore they . are always saved to NVM, regardless the value of Note: If parameter is omitted the settings are saved in the non volatile memory. Read command has the same effect as Execution command with parameter AT+CSAS? omitted. Test command returns the possible range of values for the parameter AT+CSAS=? . Reference GSM 07.05 3.5.3.2.6 +CRES - Restore Settings +CRES - Restore Settings +CSAS Execution command restores message service settings saved by AT+CRES command from either NVM or SIM. [=] Parameter: 0 - it restores message service settings from NVM. 1..n - it restores message service settings from SIM. The value of n depends on the SIM and its max is 3. Note: certain settings may not be supported by the SIM and therefore they are always restored from NVM, regardless the value of . Note: If parameter is omitted the command restores message service settings from NVM. Read command has the same effect as Execution command with parameter AT+CRES? omitted. Test command returns the possible range of values for the parameter AT+CRES=? . Reference GSM 07.05 page 122 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

123 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.3.3 Message Receiving And Reading 3.5.3.3.1 +CNMI - New Message Indi cations To Terminal Equipment +CNMI - New Message Indications To Terminal Equipment Set command selects the behaviour of the device on how the receiving of AT+CNMI[=[ new messages from the network is indicated to the DTE . [, [,[, Parameter: [,]]]]]] - unsolicited result codes buffering option TA . If TA result code buffer is full, 0 - Buffer unsolicited result codes in the indications can be buffered in some other place or the oldest indications may be discarded and replaced with the new received indications. 1 - Discard indication and reject new received message unsolicited result TA-TE codes when link is reserved, otherwise forward them directly to the . TE 2 - Buffer unsolicited result codes in the TA in case the DTE is busy and flush them to the TE after reservation. Otherwise forward them directly . TE to the is set to 1 an indication via 100 ms break is issued when a SMS 3 - if is received while the module is in GPRS online mode. It enables the hardware ring line for 1 s. too. - result code indication reporting for SMS-DELIVER 0 - No SMS-DELIVER indications are routed to the TE . 1 - If SMS-DELIVER is stored into ME/TA , indication of the memory using the following unsolicited result code: location is routed to the TE +CMTI: , where: - memory storage where the new message is stored "SM" "ME" - location on the memory where SM is stored. 2 - SMS-DELIVERs (except class 2 messages and messages in the message waiting indication group) are routed directly to the TE using the following unsolicited result code: (PDU Mode) +CMT: , where: - alphanumeric representation of originator/destination number corresponding to the entry found in MT phonebook - PDU length - PDU message (TEXT Mode) ,,,< [ ha>, id>,, p p +CMT:,

124 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment (the information written in ,,] +CSDH last setting) italics will be present depending on where: - originator address number ; used - alphanumeric representation of or character set should be the one selected with either command or @CSCS . +CSCS - arrival time of the message to the SC , - type of number or : 129 - number in national format 145 - number in international format (contains the "+") - first octet of GSM 03.40 - Protocol Identifier - Data Coding Scheme - Service Centre number - text length - TP-User-Data Class 2 messages and messages in the message waiting indication group (stored message) result in indication as defined in . =1 3 - Class 3 SMS-DELIVERs are routed directly to TE using unsolicited result codes defined in =2 . Messages of other data coding schemes result in indication as defined in . =1 - broadcast reporting option 0 - Cell Broadcast Messages are not sent to the DTE 2 - New Cell Broadcast Messages are sent to the DTE with the unsolicited result code: (PDU Mode) +CBM: where: - PDU length - message PDU (TEXT Mode) +CBM:,,,, where: - message serial number - message ID - Data Coding Scheme - page number - total number of pages of the message - CBM Content of Message - SMS-STATUS-REPORTs reporting option DTE 0 - status report receiving is not reported to the page 124 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

125 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment 1 - the status report is sent to the DTE with the following unsolicited result code: (PDU Mode) +CDS: where: - PDU length - message PDU (TEXT Mode) +CDS: ,,,,,

, where: - first octet of the message PDU - message reference number - arrival time of the message to the SC - sending time of the message
- message status as coded in the PDU 2 - if a status report is stored, then the following unsolicited result code is sent: +CDSI: , where: - memory storage where the new message is stored "SM" - location on the memory where SM is stored - buffered result codes handling method: 0 - TA buffer of unsolicited result codes defined within this command is flushed to the TE when =1..3 is entered ( OK response shall be given before flushing the codes) 1 - TA buffer of unsolicited result codes defined within this command is =1..3 is entered. cleared when is the same as issuing the Read command. AT+CNMI Note: issuing is the same as issuing the command Note: issuing AT+CNMI= . AT+CNMI=0 Read command returns the current parameter settings for +CNMI command AT+CNMI? in the form: +CNMI: ,,,, +CNMI Test command reports the supported range of values for the AT+CNMI=? command parameters. For compatibility with previous versions, Test command returns: ,(0-3),(0,2),(0-2),(0,1) +CNMI: (0-2) page 125 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

126 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment An enhanced version of Test command has been defined: , AT+CNMI=?? that provides the complete range of values for parameter . Enhanced test command reports the supported range of values for all the AT+CNMI=?? +CNMI command parameters. Reference GSM 07.05 is Note DTR signal is ignored, hence the indication is sent even if the DTE signal is Low). In this case the unsolicited result code may be inactive ( DTR lost so if MODULE remains active while DTE is not, at DTE startup is suggested to check whether new messages have reached the device AT+CMGL=0 that lists the new messages meanwhile with command received. 3.5.3.3.2 +CMGL - List Messages +CMGL - List Messages Execution command reports the list of all the messages with status value AT+CMGL stored into message storage ( is the message [=] storage for read and delete SMs as last settings of command +CPMS ). The parameter type and the command output depend on the last settings of command +CMGF (message format to be used) (PDU Mode) Parameter: 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent 4 - all messages. Each message to be listed is represented in the format: +CMGL: ,, where - message position in the memory storage list. - status of the message - length of the PDU in bytes - message in PDU format according to GSM 3.40 (Text Mode) Parameter: page 126 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

127 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGL - List Messages "REC UNREAD" - new message "REC READ" - read message "STO UNSENT" - stored message not yet sent "STO SENT" - stored message already sent "ALL" - all messages. Each message to be listed is represented in the format (the information +CSDH last setting): written in italics will be present depending on +CMGL: ,, ,,[,,] where - message position in the storage - message status - originator/destination number - type of number 129 - number in national format 145 - number in international format (contains the "+") - text length - TP-User-Data : Each message delivery confirm is represented in the format +CMGL: ,,,,,,,

, where - message position in the storage - message status - first octet of the message PDU - message reference number - arrival time of the message to the SC - sending time of the message
- message status as coded in the PDU result code is sent at the end of the listing. Note: OK Note: If parameter is omitted the command returns the list of sms with “REC UNREAD” status. Read command has the same effect as Execution command with parameter AT+CMGL? omitted s Test command returns a list of supported AT+CMGL=? ) the Test command output is not included in (+CMGF=1 Note If Text Mode parenthesis AT+CMGL=? +CMGL: "REC UNREAD","REC READ","STO UNSENT", page 127 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

128 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGL - List Messages "STO SENT","ALL" @CMGL has been defined Note The improving command Reference GSM 07.05 3.5.3.3.3 @CMGL - List Messages @CMGL - List Messages Execution command reports the list of all the messages with status value [email protected] is the message stored into message storage ( [=] ). storage for read and delete SMs as last settings of command +CPMS The parameter type and the command output depend on the last settings of (message format to be used) +CMGF command (PDU Mode) Parameter: 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent 4 - all messages. Each message to be listed is represented in the format: @CMGL: ,, where - message position in the memory storage list. - status of the message - length of the PDU in bytes - message in PDU format according to GSM 3.40 (Text Mode) Parameter: "REC UNREAD" - new message "REC READ" - read message "STO UNSENT" - stored message not yet sent "STO SENT" - stored message already sent "ALL" - all messages. Each message to be listed is represented in the format (the information written in italics will be present depending on +CSDH last setting): page 128 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

129 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @CMGL - List Messages [,,] @CMGL: ,,,, where - message position in the storage - message status - originator/destination number - type of number 129 - number in national format 145 - number in international format (contains the "+") - text length - TP-User-Data Each message delivery confirm is represented in the format : @CMGL: ,,,,,,,

, where - message position in the storage - message status - first octet of the message PDU - message reference number - arrival time of the message to the SC
- sending time of the message - message status as coded in the PDU because at the end of the Note: The command differs from the +CMGL result code. is put before the OK listing a Note: If parameter is omitted the command returns the list of sms with “REC UNREAD” status. Read command has the same effect as Execution command with parameter [email protected]? omitted Test command returns a list of supported s [email protected]=? Note If Text Mode (+CMGF=1 ) the Test command output is not included in parenthesis [email protected]=? @CMGL: "REC UNREAD","REC READ","STO UNSENT", "STO SENT","ALL" Reference GSM 07.05 page 129 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

130 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.3.3.4 +CMGR - Read Message +CMGR - Read Message Execution command reports the message with location value from AT+CMGR= message storage ( is the message storage for read and +CPMS ). delete SMs as last settings of command Parameter: - message index. The output depends on the last settings of command (message +CMGF format to be used) (PDU Mode) The output has the following format: +CMGR: , where - status of the message 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent - length of the PDU in bytes. - message in PDU format according to GSM 3.40. The status of the message and entire message data unit is returned. (Text Mode) Output format for received messages (the information written in italics will last setting): +CSDH be present depending on +CMGR: ,,, [,,,,,, ,] Output format for sent messages: +CMGR: ,, [,,,,,, ,,] Output format for message delivery confirm: +CMGR: ,,,,,,

, where: - status of the message "REC UNREAD" - new received message unread "REC READ" - received message read page 130 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

131 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGR - Read Message "STO UNSENT" - message stored not yet sent "STO SENT" - message stored already sent - first octet of the message PDU - message reference number - arrival time of the message to the SC

- sending time of the message - message status as coded in the PDU - Protocol Identifier - Data Coding Scheme - Originator address number - Destination address number - Service Centre number , , , - type of number , 129 - number in national format 145 - number in international format (contains the "+") - text length - TP-User_data Note: in both cases if status of the message is 'received unread', status in the storage changes to 'received read'. Note: an error result code is sent on empty record . result code. Test command returns the OK AT+CMGR=? Note The improving command @CMGR has been defined Reference GSM 07.05 3.5.3.3.5 @CMGR - Read Message @CMGR - Read Message Execution command reports the message with location value from [email protected]= message storage ( is the message storage for read and delete SMs as last settings of command +CPMS ). Parameter: - message index. The output depends on the last settings of command +CMGF (message format to be used) (PDU Mode) The output has the following format: @CMGR: , where - status of the message page 131 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

132 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @CMGR - Read Message 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent - length of the PDU in bytes. - message in PDU format according to GSM 3.40. The status of the message and entire message data unit is returned. (Text Mode) Output format for received messages (the information written in italics will last setting): be present depending on +CSDH @CMGR: ,,, [,,,,,, ,] Output format for sent messages: [,,,,,, @CMGR: ,, ,,] Output format for message delivery confirm: @CMGR: ,,,,,,

, where: - status of the message "REC UNREAD" - new received message unread "REC READ" - received message read "STO UNSENT" - message stored not yet sent "STO SENT" - message stored already sent - first octet of the message PDU - message reference number - arrival time of the message to the SC
- sending time of the message - message status as coded in the PDU - Protocol Identifier - Data Coding Scheme - Originator address number - Destination address number - Service Centre number , , - type of number , , 129 - number in national format 145 - number in international format (contains the "+") - text length - message text page 132 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

133 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @CMGR - Read Message Note: the command differs from the +CMGR because after the message a result code. OK is put before the or Note: in both cases if status of the message is 'received unread', status in the storage changes to 'received read'. Note: an error result code is sent on empty record . Test command has no effect; the answer is OK [email protected]=? Reference GSM 07.05 page 133 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

134 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.3.4 Message Sending And Writing 3.5.3.4.1 +CMGS - Send Message +CMGS - Send Message (PDU Mode) (PDU Mode) Execution command sends to the network a message. AT+CMGS= Parameter: - length of the PDU to be sent in bytes. 7..164 The device responds to the command with the prompt '>' and waits for the specified number of bytes. char (0x1A hex). Ctrl-Z To send the message issue ESC char (0x1B hex). To exit without sending the message issue If message is successfully sent to the network, then the result is sent in the format: +CMGS: where - message reference number. Note: if message sending fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, which may take several seconds, no other SIM interacting commands are issued. (Text Mode) (Text Mode) Execution command sends to the network a message. AT+CMGS= [,] Parameters: - destination address number. - type of destination address 129 - number in national format 145 - number in international format (contains the "+") The device responds to the command with the prompt '>' and waits for message text (max 160 characters). Ctrl-Z char (0x1A hex). To send the message issue ESC char (0x1B hex). To exit without sending the message issue If message is successfully sent to the network, then the result is sent in the format: page 134 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

135 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGS - Send Message +CMGS: where - message reference number. Note: if message sending fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, which may take several seconds, no other SIM interacting commands are issued. Note To avoid malfunctions is suggested to wait for the +CMGS: or +CMS response before issuing further commands. ERROR: Reference GSM 07.05 3.5.3.4.2 +CMSS - Send Message From Storage +CMSS - Send Message From Storage Execution command sends to the network a message which is already AT+CMSS= ) at the location . stored in the storage (see +CPMS [, [,]] Parameters: - location value in the message storage of the message to send - destination address; if it is given it shall be used instead of the one stored with the message. - type of destination address 129 - number in national format 145 - number in international format (contains the "+") If message is successfully sent to the network then the result is sent in the format: +CMSS: where: - message reference number. If message sending fails for some reason, an error code is reported: +CMS ERROR: . storage see command +CMGW Note: to store a message in the Note: care must be taken to ensure that during the command execution, which may take several seconds, no other SIM interacting commands are issued. page 135 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

136 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMSS - Send Message From Storage or +CMSS: Note To avoid malfunctions is suggested to wait for the +CMS response before issuing further commands. ERROR: Reference GSM 07.05 3.5.3.4.3 +CMGW - Writ e Message To Memory +CMGW - Write Message To Memory (PDU Mode) (PDU Mode) Execution command writes in the memory storage a new AT+CMGW= message. [,] Parameter: - length in bytes of the PDU to be written. 7..164 - message status. 0 - new message 1 - read message 2 - stored message not yet sent (default) 3 - stored message already sent The device responds to the command with the prompt '>' and waits for the specified number of bytes. To write the message issue Ctrl-Z char (0x1A hex). To exit without writing the message issue ESC char (0x1B hex). If message is successfully written in the memory, then the result is sent in the format: +CMGW: where: - message location index in the memory . If message storing fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, no other SIM interacting commands are issued. (Text Mode) (Text Mode) Execution command writes in the memory storage a new AT+CMGW[=[, message. [,]]] Parameters: - destination address number. "REC UNREAD" - new received message unread "REC READ" - received message read page 136 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

137 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGW - Write Message To Memory "STO UNSENT" - message stored not yet sent (default) "STO SENT" - message stored already sent - type of destination address. 129 - number in national format 145 - number in international format (contains the "+") - message status. The device responds to the command with the prompt '>' and waits for the message text (max 160 characters). Ctrl-Z char (0x1A hex). To write the message issue To exit without writing the message issue ESC char (0x1B hex). If message is successfully written in the memory, then the result is sent in the format: +CMGW: where: . - message location index in the memory If message storing fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, no other SIM interacting commands are issued. Reference GSM 07.05 +CMGW: Note To avoid malfunctions is suggested to wait for the or +CMS ERROR: response before issuing further commands. 3.5.3.4.4 +CMGD - Delete Message +CMGD - Delete Message the message(s). Execution command deletes from memory AT+CMGD= Parameter: [,] - message index in the selected storage - an integer indicating multiple message deletion request. 0 (or omitted) - delete message specified in storage, leaving unread 1 - delete all read messages from messages and stored mobile originated messages (whether sent or not) untouched storage and sent mobile 2 - delete all read messages from originated messages, leaving unread messages and unsent mobile originated messages untouched 3 - delete all read messages from storage, sent and unsent mobile originated messages, leaving unread messages untouched page 137 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

138 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGD - Delete Message 4 - delete all messages from storage. is ignored and is present and not set to 0 then Note: if ME shall follow the rules for shown above. Note: if the location to be deleted is empty, an error message is reported. Test command shows the valid memory locations and optionally the AT+CMGD=? supported values of . +CMGD: (list of supported s)[,(list of supported s)] AT+CMGD=? Example +CMGD: (1,2,3,6,7,17,18,19,20,37,38,39,47),(0-4) OK Reference GSM 07.05 page 138 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

139 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.4 FAX Class 1 AT Commands 3.5.4.1 General Configuration NOTE: All the test command results are without command echo 3.5.4.1.1 +FMI - Manufacturer ID +FMI - Manufacturer ID Read command reports the manufacturer ID. The output depends on the AT+FMI? command. #SELINT choice made through AT+FMI? Example Telit_Mobile_Terminals OK Reference ITU T.31 and TIA/EIA-578-A specifications 3.5.4.1.2 +FMM - Model ID +FMM - Model ID Read command reports the model ID AT+FMM? Reference ITU T.31 and TIA/EIA-578-A specifications 3.5.4.1.3 +FMR - Revision ID +FMR - Revision ID Read command reports the software revision ID AT+FMR? ITU T.31 and TIA/EIA-578-A specifications Reference page 139 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

140 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.4.2 Transmission/Reception Control Transmission And Pause 3.5.4.2.1 +FTS - Stop +FTS - Stop Transmission And Pause Execution command causes the modem to terminate a transmission and AT+FTS=

141 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.4.2.4 +FRM - Receive Data Modulation +FRM - Receive Data Modulation Execution command causes the module to receive facsimile data using the AT+FRM= modulation defined by the parameter . Parameter: - carrier modulation 24 - V27ter/2400 bps 48 - V27ter/4800 bps 72 - V29/7200 bps 96 - V29/9600 bps Test command returns all supported values of the parameter . AT+FRM=? Note: the output is not bracketed ITU T.31 and TIA/EIA-578-A specifications Reference 3.5.4.2.5 +FTH - Transmit Data With HDLC Framing +FTH - Transmit Data With HDLC Framing Execution command causes the module to transmit facsimile data using AT+FTH= HDLC protocol and the modulation defined by the parameter . Parameter: - carrier modulation 3 - V21/300 bps Test command returns all supported values of the parameter . AT+FTH=? ITU T.31 and TIA/EIA-578-A specifications Reference 3.5.4.2.6 +FRH - Receive Data With HDLC Framing +FRH - Receive Data Data With HDLC Framing to receive facsimile data using Execution command causes the module AT+FRH= HDLC protocol and the modulation defined by the parameter . Parameter: - carrier modulation 3 - V21/300 bps . Test command returns all supported values of the parameter AT+FRH=? ITU T.31 and TIA/EIA-578-A specifications Reference page 141 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

142 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.4.3 Serial Port Control 3.5.4.3.1 +FLO - Select Flow Control Specified By Type +FLO - Select Flow Control Specified By Type Set command selects the flow control behaviour of the serial port in both AT+FLO= directions: from DTE to DTA and from DTA to DTE . Parameter: - flow control option for the data on the serial port 0 - flow control None 1 - flow control Software ( ) XON-XOFF CTS-RTS 2 - flow control Hardware ( ) – (factory default) Note: This command is a shortcut of the +IFC command. Note: +FLO’s settings are functionally a subset of &K’s ones. Read command returns the current value of parameter AT+FLO? Test command returns all supported values of the parameter . AT+FLO=? Reference ITU T.31 and TIA/EIA-578-A specifications 3.5.4.3.2 +FPR - Select Serial Port Rate +FPR - Select Serial Port Rate DTE Set command selects the the serial port speed in both directions, from AT+FPR= DTE DTA and from DTA to to . When autobauding is selected, then the speed is detected automatically. Parameter: - serial port speed selection 0 - autobauding Read command returns the current value of parameter AT+FPR? . Test command returns all supported values of the parameters AT+FPR=? Reference ITU T.31 and TIA/EIA-578-A specifications Character Replacement Control 3.5.4.3.3 +FDD - Double Escape +FDD - Double Escape Character Replacement Control pair to encode Set command concerns the use of the AT+FDD= consecutive escape characters ( ) in user data. <10h><10h> Parameter 0 - currently the only available value. The DCE decode of is either or discard. The DCE encode of <10h><10h> is Read command returns the current value of parameter AT+FDD? . Test command returns all supported values of parameter AT+FDD=? ITU T.31 and TIA/EIA-578-A specifications Reference page 142 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

143 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5 Custom AT Commands 3.5.5.1 General Configuration AT Commands 3.5.5.1.1 #CGMI - Manufacturer Identification #CGMI - Manufacturer Identification Execution command returns the device manufacturer identification code AT#CGMI with command echo. The output depends on the choice made through #SELINT command. Read command has the same effect as the Execution command AT#CGMI? 3.5.5.1.2 #CGMM - Model Identification #CGMM - Model Identification Execution command returns the device model identification code with AT#CGMM command echo. Read command has the same effect as the Execution command AT#CGMM? 3.5.5.1.3 #CGMR - Revision Identification #CGMR - Revision Identification Execution command returns device software revision number with AT#CGMR command echo. Read command has the same effect as the Execution command AT#CGMR? 3.5.5.1.4 #CGSN - Product Se rial Number Identification #CGSN - Product Serial Number Identification Execution command returns the product serial number, identified as the AT#CGSN IMEI of the mobile, with command echo. Read command has the same effect as the Execution command AT#CGSN? ile Subscriber Identity (IMSI) 3.5.5.1.5 #CIMI - International Mob #CIMI - International Mobile Subscriber Identity (IMSI) Execution command returns the international mobile subscriber identity, AT#CIMI identified as the IMSI number, with command echo. Read command has the same effect as the Execution command AT#CIMI? page 143 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

144 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.1.6 #CAP - Change Audio Path #CAP - Change Audio Path Set command switches the active audio path depending on parameter AT#CAP[=[]] Parameter: - audio path 0 - audio path follows the Axe input (factory default): if Axe is low, handsfree is enabled; if Axe is high, internal path is enabled 1 - enables handsfree external mic/ear audio path 2 - enables internal mic/ear audio path Note: The audio path are mutually exclusive, enabling one disables the other. Note: when changing the audio path, the volume level is set at the previously stored value for that audio path (see +CLVL ). Note: issuing AT#CAP is the same as issuing the Read command. is the same as issuing the command AT#CAP= Note: issuing . AT#CAP=0 reports the active audio path in the format: Read command AT#CAP? . #CAP: Test command reports the supported values for the parameter . AT#CAP=? 3.5.5.1.7 #SRS - Select Ringer Sound #SRS - Select Ringer Sound Set command sets the ringer sound. AT#SRS[= ,] Parameters: - ringing tone 0 - current ringing tone 1.. max - ringing tone number, where max can be read by issuing the Test command . AT#SRS=? - ringing tone playing time-out in seconds. 0 - ringer is stopped (if present) and current ringer sound is set. 1..60 - ringer sound playing for seconds and, if > 0, ringer sound is set as default ringer sound. > 0 and > 0 , the Note: when the command is issued with page 144 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

145 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SRS - Select Ringer Sound ringing tone is played for seconds and stored as default ringing tone. = 0 and > 0 , the playing of the Note: if command is issued with ringing tone is set as current. ringing is stopped (if present) and Note: if command is issued with and = 0 > 0 then the current ringing tone is played. then the default ringing tone is set as are and Note: if both 0 current and ringing is stopped. Note: If all parameters are omitted then the behaviour of Set command is the same as Read command Read command reports current selected ringing and its status in the form: AT#SRS? #SRS: , where: - ringing tone number 1.. max - ringing status 0 - selected but not playing 1 - currently playing and Test command reports the supported values for the parameters AT#SRS=? 3.5.5.1.8 #SRP -Select Ringer Path #SRP - Select Ringer Path Set command selects the ringer path towards whom sending ringer sounds AT#SRP[=[]] and all signalling tones. Parameter: - ringer path number 0 - sound output towards current selected audio path (see command #CAP ) 1 - sound output towards handsfree 2 - sound output towards handset 3 - sound output towards Buzzer Output pin GPIO7 Note: In order to use the Buzzer Output an external circuitry must be added to drive it properly from the GPIO7 pin, furthermore the GPIO7 pin direction must be set to Buzzer output (Alternate function); see command #GPIO . page 145 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

146 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SRP - Select Ringer Path is the same as issuing the Read command. Note: issuing AT#SRP AT#SRP= is the same as issuing the command Note: issuing AT#SRP=0 . Read command reports the selected ringer path in the format: AT#SRP? . #SRP: Test command reports the supported values for the parameter . AT#SRP=? AT#SRP=? Example #SRP: (0-3) OK AT#SRP=3 OK 3.5.5.1.9 #STM - Signaling Tones Mode #STM - Signaling Tones Mode Set command enables/disables the signalling tones output on the audio AT#STM #SRP command path selected with [=] Parameter: - signalling tones status 0 - signalling tones disabled 1 - signalling tones enabled has Note: AT#STM=0 has the same effect as [email protected]=2 ; AT#STM=1 the same effect either as [email protected]=0 . or AT+CALM=0 Note: If parameter is omitted then the behaviour of Set command is the same as Read command Read command reports whether the current signaling tones status is AT#STM? enabled or not, in the format: #STM: Test command reports supported range of values for parameter . AT#STM=? #PCT - Display PIN Counter 3.5.5.1.10 #PCT - Display PIN Counter Execution command reports the PIN/PUK or PIN2/PUK2 input remaining AT#PCT attempts, depending on requested password in the format: +CPIN #PCT: page 146 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

147 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 where: - remaining attempts 0 - the SIM is blocked. 1..3 - if the device is waiting either SIM PIN or SIM PIN2 to be given. 1..10 - if the device is waiting either SIM PUK or SIM PUK2 to be given. Read command has the same behaviour as Execution command. AT#PCT? 3.5.5.1.11 #SHDN - Software Shut Down #SHDN - Software Shutdown Execution command causes device detach from the network and shut AT#SHDN response is returned. down. Before definitive shut down an OK Note: after the issuing of this command any previous activity is terminated and the device will not respond to any further command. Note: to turn it on again Hardware pin ON/OFF must be tied low. Read command has the same behaviour as Execution command. AT#SHDN? ke From Alarm Mode 3.5.5.1.12 #WAKE - Wa #WAKE - Wake From Alarm Mode present alarm activity and, if the Execution command stops any eventually AT#WAKE[= module is in alarm mode , it exits the alarm mode and enters the normal ] operating mode . Parameter: - operating mode 0 - normal operating mode; the module exits the alarm mode , enters the , any alarm activity is stopped (e.g. alarm tone normal operating mode playing) and an OK result code is returned. Note: if parameter is omitted, the command returns the operating status of the device in the format: #WAKE: where: 0 - normal operating mode 1 - alarm mode or normal operating mode with some alarm activity. Note: the power saving status is indicated by a CTS - OFF and DSR - OFF . normal operating status is indicated by DSR - ON status. The page 147 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

148 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #WAKE - Wake From Alarm Mode Note: during the alarm mode the device will not make any network scan and will not register to any network and therefore is not able to dial or receive any call or SM, the only commands that can be issued to the , every other command #SHDN and MODULE in this state are the #WAKE must not be issued during this state. Read command has the same effect as Execution command when AT#WAKE? parameter is omitted. 3.5.5.1.13 #QTEMP -Query Temperature Overflow #QTEMP - Query Temperature Overflow Set command has currently no effect. The interpretation of parameter AT#QTEMP is currently not implemented: any value assigned to it will simply [=] have no effect. is omitted the behaviour of Set command is the Note: if parameter same as Read command temperature sensor for over Read command queries the device internal AT#QTEMP? temperature and reports the result in the format: #QTEMP: where - over temperature indicator 0 - the device temperature is in the working range 1 - the device temperature is out of the working range . Test command reports supported range of values for parameter #QTEMP=? Note The device should not be operated out of its working temperature range; if temperature is out of range proper functioning of the device is not ensured. 3.5.5.1.14 #SGPO - Set General Purpose Output #SGPO - Set General Purpose Output . Set command sets the value of the general purpose output pin GPIO2 AT#SGPO[= []] Parameter: 0 - output pin cleared to 0 ( LOW ) ) 1 - output pin set to 1 ( HIGH Note: the GPIO2 is an OPEN COLLECTOR output, the command sets the transistor base level, hence the open collector output is negated: AT#SGPO=0 sets the open collector output HIGH LOW AT#SGPO=1 sets the open collector output GPIO2 . A pull up resistor is required on pin page 148 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

149 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SGPO - Set General Purpose Output Note: issuing AT#SGPO is the same as issuing the Read command. AT#SGPO= Note: issuing is the same as issuing the command AT#SGPO=0 . command setting, hence the opposite Read command reports the #SGPO AT#SGPO? status of the open collector pin in the format: #SGPO: . Test command reports the supported range of values of parameter . AT#SGPO=? This command is meaningful only for GM862 family Note 3.5.5.1.15 #GGPI - General Purpose Input #GGPI - General Purpose Input Set command sets the general purpose input pin . GPIO1 AT#GGPI[=[

]] Parameter: - auxiliary input GPIO1 setting AT#GGPI? reports the logic input level read from 0 - the Read command GPIO1 pin. Note: The device has an insulated input pin ( the input goes the base of an internal decoupling transistor) which can be used as a logic general purpose input. This command sets the read behaviour for this pin, since only direct read report is supported, the issue of this command is not needed. In future uses the behavior of the read input may be more complex. Note: If parameter is omitted then the behaviour of Set command is the same as Read command Read command reports the read value for the input pin GPIO1, in the AT#GGPI? format: #GGPI: , where - direction setting (see ) #GGPI= - logic value read from pin GPIO1 Note: Since the reading is done after the insulating transistor, the reported value is the opposite of the logic status of the GPIO1 input pin. Test command reports supported range of values for parameter . AT#GGPI=? This command is meaningful only for GM862 family Note page 149 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

150 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.1.16 #GPIO - General Purp ose Input/Output Pin Control #GPIO - General Purpose Input/Output Pin Control Execution command sets the value of the general purpose output pin AT#GPIO[=, GPIO according to

and parameter. [,]] Not all configuration for the three parameters are valid. Parameters: - GPIO pin number; supported range is from 1 to a value that depends on the hardware, but is GPIO2 GPIO1 is input only and output only. - its meaning depends on setting: 0 - no meaning if =0 - INPUT - output pin cleared to 0 (LOW) if =1 - OUTPUT - no meaning if =2 - ALTERNATE FUNCTION 1 - no meaning if =0 - INPUT - output pin set to 1 (HIGH) if =1 - OUTPUT - no meaning if =2 - ALTERNATE FUNCTION - INPUT =0 2 - Reports the read value from the input pin if - OUTPUT =1 - Reports the read value from the input pin if - Reports a no meaning value if - ALTERNATE FUNCTION =2 - GPIO pin direction 0 - pin direction is INPUT 1 - pin direction is OUTPUT 2 - pin direction is ALTERNATE FUNCTION (see Note). Note: when =2 (and is omitted) the command reports the direction and value of pin GPIO in the format: #GPIO: , where - current direction setting for the GPIO logic value read from pin in the case the pin is set • GPIO to input; • logic value present in output of the pin GPIO in the case the pin is currently set to output; GPIO • no meaning value for the pin in the case the pin is set to alternate function. Note: (valid only for GPIO1 ) since the reading is done after the insulating transistor, the reported value is the opposite of the logic status of the GPIO1 input pin Note: if all parameters are omitted the command reports the read direction pin, int the format: GPIO and value of all #GPIO: ,[#GPIO: ,[...]] page 150 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

151 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #GPIO - General Purpose Input/Output Pin Control Note: "ALTERNATE FUNCTION" value is valid only for following pins: • GPIO5 - alternate function is “RF Transmission Monitor” GPIO6 - alternate function is "Alarm Output" (see +CALA ) • • - alternate function is "Buzzer Output" (see #SRP ) GPIO7 Note: while using the pins in the alternate function, the GPIO read/write access to that pin is not accessible and shall be avoided. Note: The GPIO2 is an OPEN COLLECTOR output, the command sets the transistor base level, hence the open collector output is negated Read command has the same effect as Execution command when all AT#GPIO? parameters are omitted. Test command reports the supported range of values of the command AT#GPIO=? .

and , parameters AT#GPIO=3,0,1 Example OK AT#GPIO=3,2 #GPIO: 1,0 OK AT#GPIO=4,1,1 OK AT#GPIO=5,0,0 OK AT#GPIO=6,2 #GPIO: 0,1 OK 3.5.5.1.17 #I2S1 - Set PCM Output For Channel 1 #I2S1 - Set PCM Output For Channel 1 AT#I2S1[= Set command sets the type of operation. [,, Parameters: ]] 0 - PCM1 is not enabled; audio is forwarded to the analog line; PCM pins can be used as UART1 and GPIO. 1 - PCM1 is enabled; audio is forwarded to the PCM block; PCM pin cannot be used for UART1; any service on UART1 is suspended 2 - PCM1 is enabled; audio is forwarded both to the PCM block and to the analog line; PCM pins cannot be used for UART1; any service on UART1 is suspended 0 - PCM acts as slave 1 - PCM acts as master page 151 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

152 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #I2S1 - Set PCM Output For Channel 1 64 - 64 kHz. 128 - 128 kHz. 256 - 256 kHz. 512 - 512 kHz 1024 - 1024 kHz 2048 - 2048 kHz Note: issuing AT#I2S1 is the same as issuing the Read command. Read command reports the last setting, in the format: AT#I2S1? #I2S1: ,, , Reports the range of supported values for parameters AT#I2S1=? and 3.5.5.1.18 #E2SMSRI - SMS Ring Indicator #E2SMSRI - SMS Ring Indicator AT#E2SMSRI[= Set command enables/disables the Ring Indicator pin response to an []] , a negative going pulse is incoming SMS message. If enabled generated on receipt of an incoming SMS message. The duration of . this pulse is determined by the value of Parameter: - RI enabling 0 - disables RI pin response for incoming SMS messages (factory default) 50..1150 - enables RI pin response for incoming SMS messages. The value of is the duration in ms of the pulse generated on receipt of an incoming SM. Note: if command is issued and the module is in a GPRS +CNMI=3,1 connection, a 100 ms break signal is sent and a 1 sec. pulse is generated on RI pin, no matter if the RI pin response is either enabled or not. is the same as issuing the Read Note: issuing AT#E2SMSRI command. Note: issuing AT#E2SMSRI= returns the OK result code. Read command reports the duration in ms of the pulse generated on AT#E2SMSRI? receipt of an incoming SM, in the format: #E2SMSRI: means that the RI pin response to =0 Note: as seen before, the value an incoming SM is disabled. page 152 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

153 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #E2SMSRI - SMS Ring Indicator Reports the range of supported values for parameter AT#E2SMSRI=? 3.5.5.1.19 #ADC - Analog/Digital Converter Input #ADC - Analog/Digital Converter Input voltage, converted by ADC, and Execution command reads pin AT#ADC[= outputs it in the format: , [,

]] #ADC: where: voltage, expressed in mV - pin Parameters: - index of pin GM862-QUAD-PY, GM862-GPS, GE863- 1 - available for GM862-QUAD, QUAD, GE863-PY,GE863-GPS, GE864-QUAD, GE864-PY, GC864- QUAD and GC864-PY 2 - available only for GE863-QUAD, GE863-PY, GE864-QUAD, GE864- PY, GC864-QUAD and GC864-PY 3 - available only for GE863-QUAD, GE863-PY, GE864-QUAD, GE864- PY, GC864-QUAD and GC864-PY - required action 2 - query ADC value - direction; its interpretation is currently not implemented 0 - no effect. If all parameters are omitted the command reports all pins voltage, converted by ADC, in the format: #ADC: [#ADC: [...]] Note: The command returns the last valid measure. Read command has the same effect as Execution command when all AT#ADC? parameters are omitted. Test command reports the supported range of values of the command AT#ADC=? parameters . , and 3.5.5.1.20 #DAC - Digital/A nalog Converter Control #DAC - Digital/Analog Converter Control Set command enables/disables the DAC_OUT pin. AT#DAC[= Parameters: [,]] - enables/disables DAC output. 0 - disables pin; it is in high impedance status (factory default) page 153 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

154 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #DAC - Digital/Analog Converter Control 1 - enables pin; the corresponding output is driven - scale factor of the integrated output voltage; it must be present if =1 0..1023 - 10 bit precision Note: integrated output voltage = MAX_VOLTAGE * value / 1023 Note: if all parameters are omitted then the behaviour of Set command is the same as the Read command. Read command reports whether the DAC_OUT pin is currently enabled or AT#DAC? not, along with the integrated output voltage scale factor, in the format: #DAC: , Test command reports the range for the parameters and AT#DAC=? . Enable the DAC out and set its integrated output to the Example 50% of the max value: AT#DAC=1,511 OK Disable the DAC out: AT#DAC=0 OK Note With this command the DAC frequency is selected internally. D/A converter must not be used during POWERSAVING. DAC_OUT line must be integrated (for example with a low band pass filter) in order to obtain an analog voltage. For a more in depth description of the integration filter refer to the hardware user guide. 3.5.5.1.21 #VAUX - Auxilia ry Voltage Pin Output #VAUX- Auxiliary Voltage Pin Output Set command enables/disables Auxiliary Voltage pins output. AT#VAUX[=, ] Parameters: - VAUX pin index 1 - there is currently just one VAUX pin 0 - output off 1 - output on 2 - query current value of VAUX pin page 154 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

155 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #VAUX- Auxiliary Voltage Pin Output =2 Note: when and command is successful, it returns: #VAUX: where: - power output status 0 - output off 1 - output on Note: If all parameters are omitted the command has the same behaviour as Read command. Note: for the GPS product (GE863-GPS): if the Auxiliary Voltage pins output is disabled while GPS or camera is powered on they’ll both also be turned off. Read command reports the current status of all auxiliary voltage output AT#VAUX? pins, in the format: #VAUX: [#VAUX: [...]] , Test command reports the supported range of values for parameters AT#VAUX=? . 3.5.5.1.22 #CBC - Battery And Charger Status #CBC- Battery And Charger Status Execution command returns the current Battery and Charger state in the AT#CBC format: #CBC: , where: - battery charger state 0 - charger not connected 1 - charger connected and charging 2 - charger connected and charge completed - battery voltage in millivolt: it is the real battery voltage only if charger is not connected; if the charger is connected this value depends on the charger voltage. Read command has the same meaning as Execution command. AT#CBC? OK result code. Test command returns the AT#CBC=? 3.5.5.1.23 #AUTOATT - Auto-Attach Property page 155 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

156 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #AUTOATT - Auto-Attach Property Set command enables/disables the TE auto-attach property. AT#AUTOATT [=] Parameter: 0 - disables auto attach property 1 - enables auto attach property (factory default) Note: If parameter is omitted then the behaviour of Set command is the same as Read command. Read command reports whether the auto-attach property is currently AT#AUTOATT? enabled or not, in the format: #AUTOATT: Test command reports available values for parameter . AT#AUTOATT=? ltislot Class Control 3.5.5.1.24 #MSCLASS - Mu #MSCLASS - Multislot Class Control Set command sets the multislot class AT#MSCLASS[= , Parameters: ] - multislot class; take care: class 7 is not supported. 1..6 - GPRS class 8..10 - GPRS class 0 - the new multislot class is enabled only at the next detach/attach or after a reboot. 1 - the new multislot class is enabled immediately, automatically forcing a detach / attach procedure. Note: the range for former GM862 family products is 1..8, excluding class 7. Note: if all parameters are omitted the behaviour of set command is the same as read command. Read command reports the current value of the multislot class in the AT#MSCLASS? format: #MSCLASS: . Test command reports the range of available values for parameter AT#MSCLASS=? page 156 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

157 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.1.25 #MONI - Cell Monitor #MONI - Cell Monitor Set command sets one cell out of seven, in a neighbour of the serving cell AT#MONI[= including it, from which extract GSM-related informations. []] Parameter: 0..6 - it is the ordinal number of a cell, in a neighbour of the serving cell (default 0, serving cell). 7 - it is a special request to obtain GSM-related informations from the whole set of seven cells in the neighbour of the serving cell. is the same as issuing the Read command. Note: issuing AT#MONI Note: issuing is the same as issuing the command AT#MONI= . AT#MONI=0 Read command reports the following GSM-related informations for AT#MONI? selected cell and dedicated channel (if exists). a) When extracting data for the serving cell and the network name is known the format is: #MONI: BSIC: RxQual: LAC: Id: ARFCN: PWR: dBm TA: b) When the network name is unknown, the format is: #MONI: Cc: Nc: BSIC: RxQual: LAC: Id: ARFCN: PWR: dBm TA: c) When extracting data for an adjacent cell, the format is: #MONI: Adj Cell [LAC: Id:] ARFCN: PWR: dBm where: - name of network operator - country code - network operator code - progressive number of adjacent cell - base station identification code - quality of reception 0..7 - localization area code - cell identifier - assigned radio channel - received signal strength in dBm = timing advance page 157 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

158 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #MONI - Cell Monitor is reported only for the serving cell. Note: TA: AT#MONI=7 , then the Read command reports When the last setting done is the above informations for each of the cells in the neighbour of the serving strings. cell, formatting them in a sequence of -terminated Test command reports the maximum number of cells, in the neighbour of AT#MONI=? the serving cell, from which we can extract GSM-related informations, along with the ordinal number of the current selected cell, in the format: #MONI: (,) where: - maximum number of cells, in the neighbour of the serving cell, from which we can extract GSM-related informations (for compatibility with previous versions of code this value is always ). 5 - the last setting done with command #MONI . An enhanced version of the Test command has been defined: AT#MONI=?? Enhanced test command reports the maximum number of cells, in a AT#MONI=?? neighbour of the serving cell and including it, from which we can extract GSM-related informations, along with the ordinal number of the current selected cell, in the format: #MONI: (,) where: - maximum number of cells, in a neighbour of the serving cell and including it, from which we can extract GSM-related informations. This value is always 7 . #MONI . - the last setting done with command Note The refresh time of the measures is preset to 3 sec. The timing advance value is meaningful only during calls or GPRS transfers active. 3.5.5.1.26 #SERVINFO - Serving Cell Information #SERVINFO - Serving Cell Information Execution command reports informations about serving cell, in the format: AT#SERVINFO #SERVINFO: ,,,, ,,,,[,[],[], ,[PAT]] page 158 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

159 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SERVINFO - Serving Cell Information where: - BCCH ARFCN of the serving cell - received signal strength in dBm - operator name, quoted string type - country code and operator code, hexadecimal representation - Base Station Identification Code - Localization Area Code - Time Advance: it’s available only if a GSM or GPRS is running - GPRS supported in the cell 0 - not supported 1 - supported The following informations will be present only if GPRS is supported in the cell - PBCCH ARFCN of the serving cell; it’ll be printed only if “hopping” will PBCCH is supported by the cell, otherwise the label be printed - Network Operation Mode ..”I” “II” ..”III” - Routing Area Color Code - Priority Access Threshold ..0 ..3..6 Read command has the same effect as Execution command AT#SERVINFO? 3.5.5.1.27 #COPSMODE - +COPS Mode #COPSMODE - +COPS Mode +COPS +COPS see ). command ( Set command sets the behaviour of AT#COPSMODE [=] Parameter: behaviour like former GM862 family products (default) +COPS 0 - 1 - +COPS behaviour compliant with ETSI format Note: The setting is saved in NVM (and available on following reboot). Note: if parameter is omitted the behaviour of Set command is the same as Read command. +COPS command, in the Read command returns the current behaviour of AT#COPSMODE? format: page 159 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

160 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #COPSMODE - +COPS Mode #COPSMODE: where behaviour as seen before. +COPS - Test command returns the range of available values for parameter AT#COPSMODE=? . Note #COPSMODE setting. It’s suggested to reboot the module after every 3.5.5.1.28 #QSS - Query SIM Status #QSS - Query SIM Status Set command enables/disables the Query SIM Status unsolicited indication AT#QSS[= in the ME. []] Parameter: - type of notification 0 - disabled (factory default); it’s possible only to query the current SIM AT#QSS? status through Read command 1 - enabled; the ME informs at every SIM status change through the following unsolicited indication: #QSS: where: - current SIM status 0 - SIM NOT INSERTED 1 - SIM INSERTED is the same as issuing the Read command. Note: issuing AT#QSS Note: issuing AT#QSS= is the same as issuing the command AT#QSS=0 . Read command reports whether the unsolicited indication #QSS is currently AT#QSS? enabled or not, along with the SIM status, in the format: #QSS: , are described above) ( and Test command returns the supported range of values for parameter AT#QSS=? . page 160 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

161 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.1.29 #DIALMODE - ATD Dialling Mode #DIALMODE - ATD Dialling Mode Set command sets voice call ATD modality. AT#DIALMODE[= ] Parameter: OK result code is received as soon as it starts remotely ringing (factory 0 - default) 1 - OK result code is received only after the called party answers. Any character typed aborts the call and NO CARRIER result code is received. 2 - the following custom result codes are received, monitoring step by step the call status: DIALING (MO in progress) RINGING (remote ring) CONNECTED (remote call accepted) (after RELEASED ) ATH DISCONNECTED (remote hang-up) Note: The setting is saved in NVM and available on following reboot. is omitted the behaviour of Set command is the Note: if parameter same as Read command. Read command returns current ATD dialing mode in the format: AT#DIALMODE? #DIALMODE: Test command returns the range of values for parameter AT#DIALMODE=? 3.5.5.1.30 #ACAL - Automatic Call #ACAL - Automatic Call Set command enables/disables the automatic call function. AT#ACAL[= []] Parameter: 0 - disables the automatic call function (factory default) 1 - enables the automatic call function. If enabled (and &D2 has been issued), the transition OFF/ON of DTR causes an automatic call to the first number (position 0) stored in the internal phonebook. Note: type of call depends on the last issue of command +FCLASS . Note: issuing AT#ACAL is the same as issuing the Read command. Note: issuin the command g is the same as issuin AT#ACAL= g page 161 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

162 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #ACAL - Automatic Call AT#ACAL=0 . Read command reports whether the automatic call function is currently AT#ACAL? enabled or not, in the format: #ACAL: Test command returns the supported range of values for parameter AT#ACAL=? . &Z to read the number on module internal phonebook. Note See &N to write and tended Call Monitoring 3.5.5.1.31 #ECAM - Ex #ECAM - Extended Call Monitoring This command enables/disables the call monitoring function in the . ME AT#ECAM[= []] Parameter: 0 - disables call monitoring function (factory default) 1 - enables call monitoring function; the ME informs about call events, such as incoming call, connected, hang up etc. using the following unsolicited indication: #ECAM: ,,,,, [,] where - call ID - call status 0 - idle 1 - calling (MO) 2 - connecting (MO) 3 - active 4 - hold 5 - waiting (MT) 6 - alerting (MT) 7 - busy - call type 1 - voice 2 - data =1 - called number (valid only for ) - type of 129 - national number 145 - international number Note: the unsolicited indication is sent along with usual codes ( , OK NO ...). CARRIER BUSY , page 162 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

163 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #ECAM - Extended Call Monitoring is the same as issuing the Read AT#ECAM Note: issuing command. result code. OK Note: issuing AT#ECAM= returns the Read command reports whether the extended call monitoring function is AT#ECAM? currently enabled or not, in the format: #ECAM: Test command returns the list of supported values for AT#ECAM=? 3.5.5.1.32 #SMOV - SMS Overflow #SMOV - SMS Overflow Set command enables/disables the SMS overflow signalling function. AT#SMOV[= []] Parameter: 0 - disables SMS overflow signaling function(factory default) 1 - enables SMS overflow signalling function; when the maximum storage capacity has reached, the following network initiated notification is send: #USMO: Note: issuing AT#SMOV is the same as issuing the Read command. is the same as issuing the command AT#SMOV= Note: issuing . AT#SMOV=0 Read command reports whether the SMS overflow signalling function is AT#SMOV? currently enabled or not, in the format: #SMOV: Test command returns the supported range of values of parameter AT#SMOV=? . 3.5.5.1.33 #CODEC - Audio Codec #CODEC - Audio Codec Set command sets the audio codec mode. AT#CODEC[= ] Parameter: 0 - all the codec modes are enabled (factory default) page 163 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

164 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 1..31 - value obtained as sum of the following values, each of them representing a specific codec mode: , full rate mode enabled FR 1 - 2 - EFR , enhanced full rate mode enabled 4 - HR , half rate mode enabled 8 - AMR-FR , AMR full rate mode enabled 16 - AMR-HR , AMR half rate mode enabled Note: the setting 0 is equivalent to the setting 31. Note: The codec setting is saved in the profile parameters. is omitted the behaviour of Set Note: if optional parameter command is the same as Read command. Read command returns current audio codec mode in the format: AT#CODEC? #CODEC: Test command returns the range of available values for parameter AT#CODEC=? AT#CODEC=14 Example OK sets the codec modes HR (4), EFR (2) and AMR-FR (8) 3.5.5.1.34 #SHFEC - Ha ndsfree Echo Canceller #SHFEC - Handsfree Echo Canceller Set command enables/disables the echo canceller function on audio AT#SHFEC[= handsfree output. []] Parameter: 0 - disables echo canceller for handsfree mode (factory default) 1 - enables echo canceller for handsfree mode Note: This setting returns to default after power off. Note: issuing AT#SHFEC is the same as issuing the Read command. is the same as issuing the command Note: issuing AT#SHFEC= AT#SHFEC=0 . Read command reports whether the echo canceller function on audio AT#SHFEC? handsfree output is currently enabled or not, in the format: #SHFEC: page 164 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

165 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SHFEC - Handsfree Echo Canceller Test command returns the supported range of values of parameter AT#SHFEC=? . ndsfree Microphone Gain 3.5.5.1.35 #HFMICG - Ha #HFMICG - Handsfree Microphone Gain Set command sets the handsfree microphone input gain AT#HFMICG[= []] Parameter: : handsfree microphone input gain 0..7 - handsfree microphone gain (+6dB/step) Note: issuing AT#HFMICG is the same as issuing the Read command. Note: issuing returns the OK result code. AT#HFMICG= Read command returns the current handsfree microphone input gain, in the AT#HFMICG? format: #HFMICG: returns the supported range of values of parameter Test command AT#HFMICG=? . 3.5.5.1.36 #HSMICG - Ha ndset Microphone Gain #HSMICG - Handset Microphone Gain Set command sets the handset microphone input gain AT#HSMICG[= []] Parameter: : handset microphone input gain 0..7 - handset microphone gain (+6dB/step) is the same as issuing the Read Note: issuing AT#HSMICG command. Note: issuing AT#HSMICG= returns the OK result code. Read command returns the current handset microphone input gain, in the AT#HSMICG? format: #HSMICG: Test command returns the supported range of values of parameter . AT#HSMICG=? page 165 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

166 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.1.37 #SHFSD - Set Headset Sidetone #SHFSD - Set Headset Sidetone Set command enables/disables the sidetone on headset audio output. AT#SHFSD[= []] Parameter: 0 - disables the headset sidetone (factory default) 1 - enables the headset sidetone. Note: This setting returns to default after power off. Note: issuing is the same as issuing the Read command. AT#SHFSD is the same as issuing the command AT#SHFSD= Note: issuing AT#SHFSD=0 . Read command reports whether the headset sidetone is currently enabled AT#SHFSD? or not, in the format: #SHFSD: Test command returns the supported range of values of parameter AT#SHFSD=? . 3.5.5.1.38 #/ - Repeat Last Command #/ - Repeat Last Command Execute command is used to execute again the last received AT#/ command. 3.5.5.1.39 #NITZ - Network Timezone #NITZ - Network Timezone Set command enables/disables automatic date/time updating and Network AT#NITZ[= Timezone unsolicited indication. [ Date and time information may be sent by the network after GSM [,]]] registration or after GPRS attach. Parameters: 0 - disables automatic set (factory default) 1 - enables automatic set 0 - disables unsolicited message (factory default) page 166 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

167 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #NITZ - Network Timezone 1 - enables unsolicited message; after date and time updating the following unsolicited indication is sent: #NITZ: “yy/MM/dd,hh:mm:ss” where: yy - year MM - month (in digits) dd - day hh - hour mm - minute ss - second Note: issuing is the same as issuing the Read command. AT#NITZ is the same as issuing the command AT#NITZ= Note: issuing . AT#NITZ=0 Read command reports whether automatic date/time updating is currently AT#NITZ? enabled or not, and whether Network Timezone unsolicited indication is enabled or not, in the format: #NITZ: , Test command returns supported values of parameters and . AT#NITZ=? 3.5.5.1.40 #BND - Select Band #BND - Select Band Set command selects the current band. AT#BND[= []] Parameter : 0 - GSM 900MHz + DCS 1800MHz 1 - GSM 900MHz + PCS 1900MHz 2 - GMS 850MHz + PCS 1800MHz (available only on quadri-band modules) 3 - GMS 850MHz + PCS 1900MHz (available only on quadri-band modules) Note: This setting is maintained even after power off. is the same as issuing the Read command. AT#BND Note: issuing Note: issuing AT#BND= is the same as issuing the command AT#BND=0 . page 167 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

168 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Read command returns the current selected band in the format: AT#BND? #BND: Test command returns the supported range of values of parameter . AT#BND=? Note: the range of values differs between triband modules and quadric-band modules tomatic Band Selection 3.5.5.1.41 #AUTOBND - Au #AUTOBND - Automatic Band Selection Set command enables/disables the automatic band selection at power-on. AT#AUTOBND[= ] Parameter: : 0 - disables automatic band selection at power-on (factory default) is necessary 1 - enables automatic band selection at power-on; +COPS=0 condition to effectively have automatic band selection at next power-on; the automatic band selection stops as soon as a GSM cell is found. Note: if automatic band selection is enabled the band changes every about 90 seconds through available bands until a GSM cell is found. is omitted the behaviour of Set command is the Note: if parameter same as Read command. Read command returns whether the automatic band selection is enabled or AT#AUTOBND? not in the form: #AUTOBND: Test command returns the range of supported values for parameter AT#AUTOBND=? . 3.5.5.1.42 #SKIPESC - Skip Escape Sequence #SKIPESC - Skip Escape Sequence +++ Set command enables/disables skipping the escape sequence while AT#SKIPESC[= transmitting during a data connection. []] Parameter: page 168 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

169 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKIPESC - Skip Escape Sequence 0 - doesn’t skip the escape sequence; its transmission is enabled (factory default). 1 - skips the escape sequence; its transmission is not enabled. Note: in case of an FTP connection, the escape sequence is not transmitted, regardless of the command setting. Note: issuing AT#SKIPESC is the same as issuing the Read command. Note: issuing is the same as issuing the command AT#SKIPESC= AT#SKIPESC=0 . Read command reports whether escape sequence skipping is currently AT#SKIPESC? enabled or not, in the format: #SKIPESC: Test command reports supported range of values for parameter . AT#SKIPESC=? 3.5.5.1.43 #E2ESC - Esca pe Sequence Guard Time #E2ESC - Escape Sequence Guard Time Set command sets a guard time in seconds for the escape sequence in AT#E2ESC[= GPRS to be considered a valid one (and return to on-line command mode). []] Parameter: 0 - no guard time (factory default) 1..10 - guard time in seconds Note: if the Escape Sequence Guard Time is set to a value different from . zero, it overrides the one set with S12 AT#E2ESC is the same as issuing the Read command. Note: issuing returns the Note: issuing AT#E2ESC= OK result code. Read command returns current value of the escape sequence guard time, AT#E2ESC? in the format: #E2ESC: result code. OK Test command returns the AT#E2ESC=? page 169 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

170 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.1.44 #GAUTH - PPP-GPRS Connection Authentication Type #GAUTH - PPP-GPRS Connection Authentication Type Set command sets the PPP-GPRS connection authentication type. AT#GAUTH[= ] Parameter 0 - no authentication 1 - PAP authentication (factory default) 2 - CHAP authentication Note: for GSM connection is fixed to PAP Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command reports the current PPP-GPRS connection authentication AT#GAUTH? type, in the format: #GAUTH: Test command returns the range of supported values for parameter AT#GAUTH=? . 3.5.5.1.45 #RTCSTAT - RTC Status #RTCSTAT - RTC Status Set command resets the RTC status flag. AT#RTCSTAT[= ] Parameter: 0 - Set RTC Status to RTC HW OK RTC HW Error and it doesn’t Note: the initial value of RTC status flag is change until a command AT#RTCSTAT=0 is issued. Note: if a power failure occurs and the buffer battery is down the RTC is status flag is set to 1 . It doesn’t change until command AT#RTCSTAT=0 issued. Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command reports the current value of RTC status flag, in the format: AT#RTCSTAT? #RTCSTAT: Test command returns the range of supported values for parameter AT#RTCSTAT=? page 170 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

171 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.2 FTP AT Commands 3.5.5.2.1 #FTPTO - FTP Time-Out #FTPTO - FTP Time-Out Set command sets time-out for FTP operations. AT#FTPTO[= ] Parameter: - time-out in 100 ms units 100..5000 - hundreds of ms (factory default is 100) Note: The parameter is not saved in NVM. Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command returns the current FTP operations time-out, in the format: AT#FTPTO? #FTPTO: Test command returns the range of supported values for parameter AT#FTPTO=? 3.5.5.2.2 #FTPOPEN - FTP Open #FTPOPEN - FTP Open Execution command opens an FTP connection toward the FTP server. AT#FTPOPEN= , Parameters: , - string type, address and port of FTP server (factory default , port 21). - string type, authentication user identification string for FTP. - string type, authentication password for FTP. 0 - active mode (default) 1 - passive mode 3.5.5.2.3 #FTPCLOSE - FTP Close #FTPCLOSE - FTP Close Execution command closes an FTP connection. AT#FTPCLOSE Read command behavior is the same as Execution command. AT#FTPCLOSE? page 171 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

172 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.2.4 #FTPPUT - FTP Put #FTPPUT - FTP Put Execution command, issued during an FTP connection, opens a data AT#FTPPUT= connection, in order to transfer a file to the server. If the data connection succeeds, a file with name and initial size indication is sent and it’s 0 is created on the FTP server, a CONNECT NO CARRIER indication is sent. possible to transfer the file; otherwise a Parameter: - string type, name of the file to create on FTP server. to close the data connection. Note: use the escape sequence +++ ERROR result code to be returned if no Note: The command causes an FTP connection has been opened yet. 3.5.5.2.5 #FTPPUTPH - FTP Put Photo #FTPPUTPH - FTP Put Photo Execution command, issued during an FTP connection, opens a data AT#FTPPUTPH= AT#TPHOTO connection, in order to transfer the last photo taken issuing to the FTP server. If the data connection succeeds, a file with name and initial size CONNECT 0 is created on the FTP server, a indication is sent and it starts indication is sent. NO CARRIER transfer the last photo; otherwise a Parameter: - string type, name of the file on the FTP server side. Note: the file transfer type has to be binary in order to send the photo the #FTPTYPE ). right way (see command Note: The command causes an ERROR result code to be returned if no FTP connection has been opened yet. at#gprs=1 Example +IP: ###.###.###.### OK at#camon OK at#tphoto OK at#ftpopen="xxx.xxx.xxx.xxx",,,0 OK page 172 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

173 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #FTPPUTPH - FTP Put Photo at#ftptype=0 OK at#ftpputph="photo.jpg" OK at#ftpclose OK 3.5.5.2.6 #FTPGET - FTP Get #FTPGET - FTP Get Execution command, issued during an FTP connection, opens a data AT#FTPGET= connection and starts getting a file from the FTP server. CONNECT If the data connection succeeds a indication is sent, otherwise a NO CARRIER indication is sent. The file is received on the serial port. Parameter: - file name, string type. result code to be returned if no Note: The command causes an ERROR FTP connection has been opened yet. 3.5.5.2.7 #FTPTYPE - FTP Type #FTPTYPE - FTP Type Set command, issued during an FTP connection, sets the file transfer type. AT#FTPTYPE[= ] Parameter: - file transfer type: 0 - binary 1 - ascii Note: The command causes an ERROR result code to be returned if no FTP connection has been opened yet. Note: If the parameter is omitted then the behaviour of Set command is the same of Read command. Read command returns the current file transfer type, in the format: #FTPTYPE? #FTPTYPE: : Test command returns the range of available values for parameter #FTPTYPE=? #FTPTYPE: (0,1) page 173 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

174 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.2.8 #FTPMSG - FTP Read Message #FTPMSG - FTP Read Message Execution command returns the last response from the server. AT#FTPMSG Read command behaviour is the same as Execution command. AT#FTPMSG? 3.5.5.2.9 #FTPDELE - FTP Delete #FTPDELE - FTP Delete Execution command, issued during an FTP connection, deletes a file from AT#FTPDELE= the remote working directory. Parameter: - string type, it’s the name of the file to delete. ERROR Note: The command causes an result code to be returned if no FTP connection has been opened yet. Print Working Directory 3.5.5.2.10 #FTPPWD - FTP #FTPPWD - FTP Print Working Directory Execution command, issued during an FTP connection, shows the current AT#FTPPWD working directory on FTP server. ERROR result code to be returned if no Note: The command causes an FTP connection has been opened yet. 3.5.5.2.11 #FTPCWD - FTP Change Working Directory #FTPCWD - FTP Change Working Directory Execution command, issued during an FTP connection, changes the AT#FTPCWD= working directory on FTP server. Parameter: - string type, it’s the name of the new working directory. ERROR result code to be returned if no Note: The command causes an FTP connection has been opened yet. page 174 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

175 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.2.12 #FTPLIST - FTP List #FTPLIST - FTP List Execution command, issued during an FTP connection, opens a data AT#FTPLIST[= connection and starts getting from the server the list of contents of the ] specified directory or the properties of the specified file. Parameter: - string type, it’s the name of the directory or file. ERROR Note: The command causes an result code to be returned if no FTP connection has been opened yet. Note: issuing opens a data connection and starts AT#FTPLIST getting from the server the list of contents of the working directory. Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 175 of 614

176 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.3 Enhanced Easy GPRS® Extension AT Commands thentication User ID 3.5.5.3.1 #USERID - Au #USERID - Authentication User ID Set command sets the user identification string to be used during the AT#USERID authentication step. [=] Parameter: - string type, it’s the authentication User Id; the max length for this value is the output of Test command, AT#USERID=? (factory default is the empty string “”) . Note: If parameter is omitted then the behaviour of Set command is the same of Read command. Read command reports the current user identification string, in the format: AT#USERID? #USERID: . Test command returns the maximum allowed length of the string parameter AT#USERID=? . AT#USERID="myName" Example OK AT#USERID? #USERID: "myName" OK thentication Password 3.5.5.3.2 #PASSW - Au #PASSW - Authentication Password Set command sets the user password string to be used during the AT#PASSW= authentication step. Parameter: - string type, it’s the authentication password; the max length for this (factory value is the output of Test command, AT#PASSW=? default is the empty string “”). Test command returns the maximum allowed length of the string parameter AT#PASSW=? . AT#PASSW="myPassword" Example OK page 176 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

177 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.3.3 #PKTSZ - Packet Size #PKTSZ - Packet Size Set command sets the default packet size to be used by the TCP/UDP/IP AT#PKTSZ[= stack for data sending. []] Parameter: - packet size in bytes 0 - automatically chosen by the device 1..512 - packet size in bytes (factory default is 300) is the same as issuing the Read command. Note: issuing AT#PKTSZ Note: issuing AT#PKTSZ= is the same as issuing the command AT#PKTSZ=0 . Read command reports the current packet size value. AT#PKTSZ? AT#PKTSZ=0 Note: after issuing command , the Read command reports the value automatically chosen by the device. Test command returns the allowed values for the parameter . AT#PKTSZ=? AT#PKTSZ=100 Example OK AT#PKTSZ? #PKTSZ: 100 OK AT#PKTSZ=0 OK AT#PKTSZ? #PKTSZ: 300 -> value automatically chosen by device OK 3.5.5.3.4 #DSTO - Data Sending Time-Out #DSTO - Data Sending Time-Out Set command sets the maximum time that the module awaits before AT#DSTO[= sending anyway a packet whose size is less than the default one. []] Parameter: - packet sending time-out in 100ms units (factory default is 50) 0 - no time-out, wait forever for packets to be completed before send. 1..255 hundreds of ms Note: In order to avoid low performance issues, it is suggested to set the data sending time-out to a value greater than 5. page 177 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

178 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #DSTO - Data Sending Time-Out Note: this time-out applies to data whose size is less than packet size and whose sending would have been delayed for an undefined time until new data to be sent had been received and full packet size reached. is the same as issuing the Read command. AT#DSTO Note: issuing Note: issuing AT#DSTO= is the same as issuing the command AT#DSTO=0 . Read command reports the current data sending time-out value. AT#DSTO? Test command returns the allowed values for the parameter . AT#DSTO=? ->1 sec. time-out AT#DSTO=10 Example OK AT#DSTO? #DSTO: 10 OK 3.5.5.3.5 #SKTTO - Soc ket Inactivity Time-Out #SKTTO - Socket Inactivity Time-Out Set command sets the maximum time with no data exchanging on the AT#SKTTO[= socket that the module awaits before closing the socket and deactivating []] the GPRS context. Parameter: - socket inactivity time-out in seconds units 0 - no timeout. 1..65535 - time-out in sec. units (factory default is 90). Note: this time-out applies when no data is exchanged in the socket for a long time and therefore the socket connection has to be automatically closed and the GPRS context deactivated. AT#SKTTO is the same as issuing the Read command. Note: issuing AT+#SKTTO= is the same as issuing the command Note: issuing AT+#SKTTO=0 . Read command reports the current socket inactivity time-out value. AT#SKTTO? Test command returns the allowed values for parameter . AT#SKTTO=? ->(30 sec. time-out) AT#SKTTO=30 Example OK AT#SKTTO? #SKTTO: 30 page 178 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

179 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTTO - Socket Inactivity Time-Out OK 3.5.5.3.6 #SKTSET - Socket Definition #SKTSET - Socket Definition Set command sets the socket parameters values. AT#SKTSET[= , Parameters: , - socket protocol type , 0 - TCP (factory default) [], 1 - UDP []] - remote host port to be opened 0..65535 - port number (factory default is 0) - address of the remote host, string type. This parameter can be either: - any valid IP address in the format: xxx.xxx.xxx.xxx - any host name to be solved with a DNS query in the format: (factory default is the empty string “”) - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) +++ ) 255 - local host closes after an escape sequence ( - local host port to be used on UDP socket 0..65535 - port number parameter is valid only for TCP socket type, for UDP Note: sockets shall be left unused. parameter is valid only for UDP socket type, for TCP Note: sockets shall be left unused. Note: The resolution of the host name is done when opening the socket, therefore if an invalid host name is given to the #SKTSET command, then error message will be issued. Note: the DNS Query to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT ) - the authentication parameters are set (#USERID , #PASSW - the GPRS coverage is enough to permit a connection. Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. Read command reports the socket parameters values, in the format: AT#SKTSET? AT#SKTSET: ,,, page 179 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

180 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTSET - Socket Definition , Test command returns the allowed values for the parameters. AT#SKTSET=? AT#SKTSET=0,1024,"123.255.020.001" Example OK AT#SKTSET=0,1024,"www.telit.net" OK 3.5.5.3.7 #SKTOP - Socket Open #SKTOP - Socket Open Execution command activates the context number 1, proceeds with the AT#SKTOP authentication with the user ID and password previously set by #USERID commands, and opens a socket connection with the host #PASSW and command. Eventually, before opening the socket #SKTSET specified in the connection, it issues automatically a DNS query to solve the IP address of the host name. If the connection succeeds a CONNECT NO indication is sent, otherwise a CARRIER indication is sent. Read command behaviour is the same as Execution command. AT#SKTOP? AT#SKTOP Example ..GPRS context activation, authentication and socket open.. CONNECT 3.5.5.3.8 #QDNS - Query DNS #QDNS - Query DNS Execution command executes a DNS query to solve the host name into an AT#QDNS= IP address. Parameter: - host name, string type. If the DNS query is successful then the IP address will be reported in the result code: #QDNS:"", Note: the command has to activate the GPRS context if it was not previously activated. In this case the context is deactivated after the DNS query. page 180 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

181 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #QDNS - Query DNS Note: is in the format: xxx.xxx.xxx.xxx Note This command requires that the authentication parameters are correctly set and that the GPRS network is present. 3.5.5.3.9 #SKTCT - Socket TCP Connection Time-Out #SKTCT - Socket TCP Connection Time-Out Set command sets the TCP connection time-out for the first CONNECT AT#SKTCT[= answer from the TCP peer to be received. ] Parameter: - TCP first answer time-out in 100ms units CONNECT 10..1200 - hundreds of ms (factory default value is 600). Note: this time-out applies only to the time that the TCP stack waits for the CONNECT answer to its connection request. Note: The time for activate the GPRS and resolving the name with the DNS query (if the peer was specified by name and not by address) is not counted in this timeout. Note: if parameter is omitted then the behaviour of Set command is the same as Read command. Read command reports the current TCP connection time-out. AT#SKTCT? Test command returns the allowed values for parameter . AT#SKTCT=? AT#SKTCT=600 Example OK socket first connection answer timeout has been set to 60 s. 3.5.5.3.10 #SKTSAV - So cket Parameters Save #SKTSAV - Socket Parameters Save Execution command saves the actual socket parameters in the NVM of the AT#SKTSAV device. The socket parameters to store are: - User ID - Password - Packet Size - Socket Inactivity Time-Out - Data Sending Time-Out - Socket Type (UDP/TCP) page 181 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

182 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - Remote Port - Remote Address - TCP Connection Time-Out AT#SKTSAV Example OK socket parameters have been saved in NVM If some parameters have not been previously specified then a default value Note will be stored. 3.5.5.3.11 #SKTRST - So cket Parameters Reset #SKTRST - Socket Parameters Reset Execution command resets the actual socket parameters in the NVM of the AT#SKTRST device to the default ones. The socket parameters to reset are: - User ID - Password - Packet Size - Socket Inactivity Timeout - Data Sending Timeout - Socket Type - Remote Port - Remote Address - TCP Connection Time-Out AT#SKTRST Example OK socket parameters have been reset #GPRS - GPRS Context Activation 3.5.5.3.12 #GPRS - GPRS Context Activation Execution command deactivates/activates the GPRS context, eventually AT#GPRS[= proceeding with the authentication with the parameters given with #PASSW []] #USERID . and Parameter: - GPRS context activation mode 0 - GPRS context deactivation request 1 - GPRS context activation request OK is In the case that the GPRS context has been activated, the result code preceded by the intermediate result code: page 182 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

183 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +IP: reporting the local IP address obtained from the network. Note: issuing AT#GPRS reports the current status of the GPRS context, in the format: #GPRS: where: 0 - GPRS context deactivated 1 - GPRS context activated 2 - GPRS context activation pending. Note: issuing AT#GPRS= is the same as issuing the command AT#GPRS=0 . Read command has the same effect as the Execution command AT#GPRS? AT#GPRS. . Test command returns the allowed values for parameter AT#GPRS=? AT#GPRS=1 Example +IP: 129.137.1.1 OK Now GPRS Context has been activated and our IP is 129.137.1.1 AT#GPRS=0 OK Now GPRS context has been deactivated, IP is lost. 3.5.5.3.13 #SKTD - Socket Dial #SKTD - Socket Dial Set command opens the socket towards the peer specified in the AT#SKTD parameters. [=, , Parameters: , - socket protocol type [], 0 - TCP (factory default) []] 1 - UDP - remote host port to be opened 0..65535 - port number (factory default is 0) - address of the remote host, string type. This parameter can be either: - any valid IP address in the format: xxx.xxx.xxx.xxx - an y uer q

184 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTD - Socket Dial name> (factory default is the empty string “”) - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) ) +++ 255 - local host closes after an escape sequence ( - local host port to be used on UDP socket 0..65535 - port number Note: parameter is valid only for TCP socket type, for UDP sockets shall be left unused. Note: parameter is valid only for UDP socket type, for TCP sockets shall be left unused. Note: the resolution of the host name is done when opening the socket, #SKTD therefore if an invalid host name is given to the command, then an error message will be issued. Note: the command to be successful requests that: - the GPRS context 1 is correctly set with AT+CGDCONT - the authentication parameters are set , #PASSW ) the GPRS (#USERID coverage is enough to permit a connection - the GPRS has been activated with AT#GPRS=1 Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. Read command reports the socket dial parameters values, in the format: AT#SKTD? AT#SKTD: ,,, , Test command returns the allowed values for the parameters. AT#SKTD=? AT#SKTD=0,1024,"123.255.020.001",255 Example OK AT#SKTD=1,1024,"123.255.020.001", ,1025 OK In this way my local port 1025 is opened to the remote port 1024 AT#SKTD=0,1024,"www.telit.net", 255 OK Note The main difference between this command and the AT#SKTOP is that this command does not interact with the GPRS context status, leaving it ON or setting, therefore when the connection made according to the OFF #GPRS AT#SKTD is closed the context (and hence the local IP address) is with maintained. page 184 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

185 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.3.14 #SKTL - Socket Listen #SKTL - Socket Listen Execution command opens/closes the socket listening for connection AT#SKTL requests. [=, , Parameters: , - socket mode []] 0 - closes socket listening 1 - starts socket listening - socket protocol type 0 - TCP - local host input port to be listened 0..65535 - port number - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) 255 - local host closes after an escape sequence ( ) +++ Command returns the result code if successful. OK Note: the command to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT - the authentication parameters are set ( #USERID ) #PASSW , - the GPRS coverage is enough to permit a connection - the GPRS has been activated with AT#GPRS=1 When a connection request comes on the input port, if the sender is not ), an unsolicited code filtered by the internal firewall (see command #FRWL is reported: +CONN FROM: Where: - host address of the remote machine that contacted the device. When the connection is established the CONNECT indication is given and the modem goes into data transfer mode. the socket is #GPRS=0 On connection close or when context is closed with closed and no listen is anymore active. If the context is closed by the netwo rk while in listening, the socket is closed, no listen is anymore active and an unsolicited code is reported: #SKTL: ABORTED page 185 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

186 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTL - Socket Listen Note: if all parameters are omitted the command returns the current socket status and and the last settings of parameters listening , in the format: #SKTL: ,, where - socket listening status 0 - socket not listening 1 - socket listening Read command has the same effect as Execution command when AT#SKTL? parameters are omitted. , AT#SKTL=? . port> and Activate GPRS Example AT#GPRS=1 +IP: ###.###.###.### OK Start listening AT#SKTL=1,0,1024 OK or AT#SKTL=1,0,1024,255 OK Receive connection requests +CONN FROM: 192.164.2.1 CONNECT exchange data with the remote host send escape sequence +++ NO CARRIER Now listen is not anymore active to stop listening AT#SKTL=0,0,1024, 255 OK #SKTL Note The main difference between this command and the #SKTD is that does not contact any peer, nor does any interaction with the GPRS context status, leaving it ON or OFF according to the #GPRS setting, therefore #SKTL is closed the context (and hence when the connection made with the local IP address) is maintained. @SKTL The improving command has been defined. page 186 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

187 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.3.15 @SKTL - Socket Listen @SKTL - Socket Listen Execution command opens/closes the socket listening for connection [email protected] requests. [=, , Parameters: , - socket mode []] 0 - closes socket listening 1 - starts socket listening - socket protocol type 0 - TCP - local host input port to be listened 0..65535 - port number - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) 255 - local host closes after an escape sequence ( ) +++ result code if successful. OK Command returns the Note: the command to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT #USERID - the authentication parameters are set ( , ) #PASSW - the GPRS coverage is enough to permit a connection - the GPRS has been activated with AT#GPRS=1 When a connection request comes on the input port, if the sender is not filtered by the internal firewall (see command #FRWL ), an unsolicited code is reported: +CONN FROM: Where: - host address of the remote machine that contacted the device. When the connection is established the CONNECT indication is given and the modem goes into data transfer mode. the socket is #GPRS=0 On connection close or when context is closed with closed and no listen is anymore active. rk while in listening, the socket is If the context is closed by the netwo closed, no listen is anymore active and an unsolicited code is reported: page 187 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

188 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @SKTL - Socket Listen @SKTL: ABORTED Note: if all parameters are omitted the command returns the current socket listening status and the last settings of parameters , and , in the format: @SKTL: ,,, Where - socket listening status 0 - socket not listening 1 - socket listening Read command has the same effect as Execution command when [email protected]? parameters are omitted. Test command returns the allowed values for parameters , and , type> Activate GPRS Example AT#GPRS=1 +IP: ###.###.###.### OK Start listening [email protected]=1,0,1024 OK or [email protected]=1,0,1024,255 OK Receive connection requests +CONN FROM: 192.164.2.1 CONNECT exchange data with the remote host send escape sequence +++ NO CARRIER Now listen is not anymore active to stop listening [email protected]=0,0,1024, 255 OK #SKTD Note The main difference between this command and the is that @SKTL does not contact any peer, nor does any interaction with the GPRS context according to the setting, therefore #GPRS OFF status, leaving it ON or when the connection made with is closed the context (and hence @SKTL the local IP address) is maintained. page 188 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

189 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.3.16 #E2SLRI - Sock et Listen Ring Indicator #E2SLRI - Socket Listen Ring Indicator Set command enables/disables the Ring Indicator pin response to a Socket AT#E2SLRI=[] Listen connect and, if enabled, the duration of the negative going pulse generated on receipt of connect. Parameter: - RI enabling 0 - RI disabled for Socket Listen connect (factory default) 50..1150 - RI enabled for Socket Listen connect; a negative going pulse is generated on receipt of connect and is the duration in ms of this pulse. Read command reports whether the Ring Indicator pin response to a Socket AT#E2SLRI? Listen connect is currently enabled or not, in the format: #E2SLRI: Test command returns the allowed values for parameter . AT#E2SLRI=? 3.5.5.3.17 #FRWL - Firewall Setup #FRWL - Firewall Setup Execution command controls the internal firewall settings. AT#FRWL[= , Parameters: , - command action ] 0 - remove selected chain ACCEPT chain 1 - add an 2 - remove all chains ( DROP everything); and has no meaning in this case. - remote address to be added into the ACCEPT chain; string type, it can be any valid IP address in the format: xxx.xxx.xxx.xxx - mask to be applied on the ; string type, it can be any valid IP address mask in the format: xxx.xxx.xxx.xxx Command returns OK result code if successful. Note: the firewall applies for incoming (listening) connections only. Firewall general policy is DROP , therefore all packets that are not included into an ACCEPT chain rule will be silently discarded. When a packet comes from the IP address incoming_IP , the firewall chain rules will be scanned for matching with the following criteria: incoming_IP & = & page 189 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

190 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #FRWL - Firewall Setup If criteria is matched, then the packet is accepted and the rule scan is finished; if criteria is not matched for any chain the packet is silently dropped. Note: If all parameters are omitted the command reports the list of all ACCEPT chain rules registered in the Firewall settings in the format: #FRWL: , #FRWL: , ... OK Read command has the same effect as Execution command when AT#FRWL? parameters are omitted. . Test command returns the allowed values for parameter AT#FRWL=? Let assume we want to accept connections only from our Example devices which are on the IP addresses ranging from 197.158.1.1 to 197.158.255.255 We need to add the following chain to the firewall: AT#FRWL=1,"197.158.1.1","255.255.0.0" OK For outgoing connections made with #SKTD and the remote host Note #SKTOP chain for all the connection is dynamically inserted into the ACCEPT duration. Therefore the #FRWL command shall be used only for defining @SKTL #SKTL or the behaviour, deciding which hosts are either the allowed to connect to the local device. Rules are not saved in NVM, at start-up the rules list will be empty. page 190 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

191 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.4 Easy Camera® Management AT Commands 3.5.5.4.1 #CAMON - Camera ON #CAMON - Camera ON ON Execution command turns the Camera . AT#CAMON Read command has the same behaviour as Execution command AT#CAMON? AT#CAMON Example OK camera is now powered up 3.5.5.4.2 #CAMOFF - Camera OFF #CAMOFF - Camera OFF OFF . Execution command turns the Camera AT#CAMOFF Note: for the GPS product (GE863-GPS): if the camera is turned off while GPS or VAUX pin is enabled they’ll both also be powered off. Read command has the same behaviour as Execution command AT#CAMOFF? AT#CAMOFF Example OK camera is now powered down 3.5.5.4.3 #CAMEN - Camera ON/OFF #CAMEN - Camera ON/OFF . Execution command turns camera ON/OFF AT#CAMEN[= ] Parameter: - camera status 0 - turns camera OFF 1 - turns camera ON is omitted the Set command is the same as the Note: if parameter Read command. Note: for the GPS product (GE863-GPS): if the camera is turned off while GPS or VAUX pin is enabled they’ll both also be powered off. Read command reports the current camera status and, if the camera is ON , AT#CAMEN? the current camera model, in the format: #CAMEN: 0 if camera is OFF ON if camera is #CAMEN: 1, page 191 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

192 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Where: - camera model 2 - TRANSCHIP camera . Test command returns the allowed values for parameter AT#CAMEN=? 3.5.5.4.4 #SELCAM - Camera Model #SELCAM - Camera Model Set command selects current camera model AT#SELCAM[= []] Parameter: - camera model 0 - automatic detection (factory default) 2 - TRANSCHIP camera 3 - reserved for future use 4 - reserved for future use 5 - reserved for future use is the same as issuing the Read AT#SELCAM Note: issuing command. Note: issuing AT#SELCAM= is the same as issuing the command AT#SELCAM=0 Read command reports the current camera model in the format: AT#SELCAM? #SELCAM: Test command returns the allowed values for parameter AT#SELCAM=? 3.5.5.4.5 #CAMRES - Camera Resolution #CAMRES - Camera Resolution Set command sets current camera resolution AT#CAMRES[= []] Parameter: - camera resolution 0 - VGA photo output,640x480 (factory default) 1 - QVGA photo output, 320x240 2 - QQVGA photo output, 160x120 3 - reserved for future use 4 - reserved for future use is the same as issuing the Read Note: issuing AT#CAMRES command. Note: issuing AT#CAMRES= is the same as issuing the command AT#CAMRES=0 . page 192 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

193 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 in format: Read command reports the current value of the parameter AT#CAMRES? #CAMRES: Test command returns the allowed values for parameter . AT#CAMRES=? 3.5.5.4.6 #CAMCOL - Ca mera Colour Mode #CAMCOL - Camera Colour Mode Set command sets current colour mode AT#CAMCOL[= []] Parameter: - camera colour mode 0 - colour mode (factory default) 1 - Black&White mode AT#CAMCOL is the same as issuing the Read Note: issuing command. Note: issuing AT#CAMCOL= is the same as issuing the command AT#CAMCOL=0 . Read command reports the current colour mode, in the format: AT#CAMCOL? #CAMCOL: . Test command returns the allowed values for parameter . AT#CAMCOL=? 3.5.5.4.7 #CAMQUA - Camera Photo Quality #CAMQUA - Camera Photo Quality Set command sets the quality of the photo. AT#CAMQUA[= []] Parameter: - photo quality 0 - low quality of picture, high Jpeg compression 1 - medium quality of picture, medium Jpeg compression 2 - high quality of picture, low Jpeg compression (factory default) Note: increasing the photo quality increases its size. Note: issuing AT#CAMQUA is the same as issuing the Read command. is the same as issuing the command AT#CAMQUA= Note: issuing AT#CAMQUA=0 . Read command reports the current photo quality, in the format: AT#CAMQUA? page 193 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

194 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CAMQUA: Test command returns the allowed values for parameter . AT#CAMQUA=? 3.5.5.4.8 #CMODE - Camera Exposure #CMODE - Camera Exposure Set command sets the camera exposure. AT#CMODE[= []] Parameter: - camera exposure 0 - daylight mode, short exposure (factory default) 1 - nightlight mode, long exposure is the same as issuing the Read command. Note: issuing AT#CMODE Note: issuing is the same as issuing the command AT#CMODE= AT#CMODE=0 Read command reports the current camera exposure in the format: AT#CMODE? #CMODE: Test command returns the allowed values for parameter . AT#CMODE=? 3.5.5.4.9 #CAMZOOM - Camera Zoom #CAMZOOM - Camera Zoom Set command sets current zoom. AT#CAMZOOM[= []] Parameter: - camera zoom 0 - no zoom, x1 (factory default) 1 - zoom, x2 2 - zoom, x4 3 - reserved for future use Note: issuing AT#CAMZOOM is the same as issuing the Read command. Note: issuing AT#CAMZOOM= is the same as issuing the command AT#CAMZOOM=0 . Read command reports the current zoom setting, in the format: AT#CAMZOOM? #CAMZOOM: . Test command returns the allowed values for parameter AT#CAMZOOM=? page 194 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

195 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 ra Time/Date Overprint 3.5.5.4.10 #CAMTXT - Came #CAMTXT - Camera Time/Date Overprint Set command sets time/date overprinting. AT#CAMTXT[= []] Parameter: - time/date overprinting mode 0 - no overprinting (factory default) 1 - time info printed at the bottom of picture 2 - date info printed at the bottom of picture 3 - time&date info printed at the bottom of picture 4 - reserved for future use AT#CAMTXT is the same as issuing the Read Note: issuing command. Note: issuing is the same as issuing the command AT#CAMTXT= AT#CAMTXT=0 . Read command reports the current time/date overprinting mode, in the AT#CAMTXT? format: #CAMTXT: . Test command returns the allowed values for parameter AT#CAMTXT=? 3.5.5.4.11 #TPHOTO - Camera Take Photo #TPHOTO - Camera Take Photo Execution command is used to take the photo and to store it in the AT#TPHOTO MODULE memory. Note: the photo is stored in the MODULE RAM memory, therefore after a power off it is lost. Note: there's only 1 position for the photo, every photo will overwrite the previous. Read command has the same behaviour as Execution command AT#TPHOTO? AT#TPHOTO Example OK the camera has taken the photo and it is now stored on the MODULE memory Note The photo is taken during IDLE time, if the mobile is busy on network operations, (e.g. during a call) the photo cannot be taken. page 195 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

196 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Camera Read Photo 3.5.5.4.12 #RPHOTO - #RPHOTO - Camera Read Photo Execution command is used to flushing the photo stored in the MODULE AT#RPHOTO RAM memory to the serial line, ending it with the sequence: OK Read command has the same behaviour as Execution command AT#RPHOTO? AT#RPHOTO Example (binary digits of the JPEG image) xxxxxxxxxxxx OK the photo has been flushed to the serial line Note The photo is flushed as hexadecimal characters in the format selected. The baudrate is fixed at 115200, using hardware flow control. 3.5.5.4.13 #OBJL - Object List #OBJL- Object List Command Execution command reports the list of the objects stored in the MODULE AT#OBJL[=] memory. Parameter: < obj> - type of objects to be listed, string type. “IMG” - image object. Note: the behaviour of the command doesn’t change even if the parameter is omitted The output format is: #OBJL: , where: - name of the object; it is always “Snapshot” - size of the object in bytes Read command has the same behaviour as Execution command AT#OBJL? Test command has the same behaviour as Execution command AT#OBJL=? AT#OBJL="IMG" Example #OBJL: Snapshot,47224 OK page 196 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

197 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.4.14 #OBJR - Object Read #OBJR - Object Read Execution command is used to flushing the photo stored in the MODULE AT#OBJR=, RAM memory to the serial line. "Snapshot" The difference between this command and output #OBJR is that #RPHOTO ends without the sequence: OK Parameter: - type of objects to be listed, string type “IMG” - Image object Note: is the only name of the object. "Snapshot" AT#OBJR="IMG","Snapshot" Example binary digits of the JPEG image xxxxxxxxxxxx ... the photo has been flushed to the serial line. Note The photo is flushed as hexadecimal characters in the format selected. The baudrate is fixed at 115200, using hardware flow control. page 197 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

198 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 E-mail Management AT Commands 3.5.5.5 3.5.5.5.1 #ESMTP - E-mail SMTP Server #ESMTP - E-mail SMTP Server Set command sets the SMTP server address, used for E-mail sending. AT#ESMTP SMTP server can be specified as IP address or as nick name. [=] Parameter: - SMTP server address, string type. This parameter can be either: - any valid IP address in the format: xxx.xxx.xxx.xxx - any host name to be solved with a DNS query in the format: (factory default is the empty string “”) is the output of Test command. Note: the max length for Note: If parameter is omitted then the behaviour of Set command is the same of Read command Read Command reports the current SMTP server address, in the format: AT#ESMTP? #ESMTP: Test command returns the max length for the parameter . AT#ESMTP=? AT#ESMTP="smtp.mydomain.com" Example OK The SMTP server used shall be inside the APN space (the smtp server Note provided by the network operator) or it must allow the Relay, otherwise it will refuse to send the email. 3.5.5.5.2 #EADDR - E-mail Sender Address #EADDR - E-mail Sender Address Set command sets the sender address string to be used for sending the e- AT#EADDR mail. [=] Parameter: - sender address, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) Note: If parameter is omitted then the behaviour of Set command is the same of Read command Read command reports the current sender address, in the format: AT#EADDR? #EADDR: page 198 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

199 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #EADDR - E-mail Sender Address Test command returns the maximum allowed length of the string parameter AT#EADDR=? . AT#EADDR="[email protected]" Example OK AT#EADDR? #EADDR: "[email protected]" OK Authentication User Name 3.5.5.5.3 #EUSER - E-mail #EUSER - E-mail Authentication User Name Set command sets the user identification string to be used during the AT#EUSER authentication step of the SMTP. [=] Parameter: - email authentication User ID, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) parameter shall be Note: if no authentication is required then the empty "". Note: If parameter is omitted then the behaviour of Set command is the same of Read command Read command reports the current user identification string, in the format: AT#EUSER? #EUSER: Test command returns the maximum allowed length of the string parameter AT#EUSER=? . AT#EUSER="myE-Name" Example OK AT#EUSER? #EUSER: "myE-Name" OK Note It is a different user field than the one used for GPRS authentication (see #USERID ). page 199 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

200 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.5.4 #EPASSW - E-mail Authentication Password #EPASSW - E-mail Authentication Password Set command sets the password string to be used during the authentication AT#EPASSW= step of the SMTP. Parameter: - email authentication password, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) Note: if no authentication is required then the parameter shall be empty "". Test command returns the maximum allowed length of the string parameter AT#EPASSW=? . AT#USERID="myPassword" Example OK Note It is a different password field than the one used for GPRS authentication (see ). #PASSW 3.5.5.5.5 #SEMAIL - E-mail Sendin g With GPRS Context Activation #SEMAIL - E-mail Sending With GPRS Context Activation Execution command activates a GPRS context, if not previously activated AT#SEMAIL= , and sends an e-mail message. The GPRS context is by #EMAILACT ,, deactivated when the e-mail is sent. [,] Parameters: - destination address, string type. - subject of the message, string type. - attached image flag 0 - don't attach any image 1 - attach the last snapshot taken - image name (default is “snapshot.jpg”) The device responds to the command with the prompt ' > ' and awaits for the message body text. Ctrl-Z To complete the operation send char ( 0x1A hex); to exit without writing the message send ESC char ( 0x1B hex). If e-mail message is successfully sent, then the response is . OK If message sending fails for some reason, an error code is reported Note: Care must be taken to ensure that durin g the command execution, page 200 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

201 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SEMAIL - E-mail Sending With GPRS Context Activation no other commands are issued. To avoid malfunctions is suggested to wait for the ERROR / +CMS or OK ERROR: response before issuing further commands. #GPRS Note: if GPRS context was previously activated by it’s not possible to successfully send the e-mail message and the response is the result code activation failed . Note: sending an e-mail with an image attachment can take quite a long time since it can be over 50Kb to send and can take more than 1 minute. ","subject of the mail",1 [email protected] AT#SEMAIL=" Example >message body... this is the text of the mail message... CTRL-Z ..wait.. OK Message has been sent. 3.5.5.5.6 #EMAILACT - E-mail GPRS Context Activation #EMAILACT - E-mail GPRS Context Ativation Execution command deactivates/activates the GPRS context, eventually AT#EMAILACT[= proceeding with the authentication with the parameters given with #PASSW []] #USERID . and Parameter: - GPRS context activation mode 0 - GPRS context deactivation request 1 - GPRS context activation request Note: issuing AT#EMAILACT reports the current status of the GPRS context for the e-mail, in the format: #EMAILACT: where: 0 - GPRS context deactivated 1 - GPRS context activated is the same as issuing the command Note: issuing AT#EMAILACT= AT#EMAILACT=0 . Read command has the same effect of the Execution command AT#EMAILACT? page 201 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

202 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #EMAILACT - E-mail GPRS Context Ativation AT#EMAILACT . . Test command returns the allowed values for parameter AT#EMAILACT=? AT#EMAILACT=1 Example OK Now GPRS Context has been activated AT# EMAILACT=0 OK Now GPRS context has been deactivated. 3.5.5.5.7 #EMAILD - E-mail Sending #EMAILD - E-mail Sending Execution command sends an e-mail message if GPRS context has already AT#EMAILD= . AT#EMAILACT=1 been activated with ,, [,] Parameters: - destination address, string type. - subject of the message, string type - attached image flag 0 - don't attach any image 1 - attach the last snapshot taken - image name (default is “snapshot.jpg”) The device responds to the command with the prompt ' > ' and awaits for the message body text. hex); to exit without To complete the operation send Ctrl-Z char ( 0x1A char ( ESC hex). 0x1B writing the message send If e-mail message is successfully sent, then the response is OK . If message sending fails for some reason, an error code is reported Note: Care must be taken to ensure that during the command execution, no other commands are issued. To avoid malfunctions is suggested to wait for the OK or ERROR / +CMS ERROR: response before issuing further commands. Note: sending an e-mail with an image attachment can take quite a long time since it can be over 50Kb to send and can take more than 1 minute. ”,”subject of the mail”,1 [email protected] AT#EMAILD=” Example >message body... this is the text of the mail message... CTRL-Z page 202 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

203 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #EMAILD - E-mail Sending ..wait.. OK Message has been sent. The only difference between this command and the is that this #SEMAIL Note command does not interact with the GPRS context status, leaving it ON or setting, thus, when the connection made #EMAILACT OFF according to the is closed, the context status is maintained. #EMAILD with 3.5.5.5.8 #ESAV - Email Parameters Save #ESAV - Email Parameters Save Execution command saves the actual e-mail parameters in the NVM of the AT#ESAV device. The values stored are: - E-mail User Name - E-mail Password - E-mail Sender Address - E-mail SMTP server Note If some parameters have not been previously specified then a default value will be taken. 3.5.5.5.9 #ERST - E-mail Parameters Reset #ERST - E-mail Parameters Reset Execution command resets the actual e-mail parameters in the NVM of the AT#ERST device to the default ones. The values reset are: - E-mail User Name - E-mail Password - E-mail Sender Address - E-mail SMTP server 3.5.5.5.10 #EMAILMSG -SMTP Read Message #EMAILMSG - SMTP Read Message Execution command returns the last response from SMTP server. AT#EMAILMSG Read command has the same behaviour as Execution command. AT#EMAILMSG? page 203 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

204 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.6 Easy Scan® Extension AT Commands 3.5.5.6.1 #CSURV - Network Survey #CSURV - Network Survey Execution command allows to perform a quick survey through channels AT#CSURV command issue, starting from #BND belonging to the band selected by last [=,] to channel channel . If parameters are omitted, a full band scan is performed. AT*CSURV [=,] Parameters: (both syntax are - starting channel possible) - ending channel After issuing the command the device responds with the string: Network survey started... and, after a while, a list of informations, one for each received carrier, is reported, each of them in the format: (For BCCH-Carrier) arfcn: bsic: rxLev: ber: mcc: mnc: lac: cellId: cellStatus: numArfcn: arfcn: [ ..[ ]] [numChannels: array: [ ..[]] [pbcch: [nom: rac: spgc: pat: nco: t3168: t3192: drxmax: ctrlAck: bsCVmax: alpha: pcMeasCh: ]]] where: - C0 carrier assigned radio channel (BCCH - Broadcast Control Channel) - base station identification code - receiption level (in dBm) - bit error rate (in %) - mobile country code - mobile network code - location area code - cell identifier - cell status ..CELL_SUITABLE - C0 is a suitable cell. CELL_LOW_PRIORITY - the cell is low priority based on the received system information. CELL_FORBIDDEN - the cell is forbidden. BARRED - the cell is barred based on the received s _ stem y CELL page 204 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

205 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURV - Network Survey information. is low. CELL_LOW_LEVEL - the cell CELL_OTHER - none of the above e.g. exclusion timer running, no BCCH available...etc. - number of valid channels in the Cell Channel Description - arfcn of a valid channel in the Cell Channel Description ( n is in the range ) 1.. - number of valid channels in the BCCH Allocation list; the output of this information for non-serving cells depends on last #CSURVEXT setting: 1. if #CSURVEXT=0 this information is displayed only for serving cell 2. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. n is in the range n - arfcn of a valid channel in the BA list ( > ); the output of this information for non- serving cells depends on last #CSURVEXT setting: 1. if #CSURVEXT=0 this information is displayed only for serving cell 2. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. 3. (The following informations will be printed only if GPRS is supported in the cell) - 0 1 - network operation mode 1 2 3 - routing area code 0..255 - - SPLIT_PG_CYCLE support ..0 - SPLIT_PG_CYCLE is not supported on CCCH on this cell ..1 - SPLIT_PG_CYCLE is supported on CCCH on this cell - priority access threshold 0 - 3..6 - - network control order 0..2 - - timer 3168 - timer 3192 - discontinuous reception max time (in seconds) - packed control ack - blocked sequenc countdown max value page 205 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

206 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURV - Network Survey - alpha parameter for power control type of channel which shall be used for downlink - measurements for power control 0 - BCCH 1 - PDCH (For non BCCH-Carrier ) arfcn: rxLev: where: - RF channel - receiption level (in dBm) The output ends with the string: Network survey ended Read command has the same behaviour as Execution command with AT#CSURV? parameters omitted. AT*CSURV? AT#CSURV Example Network survey started... 5 2 ber: 0.00 mcc: 610 mnc: 1 arfcn: 48 bsic: 24 rxLev: - _ SUITABLE lac: 33281 cellId: 3648 cellStatus: CELL numArfcn: 2 arfcn: 30 48 numChannels: 5 array: 14 19 22 48 82 arfcn: 14 rxLev: 8 Network survey ended OK The command is executed within max. 2 minutes. Note 3.5.5.6.2 #CSURVC - Networ k Survey (Numeric Format) #CSURVC - Network Survey (Numeric Format) a quick survey through channels Execution command allows to perform AT#CSURVC command issue, starting from #BND belonging to the band selected by last [=,] . If parameters are omitted, a full band scan is to channel channel performed. AT*CSURVC [=,] page 206 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

207 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) Parameters: (both syntax are - starting channel possible) - ending channel After issuing the command the device responds with the string: Network survey started... and, after a while, a list of informations, one for each received carrier, is reported, each of them in the format: (For BCCH-Carrier) ,,,,,,,, ,[, ..[ ]] [,[, ..[]] [ [ ]]] where: - C0 carrier assigned radio channel (BCCH - Broadcast Control Channel) - base station identification code - receiption level (in dBm) - bit error rate (in %) - mobile country code - mobile network code - location area code - cell identifier - cell status ..0 - C0 is a suitable cell (CELL_SUITABLE). 1 - the cell is low priority based on the received system information (CELL_LOW_PRIORITY). 2 - the cell is forbidden (CELL_FORBIDDEN). 3 - the cell is barred based on the received system information (CELL_BARRED). 4 - the cell is low (CELL_LOW_LEVEL). 5 - none of the above e.g. exclusion timer running, no BCCH available...etc.. (CELL_OTHER). - number of valid channels in the Cell Channel Description - arfcn of a valid channel in the Cell Channel Description ( n is in n the range 1.. ) - number of valid channels in the BCCH Allocation list; the output of this information for non-serving cells depends on last #CSURVEXT setting: ed onl y for la y p #CSURVEXT=0 this information is dis 1. if page 207 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

208 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) serving cell 2. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. n - arfcn of a valid channel in the BA list ( > n ); the output of this information for non- setting: serving cells depends on last #CSURVEXT #CSURVEXT=0 this information is displayed only for 1. if serving cell 2. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. (The following informations will be printed only if GPRS is supported in the cell) - 0 1 > - network operation mode - routing area code 0..255 - - SPLIT_PG_CYCLE support ..0 - SPLIT_PG_CYCLE is not supported on CCCH on this cell ..1 - SPLIT_PG_CYCLE is supported on CCCH on this cell - priority access threshold 0 - 3..6 - - network control order 0..2 - - timer 3168 - timer 3192 - discontinuous reception max time (in seconds) - packed control ack - blocked sequenc countdown max value - alpha parameter for power control - type of channel which shall be used for downlink measurements for power control 0 - BCCH 1 - PDCH (For non BCCH-Carrier) , where: - RF channel - receiption level (in dBm) page 208 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

209 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) The output ends with the string: Network survey ended Read command has the same behaviour as the Execution command with AT#CSURVC? parameters omitted AT*CSURVC? AT#CSURVC Example Network survey started... 48,24,-52,0.00,610,1,33281,3648,0,2,30 48,5,14 19 22 48 82 14,8 Network survey ended OK Note The command is executed within max. 2 minute. is the same as that provided by The information provided by #CSURVC #CSURVC . The difference is that the output of #CSURV is in numeric format only. ey Of User Defined Channels 3.5.5.6.3 #CSURVU - Network Surv #CSURVU - Network Survey Of User Defined Channels Execution command allows to perform a quick survey through the given AT#CSURVU=[ #BND channels. The range of available channels depends on the last [,[,... issue. [,]]]] . #CSURV The result format is like command AT*CSURVU=[ [,[,... Parameters: [,]]]] > n must be in a increasing order. is the same as issuing the command Note: issuing AT#CSURVU= . AT#CSURVU=0 AT#CSURVU=59,110 Example Network survey started... page 209 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

210 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 7 6 ber: 0.00 mcc: 546 mnc: 1 arfcn: 59 bsic: 16 rxLev: - SUITABLE _ lac: 54717 cellId: 21093 cellStatus: CELL numArfcn 2 arfcn: 36 59 arfcn: 110 rxLev: -107 Network survey ended OK Note The command is executed within max. 2 minute. User Defined Channels (Numeric 3.5.5.6.4 #CSURVUC - Network Survey Of Format) #CSURVUC - Network Survey Of User Defined Channels (Numeric Format) Execution command allows to perform a quick survey through the given AT#CSURVUC=[ channels. The range of available channels depends on the last #BND [,[,... issue. [,]]]] . #CSURVC The result format is like command AT*CSURVUC=[ [,[,... Parameters: [,]]]] - channel number (arfcn) > is the same as issuing the command Note: issuing AT#CSURVUC= . AT#CSURVUC=0 AT#CSURVUC=59,110 Example Network survey started... 59,16,-76,0.00,546,1,54717,21093,0,2,36 59 110,-107 Network survey ended written authorization - All Right reserved page 210 of 614 Reproduction forbidden without Telit Communications S.p.A.

211 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVUC - Network Survey Of User Defined Channels (Numeric Format) OK The command is executed within max. 2 minute. Note is the same as that provided by #CSURVUC The information provided by #CSURVU . The difference is that the output of #CSURVUC is in numeric format only. 3.5.5.6.5 #CSURVB - BC CH Network Survey #CSURVB - BCCH Network Survey (maximum M Execution command performs a quick network survey through AT#CSURVB= number of available frequencies depending on last selected band) channels. BCCH carriers are found. The survey stops as soon as #CSURV . The result format is like command Parameter: - number of desired BCCH carriers 1..M Test command reports the range of values for parameter in the format: AT#CSURVB=? (1-M) where M is the maximum number of available frequencies depending on last selected band. ork Survey (Numeric Format) 3.5.5.6.6 #CSURVBC - BCCH Netw #CSURVBC - BCCH Network Survey (Numeric Format) (maximum M Execution command performs a quick network survey through AT#CSURVBC= number of available frequencies depending on last selected band) channels. The survey stops as soon as BCCH carriers are found. The result is given in numeric #CSURVC . format and is like command Parameter: - number of desired BCCH carriers 1..M in the format: Test command reports the range of values for parameter AT#CSURVBC=? (1-M) page 211 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

212 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 is the maximum number of available frequencies depending on last M where selected band. 3.5.5.6.7 #CSURVF - Network Survey Format #CSURVF - Network Survey Format Set command controls the format of the numbers output by all the Easy AT#CSURVF[= Scan® []] Parameter: - numbers format 0 - Decimal 1 - Hexadecimal values, no text 2 - Hexadecimal values with text Note: issuing AT#CSURVF is the same as issuing the Read command. AT#CSURVF= is the same as issuing the command Note: issuing . AT#CSURVF=0 Read command reports the current number format, as follows: AT#CSURVF? #CSURVF: Test command reports the supported range of values for the parameter AT#CSURVF=? . 3.5.5.6.8 #CSURVNLF - < LF> Removing On Easy Scan® Commands Family #CSURVNLF - Removing On Easy Scan® Commands Family removing from Set command enables/disables the automatic AT#CSURVNLF each information text line. [=] Parameter: 0 - disables removing; they’ll be present in the information text (factory default) from imformation text 1 - remove Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command reports whether automatic removing is currently AT#CSURVNLF? enabled or not, in the format: Test command reports the range of values for parameter . AT#CSURVNLF=? page 212 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

213 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.6.9 #CSURVEXT - Ex tended Network Survey #CSURVEXT - Extended Network Survey Set command enables/disables extended network survey. AT#CSURVEXT [=] Parameter: 0 - disables extended network survey (factory default) 1 - enables extended network survey; all the network survey execution , #CSURVUC , #CSURVU , commands ( #CSURV , #CSURVC , #CSURVBC ) display the BAList for every valid scanned #CSURVB BCCh carrier 2 - enables extended network survey; all the network survey execution commands ( #CSURVUC #CSURV , #CSURVC , #CSURVU , , ) display the BAList for every valid scanned #CSURVB #CSURVBC , BCCh carrier and, if GPRS is supported in the cell, they report some GPRS informations carried by the System Information 13 of the BCCh Note: if parameter is omitted the behaviour of Set command is the same as Read command. network survey is currently Read command reports whether extended AT#CSURVEXT? enabled or not, in the format: . Test command reports the range of values for parameter AT#CSURVEXT=? page 213 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

214 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.7 Jammed Detect & Report AT Commands 3.5.5.7.1 #JDR - Jammed Detect & Report #JDR - Jammed Detect & Report Set command allows to control the Jammed Detect & Report feature. AT#JDR[= [ The MODULE can detect if a communication Jammer is active in its range [,, and give indication to the user of this condition either on the serial line with ]]] an unsolicited code or on a dedicated GPIO by rising it. The MODULE can also report to the network the Jammed status condition, even if normal communications are inhibited by the Jammer, by using a unique message. Parameters: - behaviour mode of the Jammed Detect & Report 0 - disables Jammed Detect & Report (factory default) 1 - enables the Jammed Detect; the Jammed condition is reported on pin GPIO2/JDR - Normal Operating Condition LOW GPIO2/JDR GPIO2/JDR - Jammed Condition. HIGH 2 - enables the Jammed Detect; the Jammed condition is reported with a single unsolicited result code on serial line, in the format: #JDR: where: JAMMED - Jammed condition detected OPERATIVE - Normal Operating condition restored. This code will be shown only after a jammed condition has occurred. 3 - enables the Jammed Detect; the MODULE will make both the actions =1 . and =2 as for 4 - enables the Jammed Detect; the Jammed condition is reported with an unsolicited code every 3s on serial line, in the format: #JDR: where: JAMMED - Jammed condition detected OPERATIVE - Normal Operating condition restored. This code will be shown only after a jammed condition has occurred. 5 - enables the Jammed Detect; the MODULE will make both the actions and =4 . =1 as for - Maximum Noise Power Level 0..127 page 214 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

215 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #JDR - Jammed Detect & Report - Disturbed Channel Minimum Number 0..254 Note: issuing is the same as issuing the Read command. AT#JDR AT#JDR= is the same as issuing the command Note: issuing AT#JDR=0 . Read command reports the current behaviour mode, Maximum Noise AT#JDR? Power Level and Disturbed Channel Minimum Number, in the format: #JDR: ,, Test command reports the supported range of values for the parameters AT#JDR=? and , AT#JDR=2 Example OK ...jammer enters in the range... #JDR: JAMMED ...jammer exits the range... #JDR: OPERATIVE Note It is suggested not to change the default setting for Maximum Noise Power Level and Disturbed Channel Minimum Number. If the device is installed in a particular environment where the default values permit to are not satisfactory the two parameters and adapt the detection to all conditions. page 215 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

216 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.8 Easy Script® Extension - Python 6 Interpreter, AT Commands 3.5.5.8.1 #WSCRIPT - Write Script #WSCRIPT - Write Script Execution command inserts a script text and save it with the name AT#WSCRIPT= in the NVM of the module supporting the Python extension. , [,] The script text should be sent using Raw Ascii file transfer. It is important to set properly the port settings. In particular: Baud rate: 115200 bps Flow control: hardware. Parameters: - file name, string type (max 16 chars, case sensitive). - file size in bytes - file hidden attribute (default). #RSCRIPT 0 - file content is readable with command will report empty file. #RSCRIPT 1 - file content is hidden, >>> ' and waits for The device responds to the command with the prompt ' the script file text for bytes. The operations completes when all the bytes are received. If script writing ends successfully, the response is OK ; otherwise an error code is reported Note: The script name should be passed between quotes and all .py extension - Script names are Case Executable Scripts files must have sensitive. Note: When sending the script be sure that the line terminator is and that your terminal program does not change it. Note: with the hidden attribute it is possible to protect your script from being viewed and copied, only the file name can be viewed, its content is hidden even if the file is still being run correctly. It's your care to maintain knowledge on what the script file contains. AT#WSCRIPT="First.py ",54,0 Example >>> here receive the prompt: depending on your editor settings it’s possible that the prompt overrides the above line; then type or send the script, sized 54 bytes OK 6 PYTHON is a registered trademark of the Python Software Foundation. page 216 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

217 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #WSCRIPT - Write Script Script has been stored. Note This command can also be used to write any text file in the MODULE- PYTHON memory (not script files only), for example application data or . .py settings files with a different extension than 3.5.5.8.2 #ESCRIPT - Select Active Script #ESCRIPT - Select Active Script Set command selects the name of the script that will be executed by the AT#ESCRIPT[= Easy Script® interpreter at the start-up. The script will be executed at start- []] up only if the DTR line is found LOW during initial start-up (that is: COM is not open on a PC), otherwise the Easy Script® interpreter will not execute and the module supporting the Python extension will behave normally answering only to AT commands on the serial port. Parameter: - file name, string type (max 16 chars, case sensitive). extension. .py Note: all script files must have must match with a file name written with the Note: The in order to have it run. #WSCRIPT Note: the command does not check whether the script does exist in the NVM of the module supporting the Python extension or not. If the file is not present at the start-up then the Script Interpreter will not execute. Note: issuing is the same as issuing the Read AT#ESCRIPT command. Note: issuing AT#ESCRIPT= is the same as issuing the command AT#ESCRIPT=”” . Read command reports the name of the script that will be executed by the AT#ESCRIPT? Easy Script® interpreter at the start-up. AT#ESCRIPT="First.py " Example OK ps u Script First.py will be executed at the next start- if DTR is found LOW. page 217 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

218 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.8.3 #RSCRIPT - Read Script #RSCRIPT - Read Script Execution command reports the content of script file . AT#RSCRIPT= Parameter: - file name, string type (max 16 chars, case sensitive). <<< The device responds to the command with the prompt ' ', followed by the script file text. Note: if the file was saved with the hidden attribute, then an empty file is reported with the OK result code. Note: If the file is not present an error code is reported. AT#RSCRIPT="First.py " Example hereafter receive the prompt: depending on your editor settings it’s possible that the prompt overrides the above line; then the script is displayed, immediately after the prompt << ... [#LSCRIPT: ]] #LSCRIPT: free bytes: where: - file name, string type (max 16 chars, case sensitive) > - size of available NVM memory in bytes Read command has the same behavior of Execution command. AT#LSCRIPT? AT#LSCRIPT Example #LSCRIPT: First.py 51 #LSCRIPT: Second.py 178 page 218 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

219 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #LSCRIPT - List Script Names #LSCRIPT: Third.py 95 #LSCRIPT: free bytes: 20000 OK 3.5.5.8.5 #DSCRIPT - Delete Script #DSCRIPT - Delete Script Execution command deletes a script file from NVM memory. AT#DSCRIPT= Parameter: - name of the script file to delete, string type (max 16 chars, case sensitive) Note: if the file is not present an error code is reported. AT#DSCRIPT="Third.py" Example OK 3.5.5.8.6 #REBOOT - Reboot #REBOOT - Reboot Execution command reboots immediately the unit. AT#REBOOT It can be used to reboot the system after a remote update of the script in order to have the new one running. Read command has the same behavior of Execution command. AT#REBOOT? AT#REBOOT Example ... Module Reboots ... Note This command does not return result codes. page 219 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

220 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.9 GPS AT Commands Set 3.5.5.9.1 $GPSP - GPS cont roller power management $GPSP - GPS controller power management Execution command allows to manage power-up or down of the GPS AT$GPSP= controller Parameter: 0 - GPS controller is powered down 1 - GPS controller is powered up (default) Note: for the GPS product (GE863-GPS): if the GPS controller is powered down while camera or VAUX pin is enabled they’ll both also be powered off. Read command reports return the current status AT$GPSP? Test command returns the range of values accepted (0-1) AT$GPSP=? Example AT$GPSP=0 OK Note If a camera is used with the module and it is powered on, the command will be not executed due to the fact the supply voltage is in common between the 2 devices. $GPSR - GPS Reset 3.5.5.9.2 $GPSR - GPS Reset Execution command allows to manage allows to reset the GPS AT$GPSR= controller. Parameter: 0 - Hardware reset: The GPS receiver is reset and restarts by using the values stored in the internal memory of the GPS receiver. (1 1 - Coldstart (No Almanac, No Ephemeris) : This option clears all data that is currently stored in the internal memory of the GPS receiver including position, almanac, ephemeris, and time. The stored clock drift however, is retained (1 : This option clears all initialization 2 - Warmstart (No ephemeris) data in the GPS receiver and subsequently reloads the data that is currently displayed in the Receiver Initialization Setup screen. The almanac is retained but the ephemeris is cleared. (1 3 - Hotstart (with stored Almanac and Ephemeris) : The GPS receiver restarts b g y usin the values stored in the internal memor of y page 220 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

221 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSR - GPS Reset the GPS receiver; validated ephemeris and almanac. Read command that provides the range of accepted values (0-3) AT$GPSR=? AT$GPSR=0 Example OK (1 Available only in Controlled mode. (SW reset) Note 3.5.5.9.3 $GPSD - GPS Device Type Set $GPSD - GPS Device Type Set Set command defines which GPS device is connected to the module. It AT$GPSD= dedicates the Serial port #1 of the module (TRACE) to receive the GPS strings from the GPS module. Parameter: 0 - none (Serial port not connected to GPS device) 2 - Controlled Mode (Modem serial port connected to GPS serial port – default) (1 Read command that returns the current status AT$GPSD? Test command that provides the range of accepted values for the AT$GPSD=? parameter (0-3) AT$GPSD=0 Example OK AT$GPSD=0 (1 AT$GPSSAV must be executed after to store this setting in memory Note (the new functionality will be available after the next power_on) 3.5.5.9.4 $GPSSW - GPS Software Version $GPSSW - GPS Software Version Execution command provides GPS Module software version in the AT$GPSSW format: $GPSSW: Example AT$GPSSW $GPSSW: GSW3.1.1_3.1.00.07-C23P1.00 OK Antenna Type Definition 3.5.5.9.5 $GPSAT – GPS $GPSAT – Configure GPS Antenna Type Set command selects the GPS antenna used. AT$GPSAT= Parameter: page 221 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

222 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSAT – Configure GPS Antenna Type 0 - GPS Antenna not supplied by the module 1 - GPS Antenna supplied by the module (default) Read command returns the current status AT$GPSAT? Test command provides the range of accepted values (0-1) AT$GPSAT=? Example AT$GPSAT=1 OK Note AT$GPSSAV must be executed to save this configuration If set to 0 the Antenna current and Voltage readout are not available. Refer to the HW user guide for the compatible GPS antennas 3.5.5.9.6 $GPSAV – GPS Ante nna Supply Voltage Readout $GPSAV – GPS Antenna Readout Voltage Read command returns the measured GPS antenna’s supply voltage in AT$GPSAV? mV AT$GPSAV? AT$GPSAV? $GPSAV:3800 OK Note Not available if antenna Type set to 0 3.5.5.9.7 $GPSAI – GPS Antenna Current Readout $GPSAI - GPS Antenna Current Monitor Read command reports the GPS antenna’s current consumption in AT$GPSAI? the format: (1 $GPSAI:[,] where: - the measured current in mA (1 < status> - 0 - GPS antenna OK 1 - GPS antenna consumption out of the limits Example AT$GPSAI? $GPSAI:040,0 OK (1 Available only if antenna protection is activated (see $GPSAP) Note page 222 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

223 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.9.8 $GPSAP – GPS Antenna Protection $GPSAP - GPS Antenna Protection Write command that allows to activate an automatic protection in AT$GPSAP=[,] case of high current consumption of GPS antenna. The protection disables the GPS antenna supply voltage. Parameters: 0 - deactivate current antenna protection (default) 1 - activate current antenna protection - the antenna current limit value in mA (000-200) parameter =0 If parameter is omitted Read command that returns the current antenna limit value in the AT$GPSAP? format: $GPSAP:, and Test command that returns the available ranges for AT$GPSAP=? AT$GPSAP=0 Example OK Note : no SW control on antenna st atus (HW current limitation only) (1 AT$GPSAP=1,25 OK activate current antenna protection with related current limit (1 AT$GPSAP? $GPSAP:1,050 OK Antenna protection activated with 50mA limit (1 Note AT$GPSSAV must be executed to save this configuration The module is already provided of an Hardware protection for the high current consumption that is automatically activated if the consumption exceeds 50mA page 223 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

224 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.5.5.9.9 $GPSNMUN – Unsolicited NMEA Data Configuration $GPSNMUN – Unsolicited NMEA Data Configuration Set command permits to activate an Unsolicited streaming of GPS data AT$GPSNMUN= (in NMEA format) through the standard GSM serial port (AT) and defines [,,,,< (1 which NMEA sentences will be available GSV>,,] Parameters: 0 - NMEA data stream de-activated (default) 1 - NMEA data stream activated 2 - NMEA data stream activated with the following unsolicited response syntax: 3 - dedicated NMEA data stream; it is not possible to send AT commands; with the escape sequence ‘+++’ the user can return to command mode - Global Positioning System Fix Data 0 - disable 1 - enable - Geographical Position - Latitude/Longitude 0 - disable 1 - enable - GPS DOP and Active Satellites 0 - disable 1 - enable - GPS Satellites in View 0 - disable 1 - enable - recommended Minimum Specific GPS Data 0 - disable 1 - enable - Course Over Ground and Ground Speed 0 - disable 1 - enable <0,0,0,0,0,0> DEFAULT: The unsolicited response syntax for =1 is: $GPSNMUN: Note: If all parameters are omitted then the behaviour of Set command is the same as Read command Read command returns whether the unsolicited GPS NMEA data AT$GPSNMUN? streaming is currently enabled or not, along with the NMEA sentences availability status, in the format: page 224 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

225 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSNMUN – Unsolicited NMEA Data Configuration ,,,, $GPSNMUN:,, Test command returns the supported range of values for parameters AT$GPSNMUN=? , ,,,,, Example AT$GPSNMUN=1,0,0,1,0,0,0 OK These sets the GSA as available sentence in the unsolicited message AT$GPSNMUN=0 OK Turn-off the unsolicited mode AT$GPSNMUN? $GPSNMUN: 1,0,0,1,0,0,0 OK Give the current frame selected (GSA) The unsolicited message will be: $GPSNMUN: $GPGSA,A,3,23,20,24,07,13,04,02,,,,,,2.4,1.6,1.8* 3C Reference NMEA 01803 Specifications (1 AT$GPSSAV must be executed to save this configuration Note The command is available in “Controlled Mode” only The available NMEA Sentences are depending on the GPS receiver used In GE863-GPS and GM862-GPS the fields PDOP and VDOP are not available Use NMEA serial port instead if full DOP info are needed $GPSACP – Get Acquired Position 3.5.5.9.10 $GPSACP - Get Acquired position information Read command returns information about the last GPS position in the AT$GPSACP format: $GPSACP: ,,,,, ,, ,,, where: - UTC time (hhmmss) referred to GGA sentence - ddmm.mmmm N/S (referred to GGA sentence) Values: page 225 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

226 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSACP - Get Acquired position information dd (degrees) 00 to 90 mm.mmmm (minutes) 00,0000 to 59.9999 N/S: North / South - dddmm.mmmm E/W (referred to GGA sentence) Values: ddd (degrees) 00 to 180 mm.mmmm (minutes) 00,0000 to 59.9999 E/W: East / West - x.x - Horizontal Diluition of Precision (referred to GGA sentence) - xxxx.x Altitude - mean-sea-level (geoid) in meters (referred to GGA sentence) - referred to GSA sentence 1 - Invalid Fix 2 - 2D fix 3 - 3D fix - ddd.mm - Course over Ground (degrees, True) (referred to VTG sentence) Values: ddd: 000 to 360 degrees mm 00 to 59 minutes - xxxx.x Speed over ground (Km/hr) (referred to VTG sentence) - xxxx.x- Speed over ground (knots) (referred to VTG sentence) - ddmmyy Date of Fix (referred to RMC sentence) Values: dd (day) 01 to 31 mm (month) 01 to 12 yy (year) 00 to 99 (2000 to 2099) - nn - Total number of satellites in view (referred to GSV sentence) AT$GPSACP Example $GPSACP:080220,4542.82691N,01344.26820E,259.07,3,2.1 ,0.1,0.0,0.0,270705,09 OK $GPSSAV – Save G PS Parameters Configuration 3.5.5.9.11 $GPSSAV – Save GPS Parameters Execution command saves the current configuration in the non volatile AT$GPSSAV EEPROM memory of the module. Example AT$GPSSAV page 226 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

227 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSSAV – Save GPS Parameters OK Note The module must be restarted to use the new configuration 3.5.5.9.12 $GPSRST – Restore to Default GPS Parameters $GPSRST – Restore all GPS Parameters Execution command restores the GPS parameters to “Factory Default” AT$GPSRST configuration and stores them in the non volatile EEPROM memory of the module. AT$GPSRST Example OK Note The module must be restarted to use the new configuration page 227 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

228 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6 SELINT 1 3.6.1 Hayes Compliant AT Commands 3.6.1.1 Generic Modem Control 3.6.1.1.1 &F - Set To Fact ory-Defined Configuration &F - Set To Factory-Defined Configuration Execution command sets the configuration parameters to default values AT&F[] specified by manufacturer; it takes in consideration hardware configuration switches and other manufacturer-defined criteria. Parameter: : 0 - just the factory profile base section parameters are considered. 1 - either the factory profile base section and the extended section are considered (full factory profile). is omitted, the command has the same Note: if parameter behaviour as AT&F0 Reference V25ter. 3.6.1.1.2 Z - Soft Reset Z - Soft Reset Execution command loads the base section of the specified user profile and ATZ[] the extended section of the default factory profile. Parameter: 0..1 - user profile number Note: any call in progress will be terminated. Note: if parameter is omitted, the command has the same behaviour as ATZ0 . Reference V25ter. page 228 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

229 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.1.3 +FCLASS - Select Active Service Class +FCLASS - Select Active Service Class Set command sets the wireless module in specified connection mode (data, AT+FCLASS= fax, voice), hence all the calls done afterwards will be data or voice. Parameter: 0 - data 1 - fax class 1 8 - voice Read command returns the current configuration value of the parameter AT+FCLASS? . Test command returns all supported values of the parameters . AT+FCLASS=? Reference GSM 07.07 Default Reset Basic Profile 3.6.1.1.4 &Y - Designate A &Y - Designate A Default Reset Basic Profile Execution command defines the basic profiles which will be loaded on AT&Y[] startup. Parameter: 0..1 - profile (default is 0): the wireless module is able to store 2 complete configurations (see command &W ). , which loads just once the desired Note: differently from command Z profile, the one chosen through command &Y will be loaded on every startup. Note: if parameter is omitted, the command has the same behaviour as AT&Y0 3.6.1.1.5 &P - Designate A Default Reset Full Profile &P - Designate A Default Reset Full Profile Execution command defines which full profile will be loaded on startup. AT&P[] Parameter: 0..1 – profile number: the wireless module is able to store 2 full configurations (see command &W ). page 229 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

230 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 , which loads just once the desired Note: differently from command Z will be loaded on every &P profile, the one chosen through command startup. Note: if parameter is omitted, the command has the same behaviour as AT&P0 Reference Telit Specifications 3.6.1.1.6 &W - Store Current Configuration &W - Store Current Configuration the complete configuration of the Execution command stores on profile AT&W[] device. Parameter: 0..1 - profile Note: if parameter is omitted, the command has the same behaviour of AT&W0 . In The Module Internal Phonebook 3.6.1.1.7 &Z - Store Telephone Number &Z - Store Telephone Number In The Wireless Module Internal Phonebook the telephone number Execution command stores in the record . AT&Z= The records cannot be overwritten, they must be cleared before rewriting. Parameters: - phonebook record - telephone number (string type) Note: the wireless module has a built in non volatile memory in which 10 telephone numbers of a maximum 24 digits can be stored Note: to delete the record must be the command AT&Z= issued. Note: the records in the module memory can be viewed with the command , while the telephone number stored in the record n can be dialed by AT&N . ATDS= giving the command page 230 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

231 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Phonebook Stored Numbers 3.6.1.1.8 &N - Display Internal &N - Display Internal Phonebook Stored Numbers Execution command returns the telephone number stored at the AT&N[] position in the internal memory. Parameter: - phonebook record number is omitted then all the internal records are shown. Note: if parameter 3.6.1.1.9 +GMI - Manufacturer Identification +GMI - Manufacturer Identification Execution command returns the manufacturer identification. AT+GMI Note: this is one of the commands whose output differs depending on the setting. last #SELINT Reference V.25ter 3.6.1.1.10 +GMM - Model Identification +GMM - Model Identification Execution command returns the model identification. AT+GMM Reference V.25ter +GMR - Revision Identification +GMR - Revision Identification Execution command returns the software revision identification. AT+GMR Reference V.25ter 3.6.1.1.11 +GCAP - Capabilities List +GCAP - Capabilities List Execution command returns the equipment supported command set list. AT+GCAP Where: +CGSM : GSM ETSI command set : Fax command set +FCLASS +DS : Data Service common modem command set : Mobile Specific command set +MS Reference V.25ter page 231 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

232 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.1.12 +GSN - Serial Number +GSN - Serial Number Execution command returns the device board serial number. AT+GSN Note: The number returned is not the IMSI, it is only the board number Reference V.25ter 3.6.1.1.13 &V - Display Cu rrent Configuration & Profile &V - Display Current Configuration & Profile Execution command returns some of the base configuration AT&V parameters settings. Note: this is one of the commands whose output differs depending on the last #SELINT setting. ent Configuration & Profile 3.6.1.1.14 &V0 - Display Curr &V0 - Display Current Configuration & Profile Execution command returns all the configuration parameters settings. AT&V0 &V , it is included only for backwards Note: this command is the same as compatibility. Note: this is one of the commands whose output differs depending on the last #SELINT setting. 3.6.1.1.15 &V1 - Display S Registers Values &V1 - Display S Registers Values registers in decimal and S Execution command returns the value of the AT&V1 hexadecimal value in the format: HEX REG DEC ... where - S register number (0..38) - current value in decimal notation - current value in hexadecimal notation page 232 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

233 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.1.16 &V3 - Displ ay S Registers Values &V3 - Display S Registers Values registers in decimal and S Execution command returns the value of the AT&V3 hexadecimal value in the format: REG DEC HEX ... where register number (0..38) S - - current value in decimal notation - current value in hexadecimal notation &V2 - Display La st Connection Statistics 3.6.1.1.17 &V2 - Display Last Connection Statistics Execution command returns the last connection statistics & connection AT&V2 failure reason. 3.6.1.1.18 \V - Single Line Connect Message \V - Single Line Connect Message Execution command set single line connect message. AT\V Parameter: 0 - off 1 - on 3.6.1.1.19 +GCI - Country Of Installation +GCI - Country Of Installation Set command selects the installation country code according to AT+GCI= ITU-T.35 Annex A. Parameter: 59 - it currently supports only the Italy country code Read command reports the currently selected country code. AT+GCI? Test command reports the supported country codes. AT+GCI=? page 233 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

234 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Reference V25ter. 3.6.1.1.20 %L - Line Signal Level %L - Line Signal Level It has no effect and is included only for backward compatibility with landline AT%L modems 3.6.1.1.21 %Q - Line Quality %Q - Line Quality It has no effect and is included only for backward compatibility with landline AT%Q modems L - Speaker Loudness 3.6.1.1.22 L - Speaker Loudness It has no effect and is included only for backward compatibility with landline ATL modems 3.6.1.1.23 M - Speaker Mode M - Speaker Mode It has no effect and is included only for backward compatibility with landline ATM modems page 234 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

235 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 DTE - Modem Interface Control 3.6.1.2 3.6.1.2.1 E - Command Echo E - Command Echo Set command enables/disables the command echo. ATE[] Parameter: 0 - disables command echo 1 - enables command echo (factory default) , hence command sent to the device are echoed back to the DTE before the response is given. Note: if parameter is omitted, the command has the same behaviour of ATE0 Reference V25ter 3.6.1.2.2 Q - Quiet Result Codes Q - Quiet Result Codes Set command enables or disables the result codes. ATQ[] Parameter: 0 - enables result codes (factory default) 1 - every result code is replaced with a 2 - disables result codes ATQ2 ATQ1 every information text transmitted Note: After issuing either or in response to commands is not affected Note: if parameter is omitted, the command has the same behaviour as ATQ0 After issuing ATQ1 Example AT+CGACT=? +CGACT: (0-1) a ends the response After issuing ATQ2 AT+CGACT=? +CGACT: (0-1) nothing is appended to the response Reference V25ter page 235 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

236 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.2.3 V - Response Format V - Response Format Set command determines the contents of the header and trailer transmitted ATV[] with result codes and information responses. It also determines if result codes are transmitted in a numeric form or an alphanumeric form (see [§3.2.3 Information Responses And Result Codes] for the table of result codes). Parameter: 0 - limited headers and trailers and numeric format of result codes information responses result codes 1 - full headers and trailers and verbose format of result codes (factory default) information responses result codes portion of information responses is not affected by this Note: the setting. Note: if parameter is omitted, the command has the same behaviour of ATV0 Reference V25ter 3.6.1.2.4 X - Extended Result Codes X - Extended Result Codes Set command selects the result code messages subset used by the modem ATX[] to inform the DTE of the result of the commands. Parameter: 0 - send only ERROR NO , OK , CONNECT , RING , NO CARRIER , ANSWER results. Busy tones reporting is disabled. 1..4 - reports all messages (factory default is 1). page 236 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

237 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Note: If parameter is omitted, the command has the same behaviour as ATX0 Note +DR response message see also CONNECT For complete control on command. Reference V25ter 3.6.1.2.5 I - Identification Information I - Identification Information Execution command returns one or more lines of information text followed ATI[] by a result code. Parameter: 0 - numerical identifier. 1 - module checksum 2 - checksum check result 3 - manufacturer 4 - product name 5 - DOB version Note: this is one of the commands whose output differs depending on the setting. last #SELINT Note: if parameter is omitted, the command has the same behaviour as ATI0 Reference V25ter 3.6.1.2.6 &C - Data Carrier Detect (DCD) Control &C - Data Carrier Detect (DCD) Control Set command controls the RS232 DCD output behaviour. AT&C[] Parameter: remains high always. 0 - DCD is high, 1 - DCD follows the Carrier detect status: if carrier is detected DCD is low. (factory default) otherwise DCD 2 - off while disconnecting DCD Note: if parameter is omitted, the command has the same behaviour as AT&C0 Reference V25ter page 237 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

238 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 al Ready (DTR) Control 3.6.1.2.7 &D - Data Termin &D - Data Terminal Ready (DTR) Control Set command controls the Module behaviour to the RS232 DTR transitions. AT&D[] Parameter: 0 - transitions are ignored. (factory default) DTR high to low transition of DTR pin 1 - when the MODULE is connected, the the current connection is NOT sets the device in command mode, closed. 2 - when the MODULE is connected , the high to low transition of DTR pin sets the device in command mode and the current connection is closed. operation is enabled C108/1 3 - operation is disabled C108/1 4 - low , Note: if AT&D2 has been issued and the DTR has been tied autoanswering is inhibited and it is possible to answer only issuing command ATA . Note: if parameter is omitted, the command has the same behaviour as AT&D0 Reference V25ter 3.6.1.2.8 \Q - Standard Flow Control \Q - Standard Flow Control Set command controls the RS232 flow control behaviour. AT\Q[] Parameter: 0 - no flow control 1 - software bi-directional with filtering ( XON/XOFF ) active) 2 - hardware mono-directional flow control (only CTS 3 - hardware bi-directional flow control (both RTS/CTS active) (factory default) Note: if parameter is omitted, the command has the same behaviour as AT\Q0 &K’s ones. settings are functionally a subset of Note: \Q’s Reference V25ter page 238 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

239 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.2.9 &K - Flow Control &K - Flow Control Set command controls the RS232 flow control behaviour. AT&K[] Parameter: 0 - no flow control 1 - hardware mono-directional flow control (only CTS active) 2 - software mono-directional flow control ( XON/XOFF ) 3 - hardware bi-directional flow control (both RTS/CTS active) (factory default) 4 - software bi-directional with filtering ( XON/XOFF ) ) 5 - pass through: software bi-directional without filtering ( XON/XOFF RTS/CTS 6 - both hardware bi-directional flow control (both active) and XON/XOFF ) with filtering software bi-directional flow control ( Note: if parameter is omitted, the command has the same behaviour as AT&K0 , Note: &K has no Read Command. To verify the current setting of &K simply check the settings of the active profile with . AT&V 3.6.1.2.10 &S - Data Set Ready (DSR) Control &S - Data Set Ready (DSR) Control pin behaviour. Set command controls the RS232 DSR AT&S[] Parameter: 0 - always ON 1 - follows the GSM traffic channel indication. 2 - when connected ON 3 - ON when device is ready to receive commands (factory default). DSR is tied up when the device receives Note: if option 1 is selected then from the network the GSM traffic channel indication. Note: if parameter is omitted, the command has the same behaviour as AT&S0 page 239 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

240 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.2.11 \R - Ring (RI) Control \R - Ring (RI) Control RING output pin behaviour. Set command controls the AT\R[] Parameter: 0 - RING on during ringing and further connection 1 - RING on during ringing (factory default) 2 - RING follows the ring signal Note: to check the ring option status use the &V command. Note: if parameter is omitted, the command has the same behaviour as AT\R0 3.6.1.2.12 +IPR - Fixe d DTE Interface Rate +IPR - Fixed DTE Interface Rate Set command specifies the speed at which the device accepts DTE AT+IPR= commands during command mode operations; it may be used to fix the DTE-DCE interface speed. Parameter: 0 ..300 1200 2400 4800 9600 19200 38400 57600 115200 is or set to 0, then automatic speed detection is enabled and also If ) is set to auto-detect. (default) character format (see +ICF If DTE-DCE is specified and not 0, speed is fixed at that speed, hence no speed auto-detection (autobauding) is enabled. Read command returns the current value of parameter. +IPR AT+IPR? Test command returns the supported serial port speed list. AT+IPR=? Reference V25ter page 240 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

241 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.2.13 +IFC - DTE-Modem Local Flow Control +IFC - DTE-Modem Local Flow Control Set command selects the flow control behaviour of the serial port in both AT+IFC=, DTE to directions: from DTE to modem ( option) and from modem ) ( Parameter: - flow control option for the data received by DTE 0 - flow control None 1 - filtered XON/XOFF 2 - C105 (RTS) (factory default) XON/XOFF 3 - not filtered - flow control option for the data sent by modem 0 - flow control None 1 - XON/XOFF 2 - (factory default) C106 (CTS) Note: This command is equivalent to &K command. Read command returns active flow control settings. AT+IFC? Test command returns all supported values of the parameters AT+IFC=? and . Reference V25ter dem Local Rate Reporting 3.6.1.2.14 +ILRR - DTE-Mo +ILRR - DTE-Modem Local Rate Reporting Set command controls whether or not the +ILRR: information text is AT+ILRR= . transmitted from the modem to the DTE Parameter: 0 - local port speed rate reporting disabled (factory default) 1 - local port speed rate reporting enabled Note: this information if enabled is sent upon connection. . Read command returns active setting of AT+ILRR? . Test command returns all supported values of the parameter AT+ILRR=? Reference V25ter page 241 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

242 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +ICF - DTE-Modem Character Framing 3.6.1.2.15 +ICF - DTE-Modem Character Framing Set command defines the asynchronous character framing to be used when AT+ICF= autobauding is disabled. [,] Parameters: - determines the number of bits in the data bits, the presence of a parity bit, and the number of stop bits in the start-stop frame. 0 - autodetection 1 - 8 Data, 2 Stop 2 - 8 Data, 1 Parity, 1 Stop 3 - 8 Data, 1 Stop 4 - 7 Data, 2 Stop 5 - 7 Data, 1 Parity, 1 Stop - determines how the parity bit is generated and checked, if present 0 - Odd 1 - Even and Read command returns current settings for subparameters AT+ICF? . Test command returns the ranges of values for the parameters AT+ICF=? and Reference V25ter AT+ICF = 0 - auto detect Example AT+ICF = 1 - 8N2 AT+ICF = 2,0 - 8O1 AT+ICF = 2,1 - 8E1 AT+ICF = 3 - 8N1 (default) AT+ICF = 5,0 - 7O1 AT+ICF = 5,1 - 7E1 page 242 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

243 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.3 Call Control 3.6.1.3.1 D - Dial D - Dial the phone number given as parameter. Execution command starts a call to ATD[;] If “;” is present, a VOICE call to the given number is performed, regardless of the current value of the connection mode set by +FCLASS command . Parameter: - phone number to be dialed setting. Note: type of call (data, fax or voice) depends on last +FCLASS Note: the numbers accepted are 0-9 and *,#,”A”, ”B”, ”C”, ”D”,”+”. Note: for backwards compatibility with landline modems modifiers “T”, ”P”, ”R”, ”,”, ”W”, “!”, “@” are accepted but have no effect. Issues a call to phone number which corresponding alphanumeric field is ATD>[;] ; all available memories will be searched for the correct entry. If “;” is present a VOICE call is performed. Parameter: - alphanumeric field corresponding to phone number; it must be enclosed in quotation marks. Note: used character set should be the one selected with either command Select TE character set @CSCS . +CSCS or > , Issues a call to phone number in phonebook memory storage [;] > ATD> (available memories may be queried with AT+CPBS=? ). If “ ; ” is present a voice call is performed. Parameters: - phonebook memory storage; it must not be enclosed in quotation marks. SM - SIM phonebook FD - SIM fixed dialling-phonebook LD - SIM last-dialling-phonebook MC - device missed (unanswered received) calls list RC - ME received calls list - entry location; it should be in the range of locations available in the memory used. y in entr of the active location ATD> < n > [;] Issues a call to p hone numbe r page 243 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

244 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 D - Dial phonebook memory storage (see +CPBS ). voice ” is present a ; call is performed. If “ Parameter: - active phonebook memory storage entry location; it should be in the range of locations available in the active phonebook memory storage. Issues a call to the last number dialed. ATDL Issues a call to the number stored in the MODULE internal phonebook ATDS=[;] position number . If “;” is present a VOICE call is performed. Parameter: - internal phonebook position to be called (See commands and &N ) &Z Issues a call overwriting the CLIR supplementary service subscription ATDI[;] default value for this call ATDi[;] If “;” is present a VOICE call is performed. I - invocation, restrict CLI presentation i - suppression, allow CLI presentation Issues a call checking the CUG supplementary service information for the ATDG[;] current call. Refer to +CCUG command. ATDg[;] If “;” is present a VOICE call is performed. This command is specific of GPRS functionality and causes the MT to ATD* perform whatever actions are necessary to establish communication [*][*[] between the TE and the external PDN. [*[]]]]# Parameters: - GPRS Service Code, a digit string (value 99) which identifies a request to use the GPRS - string that identifies the called party in the address space applicable to the PDP. - a string which indicates the layer 2 protocol to be used (see +CGDATA command). For communications software that does not support arbitrary characters in the dial string, the following numeric equivalents shall be used: 1 - PPP Other values are reserved and will result in an ERROR response to the Set command. - a digit which specifies a particular PDP context definition (see +CGDCONT command). Example To dial a number in SIM phonebook entry 6: ATD>SM6 page 244 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

245 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 D - Dial OK h entry of active To have a voice call to the 6- t phonebook: ATD>6; OK : “Name” To call the entry with alphanumeric field ATD>”Name”; OK Reference V25ter. 3.6.1.3.2 T - Tone Dial T - Tone Dial Set command has no effect is included only for backward compatibility with ATT landline modems. Reference V25ter. 3.6.1.3.3 P - Pulse Dial P - Pulse Dial Set command has no effect is included only for backward compatibility with ATP landline modems. Reference V25ter. 3.6.1.3.4 A - Answer A - Answer Execution command is used to answer to an incoming call if automatic ATA answer is disabled. Note: This command MUST be the last in the command line and must be character. followed immediately by a Reference V25ter. page 245 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

246 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.3.5 H - Disconnect H – Disconnect Execution command is used to close the current conversation (voice, data ATH or fax). Note: this command can be issued only in command mode; when a data conversation is active the device is in on-line mode (commands are not sensed and characters are sent to the other party), hence escape sequence (see register S2 ) is required before issuing this command, otherwise if &D1 option is active, DTR pin has to be tied low to return in command mode. Reference V25ter. 3.6.1.3.6 O - Return To On Line Mode O - Return To On Line Mode Execution command is used to return to on-line mode from command mode. ATO If there's no active connection it returns ERROR . Note: After issuing this command, if the device is in conversation, to send other commands to the device you must return to command mode by ) or tying low &D1 pin if issuing the escape sequence (see register S2 DTR option is active. Reference V25ter. 3.6.1.3.7 &G - Guard Tone &G - Guard Tone Set command has no effect is included only for backward compatibility with AT&G landline modems. 3.6.1.3.8 &Q - Sync/Async Mode &Q - Sync/Async Mode Set command has no effect is included only for backward compatibility with AT&Q landline modems. page 246 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

247 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.4 Modulation Control 3.6.1.4.1 +MS - Modulation Selection +MS - Modulation Selection Set command has no effect is included only for backward compatibility with AT+MS= landline modems. [, [, Parameter: [, - a string which specifies the preferred modem carrier to use in ]]] originating or answering a connection V21 V22 V22B V23C V32 V34 - it enables/disables automatic modulation negotiation. 0 - disabled 1 - enabled. It has effect only if it is defined for the associated modulation. may establish a DCE - it specifies the lowest value at which the connection. 0 - unspecified - it specifies the highest value at which the DCE may establish a connection. 0 - unspecified 300..14400 - rate in bps command. Note: to change modulation requested use +CBST , , Read command returns the current value of AT+MS? , parameters. , , Test command returns all supported values of the AT+MS=? , parameters. 3.6.1.4.2 %E - Line Quality Monitor A nd Auto Retrain Or Fallback/Fallforward %E - Line Quality Monitor And Auto Retrain Or Fallback/Fallforward Execution command has no effect and is included only for backward AT%E compatibility with landline modems. page 247 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

248 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.5 Compression Control 3.6.1.5.1 +DS - Data Compression +DS - Data Compression Set command sets the V42 compression parameter. AT+DS= Parameter: 0 - no compression, it is currently the only supported value Read command returns current value of the data compression parameter. AT+DS? Test command returns all supported values of the parameter AT+DS=? Reference V25ter 3.6.1.5.2 +DR - Data Compression Reporting +DR - Data Compression Reporting Set command enables/disables the data compression reporting upon AT+DR= connection. Parameter: 0 - data compression reporting disabled; 1 - data compression reporting enabled upon connection. Note: if enabled, the following intermediate result code is transmitted before the final result code: +DR: (the only supported value for is “NONE”) . Read command returns current value of AT+DR? Test command returns all supported values of the parameter AT+DR=? V25ter Reference page 248 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

249 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Break Control 3.6.1.6 3.6.1.6.1 \B - Transmit Break To Remote \B - Transmit Break To Remote Execution command has no effect and is included only for backward AT\B compatibility with landline modems 3.6.1.6.2 \K - Break Handling \K - Break Handling Execution command has no effect and is included only for backward AT\K compatibility with landline modems Parameter: 1..5 3.6.1.6.3 \N - Operating Mode \N - Operating Mode Execution command has no effect and is included only for backward AT\N compatibility with landline modems page 249 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

250 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.7 S Parameters ” are known as “ S-Parameters Basic commands that begin with the letter “ S ”. The number following S ” indicates the “parameter number” being referenced. If the number is not recognized as a valid the “ parameter number, an ERROR result code is issued. S-Parameter , an If no value is given for the subparameter of an result code will be issued ERROR and the stored value left unchanged. S-parameter : Note: what follows is a special way to select and set an ATS n selects n 3. n is in the range (0, 2, as current parameter number. If the value of 3, 4, 5, 7, 12, 25, 30, 38), this command establishes S n as last selected parameter. Every value out of this range and less than 256 can be used but has no meaning and is maintained only for backward compatibility with landline modems. or AT= S-parameter set the contents of the selected 4. ATS= Example: S7 ATS7 establishes as last selected parameter. AT=40 sets the content of S7 to 40 S7 to 15. ATS=15 sets the content of 3.6.1.7.1 S0 - Number Of Rings To Auto Answer S0 - Number Of Rings To Auto Answer Set command sets the number of rings required before device automatically ATS0[=] answers an incoming call. Parameter: - number of rings 0 - auto answer disabled (factory default) 1..255 - number of rings required before automatic answer. Read command returns the current value of S0 parameter. ATS0? without command echo and Test command returns the range for ATS0=? parenthesis. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s Reference V25ter page 250 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

251 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.7.2 S1 - Ring Counter S1 - Ring Counter is incremented each time the device detects the ring signal of an S1 ATS1 incoming call. S1 is cleared as soon as no ring occur. Note: the form ATS1 has no effect. ring counter. Read command returns the value of S1 ATS1? ring counter without Test command returns the range of values for S1 ATS1=? command echo and parenthesis. Note For either Read and Test command the format of the numbers in output is always 3 digits, left-filled with 0s 3.6.1.7.3 S2 - Escape Character S2 - Escape Character Set command sets the ASCII character to be used as escape character. ATS2[=] Parameter: - escape character decimal ASCII 0..255 - factory default value is 43 (+). Note: the escape sequence consists of three escape characters preceded to set n ms of idle (see S12 ). n and followed by Read command returns the current value of S2 parameter. ATS2? Test command returns the range for without command echo and ATS2=? parenthesis For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s 3.6.1.7.4 S3 - Command Li ne Termination Character S3 - Command Line Termination Character Set command sets the value of the character either recognized by the ATS3[=] device as command line terminator and generated by the device as part of the header, trailer, and terminator for result codes and information text, along with S4 parameter. Parameter: - command line termination character (decimal ASCII) 0..127 - factory default value is 13 (ASCII CR ) S3 Note: the “previous” value of is used to determine the command line S3 termination character for entering the command line containing the settin g command. However the result code issued shall use the “new” value page 251 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

252 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 of S3 (as set during the processing of the command line). Read command returns the current value of S3 parameter. ATS3? without command echo and Test command returns the range for ATS3=? parenthesis. Note For either Read and Test command the format of the numbers in output is always 3 digits, left-filled with 0s Reference V25ter 3.6.1.7.5 S4 - Response Formatting Character S4 - Response Formatting Character Set command sets the value of the character generated by the device as ATS4[=] part of the header, trailer, and terminator for result codes and information text, along with the S3 parameter. Parameter: - response formatting character (decimal ASCII) 0..127 - factory default value is 10 (ASCII ) LF S4 Note: if the value of is changed in a command line the result code issued in response of that command line will use the new value of S4 . S4 parameter. Read command returns the current value of ATS4? Test command returns the range for without command echo and ATS4=? parenthesis For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s Reference V25ter 3.6.1.7.6 S5 - Command Line Editing Character S5 - Command Line Editing Character Set command sets the value of the character recognized by the device as a ATS5[=] request to delete from the command line the immediately preceding character. Parameter: - command line editing character (decimal ASCII) BS 0..127 - factory default value is 8 (ASCII ). Read command returns the current value of S5 parameter. ATS5? Test command returns the range for without command echo and ATS5=? parenthesis. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s Reference V25ter page 252 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

253 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.1.7.7 S7 - Connection Completion Time-Out S7 - Connection Completion Time-Out Set command sets the amount of time, in seconds, that the device shall ATS7[=] allow between either answering a call (automatically or by A command) or completion of signalling of call addressing information to network (dialling), and establishment of a connection with the remote device. Parameter: - number of seconds 1..255 - factory default value is 60. Read command returns the current value of parameter. S7 ATS7? without command echo and Test command returns the range for ATS7=? parenthesis. Note For either Read and Test command the format of the numbers in output is always 3 digits, left-filled with 0s Reference V25ter 3.6.1.7.8 S12 - Escape Prompt Delay S12 - Escape Prompt Delay Set command sets the period, before and after an escape sequence, during ATS12[=

254 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 parenthesis. Note: the output depends on the choice made through #SELINT command. Note For either Read and Test command the format of the numbers in output is always 3 digits, left-filled with 0s nect Inactivity Timer S30 - Discon 3.6.1.7.10 S30 - Disconnect Inactivity Timer Set command defines the inactivity timeout in minutes. The device ATS30[=] disconnects if no characters are exchanged for a time period of at least minutes. Parameter: - expressed in minutes 0 - disabled, disconnection due to inactivity is disabled (factory default). 1..127 - inactivity timeout value. Read command returns the current value of S30 parameter. ATS30? without command echo and Test command returns the range for ATS30=? parenthesis. #SELINT Note: the output depends on the choice made through command. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s 3.6.1.7.11 S38 - Delay Before Forced Hang Up S38 -Delay Before Forced Hang Up Set command sets the delay, in seconds, between the device’s receipt of H ATS38[=] if device is programmed to command (or ON -to- OFF transition of DTR follow the signal) and the disconnect operation. Parameter: - expressed in seconds seconds for the remote device to 0..254 - the device will wait acknowledge all data in the device buffer before disconnecting (factory default value is 20). 255 - the device doesn’t time-out and continues to deliver data in the buffer until the connection is lost or the data is delivered. Note: parameter can be used to ensure that data in device buffer is sent before device disconnects. parameter. Read command returns the current value of S38 ATS38? Test command returns the range of supported values for without ATS38=? command echo and parenthesis. For either Read and Test command the format of the numbers in output is Note always 3 digits, left-filled with 0s page 254 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

255 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2 ETSI GSM 07.07 AT Commands 3.6.2.1 General 3.6.2.1.1 +CGMI - Request Manufacturer Identification +CGMI - Request Manufacturer Identification Execution command returns the device manufacturer identification code AT+CGMI without command echo. The output depends on the choice made through #SELINT command. Read command has the same behaviour as Execution command AT+CGMI? Reference GSM 07.07 Model Identification 3.6.2.1.2 +CGMM - Request +CGMM - Request Model Identification Execution command returns the device model identification code without AT+CGMM command echo. Reference GSM 07.07 Revision Identification 3.6.2.1.3 +CGMR - Request +CGMR - Request Revision Identification Execution command returns device software revision number without AT+CGMR command echo. Read command has the same behaviour as Execution command AT+CGMR? Reference GSM 07.07 Serial Number Identification 3.6.2.1.4 +CGSN - Request Product +CGSN - Request Product Serial Number Identification Execution command returns the product serial number, identified as the AT+CGSN IMEI of the mobile, without command echo. Read command has the same behaviour as Execution command AT+CGSN? Reference GSM 07.07 page 255 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

256 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.1.5 +CSCS - Select TE Character Set +CSCS - Select TE Character Set Set command sets the current character set used by the device. AT+CSCS [=] Parameter: - character set “IRA” - ITU-T.50 ”8859-1” - ISO 8859 Latin 1 ”PCCP437” - PC character set Code Page 437. ”UCS2” - 16-bit universal multiple-octet coded character set (ISO/IEC10646) Note: If parameter is omitted then the behaviour of Set command is the same as Read command. Read command returns the current value of the active character set. AT+CSCS? Test command returns the supported values of the parameter . AT+CSCS=? For compatibility with previous versions, Test command returns +CSCS: (“IRA”) An enhanced version of Test command has been defined: AT+CSCS=?? , . that provides the complete range of values for Enhanced test command returns the supported values of the parameter AT+CSCS=?? Reference GSM 07.07 3.6.2.1.6 +CIMI - Request International Mobile Subscriber Identity (IMSI) +CIMI - Request International Mobile Subscriber Identify (IMSI) Execution command returns the value of the Internal Mobile Subscriber AT+CIMI Identity stored in the SIM without command echo. Note: a SIM card must be present in the SIM card housing, otherwise the . ERROR command returns Read command has the same behaviour as Execution command AT+CIMI? Reference GSM 07.07 page 256 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

257 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.2 Call Control 3.6.2.2.1 +CHUP - Hang Up Call +CHUP - Hang Up Call Execution command cancels all active and held calls, also if a multi-party AT+CHUP session is running. result code Test command returns the OK AT+CHUP=? Reference GSM 07.07 3.6.2.2.2 +CBST - Select Bearer Service Type +CBST - Select Bearer Service Type , and with data rate Set command sets the bearer service AT+CBST the connection element to be used when data calls are originated. [= Values may also be used during mobile terminated data call setup, [, ). +CSNS especially in case of single numbering scheme calls (refer [,]]] Parameters: The default values of the subparameters are manufacturer specific since they depend on the purpose of the device and data services provided by it. Not all combinations of these subparameters are supported. The supported values are: 0 - autobauding (automatic selection of the speed, factory default) 1 - 300 bps (V.21) 2 - 1200 bps (V.22) 3 - 1200/75 bps (V.23) 4 - 2400 bps (V.22bis) 6 - 4800 bps (V.32) 7 - 9600 bps (V.32) 14 - 14400 bps (V.34) 65 - 300 bps (V.110) 66 - 1200 bps (V.110) 68 - 2400 bps (V.110 or X.31 flag stuffing) 70 - 4800 bps (V.110 or X.31 flag stuffing) 71 - 9600 bps (V.110 or X.31 flag stuffing) 75 - 14400 bps (V110 or X.31 flag stuffing) 0 - data circuit asynchronous (factory default) 0 - transparent 1 - non transparent (default) written authorization - All Right reserved page 257 of 614 Reproduction forbidden without Telit Communications S.p.A.

258 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CBST - Select Bearer Service Type Note: the settings AT+CBST=0,0,0 AT+CBST=14,0,0 AT+CBST=75,0,0 are not supported. Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. , Read command returns current value of the parameters AT+CBST? and Test command returns the supported range of values for the parameters. AT+CBST=? Reference GSM 07.07 3.6.2.2.3 +CRLP - Radio Link Protocol +CRLP - Radio Link Protocol Set command sets Radio Link Protocol (RLP) parameters used when non- AT+CRLP= transparent data calls are originated [,[, [,[,]]]] Parameters: - IWF window Dimension 1..61 - factory default value is 61 - MS window Dimension 1..61 - default value is 61 - acknowledge timer (10 ms units). 39..255 - default value is 78 - retransmission attempts 1..255 - default value is 6 - protocol version 0 Read command returns the current value of the RLP protocol parameters. AT+CRLP? Test command returns supported range of values of the RLP protocol AT+CRLP=? parameters. Reference GSM 07.07 page 258 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

259 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 ce Reporting Control 3.6.2.2.4 +CR - Servi +CR - Service Reporting Control Set command controls whether or not intermediate result code AT+CR= +CR: TA , where to the is returned from the TE ASYNC - asynchronous transparent SYNC - synchronous transparent REL ASYNC - asynchronous non-transparent REL SYNC - synchronous non-transparent If enabled, the intermediate result code is transmitted at the point during connect negotiation at which the has determined which speed and TA quality of service will be used, before any error control or data compression CONNECT reports are transmitted, and before the intermediate result code is transmitted. Parameter: 0 - disables intermediate result code report (factory default) 1 - enables intermediate result code report. This command replaces V.25ter [14] command Modulation Reporting Control +MR , which is not appropriate for use with a GSM terminal. Read command returns current intermediate report setting AT+CR? Test command returns the supported range of values of parameter AT+CR=? . Reference GSM 07.07 3.6.2.2.5 +CEER - Extended Error Report +CEER - Extended Error Report Execution command returns one or more lines of information text AT+CEER in the format: +CEER: This report regards some error condition that may occur: - the failure in the last unsuccessful call setup (originating or answering) - the last call release - the last unsuccessful GPRS attach or unsuccessful PDP context activation, page 259 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

260 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CEER - Extended Error Report - the last GPRS detach or PDP context deactivation. Note: if none of this condition has occurred since power up then No Error condition is reported Read command reports a information text regarding some error condition AT+CEER? that may occur result code. Test command returns OK AT+CEER=? Reference GSM 07.07 3.6.2.2.6 +CRC - Cellular Result Codes +CRC - Cellular Result Codes Set command controls whether or not the extended format of incoming call AT+CRC= indication is used. Parameter: 0 - disables extended format reporting (factory default) 1 - enables extended format reporting When enabled, an incoming call is indicated to the TE with unsolicited result code: +CRING: . instead of the normal RING where - call type: DATA FAX - facsimile (TS 62) VOICE - normal voice (TS 11) . Read command returns current value of the parameter AT+CRC? . Test command returns supported values of the parameter AT+CRC=? Reference GSM 07.07 page 260 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

261 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 le Numbering Scheme 3.6.2.2.7 +CSNS - Sing +CSNS - Single Numbering Scheme Set command selects the bearer or teleservice to be used when mobile AT+CSNS= terminated single numbering scheme call is established. Parameter values equals to a data set with +CBST command shall be used when service. Parameter: 0 - voice (factory default) 2 - fax (TS 62) 4 - data Note: if +CBST parameter is set to a value that is not applicable to single numbering calls, ME/TA shall map the value to the closest valid one. E.g. if user has set =71 , =0 and =1 (non-trasparent asynchronous 9600 bps V.110 ISDN connection) for mobile originated calls, ME/TA shall map the values into non-trasparent asynchronous 9600 bps V.32 modem connection when single num bering scheme call is answered. . Read command returns current value of the parameter AT+CSNS? . Test command returns supported values of the parameter AT+CSNS=? Reference GSM 07.07 3.6.2.2.8 +CVHU - Vo ice Hang Up Control +CVHU - Voice Hang Up Control drop DTR or “ " shall cause a voice ATH Set command selects whether AT+CVHU[= connection to be disconnected or not. ] Parameter: 0 - " Drop DTR " ignored but OK result code given. ATH disconnects. result code given. OK 1 - " ignored but Drop DTR " and ATH 2 - " Drop DTR " behaviour according to &D setting. ATH disconnects (factory default). Note: if parameter is omitted the behaviour of Set command is the same as Read command. parameter, Read command reports the current value of the AT+CVHU? +CVHU: Test command reports the range of supported values for parameter AT+CVHU=? page 261 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

262 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Network Service Handling 3.6.2.3 3.6.2.3.1 +CNUM - Subscriber Number +CNUM - Subscriber Number Execution command returns the subscriber number i.e. the phone number AT+CNUM of the device that is stored in the SIM card. Note: the returned number format is: +CNUM: , where - string containing the phone number in the format - type of number: 129 - national numbering scheme. 145 - international numbering scheme (contains the character "+"). Reference GSM 07.07 3.6.2.3.2 +COPN - Read Operator Names +COPN - Read Operator Names . The Execution command returns the list of operator names from the ME AT+COPN #SELINT command. output depends on the choice made through Reference GSM 07.07 3.6.2.3.3 +CREG - Netw ork Registration Report +CREG - Network Registration Report Set command enables/disables network registration reports depending on AT+CREG[= . the parameter []] Parameter: 0 - disable network registration unsolicited result code (factory default) 1 - enable network registration unsolicited result code 2 - enable network registration unsolicited result code with network Cell identification data =1 If , network registration result code reports: +CREG: where page 262 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

263 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CREG - Network Registration Report 0 - not registered, ME is not currently searching a new operator to register to 1 - registered, home network 2 - not registered, but ME is currently searching a new operator to register to 3 - registration denied 4 -unknown 5 - registered, roaming If =2 , network registration result code reports: +CREG: [,,] where: - Local Area Code for the currently registered on cell - Cell Id for the currently registered on cell =2 and the mobile is Note: and are reported only if registered on some network cell. Note: issuing is the same as issuing the Read command. AT+CREG AT+CREG= is the same as issuing the command Note: issuing AT+CREG=0 . parameter values in the Read command reports the and AT+CREG? format: +CREG: ,[,,] and the mobile is are reported only if =2 Note: and registered on some network cell. Test command returns the range of supported AT+CREG=? AT Example OK at+creg? +CREG: 0,2 (the MODULE is in network searching state) OK at+creg? +CREG: 0,2 OK at+creg? +CREG: 0,2 OK at+creg? page 263 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

264 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CREG - Network Registration Report +CREG: 0,2 OK at+creg? +CREG: 0,1 (the MODULE is registered ) OK at+creg? +CREG: 0,1 OK Reference GSM 07.07 3.6.2.3.4 +COPS - Operator Selection +COPS - Operator Selection Set command forces an attempt to select and register the GSM network AT+COPS[= operator. [ parameter defines whether the operator selection is done [, . automatically or it is forced by this command to operator [,]]]] . shall be given in format The operator The behaviour of +COPS command depends on the last #COPSMODE setting. (#COPSMODE=0) Parameters: 0 - automatic choice (the parameter will be ignored) (factory default) 1 - manual choice unlocked (network is kept as long as available, then it can be changed with some other suited networks to guarantee the service) 2 - deregister from GSM network; the MODULE is kept unregistered until a =0, 1, 4 +COPS is issued 5 or with will be ignored) 3 - set only parameter (the parameter 4 - manual/automatic ( field shall be present); if manual selection fails, automatic mode (=0 ) is entered 5 - manual choice locked (network is kept fixed, if the chosen network is not available, then the mobile has no service) 0 - alphanumeric long form (max length 16 digits) 1 - alphanumeric short form 2 - Numeric 5 digits [country code (3) + network code (2)] Reproduction forbidden without Telit Communications S.p.A. page 264 of 614 written authorization - All Right reserved

265 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +COPS - Operator Selection : network operator in format defined by parameter. (#COPSMODE=1) Parameters: 0 - automatic choice (the parameter will be ignored) (default) 1 - manual choice > field shall be present) (=0, 1 or 4 is issued +COPS 3 - set only parameter (the parameter will be ignored) 4 - manual/automatic ( field shall be present); if manual selection fails, automatic mode (=0 ) is entered 0 - alphanumeric long form (max length 16 digits) 2 - numeric 5 digits [country code (3) + network code (2)] parameter. : network operator in format defined by parameter setting is stored in NVM and available at next Note: reboot. If =1 or 4 , the selected network is stored in NVM too and is available at next reboot (this will happen even with a new SIM inserted) Note: issuing AT+COPS is the same as issuing the Read command. Note: issuing AT+COPS= is the same as issuing the command . AT+COPS=0 Read command returns current value of in and , AT+COPS? are format ; if no operator is selected, and omitted +COPS: [, , ] Test command returns a list of quadruplets, each representing an operator AT+COPS=? present in the network. #COPSMODE setting. The behaviour of Test command depends on the last (#COPSMODE=0) The command outputs as many rows as the number of quadruplets, each of them in the format: +COPS: ( ,=0)>,””, =2)>) page 265 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

266 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +COPS - Operator Selection where - operator availability 0 - unknown 1 - available 2 - current 3 - forbidden (#COPSMODE=1) The quadruplets in the list are separated by commas: +COPS: [list of supported ( ,=0)>,, =2)> )s][,,(list of supported s), (list of supporteds)] where - operator availability 0 - unknown 1 - available 2 - current 3 - forbidden Note: since with this command a network scan is done, this command may require some seconds before the output is given. (in =0 ) is the same as the Note: The value of parameter recent GM862 family products. Reference GSM 07.07 3.6.2.3.5 +CLCK - Facility Lock/ Unlock +CLCK - Facility Lock/Unlock Execution command is used to lock or unlock a ME o a network facility. AT+CLCK= , Parameters: [, - facility [,]] "SC" - SIM (PIN request) (device asks SIM password at power-up and when this lock command issued) "AO"- BAOC (Barr All Outgoing Calls) "OI" - BOIC (Barr Outgoing International Calls) "OX" - BOIC-exHC (Barr Outgoing International Calls except to Home Country) "AI" - BAIC (Barr All Incoming Calls) "IR" - BIC-Roam g Calls when Roamin g outside the home Barr Incomin ( page 266 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

267 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLCK - Facility Lock/Unlock country) "AB" - All Barring services (applicable only for ) =0 "AG" - All outGoing barring services (applicable only for =0 ) "AC" - All inComing barring services (applicable only for =0 ) "FD" - SIM fixed dialling memory feature (if PIN2 authentication has no t been done during the current session, PIN2 is required as ) "PN" - network Personalisation "PU" - network subset Personalisation - defines the operation to be done on the facility 0 - unlock facility 1 - lock facility 2 - query status - shall be the same as password specified for the facility from the DTE user interface or with command Change Password +CPWD - represents the class of information of the facility as sum of bits (default is 7) 1- voice (telephony) 2 - data (refers to all bearer services) 4 - fax (facsimile services) 8 - short message service 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access =2 and command successful, it returns: Note: when +CLCK: where - current status of the facility 0 - not active 1 - active Test command reports all the facility supported by the device. AT+CLCK=? Reference GSM 07.07 Note @CLCK The improving command has been defined. page 267 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

268 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.3.6 @CLCK - Facility Lock/ Unlock @CLCK - Facility Lock/Unlock o a network facility. ME Execution command is used to lock or unlock a [email protected]= , Parameters: [, - facility [,]] "SC" - SIM (PIN request) (device asks SIM password at power-up and when this lock command issued) "AO"- BAOC (Barr All Outgoing Calls) "OI" - BOIC (Barr Outgoing International Calls) "OX" - BOIC-exHC (Barr Outgoing International Calls except to Home Country) "AI" - BAIC (Barr All Incoming Calls) "IR" - BIC-Roam (Barr Incoming Calls when Roaming outside the home country) "AB" - All Barring services (applicable only for =0 ) =0 ) "AG" - All outGoing barring services (applicable only for =0 "AC" - All inComing barring services (applicable only for ) "FD" - SIM fixed dialling memory feature (if PIN2 authentication has no t been done during the current session, PIN2 is required as ) "PN" - network Personalisation "PU" - network subset Personalisation - defines the operation to be done on the facility 0 - unlock facility 1 - lock facility 2 - query status - shall be the same as password specified for the facility from the DTE user interface or with command Change Password +CPWD - represents the class of information of the facility as sum of bits (default is 7) 1- voice (telephony) 2 - data (refers to all bearer services) 4 - fax (facsimile services) 8 - short message service 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access =2 Note: when and command successful, it returns: @CLCK: , [@CLCK: ,[...]] page 268 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

269 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @CLCK - Facility Lock/Unlock where - the current status of the facility 0 - not active 1 - active - class of information of the facility Test command reports all the faci lities supported by the device. [email protected]=? Reference GSM 07.07 Example Querying such a facility returns an output on three rows, the first for voice, the second for data, the third for fax: [email protected] =”AO”,2 @CLCK: ,1 @CLCK: ,2 @CLCK: ,4 OK 3.6.2.3.7 +CPWD - Change Facility Password +CPWD - Change Facility Password Execution command changes the password for the facility lock function AT+CPWD=, . defined by command Facility Lock +CLCK , Parameters: - facility “SC” - SIM (PIN request) “AB” - All barring services “P2” - SIM PIN2 - string type, it shall be the same as password specified for the facility from the ME user interface or with command +CPWD . - string type, it is the new password is the ne Note: parameter is the old password while w one. which presents Test command returns a list of pairs ( , ) AT+CPWD=? the available facilities and the maximum length of their password ) ( Reference GSM 07.07 page 269 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

270 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.3.8 +CLIP - Calling Line Identification Presentation +CLIP - Calling Line Identification Presentation AT+CLIP[=[]] Set command enables/disables the presentation of the CLI (Calling Line Identity) at the . This command refers to the GSM supplementary service TE CLIP (Calling Line Identification Presentation) that enables a called subscriber to get the CLI of the calling party when receiving a mobile terminated call. Parameters: 0 - disables CLI indication (factory default) 1 - enables CLI indication If enabled the device reports after each RING the response: +CLIP:,,,, , where: - calling line number - type of address octet in integer format 145 - international numbering scheme (contains the character "+") 129 - national numbering scheme - string type subaddress of format specified by - type of subaddress octet in integer format - string type; alphanumeric representation of corresponding to the entry found in phonebook; used character set should be the one selected either with command Select TE or . @CSCS +CSCS character set 0 - CLI valid 1 - CLI has been withheld by the originator. 2 - CLI is not available due to interworking problems or limitation or originating network. is the same as issuing the Read command. AT+CLIP Note: issuing Note: issuing AT+CLIP= is the same as issuing the command . AT+CLIP=0 AT+CLIP? Read command returns the presentation status of the CLI in the format: +CLIP: , where: 0 - CLI presentation disabled page 270 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

271 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLIP - Calling Line Identification Presentation 1 - CLI presentation enabled - status of the CLIP service on the GSM network 0 - CLIP not provisioned 1 - CLIP provisioned 2 - unknown (e.g. no network is present ) Note: This command issues a status request to the network, hence it may take a few seconds to give the answer due to the time needed to exchange data with it. Test command returns the supported values of the parameter AT+CLIP=? Reference GSM 07.07 Note The command changes only the report behaviour of the device, it does not change CLI supplementary service setting on the network. Identification Restriction 3.6.2.3.9 +CLIR - Calling Line +CLIR - Calling Line Identification Restriction Set command overrides the CLIR subscription when temporary mode is AT+CLIR[=[]] provisioned as a default adjustment for all following outgoing calls. This adjustment can be revoked by using the opposite command. This command refers to CLIR-service (GSM 02.81) that allows a calling subscriber to enable or disable the presentation of the CLI to the called party when originating a call. Parameter: - facility status on the Mobile 0 - CLIR facility according to CLIR service network status 1 - CLIR facility active (CLI not sent) 2 - CLIR facility not active (CLI sent) Note: issuing AT+CLIR is the same as issuing the Read command. Note: issuing AT+CLIR= is the same as issuing the command AT+CLIR=0 . Read command gives the default adjustment for all outgoing calls ( ) and AT+CLIR? also triggers an interrogation of the provision status of the CLIR service ( ), where - facility status on the Mobile 0 - CLIR facility according to CLIR service network status 1 - CLIR facility active (CLI not sent) 2 - CLIR facility not active (CLI sent) page 271 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

272 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLIR - Calling Line Identification Restriction - facility status on the Network 0 - CLIR service not provisioned 1 - CLIR service provisioned permanently 2 - unknown (e.g. no network present, etc.) 3 - CLI temporary mode presentation restricted 4 - CLI temporary mode presentation allowed Test command reports the supported values of parameter . AT+CLIR=? Reference GSM 07.07 Note This command sets the default behaviour of the device in outgoing calls. +CCFC - Call Forwar ding Number And Conditions 3.6.2.3.10 +CCFC - Call Forwarding Number And Condition Execution command controls the call forwarding supplementary service. AT+CCFC= Registration, erasure, activation, deactivation, and status query are , supported. [,[, [, Parameters: [,,,

273 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCFC - Call Forwarding Number And Condition 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access - the time in seconds after which the call is diverted if "no reply"

274 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCWA - Call Waiting 2 - data 4 - fax (facsimile services) 8 - short message service 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access Note: the response to the query command is in the format: +CCWA:, where represents the status of the service: 0 - inactive 1 - active - class of calls the service status refers to. is in the Note: the unsolicited result code enabled by parameter format: +CCWA: ,,,, where - string type phone number of calling address in format specified by - type of address in integer format - see before - string type; alphanumeric representation of corresponding to the entry found in phonebook; used character . set should be the one selected with either +CSCS or @CSCS 0 - CLI valid 1 - CLI has been withheld by the originator 2 - CLI is not available due to in terworking problems or limitations of originating network Note: if parameter is omitted then network is not interrogated. Note: in the query command the class parameter must not be issued. Note: the difference between call waiting report disabling ( AT+CCWA = AT+CCWA = 0,0,7 ) is that in the 0,1,7 ) and call waiting service disabling ( first case the call waiting indication is sent to the device by network but this ; instead in the second case the call DTE last one does not report it to the page 274 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

275 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCWA - Call Waiting waiting indication is not generated by the network. Hence the device nd st results busy to the third party in the 2 case while in the 1 case a ringing indication is sent to the third party. has no effect a non sense and must Note: The command AT+CCWA=1,0 not be issued. Note: issuing AT+CCWA is the same as issuing the Read command. is the same as issuing the command AT+CCWA= Note: issuing . AT+CCWA=0 Read command reports the current value of the parameter . AT+CCWA? Test command reports the supported values for the parameter . AT+CCWA=? Reference GSM 07.07 3.6.2.3.12 +CHLD - Call Holding Services +CHLD - Call Holding Services Execution command controls the network call hold service. With this service AT+CHLD= it is possible to disconnect temporarily a call and keep it suspended while it is retained by the network, contemporary it is possible to connect another party or make a multiparty connection. Parameter: 0 - releases all held calls, or sets the UDUB (User Determined User Busy) indication for a waiting call. 1 - releases all active calls (if any exist), and accepts the other (held or waiting) call 1X - releases a specific active call X 2 - places all active calls (if any exist) on hold and accepts the other (held or waiting) call. 2X - places all active calls on hold except call X with which communication shall be supported 3 - adds an held call to the conversation Note: "X" is the numbering (starting with 1) of the call given by the sequence of setting up or receiving the calls (active, held or waiting) as seen by the served subscriber. Calls hold their num ber until they are released. New calls take the lowest available number. Note: where both a held and a waiting call exist, the above procedures apply to the waiting call (i.e. not to the held call) in conflicting situation. s . Test command returns the list of supported AT+CHLD=? page 275 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

276 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CHLD: (0,1,2,3) Note: consider what has been written about the Set command relating the actions on a specific call (X). Reference GSM 07.07 Note ONLY for VOICE calls 3.6.2.3.13 Supplementary Service Data +CUSD - Unstructured +CUSD - Unstructured Supplementary Service Data Set command allows control of the Unstructured Supplementary Service AT+CUSD[= Data (USSD [GSM 02.90]). [[, [,]]]] Parameters: - is used to disable/enable the presentation of an unsolicited result code. 0 - disable the result code presentation in the DTA 1 - enable the result code presentation in the DTA parameter is not given, network is not - USSD-string (when interrogated) - If indicates that GSM338 default alphabet is used ME/TA converts GSM alphabet into current TE character set (see +CSCS ). - If indicates that 8-bit data coding scheme is used: ME/TA converts each 8-bit octet into two IRA character long hexadecimal as two TE number; e.g. octet with integer value 42 is presented to characters 2A (IRA 50 and 65). - GSM 3.38 Cell Broadcast Data Coding Scheme in integer format (default is 0). is in the Note: the unsolicited result code enabled by parameter format: +CUSD: [,,] to the TE where: : 0 - no further user action required (network initiated USSD-Notify, or no further information needed after mobile initiated operation). 1 - further user action required (network initiated USSD-Request, or further information needed after mobile initiated operation) 2 - USSD terminated by the network 3 - other local client has responded 4 - operation not supported page 276 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

277 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CUSD - Unstructured Supplementary Service Data 5 - network time out Note: in case of successful mobile initiated operation, DTA waits the USSD before the final result DTE response from the network and sends it to the code. This will block the AT command interface for the period of the operation. is the same as issuing the Read command. Note: issuing AT+CUSD is the same as issuing the command Note: issuing AT+CUSD= AT+CUSD=0 . Read command reports the current value of the parameter AT+CUSD? Test command reports the supported values for the parameter AT+CUSD=? Reference GSM 07.07 Note Only mobile initiated operations are supported 3.6.2.3.14 +CAOC - Advice Of Charge +CAOC - Advice Of Charge Set command refers to the Advice of Charge supplementary service; the AT+CAOC[= command also includes the possibility to enable an unsolicited event []] reporting of the CCM (Call Cost Meter) information. Parameter: 0 - query CCM value 1 - disables unsolicited CCM reporting 2 - enables unsolicited CCM reporting is in the Note: the unsolicited result code enabled by parameter format: +CCCM: where: - call cost meter value hexadecimal representation (3 bytes) Note: the unsolicited result code is issued when the CCM value +CCCM changes, but not more than every 10 seconds. Note: issuing AT+CAOC is the same as issuing the Read command. is the same as issuing the command AT+CAOC= Note: issuing AT+CAOC=0 . Read command reports the value of parameter in the format: AT+CAOC? page 277 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

278 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CAOC - Advice Of Charge +CAOC: parameter. Test command reports the supported values for AT+CAOC=? Note: the representation format doesn’t match the v.25ter§5.7.3 “Information text formats for test commands”. The output is: +CAOC: 0, 1, 2 Reference GSM 07.07 Note +CAOC command uses the CCM of the device internal memory, not the CCM stored in the SIM. The difference is that the internal memory CCM is reset at power up, while the SIM CCM is reset only on user request. Advice of Charge values stored in the SIM (ACM, ACMmax, PUCT) can be . and +CAMM , accessed with commands +CACM +CPUC 3.6.2.3.15 +CLCC - List Current Calls +CLCC - List Current Calls Execution command returns the list of current calls and their characteristics AT+CLCC in the format: [+CLCC:,

,,,,, [+CLCC:,,,,,,[...]]] where: - call identification number > - call direction 0 - mobile originated call 1 - mobile terminated call - state of the call 0 - active 1 - held 2 - dialing ( MO call) 3 - alerting ( MO call) 4 - incoming ( MT call) call) MT 5 - waiting ( - call type 0 - voice 1 - data 2 - fax page 278 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

279 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLCC - List Current Calls 9 - unknown - multiparty call flag 0 - call is not one of multiparty (conference) call parties - phone number in format specified by - type of phone number byte in integer format 129 - national numbering scheme 145 - international numbering scheme (contains the character "+") Note: If no call is active then only OK message is sent. This command is to know the various call status +CHLD useful in conjunction with command for call holding. Reference GSM 07.07 3.6.2.3.16 +CSSN - SS Notification +CSSN - SS Notification It refers to supplementary service related network initiated notifications. AT+CSSN[= Set command enables/disables the presentation of notification result codes [[,]]] from TA to TE . Parameters: - sets the +CSSI result code presentation status 0 - disable 1 - enable +CSSU - sets the result code presentation status 0 - disable 1 - enable and a supplementary service notification is received after a When =1 mobile originated call setup, an unsolicited code: +CSSI: call setup result codes, where: MO is sent to TE before any other : 1 - some of the conditional call forwardings are active 2 - call has been forwarded 3 - call is waiting 5 - outgoing calls are barred 6 - incoming calls are barred page 279 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

280 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSSN - SS Notification =1 and a supplementary service notification is received during a When mobile terminated call setup or during a call, an unsolicited result code +CSSU: , where: is sent to TE : 0 - this is a forwarded call ( MT call setup) 2 - call has been put on hold (during a voice call) 3 - call has been retrieved (during a voice call) Note: issuing is the same as issuing the Read command. AT+CSSN AT+CSSN= Note: issuing is the same as issuing the command AT+CSSN=0 . Read command reports the current value of the parameters. AT+CSSN? , Test command reports the supported range of values for parameters AT+CSSN=? . Reference GSM 07.07 oup Supplementary Service Control +CCUG - Closed User Gr 3.6.2.3.17 +CCUG - Closed User Group Supplementary Service Control Set command allows control of the Closed User Group supplementary AT+CCUG[= service [GSM 02.85]. [[, [,]]]] Parameters: 0 - disable CUG temporary mode (factory default). 1 - enable CUG temporary mode: it enables to control the CUG information on the air interface as a default adjustment for all following outgoing calls. 0..9 - CUG index 10 - no index (preferential CUG taken from subscriber data) (default) 0 - no information (default) 1 - suppress Outgoing Access (OA) 2 - suppress preferential CUG 3 - suppress OA and preferential CUG page 280 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

281 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 is the same as issuing the Read command. AT+CCUG Note: issuing is the same as issuing the command Note: issuing AT+CCUG= . AT+CCUG=0 Read command reports the current value of the parameters AT+CCUG? Test command reports the supported range of values for the parameters AT+CCUG=? , , Reference GSM 07.07 page 281 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

282 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.4 Mobile Equipment Control 3.6.2.4.1 +CPAS - Phon e Activity Status +CPAS - Phone Activity Status Execution command reports the device status in the form: AT+CPAS +CPAS: Where: - phone activity status TA/TE ) 0 - ready (device allows commands from 1 - unavailable (device does not allow commands from TA/TE ) 2 - unknown (device is not guaranteed to respond to instructions) 3 - ringing (device is ready for commands from , but the ringer is TA/TE active) 4 - call in progress (device is ready for commands from TA/TE , but a call is in progress) Read command has the same effect as Execution command. AT+CPAS? Test command reports the supported range of values for . AT+CPAS=? +CPAS Note: although is an execution command, ETSI 07.07 requires the Test command to be defined. Example ATD03282131321; OK AT+CPAS +CPAS: 3 the called phone is ringing OK AT+CPAS +CPAS: 4 the called phone has answered to your call OK ATH OK Reference GSM 07.07 3.6.2.4.2 +CFUN - Set Phone Functionality +CFUN - Set Phone Functionality . ME Set command selects the level of functionality in the AT+CFUN= Parameter: - is the power saving function mode 0 - minimum functionality, NON-CYCL IC SLEEP mode: in this mode, the level ou have set y , once A T interface is not accessible. Conse q uentl y page 282 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

283 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 0, do not send further characters. Otherwise these characters remain in the input buffer and may delay the output of an unsolicited result code. The first wake-up event stops power saving and takes the ME back to full functionality level =1 . 1 - mobile full functionality with power saving disabled (factory default) 2 - disable TX 4 - disable either TX and RX 5 - mobile full functionality with power saving enabled Note: if power saving enabled, it reduces the power consumption during the idle time, thus allowing a longer standby time with a given battery capacity. Note: to place the telephone in power saving mode, set the parameter at value = 5 and the line DTR (RS232) must be set to OFF . Once OFF in power saving, the CTS line switch to the status to signal that the telephone is really in power saving condition. During the power saving condition, before sending any AT command on the serial line, the DTR must be enabled and it must be waited for the CTS (RS232) line to go in ON status. Until the line is , the telephone will not return back in the power ON DTR saving condition. Note: the power saving function does not affect the network behavior of the MODULE, even during the power save condition the module remains registered on the network and reachable for incoming calls or SMS. If a call arrives during the power save, then the module will wake up and proceed normally with the unsolicited incoming call code Read command reports the current level of functionality. AT+CFUN? Test command returns the list of supported values for AT+CFUN=? For compatibility with previous versions, Test command returns +CFUN: (1, 5) An enhanced version of Test command has been defined: AT+CFUN=?? , that provides the complete range of values for . Enhanced test command returns the list of supported values for AT+CFUN=?? Reference GSM 07.07 3.6.2.4.3 +CPIN - Enter PIN +CPIN - Enter PIN sends to the device a password which is necessary before it Set command AT+CPIN[= can be operated (SIM PIN, SIM PUK, PH-SIM PIN, etc.). [,]] If the PIN required is SIM PUK or SIM PUK2, the is required. This second pin, ,will replace the old pin in the SIM. The command may be used to change the SIM PIN by sending it with both p ; if no PIN g endin uest is p arameters < p in> and when PIN re q page 283 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

284 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN request is pending the command will return an error code and to change the PIN the command must be used instead. +CPWD Parameters: - string type value - string type value. To check the status of the PIN request use the command AT+CPIN? Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. Read command reports the PIN/PUK/PUK2 request status of the device in AT+CPIN? the form: +CPIN: where: - PIN/PUK/PUK2 request status code READY - ME is not pending for any password SIM PIN - ME is waiting SIM PIN to be given SIM PUK - ME is waiting SIM PUK to be given PH-SIM PIN - ME is waiting phone-to-SIM card password to be given PH-FSIM PIN - ME is waiting phone-to-very first SIM card password to be given PH-FSIM PUK - ME is waiting phone-to-very first SIM card unblocking password to be given SIM PIN2 - ME is waiting SIM PIN2 to be given; this is returned only when the last executed command resulted in PIN2 ) authentication failure (i.e. +CME ERROR: 17 SIM PUK2 - ME is waiting SIM PUK2 to be given; this is returned only when the last executed command resulted in PUK2 authentication failure (i.e. +CME ERROR: 18 ) PH-NET PIN - ME is waiting network personalization password to be given PH-NET PUK - ME is waiting network personalization unblocking password to be given PH-NETSUB PIN - ME is waiting network subset personalization password to be given PH-NETSUB PIN - ME is waiting network subset personalization unblocking password to be given PH-SP PIN - ME is waiting service provider personalization password to be given ice provider personalization unblocking PH-SP PUK - ME is waiting serv password to be given PH-CORP PIN - ME is waiting corporate personalization password to be given PH-CORP PUK - ME is waiting corporate personalization unblocking password to be given page 284 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

285 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN Note: Pin pending status at startup depends on PIN facility setting, to change or query the default power up setting use either the AT+CLCK=SC,, command or the [email protected]=SC,, command. AT+CMEE=1 Example OK AT+CPIN? +CME ERROR: 10 error: you have to insert the SIM AT+CPIN? y ou inserted the SIM and device is not +CPIN: READY waiting for PIN to be given OK Note What follows is a list of the commands which are accepted when ME is pending SIM PIN or SIM PUK A #SRP #CAMOFF +IPR #CAP #CAMEN +ICF D #CODEC #TPHOTO +IFC H O #CBC #RPHOTO +CMUX E #SELCAM +CNMI #I2S1 I #STM #CAMQUA +CPAS L #SHFEC #CMODE +CCLK +CALA M #SHFSD #CAMRES #CAMTXT #HFMICG P +CRSM Q #HSMICG #CAMZOOM +CLIP #CAMCOL #GPIO +DR S #OBJL +DS T #SGPO #OBJR +MS #GGPI V #ADC #COPSMODE +GCAP X #QTEMP +GCI #DIALMODE Z #DAC #SEMAIL +ILRR &C #F26M #EMAILD +CALM &D #EUSER #RTCSTAT +CHUP &F &K #ACAL +FCLASS #EPASSW #PCT +FMI &N #ESMTP #WAKE #EADDR &P +FMM &S #SHDN #EMAILMSG +FMR &V #JDR #ESAV +FTS &W #ERST +FRS #CSURV &Y #CSURVC #QSS +FTM &Z #CSURVU #SSCTRACE +FRM +CFUN %E #CSURVUC +FRH %L +FTH +CGMI #CSURVF page 285 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

286 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN %Q #CSURVNLF +CGMM +FLO \K #CSURVB +CGMR +FPR +FDD \Q #CSURVBC +GMI \R +GMM +CSNS #PASSW \V #PKTSZ +GMR +CRLP #BND #SKTSAV +CGSN +CR #AUTOBND #SKTSET +GSN +CREG #CGMI #SKTOP +CRC +CGREG #CGMM #SKTTO +CMEE +COPS +CBC #CGMR #USERID +CPIN +CIND +CSQ #DSTO #CGSN #MONI #SKTCT +CSDH +CMER #SERVINFO #SKTRST +CRSL #SELINT +CLVL #FTPPUTPH #SRS #CAMON +CMUT All the above commands, but the ones in the grayed cells, can be issued even if the SIM card is not inserted yet. Reference GSM 07.07 3.6.2.4.4 +CSQ - Signal Quality +CSQ - Signal Quality Execution command reports received signal quality indicators in the form: AT+CSQ +CSQ:, where - received signal strength indication 0 - (-113) dBm or less 1 - (-111) dBm 2..30 - (-109)dBm..(-53)dBm / 2 dBm per step 31 - (-51)dBm or greater 99 - not known or not detectable - bit error rate (in percent) 0 - less than 0.2% 1 - 0.2% to 0.4% 2 - 0.4% to 0.8% 3 - 0.8% to 1.6% 4 - 1.6% to 3.2% 5 - 3.2% to 6.4% 6 - 6.4% to 12.8% 7 - more than 12.8% page 286 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

287 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSQ - Signal Quality 99 - not known or not detectable %Q and %L commands, Note: this command should be used instead of the since GSM relevant parameters are the radio link ones and no line is present, hence %Q %L and have no meaning. Read command has the same effect as Execution command. AT+CSQ? Test command returns the supported range of values of the parameters AT+CSQ=? and . Note: although +CSQ is an execution command, ETSI 07.07 requires the Test command to be defined. Reference GSM 07.07 3.6.2.4.5 +CIND - Indicator Control +CIND - Indicator Control Set command is used to control the registration / deregistration of ME AT+CIND[= , whenever the indicators, in order to automatically send the +CIEV URC [ value of the associated indicator changes. The supported indicators [,[,...]]]] ( AT+CIND=? ) and their order appear from test command Parameter: - registration / deregistration state 0 - the indicator is deregistered; it cannot be presented as unsolicited result code ( +CIEV URC ), but can be directly queried with AT+CIND? 1 - indicator is registered: indicator event report is allowed; this is the factory default for every indicator Note: issuing AT+CIND causes the read command to be executed causes all the indicators to be registered, Note: issuing AT+CIND= as the command AT+CIND=1,1,1,1,1,1,1,1,1 was issued. Read command returns the current value status of ME indicators, in the AT+CIND? format: +CIND: [,[,...]] s is the same as that in which appear Note: the order of the values the supported indicators from test command AT+CIND=? is a description returns pairs, where string value Test command AT+CIND=? (max. 16 chars) of the indicator and compound value is the supported values for the indicator, in the format: +CIND: (, (list of supported s))[,(, (list of supported s))[,...]] page 287 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

288 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 where: - indicator names as follows (along with their ranges) “battchg” - battery charge level - battery charge level indicator range 0..5 99 - not measurable “signal” - signal quality - signal quality indicator range 0..7 99 - not measurable “service” - service availability - service availability indicator range 0 - not registered to any network 1 - registered to home network “sounder” - sounder activity - sounder activity indicator range 0 - there’s no any sound activity 1 - there’s some sound activity “message” - message received - message received indicator range 0 - there is no unread short message at memory location “SM” 1 - unread short message at memory location “SM” “call” - call in progress - call in progress indicator range 0 - there’s no calls in progress 1 - at least a call has been established “roam” - roaming - roaming indicator range 0 - registered to home network or not registered 1 - registered to other network “smsfull” - a short message memory storage in the MT has become full (1), or memory locations are available (0) - short message memory storage indicator range 0 - memory locations are available 1 - a short message memory storage in the MT has become full. “rssi” - received signal (field) strength - received signal strength level indicator range 112 dBm ≤ 0 - signal strength 1..4 - signal strength in 15 dBm steps page 288 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

289 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 51 dBm ≥ 5 - signal strength 99 - not measurable Next command causes all the indicators to be registered Example AT+CIND=1,1,1,1,1,1,1,1,1 Next command causes all the indicators to be de- registered AT+CIND=0,0,0,0,0,0,0,0,0 Next command to query the current value of all indicators AT+CIND? CIND: 4,0,1,0,0,0,0,0,2 OK +CMER Note See command Reference GSM 07.07 3.6.2.4.6 +CMER - Mobile Equipment Event Reporting +CMER - Mobile Equipment Event Reporting Set command enables/disables sending of unsolicited result codes from AT+CMER[= TA to TE in the case of indicator state changes (n.b.: sending of URCs in [ the case of key pressings or display changes are currently not [, implemented). [, [, Parameters: [,]]]]]] - controls the processing of unsolicited result codes 0 - discard +CIEV Unsolicited Result Codes . when TA-TE link is reserved 1 - discard +CIEV Unsolicited Result Codes (e.g. on-line data mode); otherwise forward them directly to the TE. 2 - buffer +CIEV Unsolicited Result Codes in the TA when TA-TE link is reserved (e.g. on-line data mode) and flush them to the TE after reservation; otherwise forward them directly to the TE. 3 - forward +CIEV Unsolicited Result Codes directly to the TE; when TA Break is replaced with a (100 is in on-line data mode each +CIEV URC ms), and is stored in a buffer; onche the ME goes into command mode was entered), all URCs stored in the buffer will be output. (after +++ - keypad event reporting 0 - no keypad event reporting - display event reporting 0 - no display event reporting - indicator event reporting 0 - no indicator event reporting 1 - indicator event reporting page 289 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

290 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMER - Mobile Equipment Event Reporting Note: issuing AT+CMER causes the read command to be executed AT+CMER= causes the command Note: issuing to be issued. AT+CMER=0,0,0,0,0 Read command returns the current setting of parameters, in the format: AT+CMER? +CMER: ,,,, Test command returns the range of supported values for parameters AT+CMER=? , in the format: , , , , +CMER: (list of supported s),(list of supported s), (list of supported s),(list of supported s),(list of supported s) Reference GSM 07.07 Phonebook Memory Storage 3.6.2.4.7 +CPBS - Select +CPBS - Select Phonebook Memory Storage Set command selects phonebook memory storage , which will be AT+CPBS used by other phonebook commands. [=] Parameter: "SM" - SIM phonebook "FD" - SIM fixed dialling-phonebook (only phase 2/2+ SIM) "LD" - SIM last-dialling-phonebook ( +CPBF are not +CPBW and applicable for this storage) (+CPBW and "MC" - device missed (unanswered received) calls list are not applicable for this storage) +CPBF "RC" - ME received calls list ( +CPBW and +CPBF are not applicable for this storage) Note: If parameter is omitted then Set command has the same behaviour as Read command. Read command returns the actual values of the parameter , the AT+CPBS? number of occupied records and the maximum index number , in the format: +CPBS: ,, Note: For =”MC” : if there are more than one missed calls from the same number the read command will return only the last call Test command p e of values for the g pp orted ran arameters r eturns the su AT+CPBS=? Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 290 of 614

291 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 . Note: the presentation format of the Test command output is the set of , each of them enclosed in parenthesis: available values for +CPBS: ("SM"),("FD"),("LD"),("MC"),("RC") Reference GSM 07.07 3.6.2.4.8 +CPBR - Read Phonebook Entries +CPBR - Read Phonebook Entries Execution command returns phonebook entries in location number range AT+CPBR= from the current phonebook memory storage selected .. is omitted, only location is returned. with +CPBS . If [,] Parameters: - integer type value in the range of location numbers of phonebook memory - integer type value in the range of location numbers of phonebook memory The response format is: +CPBR: ,,, where: - the current position number of the PB index (to see the range of +CPBR=? values use ) - the phone number stored in the format - type of phone number byte in integer format 129 - national numbering scheme 145 - international numbering scheme (contains the character "+") - the alphanumeric text associated to the number; used character set should be the one selected with either command or +CSCS @CSCS . Note: If all queried locations are empty (but available), no information text lines will be returned, while if listing fails in an ME error, +CME ERROR: is returned. Test command returns the supported range of values of the parameters in AT+CPBR=? the form: +CPBR: ( - ),, where: number, integer type - the minimum page 291 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

292 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - the maximum number, integer type field length, integer type - maximum - maximum field length, integer type Note Remember to select the PB storage with +CPBS command before issuing PB commands. Reference GSM 07.07 3.6.2.4.9 +CPBF - Find Phonebook Entries +CPBF - Find Phonebook Entries Execution command issues a search for the phonebook records that have AT+CPBF= field the sub-string at the start of the Parameter: - string type, it is NOT case sensitive; used character set should be the one selected with either command +CSCS or @CSCS . The command returns a report in the form: +CPBF: ,,,[[...] >,,,] n +CPBF: , , have the same meaning as in the command +CPBR report. Note: if no PB records satisfy the search criteria then an ERROR message is reported. and Test command reports the maximum lengths of fields AT+CPBF=? in the PB entry in the form: +CPBF: [],[] Note Remember to select the PB storage with +CPBS command before issuing PB commands. Reference GSM 07.07 3.6.2.4.10 +CPBW - Write Phonebook Entry +CPBW - Write Phonebook Entry a phonebook record Execution command stores at the position AT+CPBW= parameters , and defined by [] , [ page 292 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

293 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Parameters: [, - record position [,]]] - string type, phone number in the format - the type of number 129 - national numbering scheme 145 - international numbering scheme (contains the character "+") - the text associated to the number, string type; used character set should be the one selected with either command +CSCS or @CSCS . Note: If record number already exists, it will be overwritten. Note: if only is given, the record number is deleted. Note: if is stored in the first free is omitted, the number phonebook location. Note: omission of all the subparameters causes an ERROR result code. returns location range supported by the current storage as Test command AT+CPBW=? a compound value, the maximum length of field supported number format of the storage and maximum length of field. The format is: +CPBW: (list of supported s),[], (list of supported s),[] where: - integer type value indicating the maximum length of field - integer type value indicating the maximum length of field Reference GSM 07.07 Remember to select the PB storage with command before issuing +CPBS Note PB commands. - Clock Management 3.6.2.4.11 +CCLK +CCLK - Clock Management Set command sets the real-time clock of the ME. AT+CCLK [=

294 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - current time as quoted string in the format :

295 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CALA - Alarm Management 1 - the MODULE simply wakes up fully operative as if the ON/OFF button ON had been pressed. If the device is already at the alarm time, then it does nothing. 2 - the MODULE wakes up in "alarm mode" if at the alarm time it was off, otherwise it remains fully operative. In both cases the MODULE issues an unsolicited code every 3s: +ALARM: is the +CALA optional parameter previously set. where The device keeps on sending the unsolicited code every 3s until a #WAKE #SHDN command is received or a 90s timeout occurs. If the or #WAKE device is in "alarm mode" and it does not receive the command within 90s then it shuts down. (default) 3 - the MODULE wakes up in "alarm mode" if at the alarm time it was off, otherwise it remains fully operative. In both cases the MODULE starts playing the alarm tone on the selected path for the ringer (see command #SRP ) The device keeps on playing the alarm tone until a or #SHDN #WAKE command is received or a 90s timeout o ccurs. If the device is in "alarm mode" and it does not receive the #WAKE command within 90s then it shuts down. 4 - the MODULE wakes up in "alarm mode" if at the alarm time it was off, otherwise it remains fully operative. In both cases the MODULE brings has been set to alarm high, provided its GPIO6 the pin output, and keeps it in this state until a or #SHDN command is #WAKE received or a 90s timeout occurs. If the device is in "alarm mode" and it does not receive the #WAKE command within 90s then it shuts down. 5 - the MODULE will make both the actions as for =2 and =3 . 6 - the MODULE will make both the actions as for =2 and =4 . 7 - the MODULE will make both the actions as for =3 and =4 . is - unsolicited alarm code text string. It has meaning only if equal to 2 or 5 or 6. Note: The "alarm mode" is indicated by hardware pin to the ON status CTS and DSR to the OFF status, while the "power saving" status is indicated by OFF a CTS - and DSR - OFF status. The normal operating status is indicated by DSR - ON . During the "alarm mode" the device will not make any network scan and will not register to any network and therefore is not able to dial or receive any call or SMS, the only commands that can be issued to the MODULE in this and state are the #SHDN , every other command must not be #WAKE issued during this state. page 295 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

296 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CALA - Alarm Management Note: If the parameter is omitted the behaviour of Set command is the same as Read command. Read command reports the current alarm time stored in the internal Real AT+CALA? Time Clock, if present, in the format: +CALA:

297 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CRSM - Restricted SIM Access where: , - information from the SIM about the execution of the actual command either on successful or on failed execution. - on a successful completion of the command previously issued it gives the requested data (hexadecimal character format). It’s not returned after a successful UPDATE BINARY or UPDATE RECORD command. Note: this command requires PIN authentication. However commands READ BINARY and READ RECORD can be issued before PIN authentication and if the SIM is blocked (after three failed PIN authentication attempts) to access the contents of the Elementary Files. Note: use only decimal numbers for parameters , , . , and result code OK Test command returns the AT+CRSM=? GSM 07.07, GSM 11.11 Reference 3.6.2.4.14 +CALM - Alert Sound Mode +CALM - Alert Sound Mode Set command is used to select the general alert sound mode of the device. AT+CALM[= ] Parameter: 0 - normal mode 1 - silent mode; no sound will be generated by the device, except for alarm sound 2 - stealth mode; no sound will be generated by the device Note: if silent mode is selected then incoming calls will not produce alerting sounds but only the unsolicited messages RING . +CRING or Note: If parameter is omitted then the behaviour of Set command is the same as Read command. Read command returns the current value of parameter . AT+CALM? Test command returns the supported values for the parameter as AT+CALM=? compound value. For compatibility with previous versions, Test command returns +CALM: (0,1) AT+CALM=?? , An enhanced version of Test command has been defined: . that provides the complete range of values for page 297 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

298 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Enhanced test command returns the complete range of values for the AT+CALM=?? as compound value: parameter +CALM: (0-2) Reference GSM 07.07 3.6.2.4.15 +CRSL - Ringer Sound Level +CRSL - Ringer Sound Level Set command is used to select the incoming call ringer sound level of the AT+CRSL[= device. ] Parameter: - ringer sound level 0 - Off 1 - low 2 - middle 3 - high 4 - progressive Note: if parameter is omitted then the behaviour of Set command is the same as Read command setting of the call ringer in the Read command reports the current AT+CRSL? format: +CRSL: supported values as compound value, in the Test command reports AT+CRSL=? format: +CRSL: (0-4) Note: an enhanced version of Test command has been defined: . AT+CRSL=?? Enhanced Test command returns the complete range of supported values AT+CRSL=?? : for the parameter +CRSL: (0-4) Reference GSM 07.07 3.6.2.4.16 +CLVL - Loudspeaker Volume Level +CLVL - Loudspeaker Volume Level Set command is used to select the volume of the internal loudspeaker audio AT+CLVL[= output of the device. ] page 298 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

299 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Parameter: - loudspeaker volume max - the value of 0.. max can be read by issuing the Test command AT+CLVL=? Note: If the parameter is omitted the behavior of Set command is the same as Read command. Read command reports the current setting of the loudspeaker AT+CLVL? volume in the format: +CLVL: Test command reports supported values range in the format: AT+CLVL=? +CLVL: (0- ) max Reference GSM 07.07 3.6.2.4.17 +CMUT - Microphone Mute Control +CMUT - Microphone Mute Control Set command enables/disables the muting of the microphone audio line AT+CMUT[=[]] during a voice call. Parameter: 0 - mute off, microphone active (factory default) 1 - mute on, microphone muted. Note: this command mutes/activates both microphone audio paths, internal mic and external mic. is the same as issuing the Read command. Note: issuing AT+CMUT Note: issuing AT+CMUT= is the same as issuing the command AT+CMUT=0 . Read command reports whether the muting of the microphone audio line AT+CMUT? during a voice call is enabled or not, in the format: +CMUT: parameter. Test command reports the supported values for AT+CMUT=? Reference GSM 07.07 3.6.2.4.18 +CACM - Ac cumulated Call Meter +CACM - Accumulated Call Meter page 299 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

300 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Set command resets the Advice of Charge related Accumulated Call Meter AT+CACM[= in SIM (ACM). Internal memory CCM remains unchanged. ] Parameter: - to access this command PIN2 password is required Note: If the parameter is omitted the behaviour of Set command is the same as Read command. Read command reports the current value of the SIM ACM in the format: AT+CACM? +CACM: is in units whose price and currency is defined with Note: the value command +CPUC Reference GSM 07.07 lated Call Meter Maximum 3.6.2.4.19 +CAMM - Accumu +CAMM - Accumulated Call Meter Maximum Set command sets the Advice of Charge related Accumulated Call Meter AT+CAMM[= command). This value ACM maximum value in SIM (see also +CACM , represents the maximum number of home units allowed to be consumed by ] the subscriber. When ACM reaches value further calls are prohibited. SIM PIN2 is required to set the value. Parameter: - maximum number of units allowed to be consumed - PIN2 password Note: The =0 value disables the feature. Note: if the parameters are omitted the behavior of Set command is the same as Read command. Read command reports the maximum value of ACM stored in SIM in the AT+CAMM? format: +CAMM : Reference GSM 07.07 3.6.2.4.20 +CPUC - Price Pe r Unit And Currency Table +CPUC - Price Per Unit And Currency Table Set command sets the values of Advice of Charge related price per unit and AT+CPUC[= currenc table information can be rice y p er unit currenc p y table in SIM. The , page 300 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

301 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CACM used to convert the home units (as used in commands +CAOC , ,] and +CAMM ) into currency units. Parameters: - string type; three-character currency code (e.g. LIT, USD, DEM etc..); used character set should be the one selected with either command . @CSCS or +CSCS - price per unit string (dot is used as decimal separator) e.g. 1989.27 - SIM PIN2 is usually required to set the values Note: if the parameters are omitted the behavior of Set command is the same as Read command. and Read command reports the current values of AT+CPUC? parameters in the format: +CACM : , Reference GSM 07.07 3.6.2.4.21 +CCID - Read ICCID (Integ rated Circuit Card Identification) +CCID - Read ICCID (Integrated Circuit Card Identification) Execution command reads on SIM the ICCID (card identification number AT+CCID that provides a unique identification number for the SIM) Read command has the same effect as Execution command. AT+ CCID? . OK Test command reports AT+CCID=? page 301 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

302 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.5 Mobile Equipment Errors 3.6.2.5.1 +CMEE - Report Mobile Equipment Error +CMEE - Report Mobile Equipment Error Set command enables/disables the report of result code: AT+CMEE[=[]] +CME ERROR: as an indication of an error relating to the +Cxxx commands issued. When enabled, device related errors cause the final result +CME ERROR: code instead of the default ERROR final result code. ERROR is anyway returned normally when the error message is related to syntax, invalid parameters, or DTE functionality. Parameter: - enable flag ERROR reports, use only +CME ERROR: 0 - disable report. in numeric format +CME ERROR: reports, with 1 - enable +CME ERROR: 2 - enable reports, with in verbose format is the same as issuing the Read command. AT+CMEE Note: issuing Note: issuing AT+CMEE= is the same as issuing the command AT+CMEE=0 . Read command returns the current value of subparameter AT+CMEE? +CMEE: Test command returns the range of values for subparameter in the format: AT+CMEE=? +CMEE: 0, 1, 2 Note: the representation format of the Test command output is not included in parenthesis. Reference GSM 07.07 page 302 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

303 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.6 Voice Control 3.6.2.6.1 +VTS - DTMF Tones Transmission +VTS - DTMF Tones Transmission Execution command allows the transmission of DTMF tones. AT+VTS= Parameters: [,duration] i.e. ASCII characters in the set (0-9), s, - string of #,*,(A-D) ; it allows the user to send a sequence of DTMF tones, each +VTD of them with a duration that was defined through command. - duration of a tone in 1/100 sec..; this parameter can be specified only if the length of first parameter is just one ASCII character 0 - a single DTMF tone will be transmitted for a duration depending on the +VTD setting is. network, no matter what the current (in 1..255 - a single DTMF tone will be transmitted for a time 10 ms multiples), no matter what the current setting is. +VTD +FCLASS ). Note: this commands operates in voice mode only (see For compatibility with previous versions, Test command returns AT+VTS=? +VTS: (),(),() AT+VTS=?? An enhanced version of Test command has been defined: , that provides the correct range of values for . Test command provides the list of supported s and the list of AT+VTS=?? supported in the format: s (list of supported s)[,(list of supported s)] Reference GSM 07.07 and TIA IS-101 3.6.2.6.2 +VTD - Tone Duration +VTD - Tone Duration Set command sets the length of tones transmitted with +VTS command. AT+VTD[= ] Parameter: - duration of a tone 0 - the duration of every single tone is dependent on the network (factory default) 1..255 - duration of every single tone in 1/10 sec. Note: If parameter is omitted the behaviour of Set command is the same as Read command. Read command reports the current Tone Duration, in the format: AT+VTD? Test command provides the list of supported s in the format: AT+VTD=? (list of supported s) GSM 07.07 and TIA IS-101 Reference page 303 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

304 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.7 Commands For GPRS Mobile Station Class 3.6.2.7.1 +CGCLASS - GPRS +CGCLASS - GPRS Mobile Station Class Set command sets the GPRS class according to parameter. AT+CGCLASS [=] Parameter: - GPRS class “B” - GSM/GPRS (factory default) “CG” - class C in GPRS only mode (GPRS only) “CC” - class C in circuit switched only mode (GSM only) Note: the setting is saved in NVM (and available on following reboot). Note: if parameter is omitted, then the behaviour of Set command is the same as Read command. Read command returns the current value of the GPRS class in the format: AT+CGCLASS? +CGLASS: Test command reports the range for the parameter AT+CGCLASS=? 3.6.2.7.2 +CGATT - GPRS Attach Or Detach +CGATT - GPRS Attach Or Detach Execution command is used to attach the terminal to, or detach the terminal AT+CGATT[= . from, the GPRS service depending on the parameter ] Parameter: - state of GPRS attachment 0 - detached 1 - attached Note: If the parameter is omitted the behaviour of Execution command is the same as Read command. Read command returns the current GPRS service state. AT+CGATT? Test command requests information on the supported GPRS service states. AT+CGATT=? Example AT+CGATT? +CGATT: 0 OK AT+CGATT=? +CGATT: (0,1) OK AT+CGATT=1 page 304 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

305 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGATT - GPRS Attach Or Detach OK Reference GSM 07.07 3.6.2.7.3 +CGREG - GPRS Network Registration Status +CGREG - GPRS Network Registration Status Set command controls the presentation of an unsolicited result code AT+CGREG[= : (see format below). +CGREG []] Parameter: - result code presentation mode 0 - disable network registration unsolicited result code 1 - enable network registration unsolicited result code; if there is a change in the terminal GPRS network registration status, it is issued the unsolicited result code: +CGREG: where: - registration status 0 - not registered, terminal is not currently searching a new operator to register to 1 - registered, home network 2 - not registered, but terminal is currently searching a new operator to register to 3 - registration denied 4 - unknown 5 - registered, roaming 2 - enable network registration and location information unsolicited result code; if there is a change of the network cell, it is issued the unsolicited result code: +CGREG: [,,] where: - registration status (see above for values) - location area code in hexadecimal format (e.g. "00C3" equals 195 in decimal) - cell ID in hexadecimal format Note: issuing AT+CGREG is the same as issuing the Read command. AT+CGREG= the command g is the same as issuin g Note: issuin page 305 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

306 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGREG - GPRS Network Registration Status . AT+CGREG=0 and Read command returns the status of result code presentation mode AT+CGREG? the integer which shows whether the network has currently indicated the registration of the terminal in the format: +CGREG:, . Test command returns supported values for parameter AT+CGREG=? Reference GSM 07.07 3.6.2.7.4 +CGDCONT - Define PDP Context +CGDCONT - Define PDP Context Set command specifies PDP context parameter values for a PDP context AT+CGDCONT[= identified by the (local) context identification parameter, [ [, Parameters: [, - (PDP Context Identifier) numeric parameter which specifies a [, particular PDP context definition. [, - where the value of 1.. max max is returned by the Test command [, - (Packet Data Protocol type) a string parameter which [, specifies the type of packet data protocol [,...[,pdN]]]]]]]]]] "IP" - Internet Protocol "PPP" - Point to Point Protocol - (Access Point Name) a string parameter which is a logical name that is used to select the GGSN or the external packet data network. If the value is null or omitted, then the subscription value will be requested. - a string parameter that identifies the terminal in the address space applicable to the PDP. The allocated address may be read using the +CGPADDR command. - numeric parameter that controls PDP data compression 0 - off (default if value is omitted) 1 - on - numeric parameter that controls PDP header compression 0 - off (default if value is omitted) 1 - on , ..., - zero to N string parameters whose meanings are specific to the Note: a special form of the Set command, +CGDCONT= , causes the to become undefined. values for context number Note: issuing is the same as issuing the Read AT+CGDCONT command. written authorization - All Right reserved page 306 of 614 Reproduction forbidden without Telit Communications S.p.A.

307 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGDCONT - Define PDP Context result code. Note: issuing AT+CGDCONT= returns the OK Read command returns the current settings for each defined context in the AT+CGDCONT? format: ,,,, +CGDCONT: , [,[,...[,pdN]]][+CGDCONT: ,,,,, [,[,...[,pdN]]][...]] Test command returns values supported as a compound value AT+CGDCONT=? AT+CGDCONT=1,”IP”, ”APN” ,”10.10.10.10”,0,0 Example OK AT+CGDCONT? APN” +CGDCONT: 1,”IP”,“ ,”10.10.10.10”,0,0 OK AT+CGDCONT=? +CGDCONT: (1-5),”IP”,,,(0-1),(0-1) OK Reference GSM 07.07 ice Profile (Minimum Acceptable) 3.6.2.7.5 +CGQMIN - Quality Of Serv +CGQMIN - Quality Of Service Profile (Minimum Acceptable) Set command allows to specify a minimum acceptable profile which is AT+CGQMIN[= checked by the terminal against the negotiated profile returned in the [ Activate PDP Context Accept message. [, [, Parameters: [, command). +CGDCONT - PDP context identification (see [, - precedence class [,]]]]]]] - delay class - reliability class - peak throughput class - mean throughput class If a value is omitted for a particular class then this class is not checked. Note: a special form of the Set command, +CGQMIN= causes the requested profile for context number to become undefined. Note: issuing AT+CGQMIN is the same as issuing the Read command. result code. Note: issuing AT+CGQMIN= returns the OK Read command s for each defined context in the r g eturns the current settin AT+CGQMIN? page 307 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

308 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGQMIN - Quality Of Service Profile (Minimum Acceptable) format: +CGQMIN: ,,,,, [+CGQMIN: ,, ,,,[...]] If no PDP context has been defined, it has no effect and OK result code is returned. Test command returns as a compound value the type of the current PDP AT+CGQMIN=? context and the supported values for the subparameters in the format: +CGQMIN: ,(list of supported s), (list of supported s),(list of supported s), (list of supported s),(list of supported s) Note: only the “IP” PDP_Type is currently supported. Example AT+CGQMIN=1,0,0,3,0,0 OK AT+CGQMIN? +CGQMIN: 1,0,0,5,0,0 OK AT+CGQMIN=? +CGQMIN: “IP”,(0-3),(0-4),(0-5),(0-9),(0-19,31) OK Reference GSM 07.07; GSM 03.60 3.6.2.7.6 +CGQREQ - Quality Of Service Profile (Requested) +CGQREQ - Quality Of Service Profile (Requested) Set command allows to specify a Quality of Service Profile that is used AT+CGQREQ[= when the terminal sends an Activate PDP Context Request message to the [ network. It specifies a profile for the context identified by the (local) context [, . identification parameter, [, [, Parameters: [, +CGDCONT - PDP context identification (see command). [,]]]]]]] - precedence class - delay class - reliability class - peak throughput class - mean throughput class If a value is omitted for a particular class then this class is not checked. page 308 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

309 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGQREQ - Quality Of Service Profile (Requested) Note: a special form of the Set command, +CGQREQ= causes the to become undefined. requested profile for context number AT+CGQREQ is the same as issuing the Read Note: issuing command. returns the Note: issuing AT+CGQREQ= OK result code. Read command returns the current settings for each defined context in the AT+CGQREQ? format: +CGQREQ: ,,,,, [+CGQREQ: ,, ,,,[...]] OK If no PDP context has been defined, it has no effect and result code is returned. Test command returns as a compound value the type of the current PDP AT+CGQREQ=? context and the supported values for the subparameters in the format: +CGQREQ: ,(list of supported s), (list of supported s),(list of supported s), (list of supported s),(list of supported s) Note: only the “IP” PDP_Type is currently supported. Example AT+CGQREQ? +CGQREQ: 1,0,0,3,0,0 OK AT+CGQREQ=1,0,0,3,0,0 OK AT+CGQREQ=? +CGQREQ: ”IP”,(0-3),(0-4),(0-5),(0-9),(0-19,31) OK GSM 07.07; GSM 03.60 Reference 3.6.2.7.7 +CGACT - PDP Context Activate Or Deactivate +CGACT - PDP Context Activate Or Deactivate Execution command is used to activate or deactivate the specified PDP AT+CGACT[= context(s) [[, [,[,...]]]]] Parameters: - indicates the state of PDP context activation 0 - deactivated 1 - activated page 309 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

310 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - a numeric parameter which specifies a particular PDP context definition (see +CGDCONT command) Note: if no s are specified the activation/deactivation form of the command activates/deactivates all defined contexts. Note: issuing AT+CGACT is the same as issuing the Read command. Note: issuing AT+CGACT= result code. OK returns the Read command returns the current activation state for all the defined PDP AT+CGACT? contexts in the format: +CGACT: ,[+CGACT: ,[...]] Test command reports information on the supported PDP context activation AT+CGACT=? states parameters in the format: +CGACT: (0-1) Example AT+CGACT? +CGACT: 1,1 OK AT+CGACT=1,1 OK Reference GSM 07.07 3.6.2.7.8 +CGPADDR - Show PDP Address +CGPADDR - Show PDP Address Execution command returns a list of PDP addresses for the specified AT+CGPADDR= context identifiers in the format: [[, [,...]]] +CGPADDR: ,[ +CGPADDR: ,[...]] Parameters: - a numeric parameter which specifies a particular PDP context definition (see +CGDCONT command). If no is specified, the addresses for all defined contexts are returned. - a string that identifies the terminal in the address space applicable to the PDP. The address may be static or dynamic. For a static address, it will be the one set by the +CGDCONT command when the context was defined. For a dynamic address it will be the one assigned during the last PDP context activation that used the context definition referred to b is omitted if none is ; addr> _ page 310 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

311 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGPADDR - Show PDP Address available Test command returns a list of defined s. AT+CGPADDR=? Example AT#GPRS=1 +IP: xxx.yyy.zzz.www OK AT+CGPADDR=1 +CGPADDR: 1,”xxx.yyy.zzz.www” OK AT+CGPADDR=? +CGPADDR: (1) OK Reference GSM 07.07 3.6.2.7.9 +CGDATA - Enter Data State +CGDATA - Enter Data State Execution command causes to perform whatever actions are necessary to AT+CGDATA= establish a communication with the network using one or more GPRS PDP [,[ types. [,[,...]]]] Parameters: - string parameter that indicates the layer 2 protocol to be used "PPP" - PPP Point-to-point protocol - numeric parameter which specifies a particular PDP context command). definition (see +CGDCONT Note: if parameter is omitted, the layer 2 protocol is unspecified Test command reports information on the supported layer 2 protocols. AT+CGDATA=? Note: the representation format of the Test command output is not included in parenthesis AT+CGDATA=? Example +CGDATA: ”PPP” OK AT+CGDATA=”PPP”,1 OK Reference GSM 07.07 page 311 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

312 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.2.8 Commands For Battery Charger 3.6.2.8.1 +CBC - Battery Charge +CBC - Battery Charge Execution command returns the current Battery Charge status in the format: AT+CBC +CBC: , where: - battery charge status 0 - ME is powered by the battery 1 - ME has a battery connected, and charger pin is being powered 2 - ME does not have a battery connected 3 - Recognized power fault, calls inhibited - battery charge level 0 - battery is exhausted, or ME does not have a battery connected 25 - battery charge remained is estimated to be 25% 50 - battery charge remained is estimated to be 50% 75 - battery charge remained is estimated to be 75% 100 - battery is fully charged. indicates that the battery charger supply is inserted and the =1 Note: battery is being recharged if necessary with it. Supply for operations is ME taken anyway from VBATT pins. Note: without battery/power connected on VBATT pins or during a power fault the unit is not working, therefore values =2 and =3 will never appear. Read command has the same effect as Execution command. AT+CBC? and , Test command returns the complete range of values for AT+CBC=? in the format: +CBC: (0-3),(0-100) Note: an enhanced version of Test command has been defined: . AT+CBC=?? +CBC Note: although is an execution command, ETSI 07.07 requires the Test command to be defined. Enhanced test command returns the complete range of values for AT+CBC=?? : and +CBC: (0-3),(0-100) AT+CBC Example +CBC: 0,75 OK page 312 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

313 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CBC - Battery Charge does not make differences between being powered by a battery or Note The ME by a power supply on the VBATT pins, so it is not possible to distinguish between these two cases. Reference GSM 07.07 page 313 of 614 written authorization - All Right reserved Reproduction forbidden without Telit Communications S.p.A.

314 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.3 ETSI GSM 07.05 AT Commands for SMS and CBS 3.6.3.1 General Configuration ct Message Service 3.6.3.1.1 +CSMS - Sele +CSMS - Select Message Service . It returns the types of Set command selects messaging service AT+CSMS ME : messages supported by the [=] Parameter: 0 - The syntax of SMS AT commands is compatible with GSM 07.05 Phase 2 version 4.7.0 (factory default) 1 - The syntax of SMS AT commands is compatible with GSM 07.05 Phase 2+. Set command returns current service setting along with the types of messages supported by the ME: +CSMS: ,,, where: - mobile terminated messages support 0 - type not supported 1 - type supported - mobile originated messages support 0 - type not supported 1 - type supported - broadcast type messages support 0 - type not supported 1 - type supported Note: If parameter is omitted then the behavior of Set command is the same as Read command. Read command reports current service setting along with supported AT+CSMS? message types in the format: +CSMS: ,,, where: - messaging service (see above) - mobile terminated messages support (see above) - mobile originated messages support (see above) - broadcast type messages support (see above) Test command re y orted b pp the device. the p orts a list of all services su AT+CSMS=? page 314 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

315 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSMS - Select Message Service supported value of the parameter . Reference GSM 07.05; GSM 03.40; GSM 03.41 3.6.3.1.2 +CPMS - Preferred Message Storage +CPMS - Preferred Message Storage and , Set command selects memory storages AT+CPMS[= to be used for reading, writing, sending and storing SMs. [, Parameters: [,]]] - memory from which messages are read and deleted "SM" - SIM SMS memory storage "ME" - ME internal storage (read only, no delete) - memory to which writing and sending operations are made "SM" - SIM SMS memory storage - memory to which received SMs are preferred to be stored "SM" - SIM SMS memory storage The command returns the memory storage status in the format: +CPMS: ,,,,, where - number of SMs stored into - max number of SMs that can contain - number of SMs stored into max number of SMs that can contain - number of SMs stored into can contain - max number of SMS that Note: The only supported memory storage for writing and sending SMs is . the SIM internal memory "SM", so =="SM" Note: the received class 0 SMS are stored in the "ME" memory regardless the setting and they are automatically deleted at power off. Note: If all parameters are omitted the behavior of Set command is the same as Read command. Read command reports the message storage status in the format: AT+CPMS? +CPMS: ,,,,,, ,, page 315 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

316 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPMS - Preferred Message Storage , where are the selected storage memories and for reading, writing and storing respectively. , Test command reports the supported values for parameters AT+CPMS=? and Example AT+CPMS? +CPMS: "SM",5,10,"SM",5,10,"SM",5,10 you have 5 out of 10 SMS SIM positions occupied OK Reference GSM 07.05 3.6.3.1.3 +CMGF - Message Format +CMGF - Message Format Set command selects the format of messages used with send, list, read and AT+CMGF[= write commands. []] Parameter: 0 - PDU mode, as defined in GSM 3.40 and GSM 3.41 (factory default) 1 - text mode Note: issuing AT+CMGF is the same as issuing the Read command. Note: issuing AT+CMGF= is the same as issuing the command AT+CMGF=0 . . Read command reports the current value of the parameter AT+CMGF? parameter. Test command reports the supported value of AT+CMGF=? Reference GSM 07.05 page 316 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

317 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.3.2 Message Configuration 3.6.3.2.1 +CSCA - Service Center Address +CSCA - Service Center Address Set command sets the Service Center Address to be used for mobile AT+CSCA[= originated SMS transmissions. [ [,]]] Parameter: - SC phone number in the format defined by - the type of number 129 - national numbering scheme 145 - international numbering scheme (contains the character "+") Note: to use the SM service, is mandatory to set a Service Center Address at which service requests will be directed. Note: in Text mode, this setting is used by send and write commands; in PDU mode, setting is used by the same commands, but only when the parameter equals zero. length of the SMSC address coded into the is the same as issuing the Read command. Note: issuing AT+CSCA OK result code to be issued. Note: issuing AT+CSCA= causes an Read command reports the current value of the SCA in the format: AT+CSCA? +CSCA: , Note: if SCA is not present the device reports an error message. OK result code. Test command returns the AT+ CSCA=? Reference GSM 07.05 page 317 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

318 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.3.2.2 +CSMP - Set T ext Mode Parameters +CSMP - Set Text Mode Parameters Set command is used to select values for additional parameters for storing AT+CSMP[= and sending SMs when the text mode is used ) (+CMGF=1 [ [, Parameters: [, - depending on the command or result code: [,]]]]] first octet of GSM 03.40 SMS-DELIVER, SMS-SUBMIT (default 17), SMS-STATUS-REPORT, or SMS-COMMAND (default 2) in integer format. - depending on SMS-SUBMIT setting: GSM 03.40 TP-Validity-Period either in integer format (default 167) or in time-string format - GSM 03.40 TP-Protocol-Identifier in integer format. - depending on the command or result code: GSM 03.38 SMS Data Coding Scheme (default 0), or Cell Broadcast Data Coding Scheme is the same as issuing the Read command. AT+CSMP Note: issuing AT+CSMP= Note: issuing is the same as issuing the command . AT+CSMP=0 Read command reports the current setting in the format: AT+CSMP? +CSMP: < fo>,,, Test command reports the supported range of values for , , AT+CSMP=? parameters. and Set the parameters for an outgoing message with 24 hours Example of validity period and default properties: AT+CSMP=17,167,0,0 OK Reference GSM 07.05; GSM 03.40; GSM 03.38 3.6.3.2.3 +CSDH - Show Text Mode Parameters +CSDH - Show Text Mode Parameters Set command controls whether detailed header information is shown in text AT+CSDH[= ) result codes. mode (+CMGF=1 []] Parameter: 0 - do not show header values defined in commands +CSCA and +CSMP ) nor , ( , , , , and page 318 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

319 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSDH - Show Text Mode Parameters in or , +CMGL , +CMGR result codes for SMS-DELIVERs +CMT and SMS-SUBMITs in text m ode. For SMS-COMMANDs in +CMGR result code do not show or , , , , 1 - show the values in result codes AT+CSDH is the same as issuing the Read command. Note: issuing Note: issuing AT+CSDH= is the same as issuing the command AT+CSDH=0 . Read command reports the current setting in the format: AT+CSDH? +CSDH: Test command reports the supported range of values for parameter AT+CSDH=? Reference GSM 07.05 3.6.3.2.4 +CSCB - Select Cell Broadcast Message Types +CSCB -Select Cell Broadcast Message Types Set command selects which types of Cell Broadcast Messages are to be AT+CSCB[= received by the device. [ [, Parameter: [,]]]] 0 - the message types defined by and are accepted (factory default) and are rejected 1 - the message types defined by - Message Identifiers, string type: all different possible combinations of the CBM message identifiers; default is empty string (“”). - Data Coding Schemes, string type: all different possible combinations of CBM data coding schemes; default is empty string (“”). Note: issuing AT+CSCB is the same as issuing the Read command. AT+CSCB= is the same as issuing the command Note: issuing . AT+CSCB=0 , Read command reports the current value of parameters AT+CSCB? and . Test command returns the range of values for parameter . AT+CSCB=? AT+CSCB? Example page 319 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

320 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSCB -Select Cell Broadcast Message Types +CSCB: 1,"","" (all CBMs are accepted, none is rejected) OK AT+CSCB=0,"0,1,300-315,450","0-3" OK GSM 07.05, GSM 03.41, GSM 03.38. Reference 3.6.3.2.5 +CSAS - Save Settings +CSAS - Save Settings Execution command saves settings +CSC which have been made by the A AT+CSAS commands in local non volatile memory. +CSCB and +CSMP [=] Parameter: 0 - it saves the settings to NVM (factory default). 1..n - SIM profile number; the value of n depends on the SIM and its max is 3. Note: certain settings may not be supported by the SIM and therefore they are always saved to NVM, regardless the value of . Note: If parameter is omitted the settings are saved in the non volatile memory. Read command has the same effect as Execution command with parameter AT+CSAS? omitted. Test command returns the possible range of values for the parameter AT+CSAS=? . Reference GSM 07.05 3.6.3.2.6 +CRES - Restore Settings +CRES - Restore Settings Execution command restores message service settings saved by +CSAS AT+CRES command from either NVM or SIM. [=] Parameter: 0 - it restores message service settings from NVM. 1..n - it restores message service settings from SIM. The value of n depends on the SIM and its max is 3. Note: certain settin the SIM and there y ore the f g s ma y not be su pp orted b y page 320 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

321 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CRES - Restore Settings are always restored from NVM, regardless the value of . Note: If parameter is omitted the command restores message service settings from NVM. Read command has the same effect as Execution command with parameter AT+CRES? omitted. Test command returns the possible range of values for the parameter AT+CRES=? . Reference GSM 07.05 page 321 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

322 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.3.3 Message Receiving And Reading 3.6.3.3.1 +CNMI - New Message Indi cations To Terminal Equipment +CNMI - New Message Indications To Terminal Equipment Set command selects the behaviour of the device on how the receiving of AT+CNMI[=[ new messages from the network is indicated to the . DTE [, [,[, Parameter: [,]]]]]] - unsolicited result codes buffering option 0 - Buffer unsolicited result codes in the result code buffer is full, TA . If TA indications can be buffered in some other place or the oldest indications may be discarded and replaced with the new received indications. 1 - Discard indication and reject new received message unsolicited result codes when TA-TE link is reserved, otherwise forward them directly to . the TE 2 - Buffer unsolicited result codes in the TA in case the DTE is busy and after reservation. Otherwise forward them directly TE flush them to the TE to the . 3 - if is set to 1 an indication via 100 ms break is issued when a SMS is received while the module is in GPRS online mode. It enables the hardware ring line for 1 s. too. - result code indication reporting for SMS-DELIVER 0 - No SMS-DELIVER indications are routed to the TE . 1 - If SMS-DELIVER is stored into ME/TA , indication of the memory location is routed to the using the following unsolicited result code: TE +CMTI: , where: - memory storage where the new message is stored "SM" "ME" - location on the memory where SM is stored. 2 - SMS-DELIVERs (except class 2 messages and messages in the TE using message waiting indication group) are routed directly to the the following unsolicited result code: (PDU Mode) +CMT: [], where: - alphanumeric representation of originator/destination number corresponding to the entry found in phonebook MT - PDU length - PDU message (TEXT Mode) id>,, ha>, p ,,,< [ p +CMT:,

323 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment ,,] (the information written in italics will be present depending on +CSDH last setting) where: - originator address number - alphanumeric representation of or - arrival time of the message to the SC , - type of number or : 129 - number in national format 145 - number in international format (contains the "+") - first octet of GSM 03.40 - Protocol Identifier - Data Coding Scheme - Service Centre number - text length - TP-User-Data Class 2 messages and messages in the message waiting indication =1 . group (stored message) result in indication as defined in 3 - Class 3 SMS-DELIVERs are routed directly to TE using unsolicited =2 . Messages of other data coding result codes defined in =1 schemes result in indication as defined in . - broadcast reporting option 0 - Cell Broadcast Messages are not sent to the DTE 2 - New Cell Broadcast Messages are sent to the DTE with the unsolicited result code: (PDU Mode) +CBM: where: - PDU length - message PDU (TEXT Mode) +CBM:,,,, where: - message serial number - message ID - Data Coding Scheme - page number - total number of pages of the message - CBM Content of Message - SMS-STATUS-REPORTs reporting option DTE 0 - status report receiving is not reported to the DTE 1 - the status report is sent to the with the following unsolicited result code: page 323 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

324 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment (PDU Mode) +CDS: where: - PDU length - message PDU (TEXT Mode) +CDS: ,,,,,

, where: - first octet of the message PDU - message reference number - arrival time of the message to the SC
- sending time of the message - message status as coded in the PDU 2 - if a status report is stored, then the following unsolicited result code is sent: +CDSI: , where: - memory storage where the new message is stored "SM" - location on the memory where SM is stored - buffered result codes handling method: 0 - TA buffer of unsolicited result codes defined within this command is flushed to the TE when =1..3 is entered ( OK response shall be given before flushing the codes) 1 - TA buffer of unsolicited result codes defined within this command is cleared when =1..3 is entered. Note: issuing AT+CNMI is the same as issuing the Read command. Note: issuing AT+CNMI= is the same as issuing the command AT+CNMI=0 . Read command returns the current parameter settings for +CNMI command AT+CNMI? in the form: +CNMI: ,,,, Test command reports the supported range of values for the +CNMI AT+CNMI=? command parameters. For compatibility with previous versions, Test command returns: +CNMI: (0-2) ,(0-3),(0,2),(0-2),(0,1) , AT+CNMI=?? n enhanced version of Test command has been defined: A page 324 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

325 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment . that provides the complete range of values for parameter Enhanced test command reports the supported range of values for all the AT+CNMI=?? +CNMI command parameters. Reference GSM 07.05 DTR signal is ignored, hence the indication is sent even if the DTE is Note DTR signal is Low). In this case the unsolicited result code may be inactive ( lost so if MODULE remains active while DTE is not, at DTE startup is suggested to check whether new messages have reached the device AT+CMGL=0 that lists the new messages meanwhile with command received. 3.6.3.3.2 +CMGL - List Messages +CMGL - List Messages Execution command reports the list of all the messages with status value AT+CMGL stored into is the message message storage ( [=] ). +CPMS storage for read and delete SMs as last settings of command The parameter type and the command output depend on the last settings of +CMGF command (message format to be used) (PDU Mode) Parameter: 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent 4 - all messages. Each message to be listed is represented in the format: +CMGL: ,, where - message position in the memory storage list. - status of the message - length of the PDU in bytes - message in PDU format according to GSM 3.40 (Text Mode) Parameter: "REC UNREAD" - new message "REC READ" - read message written authorization - All Right reserved page 325 of 614 Reproduction forbidden without Telit Communications S.p.A.

326 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGL - List Messages "STO UNSENT" - stored message not yet sent "STO SENT" - stored message already sent "ALL" - all messages. Each message to be listed is represented in the format (the information last setting): +CSDH written in italics will be present depending on +CMGL: ,,,, [,,] where - message position in the storage - message status - originator/destination number - type of number 129 - number in national format 145 - number in international format (contains the "+") - text length - TP-User-Data : Each message delivery confirm is represented in the format +CMGL: ,,,,,,,

, where - message position in the storage - message status - first octet of the message PDU - message reference number - arrival time of the message to the SC - sending time of the message
- message status as coded in the PDU Note: OK result code is sent at the end of the listing. Note: If parameter is omitted the command returns the list of sms with “REC UNREAD” status. Read command has the same effect as Execution command with parameter AT+CMGL? omitted Test command returns a list of supported s AT+CMGL=? (+CMGF=1 ) the Test command output is not included in Note If Text Mode parenthesis AT+CMGL=? +CMGL: "REC UNREAD","REC READ","STO UNSENT", "STO SENT","ALL" page 326 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

327 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGL - List Messages has been defined Note The improving command @CMGL Reference GSM 07.05 3.6.3.3.3 @CMGL - List Messages @CMGL - List Messages Execution command reports the list of all the messages with status value [email protected] stored into message storage ( is the message [=] +CPMS storage for read and delete SMs as last settings of command ). The parameter type and the command output depend on the last settings of +CMGF command (message format to be used) (PDU Mode) Parameter: 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent 4 - all messages. Each message to be listed is represented in the format: @CMGL: ,, where - message position in the memory storage list. - status of the message - length of the PDU in bytes - message in PDU format according to GSM 3.40 (Text Mode) Parameter: "REC UNREAD" - new message "REC READ" - read message "STO UNSENT" - stored message not yet sent "STO SENT" - stored message already sent "ALL" - all messages. Each message to be listed is represented in the format: @CMGL: ,,[,,,,] page 327 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

328 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @CMGL - List Messages where - message position in the storage - message status - originator/destination number - type of number 129 - number in national format 145 - number in international format (contains the "+") - text length - TP-User-Data : Each message delivery confirm is represented in the format @CMGL: ,,,,,,,

, where - message position in the storage - message status - first octet of the message PDU - message reference number - arrival time of the message to the SC
- sending time of the message - message status as coded in the PDU because at the end of the +CMGL Note: The command differs from the is put before the OK result code. listing a Note: If parameter is omitted the command returns the list of sms with “REC UNREAD” status. Read command has the same effect as Execution command with parameter [email protected]? omitted Test command returns a list of supported s [email protected]=? Note If Text Mode (+CMGF=1 ) the Test command output is not included in parenthesis [email protected]=? @CMGL: "REC UNREAD","REC READ","STO UNSENT", "STO SENT","ALL" Reference GSM 07.05 3.6.3.3.4 +CMGR - Read Message +CMGR - Read Message Execution command reports the message with location value from AT+CMGR= messa g e for read and g e stora is the messa g e stora g e ( page 328 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

329 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGR - Read Message ). +CPMS delete SMs as last settings of command Parameter: - message index. +CMGF (message The output depends on the last settings of command format to be used) (PDU Mode) The output has the following format: +CMGR: , where - status of the message 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent - length of the PDU in bytes. - message in PDU format according to GSM 3.40. The status of the message and entire message data unit is returned. (Text Mode) Output format for received messages: +CMGR: ,,, [,,,,,, ,] Output format for sent messages: +CMGR: ,[,,,,,,, ,,] Output format for message delivery confirm: +CMGR: ,,,,,,

, where: - status of the message "REC UNREAD" - new received message unread "REC READ" - received message read "STO UNSENT" - message stored not yet sent "STO SENT" - message stored already sent - first octet of the message PDU - message reference number page 329 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

330 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGR - Read Message - arrival time of the message to the SC

- sending time of the message - message status as coded in the PDU - Protocol Identifier - Data Coding Scheme - Originator address number - Destination address number - Service Centre number , , , - type of number , 129 - number in national format 145 - number in international format (contains the "+") - text length - TP-User_data Note: in both cases if status of the message is 'received unread', status in the storage changes to 'received read'. . Note: an error result code is sent on empty record Test command returns the OK result code. AT+CMGR=? Note The improving command @CMGR has been defined Reference GSM 07.05 3.6.3.3.5 @CMGR - Read Message @CMGR - Read Message Execution command reports the message with location value from [email protected]= message storage ( is the message storage for read and delete SMs as last settings of command +CPMS ). Parameter: - message index. +CMGF The output depends on the last settings of command (message format to be used) (PDU Mode) The output has the following format: @CMGR: , where - status of the message 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent page 330 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

331 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @CMGR - Read Message - length of the PDU in bytes. - message in PDU format according to GSM 3.40. is The status of the message and entire message data unit returned. (Text Mode) Output format for received messages: @CMGR: ,,, [,,,,,, ,] Output format for sent messages: @CMGR: ,[,,,,,,, ,,] Output format for message delivery confirm: @CMGR: ,,,,,,

, where: - status of the message "REC UNREAD" - new received message unread "REC READ" - received message read "STO UNSENT" - message stored not yet sent "STO SENT" - message stored already sent - first octet of the message PDU - message reference number - arrival time of the message to the SC
- sending time of the message - message status as coded in the PDU - Protocol Identifier - Data Coding Scheme - Originator address number - Destination address number - Service Centre number , , , - type of number , 129 - number in national format 145 - number in international format (contains the "+") - text length - message text Note: the command differs from the +CMGR because after the message a result code. is put before the or OK Note: in both cases if status of the message is 'received unread', status in the storage changes to 'received read'. page 331 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

332 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @CMGR - Read Message Note: an error result code is sent on empty record . OK Test command has no effect; the answer is [email protected]=? Reference GSM 07.05 3.6.3.4 Message Sending And Writing 3.6.3.4.1 +CMGS - Send Message +CMGS - Send Message (PDU Mode) (PDU Mode) Execution command sends to the network a message. AT+CMGS= Parameter: - length of the PDU to be sent in bytes. 7..164 The device responds to the command with the prompt '>' and waits for the specified number of bytes. To send the message issue char (0x1A hex). Ctrl-Z To exit without sending the message issue char (0x1B hex). ESC If message is successfully sent to the network, then the result is sent in the format: +CMGS: where - message reference number. Note: if message sending fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, which may take several seconds, no other SIM interacting commands are issued. (Text Mode) (Text Mode) Execution command sends to the network a message. AT+CMGS= [,] Parameters: - destination address number. - type of destination address 129 - number in national format 145 - number in international format (contains the "+") The device responds to the command with the prompt '>' and waits for message text (max 160 characters). To send the message issue char (0x1A hex). Ctrl-Z page 332 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

333 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGS - Send Message ESC To exit without sending the message issue char (0x1B hex). If message is successfully sent to the network, then the result is sent in the format: +CMGS: where - message reference number. Note: if message sending fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, which may take several seconds, no other SIM interacting commands are issued. Note To avoid malfunctions is suggested to wait for the +CMGS: or +CMS response before issuing further commands. ERROR: Reference GSM 07.05 Message From Storage 3.6.3.4.2 +CMSS - Send +CMSS - Send Message From Storage Execution command sends to the network a message which is already AT+CMSS= . stored in the storage (see +CPMS ) at the location [, [,]] Parameters: - location value in the message storage of the message to send - destination address; if it is given it shall be used instead of the one stored with the message. - type of destination address 129 - number in national format 145 - number in international format (contains the "+") If message is successfully sent to the network then the result is sent in the format: +CMSS: where: - message reference number. If message sending fails for some reason, an error code is reported: +CMS ERROR: . storage see command +CMGW Note: to store a message in the the command execution, g Note: care must be taken to ensure that durin page 333 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

334 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMSS - Send Message From Storage which may take several seconds, no other SIM interacting commands are issued. To avoid malfunctions is suggested to wait for the +CMS or +CMSS: Note response before issuing further commands. ERROR: Reference GSM 07.05 3.6.3.4.3 +CMGW - Write Message To Memory +CMGW - Write Message To Memory (PDU Mode) (PDU Mode) memory storage a new Execution command writes in the AT+CMGW= message. [,] Parameter: - length in bytes of the PDU to be written. 7..164 - message status. 0 - new message 1 - read message 2 - stored message not yet sent (default) 3 - stored message already sent The device responds to the command with the prompt '>' and waits for the specified number of bytes. To write the message issue Ctrl-Z char (0x1A hex). To exit without writing the message issue ESC char (0x1B hex). If message is successfully written in the memory, then the result is sent in the format: +CMGW: where: - message location index in the memory . If message storing fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, no other SIM interacting commands are issued. (Text Mode) (Text Mode) Execution command writes in the memory storage a new AT+CMGW[=[, message. [,]]] Parameters: - destination address number. "REC UNREAD" - new received message unread "REC READ" - received message read page 334 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

335 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGW - Write Message To Memory "STO UNSENT" - message stored not yet sent (default) "STO SENT" - message stored already sent - type of destination address. 129 - number in national format 145 - number in international format (contains the "+") - message status. The device responds to the command with the prompt '>' and waits for the message text (max 160 characters). Ctrl-Z char (0x1A hex). To write the message issue To exit without writing the message issue ESC char (0x1B hex). If message is successfully written in the memory, then the result is sent in the format: +CMGW: where: . - message location index in the memory If message storing fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, no other SIM interacting commands are issued. Reference GSM 07.05 +CMGW: Note To avoid malfunctions is suggested to wait for the or +CMS ERROR: response before issuing further commands. 3.6.3.4.4 +CMGD - Delete Message +CMGD - Delete Message the message(s). Execution command deletes from memory AT+CMGD= Parameter: [,] - message index in the selected storage - an integer indicating multiple message deletion request. 0 (or omitted) - delete message specified in storage, leaving unread 1 - delete all read messages from messages and stored mobile originated messages (whether sent or not) untouched storage and sent mobile 2 - delete all read messages from originated messages, leaving unread messages and unsent mobile originated messages untouched 3 - delete all read messages from storage, sent and unsent mobile originated messages, leaving unread messages untouched page 335 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

336 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGD - Delete Message 4 - delete all messages from storage. is ignored and is present and not set to 0 then Note: if ME shall follow the rules for shown above. Note: if the location to be deleted is empty, an error message is reported. Test command shows the valid memory locations and optionally the AT+CMGD=? supported values of . +CMGD: (list of supported s)[,(list of supported s)] AT+CMGD=? Example +CMGD: (1,2,3,6,7,17,18,19,20,37,38,39,47),(0-4) OK Reference GSM 07.05 page 336 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

337 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.4 FAX Class 1 AT Commands 3.6.4.1 General Configuration NOTE: All the test command results are without command echo 3.6.4.1.1 +FMI - Manufacturer ID +FMI - Manufacturer ID Read command reports the manufacturer ID. The output depends on the AT+FMI? choice made through command. #SELINT AT+FMI? Example Telit OK Reference ITU T.31 and TIA/EIA-578-A specifications 3.6.4.1.2 +FMM - Model ID +FMM - Model ID Read command reports the model ID AT+FMM? Reference ITU T.31 and TIA/EIA-578-A specifications 3.6.4.1.3 +FMR - Revision ID +FMR - Revision ID Read command reports the software revision ID AT+FMR? ITU T.31 and TIA/EIA-578-A specifications Reference page 337 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

338 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.4.2 Transmission/Reception Control Transmission And Pause 3.6.4.2.1 +FTS - Stop +FTS - Stop Transmission And Pause Execution command causes the modem to terminate a transmission and AT+FTS=

339 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.4.2.4 +FRM - Receive Data Modulation +FRM - Receive Data Modulation Execution command causes the module to receive facsimile data using the AT+FRM= modulation defined by the parameter . Parameter: - carrier modulation 24 - V27ter/2400 bps 48 - V27ter/4800 bps 72 - V29/7200 bps 96 - V29/9600 bps Test command returns all supported values of the parameter . AT+FRM=? Note: the output is not bracketed ITU T.31 and TIA/EIA-578-A specifications Reference 3.6.4.2.5 +FTH - Transmit Data With HDLC Framing +FTH - Transmit Data With HDLC Framing Execution command causes the module to transmit facsimile data using AT+FTH= HDLC protocol and the modulation defined by the parameter . Parameter: - carrier modulation 3 - V21/300 bps Test command returns all supported values of the parameter . AT+FTH=? ITU T.31 and TIA/EIA-578-A specifications Reference 3.6.4.2.6 +FRH - Receive Data With HDLC Framing +FRH - Receive Data Data With HDLC Framing to receive facsimile data using Execution command causes the module AT+FRH= HDLC protocol and the modulation defined by the parameter . Parameter: - carrier modulation 3 - V21/300 bps . Test command returns all supported values of the parameter AT+FRH=? ITU T.31 and TIA/EIA-578-A specifications Reference page 339 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

340 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.4.3 Serial Port Control 3.6.4.3.1 +FLO - Select Flow Control Specified By Type +FLO - Select Flow Control Specified By Type Set command selects the flow control behaviour of the serial port in both AT+FLO= directions: from DTE to DTA and from DTA to DTE . Parameter: - flow control option for the data on the serial port 0 - flow control None 1 - flow control Software ( ) XON-XOFF CTS-RTS 2 - flow control Hardware ( ) – (factory default). Note: This command is a shortcut of the +IFC command. Note: +FLO’s settings are functionally a subset of &K’s ones. Read command returns the current value of parameter AT+FLO? Test command returns all supported values of the parameter . AT+FLO=? Reference ITU T.31 and TIA/EIA-578-A specifications 3.6.4.3.2 +FPR - Select Serial Port Rate +FPR - Select Serial Port Rate DTE Set command selects the the serial port speed in both directions, from AT+FPR= DTE DTA and from DTA to to . When autobauding is selected, then the speed is detected automatically. Parameter: - serial port speed selection 0 – autobauding Read command returns the current value of parameter AT+FPR? . Test command returns all supported values of the parameters AT+FPR=? Reference ITU T.31 and TIA/EIA-578-A specifications Character Replacement Control 3.6.4.3.3 +FDD - Double Escape +FDD - Double Escape Character Replacement Control pair to encode Set command concerns the use of the AT+FDD= consecutive escape characters ( ) in user data. <10h><10h> Parameter 0 - currently the only available value. The DCE decode of is either or discard. The DCE encode of <10h><10h> is Read command returns the current value of parameter AT+FDD? . Test command returns all supported values of parameter AT+FDD=? ITU T.31 and TIA/EIA-578-A specifications Reference page 340 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

341 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5 Custom AT Commands 3.6.5.1 General Configuration AT Commands 3.6.5.1.1 #CGMI - Manufacturer Identification #CGMI - Manufacturer Identification Execution command returns the device manufacturer identification code AT#CGMI with command echo. The output depends on the choice made through #SELINT command. Read command has the same effect as the Execution command AT#CGMI? 3.6.5.1.2 #CGMM - Model Identification #CGMM - Model Identification Execution command returns the device model identification code with AT#CGMM command echo. Read command has the same effect as the Execution command AT#CGMM? 3.6.5.1.3 #CGMR - Revision Identification #CGMR - Revision Identification Execution command returns device software revision number with AT#CGMR command echo. Read command has the same effect as the Execution command AT#CGMR? 3.6.5.1.4 #CGSN - Product Serial Number Identification #CGSN - Product Serial Number Identification Execution command returns the product serial number, identified as the AT#CGSN IMEI of the mobile, with command echo. Read command has the same effect as the Execution command AT#CGSN? ile Subscriber Identity (IMSI) 3.6.5.1.5 #CIMI - International Mob #CIMI - International Mobile Subscriber Identity (IMSI) Execution command returns the international mobile subscriber identity, AT#CIMI identified as the IMSI number, with command echo. Read command has the same effect as the Execution command AT#CIMI? page 341 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

342 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.1.6 #CAP - Change Audio Path #CAP - Change Audio Path Set command switches the active audio path depending on parameter AT#CAP[=[]] Parameter: - audio path 0 - audio path follows the Axe input (factory default): if Axe is low, handsfree is enabled; if Axe is high, internal path is enabled 1 - enables handsfree external mic/ear audio path 2 - enables internal mic/ear audio path Note: The audio path are mutually exclusive, enabling one disables the other. Note: when changing the audio path, the volume level is set at the previously stored value for that audio path (see +CLVL ). Note: issuing AT#CAP is the same as issuing the Read command. is the same as issuing the command AT#CAP= Note: issuing . AT#CAP=0 reports the active audio path in the format: Read command AT#CAP? . #CAP: Test command reports the supported values for the parameter . AT#CAP=? 3.6.5.1.7 #SRS - Select Ringer Sound #SRS - Select Ringer Sound Set command sets the ringer sound. AT#SRS[= ,] Parameters: - ringing tone 0 - current ringing tone 1.. max - ringing tone number, where max can be read by issuing the Test command . AT#SRS=? - ringing tone playing time-out in seconds. 0 - ringer is stopped (if present) and current ringer sound is set. 1..60 - ringer sound playing for seconds and, if > 0, ringer sound is set as default ringer sound. > 0 and > 0 , the Note: when the command is issued with page 342 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

343 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SRS - Select Ringer Sound ringing tone is played for seconds and stored as default ringing tone. = 0 and > 0 , the playing of the Note: if command is issued with ringing tone is set as current. ringing is stopped (if present) and Note: if command is issued with and = 0 > 0 then the current ringing tone is played. then the default ringing tone is set as are and Note: if both 0 current and ringing is stopped. Note: If all parameters are omitted then the behaviour of Set command is the same as Read command Read command reports current selected ringing and its status in the form: AT#SRS? #SRS: , where: - ringing tone number 1.. max - ringing status 0 - selected but not playing 1 - currently playing and Test command reports the supported values for the parameters AT#SRS=? 3.6.5.1.8 #SRP -Select Ringer Path #SRP - Select Ringer Path Set command selects the ringer path towards whom sending ringer sounds AT#SRP[=[]] and all signalling tones. Parameter: - ringer path number 0 - sound output towards current selected audio path (see command #CAP ) 1 - sound output towards handsfree 2 - sound output towards handset 3 - sound output towards Buzzer Output pin GPIO7 Note: In order to use the Buzzer Output an external circuitry must be added to drive it properly from the GPIO7 pin, furthermore the GPIO7 pin direction must be set to Buzzer output (Alternate function); see command #GPIO . page 343 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

344 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SRP - Select Ringer Path is the same as issuing the Read command. AT#SRP Note: issuing Note: issuing AT#SRP= is the same as issuing the command AT#SRP=0 . Read command reports the selected ringer path in the format: AT#SRP? #SRP: . Test command reports the supported values for the parameter . AT#SRP=? AT#SRP=? Example #SRP: (0-3) OK AT#SRP=3 OK 3.6.5.1.9 #STM - Signaling Tones Mode #STM - Signaling Tones Mode Set command enables/disables the signalling tones output on the audio AT#STM path selected with command #SRP [=] Parameter: - signalling tones status 0 - signalling tones disabled 1 - signalling tones enabled AT#STM=0 has Note: AT#STM=1 has the same effect as [email protected]=2 ; . the same effect either as AT+CALM=0 or [email protected]=0 Note: If parameter is omitted then the behaviour of Set command is the same as Read command Read command reports whether the current signaling tones status is AT#STM? enabled or not, in the format: #STM: . Test command reports supported range of values for parameter AT#STM=? page 344 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

345 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.1.10 #PCT - Display PIN Counter #PCT - Display PIN Counter Execution command reports the PIN/PUK or PIN2/PUK2 input remaining AT#PCT +CPIN attempts, depending on requested password in the format: #PCT: where: - remaining attempts 0 - the SIM is blocked. 1..3 - if the device is waiting either SIM PIN or SIM PIN2 to be given. 1..10 - if the device is waiting either SIM PUK or SIM PUK2 to be given. Read command has the same behaviour as Execution command. AT#PCT? Software Shut Down 3.6.5.1.11 #SHDN - #SHDN - Software Shutdown Execution command causes device detach from the network and shut AT#SHDN OK response is returned. down. Before definitive shut down an Note: after the issuing of this command any previous activity is terminated and the device will not respond to any further command. Note: to turn it on again Hardware pin ON/OFF must be tied low. Read command has the same behaviour as Execution command. AT#SHDN? 3.6.5.1.12 #WAKE - Wa ke From Alarm Mode #WAKE - Wake From Alarm Mode present alarm activity and, if the Execution command stops any eventually AT#WAKE[= , it exits the normal alarm mode alarm mode and enters the module is in ] operating mode . Parameter: - operating mode 0 - normal operating mode; the module exits the , enters the alarm mode normal operating mode , any alarm activity is stopped (e.g. alarm tone playing) and an OK result code is returned. Note: if parameter is omitted, the command returns the operating status of the device in the format: #WAKE: where: page 345 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

346 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #WAKE - Wake From Alarm Mode 0 - normal operating mode 1 - alarm mode or normal operating mode with some alarm activity. Note: the power saving status is indicated by a CTS - OFF and DSR - OFF status. The is indicated by DSR - ON . normal operating status Note: during the alarm mode the device will not make any network scan and will not register to any network and therefore is not able to dial or receive any call or SM, the only commands that can be issued to the MODULE in this state are the , every other command #SHDN and #WAKE must not be issued during this state. Read command has the same effect as Execution command when AT#WAKE? parameter is omitted. 3.6.5.1.13 #QTEMP -Query Temperature Overflow #QTEMP - Query Temperature Overflow Set command has currently no effect. The interpretation of parameter AT#QTEMP is currently not implemented: any value assigned to it will simply [=] have no effect. is omitted the behaviour of Set command is the Note: if parameter same as Read command Read command queries the device internal temperature sensor for over AT#QTEMP? temperature and reports the result in the format: #QTEMP: where - over temperature indicator 0 - the device temperature is in the working range 1 - the device temperature is out of the working range . Test command reports supported range of values for parameter #QTEMP=? The device should not be operated out of its working temperature range; if Note temperature is out of range proper functioning of the device is not ensured. page 346 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

347 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.1.14 #SGPO - Set General Purpose Output #SGPO - Set General Purpose Output Set command sets the value of the general purpose output pin GPIO2 . AT#SGPO[= []] Parameter: LOW ) 0 - output pin cleared to 0 ( 1 - output pin set to 1 ( HIGH ) GPIO2 Note: the is an OPEN COLLECTOR output, the command sets the transistor base level, hence the open collector output is negated: AT#SGPO=0 sets the open collector output HIGH AT#SGPO=1 sets the open collector output LOW A pull up resistor is required on pin . GPIO2 is the same as issuing the Read command. AT#SGPO Note: issuing Note: issuing AT#SGPO= is the same as issuing the command AT#SGPO=0 . Read command reports the #SGPO command setting, hence the opposite AT#SGPO? status of the open collector pin in the format: #SGPO: . . Test command reports the supported range of values of parameter AT#SGPO=? This command is meaningful only for GM862 family Note 3.6.5.1.15 #GGPI - General Purpose Input #GGPI - General Purpose Input . GPIO1 Set command sets the general purpose input pin AT#GGPI[=[

]] Parameter: - auxiliary input GPIO1 setting 0 - the Read command AT#GGPI? reports the logic input level read from GPIO1 pin. Note: The device has an insulated input pin ( the input goes the base of an internal decoupling transistor) which can be used as a logic general purpose input. This command sets the read behaviour for this pin, since only direct read report is supported, the issue of this command is not needed. In future uses the behavior of the read input may be more complex. Note: If parameter is omitted then the behaviour of Set command is the same as Read command page 347 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

348 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #GGPI - General Purpose Input Read command reports the read value for the input pin GPIO1, in the AT#GGPI? format: #GGPI:

, where ) - direction setting (see #GGPI= - logic value read from pin GPIO1 Note: Since the reading is done after the insulating transistor, the reported value is the opposite of the logic status of the GPIO1 input pin. Test command reports supported range of values for parameter . AT#GGPI=? This command is meaningful only for GM862 family Note 3.6.5.1.16 #GPIO - General Purp ose Input/Output Pin Control #GPIO - General Purpose Input/Output Pin Control Execution command sets the value of the general purpose output pin AT#GPIO[=, and parameter. GPIO according to [,]] Not all configuration for the three parameters are valid. Parameters: - GPIO pin number; supported range is from 1 to a value that GPIO1 is input only and GPIO2 is depends on the hardware, but output only. - its meaning depends on setting: 0 - no meaning if =0 - INPUT - output pin cleared to 0 (LOW) if =1 - OUTPUT - no meaning if =2 - ALTERNATE FUNCTION - INPUT =0 1 - no meaning if - output pin set to 1 (HIGH) if - OUTPUT =1 - no meaning if =2 - ALTERNATE FUNCTION 2 - Reports the read value from the input pin if =0 - INPUT - Reports the read value from the input pin if =1 - OUTPUT - Reports a no meaning value if =2 - ALTERNATE FUNCTION - GPIO pin direction 0 - pin direction is INPUT 1 - pin direction is OUTPUT 2 - pin direction is ALTERNATE FUNCTION (see Note). is omitted) the command reports the Note: when =2 (and GPIO in the format: direction and value of pin #GPIO: , where page 348 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

349 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #GPIO - General Purpose Input/Output Pin Control

- current direction setting for the GPIO is set • logic value read from pin GPIO in the case the pin to input; logic value present in output of the pin GPIO in the case the • pin is currently set to output; no meaning value for the pin GPIO • in the case the pin is set to alternate function. Note: (valid only for GPIO1 ) since the reading is done after the insulating GPIO1 transistor, the reported value is the opposite of the logic status of the input pin Note: if all parameters are omitted the command reports the read direction and value of all pin, int the format: GPIO #GPIO: ,[#GPIO: ,[...]] Note: "ALTERNATE FUNCTION" value is valid only for following pins: • GPIO5 - alternate function is “RF Transmission Monitor” • GPIO6 - alternate function is "Alarm Output" (see +CALA ) • GPIO7 - alternate function is "Buzzer Output" (see #SRP ) Note: while using the pins in the alternate function, the GPIO read/write access to that pin is not accessible and shall be avoided. Note: The is an OPEN COLLECTOR output, the command sets the GPIO2 transistor base level, hence the open collector output is negated Read command has the same effect as Execution command when all AT#GPIO? parameters are omitted. Test command reports the supported range of values of the command AT#GPIO=? . parameters , and AT#GPIO=3,0,1 Example OK AT#GPIO=3,2 #GPIO: 1,0 OK AT#GPIO=4,1,1 OK AT#GPIO=5,0,0 OK AT#GPIO=6,2 #GPIO: 0,1 OK page 349 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

350 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.1.17 #I2S1 - Set PCM Output For Channel 1 #I2S1 - Set PCM Output For Channel 1 AT#I2S1[= Set command sets the type of operation. [,, Parameters: ]] 0 - PCM1 is not enabled; audio is forwarded to the analog line; PCM pins can be used as UART1 and GPIO. 1 - PCM1 is enabled; audio is forwarded to the PCM block; PCM pin cannot be used for UART1; any service on UART1 is suspended 2 - PCM1 is enabled; audio is forwarded both to the PCM block and to the analog line; PCM pins cannot be used for UART1; any service on UART1 is suspended 0 - PCM acts as slave 1 - PCM acts as master 64 - 64 kHz. 128 - 128 kHz. 256 - 256 kHz. 512 - 512 kHz 1024 - 1024 kHz 2048 - 2048 kHz Note: issuing AT#I2S1 is the same as issuing the Read command. Read command reports the last setting, in the format: AT#I2S1? #I2S1: ,, Reports the range of supported values for parameters , AT#I2S1=? and 3.6.5.1.18 #E2SMSRI - SMS Ring Indicator #E2SMSRI - SMS Ring Indicator AT#E2SMSRI[= Set command enables/disables the Ring Indicator pin response to an []] incoming SMS message. If enabled , a negative going pulse is generated on receipt of an incoming SMS message. The duration of this pulse is determined by the value of . Parameter: - RI enabling 0 - disables RI pin response for incoming SMS messages (factory default) 50..1150 - enables RI pin response for incoming SMS messages. The value of is the duration in ms of the pulse generated on receipt of an incoming SM. page 350 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

351 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #E2SMSRI - SMS Ring Indicator Note: if +CNMI=3,1 command is issued and the module is in a GPRS connection, a 100 ms break signal is sent and a 1 sec. pulse is generated on RI pin, no matter if the RI pin response is either enabled or not. AT#E2SMSRI is the same as issuing the Read Note: issuing command. returns the Note: issuing AT#E2SMSRI= OK result code. Read command reports the duration in ms of the pulse generated on AT#E2SMSRI? receipt of an incoming SM, in the format: #E2SMSRI: means that the RI pin response to Note: as seen before, the value =0 an incoming SM is disabled. Reports the range of supported values for parameter AT#E2SMSRI=? #ADC - Analog/Digital Converter Input 3.6.5.1.19 #ADC - Analog/Digital Converter Input Execution command reads pin voltage, converted by ADC, and AT#ADC[= outputs it in the format: , [,

]] #ADC: where: - pin voltage, expressed in mV Parameters: - index of pin 1 - available for GM862-QUAD, GM862-QUAD-PY, GM862-GPS, GE863- QUAD, GE863-PY, GE863-GPS, GE864-QUAD, GE864-PY, GC864- QUAD and GC864-PY 2 - available only for GE863-QUAD, GE863-PY, GE864-QUAD, GE864- PY, GC864-QUAD and GC864-PY 3 - available only for GE863-QUAD, GE863-PY, GE864-QUAD, GE864- PY, GC864-QUAD and GC864-PY - required action 2 - query ADC value - direction; its interpretation is currently not implemented 0 - no effect. If all parameters are omitted the command reports all pins voltage, converted by ADC, in the format: page 351 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

352 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #ADC: [#ADC: [...]] Note: The command returns the last valid measure. Read command has the same effect as Execution command when all AT#ADC? parameters are omitted. Test command reports the supported range of values of the command AT#ADC=? parameters , and

. 3.6.5.1.20 #DAC - Digital/A nalog Converter Control #DAC - Digital/Analog Converter Control Set command enables/disables the DAC_OUT pin. AT#DAC[= Parameters: [,]] - enables/disables DAC output. 0 - disables pin; it is in high impedance status (factory default) 1 - enables pin; the corresponding output is driven - scale factor of the integrated output voltage; it must be present if =1 0..1023 - 10 bit precision Note: integrated output voltage = MAX_VOLTAGE * value / 1023 Note: if all parameters are omitted then the behaviour of Set command is the same as the Read command. Read command reports whether the DAC_OUT pin is currently enabled or AT#DAC? not, along with the integrated output voltage scale factor, in the format: #DAC: , Test command reports the range for the parameters and AT#DAC=? . Enable the DAC out and set its integrated output to the Example 50% of the max value: AT#DAC=1,511 OK Disable the DAC out: AT#DAC=0 OK Note With this command the DAC frequency is selected internally. D/A converter must not be used during POWERSAVING. DAC_OUT line must be integrated (for example with a low band pass filter) in order to obtain an analog voltage. For a more in de p th descri ration filter refer to the hardware g tion of the inte p page 352 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

353 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #DAC - Digital/Analog Converter Control user guide. ry Voltage Pin Output 3.6.5.1.21 #VAUX - Auxilia #VAUX- Auxiliary Voltage Pin Output Set command enables/disables Auxiliary Voltage pins output. AT#VAUX[=, ] Parameters: - VAUX pin index 1 - there is currently just one VAUX pin 0 - output off 1 - output on 2 - query current value of VAUX pin Note: when and command is successful, it returns: =2 #VAUX: where: - power output status 0 - output off 1 - output on Note: If all parameters are omitted the command has the same behaviour as Read command. Note: for the GPS product (GE863-GPS): if the Auxiliary Voltage pins output is disabled while GPS or camera is powered on they’ll both also be turned off. Read command reports the current status of all auxiliary voltage output AT#VAUX? pins, in the format: #VAUX: [#VAUX: [...]] , Test command reports the supported range of values for parameters AT#VAUX=? . 3.6.5.1.22 #CBC - Battery And Charger Status #CBC- Battery And Charger Status Execution command returns the current Battery and Charger state in the AT#CBC format: page 353 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

354 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CBC- Battery And Charger Status #CBC: , where: - battery charger state 0 - charger not connected 1 - charger connected and charging 2 - charger connected and charge completed - battery voltage in millivolt: it is the real battery voltage only if charger is not connected; if the charger is connected this value depends on the charger voltage. Read command has the same meaning as Execution command. AT#CBC? result code. Test command returns the OK AT#CBC=? 3.6.5.1.23 #AUTOATT - Auto-Attach Property #AUTOATT - Auto-Attach Property Set command enables/disables the TE auto-attach property. AT#AUTOATT [=] Parameter: 0 - disables auto attach property 1 - enables auto attach property (factory default) Note: If parameter is omitted then the behaviour of Set command is the same as Read command. Read command reports whether the auto-attach property is currently AT#AUTOATT? enabled or not, in the format: #AUTOATT: Test command reports available values for parameter . AT#AUTOATT=? 3.6.5.1.24 #MSCLASS - Mu ltislot Class Control #MSCLASS - Multislot Class Control Set command sets the multislot class AT#MSCLASS[= , Parameters: ] - multislot class; take care: class 7 is not supported. 1..6 - GPRS class 8..10 - GPRS class page 354 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

355 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #MSCLASS - Multislot Class Control 0 - the new multislot class is enabled only at the next detach/attach or after a reboot. 1 - the new multislot class is enabled immediately, automatically forcing a detach / attach procedure. Note: the range for former GM862 family products is 1..8, excluding class 7. Note: if all parameters are omitted the behaviour of set command is the same as read command. Read command reports the current value of the multislot class in the AT#MSCLASS? format: #MSCLASS: . Test command reports the range of available values for parameter AT#MSCLASS=? 3.6.5.1.25 #MONI - Cell Monitor #MONI - Cell Monitor Set command sets one cell out of seven, in a neighbour of the serving cell AT#MONI[= including it, from which extract GSM-related informations. []] Parameter: 0..6 - it is the ordinal number of a cell, in a neighbour of the serving cell (default 0, serving cell). 7 - it is a special request to obtain GSM-related informations from the whole set of seven cells in the neighbour of the serving cell. Note: issuing AT#MONI is the same as issuing the Read command. Note: issuing is the same as issuing the command AT#MONI= AT#MONI=0 . Read command reports the following GSM-related informations for AT#MONI? selected cell and dedicated channel (if exists). d) When extracting data for the serving cell and the network name is known the format is: #MONI: BSIC: RxQual: LAC: Id: ARFCN: PWR: dBm TA: e) When the network name is unknown, the format is: page 355 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

356 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #MONI - Cell Monitor #MONI: Cc: Nc: BSIC: RxQual: LAC: Id: ARFCN: PWR: dBm TA: f) When extracting data for an adjacent cell, the format is: #MONI: Adj Cell [LAC: Id:] ARFCN: PWR: dBm where: - name of network operator - country code - network operator code - progressive number of adjacent cell - base station identification code - quality of reception 0..7 - localization area code - cell identifier - assigned radio channel - received signal strength in dBm = timing advance is reported only for the serving cell. Note: TA: When the last setting done is AT#MONI=7 , then the Read command reports the above informations for each of the cells in the neighbour of the serving strings. cell, formatting them in a sequence of -terminated Test command reports the maximum number of cells, in the neighbour of AT#MONI=? the serving cell, from which we can extract GSM-related informations, along with the ordinal number of the current selected cell, in the format: #MONI: (,) where: - maximum number of cells, in the neighbour of the serving cell, from which we can extract GSM-related informations (for ). compatibility with previous versions of code this value is always 6 - the last setting done with command #MONI . An enhanced version of the Test command has been defined: AT#MONI=?? Enhanced test command reports the maximum number of cells, in a AT#MONI=?? neighbour of the serving cell and including it, from which we can extract GSM-related informations, along with the ordinal number of the current selected cell, in the format: page 356 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

357 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #MONI - Cell Monitor #MONI: (,) where: - maximum number of cells, in a neighbour of the serving cell and including it, from which we can extract GSM-related informations. This value is always 7 . #MONI . - the last setting done with command Note The refresh time of the measures is preset to 3 sec. The timing advance value is meaningful only during calls or GPRS transfers active. 3.6.5.1.26 #SERVINFO - Serving Cell Information #SERVINFO - Serving Cell Information Execution command reports informations about serving cell, in the format: AT#SERVINFO #SERVINFO: ,,,, ,,,,[,[],[], ,[PAT]] where: - BCCH ARFCN of the serving cell - received signal strength in dBm - operator name, quoted string type - country code and operator code, hexadecimal representation - Base Station Identification Code - Localization Area Code - Time Advance: it’s available only if a GSM or GPRS is running - GPRS supported in the cell 0 - not supported 1 - supported The following informations will be present only if GPRS is supported in the cell - PBCCH ARFCN of the serving cell; it’ll be printed only if PBCCH is supported by the cell, otherwise the label “hopping” will be printed - Network Operation Mode ..”I” “II” ..”III” - Routing Area Color Code - Priority Access Threshold ..0 page 357 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

358 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SERVINFO - Serving Cell Information ..3..6 Read command has the same effect as Execution command AT#SERVINFO? 3.6.5.1.27 #COPSMODE - +COPS Mode #COPSMODE - +COPS Mode ). Set command sets the behaviour of +COPS command ( see +COPS AT#COPSMODE [=] Parameter: 0 - +COPS behaviour like former GM862 family products (default) behaviour compliant with ETSI format 1 - +COPS Note: The setting is saved in NVM (and available on following reboot). is omitted the behaviour of Set command is Note: if parameter the same as Read command. Read command returns the current behaviour of +COPS command, in the AT#COPSMODE? format: #COPSMODE: where - +COPS behaviour as seen before. Test command returns the range of available values for parameter AT#COPSMODE=? . #COPSMODE It’s suggested to reboot the module after every setting. Note 3.6.5.1.28 #QSS - Query SIM Status #QSS - Query SIM Status Set command enables/disables the Query SIM Status unsolicited indication AT#QSS[= in the ME. []] Parameter: - type of notification 0 - disabled (factory default); it’s possible only to query the current SIM AT#QSS? status through Read command 1 - enabled; the ME informs at every SIM status change through the following unsolicited indication: #QSS: page 358 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

359 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #QSS - Query SIM Status where: - current SIM status 0 - SIM NOT INSERTED 1 - SIM INSERTED AT#QSS Note: issuing is the same as issuing the Read command. Note: issuing AT#QSS= is the same as issuing the command AT#QSS=0 . #QSS is currently Read command reports whether the unsolicited indication AT#QSS? enabled or not, along with the SIM status, in the format: #QSS: , ( and are described above) Test command returns the supported range of values for parameter AT#QSS=? . - ATD Dialling Mode 3.6.5.1.29 #DIALMODE #DIALMODE - ATD Dialling Mode Set command sets voice call ATD modality. AT#DIALMODE[= ] Parameter: 0 - OK result code is received as soon as it starts remotely ringing (factory default) 1 - OK result code is received only after the called party answers. Any character typed aborts the call and NO CARRIER result code is received. 2 - the following custom result codes are received, monitoring step by step the call status: DIALING (MO in progress) (remote ring) RINGING CONNECTED (remote call accepted) ) RELEASED (after ATH (remote hang-up) DISCONNECTED Note: The setting is saved in NVM and available on following reboot. Note: if parameter is omitted the behaviour of Set command is the same as Read command. ATD dialing mode in the format: Read command returns current AT#DIALMODE? #DIALMODE: Test command returns the range of values for parameter AT#DIALMODE=? page 359 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

360 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.1.30 #ACAL - Automatic Call #ACAL - Automatic Call Set command enables/disables the automatic call function. AT#ACAL[= []] Parameter: 0 - disables the automatic call function (factory default) 1 - enables the automatic call function. If enabled (and &D2 has been of DTR issued), the transition OFF/ON causes an automatic call to the first number (position 0) stored in the internal phonebook. Note: type of call depends on the last issue of command +FCLASS . AT#ACAL is the same as issuing the Read command. Note: issuing AT#ACAL= is the same as issuing the command Note: issuing AT#ACAL=0 . Read command reports whether the automatic call function is currently AT#ACAL? enabled or not, in the format: #ACAL: returns the supported range of values for parameter Test command AT#ACAL=? . &N to read the number on module internal phonebook. Note See &Z to write and 3.6.5.1.31 #ECAM - Ex tended Call Monitoring #ECAM - Extended Call Monitoring . This command enables/disables the call monitoring function in the ME AT#ECAM[= []] Parameter: 0 - disables call monitoring function (factory default) 1 - enables call monitoring function; the ME informs about call events, such as incoming call, connected, hang up etc. using the following unsolicited indication: #ECAM: ,,,,, [,] where - call ID - call status 0 - idle page 360 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

361 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #ECAM - Extended Call Monitoring 1 - calling (MO) 2 - connecting (MO) 3 - active 4 - hold 5 - waiting (MT) 6 - alerting (MT) 7 - busy - call type 1 - voice 2 - data =1 - called number (valid only for ) - type of 129 - national number 145 - international number Note: the unsolicited indication is sent along with usual codes ( OK NO , , ...). BUSY CARRIER Note: issuing is the same as issuing the Read AT#ECAM command. AT#ECAM= returns the OK result code. Note: issuing Read command reports whether the extended call monitoring function is AT#ECAM? currently enabled or not, in the format: #ECAM: Test command returns the list of supported values for AT#ECAM=? 3.6.5.1.32 #SMOV - SMS Overflow #SMOV - SMS Overflow Set command enables/disables the SMS overflow signalling function. AT#SMOV[= []] Parameter: 0 - disables SMS overflow signalling function(factory default) 1 - enables SMS overflow signalling function; when the maximum storage capacity has reached, the following network initiated notification is send: #USMO: Note: issuing AT#SMOV is the same as issuing the Read command. Note: issuin the command g is the same as issuin AT#SMOV= g page 361 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

362 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 AT#SMOV=0 . S overflow signaling function is Read command reports whether the SM AT#SMOV? currently enabled or not, in the format: #SMOV: Test command returns the supported range of values of parameter AT#SMOV=? . 3.6.5.1.33 #CODEC - Audio Codec #CODEC - Audio Codec Set command sets the audio codec mode. AT#CODEC[= ] Parameter: 0 - all the codec modes are enabled (factory default) 1..31 - value obtained as sum of the following values, each of them representing a specific codec mode: , full rate mode enabled FR 1 - 2 - , enhanced full rate mode enabled EFR 4 - HR , half rate mode enabled 8 - AMR-FR , AMR full rate mode enabled 16 - AMR-HR , AMR half rate mode enabled Note: the setting 0 is equivalent to the setting 31. Note: The codec setting is saved in the profile parameters. is omitted the behavior of Set Note: if optional parameter command is the same as Read command. Read command returns current audio codec mode in the format: AT#CODEC? #CODEC: Test command returns the range of available values for parameter AT#CODEC=? AT#CODEC=14 Example OK sets the codec modes HR (4), EFR (2) and AMR-FR (8) page 362 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

363 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 ndsfree Echo Canceller 3.6.5.1.34 #SHFEC - Ha #SHFEC - Handsfree Echo Canceller Set command enables/disables the echo canceller function on audio AT#SHFEC[= handsfree output. []] Parameter: 0 - disables echo canceller for handsfree mode (factory default) 1 - enables echo canceller for handsfree mode Note: This setting returns to default after power off. Note: issuing AT#SHFEC is the same as issuing the Read command. is the same as issuing the command AT#SHFEC= Note: issuing . AT#SHFEC=0 Read command reports whether the echo canceller function on audio AT#SHFEC? handsfree output is currently enabled or not, in the format: #SHFEC: Test command returns the supported range of values of parameter AT#SHFEC=? . 3.6.5.1.35 #HFMICG - Ha ndsfree Microphone Gain #HFMICG - Handsfree Microphone Gain Set command sets the handsfree microphone input gain AT#HFMICG[= []] Parameter: : handsfree microphone input gain 0..7 - handsfree microphone gain (+6dB/step) Note: issuing AT#HFMICG is the same as issuing the Read command. Note: issuing AT#HFMICG= result code. OK returns the Read command returns the current handsfree microphone input gain, in the AT#HFMICG? format: #HFMICG: returns the supported range of values of parameter Test command AT#HFMICG=? . page 363 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

364 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 ndset Microphone Gain 3.6.5.1.36 #HSMICG - Ha #HSMICG - Handset Microphone Gain Set command sets the handset microphone input gain AT#HSMICG[= []] Parameter: : handset microphone input gain 0..7 - handset microphone gain (+6dB/step) Note: issuing AT#HSMICG is the same as issuing the Read command. returns the result code. Note: issuing AT#HSMICG= OK Read command returns the current handset microphone input gain, in the AT#HSMICG? format: #HSMICG: Test command returns the supported range of values of parameter . AT#HSMICG=? 3.6.5.1.37 #SHFSD - Set Headset Sidetone #SHFSD - Set Headset Sidetone Set command enables/disables the sidetone on headset audio output. AT#SHFSD[= []] Parameter: 0 - disables the headset sidetone (factory default) 1 - enables the headset sidetone. Note: This setting returns to default after power off. is the same as issuing the Read command. Note: issuing AT#SHFSD is the same as issuing the command AT#SHFSD= Note: issuing AT#SHFSD=0 . Read command reports whether the headset sidetone is currently enabled AT#SHFSD? or not, in the format: #SHFSD: Test command returns the supported range of values of parameter AT#SHFSD=? . page 364 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

365 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.1.38 #/ - Repeat Last Command #/ - Repeat Last Command Execute command is used to execute again the last received AT#/ command. 3.6.5.1.39 #NITZ - Network Timezone #NITZ - Network Timezone Set command enables/disables automatic date/time updating and Network AT#NITZ[= Timezone unsolicited indication. [ Date and time information may be sent by the network after GSM [,]]] registration or after GPRS attach. Parameters: 0 - disables automatic set (factory default) 1 - enables automatic set 0 - disables unsolicited message (factory default) 1 - enables unsolicited message; after date and time updating the following unsolicited indication is sent: #NITZ: “yy/MM/dd,hh:mm:ss” where: yy - year MM - month (in digits) - day dd hh - hour mm - minute ss - second Note: issuing is the same as issuing the Read command. AT#NITZ Note: issuing AT#NITZ= is the same as issuing the command . AT#NITZ=0 Read command reports whether automatic date/time updating is currently AT#NITZ? enabled or not, and whether Network Timezone unsolicited indication is enabled or not, in the format: #NITZ: , . and Test command returns supported values of parameters AT#NITZ=? page 365 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

366 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.1.40 #BND - Select Band #BND - Select Band Set command selects the current band. AT#BND[= []] Parameter : 0 - GSM 900MHz + DCS 1800MHz 1 - GSM 900MHz + PCS 1900MHz 2 - GMS 850MHz + PCS 1800MHz (available only on quadri-band modules) 3 - GMS 850MHz + PCS 1900MHz (available only on quadri-band modules) Note: This setting is maintained even after power off. is the same as issuing the Read command. AT#BND Note: issuing AT#BND= is the same as issuing the command Note: issuing AT#BND=0 . Read command returns the current selected band in the format: AT#BND? #BND: Test command returns the supported range of values of parameter . AT#BND=? Note: the range of values differs between triband modules and quadric-band modules tomatic Band Selection 3.6.5.1.41 #AUTOBND - Au #AUTOBND - Automatic Band Selection Set command enables/disables the automatic band selection at power-on. AT#AUTOBND[= ] Parameter: : 0 - disables automatic band selection at power-on (factory default) 1 - enables automatic band selection at power-on; +COPS=0 is necessary condition to effectively have automatic band selection at next power-on; the automatic band selection stops as soon as a GSM cell is found. Note: if automatic band selection is enabled the band changes every about 90 seconds through available bands until a GSM cell is found. is omitted the behaviour of Set command is the Note: if parameter same as Read command. page 366 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

367 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #AUTOBND - Automatic Band Selection Read command returns whether the automatic band selection is enabled or AT#AUTOBND? not in the form: #AUTOBND: Test command returns the range of supported values for parameter AT#AUTOBND=? . 3.6.5.1.42 #SKIPESC - Skip Escape Sequence #SKIPESC - Skip Escape Sequence +++ Set command enables/disables skipping the escape sequence while AT#SKIPESC[= transmitting during a data connection. []] Parameter: 0 - doesn’t skip the escape sequence; its transmission is enabled (factory default). 1 - skips the escape sequence; its transmission is not enabled. Note: in case of an FTP connection, the escape sequence is not transmitted, regardless of the command setting. Note: issuing AT#SKIPESC is the same as issuing the Read command. Note: issuing is the same as issuing the command AT#SKIPESC= . AT#SKIPESC=0 Read command reports whether escape sequence skipping is currently AT#SKIPESC? enabled or not, in the format: #SKIPESC: Test command reports supported range of values for parameter . AT#SKIPESC=? page 367 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

368 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 pe Sequence Guard Time 3.6.5.1.43 #E2ESC - Esca #E2ESC - Escape Sequence Guard Time Set command sets a guard time in seconds for the escape sequence in AT#E2ESC[= GPRS to be considered a valid one (and return to on-line command mode). []] Parameter: 0 - no guard time (factory default) 1..10 - guard time in seconds Note: if the Escape Sequence Guard Time is set to a value different from zero, it overrides the one set with S12 . Note: issuing AT#E2ESC is the same as issuing the Read command. AT#E2ESC= OK result code. returns the Note: issuing Read command returns current value of the escape sequence guard time, AT#E2ESC? in the format: #E2ESC: Test command returns the result code. OK AT#E2ESC=? Connection Authentication Type 3.6.5.1.44 #GAUTH - PPP-GPRS #GAUTH - PPP-GPRS Connection Authentication Type Set command sets the PPP-GPRS connection authentication type. AT#GAUTH[= ] Parameter 0 - no authentication 1 - PAP authentication (factory default) 2 - CHAP authentication is fixed to PAP Note: for GSM connection Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command reports the current PPP-GPRS connection authentication AT#GAUTH? type, in the format: #GAUTH: Test command returns the range of supported values for parameter AT#GAUTH=? . page 368 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

369 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.1.45 #RTCSTAT - RTC Status #RTCSTAT - RTC Status Set command resets the RTC status flag. AT#RTCSTAT[= ] Parameter: 0 - Set RTC Status to RTC HW OK and it doesn’t RTC HW Error Note: the initial value of RTC status flag is change until a command AT#RTCSTAT=0 is issued. Note: if a power failure occurs and the buffer battery is down the RTC AT#RTCSTAT=0 is . It doesn’t change until command status flag is set to 1 issued. is omitted the behaviour of Set command is Note: if parameter the same as Read command. Read command reports the current value of RTC status flag, in the format: AT#RTCSTAT? #RTCSTAT: Test command returns the range of supported values for parameter AT#RTCSTAT=? page 369 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

370 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.2 FTP AT Commands 3.6.5.2.1 #FTPTO - FTP Time-Out #FTPTO - FTP Time-Out Set command sets time-out for FTP operations. AT#FTPTO[= ] Parameter: - time-out in 100 ms units 100..5000 - hundreds of ms (factory default is 100) Note: The parameter is not saved in NVM. Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command returns the current FTP operations time-out, in the format: AT#FTPTO? #FTPTO: Test command returns the range of supported values for parameter AT#FTPTO=? 3.6.5.2.2 #FTPOPEN - FTP Open #FTPOPEN - FTP Open Execution command opens an FTP connection toward the FTP server. AT#FTPOPEN= , Parameters: , - string type, address and port of FTP server (factory default , port 21). - string type, authentication user identification string for FTP. - string type, authentication password for FTP. 0 - active mode (default) 1 - passive mode 3.6.5.2.3 #FTPCLOSE - FTP Close #FTPCLOSE - FTP Close Execution command closes an FTP connection. AT#FTPCLOSE Read command behavior is the same as Execution command. AT#FTPCLOSE? page 370 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

371 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.2.4 #FTPPUT - FTP Put #FTPPUT - FTP Put Execution command, issued during an FTP connection, opens a data AT#FTPPUT= connection and starts sending file to the FTP server. If the data connection succeeds, a CONNECT indication is sent, otherwise NO CARRIER indication is sent. a Parameter: - string type, name of the file. to close the data connection. Note: use the escape sequence +++ result code to be returned if no ERROR Note: The command causes an FTP connection has been opened yet. 3.6.5.2.5 #FTPPUTPH - FTP Put Photo #FTPPUTPH - FTP Put Photo Execution command, issued during an FTP connection, opens a data AT#FTPPUTPH= connection and starts sending to the FTP server the last photo taken issuing AT#TPHOTO . Parameter: - string type, name of the file on the FTP server side. Note: the file transfer type has to be binary in order to send the photo the ). #FTPTYPE right way (see command result code to be returned if no Note: The command causes an ERROR FTP connection has been opened yet. at#gprs=1 Example +IP: ###.###.###.### OK at#camon OK at#tphoto OK at#ftpopen="xxx.xxx.xxx.xxx",,,0 OK at#ftptype=0 OK at#ftpputph="photo.jpg" page 371 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

372 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #FTPPUTPH - FTP Put Photo OK at#ftpclose OK 3.6.5.2.6 #FTPGET - FTP Get #FTPGET - FTP Get Execution command, issued during an FTP connection, opens a data AT#FTPGET= connection and starts getting a file from the FTP server. indication is sent, otherwise a If the data connection succeeds a CONNECT indication is sent. NO CARRIER The file is received on the serial port. Parameter: - file name, string type. Note: The command causes an ERROR result code to be returned if no FTP connection has been opened yet. 3.6.5.2.7 #FTPTYPE - FTP Type #FTPTYPE - FTP Type Set command, issued during an FTP connection, sets the file transfer type. AT#FTPTYPE[= ] Parameter: - file transfer type: 0 - binary 1 - ascii Note: The command causes an ERROR result code to be returned if no FTP connection has been opened yet. Note: If the parameter is omitted then the behaviour of Set command is the same of Read command. Read command returns the current file transfer type, in the format: #FTPTYPE? #FTPTYPE: : Test command returns the range of available values for parameter #FTPTYPE=? #FTPTYPE: (0,1) page 372 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

373 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.2.8 #FTPMSG - FTP Read Message #FTPMSG - FTP Read Message Execution command returns the last response from the server. AT#FTPMSG Read command behaviour is the same as Execution command. AT#FTPMSG? 3.6.5.2.9 #FTPDELE - FTP Delete #FTPDELE - FTP Delete Execution command, issued during an FTP connection, deletes a file from AT#FTPDELE= the remote working directory. Parameter: - string type, it’s the name of the file to delete. ERROR Note: The command causes an result code to be returned if no FTP connection has been opened yet. Print Working Directory 3.6.5.2.10 #FTPPWD - FTP #FTPPWD - FTP Print Working Directory Execution command, issued during an FTP connection, shows the current AT#FTPPWD working directory on FTP server. ERROR result code to be returned if no Note: The command causes an FTP connection has been opened yet. 3.6.5.2.11 #FTPCWD - FTP Change Working Directory #FTPCWD - FTP Change Working Directory Execution command, issued during an FTP connection, changes the AT#FTPCWD= working directory on FTP server. Parameter: - string type, it’s the name of the new working directory. ERROR result code to be returned if no Note: The command causes an FTP connection has been opened yet. page 373 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

374 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.2.12 #FTPLIST - FTP List #FTPLIST - FTP List Execution command, issued during an FTP connection, opens a data AT#FTPLIST[= connection and starts getting from the server the list of contents of the ] specified directory or the properties of the specified file. Parameter: - string type, it’s the name of the directory or file. ERROR Note: The command causes an result code to be returned if no FTP connection has been opened yet. Note: issuing opens a data connection and starts AT#FTPLIST getting from the server the list of contents of the working directory. Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 374 of 614

375 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.3 Enhanced Easy GPRS® Extension AT Commands thentication User ID 3.6.5.3.1 #USERID - Au #USERID - Authentication User ID Set command sets the user identification string to be used during the AT#USERID authentication step. [=] Parameter: - string type, it’s the authentication User Id; the max length for this value is the output of Test command, AT#USERID=? (factory default is the empty string “”) . Note: If parameter is omitted then the behaviour of Set command is the same of Read command. Read command reports the current user identification string, in the format: AT#USERID? #USERID: . Test command returns the maximum allowed length of the string parameter AT#USERID=? . AT#USERID="myName" Example OK AT#USERID? #USERID: "myName" OK thentication Password 3.6.5.3.2 #PASSW - Au #PASSW - Authentication Password Set command sets the user password string to be used during the AT#PASSW= authentication step. Parameter: - string type, it’s the authentication password; the max length for this (factory value is the output of Test command, AT#PASSW=? default is the empty string “”). Test command returns the maximum allowed length of the string parameter AT#PASSW=? . AT#PASSW="myPassword" Example OK page 375 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

376 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.3.3 #PKTSZ - Packet Size #PKTSZ - Packet Size Set command sets the default packet size to be used by the TCP/UDP/IP AT#PKTSZ[= stack for data sending. []] Parameter: - packet size in bytes 0 - automatically chosen by the device 1..512 - packet size in bytes (factory default is 300) is the same as issuing the Read command. Note: issuing AT#PKTSZ Note: issuing AT#PKTSZ= is the same as issuing the command AT#PKTSZ=0 . Read command reports the current packet size value. AT#PKTSZ? AT#PKTSZ=0 Note: after issuing command , the Read command reports the value automatically chosen by the device. Test command returns the allowed values for the parameter . AT#PKTSZ=? AT#PKTSZ=100 Example OK AT#PKTSZ? #PKTSZ: 100 OK AT#PKTSZ=0 OK AT#PKTSZ? #PKTSZ: 300 -> value automatically chosen by device OK 3.6.5.3.4 #DSTO - Data Sending Time-Out #DSTO - Data Sending Time-Out Set command sets the maximum time that the module awaits before AT#DSTO[= sending anyway a packet whose size is less than the default one. []] Parameter: - packet sending time-out in 100ms units (factory default is 50) 0 - no time-out, wait forever for packets to be completed before send. 1..255 hundreds of ms Note: In order to avoid low performance issues, it is suggested to set the data sending time-out to a value greater than 5. page 376 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

377 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #DSTO - Data Sending Time-Out Note: this time-out applies to data whose size is less than packet size and whose sending would have been delayed for an undefined time until new data to be sent had been received and full packet size reached. is the same as issuing the Read command. AT#DSTO Note: issuing Note: issuing AT#DSTO= is the same as issuing the command AT#DSTO=0 . Read command reports the current data sending time-out value. AT#DSTO? Test command returns the allowed values for the parameter . AT#DSTO=? ->1 sec. time-out AT#DSTO=10 Example OK AT#DSTO? #DSTO: 10 OK 3.6.5.3.5 #SKTTO - Soc ket Inactivity Time-Out #SKTTO - Socket Inactivity Time-Out Set command sets the maximum time with no data exchanging on the AT#SKTTO[= socket that the module awaits before closing the socket and deactivating []] the GPRS context. Parameter: - socket inactivity time-out in seconds units 0 - no timeout. 1..65535 - time-out in sec. units (factory default is 90). Note: this time-out applies when no data is exchanged in the socket for a long time and therefore the socket connection has to be automatically closed and the GPRS context deactivated. AT#SKTTO is the same as issuing the Read command. Note: issuing AT+#SKTTO= is the same as issuing the command Note: issuing AT+#SKTTO=0 . Read command reports the current socket inactivity time-out value. AT#SKTTO? Test command returns the allowed values for parameter . AT#SKTTO=? ->(30 sec. time-out) AT#SKTTO=30 Example OK AT#SKTTO? #SKTTO: 30 page 377 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

378 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTTO - Socket Inactivity Time-Out OK 3.6.5.3.6 #SKTSET - Socket Definition #SKTSET - Socket Definition Set command sets the socket parameters values. AT#SKTSET[= , Parameters: , - socket protocol type , 0 - TCP (factory default) [], 1 - UDP []] - remote host port to be opened 0..65535 - port number (factory default is 0) - address of the remote host, string type. This parameter can be either: any valid IP address in the format: xxx.xxx.xxx.xxx - - any host name to be solved with a DNS query in the format: (factory default is the empty string “”) - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) +++ ) 255 - local host closes after an escape sequence ( - local host port to be used on UDP socket 0..65535 - port number parameter is valid only for TCP socket type, for UDP Note: sockets shall be left unused. parameter is valid only for UDP socket type, for TCP Note: sockets shall be left unused. Note: The resolution of the host name is done when opening the socket, therefore if an invalid host name is given to the #SKTSET command, then error message will be issued. Note: the DNS Query to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT ) - the authentication parameters are set (#USERID , #PASSW - the GPRS coverage is enough to permit a connection. Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. Read command reports the socket parameters values, in the format: AT#SKTSET? AT#SKTSET: ,,, page 378 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

379 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTSET - Socket Definition , Test command returns the allowed values for the parameters. AT#SKTSET=? AT#SKTSET=0,1024,"123.255.020.001" Example OK AT#SKTSET=0,1024,"www.telit.net" OK 3.6.5.3.7 #SKTOP - Socket Open #SKTOP - Socket Open Execution command activates the context number 1, proceeds with the AT#SKTOP authentication with the user ID and password previously set by #USERID commands, and opens a socket connection with the host #PASSW and command. Eventually, before opening the socket #SKTSET specified in the connection, it issues automatically a DNS query to solve the IP address of the host name. If the connection succeeds a CONNECT NO indication is sent, otherwise a CARRIER indication is sent. Read command behaviour is the same as Execution command. AT#SKTOP? AT#SKTOP Example ..GPRS context activation, authentication and socket open.. CONNECT 3.6.5.3.8 #QDNS - Query DNS #QDNS - Query DNS Execution command executes a DNS query to solve the host name into an AT#QDNS= IP address. Parameter: - host name, string type. If the DNS query is successful then the IP address will be reported in the result code: #QDNS:"", Note: the command has to activate the GPRS context if it was not previously activated. In this case the context is deactivated after the DNS query. page 379 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

380 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #QDNS - Query DNS xxx.xxx.xxx.xxx is in the format: Note: Note This command requires that the authentication parameters are correctly set and that the GPRS network is present. TCP Connection Time-Out 3.6.5.3.9 #SKTCT - Socket #SKTCT - Socket TCP Connection Time-Out Set command sets the TCP connection time-out for the first CONNECT AT#SKTCT[= answer from the TCP peer to be received. ] Parameter: CONNECT answer time-out in 100ms units - TCP first 10..1200 - hundreds of ms (factory default value is 600). Note: this time-out applies only to the time that the TCP stack waits for the CONNECT answer to its connection request. Note: The time for activate the GPRS and resolving the name with the DNS query (if the peer was specified by name and not by address) is not counted in this timeout. Note: if parameter is omitted then the behav iour of Set command is the same as Read command. Read command reports the current TCP connection time-out. AT#SKTCT? . Test command returns the allowed values for parameter AT#SKTCT=? AT#SKTCT=600 Example OK socket first connection answer timeout has been set to 60 s. cket Parameters Save #SKTSAV - So 3.6.5.3.10 #SKTSAV - Socket Parameters Save Execution command saves the actual socket parameters in the NVM of the AT#SKTSAV device. The socket parameters to store are: - User ID - Password - Packet Size - Socket Inactivity Time-Out - Data Sending Time-Out - Socket Type (UDP/TCP) - Remote Port page 380 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

381 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - Remote Address - TCP Connection Time-Out AT#SKTSAV Example OK socket parameters have been saved in NVM If some parameters have not been previously specified then a default value Note will be stored. 3.6.5.3.11 #SKTRST - So cket Parameters Reset #SKTRST - Socket Parameters Reset Execution command resets the actual socket parameters in the NVM of the AT#SKTRST device to the default ones. The socket parameters to reset are: - User ID - Password - Packet Size - Socket Inactivity Timeout - Data Sending Timeout - Socket Type - Remote Port - Remote Address - TCP Connection Time-Out AT#SKTRST Example OK socket parameters have been reset #GPRS - GPRS Context Activation 3.6.5.3.12 #GPRS - GPRS Context Activation Execution command deactivates/activates the GPRS context, eventually AT#GPRS[= #PASSW proceeding with the authentication with the parameters given with []] and #USERID . Parameter: - GPRS context activation mode 0 - GPRS context deactivation request 1 - GPRS context activation request is OK In the case that the GPRS context has been activated, the result code preceded by the intermediate result code: +IP: page 381 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

382 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 reporting the local IP address obtained from the network. AT#GPRS Note: issuing reports the current status of the GPRS context, in the format: #GPRS: where: 0 - GPRS context deactivated 1 - GPRS context activated 2 - GPRS context activation pending. Note: issuing AT#GPRS= is the same as issuing the command . AT#GPRS=0 Read command has the same effect as the Execution command AT#GPRS? AT#GPRS. Test command returns the allowed values for parameter . AT#GPRS=? AT#GPRS=1 Example +IP: 129.137.1.1 OK Now GPRS Context has been activated and our IP is 129.137.1.1 AT#GPRS=0 OK Now GPRS context has been deactivated, IP is lost. 3.6.5.3.13 #SKTD - Socket Dial #SKTD - Socket Dial Set command opens the socket towards the peer specified in the AT#SKTD parameters. [=, , Parameters: , - socket protocol type [], 0 - TCP (factory default) []] 1 - UDP - remote host port to be opened 0..65535 - port number (factory default is 0) - address of the remote host, string type. This parameter can be either: any valid IP address in the format: xxx.xxx.xxx.xxx - - any host name to be solved with a DNS query in the format: page 382 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

383 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTD - Socket Dial (factory default is the empty string “”) - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) 255 - local host closes after an escape sequence ( +++ ) - local host port to be used on UDP socket 0..65535 - port number Note: parameter is valid only for TCP socket type, for UDP sockets shall be left unused. Note: parameter is valid only for UDP socket type, for TCP sockets shall be left unused. Note: the resolution of the host name is done when opening the socket, therefore if an invalid host name is given to the #SKTD command, then an error message will be issued. Note: the command to be successful requests that: - the GPRS context 1 is correctly set with AT+CGDCONT , (#USERID - the authentication parameters are set ) the GPRS #PASSW coverage is enough to permit a connection - the GPRS has been activated with AT#GPRS=1 Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. Read command reports the socket dial parameters values, in the format: AT#SKTD? AT#SKTD: ,,, , Test command returns the allowed values for the parameters. AT#SKTD=? AT#SKTD=0,1024,"123.255.020.001",255 Example OK AT#SKTD=1,1024,"123.255.020.001", ,1025 OK In this way my local port 1025 is opened to the remote port 1024 AT#SKTD=0,1024,"www.telit.net", 255 OK Note The main difference between this command and the AT#SKTOP is that this command does not interact with the GPRS context status, leaving it ON or setting, therefore when the connection made OFF #GPRS according to the with is closed the context (and hence the local IP address) is AT#SKTD maintained. page 383 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

384 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.3.14 #SKTL - Socket Listen #SKTL - Socket Listen Execution command opens/closes the socket listening for connection AT#SKTL requests. [=, , Parameters: , - socket mode []] 0 - closes socket listening 1 - starts socket listening - socket protocol type 0 - TCP - local host input port to be listened 0..65535 - port number - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) +++ 255 - local host closes after an escape sequence ( ) Command returns the result code if successful. OK Note: the command to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT , - the authentication parameters are set ( #USERID ) #PASSW - the GPRS coverage is enough to permit a connection - the GPRS has been activated with AT#GPRS=1 When a connection request comes on the input port, if the sender is not ), an unsolicited code #FRWL filtered by the internal firewall (see command is reported: +CONN FROM: Where: - host address of the remote machine that contacted the device. CONNECT indication is given and When the connection is established the the modem goes into data transfer mode. On connection close or when context is closed with #GPRS=0 the socket is closed and no listen is anymore active. rk while in listening, the socket is If the context is closed by the netwo closed, no listen is anymore active and an unsolicited code is reported: #SKTL: ABORTED arameters are omitted the command returns the current socket p Note: if all page 384 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

385 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTL - Socket Listen and the last settings of parameters listening status and , in the format: #SKTL: ,, where - socket listening status 0 - socket not listening 1 - socket listening Read command has the same effect as Execution command when AT#SKTL? parameters are omitted. Test command returns the allowed values for parameters , and . Activate GPRS Example AT#GPRS=1 +IP: ###.###.###.### OK Start listening AT#SKTL=1,0,1024 OK or AT#SKTL=1,0,1024,255 OK Receive connection requests +CONN FROM: 192.164.2.1 CONNECT exchange data with the remote host send escape sequence +++ NO CARRIER Now listen is not anymore active to stop listening AT#SKTL=0,0,1024, 255 OK Note The main difference between this command and the #SKTD is that #SKTL does not contact any peer, nor does any interaction with the GPRS context status, leaving it setting, therefore #GPRS according to the ON or OFF #SKTL is closed the context (and hence when the connection made with the local IP address) is maintained. @SKTL has been defined. The improving command page 385 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

386 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - Socket Listen 3.6.5.3.15 @SKTL @SKTL - Socket Listen Execution command opens/closes the socket listening for connection [email protected] requests. [=, , Parameters: , - socket mode []] 0 - closes socket listening 1 - starts socket listening - socket protocol type 0 - TCP - local host input port to be listened 0..65535 - port number - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) 255 - local host closes after an escape sequence ( ) +++ Command returns the result code if successful. OK Note: the command to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT #USERID , - the authentication parameters are set ( ) #PASSW - the GPRS coverage is enough to permit a connection - the GPRS has been activated with AT#GPRS=1 When a connection request comes on the input port, if the sender is not ), an unsolicited code filtered by the internal firewall (see command #FRWL is reported: +CONN FROM: Where: - host address of the remote machine that contacted the device. When the connection is established the CONNECT indication is given and the modem goes into data transfer mode. #GPRS=0 the socket is On connection close or when context is closed with closed and no listen is anymore active. If the context is closed by the netwo rk while in listening, the socket is closed, no listen is anymore active and an unsolicited code is reported: @SKTL: ABORTED page 386 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

387 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 @SKTL - Socket Listen Note: if all parameters are omitted the command returns the current socket listening status and the last settings of parameters , and , in the format: @SKTL: ,,, Where - socket listening status 0 - socket not listening 1 - socket listening Read command has the same effect as Execution command when [email protected]? parameters are omitted. Test command returns the allowed values for parameters , , . and type> Activate GPRS Example AT#GPRS=1 +IP: ###.###.###.### OK Start listening [email protected]=1,0,1024 OK or [email protected]=1,0,1024,255 OK Receive connection requests +CONN FROM: 192.164.2.1 CONNECT exchange data with the remote host send escape sequence +++ NO CARRIER Now listen is not anymore active to stop listening [email protected]=0,0,1024, 255 OK #SKTD Note The main difference between this command and the is that @SKTL does not contact any peer, nor does any interaction with the GPRS context according to the setting, therefore status, leaving it ON or OFF #GPRS is closed the context (and hence @SKTL when the connection made with the local IP address) is maintained. page 387 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

388 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.3.16 #E2SLRI - Sock et Listen Ring Indicator #E2SLRI - Socket Listen Ring Indicator Set command enables/disables the Ring Indicator pin response to a Socket AT#E2SLRI=[] Listen connect and, if enabled, the duration of the negative going pulse generated on receipt of connect. Parameter: - RI enabling 0 - RI disabled for Socket Listen connect (factory default) 50..1150 - RI enabled for Socket Listen connect; a negative going pulse is generated on receipt of connect and is the duration in ms of this pulse. Read command reports whether the Ring Indicator pin response to a Socket AT#E2SLRI? Listen connect is currently enabled or not, in the format: #E2SLRI: Test command returns the allowed values for parameter . AT#E2SLRI=? 3.6.5.3.17 #FRWL - Firewall Setup #FRWL - Firewall Setup Execution command controls the internal firewall settings. AT#FRWL[= , Parameters: , - command action ] 0 - remove selected chain ACCEPT chain 1 - add an 2 - remove all chains ( DROP everything); and has no meaning in this case. - remote address to be added into the ACCEPT chain; string type, it can be any valid IP address in the format: xxx.xxx.xxx.xxx - mask to be applied on the ; string type, it can be any valid IP address mask in the format: xxx.xxx.xxx.xxx Command returns OK result code if successful. Note: the firewall applies for incoming (listening) connections only. Firewall general policy is DROP , therefore all packets that are not included into an ACCEPT chain rule will be silently discarded. When a packet comes from the IP address incoming_IP , the firewall chain rules will be scanned for matching with the following criteria: incoming_IP & = & page 388 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

389 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #FRWL - Firewall Setup If criteria is matched, then the packet is accepted and the rule scan is finished; if criteria is not matched for any chain the packet is silently dropped. Note: If all parameters are omitted the command reports the list of all ACCEPT chain rules registered in the Firewall settings in the format: #FRWL: , #FRWL: , ... OK Read command has the same effect as Execution command when AT#FRWL? parameters are omitted. . Test command returns the allowed values for parameter AT#FRWL=? Let assume we want to accept connections only from our Example devices which are on the IP addresses ranging from 197.158.1.1 to 197.158.255.255 We need to add the following chain to the firewall: AT#FRWL=1,"197.158.1.1","255.255.0.0" OK For outgoing connections made with #SKTD and the remote host Note #SKTOP chain for all the connection is dynamically inserted into the ACCEPT duration. Therefore the #FRWL command shall be used only for defining @SKTL #SKTL or the behaviour, deciding which hosts are either the allowed to connect to the local device. Rules are not saved in NVM, at start-up the rules list will be empty. page 389 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

390 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.4 Easy Camera® Management AT Commands 3.6.5.4.1 #CAMON - Camera ON #CAMON - Camera ON . ON Execution command turns the Camera AT#CAMON Read command has the same behaviour as Execution command AT#CAMON? AT#CAMON Example OK camera is now powered up 3.6.5.4.2 #CAMOFF - Camera OFF #CAMOFF - Camera OFF . OFF Execution command turns the Camera AT#CAMOFF Note: for the GPS product (GE863-GPS): if the camera is turned off while GPS or VAUX pin is enabled they’ll both also be powered off. Read command has the same behaviour as Execution command AT#CAMOFF? AT#CAMOFF Example OK camera is now powered down 3.6.5.4.3 #CAMEN - Camera ON/OFF #CAMEN - Camera ON/OFF . Execution command turns camera ON/OFF AT#CAMEN[= ] Parameter: - camera status 0 - turns camera OFF 1 - turns camera ON is omitted the Set command is the same as the Note: if parameter Read command. Note: for the GPS product (GE863-GPS): if the camera is turned off while GPS or VAUX pin is enabled they’ll both also be powered off. Read command reports the current camera status and, if the camera is ON , AT#CAMEN? the current camera model, in the format: #CAMEN: 0 if camera is OFF #CAMEN: 1, ON if camera is page 390 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

391 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Where: - camera model 2 - TRANSCHIP camera . Test command returns the allowed values for parameter AT#CAMEN=? 3.6.5.4.4 #SELCAM - Camera Model #SELCAM - Camera Model Set command selects current camera model AT#SELCAM[= []] Parameter: - camera model 0 - automatic detection (factory default) 2 - TRANSCHIP camera 3 - reserved for future use 4 - reserved for future use 5 - reserved for future use is the same as issuing the Read AT#SELCAM Note: issuing command. Note: issuing AT#SELCAM= is the same as issuing the command AT#SELCAM=0 Read command reports the current camera model in the format: AT#SELCAM? #SELCAM: Test command returns the allowed values for parameter AT#SELCAM=? 3.6.5.4.5 #CAMRES - Camera Resolution #CAMRES - Camera Resolution Set command sets current camera resolution AT#CAMRES[= []] Parameter: - camera resolution 0 - VGA photo output,640x480 (factory default) 1 - QVGA photo output, 320x240 2 - QQVGA photo output, 160x120 3 - reserved for future use 4 - reserved for future use is the same as issuing the Read Note: issuing AT#CAMRES command. Note: issuing AT#CAMRES= is the same as issuing the command AT#CAMRES=0 . page 391 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

392 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 in format: Read command reports the current value of the parameter AT#CAMRES? #CAMRES: Test command returns the allowed values for parameter . AT#CAMRES=? 3.6.5.4.6 #CAMCOL - Ca mera Colour Mode #CAMCOL - Camera Colour Mode Set command sets current colour mode AT#CAMCOL[= []] Parameter: - camera colour mode 0 - colour mode (factory default) 1 - Black&White mode AT#CAMCOL is the same as issuing the Read Note: issuing command. Note: issuing AT#CAMCOL= is the same as issuing the command AT#CAMCOL=0 . Read command reports the current colour mode, in the format: AT#CAMCOL? #CAMCOL: . Test command returns the allowed values for parameter . AT#CAMCOL=? 3.6.5.4.7 #CAMQUA - Camera Photo Quality #CAMQUA - Camera Photo Quality Set command sets the quality of the photo. AT#CAMQUA[= []] Parameter: - photo quality 0 - low quality of picture, high Jpeg compression 1 - medium quality of picture, medium Jpeg compression 2 - high quality of picture, low Jpeg compression (factory default) Note: increasing the photo quality increases its size. Note: issuing AT#CAMQUA is the same as issuing the Read command. is the same as issuing the command AT#CAMQUA= Note: issuing AT#CAMQUA=0 . Read command reports the current photo quality, in the format: AT#CAMQUA? page 392 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

393 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CAMQUA: Test command returns the allowed values for parameter . AT#CAMQUA=? 3.6.5.4.8 #CMODE - Camera Exposure #CMODE - Camera Exposure Set command sets the camera exposure. AT#CMODE[= []] Parameter: - camera exposure 0 - daylight mode, short exposure (factory default) 1 - nightlight mode, long exposure is the same as issuing the Read command. Note: issuing AT#CMODE Note: issuing is the same as issuing the command AT#CMODE= AT#CMODE=0 Read command reports the current camera exposure in the format: AT#CMODE? #CMODE: Test command returns the allowed values for parameter . AT#CMODE=? 3.6.5.4.9 #CAMZOOM - Camera Zoom #CAMZOOM - Camera Zoom Set command sets current zoom. AT#CAMZOOM[= []] Parameter: - camera zoom 0 - no zoom, x1 (factory default) 1 - zoom, x2 2 - zoom, x4 3 - reserved for future use Note: issuing AT#CAMZOOM is the same as issuing the Read command. Note: issuing AT#CAMZOOM= is the same as issuing the command AT#CAMZOOM=0 . Read command reports the current zoom setting, in the format: AT#CAMZOOM? #CAMZOOM: . Test command returns the allowed values for parameter AT#CAMZOOM=? page 393 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

394 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 ra Time/Date Overprint 3.6.5.4.10 #CAMTXT - Came #CAMTXT - Camera Time/Date Overprint Set command sets time/date overprinting. AT#CAMTXT[= []] Parameter: - time/date overprinting mode 0 - no overprinting (factory default) 1 - time info printed at the bottom of picture 2 - date info printed at the bottom of picture 3 - time&date info printed at the bottom of picture 4 - reserved for future use AT#CAMTXT is the same as issuing the Read Note: issuing command. Note: issuing is the same as issuing the command AT#CAMTXT= AT#CAMTXT=0 . Read command reports the current time/date overprinting mode, in the AT#CAMTXT? format: #CAMTXT: . Test command returns the allowed values for parameter AT#CAMTXT=? 3.6.5.4.11 #TPHOTO - Camera Take Photo #TPHOTO - Camera Take Photo Execution command is used to take the photo and to store it in the AT#TPHOTO MODULE memory. Note: the photo is stored in the MODULE RAM memory, therefore after a power off it is lost. Note: there's only 1 position for the photo, every photo will overwrite the previous. Read command has the same behaviour as Execution command AT#TPHOTO? AT#TPHOTO Example OK the camera has taken the photo and it is now stored on the MODULE memory Note The photo is taken during IDLE time, if the mobile is busy on network operations, (e.g. during a call) the photo cannot be taken. page 394 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

395 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Camera Read Photo 3.6.5.4.12 #RPHOTO - #RPHOTO - Camera Read Photo Execution command is used to flushing the photo stored in the MODULE AT#RPHOTO RAM memory to the serial line, ending it with the sequence: OK Read command has the same behaviour as Execution command AT#RPHOTO? AT#RPHOTO Example (binary digits of the JPEG image) xxxxxxxxxxxx OK the photo has been flushed to the serial line Note The photo is flushed as hexadecimal characters in the format selected. The baudrate is fixed at 115200, using hardware flow control. 3.6.5.4.13 #OBJL - Object List #OBJL- Object List Command Execution command reports the list of the objects stored in the MODULE AT#OBJL[=] memory. Parameter: < obj> - type of objects to be listed, string type. “IMG” - image object. Note: the behaviour of the command doesn’t change even if the parameter is omitted The output format is: #OBJL: , where: - name of the object; it is always “Snapshot” - size of the object in bytes Read command has the same behaviour as Execution command AT#OBJL? Test command has the same behaviour as Execution command AT#OBJL=? AT#OBJL="IMG" Example #OBJL: Snapshot,47224 OK page 395 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

396 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.4.14 #OBJR - Object Read #OBJR - Object Read Execution command is used to flushing the photo stored in the MODULE AT#OBJR=, RAM memory to the serial line. "Snapshot" The difference between this command and output #OBJR is that #RPHOTO ends without the sequence: OK Parameter: - type of objects to be listed, string type “IMG” - Image object Note: is the only name of the object. "Snapshot" AT#OBJR="IMG","Snapshot" Example binary digits of the JPEG image xxxxxxxxxxxx ... the photo has been flushed to the serial line. Note The photo is flushed as hexadecimal characters in the format selected. The baudrate is fixed at 115200, using hardware flow control. page 396 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

397 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.5 E-mail Management AT Commands 3.6.5.5.1 #ESMTP - E-mail SMTP Server #ESMTP - E-mail SMTP Server Set command sets the SMTP server address, used for E-mail sending. AT#ESMTP SMTP server can be specified as IP address or as nick name. [=] Parameter: - SMTP server address, string type. This parameter can be either: - any valid IP address in the format: xxx.xxx.xxx.xxx - any host name to be solved with a DNS query in the format: (factory default is the empty string “”) is the output of Test command. Note: the max length for Note: If parameter is omitted then the behaviour of Set command is the same of Read command Read Command reports the current SMTP server address, in the format: AT#ESMTP? #ESMTP: Test command returns the max length for the parameter . AT#ESMTP=? AT#ESMTP="smtp.mydomain.com" Example OK Note The SMTP server used shall be inside the APN space (the smtp server provided by the network operator) or it must allow the Relay, otherwise it will refuse to send the email. 3.6.5.5.2 #EADDR - E-mail Sender Address #EADDR - E-mail Sender Address Set command sets the sender address string to be used for sending the e- AT#EADDR mail. [=] Parameter: - sender address, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) Note: If parameter is omitted then the behaviour of Set command is the same of Read command Read command reports the current sender address, in the format: AT#EADDR? #EADDR: page 397 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

398 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #EADDR - E-mail Sender Address Test command returns the maximum allowed length of the string parameter AT#EADDR=? . AT#EADDR="[email protected]" Example OK AT#EADDR? #EADDR: "[email protected]" OK Authentication User Name 3.6.5.5.3 #EUSER - E-mail #EUSER - E-mail Authentication User Name Set command sets the user identification string to be used during the AT#EUSER authentication step of the SMTP. [=] Parameter: - email authentication User ID, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) parameter shall be Note: if no authentication is required then the empty "". Note: If parameter is omitted then the behaviour of Set command is the same of Read command Read command reports the current user identification string, in the format: AT#EUSER? #EUSER: Test command returns the maximum allowed length of the string parameter AT#EUSER=? . AT#EUSER="myE-Name" Example OK AT#EUSER? #EUSER: "myE-Name" OK Note It is a different user field than the one used for GPRS authentication (see #USERID ). page 398 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

399 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.5.4 #EPASSW - E-mail Authentication Password #EPASSW - E-mail Authentication Password Set command sets the password string to be used during the authentication AT#EPASSW= step of the SMTP. Parameter: - email authentication password, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) Note: if no authentication is required then the parameter shall be empty "". Test command returns the maximum allowed length of the string parameter AT#EPASSW=? . AT#USERID="myPassword" Example OK Note It is a different password field than the one used for GPRS authentication (see ). #PASSW 3.6.5.5.5 #SEMAIL - E-mail Sending With GPRS Context Activation #SEMAIL - E-mail Sending With GPRS Context Activation Execution command activates a GPRS context, if not previously activated AT#SEMAIL= , and sends an e-mail message. The GPRS context is by #EMAILACT ,, deactivated when the e-mail is sent. [,] Parameters: - destination address, string type. - subject of the message, string type. - attached image flag 0 - don't attach any image 1 - attach the last snapshot taken - image name (default is “snapshot.jpg”) The device responds to the command with the prompt ' > ' and awaits for the message body text. Ctrl-Z To complete the operation send char ( 0x1A hex); to exit without writing the message send ESC char ( 0x1B hex). If e-mail message is successfully sent, then the response is . OK If message sending fails for some reason, an error code is reported Note: Care must be taken to ensure that durin g the command execution, page 399 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

400 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SEMAIL - E-mail Sending With GPRS Context Activation no other commands are issued. To avoid malfunctions is suggested to wait for the ERROR / +CMS or OK ERROR: response before issuing further commands. #GPRS Note: if GPRS context was previously activated by it’s not possible to successfully send the e-mail message and the response is the result code activation failed . Note: sending an e-mail with an image attachment can take quite a long time since it can be over 50Kb to send and can take more than 1 minute. ","subject of the mail",1 [email protected] AT#SEMAIL=" Example >message body... this is the text of the mail message... CTRL-Z ..wait.. OK Message has been sent. 3.6.5.5.6 #EMAILACT - E-mail GPRS Context Activation #EMAILACT - E-mail GPRS Context Ativation Execution command deactivates/activates the GPRS context, eventually AT#EMAILACT[= proceeding with the authentication with the parameters given with #PASSW []] #USERID . and Parameter: - GPRS context activation mode 0 - GPRS context deactivation request 1 - GPRS context activation request Note: issuing AT#EMAILACT reports the current status of the GPRS context for the e-mail, in the format: #EMAILACT: where: 0 - GPRS context deactivated 1 - GPRS context activated is the same as issuing the command Note: issuing AT#EMAILACT= AT#EMAILACT=0 . Read command has the same effect of the Execution command AT#EMAILACT? page 400 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

401 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #EMAILACT - E-mail GPRS Context Ativation AT#EMAILACT . . Test command returns the allowed values for parameter AT#EMAILACT=? AT#EMAILACT=1 Example OK Now GPRS Context has been activated AT# EMAILACT=0 OK Now GPRS context has been deactivated. 3.6.5.5.7 #EMAILD - E-mail Sending #EMAILD - E-mail Sending Execution command sends an e-mail message if GPRS context has already AT#EMAILD= . AT#EMAILACT=1 been activated with ,, [,] Parameters: - destination address, string type. - subject of the message, string type - attached image flag 0 - don't attach any image 1 - attach the last snapshot taken - image name (default is “snapshot.jpg”) The device responds to the command with the prompt ' > ' and awaits for the message body text. hex); to exit without To complete the operation send Ctrl-Z char ( 0x1A char ( ESC hex). 0x1B writing the message send If e-mail message is successfully sent, then the response is OK . If message sending fails for some reason, an error code is reported Note: Care must be taken to ensure that during the command execution, no other commands are issued. To avoid malfunctions is suggested to wait for the OK or ERROR / +CMS ERROR: response before issuing further commands. Note: sending an e-mail with an image attachment can take quite a long time since it can be over 50Kb to send and can take more than 1 minute. ”,”subject of the mail”,1 [email protected] AT#EMAILD=” Example >message body... this is the text of the mail message... CTRL-Z page 401 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

402 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #EMAILD - E-mail Sending ..wait.. OK Message has been sent. The only difference between this command and the is that this #SEMAIL Note command does not interact with the GPRS context status, leaving it ON or setting, thus, when the connection made #EMAILACT OFF according to the is closed, the context status is maintained. #EMAILD with 3.6.5.5.8 #ESAV - Email Parameters Save #ESAV - Email Parameters Save Execution command saves the actual e-mail parameters in the NVM of the AT#ESAV device. The values stored are: - E-mail User Name - E-mail Password - E-mail Sender Address - E-mail SMTP server Note If some parameters have not been previously specified then a default value will be taken. 3.6.5.5.9 #ERST - E-mail Parameters Reset #ERST - E-mail Parameters Reset Execution command resets the actual e-mail parameters in the NVM of the AT#ERST device to the default ones. The values reset are: - E-mail User Name - E-mail Password - E-mail Sender Address - E-mail SMTP server 3.6.5.5.10 #EMAILMSG -SMTP Read Message #EMAILMSG - SMTP Read Message Execution command returns the last response from SMTP server. AT#EMAILMSG Read command has the same behaviour as Execution command. AT#EMAILMSG? page 402 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

403 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.6 Easy Scan® Extension AT Commands 3.6.5.6.1 #CSURV - Network Survey #CSURV - Network Survey Execution command allows to perform a quick survey through channels AT#CSURV command issue, starting from #BND belonging to the band selected by last [=,] to channel channel . If parameters are omitted, a full band scan is performed. AT*CSURV [=,] Parameters: (both syntax are - starting channel possible) - ending channel After issuing the command the device responds with the string: Network survey started... and, after a while, a list of informations, one for each received carrier, is reported, each of them in the format: (For BCCH-Carrier) arfcn: bsic: rxLev: ber: mcc: mnc: lac: cellId: cellStatus: numArfcn: arfcn: [ ..[ ]] [numChannels: array: [ ..[]] [pbcch: [nom: rac: spgc: pat: nco: t3168: t3192: drxmax: ctrlAck: bsCVmax: alpha: pcMeasCh: ]]] where: - C0 carrier assigned radio channel (BCCH - Broadcast Control Channel) - base station identification code - receiption level (in dBm) - bit error rate (in %) - mobile country code - mobile network code - location area code - cell identifier - cell status ..CELL_SUITABLE - C0 is a suitable cell. CELL_LOW_PRIORITY - the cell is low priority based on the received system information. CELL_FORBIDDEN - the cell is forbidden. CELL_BARRED - the cell is barred based on the received system information. page 403 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

404 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURV - Network Survey CELL_LOW_LEVEL - the cell is low. CELL_OTHER - none of the above e.g. exclusion timer running, no BCCH available...etc. - number of valid channels in the Cell Channel Description - arfcn of a valid channel in the Cell Channel Description ( is in n 1.. ) the range - number of valid channels in the BCCH Allocation list; the output of this information for non-serving cells depends on setting: last #CSURVEXT 3. if #CSURVEXT=0 this information is displayed only for serving cell 4. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. is in the range - arfcn of a valid channel in the BA list ( n 1.. ); the output of this information for non- serving cells depends on last setting: #CSURVEXT 3. if #CSURVEXT=0 this information is displayed only for serving cell 4. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. 5. (The following informations will be printed only if GPRS is supported in the cell) - 0 1 - network operation mode 1 2 3 - routing area code 0..255 - - SPLIT_PG_CYCLE support ..0 - SPLIT_PG_CYCLE is not supported on CCCH on this cell ..1 - SPLIT_PG_CYCLE is supported on CCCH on this cell - priority access threshold 0 - 3..6 - - network control order 0..2 - - timer 3168 - timer 3192 - discontinuous reception max time (in seconds) - packed control ack blocked sequenc countdown max value - alpha parameter for power control - page 404 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

405 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURV - Network Survey type of channel which shall be used for downlink - measurements for power control 0 - BCCH 1 - PDCH (For non BCCH-Carrier ) arfcn: rxLev: where: - RF channel - receiption level (in dBm) The output ends with the string: Network survey ended Read command has the same behaviour as Execution command with AT#CSURV? parameters omitted. AT*CSURV? AT#CSURV Example Network survey started... er: 0.00 mcc: 610 mnc: 1 b arfcn: 48 bsic: 24 rxLev: -52 _ SUITABLE lac: 33281 cellId: 3648 cellStatus: CELL numArfcn: 2 arfcn: 30 48 numChannels: 5 array: 14 19 22 48 82 arfcn: 14 rxLev: 8 Network survey ended OK The command is executed within max. 2 minutes. Note 3.6.5.6.2 #CSURVC - Networ k Survey (Numeric Format) #CSURVC - Network Survey (Numeric Format) a quick survey through channels Execution command allows to perform AT#CSURVC belonging to the band selected by last command issue, starting from #BND [=,] . If parameters are omitted, a full band scan is to channel channel performed. AT*CSURVC [=,] Parameters: (both syntax are - starting channel possible) page 405 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

406 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) - ending channel After issuing the command the device responds with the string: Network survey started... and, after a while, a list of informations, one for each received carrier, is reported, each of them in the format: (For BCCH-Carrier) ,,,,,,,, ,[, ..[ ]] [,[, ..[]] [ [ ]]] where: - C0 carrier assigned radio channel (BCCH - Broadcast Control Channel) - base station identification code - receiption level (in dBm) - bit error rate (in %) - mobile country code - mobile network code - location area code - cell identifier - cell status ..0 - C0 is a suitable cell (CELL_SUITABLE). 1 - the cell is low priority based on the received system information (CELL_LOW_PRIORITY). 2 - the cell is forbidden (CELL_FORBIDDEN). 3 - the cell is barred based on the received system information (CELL_BARRED). 4 - the cell is low (CELL_LOW_LEVEL). 5 - none of the above e.g. exclusion timer running, no BCCH available...etc.. (CELL_OTHER). - number of valid channels in the Cell Channel Description n - arfcn of a valid channel in the Cell Channel Description ( n 1.. ) the range - number of valid channels in the BCCH Allocation list; the output of this information for non-serving cells depends on last #CSURVEXT setting: this information is displayed only for 5. if #CSURVEXT=0 serving cell y la p ed also for 6. if #CSURVEXT=1 or 2 this information is dis page 406 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

407 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) every valid scanned BCCH carrier. - arfcn of a valid channel in the BA list ( is in the range n 1.. ); the output of this information for non- serving cells depends on last #CSURVEXT setting: 6. if #CSURVEXT=0 this information is displayed only for serving cell 7. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. (The following informations will be printed only if GPRS is supported in the cell) - 0 1 - network operation mode 1 2 3 - routing area code 0..255 - > - SPLIT_PG_CYCLE support - priority access threshold 0 - 3..6 - - network control order 0..2 - - timer 3168 - timer 3192 - discontinuous reception max time (in seconds) - packed control ack - blocked sequenc countdown max value - alpha parameter for power control - type of channel which shall be used for downlink measurements for power control 0 - BCCH 1 - PDCH (For non BCCH-Carrier) , where: - RF channel - receiption level (in dBm) page 407 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

408 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) The output ends with the string: Network survey ended Read command has the same behaviour as the Execution command with AT#CSURVC? parameters omitted AT*CSURVC? AT#CSURVC Example Network survey started... , 3648,0,2,30 48,5,14 19 22 48 48,24,-52,0.00,610,1,33281 82 14,8 Network survey ended OK Note The command is executed within max. 2 minute. is the same as that provided by The information provided by #CSURVC . The difference is that the output of #CSURV is in numeric #CSURVC format only. 3.6.5.6.3 #CSURVU - Network Surv ey Of User Defined Channels #CSURVU - Network Survey Of User Defined Channels Execution command allows to perform a quick survey through the given AT#CSURVU=[ channels. The range of available channels depends on the last #BND [,[,... issue. [,]]]] . #CSURV The result format is like command AT*CSURVU=[ [,[,... Parameters: [,]]]] n > - channel number (arfcn) must be in a increasing order. AT#CSURVU= Note: issuing is the same as issuing the command AT#CSURVU=0 . AT#CSURVU=59,110 Example page 408 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

409 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Network survey started... 6 ber: 0.00 mcc: 546 mnc: 1 7 arfcn: 59 bsic: 16 rxLev: - lac: 54717 cellId: 21093 cellStatus: CELL _ SUITABLE numArfcn 2 arfcn: 36 59 arfcn: 110 rxLev: -107 Network survey ended OK Note The command is executed within max. 2 minute. User Defined Channels (Numeric 3.6.5.6.4 #CSURVUC - Network Survey Of Format) #CSURVUC - Network Survey Of User Defined Channels (Numeric Format) Execution command allows to perform a quick survey through the given AT#CSURVUC=[ #BND channels. The range of available channels depends on the last [,[,... issue. [,]]]] #CSURVC . The result format is like command AT*CSURVUC=[ [,[,... Parameters: [,]]]] n - channel number (arfcn) > Note: issuing is the same as issuing the command AT#CSURVUC= AT#CSURVUC=0 . AT#CSURVUC=59,110 Example Network survey started... 59,16,-76,0.00,546,1,54717,21093,0,2,36 59 110,-107 Network survey ended OK The command is executed within max. 2 minute. Note written authorization - All Right reserved page 409 of 614 Reproduction forbidden without Telit Communications S.p.A.

410 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVUC - Network Survey Of User Defined Channels (Numeric Format) The information provided by #CSURVUC is the same as that provided by . The difference is that the output of #CSURVUC #CSURVU is in numeric format only. 3.6.5.6.5 #CSURVB - BC CH Network Survey #CSURVB - BCCH Network Survey (maximum Execution command performs a quick network survey through M AT#CSURVB= number of available frequencies depending on last selected band) channels. The survey stops as soon as BCCH carriers are found. The result format is like command #CSURV . Parameter: - number of desired BCCH carriers 1..M in the format: Test command reports the range of values for parameter AT#CSURVB=? (1-M) where M is the maximum number of available frequencies depending on last selected band. 3.6.5.6.6 #CSURVBC - BCCH Netw ork Survey (Numeric Format) #CSURVBC - BCCH Network Survey (Numeric Format) (maximum M Execution command performs a quick network survey through AT#CSURVBC= number of available frequencies depending on last selected band) channels. BCCH carriers are found. The survey stops as soon as The result is given in numeric format and is like command #CSURVC . Parameter: - number of desired BCCH carriers 1..M Test command reports the range of values for parameter in the format: AT#CSURVBC=? (1-M) where M is the maximum number of available frequencies depending on last selected band. page 410 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

411 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.6.7 #CSURVF - Network Survey Format #CSURVF - Network Survey Format Set command controls the format of the numbers output by all the Easy AT#CSURVF[= Scan® []] Parameter: - numbers format 0 - Decimal 1 - Hexadecimal values, no text 2 - Hexadecimal values with text Note: issuing AT#CSURVF is the same as issuing the Read command. is the same as issuing the command AT#CSURVF= Note: issuing . AT#CSURVF=0 Read command reports the current number format, as follows: AT#CSURVF? #CSURVF: Test command reports the supported range of values for the parameter AT#CSURVF=? . 3.6.5.6.8 #CSURVNLF - < LF> Removing On Easy Scan® Commands Family #CSURVNLF - Removing On Easy Scan® Commands Family removing from Set command enables/disables the automatic AT#CSURVNLF each information text line. [=] Parameter: 0 - disables removing; they’ll be present in the information text (factory default) 1 - remove from imformation text Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command reports whether automatic removing is currently AT#CSURVNLF? enabled or not, in the format: Test command reports the range of values for parameter . AT#CSURVNLF=? page 411 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

412 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.6.9 #CSURVEXT - Ex tended Network Survey #CSURVEXT - Extended Network Survey Set command enables/disables extended network survey. AT#CSURVEXT [=] Parameter: 0 - disables extended network survey (factory default) 1 - enables extended network survey; all the network survey execution , #CSURVUC , #CSURVU , commands ( #CSURV , #CSURVC , #CSURVBC ) display the BAList for every valid scanned #CSURVB BCCh carrier 2 - enables extended network survey; all the network survey execution commands ( #CSURVUC #CSURV , #CSURVC , #CSURVU , , #CSURVB ) display the BAList for every valid scanned , #CSURVBC BCCh carrier and, if GPRS is supported in the cell, they report some GPRS informations carried by the System Information 13 of the BCCh Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command reports whether extended network survey is currently AT#CSURVEXT? enabled or not, in the format: Test command reports the range of values for parameter . AT#CSURVEXT=? page 412 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

413 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.7 Jammed Detect & Report AT Commands 3.6.5.7.1 #JDR - Jammed Detect & Report #JDR - Jammed Detect & Report Set command allows to control the Jammed Detect & Report feature. AT#JDR[= [ The MODULE can detect if a communication Jammer is active in its range [,, and give indication to the user of this condition either on the serial line with ]]] an unsolicited code or on a dedicated GPIO by rising it. The MODULE can also report to the network the Jammed status condition, even if normal communications are inhibited by the Jammer, by using a unique message. Parameters: - behaviour mode of the Jammed Detect & Report 0 - disables Jammed Detect & Report (factory default) 1 - enables the Jammed Detect; the Jammed condition is reported on pin GPIO2/JDR - Normal Operating Condition LOW GPIO2/JDR GPIO2/JDR - Jammed Condition. HIGH 2 - enables the Jammed Detect; the Jammed condition is reported with a single unsolicited result code on serial line, in the format: #JDR: where: JAMMED - Jammed condition detected OPERATIVE - Normal Operating condition restored. This code will be shown only after a jammed condition has occurred. 3 - enables the Jammed Detect; the MODULE will make both the actions =1 . and =2 as for 4 - enables the Jammed Detect; the Jammed condition is reported with an unsolicited code every 3s on serial line, in the format: #JDR: where: JAMMED - Jammed condition detected OPERATIVE - Normal Operating condition restored. This code will be shown only after a jammed condition has occurred. 5 - enables the Jammed Detect; the MODULE will make both the actions and =4 . =1 as for - Maximum Noise Power Level 0..127 page 413 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

414 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #JDR - Jammed Detect & Report - Disturbed Channel Minimum Number 0..254 Note: issuing is the same as issuing the Read command. AT#JDR AT#JDR= is the same as issuing the command Note: issuing AT#JDR=0 . Read command reports the current behaviour mode, Maximum Noise AT#JDR? Power Level and Disturbed Channel Minimum Number, in the format: #JDR: ,, Test command reports the supported range of values for the parameters AT#JDR=? and , AT#JDR=2 Example OK ...jammer enters in the range... #JDR: JAMMED ...jammer exits the range... #JDR: OPERATIVE Note It is suggested not to change the default setting for Maximum Noise Power Level and Disturbed Channel Minimum Number. If the device is installed in a particular environment where the default values permit to are not satisfactory the two parameters and adapt the detection to all conditions. page 414 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

415 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.8 Easy Script® Extension - Python 7 Interpreter, AT Commands 3.6.5.8.1 #WSCRIPT - Write Script #WSCRIPT - Write Script Execution command inserts a script text and save it with the name AT#WSCRIPT= in the NVM of the module supporting the Python extension. , [,] The script text should be sent using Raw Ascii file transfer. It is important to set properly the port settings. In particular: Baud rate: 115200 bps Flow control: hardware. Parameters: - file name, string type (max 16 chars, case sensitive). - file size in bytes - file hidden attribute (default). #RSCRIPT 0 - file content is readable with command will report empty file. #RSCRIPT 1 - file content is hidden, >>> ' and waits for The device responds to the command with the prompt ' the script file text for bytes. The operations completes when all the bytes are received. If script writing ends successfully, the response is OK ; otherwise an error code is reported Note: The script name should be passed between quotes and all .py extension - Script names are Case Executable Scripts files must have sensitive. Note: When sending the script be sure that the line terminator is and that your terminal program does not change it. Note: with the hidden attribute it is possible to protect your script from being viewed and copied, only the file name can be viewed, its content is hidden even if the file is still being run correctly. It's your care to maintain knowledge on what the script file contains. AT#WSCRIPT="First.py ",54,0 Example >>> here receive the prompt: depending on your editor settings it’s possible that the prompt overrides the above line; then type or send the script, sized 54 bytes OK 7 PYTHON is a registered trademark of the Python Software Foundation. page 415 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

416 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #WSCRIPT - Write Script Script has been stored. Note This command can also be used to write any text file in the MODULE- PYTHON memory (not script files only), for example application data or . .py settings files with a different extension than 3.6.5.8.2 #ESCRIPT - Select Active Script #ESCRIPT - Select Active Script Set command selects the name of the script that will be executed by the AT#ESCRIPT[= Easy Script® interpreter at the start-up. The script will be executed at start- []] up only if the DTR line is found LOW during initial start-up (that is: COM is not open on a PC), otherwise the Easy Script® interpreter will not execute and the module with Python extension will behave normally answering only to AT commands on the serial port. Parameter: - file name, string type (max 16 chars, case sensitive). Note: all script files must have extension. .py must match with a file name written with the Note: The in order to have it run. #WSCRIPT Note: the command does not check whether the script does exist in the NVM of the module supporting the Python extension or not. If the file is not present at the start-up then the Script Interpreter will not execute. Note: issuing is the same as issuing the Read AT#ESCRIPT command. Note: issuing AT#ESCRIPT= is the same as issuing the command AT#ESCRIPT=”” . Read command reports the name of the script that will be executed by the AT#ESCRIPT? Easy Script® interpreter at the start-up. AT#ESCRIPT="First.py " Example OK u ps Script First.py will be executed at the next start- if DTR is found LOW. page 416 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

417 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.8.3 #RSCRIPT - Read Script #RSCRIPT - Read Script Execution command reports the content of script file . AT#RSCRIPT= Parameter: - file name, string type (max 16 chars, case sensitive). <<< The device responds to the command with the prompt ' ', followed by the script file text. Note: if the file was saved with the hidden attribute, then an empty file is reported with the OK result code. Note: If the file is not present an error code is reported. AT#RSCRIPT="First.py " Example hereafter receive the prompt: depending on your editor settings it’s possible that the prompt overrides the above line; then the script is displayed, immediately after the prompt << ... [#LSCRIPT: ]] #LSCRIPT: free bytes: where: - file name, string type (max 16 chars, case sensitive) > - size of available NVM memory in bytes Read command has the same behavior of Execution command. AT#LSCRIPT? AT#LSCRIPT Example #LSCRIPT: First.py 51 #LSCRIPT: Second.py 178 page 417 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

418 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #LSCRIPT - List Script Names #LSCRIPT: Third.py 95 #LSCRIPT: free bytes: 20000 OK 3.6.5.8.5 #DSCRIPT - Delete Script #DSCRIPT - Delete Script Execution command deletes a script file from NVM memory. AT#DSCRIPT= Parameter: - name of the script file to delete, string type (max 16 chars, case sensitive) Note: if the file is not present an error code is reported. AT#DSCRIPT="Third.py" Example OK 3.6.5.8.6 #REBOOT - Reboot #REBOOT - Reboot Execution command reboots immediately the unit. AT#REBOOT It can be used to reboot the system after a remote update of the script in order to have the new one running. Read command has the same behavior of Execution command. AT#REBOOT? AT#REBOOT Example ... Module Reboots ... Note This command does not return result codes. page 418 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

419 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.9 GPS AT Commands Set 3.6.5.9.1 $GPSP - GPS cont roller power management $GPSP - GPS controller power management Execution command allows to manage power-up or down of the GPS AT$GPSP= controller Parameter: 0 - GPS controller is powered down 1 - GPS controller is powered up (default) Note: for the GPS product (GE863-GPS): if the GPS controller is powered down while camera or VAUX pin is enabled they’ll both also be also powered off. Read command reports return the current status AT$GPSP? Test command returns the range of values accepted (0-1) AT$GPSP=? Example AT$GPSP=0 OK Note If a camera is used with the module and it is powered on, the command will be not executed due to the fact the supply voltage is in common between the 2 devices. $GPSR - GPS Reset 3.6.5.9.2 $GPSR - GPS Reset Execution command allows to manage allows to reset the GPS AT$GPSR= controller. Parameter: 0 - Hardware reset: The GPS receiver is reset and restarts by using the values stored in the internal memory of the GPS receiver. (1 1 - Coldstart (No Almanac, No Ephemeris) : This option clears all data that is currently stored in the internal memory of the GPS receiver including position, almanac, ephemeris, and time. The stored clock drift however, is retained (1 : This option clears all initialization 2 - Warmstart (No ephemeris) data in the GPS receiver and subsequently reloads the data that is currently displayed in the Receiver Initialization Setup screen. The almanac is retained but the ephemeris is cleared. (1 3 - Hotstart (with stored Almanac and Ephemeris) : The GPS receiver restarts b g y usin the values stored in the internal memor of y page 419 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

420 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSR - GPS Reset the GPS receiver; validated ephemeris and almanac. Read command that provides the range of accepted values (0-3) AT$GPSR=? AT$GPSR=0 Example OK (1 Available only in Controlled mode. (SW reset) Note 3.6.5.9.3 $GPSD - GPS Device Type Set $GPSD - GPS Device Type Set Set command defines which GPS device is connected to the module. It AT$GPSD= dedicates the Serial port #1 of the module (TRACE) to receive the GPS strings from the GPS module. Parameter: 0 - none (Serial port not connected to GPS device) 2 - Controlled Mode (Modem serial port connected to GPS serial port – default) (1 Read command that returns the current status AT$GPSD? Test command that provides the range of accepted values for the AT$GPSD=? parameter (0-3) AT$GPSD=0 Example OK AT$GPSD=0 (1 AT$GPSSAV must be executed after to store this setting in memory Note (the new functionality will be available after the next power_on) 3.6.5.9.4 $GPSSW - GPS Software Version $GPSSW - GPS Software Version Execution command provides GPS Module software version in the AT$GPSSW format: $GPSSW: Example AT$GPSSW $GPSSW: GSW3.1.1_3.1.00.07-C23P1.00 OK Antenna Type Definition 3.6.5.9.5 $GPSAT – GPS $GPSAT – Configure GPS Antenna Type Set command selects the GPS antenna used. AT$GPSAT= Parameter: page 420 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

421 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSAT – Configure GPS Antenna Type 0 - GPS Antenna not supplied by the module 1 - GPS Antenna supplied by the module (default) Read command returns the current status AT$GPSAT? Test command provides the range of accepted values (0-1) AT$GPSAT=? Example AT$GPSAT=1 OK Note AT$GPSSAV must be executed to save this configuration If set to 0 the Antenna current and Voltage readout are not available. Refer to the HW user guide for the compatible GPS antennas 3.6.5.9.6 $GPSAV – GPS Ante nna Supply Voltage Readout $GPSAV – GPS Antenna Readout Voltage Read command returns the measured GPS antenna’s supply voltage in AT$GPSAV? mV AT$GPSAV? AT$GPSAV? $GPSAV:3800 OK Note Not available if antenna Type set to 0 3.6.5.9.7 $GPSAI – GPS Antenna Current Readout $GPSAI - GPS Antenna Current Monitor Read command reports the GPS antenna’s current consumption in AT$GPSAI? the format: (1 $GPSAI:[,] where: - the measured current in mA (1 < status> - 0 - GPS antenna OK 1 - GPS antenna consumption out of the limits Example AT$GPSAI? $GPSAI:040,0 OK (1 Available only if antenna protection is activated (see $GPSAP) Note page 421 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

422 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.6.5.9.8 $GPSAP – GPS Antenna Protection $GPSAP - GPS Antenna Protection Write command that allows to activate an automatic protection in AT$GPSAP=[,] case of high current consumption of GPS antenna. The protection disables the GPS antenna supply voltage. Parameters: 0 - deactivate current antenna protection (default) 1 - activate current antenna protection - the antenna current limit value in mA (000-200) If parameter =0 parameter is omitted Read command that returns the current antenna limit value in the AT$GPSAP? format: $GPSAP:, Test command that returns the available ranges for and AT$GPSAP=? AT$GPSAP=0 Example OK Note : no SW control on antenna st atus (HW current limitation only) (1 AT$GPSAP=1,25 OK activate current antenna protection with related current limit (1 AT$GPSAP? $GPSAP:1,050 OK Antenna protection activated with 50mA limit (1 Note AT$GPSSAV must be executed to save this configuration The module is already provided of an Hardware protection for the high current consumption that is automatically activated if the consumption exceeds 50mA Data Configuration 3.6.5.9.9 $GPSNMUN – Unsolicited NMEA $GPSNMUN – Unsolicited NMEA Data Configuration Set command permits to activate an Unsolicited streaming of GPS data AT$GPSNMUN= (in NMEA format) through the standard GSM serial port (AT) and defines [,,,,< (1 which NMEA sentences will be available GSV>,,] page 422 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

423 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSNMUN – Unsolicited NMEA Data Configuration Parameters: 0 - NMEA data stream de-activated (default) 1 - NMEA data stream activated 2 - NMEA data stream activated with the following unsolicited response syntax: 3 - dedicated NMEA data stream; it is not possible to send AT commands; with the escape sequence ‘+++’ the user can return to command mode - Global Positioning System Fix Data 0 - disable 1 - enable - Geographical Position - Latitude/Longitude 0 - disable 1 - enable - GPS DOP and Active Satellites 0 - disable 1 - enable - GPS Satellites in View 0 - disable 1 - enable - recommended Minimum Specific GPS Data 0 - disable 1 - enable - Course Over Ground and Ground Speed 0 - disable 1 - enable DEFAULT: <0,0,0,0,0,0> The unsolicited response sintax for =1 is: $GPSNMUN: Note: If all parameters are omitted then the behaviour of Set command is the same as Read command Read command returns whether the unsolicited GPS NMEA data AT$GPSNMUN? streaming is currently enabled or not, along with the NMEA sentences availability status, in the format: $GPSNMUN:,, ,,,, Test command returns the supported range of values for parameters AT$GPSNMUN=? , ,,,,, Example AT$GPSNMUN=1,0,0,1,0,0,0 page 423 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

424 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSNMUN – Unsolicited NMEA Data Configuration OK These sets the GSA as available sentence in the unsolicited message AT$GPSNMUN=0 OK Turn-off the unsolicited mode AT$GPSNMUN? $GPSNMUN: 1,0,0,1,0,0,0 OK Give the current frame selected (GSA) The unsolicited message will be: $GPSNMUN: $GPGSA,A,3,23,20,24,07,13,04,02,,,,,,2.4,1.6,1.8* 3C NMEA 01803 Specifications Reference (1 Note AT$GPSSAV must be executed to save this configuration The command is available in “Controlled Mode” only The available NMEA Sentences are depending on the GPS receiver used In GE863-GPS and GM862-GPS the fields PDOP and VDOP are not available Use NMEA serial port instead if full DOP info are needed 3.6.5.9.10 $GPSACP – Get Acquired Position $GPSACP - Get Acquired position information Read command returns information about the last GPS position in the AT$GPSACP format: $GPSACP: ,,,,, ,, ,,, where: - UTC time (hhmmss) referred to GGA sentence - ddmm.mmmm N/S (referred to GGA sentence) Values: dd (degrees) 00 to 90 mm.mmmm (minutes) 00,0000 to 59.9999 N/S: North / South - dddmm.mmmm E/W (referred to GGA sentence) page 424 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

425 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSACP - Get Acquired position information Values: ddd (degrees) 00 to 180 mm.mmmm (minutes) 00,0000 to 59.9999 E/W: East / West - x.x - Horizontal Diluition of Precision (referred to GGA sentence) - xxxx.x Altitude - mean-sea-level (geoid) in meters (referred to GGA sentence) - referred to GSA sentence 1 - Invalid Fix 2 - 2D fix 3 - 3D fix - ddd.mm - Course over Ground (degrees, True) (referred to VTG sentence) Values: ddd: 000 to 360 degrees mm 00 to 59 minutes - xxxx.x Speed over ground (Km/hr) (referred to VTG sentence) - xxxx.x- Speed over ground (knots) (referred to VTG sentence) - ddmmyy Date of Fix (referred to RMC sentence) Values: dd (day) 01 to 31 mm (month) 01 to 12 yy (year) 00 to 99 (2000 to 2099) - nn - Total number of satellites in view (referred to GSV sentence) AT$GPSACP Example $GPSACP:080220,4542.82691N,01344.26820E,259.07,3,2.1 ,0.1,0.0,0.0,270705,09 OK 3.6.5.9.11 $GPSSAV – Save G PS Parameters Configuration $GPSSAV – Save GPS Parameters Execution command saves the current configuration in the non volatile AT$GPSSAV EEPROM memory of the module. Example AT$GPSSAV OK Note The module must be restarted to use the new configuration page 425 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

426 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSRST – Restore 3.6.5.9.12 to Default GPS Parameters $GPSRST – Restore all GPS Parameters Execution command restores the GPS parameters to “Factory Default” AT$GPSRST configuration and stores them in the non volatile EEPROM memory of the module. AT$GPSRST Example OK Note The module must be restarted to use the new configuration page 426 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

427 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7 SELINT 2 3.7.1 Hayes Compliant AT Commands 3.7.1.1 Generic Modem Control 3.7.1.1.1 &F - Set To Fact ory-Defined Configuration &F - Set To Factory-Defined Configuration Execution command sets the configuration parameters to default values AT&F[] specified by manufacturer; it takes in consideration hardware configuration switches and other manufacturer-defined criteria. Parameter: : 0 - just the factory profile base section parameters are considered. 1 - either the factory profile base section and the extended section are considered (full factory profile). is omitted, the command has the same Note: if parameter behaviour as AT&F0 Reference V25ter. 3.7.1.1.2 Z - Soft Reset Z - Soft Reset Execution command loads the base section of the specified user profile and ATZ[] the extended section of the default factory profile. Parameter: 0..1 - user profile number Note: any call in progress will be terminated. Note: if parameter is omitted, the command has the same behaviour as ATZ0 . Reference V25ter. page 427 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

428 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.1.3 +FCLASS - Select Active Service Class +FCLASS - Select Active Service Class Set command sets the wireless module in specified connection mode (data, AT+FCLASS= fax, voice), hence all the calls done afterwards will be data or voice. Parameter: 0 - data 1 - fax class 1 8 - voice Read command returns the current configuration value of the parameter AT+FCLASS? . . Test command returns all supported values of the parameters AT+FCLASS=? Reference GSM 07.07 Default Reset Basic Profile 3.7.1.1.4 &Y - Designate A &Y - Designate A Default Reset Basic Profile Execution command defines the basic profiles which will be loaded on AT&Y[] startup. Parameter: 0..1 - profile (default is 0): the wireless module is able to store 2 complete configurations (see command &W ). , which loads just once the desired Z Note: differently from command profile, the one chosen through command &Y will be loaded on every startup. Note: if parameter is omitted, the command has the same behaviour as AT&Y0 3.7.1.1.5 &P - Designate A Default Reset Full Profile &P - Designate A Default Reset Full Profile Execution command defines which full profile will be loaded on startup. AT&P[] Parameter: 0..1 – profile number: the wireless module is able to store 2 full ). &W configurations (see command page 428 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

429 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 , which loads just once the desired Note: differently from command Z will be loaded on every &P profile, the one chosen through command startup. Note: if parameter is omitted, the command has the same behaviour as AT&P0 Reference Telit Specifications 3.7.1.1.6 &W - Store Current Configuration &W - Store Current Configuration the complete configuration of the Execution command stores on profile AT&W[] device. Parameter: 0..1 - profile Note: if parameter is omitted, the command has the same behaviour of AT&W0. In The Module Internal Phonebook 3.7.1.1.7 &Z - Store Telephone Number &Z - Store Telephone Number In The Wireless Module Internal Phonebook the telephone number Execution command stores in the record . AT&Z= The records cannot be overwritten, they must be cleared before rewriting. Parameters: - phonebook record - telephone number (string type) Note: the wireless module has a built in non volatile memory in which 10 telephone numbers of a maximum 24 digits can be stored Note: to delete the record must be the command AT&Z= issued. Note: the records in the module memory can be viewed with the command , while the telephone number stored in the record n can be dialed by &N ATDS=. giving the command page 429 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

430 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Phonebook Stored Numbers 3.7.1.1.8 &N - Display Internal &N - Display Internal Phonebook Stored Numbers Execution command returns the telephone number stored at the AT&N[] position in the internal memory. Parameter: - phonebook record number is omitted then all the internal records are shown. Note: if parameter 3.7.1.1.9 +GMI - Manufacturer Identification +GMI - Manufacturer Identification Execution command returns the manufacturer identification. AT+GMI Note: this is one of the commands whose output differs depending on the last #SELINT setting. Reference V.25ter 3.7.1.1.10 +GMM - Model Identification +GMM - Model Identification Execution command returns the model identification. AT+GMM Reference V.25ter 3.7.1.1.11 +GMR - Revision Identification +GMR - Revision Identification Execution command returns the software revision identification. AT+GMR Reference V.25ter Capabilities List 3.7.1.1.12 +GCAP - +GCAP - Capabilities List Execution command returns the equipment supported command set list. AT+GCAP Where: +CGSM : GSM ETSI command set : Fax command set +FCLASS +DS : Data Service common modem command set +MS : Mobile Specific command set Reference V.25ter page 430 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

431 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.1.13 +GSN - Serial Number +GSN - Serial Number Execution command returns the device board serial number. AT+GSN Note: The number returned is not the IMSI, it is only the board number Reference V.25ter 3.7.1.1.14 &V - Display Cu rrent Configuration & Profile &V - Display Current Configuration & Profile Execution command returns some of the base configuration AT&V parameters settings. Note: this is one of the commands whose output differs depending on the last #SELINT setting. 3.7.1.1.15 rrent Configuration & Profile &V0 - Display Cu &V0 - Display Current Configuration & Profile Execution command returns all the configuration parameters settings. AT&V0 , it is included only for backwards Note: this command is the same as &V compatibility. Note: this is one of the commands whose output differs depending on the setting. #SELINT last 3.7.1.1.16 &V1 - Display S Registers Values &V1 - Display S Registers Values Execution command returns the value of the S registers in decimal and AT&V1 hexadecimal value in the format: REG DEC HEX ... where S register - number (0..38) - current value in decimal notation - current value in hexadecimal notation page 431 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

432 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 ay S Registers Values 3.7.1.1.17 &V3 - Displ &V3 - Display S Registers Values Execution command returns the value of the S registers in decimal and AT&V3 hexadecimal value in the format: REG DEC HEX ... where > n number (0..38) S register - - current value in decimal notation - current value in hexadecimal notation 3.7.1.1.18 st Connection Statistics &V2 - Display La &V2 - Display Last Connection Statistics Execution command returns the last connection statistics and connection AT&V2 failure reason. Line Connect Message 3.7.1.1.19 \V - Single \V - Single Line Connect Message Execution command set single line connect message. AT\V Parameter: 0 - off 1 - on 3.7.1.1.20 +GCI - Country Of Installation +GCI - Country Of Installation Set command selects the installation country code according to AT+GCI= ITU-T.35 Annex A. Parameter: 59 - it currently supports only the Italy country code Read command reports the currently selected country code. AT+GCI? Test command reports the supported country codes. AT+GCI=? Reference V25ter. page 432 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

433 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.1.21 %L - Line Signal Level %L - Line Signal Level It has no effect and is included only for backward compatibility with landline AT%L modems 3.7.1.1.22 %Q - Line Quality %Q - Line Quality It has no effect and is included only for backward compatibility with landline AT%Q modems 3.7.1.1.23 L - Speaker Loudness L - Speaker Loudness It has no effect and is included only for backward compatibility with landline ATL modems 3.7.1.1.24 M - Speaker Mode M - Speaker Mode It has no effect and is included only for backward compatibility with landline ATM modems page 433 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

434 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.2 DTE - Modem Interface Control 3.7.1.2.1 E - Command Echo E - Command Echo Set command enables/disables the command echo. ATE[] Parameter: 0 - disables command echo 1 - enables command echo (factory default) , hence command sent to the before the response is given. DTE device are echoed back to the Note: if parameter is omitted, the command has the same behaviour of ATE0 Reference V25ter 3.7.1.2.2 Q - Quiet Result Codes Q - Quiet Result Codes Set command enables or disables the result codes. ATQ[] Parameter: 0 - enables result codes (factory default) 1 - disables result codes 2 - disables result codes (only for backward compatibility) Note: After issuing either every information text transmitted ATQ2 or ATQ1 in response to commands is not affected Note: if parameter is omitted, the command has the same behaviour of ATQ0 After issuing ATQ1 or ATQ2 Example AT+CGACT=? +CGACT: (0-1) nothing is appended to the response Reference V25ter page 434 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

435 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.2.3 V - Response Format V - Response Format Set command determines the contents of the header and trailer transmitted ATV[] with result codes and information responses. It also determines if result codes are transmitted in a numeric form or an alphanumeric form (see [§3.2.3 Information Responses And Result Codes] for the table of result codes). Parameter: 0 - limited headers and trailers and numeric format of result codes information responses result codes 1 - full headers and trailers and verbose format of result codes (factory default) information responses result codes portion of information responses is not affected by this Note: the setting. Note: if parameter is omitted, the command has the same behaviour of ATV0 Reference V25ter 3.7.1.2.4 X - Extended Result Codes X - Extended Result Codes Set command selects the result code messages subset used by the modem ATX[] of the result of the commands. DTE to inform the Parameter: OK NO , ERROR 0 - send only , , CONNECT , RING , NO CARRIER ANSWER results. Busy tones reporting is disabled. 1..4 - reports all messages (factory default is 1). page 435 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

436 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Note: If parameter is omitted, the command has the same behaviour of ATX0 +DR response message see also CONNECT Note For complete control on command. Reference V25ter 3.7.1.2.5 I - Identification Information I - Identification Information Execution command returns one or more lines of information text followed ATI[] by a result code. Parameter: 0 - numerical identifier. 1 - module checksum 2 - checksum check result 3 - manufacturer 4 - product name 5 - DOB version Note: this is one of the commands whose output differs depending on the last setting. #SELINT Note: if parameter is omitted, the command has the same behaviour of ATI0 Reference V25ter 3.7.1.2.6 &C - Data Carrier Detect (DCD) Control &C - Data Carrier Detect (DCD) Control Set command controls the RS232 DCD output behaviour. AT&C[] Parameter: always. high remains 0 - DCD 1 - DCD follows the Carrier detect status: if carrier is detected DCD is high, otherwise DCD is low . (factory default) while disconnecting off DCD 2 - Note: if parameter is omitted, the command has the same behaviour of AT&C0 Reference V25ter page 436 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

437 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.2.7 &D - Data Termin al Ready (DTR) Control &D - Data Terminal Ready (DTR) Control transitions. DTR Set command controls the Module behaviour to the RS232 AT&D[] Parameter: 0 - DTR transitions are ignored. (factory default) high 1 - when the MODULE is connected, the DTR to low transition of pin sets the device in command mode, the current connection is NOT closed. pin DTR 2 - when the MODULE is connected , the high to low transition of sets the device in command mode and the current connection is closed. 3 - operation is enabled. C108/1 4 - C108/1 operation is disabled. DTR has been tied Note: if AT&D2 has been issued and the , low autoanswering is inhibited and it is possible to answer only issuing command ATA . Note: if parameter is omitted, the command has the same behaviour of AT&D0 Reference V25ter 3.7.1.2.8 \Q - Standard Flow Control \Q - Standard Flow Control Set command controls the RS232 flow control behaviour. AT\Q[] Parameter: 0 - no flow control 1 - software bi-directional with filtering ( XON/XOFF ) CTS 2 - hardware mono-directional flow control (only active) 3 - hardware bi-directional flow control (both RTS/CTS active) (factory default) Note: if parameter is omitted, the command has the same behaviour as AT\Q0 Note: &K’s ones. settings are functionally a subset of \Q’s Reference V25ter page 437 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

438 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.2.9 &K - Flow Control &K - Flow Control Set command controls the RS232 flow control behaviour. AT&K[] Parameter: 0 - no flow control 1 - hardware mono-directional flow control (only CTS active) 2 - software mono-directional flow control ( XON/XOFF ) RTS/CTS active) (factory 3 - hardware bi-directional flow control (both default) 4 - software bi-directional with filtering ( XON/XOFF ) 5 - pass through: software bi-directional without filtering ( XON/XOFF ) active) and RTS/CTS 6 - both hardware bi-directional flow control (both ) with filtering software bi-directional flow control ( XON/XOFF Note: if parameter is omitted, the command has the same behaviour as AT&K0 &K has no Read Command. To verify the current setting of &K , Note: . simply check the settings of the active profile with AT&V 3.7.1.2.10 &S - Data Set Ready (DSR) Control &S - Data Set Ready (DSR) Control Set command controls the RS232 DSR pin behaviour. AT&S[] Parameter: 0 - always ON 1 - follows the GSM traffic channel indication. 2 - ON when connected 3 - ON when device is ready to receive commands (factory default). DSR is tied up when the device receives Note: if option 1 is selected then from the network the GSM traffic channel indication. Note: if parameter is omitted, the command has the same behaviour of AT&S0 3.7.1.2.11 \R - Ring (RI) Control \R - Ring (RI) Control output pin behaviour. Set command controls the RING AT\R[] Parameter: page 438 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

439 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 0 - RING on during ringing and further connection 1 - RING on during ringing (factory default) 2 - follows the ring signal RING Note: to check the ring option status use the &V command. Note: if parameter is omitted, the command has the same behaviour of AT\R0 3.7.1.2.12 +IPR - Fixe d DTE Interface Rate +IPR - Fixed DTE Interface Rate speed at which the device accepts Set command specifies the DTE AT+IPR= commands during command mode operations; it may be used to fix the interface speed. DTE-DCE Parameter: 0 ..300 1200 2400 4800 9600 19200 38400 57600 115200 If is set to 0, then automatic speed detection is enabled and also character format (see +ICF ) is set to auto-detect. (default) DTE-DCE speed is fixed at that is specified and not 0, If speed, hence no speed auto-detection (autobauding) is enabled. Read command returns the current value of +IPR parameter. AT+IPR? Test command returns the list of supported autodetectable values AT+IPR=? and the list of fixed-only values in the format: :(list of supported autodetectable values), (list of fixed-only +IPR values) Reference V25ter page 439 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

440 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.2.13 +IFC - DTE-Modem Local Flow Control +IFC - DTE-Modem Local Flow Control Set command selects the flow control behaviour of the serial port in both AT+IFC=, to DTE directions: from DTE to modem ( option) and from modem ) ( Parameter: - flow control option for the data received by DTE 0 - flow control None XON/XOFF filtered 1 - 2 - C105 ( RTS ) (factory default) 3 - XON/XOFF not filtered - flow control option for the data sent by modem 0 - flow control None XON/XOFF 1 - 2 - ( CTS ) (factory default) C106 Note: This command is equivalent to &K command. Read command returns active flow control settings. AT+IFC? Test command returns all supported values of the parameters AT+IFC=? and . Reference V25ter dem Local Rate Reporting 3.7.1.2.14 +ILRR - DTE-Mo +ILRR - DTE-Modem Local Rate Reporting Set command controls whether or not the information text is +ILRR: AT+ILRR= transmitted from the modem (module) to the DTE . Parameter: 0 - local port speed rate reporting disabled (factory default) 1 - local port speed rate reporting enabled Note: this information if enabled is sent upon connection. Read command returns active setting of <>. AT+ILRR? Test command returns all supported values of the parameter AT+ILRR=? Reference V25ter 3.7.1.2.15 +ICF - DTE-Modem Character Framing +ICF - DTE-Modem Character Framing Set command defines the asynchronous character framing to be used when AT+ICF= autobauding is disabled. [,] page 440 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

441 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Parameters: - determines the number of bits in the data bits, the presence of a parity bit, and the number of stop bits in the start-stop frame. 0 - autodetection 1 - 8 Data, 2 Stop 2 - 8 Data, 1 Parity, 1 Stop 3 - 8 Data, 1 Stop 4 - 7 Data, 2 Stop 5 - 7 Data, 1 Parity, 1 Stop - determines how the parity bit is generated and checked, if present 0 - Odd 1 - Even Read command returns current settings for subparameters and AT+ICF? . Test command returns the ranges of values for the parameters AT+ICF=? and Reference V25ter AT+ICF = 0 - auto detect Example AT+ICF = 1 - 8N2 AT+ICF = 2,0 - 8O1 AT+ICF = 2,1 - 8E1 AT+ICF = 3 - 8N1 (default) AT+ICF = 5,0 - 7O1 AT+ICF = 5,1 - 7E1 page 441 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

442 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.3 Call Control 3.7.1.3.1 D - Dial D - Dial Execution command starts a call to the phone number given as parameter. ATD[;] If “ ; ” is present, a voice call to the given number is performed, regardless of the current value of the connection mode set by +FCLASS command. Parameter: - phone number to be dialed Note: type of call ( data , fax voice ) depends on last +FCLASS setting. or Note: the numbers accepted are 0-9 and *,#,”A”, ”B”, ”C”, ”D”,”+”. Note: for backwards compatibility with landline modems modifiers “T”, ”P”, ”R”, ”,”, ”W”, “!”, “@” are accepted but have no effect. Issues a call to phone number which corresponding alphanumeric field is ATD>[;] ; all available memories will be searched for the correct entry. call is performed. voice ” is present a ; If “ Parameter: - alphanumeric field corresponding to phone number; it must be enclosed in quotation marks. +CSCS . Note: used character set should be the one selected with Issues a call to phone number in phonebook memory storage , ATD> [;] entry location (available memories may be queried with ). AT+CPBS=? ; ” is present a If “ call is performed. voice Parameters: - phonebook memory storage; it must not be enclosed in quotation marks. SM - SIM phonebook FD - SIM fixed dialling-phonebook LD - SIM last-dialling-phonebook MC - device missed (unanswered received) calls list RC - ME received calls list - entry location; it should be in the range of locations available in the memory used. of the active ATD> < n > [;] Issues a call to phone number in entry location +CPBS phonebook memory storage (see ). page 442 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

443 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 D - Dial If “ ; ” is present a voice call is performed. Parameter: - active phonebook memory storage entry location; it should be in the range of locations available in the active phonebook memory storage. Issues a call to the last number dialed. ATDL Issues a call to the number stored in the MODULE internal phonebook ATDS=[;] . position number call is performed. If “;” is present a voice Parameter: - internal phonebook position to be called (See commands &N and &Z ) Issues a call overwriting the CLIR supplementary service subscription ATDI[;] default value for this call ATDi[;] ” is present a call is performed. If “ ; voice - invocation, restrict CLI presentation I i - suppression, allow CLI presentation Issues a call checking the CUG supplementary service information for the ATDG[;] command. current call. Refer to +CCUG ATDg[;] If “ call is performed. ; ” is present a voice to This command is specific of GPRS functionality and causes the MT ATD* perform whatever actions are necessary to establish communication [*][*[] and the external PDN. TE between the [*[]]]]# Parameters: - GPRS Service Code, a digit string (value 99) which identifies a request to use the GPRS - string that identifies the called party in the address space applicable to the PDP. - a string which indicates the layer 2 protocol to be used (see +CGDATA command). For communications software that does not support arbitrary characters in the dial string, the following numeric equivalents shall be used: 1 - PPP Other values are reserved and will result in an ERROR response to the Set command. context definition (see - a digit which specifies a particular PDP +CGDCONT command). To dial a number in SIM phonebook entry 6: Example ATD>SM6 OK page 443 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

444 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 D - Dial To have a voice call to the 6-th entry of active phonebook: ATD>6; OK To call the entry with alphanumeric field “Name”: ATD>”Name”; OK Reference V25ter. 3.7.1.3.2 T - Tone Dial T - Tone Dial Set command has no effect is included only for backward compatibility with ATT landline modems. Reference V25ter. 3.7.1.3.3 P - Pulse Dial P - Pulse Dial Set command has no effect is included only for backward compatibility with ATP landline modems. Reference V25ter. 3.7.1.3.4 A - Answer A - Answer Execution command is used to answer to an incoming call if automatic ATA answer is disabled. Note: This command MUST be the last in the command line and must be followed immediately by a character. Reference V25ter. 3.7.1.3.5 H - Disconnect H - Disconnect Execution command is used to close the current conversation (voice, data ATH or fax). Note: this command can be issued only in command mode; when a data page 444 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

445 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 H - Disconnect conversation is active the device is in on-line mode (commands are not sensed and characters are sent to the other party), hence escape sequence ) is required before issuing this command, otherwise if &D1 (see register S2 option is active, pin has to be tied low to return in command mode. DTR Reference V25ter. 3.7.1.3.6 O - Return To On Line Mode O - Return To On Line Mode Execution command is used to return to on-line mode from command mode. ATO If there's no active connection it returns NO CARRIER . Note: After issuing this command, if the device is in conversation, to send other commands to the device you must return to command mode by DTR &D1 pin if issuing the escape sequence (see register S2 ) or tying low option is active. Reference V25ter. 3.7.1.3.7 &G - Guard Tone &G - Guard Tone Set command has no effect is included only for backward compatibility with AT&G landline modems. 3.7.1.3.8 &Q - Sync/Async Mode &Q - Sync/Async Mode Set command has no effect is included only for backward compatibility with AT&Q landline modems. page 445 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

446 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.4 Modulation Control 3.7.1.4.1 +MS - Modulation Selection +MS - Modulation Selection Set command has no effect is included only for backward compatibility with AT+MS= landline modems. [, Parameter: [, - a string which specifies the preferred modem carrier to use in [,]]] originating or answering a connection V21 V22 V22B V23C V32 V34 - it enables/disables automatic modulation negotiation. 0 - disabled 1 - enabled. It has effect only if it is defined for the associated modulation. - it specifies the lowest value at which the DCE may establish a connection. 0 - unspecified - it specifies the highest value at which the DCE may establish a connection. 0 - unspecified 300..14400 - rate in bps Note: to change modulation requested use +CBST command. , Read command returns the current value of , AT+MS? parameters. , , , Test command returns all supported values of the AT+MS=? , parameters. 3.7.1.4.2 %E - Line Quality Monitor A nd Auto Retrain Or Fallback/Fallforward %E - Line Quality Monitor And Auto Retrain Or Fallback/Fallforward Execution command has no effect and is included only for backward AT%E compatibility with landline modems. page 446 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

447 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.5 Compression Control 3.7.1.5.1 +DS - Data Compression +DS - Data Compression Set command sets the V42 compression parameter. AT+DS= Parameter: 0 - no compression, it is currently the only supported value Read command returns current value of the data compression parameter. AT+DS? Test command returns all supported values of the parameter AT+DS=? V25ter Reference 3.7.1.5.2 +DR - Data Compression Reporting +DR - Data Compression Reporting Set command enables/disables the data compression reporting upon AT+DR= connection. Parameter: 0 - data compression reporting disabled; 1 - data compression reporting enabled upon connection. Note: if enabled, the following intermediate result code is transmitted before the final result code: +DR: is “ (the only supported value for NONE ”) Read command returns current value of . AT+DR? Test command returns all supported values of the parameter AT+DR=? V25ter Reference page 447 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

448 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.6 Break Control 3.7.1.6.1 \B - Transmit Break To Remote \B - Transmit Break To Remote Execution command has no effect and is included only for backward AT\B compatibility with landline modems 3.7.1.6.2 \K - Break Handling \K - Break Handling Execution command has no effect and is included only for backward AT\K compatibility with landline modems Parameter: 1..5 3.7.1.6.3 \N - Operating Mode \N - Operating Mode Execution command has no effect and is included only for backward AT\N compatibility with landline modems page 448 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

449 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.7 S Parameters S ” are known as “ Basic commands that begin with the letter “ ”. The number following S-Parameters the “ S ” indicates the “parameter number” being referenced. If the number is not recognized as a valid parameter number, an ERROR result code is issued. If no value is given for the subparameter of an S-Parameter , an ERROR result code will be issued and the stored value left unchanged. Note: what follows is a special way to select and set an S-parameter : 1. ATS n selects n as current parameter number. If the value of n is in the range (0, 2, 3, 4, 5, 7, 12, 25, 30, 38), this command establishes S n as last selected parameter. Every value out of this range and less than 256 can be used but has no meaning and is maintained only for backward compatibility with landline modems. S-parameter set the contents of the selected ATS= or 2. AT= Example: S7 ATS7 establishes as last selected parameter. AT=40 sets the content of S7 to 40 S7 to 15. ATS=15 sets the content of 3.7.1.7.1 S0 - Number Of Rings To Auto Answer S0 - Number Of Rings To Auto Answer Set command sets the number of rings required before device automatically ATS0=[] answers an incoming call. Parameter: - number of rings 0 - auto answer disabled (factory default) 1..255 - number of rings required before automatic answer. Read command returns the current value of S0 parameter . ATS0? Reference V25ter 3.7.1.7.2 S1 - Ring Counter S1 - Ring Counter is incremented each time the device detects the ring signal of an S1 ATS1 is cleared as soon as no ring occur. S1 incoming call. page 449 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

450 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 has no effect. ATS1 Note: the form Read command returns the value of this parameter. ATS1? 3.7.1.7.3 S2 - Escape Character S2 - Escape Character Set command sets the ASCII character to be used as escape character. ATS2=[] Parameter: - escape character decimal ASCII 0..255 - factory default value is 43 (+). Note: the escape sequence consists of three escape characters preceded ). n and followed by n ms of idle (see S12 to set S2 parameter. Read command returns the current value of ATS2? Note: the format of the numbers in output is always 3 digits, left-filled with 0s 3.7.1.7.4 S3 - Command Li ne Termination Character S3 - Command Line Termination Character Set command sets the value of the character either recognized by the ATS3=[] device as command line terminator and generated by the device as part of the header, trailer, and terminator for result codes and information text, along with S4 parameter . Parameter: - command line termination character (decimal ASCII) ) CR 0..127 - factory default value is 13 (ASCII Note: the “previous” value of S3 is used to determine the command line termination character for entering the command line containing the S3 setting command. However the result code issued shall use the “new” value of S3 (as set during the processing of the command line) Read command returns the current value of S3 parameter . ATS3? Note: the format of the numbers in output is always 3 digits, left-filled with 0s Reference V25ter 3.7.1.7.5 S4 - Response Formatting Character S4 - Response Formatting Character Set command sets the value of the character generated by the device as ATS4=[] p art of the header, trailer, and terminator for result codes and information page 450 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

451 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 . S3 parameter text, along with the Parameter: - response formatting character (decimal ASCII) 0..127 - factory default value is 10 (ASCII LF ) is changed in a command line the result code issued S4 Note: if the value of in response of that command line will use the new value of S4 . Read command returns the current value of S4 parameter. ATS4? Note: the format of the numbers in output is always 3 digits, left-filled with 0s Reference V25ter Line Editing Character 3.7.1.7.6 S5 - Command S5 - Command Line Editing Character Set command sets the value of the character recognized by the device as a ATS5=[] request to delete from the command line the immediately preceding character. Parameter: - command line editing character (decimal ASCII) 0..127 - factory default value is 8 (ASCII BS ) . Read command returns the current value of S5 parameter ATS5? Note: the format of the numbers in output is always 3 digits, left-filled with 0s Reference V25ter 3.7.1.7.7 S7 - Connection Completion Time-Out S7 - Connection Completion Time-Out Set command sets the amount of time, in seconds, that the device shall ATS7=[] allow between either answering a call (automatically or by A command) or completion of signalling of call addressing information to network (dialling), and establishment of a connection with the remote device. Parameter: - number of seconds 1..255 - factory default value is 60 Read command returns the current value of . S7 parameter ATS7? Note: the format of the numbers in output is always 3 digits, left-filled with 0s Reference V25ter page 451 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

452 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.7.8 S12 - Escape Prompt Delay S12 - Escape Prompt Delay Set command sets the period, before and after an escape sequence, during ATS12=[

453 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.1.7.11 S38 - Delay Before Forced Hang Up S38 -Delay Before Forced Hang Up Set command sets the delay, in seconds, between the device’s receipt of H ATS38=[] DTR transition of OFF -to- if device is programmed to command (or ON follow the signal) and the disconnect operation. Parameter: - expressed in seconds seconds for the remote device to 0..254 - the device will wait acknowledge all data in the device buffer before disconnecting (factory default value is 20). 255 - the device doesn’t time-out and continues to deliver data in the buffer until the connection is lost or the data is delivered. Note: parameter can be used to ensure that data in device buffer is sent before device disconnects. S38 parameter . Read command returns the current value of ATS38? Note: the format of the numbers in output is always 3 digits, left-filled with 0s page 453 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

454 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2 ETSI GSM 07.07 AT Commands 3.7.2.1 General 3.7.2.1.1 +CGMI - Request Manufacturer Identification +CGMI - Request Manufacturer Identification Execution command returns the device manufacturer identification code AT+CGMI without command echo. The output depends on the choice made through #SELINT command. result code. Test command returns OK AT+CGMI=? Reference GSM 07.07 3.7.2.1.2 +CGMM - Request Model Identification +CGMM - Request Model Identification Execution command returns the device model identification code without AT+CGMM command echo. OK Test command returns result code. AT+CGMM=? Reference GSM 07.07 Revision Identification 3.7.2.1.3 +CGMR - Request +CGMR - Request Revision Identification Execution command returns device software revision number without AT+CGMR command echo. result code. OK Test command returns AT+CGMR=? Reference GSM 07.07 3.7.2.1.4 +CGSN - Request Product Serial Number Identification +CGSN - Request Product Serial Number Identification Execution command returns the product serial number, identified as the AT+CGSN IMEI of the mobile, without command echo. OK result code. Test command returns AT+CGSN=? Reference GSM 07.07 page 454 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

455 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.1.5 +CSCS - Select TE Character Set +CSCS - Select TE Character Set Set command sets the current character set used by the device. AT+CSCS= [] Parameter: - character set “IRA” - ITU-T.50 ”8859-1” - ISO 8859 Latin 1 ”PCCP437” - PC character set Code Page 437 ”UCS2” - 16-bit universal multiple-octet coded character set (ISO/IEC10646) Read command returns the current value of the active character set. AT+CSCS? . Test command returns the supported values for parameter AT+CSCS=? Reference GSM 07.07 3.7.2.1.6 +CIMI - Request International Mobile Subscriber Identity (IMSI) +CIMI - Request International Mobile Subscriber Identify (IMSI) Execution command returns the value of the Internal Mobile Subscriber AT+CIMI Identity stored in the SIM without command echo. Note: a SIM card must be present in the SIM card housing, otherwise the command returns . ERROR result code. Test command returns OK AT+CIMI=? Reference GSM 07.07 3.7.2.1.7 +CMUX - Multiplexing Mode +CMUX – Multiplexing Mode Set command is used to enter the Multiplexed Mode. AT+CMUX= Parameters: [,] 0 - basic option; it is currently the only supported value. 0 - UIH frames used only; it is currently the only supported value. Note: after entering the Multiplexed Mode a timeout of five seconds start. If no CMUX control channel is established the engine returns to AT Command Mode Note: all the CMUX protocol parameter are fixed as defined in GSM07.10 and cannot be changed. Note: the maximum frame size is fixed: N1=31 Read command returns the current value of multiplexed mode commmand. AT+CMUX? page 455 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

456 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Test command returns all supported values enter multiplexed mode AT+CMUX=? commane. Reference GSM 07.07 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 456 of 614

457 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.2 Call Control 3.7.2.2.1 +CHUP - Hang Up Call +CHUP - Hang Up Call Execution command cancels all active and held calls, also if a multi-party AT+CHUP session is running. Test command returns the OK result code AT+CHUP=? Reference GSM 07.07 3.7.2.2.2 +CBST - Select Bearer Service Type +CBST - Select Bearer Service Type with data rate Set command sets the bearer service , and AT+CBST= to be used when data calls are originated. the connection element [ Values may also be used during mobile terminated data call setup, [, especially in case of single numbering scheme calls (refer +CSNS ). [,]]] Parameters: The default values of the subparameters are manufacturer specific since they depend on the purpose of the device and data services provided by it. Not all combinations of these subparameters are supported. The supported values are: 0 - autobauding (automatic selection of the speed, factory default) 1 - 300 bps (V.21) 2 - 1200 bps (V.22) 3 - 1200/75 bps (V.23) 4 - 2400 bps (V.22bis) 6 - 4800 bps (V.32) 7 - 9600 bps (V.32) 14 - 14400 bps (V.34) 65 - 300 bps (V.110) 66 - 1200 bps (V.110) 68 - 2400 bps (V.110 or X.31 flag stuffing) 70 - 4800 bps (V.110 or X.31 flag stuffing) 71 - 9600 bps (V.110 or X.31 flag stuffing) 75 - 14400 bps (V110 or X.31 flag stuffing) 0 - data circuit asynchronous (factory default) 0 - transparent 1 - non transparent (default) written authorization - All Right reserved page 457 of 614 Reproduction forbidden without Telit Communications S.p.A.

458 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CBST - Select Bearer Service Type Note: the settings AT+CBST=0,0,0 AT+CBST=14,0,0 AT+CBST=75,0,0 are not supported. , Read command returns current value of the parameters AT+CBST? and Test command returns the supported range of values for the parameters. AT+CBST=? Reference GSM 07.07 3.7.2.2.3 +CRLP - Radio Link Protocol +CRLP - Radio Link Protocol Set command sets Radio Link Protocol (RLP) parameters used when non- AT+CRLP=[ transparent data calls are originated [,[, [,[,]]]]] Parameters: - IWF window Dimension 1..61 - factory default value is 61 - MS window Dimension 1..61 - default value is 61 - acknowledge timer (10 ms units). 39..255 - default value is 78 - retransmission attempts 1..255 - default value is 6 - protocol version 0 Read command returns the current value of the RLP protocol parameters. AT+CRLP? Test command returns supported range of values of the RLP protocol AT+CRLP=? parameters. Reference GSM 07.07 3.7.2.2.4 +CR - Servi ce Reporting Control +CR - Service Reporting Control Set command controls whether or not intermediate result code AT+CR=[] +CR: TA , where: to the TE is returned from the ASYNC - asynchronous transparent SYNC - synchronous transparent page 458 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

459 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 REL ASYNC - asynchronous non-transparent REL SYNC - synchronous non-transparent. If enabled, the intermediate result code is transmitted at the point during TA has determined which speed and connect negotiation at which the quality of service will be used, before any error control or data compression reports are transmitted, and before the intermediate result code CONNECT is transmitted. Parameter: 0 - disables intermediate result code report (factory default) 1 - enables intermediate result code report. This command replaces V.25ter [14] command Modulation Reporting , which is not appropriate for use with a GSM terminal. Control +MR Read command returns current intermediate report setting AT+CR? Test command returns the supported range of values of parameter AT+CR=? . Reference GSM 07.07 3.7.2.2.5 +CEER - Extended Error Report +CEER - Extended Error Report Execution command returns one or more lines of information text AT+CEER in the format: +CEER: This report regards some error condition that may occur: - the failure in the last unsuccessful call setup (originating or answering) - the last call release - the last unsuccessful GPRS attach or unsuccessful PDP context activation, - the last GPRS detach or PDP context deactivation. Note: if none of this condition has occurred since power up then No Error condition is reported result code. OK Test command returns AT+CEER=? Reference GSM 07.07 page 459 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

460 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.2.6 +CRC - Cellular Result Codes +CRC - Cellular Result Codes Set command controls whether or not the extended format of incoming call AT+CRC= indication is used. [] Parameter: 0 - disables extended format reporting (factory default) 1 - enables extended format reporting: When enabled, an incoming call is indicated to the TE with unsolicited result code +CRING: instead of the normal . RING where - call type: ASYNC - asynchronous transparent data SYNC - synchronous transparent data REL ASYNC - asynchronous non-transparent data REL SYNC - synchronous non-transparent data FAX - facsimile (TS 62) VOICE - normal voice (TS 11) Read command returns current value of the parameter . AT+CRC? Test command returns supported values of the parameter . AT+CRC=? Reference GSM 07.07 le Numbering Scheme 3.7.2.2.7 +CSNS - Sing +CSNS - Single Numbering Scheme Set command selects the bearer or teleservice to be used when mobile AT+CSNS= terminated single numbering scheme call is established. Parameter values [] set with equals to a data command shall be used when +CBST service. Parameter: 0 - voice (factory default) 2 - fax (TS 62) 4 - data parameter is set to a value that is not applicable to single +CBST Note: if numbering calls, ME/TA shall map the value to the closest valid one. E.g. if page 460 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

461 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 user has set , =0 and =1 (non-trasparent =71 asynchronous 9600 bps V.110 ISDN connection) for mobile originated calls, ME/TA shall map the values into non-trasparent asynchronous 9600 bps V.32 modem connection when single num bering scheme call is answered. Read command returns current value of the parameter . AT+CSNS? . Test command returns supported values of parameter AT+CSNS=? Reference GSM 07.07 3.7.2.2.8 +CVHU - Vo ice Hang Up Control +CVHU - Voice Hang Up Control DTR drop or " " shall cause a voice ATH Set command selects whether AT+CVHU= connection to be disconnected or not. [] Parameter: 0 - " Drop DTR " ignored but OK result code given. ATH disconnects. ignored but ATH " and result code given. OK 1 - " Drop DTR " behaviour according to disconnects 2 - " Drop DTR ATH &D setting. (factory default). parameter, in the Read command reports the current value of the AT+CVHU? format: +CVHU: Test command reports the range of supported values for parameter AT+CVHU=? written authorization - All Right reserved page 461 of 614 Reproduction forbidden without Telit Communications S.p.A.

462 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.3 Network Service Handling 3.7.2.3.1 +CNUM - Subscriber Number +CNUM - Subscriber Number Execution command returns the subscriber number i.e. the phone number AT+CNUM of the device that is stored in the SIM card. Note: the returned number format is: +CNUM: , , where - alphanumeric string associated to ; used character set . should be the one selected with either +CSCS - string containing the phone number in the format - type of number: 129 - national numbering scheme 145 - international numbering scheme (contains the character "+"). Test command returns the OK result code AT+CNUM=? Reference GSM 07.07 3.7.2.3.2 +COPN - Read Operator Names +COPN - Read Operator Names Execution command returns the list of operator names from the ME . AT+COPN command. The output depends on the choice made through #SELINT OK result code Test command returns the AT+COPN=? Reference GSM 07.07 3.7.2.3.3 +CREG - Netw ork Registration Report +CREG - Network Registration Report Set command enables/disables network registration reports depending on AT+CREG= . the parameter [] Parameter: 0 - disable network registration unsolicited result code (factory default) 1 - enable network registration unsolicited result code 2 - enable network registration unsolicited result code with network Cell identification data If , network registration result code reports: =1 page 462 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

463 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CREG - Network Registration Report +CREG: where 0 - not registered, ME is not currently searching a new operator to register to 1 - registered, home network 2 - not registered, but ME is currently searching a new operator to register to 3 - registration denied 4 -unknown 5 - registered, roaming If =2 , network registration result code reports: +CREG: [ , , ] where: - Local Area Code for the currently registered on cell - Cell Id for the currently registered on cell and and the mobile is =2 are reported only if Note: registered on some network cell. Read command reports the and parameter values in the AT+CREG? format: +CREG: , [, , ] and the mobile is =2 Note: are reported only if and registered on some network cell. Test command returns the range of supported AT+CREG=? AT Example OK at+creg? n network searching +CREG: 0,2 (the MODULE is i state) OK at+creg? +CREG: 0,2 OK at+creg? +CREG: 0,2 OK page 463 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

464 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CREG - Network Registration Report at+creg? +CREG: 0,2 OK at+creg? +CREG: 0,1 (the MODULE is registered ) OK at+creg? +CREG: 0,1 OK Reference GSM 07.07 3.7.2.3.4 +COPS - Operator Selection +COPS - Operator Selection Set command forces an attempt to select and register the GSM network AT+COPS= operator. [ parameter defines whether the operator selection is done [, automatically or it is forced by this command to operator . [,]]] The operator shall be given in format . Parameters: 0 - automatic choice (the parameter will be ignored) (factory default) field shall be present) 1 - manual choice ( 2 - deregister from GSM network; the MODULE is kept unregistered until a with =0, 1 or 4 is issued +COPS 3 - set only parameter (the parameter will be ignored) 4 - manual/automatic ( field shall be present); if manual selection fails, automatic mode ( =0 ) is entered 0 - alphanumeric long form (max length 16 digits) 2 - numeric 5 digits [country code (3) + network code (2)] : network operator in format defined by parameter. parameter setting is stored in NVM and available at next Note: reboot. If = 1 or 4 , the selected network is stored in NVM too and is available at next reboot (this will happen even with a new SIM inserted) Read command returns current value of , and in AT+COPS? format ; if no o p p erator is selected, page 464 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

465 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +COPS - Operator Selection omitted [, ] +COPS: , Test command returns a list of quadruplets, each representing an operator AT+COPS=? present in the network. The quadruplets in the list are separated by commas: +COPS: [list of supported ( ,=0)>,, =2)>)s][,,(list of supported s), (list of supporteds)] where - operator availability 0 - unknown 1 - available 2 - current 3 - forbidden Note: since with this command a network scan is done, this command may require some seconds before the output is given. Reference GSM 07.07 3.7.2.3.5 +CLCK - Fa cility Lock/Unlock +CLCK - Facility Lock/Unlock o a network facility. ME Execution command is used to lock or unlock a AT+CLCK= , Parameters: [, - facility [,]] "SC" - SIM (PIN request) (device asks SIM password at power-up and when this lock command issued) "AO"- BAOC (Barr All Outgoing Calls) "OI" - BOIC (Barr Outgoing International Calls) "OX" - BOIC-exHC (Barr Outgoing International Calls except to Home Country) "AI" - BAIC (Barr All Incoming Calls) "IR" - BIC-Roam (Barr Incoming Calls when Roaming outside the home country) ) "AB" - All Barring services (applicable only for =0 "AG" - All outGoing barring services (applicable only for =0 ) =0 ) "AC" - All inComing barring services (applicable only for "FD" - SIM fixed dialling memory feature (if PIN2 authentication has no t been done during the current session, PIN2 is required as ) "PN" - network Personalisation "PU" - network subset Personalisation page 465 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

466 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLCK - Facility Lock/Unlock - defines the operation to be done on the facility 0 - unlock facility 1 - lock facility 2 - query status - shall be the same as password specified for the facility from the DTE user interface or with command Change Password +CPWD - represents the class of information of the facility as sum of bits (default is 7) 1 - voice (telephony) 2 - data (refers to all bearer services) 4 - fax (facsimile services) 8 - short message service 16 - data circuit sync 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access =2 Note: when and command successful, it returns: +CLCK: [,[+CLCK: , [...]] where - the current status of the facility 0 - not active 1 - active - class of information of the facility > ,1 +CLCK: ,2 +CLCK: ,4 nge Facility Password 3.7.2.3.6 +CPWD - Cha +CPWD - Change Facility Password Execution command changes the password for the facility lock function AT+CPWD=, . defined by command Facility Lock +CLCK , Parameters: page 466 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

467 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - facility “SC” - SIM (PIN request) “AB” - All barring services “P2” - SIM PIN2 - string type, it shall be the same as password specified for the +CPWD user interface or with command . facility from the ME - string type, it is the new password w Note: parameter is the old password while is the ne one. Test command returns a list of pairs ( , ) which presents AT+CPWD=? the available facilities and the maximum length of their password ( ) Reference GSM 07.07 3.7.2.3.7 +CLIP - Calling Line Identification Presentation +CLIP - Calling Line Identification Presentation AT+CLIP=[] Set command enables/disables the presentation of the CLI (Calling Line Identity) at the TE . This command refers to the GSM supplementary service CLIP (Calling Line Identification Presentation) that enables a called subscriber to get the CLI of the calling party when receiving a mobile terminated call. Parameters: 0 - disables CLI indication (factory default) 1 - enables CLI indication If enabled the device reports after each RING the response: +CLIP:,,,, , where: - calling line number - type of address octet in integer format 145 - international numbering scheme (contains the character " + ") 129 - national numbering scheme - string type subaddress of format specified by - type of subaddress octet in integer format - string type; alphanumeric representation of corresponding to the entry found in phonebook; used character set should be the one selected either with command Select TE character set +CSCS . page 467 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

468 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLIP - Calling Line Identification Presentation 0 - CLI valid 1 - CLI has been withheld by the originator. 2 - CLI is not available due to interworking problems or limitation or originating network. Read command returns the presentation status of the CLI in the format: AT+CLIP? +CLIP: , where: 0 - CLI presentation disabled 1 - CLI presentation enabled - status of the CLIP service on the GSM network 0 - CLIP not provisioned 1 - CLIP provisioned 2 - unknown (e.g. no network is present ) Note: This command issues a status request to the network, hence it may take a few seconds to give the answer due to the time needed to exchange data with it. Test command returns the supported values of parameter AT+CLIP=? Reference GSM 07.07 Note The command changes only the report behaviour of the device, it does not change CLI supplementary service setting on the network. Identification Restriction 3.7.2.3.8 +CLIR - Calling Line +CLIR - Calling Line Identification Restriction Set command overrides the CLIR subscription when temporary mode is AT+CLIR=[] provisioned as a default adjustment for all following outgoing calls. This adjustment can be revoked by using the opposite command. This command refers to CLIR-service (GSM 02.81) that allows a calling subscriber to enable or disable the presentation of the CLI to the called party when originating a call. Parameter: - facility status on the Mobile 0 - CLIR facility according to CLIR service network status 1 - CLIR facility active (CLI not sent) 2 - CLIR facility not active (CLI sent) ) and Read command gives the default adjustment for all outgoing calls ( AT+CLIR? also triggers an interrogation of the provision status of the CLIR service ), where ( - facility status on the Mobile 0 - CLIR facility according to CLIR service network status page 468 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

469 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 1 - CLIR facility active (CLI not sent) 2 - CLIR facility not active (CLI sent) - facility status on the Network 0 - CLIR service not provisioned 1 - CLIR service provisioned permanently 2 - unknown (e.g. no network present, etc.) 3 - CLI temporary mode presentation restricted 4 - CLI temporary mode presentation allowed . Test command reports the supported values of parameter AT+CLIR=? Reference GSM 07.07 Note This command sets the default behaviour of the device in outgoing calls. 3.7.2.3.9 +CCFC - Call Forwarding Number And Conditions +CCFC - Call Forwarding Number And Condition Execution command controls the call forwarding supplementary service. AT+CCFC= Registration, erasure, activation, deactivation, and status query are , supported. [,[, [, Parameters: [,,,

470 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCFC - Call Forwarding Number And Condition 64 - dedicated packet access 128 - dedicated PAD access

471 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCWA - Call Waiting 32 - data circuit async 64 - dedicated packet access 128 - dedicated PAD access Note: the response to the query command is in the format: +CCWA: , where: represents the status of the service: 0 - inactive 1 - active - class of calls the service status refers to. Note: the unsolicited result code enabled by parameter is in the format:: +CCWA: ,,,[[,]] where: - string type phone number of calling address in format specified by - type of address in integer format - see before - string type; alphanumeric representation of corresponding to the entry found in phonebook; used character set should be the one selected with +CSCS . 0 - CLI valid 1 - CLI has been withheld by the originator terworking problems or limitations of 2 - CLI is not available due to in originating network Note: if parameter is omitted then network is not interrogated. Note: in the query command the class parameter must not be issued. Note: the difference between call waiting report disabling ( AT+CCWA = ) and call waiting service disabling ( AT+CCWA = 0,0,7 ) is that in the 0,1,7 first case the call waiting indication is sent to the device by network but this last one does not report it to the DTE ; instead in the second case the call waiting indication is not generated by the network. Hence the device st nd case a ringing case while in the 1 results busy to the third party in the 2 indication is sent to the third party. has no effect a non sense and must AT+CCWA=1,0 Note: The command not be issued.. page 471 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

472 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CCWA - Call Waiting Read command reports the current value of the parameter . AT+CCWA? . Test command reports the supported values for the parameter AT+CCWA=? Reference GSM 07.07 3.7.2.3.11 +CHLD - Call Holding Services +CHLD - Call Holding Services Execution command controls the network call hold service. With this service AT+CHLD=[] it is possible to disconnect temporarily a call and keep it suspended while it is retained by the network, contemporary it is possible to connect another party or make a multiparty connection. Parameter: 0 - releases all held calls, or sets the UDUB (User Determined User Busy) indication for a waiting call. (only from version D) 1 - releases all active calls (if any exist), and accepts the other (held or waiting) call 1X - releases a specific active call X 2 - places all active calls (if any exist) on hold and accepts the other (held or waiting) call. 2X - places all active calls on hold except call X with which communication shall be supported (only from version D). 3 - adds an held call to the conversation Note: "X" is the numbering (starting with 1) of the call given by the sequence of setting up or receiving the calls (active, held or waiting) as seen by the ber until they are released. New calls served subscriber. Calls hold their num take the lowest available number. Note: where both a held and a waiting call exist, the above procedures apply to the waiting call (i.e. not to the held call) in conflicting situation. s . Test command returns the list of supported AT+CHLD=? +CHLD: (0,1,1X,2,2X,3) Reference GSM 07.07 Note ONLY for VOICE calls Supplementary Service Data 3.7.2.3.12 +CUSD - Unstructured +CUSD - Unstructured Supplementary Service Data Set command allows control of the Unstructured Supplementary Service AT+CUSD= Data (USSD [GSM 02.90]). [[, page 472 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

473 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CUSD - Unstructured Supplementary Service Data [,]]] Parameters: - is used to disable/enable the presentation of an unsolicited result code. 0 - disable the result code presentation in the DTA DTA 1 - enable the result code presentation in the - USSD-string (when parameter is not given, network is not interrogated) - If indicates that GSM338 default alphabet is used ME/TA converts GSM alphabet into current TE character set (see +CSCS ). ME/TA indicates that 8-bit data coding scheme is used: - If converts each 8-bit octet into two IRA character long hexadecimal number; e.g. octet with integer value 42 is presented to TE as two characters 2A (IRA 50 and 65). - GSM 3.38 Cell Broadcast Data Coding Scheme in integer format (default is 0). Note: the unsolicited result code enabled by parameter is in the format: +CUSD: [,,] to the TE where: : 0 - no further user action required (network initiated USSD-Notify, or no further information needed after mobile initiated operation). 1 - further user action required (network initiated USSD-Request, or further information needed after mobile initiated operation) 2 - USSD terminated by the network 3 - other local client has responded 4 - operation not supported 5 - network time out Note: in case of successful mobile initiated operation, DTA waits the USSD DTE response from the network and sends it to the before the final result code. This will block the AT command interface for the period of the operation. Read command reports the current value of the parameter AT+CUSD? Test command reports the supported values for the parameter AT+CUSD=? Reference GSM 07.07 Only mobile initiated operations are supported Note page 473 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

474 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.3.13 +CAOC - Advice Of Charge +CAOC - Advice Of Charge Set command refers to the Advice of Charge supplementary service; the AT+CAOC= command also includes the possibility to enable an unsolicited event reporting of the CCM (Call Cost Meter) information. Parameter: 0 - query CCM value 1 - disables unsolicited CCM reporting 2 - enables unsolicited CCM reporting Note: the unsolicited result code enabled by parameter is in the format: +CCCM: where: - call cost meter value hexadecimal representation (3 bytes) +CCCM Note: the unsolicited result code is issued when the CCM value changes, but not more than every 10 seconds. Read command reports the value of parameter in the format: AT+CAOC? +CAOC: parameter. Test command reports the supported values for AT+CAOC=? Reference GSM 07.07 Note +CAOC command uses the CCM of the device internal memory, not the CCM stored in the SIM. The difference is that the internal memory CCM is reset at power up, while the SIM CCM is reset only on user request. Advice of Charge values stored in the SIM (ACM, ACMmax, PUCT) can be , and . accessed with commands +CACM +CPUC +CAMM 3.7.2.3.14 +CLCC - List Current Calls +CLCC - List Current Calls Execution command returns the list of current calls and their characteristics AT+CLCC in the format: [ +CLCC:,

,,,[,, ,[+CLCC:,,,, ,,,[...]]] where: > - call identification number n page 474 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

475 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CLCC - List Current Calls 0 - mobile originated call 1 - mobile terminated call - state of the call 0 - active 1 - held 2 - dialing ( MO call) MO 3 - alerting ( call) MT call) 4 - incoming ( 5 - waiting ( MT call) - call type 0 - voice 1 - data 2 - fax 9 - unknown - multiparty call flag 0 - call is not one of multiparty (conference) call parties - phone number in format specified by - type of phone number byte in integer format 129 - national numbering scheme 145 - international numbering scheme (contains the character " ") + - string type; alphanumeric representation of corresponding to the entry found in phonebook; used character set . should be the one selected with +CSCS Note: If no call is active then only OK message is sent. This command is useful in conjunction with command +CHLD to know the various call status for call holding. OK result code Test command returns the AT+CLCC=? Reference GSM 07.07 3.7.2.3.15 +CSSN - SS Notification +CSSN - SS Notification It refers to supplementary service related network initiated notifications. AT+CSSN=[ Set command enables/disables the presentation of notification result codes [,]] from TA to TE . Parameters: - sets the +CSSI result code presentation status 0 - disable 1 - enable +CSSU result code presentation status - sets the 0 - disable 1 - enable page 475 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

476 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSSN - SS Notification When =1 and a supplementary service notification is received after a mobile originated call setup, an unsolicited code: +CSSI: before any other MO call setup result codes, where: TE is sent to : 1 - some of the conditional call forwardings are active 2 - call has been forwarded 3 - call is waiting 5 - outgoing calls are barred 6 - incoming calls are barred and a supplementary service notification is received during a When =1 mobile terminated call setup or during a call, an unsolicited result code: +CSSU: is sent to , where: TE : 0 - this is a forwarded call ( MT call setup) 2 - call has been put on hold (during a voice call) 3 - call has been retrieved (during a voice call). Read command reports the current value of the parameters. AT+CSSN? Test command reports the supported range of values for parameters , AT+CSSN=? . Reference GSM 07.07 3.7.2.3.16 +CCUG - Closed User Gr oup Supplementary Service Control +CCUG - Closed User Group Supplementary Service Control Set command allows control of the Closed User Group supplementary AT+CCUG= service [GSM 02.85]. [[, [,]]] Parameters: 0 - disable CUG temporary mode (factory default). 1 - enable CUG temporary mode: it enables to control the CUG information on the air interface as a default adjustment for all following outgoing calls. 0..9 - CUG index 10 - no index (preferential CUG taken from subscriber data) (default) page 476 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

477 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 0 - no information (default) 1 - suppress Outgoing Access (OA) 2 - suppress preferential CUG 3 - suppress OA and preferential CUG Read command reports the current value of the parameters AT+CCUG? Test command returns the OK result code AT+CCUG=? Reference GSM 07.07 written authorization - All Right reserved Reproduction forbidden without Telit Communications S.p.A. page 477 of 614

478 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.4 Mobile Equipment Control 3.7.2.4.1 +CPAS - Phon e Activity Status +CPAS - Phone Activity Status Execution command reports the device status in the form: AT+CPAS +CPAS: Where: - phone activity status 0 - ready (device allows commands from TA/TE ) ) 1 - unavailable (device does not allow commands from TA/TE 2 - unknown (device is not guaranteed to respond to instructions) 3 - ringing (device is ready for commands from TA/TE , but the ringer is active) 4 - call in progress (device is ready for commands from TA/TE , but a call is in progress) Test command reports the supported range of values for . AT+CPAS=? Note: although is an execution command, ETSI 07.07 requires the +CPAS Test command to be defined. Example ATD03282131321; OK AT+CPAS +CPAS: 3 the called phone is ringing OK AT+CPAS +CPAS: 4 the called phone has answered to your call OK ATH OK Reference GSM 07.07 3.7.2.4.2 +CFUN - Set Phone Functionality +CFUN - Set Phone Functionality selects the level of functionality in the ME. Set command AT+CFUN= [[,]] Parameters: - is the power saving function mode 0 - minimum functionality, NON-CYCL IC SLEEP mode: in this mode, the , once y level ou have set A T interface is not accessible. Conse q uentl y page 478 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

479 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CFUN - Set Phone Functionality 0, do not send further characters. Otherwise these characters remain in the input buffer and may delay the output of an unsolicited result code. The first wake-up event stops power saving and takes the ME back to full =1 . functionality level 1 - mobile full functionality with power saving disabled (factory default) 2 - disable TX 4 - disable either TX and RX 5 - mobile full functionality with power saving enabled - reset flag 0 - do not reset the ME before setting it to functionality level Note: if power saving enabled, it reduces the power consumption during the idle time, thus allowing a longer standby time with a given battery capacity. Note: to place the telephone in power saving mode, set the parameter at value = 5 and the line DTR (RS232) must be set to OFF . Once in power saving, the CTS line switch to the OFF status to signal that the telephone is really in power saving condition. During the power saving condition, before sending any AT command on the DTR serial line, the CTS must be enabled and it must be waited for the status. ON (RS232) line to go in , the telephone will not return back in the power Until the DTR line is ON saving condition. Note: the power saving function does not affect the network behavior of the MODULE, even during the power save condition the module remains registered on the network and reachable for incoming calls or SMS. If a call incomes during the power save, then the module will wake up and proceed normally with the unsolicited incoming call code . Read command reports the current setting of AT+CFUN? and . Test command returns the list of supported values for AT+CFUN=? Reference GSM 07.07 3.7.2.4.3 +CPIN - Enter PIN +CPIN - Enter PIN Set command sends to the device a password which is necessary before it AT+CPIN= can be operated (SIM PIN, SIM PUK, PH-SIM PIN, etc.). [,] is required. If the PIN required is SIM PUK or SIM PUK2, the This second pin, ,will replace the old pin in the SIM. The command may be used to change the SIM PIN by sending it with both when PIN request is pending; if no PIN and parameters request is pending the command will return an error code and to change the must be used instead. PIN the command +CPWD page 479 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

480 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN Parameters: - string type value - string type value. To check the status of the PIN request use the command AT+CPIN? Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. Read command reports the PIN/PUK/PUK2 request status of the device in AT+CPIN? the form: +CPIN: where: - PIN/PUK/PUK2 request status code READY - ME is not pending for any password SIM PIN - ME is waiting SIM PIN to be given SIM PUK - ME is waiting SIM PUK to be given PH-SIM PIN - ME is waiting phone-to-SIM card password to be given PH-FSIM PIN - ME is waiting phone-to-very first SIM card password to be given PH-FSIM PUK - ME is waiting phone-to-very first SIM card unblocking password to be given SIM PIN2 - ME is waiting SIM PIN2 to be given; this is returned only when the last executed command resulted in PIN2 +CME ERROR: 17 ) authentication failure (i.e. is returned SIM PUK2 - ME is waiting SIM PUK2 to be given; this only when the last executed command resulted in PUK2 authentication failure (i.e. +CME ERROR: 18 ) PH-NET PIN - ME is waiting network personalization password to be given PH-NET PUK - ME is waiting network personalization unblocking password to be given PH-NETSUB PIN - ME is waiting network subset personalization password to be given PH-NETSUB PIN - ME is waiting network subset personalization unblocking password to be given PH-SP PIN - ME is waiting service provider personalization password to be given PH-SP PUK - ME is waiting serv ice provider personalization unblocking password to be given PH-CORP PIN - ME is waiting corporate personalization password to be given PH-CORP PUK - ME is waiting corporate personalization unblocking password to be given Note: Pin pending status at startup depends on PIN facility setting, to change or query the default power up setting use the command AT+CLCK=SC, , page 480 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

481 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN AT+CMEE=1 Example OK AT+CPIN? +CME ERROR: 10 error: you have to insert the SIM AT+CPIN? y ou inserted the SIM and device is not +CPIN: READY waiting for PIN to be given OK Note What follows is a list of the commands which are accepted when ME is pending SIM PIN or SIM PUK A #SRP #CAMOFF +IPR +ICF D #CAP #CAMEN H +IFC #TPHOTO #CODEC O #CBC #RPHOTO +CMUX #I2S1 #SELCAM +CNMI E #STM #CAMQUA +CPAS I #CMODE #SHFEC +CCLK L M #CAMRES +CALA #SHFSD P #HFMICG #CAMTXT +CRSM Q #HSMICG #CAMZOOM +CLIP S #GPIO #CAMCOL +DR +DS T #SGPO #OBJL #OBJR #GGPI V +MS X #ADC +GCAP #DIALMODE #QTEMP +GCI Z #SEMAIL #DAC #EMAILD &C +ILRR &D #F26M #EUSER +CALM &F #RTCSTAT #EPASSW +CHUP &K #ESMTP +FCLASS #ACAL &N #PCT #EADDR +FMI &P #WAKE #EMAILMSG +FMM &S #SHDN #ESAV +FMR &V #JDR +FTS #ERST &W +FRS #QSS #CSURV &Y #CSURVC #SSCTRACE +FTM #CSURVU +CFUN +FRM &Z #CSURVUC +CGMI +FRH %E %L #CSURVF +CGMM +FTH %Q +CGMR +FLO #CSURVNLF \K #CSURVB +GMI +FPR \Q #CSURVBC +GMM +FDD +CSNS \R #PASSW +GMR +CRLP +CGSN #PKTSZ \V page 481 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

482 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CPIN - Enter PIN #BND #SKTSAV +GSN +CR #AUTOBND #SKTSET +CRC +CREG #CGMI #SKTOP +CMEE +CGREG +COPS +CPIN #CGMM #SKTTO +CBC #CGMR #USERID +CSQ #CGSN #DSTO +CSDH +CIND #SKTCT #MONI +CRSL +CMER #SERVINFO #SKTRST +CLVL #SELINT #FTPPUTPH +CMUT #CAMON #SRS All the above commands, but the ones in the grayed cells, can be issued even if the SIM card is not inserted yet. Reference GSM 07.07 3.7.2.4.4 +CSQ - Signal Quality +CSQ - Signal Quality Execution command reports received signal quality indicators in the form: AT+CSQ +CSQ: , where - received signal strength indication 0 - (-113) dBm or less 1 - (-111) dBm 2..30 - (-109)dBm..(-53)dBm / 2 dBm per step 31 - (-51)dBm or greater 99 - not known or not detectable - bit error rate (in percent) 0 - less than 0.2% 1 - 0.2% to 0.4% 2 - 0.4% to 0.8% 3 - 0.8% to 1.6% 4 - 1.6% to 3.2% 5 - 3.2% to 6.4% 6 - 6.4% to 12.8% 7 - more than 12.8% 99 - not known or not detectable Note: this command should be used instead of the %Q and %L commands, since GSM relevant parameters are the radio link ones and no line is present, hence %Q and %L have no meaning. Test command e of values of the orted ran g arameters pp p r eturns the su AT+CSQ=? page 482 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

483 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 and . Note: although +CSQ is an execution command, ETSI 07.07 requires the Test command to be defined. Reference GSM 07.07 3.7.2.4.5 +CIND - Indicator Control +CIND - Indicator Control Set command is used to control the registration / deregistration of ME AT+CIND= indicators, in order to automatically send the +CIEV URC , whenever the [ value of the associated indicator changes. The supported indicators [,[,...]]] ( ) and their order appear from test command AT+CIND=? Parameter: - registration / deregistration state 0 - the indicator is deregistered; it cannot be presented as unsolicited +CIEV URC result code ( AT+CIND? ), but can be directly queried with 1 - indicator is registered: indicator event report is allowed; this is the factory default for every indicator Read command returns the current value status of ME indicators, in the AT+CIND? format: +CIND: [,[,...]] Note: the order of the values s is the same as that in which appear the supported indicators from test command AT+CIND=? returns pairs, where string value is a description Test command AT+CIND=? (max. 16 chars) of the indicator and compound value is the supported values for the indicator, in the format: +CIND: (, (list of supported s))[,(, (list of supported s))[,...]] where: - indicator names as follows (along with their ranges) “battchg” - battery charge level - battery charge level indicator range 0..5 99 - not measurable “signal” - signal quality - signal quality indicator range 0..7 99 - not measurable “service” - service availability page 483 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

484 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CIND - Indicator Control - service availability indicator range 0 - not registered to any network 1 - registered to home network “sounder” - sounder activity - sounder activity indicator range 0 - there’s no any sound activity 1 - there’s some sound activity “message” - message received - message received indicator range 0 - there is no unread short message at memory location “SM” 1 - unread short message at memory location “SM” “call” - call in progress - call in progress indicator range 0 - there’s no calls in progress 1 - at least a call has been established “roam” - roaming - roaming indicator range 0 - registered to home network or not registered 1 - registered to other network “smsfull” - a short message memory storage in the MT has become full (1), or memory locations are available (0) - short message memory storage indicator range 0 - memory locations are available 1 - a short message memory storage in the MT has become full. “rssi” - received signal (field) strength - received signal strength level indicator range 0 - signal strength ≤ 112 dBm 1..4 - signal strength in 15 dBm steps 5 - signal strength ≥ 51 dBm 99 - not measurable Next command causes all the indicators to be registered Example AT+CIND=1,1,1,1,1,1,1,1,1 Next command causes all the indicators to be de- registered AT+CIND=0,0,0,0,0,0,0,0,0 Next command to query the current value of all indicators AT+CIND? CIND: 4,0,1,0,0,0,0,0,2 OK page 484 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

485 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CIND - Indicator Control Note See command +CMER Reference GSM 07.07 3.7.2.4.6 +CMER - Mobile Equipment Event Reporting +CMER - Mobile Equipment Event Reporting Set command enables/disables sending of unsolicited result codes from AT+CMER= TA to TE in the case of indicator state changes (n.b.: sending of URCs in [ the case of key pressings or display changes are currently not [, implemented). [, [, Parameters: [,]]]]] - controls the processing of unsolicited result codes 0 - discard +CIEV Unsolicited Result Codes . when TA-TE link is reserved 1 - discard +CIEV Unsolicited Result Codes (e.g. on-line data mode); otherwise forward them directly to the TE. in the TA when TA-TE link is +CIEV Unsolicited Result Codes 2 - buffer reserved (e.g. on-line data mode) and flush them to the TE after reservation; otherwise forward them directly to the TE. 3 - forward +CIEV Unsolicited Result Codes directly to the TE; when TA +CIEV URC is in on-line data mode each is replaced with a Break (100 ms), and is stored in a buffer; onche the ME goes into command mode (after +++ was entered), all URCs stored in the buffer will be output. - keypad event reporting 0 - no keypad event reporting - display event reporting 0 - no display event reporting - indicator event reporting 0 - no indicator event reporting 1 - indicator event reporting Read command returns the current setting of parameters, in the format: AT+CMER? +CMER: ,,,, Test command returns the range of supported values for parameters AT+CMER=? , in the format: , , , , +CMER: (list of supported s),(list of supported s), (list of supported s),(list of supported s),(list of supported s) Reference GSM 07.07 page 485 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

486 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.4.7 +CPBS - Select Phonebook Memory Storage +CPBS - Select Phonebook Memory Storage Set command selects phonebook memory storage , which will be AT+CPBS= used by other phonebook commands. Parameter: "SM" - SIM phonebook "FD" - SIM fixed dialling-phonebook (only phase 2/2+ SIM) "LD" - SIM last-dialling-phonebook (+CPBW and +CPBF are not applicable for this storage) "MC" - device missed (unanswered received) calls list and (+CPBW are not applicable for this storage) +CPBF (+CPBW and +CPBF are not applicable for "RC" - ME received calls list this storage). Read command returns the actual values of the parameter , the AT+CPBS? number of occupied records and the maximum index number , in the format: , +CPBS: , =”MC” : if there are more than one missed calls from Note: For the same number the read command will return only the last call returns the supported range of values for the parameters Test command AT+CPBS=? . Reference GSM 07.07 3.7.2.4.8 +CPBR - Read Phonebook Entries +CPBR - Read Phonebook Entries Execution command returns phonebook entries in location number range AT+CPBR= from the current phonebook memory storage selected .. with +CPBS is returned. is omitted, only location . If [,] Parameters: - integer type value in the range of location numbers of phonebook memory - integer type value in the range of location numbers of phonebook memory The response format is: +CPBR: , , , where: - the current position number of the PB index (to see the range of +CPBR=? values use ) page 486 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

487 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - the phone number stored in the format - type of phone number byte in integer format 129 - national numbering scheme 145 - international numbering scheme (contains the character " + ") - the alphanumeric text associated to the number; used character set should be the one selected with command +CSCS. Note: If all queried locations are empty (but available), no information text lines will be returned, while if listing fails in an +CME ERROR: error, ME is returned. Test command returns the supported range of values of the parameters in AT+CPBR=? the form: - ), +CPBR: ( , where: - the minimum number, integer type number, integer type - the maximum - maximum field length, integer type - maximum field length, integer type Remember to select the PB storage with +CPBS Note command before issuing PB commands. Reference GSM 07.07 3.7.2.4.9 +CPBF - Find Phonebook Entries +CPBF - Find Phonebook Entries Execution command issues a search for the phonebook records that have AT+CPBF= field the sub-string at the start of the Parameter: - string type; used character set should be the one selected with +CSCS. command The command returns a report in the form: +CPBF: ,,,[[...] +CPBF: ,,,] , , , and as in the command +CPBR report. Note: if the command returns all the phonebook records. =”” ERROR Note: if no PB records satisfy the search criteria then an message is reported. page 487 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

488 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 and Test command reports the maximum lengths of fields AT+CPBF=? in the PB entry in the form: +CPBF: [],[] Remember to select the PB storage with +CPBS Note command before issuing PB commands. Reference GSM 07.07 3.7.2.4.10 +CPBW - Write Phonebook Entry +CPBW - Write Phonebook Entry a phonebook record Execution command stores at the position AT+CPBW= , parameters defined by and [] [, Parameters: [, - record position [,]]] - string type, phone number in the format - the type of number 129 - national numbering scheme 145 - international numbering scheme (contains the character " + ") - the text associated to the number, string type; used character set should be the one selected with command +CSCS . Note: If record number already exists, it will be overwritten. Note: if only is given, the record number is deleted. is omitted, the number is stored in the first free Note: if phonebook location. returns location range supported by the current storage as Test command AT+CPBW=? a compound value, the maximum length of field supported number format of the storage and maximum length of field. The format is: +CPBW: (list of supported s),[], (list of supported s),[] where: - integer type value indicating the maximum length of field - integer type value indicating the maximum length of field Reference GSM 07.07 command before issuing Remember to select the PB storage with +CPBS Note PB commands. page 488 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

489 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.4.11 +CCLK - Clock Management +CCLK - Clock Management Set command sets the real-time clock of the ME . AT+CCLK=

490 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CALA - Alarm Management - index of the alarm 0 - The only value supported is 0. - alarm behaviour type 0 - reserved for other equipment use. 1 - the MODULE simply wakes up fully operative as if the ON/OFF button had been pressed. If the device is already ON at the alarm time, then it does nothing. 2 - the MODULE wakes up in "alarm mode" if at the alarm time it was off, otherwise it remains fully operative. In both cases the MODULE issues an unsolicited code every 3s: +ALARM: is the +CALA optional parameter previously set. where The device keeps on sending the unsolicited code every 3s until a #WAKE or #SHDN command is received or a 90s timeout occurs. If the device is in "alarm mode" and it does not receive the #WAKE command within 90s then it shuts down. (default) 3 - the MODULE wakes up in "alarm mode" if at the alarm time it was off, otherwise it remains fully operative. In both cases the MODULE starts playing the alarm tone on the selected path for the ringer (see command #SRP ) #SHDN The device keeps on playing the alarm tone until a #WAKE or ccurs. If the device is in "alarm command is received or a 90s timeout o mode" and it does not receive the command within 90s then it #WAKE shuts down. 4 - the MODULE wakes up in "alarm mode" if at the alarm time it was off, otherwise it remains fully operative. In both cases the MODULE brings the pin GPIO6 high, provided its has been set to alarm #WAKE or #SHDN command is output, and keeps it in this state until a received or a 90s timeout occurs. If the device is in "alarm mode" and it does not receive the #WAKE command within 90s then it shuts down. 5 - the MODULE will make both the actions as for type=2 and =3 . 6 - the MODULE will make both the actions as for type=2 and =4 . . 7 - the MODULE will make both the actions as for type=3 and =4 - unsolicited alarm code text string. It has meaning only if is equal to 2 or 5 or 6. Note: The "alarm mode" is indicated by hardware pin CTS to the ON status OFF and DSR to the status, while the "power saving" status is indicated by a CTS - OFF and DSR - OFF status. The normal operating status is - DSR ON . indicated by During the "alarm mode" the device will not make any network scan and will not register to any network and therefore is not able to dial or receive any page 490 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

491 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CALA - Alarm Management call or SMS, the only commands that can be issued to the MODULE in this state are the and #SHDN , every other command must not be #WAKE issued during this state. Read command reports the current alarm time stored in the internal Real AT+CALA? Time Clock, if present, in the format: +CALA:

492 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CRSM - Restricted SIM access actual command either on successful or on failed execution. - on a successful completion of the command previously ted data (hexadecimal issued it gives the reques character format). It’s not returned after a successful UPDATE BINARY or UPDATE RECORD command. Note: this command requires PIN authentication. However commands READ BINARY and READ RECORD can be issued before PIN he SIM is blocked (after three failed PIN authentication and if t the contents of the Elementary authentication attempts) to access Files. Note: use only decimal numbers for parameters , . and , , Test command returns the result code OK AT+CRSM=? Reference GSM 07.07, GSM 11.11 3.7.2.4.14 +CALM - Alert Sound Mode +CALM - Alert Sound Mode Set command is used to select the general alert sound mode of the device. AT+CALM= Parameter: 0 - normal mode 1 - silent mode; no sound will be generated by the device, except for alarm sound 2 - stealth mode; no sound will be generated by the device Note: if silent mode is selected then incoming calls will not produce alerting . sounds but only the unsolicited messages RING or +CRING . Read command returns the current value of parameter AT+CALM? Test command returns the supported values for the parameter as AT+CALM=? compound value. +CALM: (0-2) Reference GSM 07.07 Ringer Sound Level 3.7.2.4.15 +CRSL - +CRSL - Ringer Sound Level page 492 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

493 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CRSL - Ringer Sound Level Set command is used to select the incoming call ringer sound level of the AT+CRSL= device. Parameter: - ringer sound level 0 - Off 1 - low 2 - middle 3 - high 4 - progressive setting of the call ringer in the Read command reports the current AT+CRSL? format: +CRSL: Test command reports supported values as compound value. AT+CRSL=? +CRSL: (0-4) Reference GSM 07.07 3.7.2.4.16 +CLVL - Loudspeaker Volume Level +CLVL - Loudspeaker Volume Level Set command is used to select the volume of the internal loudspeaker audio AT+CLVL= output of the device. Parameter: - loudspeaker volume 0.. max - the value of max can be read by issuing the Test command AT+CLVL=? Read command reports the current setting of the loudspeaker AT+CLVL? volume in the format: +CLVL: supported values range in the format: Test command reports AT+CLVL=? +CLVL: (0- max ) Reference GSM 07.07 3.7.2.4.17 +CMUT - Microphone Mute Control +CMUT - Microphone Mute Control Set command enables/disables the muting of the microphone audio line AT+CMUT= during a voice call. Parameter: page 493 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

494 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 0 - mute off, microphone active (factory default) 1 - mute on, microphone muted. Note: this command mutes/activates both microphone audio paths, internal mic and external mic. Read command reports whether the muting of the microphone audio line AT+CMUT? during a voice call is enabled or not, in the format: +CMUT: parameter. Test command reports the supported values for AT+CMUT=? Reference GSM 07.07 +CACM - Ac 3.7.2.4.18 cumulated Call Meter +CACM - Accumulated Call Meter Set command resets the Advice of Charge related Accumulated Call Meter AT+CACM= in SIM (ACM). Internal memory CCM remains unchanged. [] Parameter: - to access this command PIN2 password is required Read command reports the current value of the SIM ACM in the format: AT+CACM? +CACM: Note: the value is in units whose price and currency is defined with command +CPUC Test command returns the result code OK AT+CACM=? Reference GSM 07.07 lated Call Meter Maximum 3.7.2.4.19 +CAMM - Accumu +CAMM - Accumulated Call Meter Maximum Set command sets the Advice of Charge related Accumulated Call Meter AT+CAMM= command). This value +CACM ACM maximum value in SIM (see also [, represents the maximum number of home units allowed to be consumed by ] the subscriber. When ACM reaches value further calls are prohibited. SIM PIN2 is required to set the value. Parameter: - maximum number of units allowed to be consumed - PIN2 password = 0 value disables the feature. Note: The Read command reports the maximum value of ACM stored in SIM in the AT+CAMM? format: +CAMM : page 494 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

495 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 result code OK Test command returns the AT+CAMM=? Reference GSM 07.07 3.7.2.4.20 +CPUC - Price Pe r Unit And Currency Table +CPUC - Price Per Unit And Currency Table Set command sets the values of Advice of Charge related price per unit and AT+CPUC= currency table in SIM. The price per unit currency table information can be , +CACM , used to convert the home units (as used in commands +CAOC , ) into currency units. +CAMM and Parameters: - string type; three-character currency code (e.g. “LIT”, “L. “, “USD”, “DEM” etc..); used character set should be the one selected with command . +CSCS - price per unit string (dot is used as decimal separator) e.g. 1989.27 - SIM PIN2 is usually required to set the values Read command reports the current values of and AT+CPUC? parameters in the format: , +CACM : result code OK Test command returns the AT+CPUC=? Reference GSM 07.07 ailable AT Commands 3.7.2.4.21 +CLAC - Av +CLAC - Available AT Commands Execution command causes the ME to return the AT commands that are AT+CLAC available for the user, in the following format: [[...]] ERROR result code Test command returns AT+CLAC=? Reference GSM 07.07 page 495 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

496 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.5 Mobile Equipment Errors 3.7.2.5.1 +CMEE - Report Mobile Equipment Error +CMEE - Report Mobile Equipment Error Set command enables/disables the report of result code: AT+CMEE=[] +CME ERROR: as an indication of an error relating to the + Cxxx commands issued. When enabled, device related errors cause the +CME ERROR: final is result code instead of the default ERROR final result code. ERROR anyway returned normally when the error message is related to syntax, invalid parameters, or functionality. DTE Parameter: - enable flag reports, use only 0 - disable +CME ERROR: ERROR report. 1 - enable +CME ERROR: reports, with in numeric format in verbose format reports, with 2 - enable +CME ERROR: Read command returns the current value of subparameter : AT+CMEE? +CMEE: Test command returns the range of values for subparameter AT+CMEE=? Reference GSM 07.07 page 496 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

497 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.6 Voice Control 3.7.2.6.1 +VTS - DTMF Tones Transmission +VTS - DTMF Tones Transmission Execution command allows the transmission of DTMF tones. AT+VTS= Parameters: [,duration] - string of s, i.e. ASCII characters in the set (0-9), ; it allows the user to send a sequence of DTMF tones, each #,*,(A-D) of them with a duration that was defined through +VTD command. - duration of a tone in 1/100 sec.; this parameter can be specified only if the length of first parameter is just one ASCII character 0 - a single DTMF tone will be transmitted for a duration depending on the network, no matter what the current +VTD setting is. (in 1..255 - a single DTMF tone will be transmitted for a time setting is. +VTD 10 ms multiples), no matter what the current Note: this commands operates in voice mode only (see +FCLASS ). s Test command provides the list of supported and the list of AT+VTS=? in the format: supported s (list of supported s)[,(list of supported s)] Reference GSM 07.07 and TIA IS-101 3.7.2.6.2 +VTD - Tone Duration +VTD - Tone Duration command. +VTS Set command sets the length of tones transmitted with AT+VTD= Parameter: - duration of a tone 0 - the duration of every single tone is dependent on the network (factory default) 1..255 - duration of every single tone in 1/10 sec. Read command reports the current Tone Duration, in the format: AT+VTD? in the format: s Test command provides the list of supported AT+VTD=? (list of supported s) GSM 07.07 and TIA IS-101 Reference page 497 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

498 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.7 Commands For GPRS 3.7.2.7.1 +CGCLASS - GPRS Mobile Station Class +CGCLASS - GPRS mobile station class parameter. Set command sets the GPRS class according to AT+CGCLASS= [] Parameter: - GPRS class “B” - GSM/GPRS (factory default) “CG” - class C in GPRS only mode (GPRS only) “CC” - class C in circuit switched only mode (GSM only) Note: the setting is saved in NVM (and available on following reboot). Read command returns the current value of the GPRS class in the format: AT+CGCLASS? +CGLASS: Test command reports the range for the parameter AT+CGCLASS=? 3.7.2.7.2 +CGATT - GPRS Attach Or Detach +CGATT - GPRS Attach Or Detach Execution command is used to attach the terminal to, or detach the terminal AT+CGATT=[ from, the GPRS service depending on the parameter . ] Parameter: - state of GPRS attachment 0 - detached 1 - attached Read command returns the current GPRS service state. AT+CGATT? Test command requests information on the supported GPRS service states. AT+CGATT=? Example AT+CGATT? +CGATT: 0 OK AT+CGATT=? +CGATT: (0,1) OK AT+CGATT=1 OK Reference GSM 07.07 page 498 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

499 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.7.3 +CGREG - GPRS Network Registration Status +CGREG - GPRS Network Registration Status Set command controls the presentation of an unsolicited result code AT+CGREG=[] +CGREG: (see format below) . Parameter: - result code presentation mode 0 - disable network registration unsolicited result code 1 - enable network registration unsolicited result code; if there is a change in the terminal GPRS network registration status, it is issued the unsolicited result code: +CGREG: where: - registration status 0 - not registered, terminal is not currently searching a new operator to register to 1 - registered, home network 2 - not registered, but terminal is currently searching a new operator to register to 3 - registration denied 4 - unknown 5 - registered, roaming 2 - enable network registration and location information unsolicited result code; if there is a change of the network cell, it is issued the unsolicited result code: +CGREG: [,,] where: - registration status (see above for values) - location area code in hexadecimal format (e.g. "00C3" equals 195 in decimal) - cell ID in hexadecimal format. and Read command returns the status of result code presentation mode AT+CGREG? the integer which shows whether the network has currently indicated the registration of the terminal in the format: +CGREG: , Test command returns supported values for parameter AT+CGREG=? Reference GSM 07.07 page 499 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

500 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.7.4 +CGDCONT - Define PDP Context +CGDCONT - Define PDP Context Set command specifies PDP context parameter values for a PDP context AT+CGDCONT= identified by the (local) context identification parameter, [ [, Parameters: [, - (PDP Context Identifier) numeric parameter which specifies a [, particular PDP context definition. [, 1.. - where the value of max max is returned by the Test command [, - (Packet Data Protocol type) a string parameter which [, specifies the type of packet data protocol [,...[,pdN]]]]]]]]] "IP" - Internet Protocol "PPP" - Point to Point Protocol - (Access Point Name) a string parameter which is a logical name that is used to select the GGSN or the external packet data network. If the value is null or omitted, then the subscription value will be requested. - a string parameter that identifies the terminal in the address space applicable to the PDP. The allocated address may be command. +CGPADDR read using the - numeric parameter that controls PDP data compression 0 - off (default if value is omitted) 1 - on - numeric parameter that controls PDP header compression 0 - off (default if value is omitted) 1 - on , ..., - zero to N string parameters whose meanings are specific to the , causes the Note: a special form of the Set command, +CGDCONT= to become undefined. values for context number Read command returns the current settings for each defined context in the AT+CGDCONT? format: +CGDCONT: , ,,,, [,[,...[,pdN]]][+CGDCONT: , ,,,, [,[,...[,pdN]]][...]] Test command returns values supported as a compound value AT+CGDCONT=? AT+CGDCONT=1,”IP”, ”APN” ,”10.10.10.10”,0,0 Example OK AT+CGDCONT? +CGDCONT: 1,”IP”,“ ,”10.10.10.10”,0,0 APN” OK AT+CGDCONT=? +CGDCONT: (1-5),”IP”,,,(0-1),(0-1) page 500 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

501 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGDCONT - Define PDP Context OK Reference GSM 07.07 ice Profile (Minimum Acceptable) 3.7.2.7.5 +CGQMIN - Quality Of Serv +CGQMIN - Quality Of Service Profile (Minimum Acceptable) Set command allows to specify a minimum acceptable profile which is AT+CGQMIN= checked by the terminal against the negotiated profile returned in the [ Activate PDP Context Accept message. [, [, Parameters: [, +CGDCONT - PDP context identification (see command). [, - precedence class [,]]]]]] - delay class - reliability class - peak throughput class - mean throughput class If a value is omitted for a particular class then this class is not checked. Note: a special form of the Set command, +CGQMIN= causes the to become undefined. requested profile for context number Read command returns the current settings for each defined context in the AT+CGQMIN? format: +CGQMIN: ,,,,, [+CGQMIN: ,, ,,,[...]] If no PDP context has been defined, it has no effect and OK result code is returned. Test command returns as a compound value the type of the current PDP AT+CGQMIN=? context and the supported values for the subparameters in the format: +CGQMIN: ,(list of supported s), (list of supported s),(list of supported s), (list of supported s),(list of supported s) Note: only the “IP” PDP_Type is currently supported. Example AT+CGQMIN=1,0,0,3,0,0 OK AT+CGQMIN? +CGQMIN: 1,0,0,5,0,0 page 501 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

502 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGQMIN - Quality Of Service Profile (Minimum Acceptable) OK AT+CGQMIN=? +CGQMIN: “IP”,(0-3),(0-4),(0-5),(0-9),(0-19,31) OK Reference GSM 07.07; GSM 03.60 3.7.2.7.6 +CGQREQ - Quality Of Service Profile (Requested) +CGQREQ - Quality Of Service Profile (Requested) Set command allows to specify a Quality of Service Profile that is used AT+CGQREQ= when the terminal sends an Activate PDP Context Request message to the [ network. It specifies a profile for the context identified by the (local) context [, . identification parameter, [, [, Parameters: [, command). +CGDCONT - PDP context identification (see [,]]]]]] - precedence class - delay class - reliability class - peak throughput class - mean throughput class If a value is omitted for a particular class then this class is not checked. causes the Note: a special form of the Set command, +CGQREQ= to become undefined. requested profile for context number Read command returns the current settings for each defined context in the AT+CGQREQ? format: +CGQREQ: ,,,,, [+CGQREQ: ,, ,,,[...]] OK result code is If no PDP context has been defined, it has no effect and returned. Test command returns as a compound value the type of the current PDP AT+CGQREQ=? context and the supported values for the subparameters in the format: +CGQREQ: ,(list of supported s), (list of supported s),(list of supported s), (list of supported s),(list of supported s) Note: only the “IP” PDP_Type is currently supported. Example AT+CGQREQ? written authorization - All Right reserved page 502 of 614 Reproduction forbidden without Telit Communications S.p.A.

503 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGQREQ - Quality Of Service Profile (Requested) +CGQREQ: 1,0,0,3,0,0 OK AT+CGQREQ=1,0,0,3,0,0 OK AT+CGQREQ=? +CGQREQ: ”IP”,(0-3),(0-4),(0-5),(0-9),(0-19,31) OK Reference GSM 07.07; GSM 03.60 3.7.2.7.7 +CGACT - PDP Context Activate Or Deactivate +CGACT - PDP Context Activate Or Deactivate Execution command is used to activate or deactivate the specified PDP AT+CGACT= context(s) [[, [,[,...]]]] Parameters: - indicates the state of PDP context activation 0 - deactivated 1 - activated - a numeric parameter which specifies a particular PDP context definition (see +CGDCONT command) Note: if no s are specified the activation/deactivation form of the command activates/deactivates all defined contexts. Read command returns the current activation state for all the defined PDP AT+CGACT? contexts in the format: +CGACT: ,[+CGACT: ,[...]] Test command reports information on the supported PDP context activation AT+CGACT=? states parameters in the format: +CGACT: (0,1) AT+CGACT=1,1 Example OK AT+CGACT? +CGACT: 1,1 OK Reference GSM 07.07 page 503 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

504 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.7.8 +CGPADDR - Show PDP Address +CGPADDR - Show PDP Address Execution command returns a list of PDP addresses for the specified AT+CGPADDR= context identifiers in the format: [[, [,...]]] +CGPADDR: ,[< CR>+CGPADDR: , [...]] Parameters: - a numeric parameter which specifies a particular PDP context is specified, the definition (see +CGDCONT command). If no addresses for all defined contexts are returned. - a string that identifies the terminal in the address space applicable to the PDP. The address may be static or dynamic. For a static address, it will be the one set by the command when the context was defined. For a +CGDCONT dynamic address it will be the one assigned during the last PDP context activation that used the context definition is omitted if none is referred to by ; available Test command returns a list of defined s. AT+CGPADDR=? Example AT#GPRS=1 +IP: xxx.yyy.zzz.www OK AT+CGPADDR=1 +CGPADDR: 1,”xxx.yyy.zzz.www” OK AT+CGPADDR=? +CGPADDR: (1) OK Reference GSM 07.07 3.7.2.7.9 +CGDATA - Enter Data State +CGDATA - Enter Data State Execution command causes to perform whatever actions are necessary to AT+CGDATA= establish a communication with the network using one or more GPRS PDP [,[ types. [,[,...]]]] Parameters: - string parameter that indicates the layer 2 protocol to be used "PPP" - PPP Point-to-point protocol page 504 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

505 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CGDATA - Enter Data State - numeric parameter which specifies a particular PDP context command). +CGDCONT definition (see is omitted, the layer 2 protocol is unspecified Note: if parameter Test command reports information on the supported layer 2 protocols. AT+CGDATA=? AT+CGDATA=? Example +CGDATA: (”PPP”) OK AT+CGDATA=”PPP”,1 OK Reference GSM 07.07 page 505 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

506 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.2.8 Commands For Battery Charger 3.7.2.8.1 +CBC - Battery Charge CBC - Battery Charge + Execution command returns the current Battery Charge status in the format: AT+CBC +CBC: , where: - battery status 0 - ME is powered by the battery 1 - ME has a battery connected, and charger pin is being powered 2 - ME does not have a battery connected 3 - Recognized power fault, calls inhibited - battery charge level ME does not have a battery connected 0 - battery is exhausted, or 25 - battery charge remained is estimated to be 25% 50 - battery charge remained is estimated to be 50% 75 - battery charge remained is estimated to be 75% 100 - battery is fully charged. Note: =1 indicates that the battery charger supply is inserted and the ME battery is being recharged if necessary with it. Supply for operations is taken anyway from VBATT pins. Note: without battery/power connected on VBATT pins or during a power =3 will and fault the unit is not working, therefore values =2 never appear. Test command returns parameter values supported as a compound value. AT+CBC=? +CBC: (0-3),(0-100) Note: although +CBC is an execution command, ETSI 07.07 requires the Test command to be defined. Example AT+CBC +CBC: 0,75 OK does not make differences between being powered by a battery or Note The ME pins, so it is not possible to distinguish VBATT by a power supply on the between these two cases. Reference GSM 07.07 page 506 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

507 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.3 ETSI GSM 07.05 AT Commands for SMS and CB services 3.7.3.1 General Configuration 3.7.3.1.1 +CSMS - Select Message Service +CSMS - Select Message Service Set command selects messaging service . It returns the types of AT+CSMS= : messages supported by the ME Parameter: 0 - The syntax of SMS AT commands is compatible with GSM 07.05 Phase 2 version 4.7.0 (factory default) 1 - The syntax of SMS AT commands is compatible with GSM 07.05 Phase 2+. ME Set command returns the types of messages supported by the : +CSMS: ,, where: - mobile terminated messages support 0 - type not supported 1 - type supported - mobile originated messages support 0 - type not supported 1 - type supported - broadcast type messages support 0 - type not supported 1 - type supported Read command reports current service setting along with supported AT+CSMS? message types in the format: +CSMS: ,,, where: - messaging service (see above) - mobile terminated messages support (see above) - mobile originated messages support (see above) - broadcast type messages support (see above) Test command reports the supported value of the parameter . AT+CSMS=? Reference GSM 07.05; GSM 03.40; GSM 03.41 page 507 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

508 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.3.1.2 +CPMS - Preferred Message Storage +CPMS - Preferred Message Storage and , Set command selects memory storages AT+CPMS= to be used for reading, writing, sending and storing SMs. [, Parameters: [,]] - memory from which messages are read and deleted "SM" - SIM SMS memory storage "ME" - ME internal storage (read only, no delete) - memory to which writing and sending operations are made "SM" - SIM SMS memory storage - memory to which received SMs are preferred to be stored "SM" - SIM SMS memory storage The command returns the memory storage status in the format: +CPMS: ,,,,, where: - number of SMs stored into can contain - max number of SMs that - number of SMs stored into max number of SMs that can contain - number of SMs stored into - max number of SMS that can contain Note: The only supported memory storage for writing and sending SMs is the SIM internal memory "SM", so =="SM" . Note: the received class 0 SMS are stored in the "ME" memory regardless setting and they are automatically deleted at power off. the Read command reports the message storage status in the format: AT+CPMS? +CPMS: ,,,,,, ,, are the selected storage memories where , and for reading, writing and storing respectively. Test command reports the supported values for parameters , AT+CPMS=? and Example AT+CPMS? +CPMS: "SM",5,10,"SM",5,10,"SM",5,10 OK (you have 5 out of 10 SMS SIM positions occupied) Reference GSM 07.05 page 508 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

509 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.3.1.3 +CMGF - Message Format +CMGF - Message Format Set command selects the format of messages used with send, list, read and AT+CMGF= write commands. [] Parameter: 0 - PDU mode, as defined in GSM 3.40 and GSM 3.41 (factory default) 1 - text mode . Read command reports the current value of the parameter AT+CMGF? parameter. Test command reports the supported value of AT+CMGF=? Reference GSM 07.05 page 509 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

510 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.3.2 Message Configuration 3.7.3.2.1 +CSCA - Service Center Address +CSCA -Service Center Address Set command sets the Service Center Address to be used for mobile AT+CSCA= originated SMS transmissions. [,] Parameter: - SC phone number in the format defined by - the type of number 129 - national numbering scheme 145 - international numbering scheme (contains the character " + ") Note: to use the SM service, is mandatory to set a Service Center Address at which service requests will be directed. Note: in Text mode, this setting is used by send and write commands; in PDU mode, setting is used by the same commands, but only when the length of the SMSC address coded into the parameter equals zero. Read command reports the current value of the SCA in the format: AT+CSCA? +CSCA: , Note: if SCA is not present the device reports an error message. Test command returns the OK result code. AT+CSCA=? Reference GSM 07.05 3.7.3.2.2 +CSMP - Set T ext Mode Parameters +CSMP - Set Text Mode Parameters Set command is used to select values for additional parameters for storing AT+CSMP= ) and sending SMs when the text mode is used ( AT+CMGF=1 [ [, Parameters: [, - depending on the command or result code: [,]]]] first octet of GSM 03.40 SMS-DELIVER, SMS-SUBMIT (default 17), SMS-STATUS-REPORT, or SMS-COMMAND (default 2) in integer format. - depending on SMS-SUBMIT setting: GSM 03.40 TP-Validity-Period either in integer format (default 167) or in quoted time-string format - GSM 03.40 TP-Protocol-Identifier in integer format. - depending on the command or result code: ( Scheme , or Cell ) default 0 g GSM 03.38 SMS Data Codin page 510 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

511 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSMP - Set Text Mode Parameters Broadcast Data Coding Scheme Read command reports the current setting in the format: AT+CSMP? +CSMP: < fo>,,, Test command returns the OK result code. AT+CSMP=? Example Set the parameters for an outgoing message with 24 hours of validity period and default properties: AT+CSMP=17,167,0,0 OK GSM 07.05; GSM 03.40; GSM 03.38 Reference 3.7.3.2.3 +CSDH - Show Text Mode Parameters +CSDH - Show Text Mode Parameters Set command controls whether detailed header information is shown in text AT+CSDH= mode ( AT+CMGF=1 ) result codes. [] Parameter: +CSCA and +CSMP 0 - do not show header values defined in commands , , ( , , , ) nor and +CMGL in +CMT , or , +CMGR result codes for SMS-DELIVERs ode. For SMS-COMMANDs in and SMS-SUBMITs in text m +CMGR or result code do not show , , , , 1 - show the values in result codes Read command reports the current setting in the format: AT+CSDH? +CSDH: Test command reports the supported range of values for parameter AT+CSDH=? Reference GSM 07.05 3.7.3.2.4 +CSCB - Select Cell Broadcast Message Types +CSCB -Select Cell Broadcast Message Types Set command selects which types of Cell Broadcast Messages are to be AT+CSCB= received by the device. [[, [,]]] Parameters: and are accepted 0 - the message types defined by (factory default) page 511 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

512 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CSCB -Select Cell Broadcast Message Types and are rejected 1 - the message types defined by - Message Identifiers, string type: all different possible combinations of the CBM message identifiers; default is empty string (“”). - Data Coding Schemes, string type: all different possible combinations of CBM data coding schemes; default is empty string (“”). Read command reports the current value of parameters , AT+CSCB? . and . Test command returns the range of values for parameter AT+CSCB=? AT+CSCB? Example +CSCB: 1,"","" (all CBMs are accepted, none is rejected) OK AT+CSCB=0,"0,1,300-315,450","0-3" OK Reference GSM 07.05, GSM 03.41, GSM 03.38. 3.7.3.2.5 +CSAS - Save Settings +CSAS - Save Settings +CSC which have been made by the Execution command saves settings A AT+CSAS and +CSCB +CSMP commands in local non volatile memory. [=] Parameter: 0 - it saves the settings to NVM (factory default). 1..n - SIM profile number; the value of n depends on the SIM and its max is 3. Note: certain settings may not be supported by the SIM and therefore they are always saved to NVM, regardless the value of . Note: If parameter is omitted the settings are saved in the non volatile memory. Test command returns the possible range of values for the parameter AT+CSAS=? . Reference GSM 07.05 page 512 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

513 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.3.2.6 +CRES - Restore Settings +CRES - Restore Settings +CSAS Execution command restores message service settings saved by AT+CRES command from either NVM or SIM. [=] Parameter: 0 - it restores message service settings from NVM. 1..n - it restores message service settings from SIM. The value of n depends on the SIM and its max is 3. Note: certain settings may not be supported by the SIM and therefore they are always restored from NVM, regardless the value of . Note: If parameter is omitted the command restores message service settings from NVM. Test command returns the possible range of values for the parameter AT+CRES=? . Reference GSM 07.05 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 513 of 614

514 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.3.3 Message Receiving And Reading 3.7.3.3.1 +CNMI - New Message Indi cations To Terminal Equipment +CNMI - New Message Indications To Terminal Equipment Set command selects the behaviour of the device on how the receiving of AT+CNMI=[ . DTE new messages from the network is indicated to the [, [,[, Parameter: [,]]]]] - unsolicited result codes buffering option 0 - Buffer unsolicited result codes in the TA . If TA result code buffer is full, indications can be buffered in some other place or the oldest indications may be discarded and replaced with the new received indications. 1 - Discard indication and reject new received message unsolicited result codes when TA-TE link is reserved, otherwise forward them directly to . TE the DTE 2 - Buffer unsolicited result codes in the TA in case the is busy and flush them to the TE after reservation. Otherwise forward them directly to the TE. 3 - if is set to 1 an indication via 100 ms break is issued when a SMS is received while the module is in GPRS online mode. It enables the hardware ring line for 1 s. too. - result code indication reporting for SMS-DELIVER 0 - No SMS-DELIVER indications are routed to the TE. 1 - If SMS-DELIVER is stored into ME/TA, indication of the memory location is routed to the TE using the following unsolicited result code: +CMTI: , where: - memory storage where the new message is stored "SM" "ME" - location on the memory where SMS is stored. 2 - SMS-DELIVERs (except class 2 messages and messages in the message waiting indication group) are routed directly to the TE using the following unsolicited result code: (PDU Mode) +CMT: [], where: - alphanumeric representation of originator/destination number corresponding to the entry found in MT phonebook ; used character set should be the one selected with +CSCS command . - PDU length - PDU message page 514 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

515 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment (TEXT Mode) +CMT:,, [,,,,, ,,] (the information written in italics will be present depending on last setting) +CSDH where: - originator address number, represented in the currently selected character set (see +CSCS ) - alphanumeric representation of or ; used character set should be the one selected with command . +CSCS - arrival time of the message to the SC , - type of number or : 129 - number in national format 145 - number in international format (contains the " + ") - first octet of GSM 03.40 - Protocol Identifier < - Data Coding Scheme > dcs - Service Centre number - text length - TP-User-Data • If indicates that GSM03.38 default alphabet is used and indicates that GSM03.40 TP-User-Data-Header-Indication is not set (bit 6 of is 0), each character of GSM alphabet will be converted into current TE character set (see +CSCS ) • If indicates that 8-bit or UCS2 data coding scheme is used indicates that GSM03.40 TP-User-Data-Header- or Indication is set (bit 6 of is 1), each 8-bit octet will be converted into two IRA character long hexadecimal number (e.g. octet 0x2A will be converted as two characters 0x32 0x41) Class 2 messages and messages in the message waiting indication group (stored message) result in indication as defined in =1 . 3 - Class 3 SMS-DELIVERs are routed directly to TE using unsolicited result codes defined in =2 . Messages of other data coding schemes result in indication as defined in =1 . - broadcast reporting option 0 - Cell Broadcast Messages are not sent to the DTE 2 - New Cell Broadcast Messages are sent to the DTE with the unsolicited result code: (PDU Mode) +CBM: where: - PDU length - message PDU page 515 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

516 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment (TEXT Mode) +CBM:,,,, where: - message serial number - message ID - Data Coding Scheme - page number - total number of pages of the message - CBM Content of Message • If indicates that GSM03.38 default alphabet is used , each character of GSM alphabet will be converted into current TE character set (see +CSCS ) If indicates that 8-bit or UCS2 data coding scheme is • used, each 8-bit octet will be converted into two IRA character long hexadecimal number (e.g. octe t 0x2A will be converted as two characters 0x32 0x41) - SMS-STATUS-REPORTs reporting option 0 - status report receiving is not reported to the DTE 1 - the status report is sent to the DTE with the following unsolicited result code: (PDU Mode) +CDS: where: - PDU length - message PDU (TEXT Mode) +CDS: ,,,,,

, where: - first octet of the message PDU - message reference number - arrival time of the message to the SC - sending time of the message
- message status as coded in the PDU 2 - if a status report is stored, then the following unsolicited result code is sent: +CDSI: , where: - memory storage where the new message is stored "SM" - location on the memory where SMS is stored - buffered result codes handling method: page 516 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

517 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CNMI - New Message Indications To Terminal Equipment TA 0 - buffer of unsolicited result codes defined within this command is flushed to the TE when =1..3 is entered ( OK response shall be given before flushing the codes) 1 - TA buffer of unsolicited result codes defined within this command is cleared when is entered. =1..3 Read command returns the current parameter settings for +CNMI command AT+CNMI? in the form: +CNMI: ,,,, Test command reports the supported range of values for the +CNMI AT+CNMI=? command parameters. Reference GSM 07.05 Note DTR signal is ignored, hence the indication is sent even if the DTE is Low signal is DTR inactive ( ). In this case the unsolicited result code may is not, at DTE startup is DTE be lost so if MODULE remains active while suggested to check whether new messages have reached the device that lists the new messages meanwhile with command AT+CMGL=0 received. 3.7.3.3.2 +CMGL - List Messages +CMGL - List Messages Execution command reports the list of all the messages with status value AT+CMGL message storage ( is the message stored into [=] storage for read and delete SMs as last settings of command ). +CPMS The parameter type and the command output depend on the last settings of command +CMGF (message format to be used) (PDU Mode) Parameter: 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent 4 - all messages. Each message to be listed is represented in the format: +CMGL: ,,, where: - message position in the memory storage list. - status of the message page 517 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

518 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGL - List Messages - string type alphanumeric representation of , or corresponding to an entry found in the phonebook; used character set is the one selected with command +CSCS . - length of the PDU in bytes - message in PDU format according to GSM 3.40 (Text Mode) Parameter: "REC UNREAD" - new message "REC READ" - read message "STO UNSENT" - stored message not yet sent "STO SENT" - stored message already sent "ALL" - all messages. Each message to be listed is represented in the format (the information written in italics will be present depending on +CSDH last setting): +CMGL: ,,,, [,, ] where - message position in the storage - message status - originator/destination number, represented in the currently +CSCS selected character set (see ) - string type alphanumeric representation of or , corresponding to an entry found in the phonebook; used character set is the one selected with command +CSCS . - TP-Service Centre Time Stamp in Time String Format - type of number 129 - number in national format 145 - number in international format (contains the " + ") - text length - TP-User-Data • If indicates that GSM03.38 default alphabet is used , each character of GSM alphabet will be converted into current TE character set (see +CSCS ) indicates that 8-bit or UCS2 data coding scheme is used, • If each 8-bit octet will be converted into two IRA character long 2A will be converted as two hexadecimal number (e.g. octet 0x characters 0x32 0x41) Each message delivery confirm is represented in the format : page 518 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

519 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGL - List Messages +CMGL: ,,,,,,,

, where - message position in the storage - message status - first octet of the message PDU - message reference number - arrival time of the message to the SC
- sending time of the message - message status as coded in the PDU Note: result code is sent at the end of the listing. OK Note: If parameter is omitted the command returns the list of sms with “ REC UNREAD ” status . Test command returns a list of supported s AT+CMGL=? Reference GSM 07.05 3.7.3.3.3 +CMGR - Read Message +CMGR - Read Message from Execution command reports the message with location value AT+CMGR= message storage ( is the message storage for read and +CPMS ). delete SMs as last settings of command Parameter: - message index. The output depends on the last settings of command +CMGF (message format to be used) (PDU Mode) The output has the following format: +CMGR: ,, where - status of the message 0 - new message 1 - read message 2 - stored message not yet sent 3 - stored message already sent - string type alphanumeric representation of or , found in the to an entr y honebook; used p g p ondin corres page 519 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

520 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGR - Read Message character set is the one selected with command +CSCS . - length of the PDU in bytes. - message in PDU format according to GSM 3.40. The status of the message and entire message data unit is returned. (Text Mode) Output format for received messages (the information written in italics will be present depending on +CSDH last setting) : [,,,, +CMGR: ,,, ,,,] Output format for sent messages: [,,,,,, +CMGR: ,, ,,] Output format for message delivery confirm: +CMGR: ,,,,,,

, where: - status of the message "REC UNREAD" - new received message unread "REC READ" - received message read "STO UNSENT" - message stored not yet sent "STO SENT" - message stored already sent - first octet of the message PDU - message reference number - arrival time of the message to the SC - sending time of the message
- message status as coded in the PDU - Protocol Identifier - Data Coding Scheme - Originator address number, represented in the currently selected character set (see +CSCS ) - Destination address number, represented in the currently selected ) character set (see +CSCS , - string type alphanumeric representation of or corresponding to an entry found in the phonebook; used character set is the one selected with command +CSCS . NB: this optional field is currently not supported. - Service Centre number , , - type of number , , 129 - number in national format ") + 145 - number in international format (contains the " - text length page 520 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

521 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGR - Read Message - TP-User_data indicates that GSM03.38 default alphabet is used , each • If character of GSM alphabet will be converted into current TE character set (see ) +CSCS • If indicates that 8-bit or UCS2 data coding scheme is used, each 8-bit octet will be converted into two IRA character long 2A will be converted as two hexadecimal number (e.g. octet 0x characters 0x32 0x41) Note: in both cases if status of the message is 'received unread', status in the storage changes to 'received read'. . Note: an error result code is sent on empty record result code OK Test command returns the AT+CMGR=? Reference GSM 07.05 page 521 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

522 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.3.4 Message Sending And Writing 3.7.3.4.1 +CMGS - Send Message +CMGS - Send Message (PDU Mode) (PDU Mode) Execution command sends to the network a message. AT+CMGS= Parameter: - length of the PDU to be sent in bytes. 7..164 The device responds to the command with the prompt '>' and waits for the specified number of bytes. To send the message issue Ctrl-Z char ( 0x1A hex). 0x1B hex). char ( ESC To exit without sending the message issue If message is successfully sent to the network, then the result is sent in the format: +CMGS: where - message reference number. Note: if message sending fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, which may take several seconds, no other SIM interacting commands are issued. (Text Mode) (Text Mode) Execution command sends to the network a message. AT+CMGS= [,] Parameters: - destination address number, represented in the currently selected ). +CSCS character set (see - type of destination address 129 - number in national format 145 - number in international format (contains the " + ") > The device responds to the command with the prompt ' ' and waits for message text (max 160 characters). To send the message issue Ctrl-Z char ( 0x1A hex). 0x1B hex). ESC char ( To exit without sending the message issue page 522 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

523 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGS - Send Message If message is successfully sent to the network, then the result is sent in the format: +CMGS: where - message reference number. Note: if message sending fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, which may take several seconds, no other SIM interacting commands are issued. OK result code. Test command resturns the AT+CMGS=? or Note To avoid malfunctions is suggested to wait for the +CMGS: +CMS ERROR: response before issuing further commands. Reference GSM 07.05 Message From Storage 3.7.3.4.2 +CMSS - Send +CMSS - Send Message From Storage Execution command sends to the network a message which is already AT+CMSS= storage (see stored in the . +CPMS ) at the location [, [,]] Parameters: of the message - location value in the message storage to send - destination address, represented in the currently selected character set (see +CSCS ); if it is given it shall be used instead of the one stored with the message. - type of destination address 129 - number in national format + ") 145 - number in international format (contains the " If message is successfully sent to the network then the result is sent in the format: +CMSS: where: - message reference number. If message sending fails for some reason, an error code is reported: +CMS ERROR: page 523 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

524 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMSS - Send Message From Storage +CMGW. storage see command Note: to store a message in the Note: care must be taken to ensure that during the command execution, which may take several seconds, no other SIM interacting commands are issued. OK result code. Test command resturns the AT+CMSS=? +CMS or Note To avoid malfunctions is suggested to wait for the +CMSS: ERROR: response before issuing further commands. Reference GSM 07.05 e Message To Memory 3.7.3.4.3 +CMGW - Writ +CMGW - Write Message To Memory (PDU Mode) (PDU Mode) Execution command writes in the memory storage a new AT+CMGW= message. [,] Parameter: - length in bytes of the PDU to be written. 7..164 - message status. 0 - new message 1 - read message 2 - stored message not yet sent (default) 3 - stored message already sent The device responds to the command with the prompt '>' and waits for the specified number of bytes. To write the message issue Ctrl-Z hex). 0x1A char ( To exit without writing the message issue char ( 0x1B hex). ESC If message is successfully written in the memory, then the result is sent in the format: +CMGW: where: - message location index in the memory . If message storing fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, no other SIM interacting commands are issued. (Text Mode) (Text Mode) page 524 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

525 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +CMGW - Write Message To Memory Execution command writes in the memory storage a new AT+CMGW[= message. [, [,]]] Parameters: - destination address number, represented in the currently selected character set (see +CSCS ). - type of destination address. 129 - number in national format + ") 145 - number in international format (contains the " - message status. "REC UNREAD" - new received message unread "REC READ" - received message read "STO UNSENT" - message stored not yet sent (default) "STO SENT" - message stored already sent ' and waits for the > The device responds to the command with the prompt ' message text (max 160 characters). To write the message issue Ctrl-Z char ( 0x1A hex). 0x1B To exit without writing the message issue ESC char ( hex). If message is successfully written in the memory, then the result is sent in the format: +CMGW: where: - message location index in the memory . If message storing fails for some reason, an error code is reported. Note: care must be taken to ensure that during the command execution, no other SIM interacting commands are issued. Test command returns the OK result code. AT+CMGW=? Reference GSM 07.05 To avoid malfunctions is suggested to wait for the or +CMGW: Note response before issuing further commands. +CMS ERROR: page 525 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

526 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.3.4.4 +CMGD - Delete Message +CMGD - Delete Message Execution command deletes from memory the message(s). AT+CMGD= Parameter: [,] - message index in the selected storage - an integer indicating multiple message deletion request. 0 (or omitted) - delete message specified in storage, leaving unread 1 - delete all read messages from messages and stored mobile originated messages (whether sent or not) untouched storage and sent mobile 2 - delete all read messages from originated messages, leaving unread messages and unsent mobile originated messages untouched 3 - delete all read messages from storage, sent and unsent mobile originated messages, leaving unread messages untouched 4 - delete all messages from storage. Note: if is present and not set to 0 then is ignored and ME shall follow the rules for shown above. Note: if the location to be deleted is empty, an error message is reported. Test command shows the valid memory locations and optionally the AT+CMGD=? . supported values of +CMGD: (supported s list)[,(supported s list)] AT+CMGD=? Example +CMGD: (1,2,3,6,7,17,18,19,20,37,38,39,47),(0-4) OK Reference GSM 07.05 page 526 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

527 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.4 FAX Class 1 AT Commands 3.7.4.1 General Configuration NOTE: All the test command results are without command echo 3.7.4.1.1 +FMI - Manufacturer ID +FMI - Manufacturer ID Read command reports the manufacturer ID. The output depends on the AT+FMI? choice made through command. #SELINT AT+FMI? Example Telit OK Reference ITU T.31 and TIA/EIA-578-A specifications 3.7.4.1.2 +FMM - Model Id +FMM - Model ID Read command reports the model ID AT+FMM? Reference ITU T.31 and TIA/EIA-578-A specifications 3.7.4.1.3 +FMR - Revision ID +FMR - Revision ID Read command reports the software revision ID AT+FMR? ITU T.31 and TIA/EIA-578-A specifications Reference page 527 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

528 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.4.2 Transmission/Reception Control Transmission And Pause 3.7.4.2.1 +FTS - Stop +FTS - Stop Transmission And Pause Execution command causes the modem to terminate a transmission and AT+FTS=

529 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.4.2.4 +FRM - Receive Data Modulation +FRM - Receive Data Modulation Execution command causes the module to receive facsimile data using the AT+FRM= modulation defined by the parameter . Parameter: - carrier modulation 24 - V27ter/2400 bps 48 - V27ter/4800 bps 72 - V29/7200 bps 96 - V29/9600 bps . Test command returns all supported values of the parameter AT+FRM=? Reference ITU T.31 and TIA/EIA-578-A specifications Data With HDLC Framing 3.7.4.2.5 +FTH - Transmit +FTH - Transmit Data With HDLC Framing Execution command causes the module to transmit facsimile data using AT+FTH= HDLC protocol and the modulation defined by the parameter . Parameter: - carrier modulation 3 - V21/300 bps . Test command returns all supported values of the parameter AT+FTH=? Reference ITU T.31 and TIA/EIA-578-A specifications 3.7.4.2.6 +FRH - Receive Data With HDLC Framing +FRH - Receive Data Data With HDLC Framing Execution command causes the module to receive facsimile data using AT+FRH= HDLC protocol and the modulation defined by the parameter . Parameter: - carrier modulation 3 - V21/300 bps Test command returns all supported values of the parameter . AT+FRH=? ITU T.31 and TIA/EIA-578-A specifications Reference page 529 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

530 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.4.3 Serial Port Control 3.7.4.3.1 +FLO - Select Flow Control Specified By Type +FLO - Select Flow Control Specified By Type Set command selects the flow control behaviour of the serial port in both AT+FLO= to directions: from DTE . DTA and from DTA to DTE Parameter: - flow control option for the data on the serial port 0 - flow control None 1 - flow control Software ( XON - XOFF ) - 2 - flow control Hardware ( CTS RTS ) – (factory default) Note: This command is a shortcut of the +IFC command. Note: +FLO’s settings are functionally a subset of &K’s ones. Read command returns the current value of parameter AT+FLO? Test command returns all supported values of the parameter . AT+FLO=? Reference ITU T.31 and TIA/EIA-578-A specifications 3.7.4.3.2 +FPR - Select Serial Port Rate +FPR - Select Serial Port Rate Set command selects the the serial port speed in both directions, from DTE AT+FPR= DTA and from to to DTE . When autobauding is selected, then the DTA speed is detected automatically. Parameter: - serial port speed selection 0 - autobauding Read command returns the current value of parameter AT+FPR? . Test command returns all supported values of the parameters AT+FPR=? Reference ITU T.31 and TIA/EIA-578-A specifications Character Replacement Control 3.7.4.3.3 +FDD - Double Escape +FDD - Double Escape Character Replacement Control Set command concerns the use of the pair to encode AT+FDD= consecutive escape characters ( <10h><10h> ) in user data. Parameter 0 - currentl available value. The decode of DCE is y the onl y page 530 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

531 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 +FDD - Double Escape Character Replacement Control <10h><10h> or discard. The DCE encode of either is Read command returns the current value of parameter AT+FDD? . Test command returns all supported values of parameter AT+FDD=? ITU T.31 and TIA/EIA-578-A specifications Reference page 531 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

532 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5 Custom AT Commands General Configuration AT Commands 3.7.5.1 3.7.5.1.1 #CGMI - Manufacturer Identification #CGMI - Manufacturer Identification Execution command returns the device manufacturer identification code AT#CGMI with command echo. The output depends on the choice made through command. #SELINT Test command returns the OK result code. AT#CGMI=? 3.7.5.1.2 #CGMM - Model Identification #CGMM - Model Identification Execution command returns the device model identification code with AT#CGMM command echo. Test command returns the OK result code. AT#CGMM=? 3.7.5.1.3 #CGMR - Revision Identification #CGMR - Revision Identification Execution command returns device software revision number with AT#CGMR command echo. Test command returns the OK result code. AT#CGMR=? 3.7.5.1.4 #CGSN - Product Serial Number Identification #CGSN - Product Serial Number Identification Execution command returns the product serial number, identified as the AT#CGSN IMEI of the mobile, with command echo. Test command returns the OK result code. AT#CGSN=? ile Subscriber Identity (IMSI) 3.7.5.1.5 #CIMI - International Mob #CIMI - International Mobile Subscriber Identity (IMSI) Execution command returns the international mobile subscriber identity, AT#CIMI identified as the IMSI number, with command echo. Test command returns the OK result code. AT#CIMI=? page 532 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

533 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.1.6 #CCID - Read ICCID (Integ rated Circuit Card Identification) #CCID - Read ICCID Execution command reads on SIM the ICCID (card identification number AT#CCID that provides a unique identification number for the SIM) result code. OK Test command returns the AT#CCID=? 3.7.5.1.7 #CAP - Change Audio Path #CAP - Change Audio Path Set command switches the active audio path depending on parameter AT#CAP=[] Parameter: - audio path 0 - audio path follows the Axe input (factory default): if Axe is low, handsfree is enabled; if Axe is high, internal path is enabled 1 - enables handsfree external mic/ear audio path 2 - enables internal mic/ear audio path Note: The audio path are mutually exclusive, enabling one disables the other. Note: when changing the audio path, the volume level is set at the previously stored value for that audio path (see ). +CLVL reports the active audio path in the format: Read command AT#CAP? . #CAP: Test command reports the supported values for the parameter . AT#CAP=? 3.7.5.1.8 #SRS - Select Ringer Sound #SRS - Select Ringer Sound Set command sets the ringer sound. AT#SRS= [,] Parameters: - ringing tone 0 - current ringing tone 1.. max - ringing tone number, where max can be read by issuing the Test command AT#SRS=? . - ringing tone playing time-out in seconds. 0 - ringer is stopped (if present) and current ringer sound is set. 1..60 - rin > 0, er seconds and, if g rin g er sound p la y in g for page 533 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

534 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SRS - Select Ringer Sound sound is set as default ringer sound. Note: when the command is issued with > 0 and > 0 , the ringing tone is played for seconds and stored as default ringing tone. Note: if command is issued with > 0 and = 0 , the playing of the ringing is stopped (if present) and ringing tone is set as current. Note: if command is issued with = 0 and > 0 then the current ringing tone is played. are and then the default ringing tone is set as 0 Note: if both current and ringing is stopped. Note: If all parameters are omitted then the behaviour of Set command is the same as Read command Read command reports current selected ringing and its status in the form: AT#SRS? #SRS: , where: - ringing tone number 1.. max - ringing status 0 - selected but not playing 1 - currently playing and Test command reports the supported values for the parameters AT#SRS=? 3.7.5.1.9 #SRP -Select Ringer Path #SRP - Select Ringer Path Set command selects the ringer path towards whom sending ringer sounds AT#SRP=[] and all signalling tones. Parameter: - ringer path number 0 - sound output towards current selected audio path (see #CAP command ) 1 - sound output towards handsfree 2 - sound output towards handset 3 - sound output towards Buzzer Output pin GPIO7 Note: In order to use the Buzzer Output an external circuitry must be page 534 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

535 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 added to drive it properly from the GPIO7 pin, furthermore the GPIO7 pin direction must be set to Buzzer output (Alternate function); see command #GPIO . Read command reports the selected ringer path in the format: AT#SRP? #SRP: . . Test command reports the supported values for the parameter AT#SRP=? AT#SRP=? Example #SRP: (0-3) OK AT#SRP=3 OK 3.7.5.1.10 #STM - Signalling Tones Mode #STM - Signalling Tones Mode Set command enables/disables the signalling tones output on the audio AT#STM= #SRP path selected with command [] Parameter: - signalling tones status 0 - signalling tones disabled 1 - signalling tones enabled AT#STM=1 ; has the Note: AT#STM=0 has the same effect as AT+CALM=2 same effect as AT+CALM=0 . Read command reports whether the current signaling tones status is AT#STM? enabled or not, in the format: #STM: Test command reports supported range of values for parameter . AT#STM=? 3.7.5.1.11 #PCT - Display PIN Counter #PCT - Display PIN Counter Execution command reports the PIN/PUK or PIN2/PUK2 input remaining AT#PCT requested password in the format: attempts, depending on +CPIN #PCT: where: - remaining attempts 0 - the SIM is blocked. 1..3 - if the device is waiting either SIM PIN or SIM PIN2 to be given. 1..10 - if the device is waiting either SIM PUK or SIM PUK2 to be given. Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 535 of 614

536 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Test command returns the OK result code. AT#PCT=? 3.7.5.1.12 #SHDN - Software Shut Down #SHDN - Software Shutdown Execution command causes device detach from the network and shut AT#SHDN OK down. Before definitive shut down an response is returned. Note: after the issuing of this command any previous activity is terminated and the device will not respond to any further command. Note: to turn it on again Hardware pin ON/OFF must be tied low. Test command returns the OK result code. AT#SHDN=? 3.7.5.1.13 #WAKE - Wa ke From Alarm Mode #WAKE - Wake From Alarm Mode Execution command stops any eventually present alarm activity and, if the AT#WAKE= , it exits the normal module is in alarm mode and enters the alarm mode [] . operating mode Parameter: - operating mode 0 - normal operating mode; the module exits the alarm mode , enters the normal operating mode , any alarm activity is stopped (e.g. alarm tone playing) and an OK result code is returned. Note: the power saving status is indicated by a CTS - OFF and DSR - OFF normal operating status . is indicated by DSR - ON status. The Note: during the alarm mode the device will not make any network scan and will not register to any network and therefore is not able to dial or receive any call or SM, the only commands that can be issued to the #WAKE and MODULE in this state are the , every other command #SHDN must not be issued during this state. Read command returns the operating status of the device in the format: AT#WAKE? #WAKE: where: 0 - normal operating mode 1 - alarm mode or normal operating mode with some alarm activity. page 536 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

537 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.1.14 #QTEMP -Query Temperature Overflow #QTEMP - Query Temperature Overflow Set command has currently no effect. The interpretation of parameter AT#QTEMP= value assigned to it will simply is currently not implemented: any [] have no effect. temperature sensor for over Read command queries the device internal AT#QTEMP? temperature and reports the result in the format: #QTEMP: where - over temperature indicator 0 - the device temperature is in the working range 1 - the device temperature is out of the working range . Test command reports supported range of values for parameter #QTEMP=? The device should not be operated out of its working temperature range, Note elsewhere proper functioning of the device is not ensured. 3.7.5.1.15 #GPIO - General Purp ose Input/Output Pin Control #GPIO - General Purpose Input/Output Pin Control Execution command sets the value of the general purpose output pin AT#GPIO=[, parameter.

GPIO and according to [,]] Not all configuration for the three parameters are valid. Parameters: - GPIO pin number; supported range is from 1 to a value that depends on the hardware, but GPIO1 is input only and GPIO2 is output only. - its meaning depends on setting: 0 - no meaning if =0 - INPUT - output pin cleared to 0 (LOW) if =1 - OUTPUT - no meaning if =2 - ALTERNATE FUNCTION 1 - no meaning if =0 - INPUT - output pin set to 1 (HIGH) if =1 - OUTPUT - no meaning if - ALTERNATE FUNCTION =2 2 - Reports the read value from the input pin if =0 - INPUT - Reports the read value from the input pin if =1 - OUTPUT - Reports a no meaning value if =2 - ALTERNATE FUNCTION - GPIO pin direction 0 - pin direction is INPUT 1 - pin direction is OUTPUT 2 - pin direction is ALTERNATE FUNCTION (see Note). Note: when =2 orts the p is omitted the command re ) ( and page 537 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

538 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #GPIO - General Purpose Input/Output Pin Control direction and value of pin GPIO in the format: #GPIO:

, where GPIO - current direction setting for the • GPIO in the case the pin is set logic value read from pin to input; • logic value present in output of the pin GPIO in the case the pin is currently set to output; • no meaning value for the pin GPIO in the case the pin is set to alternate function. ) since the reading is done after the insulating GPIO1 Note: (valid only for GPIO1 transistor, the reported value is the opposite of the logic status of the input pin Note: "ALTERNATE FUNCTION" value is valid only for following pins: • GPIO5 - alternate function is “RF Transmission Monitor” ) • GPIO6 - alternate function is "Alarm Output" (see +CALA • ) #SRP GPIO7 - alternate function is "Buzzer Output" (see Note: while using the pins in the alternate function, the GPIO read/write access to that pin is not accessible and shall be avoided. GPIO2 is an OPEN COLLECTOR output, the command sets the Note: The transistor base level, hence the open collector output is negated pins, in the Read command reports the read direction and value of all GPIO AT#GPIO? format: #GPIO: ,[#GPIO: ,[...]] where - as seen before - as seen before Test command reports the supported range of values of the command AT#GPIO=? , . parameters and AT#GPIO=3,0,1 Example OK AT#GPIO=3,2 #GPIO: 1,0 OK AT#GPIO=4,1,1 OK AT#GPIO=5,0,0 OK AT#GPIO=6,2 page 538 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

539 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #GPIO - General Purpose Input/Output Pin Control #GPIO: 0,1 OK 3.7.5.1.16 #I2S1 - Set PCM Output For Channel 1 #I2S1 - Set PCM Output For Channel 1 AT#I2S1= Set command sets the type of operation. [ [,, Parameters: ]] 0 - PCM1 is not enabled; audio is forwarded to the analog line; PCM pins can be used as UART1 and GPIO. 1 - PCM1 is enabled; audio is forwarded to the PCM block; PCM pin cannot be used for UART1; any service on UART1 is suspended 2 - PCM1 is enabled; audio is forwarded both to the PCM block and to the analog line; PCM pins cannot be used for UART1; any service on UART1 is suspended 0 - PCM acts as slave 1 - PCM acts as master 64 - 64 kHz. 128 - 128 kHz. 256 - 256 kHz. 512 - 512 kHz 1024 - 1024 kHz 2048 - 2048 kHz Read command reports the last setting, in the format: AT#I2S1? #I2S1: ,, , Reports the range of supported values for parameters AT#I2S1=? and 3.7.5.1.17 #E2SMSRI - SMS Ring Indicator #E2SMSRI - SMS Ring Indicator AT#E2SMSRI= Set command enables/disables the Ring Indicator pin response to an [] incoming SMS message. If enabled , a negative going pulse is SMS message. The duration of generated on receipt of an incoming . this pulse is determined by the value of Parameter: - RI enabling 0 - disables RI pin response for incoming SMS messages (factory default) page 539 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

540 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #E2SMSRI - SMS Ring Indicator 50..1150 - enables RI pin response for incoming SMS messages. The value of is the duration in ms of the pulse generated on receipt of an incoming SM. Note: if +CNMI=3,1 command is issued and the module is in a GPRS connection, a 100 ms break signal is sent and a 1 sec. pulse is generated on RI pin, no matter if the RI pin response is either enabled or not. Read command reports the duration in ms of the pulse generated on AT#E2SMSRI? receipt of an incoming SM, in the format: #E2SMSRI: Note: as seen before, the value =0 means that the RI pin response to an incoming SM is disabled. Reports the range of supported values for parameter AT#E2SMSRI=? 3.7.5.1.18 #ADC - Read Analog/Digital Converter input #ADC - Read Analog/Digital Converter input Execution command reads pin voltage, converted by ADC, and AT#ADC= outputs it in the format: [, [,

]] #ADC: where: voltage, expressed in mV - pin Parameters: - index of pin 1 - available for GM862-QUAD, GM862-QUAD-PY, GM862-GPS, GE863- QUAD, GE863-PY, GE863-GPS, GE864-QUAD, GE864-PY, GC864- QUAD and GC864-PY 2 - available only for GE863-QUAD, GE863-PY, GE864-QUAD, GE864- PY, GC864-QUAD and GC864-PY 3 - available only for GE863-QUAD, GE863-PY, GE864-QUAD, GE864- PY, GC864-QUAD and GC864-PY - required action 2 - query ADC value - direction; its interpretation is currently not implemented 0 - no effect. Note: The command returns the last valid measure. Read command reports all pins voltage, converted by ADC, in the format: AT#ADC? page 540 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

541 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #ADC: [#ADC: [...]] Test command reports the supported range of values of the command AT#ADC=? .

and parameters , nalog Converter control 3.7.5.1.19 #DAC - Digital/A #DAC - Digital/Analog Converter control Set command enables/disables the DAC_OUT pin. AT#DAC= [ Parameters: [,]] - enables/disables DAC output. 0 - disables pin; it is in high impedance status (factory default) 1 - enables pin; the corresponding output is driven - scale factor of the integrated output voltage; it must be present if =1 0..1023 - 10 bit precision Note: integrated output voltage = MAX_VOLTAGE * value / 1023 Read command reports whether the DAC_OUT pin is currently enabled or AT#DAC? not, along with the integrated output voltage scale factor, in the format: #DAC: , Test command reports the range for the parameters and AT#DAC=? . Enable the DAC out and set its integrated output to the Example 50% of the max value: AT#DAC=1,511 OK Disable the DAC out: AT#DAC=0 OK Note With this command the DAC frequency is selected internally. D/A converter must not be used during POWERSAVING. DAC_OUT line must be integrated (for example with a low band pass filter) in order to obtain an analog voltage. For a more in depth description of the integration filter refer to the hardware user guide. Voltage Output Control 3.7.5.1.20 #VAUX - Auxiliary page 541 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

542 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #VAUX- Auxiliary Voltage Output Control Set command enables/disables Auxiliary Voltage pins output. AT#VAUX= [,] Parameters: - VAUX pin index 1 - there is currently just one VAUX pin 0 - output off 1 - output on 2 - query current value of VAUX pin and command is successful, it returns: =2 Note: when #VAUX: where: - power output status 0 - output off 1 - output on Note: for the GPS product (GE863-GPS): if the Auxiliary Voltage pins output is disabled while GPS or camera is powered on they’ll both also be turned off. Read command reports the current status of all auxiliary voltage output AT#VAUX? pins, in the format: #VAUX: [#VAUX: [...]] , Test command reports the supported range of values for parameters AT#VAUX=? . 3.7.5.1.21 #CBC - Battery And Charger Status #CBC- Battery And Charger Status Execution command returns the current Battery and Charger state in the AT#CBC format: #CBC: , where: - battery charger state 0 - charger not connected 1 - charger connected and charging 2 - charger connected and charge completed - battery voltage in millivolt: it is the real battery voltage only if charger is not connected; if the charger is connected this value depends on the charger voltage. page 542 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

543 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CBC- Battery And Charger Status OK result code. Test command returns the AT#CBC=? 3.7.5.1.22 #AUTOATT - Auto-Attach Property #AUTOATT - Auto-Attach Property Set command enables/disables the TE auto-attach property. AT#AUTOATT= [] Parameter: 0 - disables auto attach property 1 - enables auto attach property (factory default) Read command reports whether the auto-attach property is currently AT#AUTOATT? enabled or not, in the format: #AUTOATT: Test command reports available values for parameter . AT#AUTOATT=? 3.7.5.1.23 #MSCLASS - Mu ltislot Class Control #MSCLASS - Multislot Class Control Set command sets the multislot class AT#MSCLASS= [, Parameters: ] - multislot class; take care: class 7 is not supported. 1..6 - GPRS class 8..10 - GPRS class 0 - the new multislot class is enabled only at the next detach/attach or after a reboot. 1 - the new multislot class is enabled immediately, automatically forcing a detach / attach procedure. range for former GM862 family products is 1..8, Note: the excluding class 7. Read command reports the current value of the multislot class in the AT#MSCLASS? format: #MSCLASS: . Test command reports the range of available values for parameter AT#MSCLASS=? 3.7.5.1.24 #MONI - Cell Monitor #MONI - Cell Monitor page 543 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

544 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #MONI - Cell Monitor Set command sets one cell out of seven, in a neighbour of the serving cell AT#MONI[= including it, from which extract GSM-related informations. []] Parameter: 0..6 - it is the ordinal number of the cell, in a neighbour of the serving cell (default 0, serving cell). 7 - it is a special request to obtain GSM-related informations from the whole set of seven cells in the neighbour of the serving cell. Note: issuing AT#MONI reports the following GSM-related informations for selected cell and dedicated channel (if exists). a) When extracting data for the serving cell and the network name is known the format is: #MONI: BSIC: RxQual: LAC: Id: ARFCN: PWR: dBm TA: b) When the network name is unknown, the format is: #MONI: Cc: Nc: BSIC: RxQual: LAC: Id: ARFCN: PWR: dBm TA: c) When extracting data for an adjacent cell, the format is: #MONI: Adj Cell [LAC: Id:] ARFCN: PWR: dBm where: - name of network operator - country code - network operator code - progressive number of adjacent cell - base station identification code - quality of reception 0..7 - localization area code - cell identifier - assigned radio channel - received signal strength in dBm = timing advance Note: TA: is reported only for the serving cell. , then the Read command reports AT#MONI=7 When the last setting done is the above informations for each of the cells in the neighbour of the serving cell, formatting them in a sequence of -terminated strings. Test command reports the maximum number of cells, in a neighbour of the AT#MONI=? page 544 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

545 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #MONI - Cell Monitor serving cell excluding it, from which we can extract GSM-related informations, along with the ordinal number of the current selected cell, in the format: #MONI: (,) where: - maximum number of cells, in a neighbour of the serving cell and excluding it, from which we can extract GSM-related informations. This value is always 6 . . - the last setting done with command #MONI Note The refresh time of the measures is preset to 3 sec. The timing advance value is meaningful only during calls or GPRS transfers active. 3.7.5.1.25 #SERVINFO - Serving Cell Information #SERVINFO - Serving Cell Information Execution command reports informations about serving cell, in the format: AT#SERVINFO #SERVINFO: ,,,, ,,,,[,[],[], ,[PAT]] where: - BCCH ARFCN of the serving cell - received signal strength in dBm - operator name, quoted string type - country code and operator code, hexadecimal representation - Base Station Identification Code - Localization Area Code - Time Advance: it’s available only if a GSM or GPRS is running - GPRS supported in the cell 0 - not supported 1 - supported The following informations will be present only if GPRS is supported in the cell - PBCCH ARFCN of the serving cell; it’ll be printed only if will “hopping” PBCCH is supported by the cell, otherwise the label be printed - Network Operation Mode ..”I” page 545 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

546 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SERVINFO - Serving Cell Information “II” ..”III” - Routing Area Color Code - Priority Access Threshold ..0 ..3..6 3.7.5.1.26 #QSS - Query SIM Status #QSS - Query SIM Status Set command enables/disables the Query SIM Status unsolicited indication AT#QSS= in the ME. [] Parameter: - type of notification 0 - disabled (factory default); it’s possible only to query the current SIM AT#QSS? status through Read command 1 - enabled; the ME informs at every SIM status change through the following unsolicited indication: #QSS: where: - current SIM status 0 - SIM NOT INSERTED 1 - SIM INSERTED Note: issuing AT#QSS is the same as issuing the Read command. AT#QSS= is the same as issuing the command Note: issuing AT#QSS=0 . Read command reports whether the unsolicited indication #QSS is currently AT#QSS? enabled or not, along with the SIM status, in the format: #QSS: , ( are described above) and Test command returns the supported range of values for parameter AT#QSS=? . 3.7.5.1.27 #DIALMODE - ATD Dialling Mode page 546 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

547 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #DIALMODE - ATD Dialling Mode modality. Set command sets voice call ATD AT#DIALMODE= [] Parameter: OK result code is received as soon as it starts remotely ringing (factory 0 - default) 1 - OK result code is received only after the called party answers. Any character typed aborts the call and NO CARRIER result code is received. 2 - the following custom result codes are received, monitoring step by step the call status: DIALING (MO in progress) RINGING (remote ring) CONNECTED (remote call accepted) RELEASED (after ATH ) DISCONNECTED (remote hang-up) Note: The setting is saved in NVM and available on following reboot. dialing mode in the format: ATD Read command returns current AT#DIALMODE? #DIALMODE: Test command returns the range of values for parameter AT#DIALMODE=? 3.7.5.1.28 #ACAL - Automatic Call #ACAL - Automatic Call Set command enables/disables the automatic call function. AT#ACAL= [] Parameter: 0 - disables the automatic call function (factory default) 1 - enables the automatic call function. If enabled (and &D2 has been causes an automatic call to the DTR of OFF/ON issued), the transition first number (position 0) stored in the internal phonebook. Note: type of call depends on the last issue of command +FCLASS . Read command reports whether the automatic call function is currently AT#ACAL? enabled or not, in the format: #ACAL: Test command returns the supported range of values for parameter AT#ACAL=? . &Z to write and &N to read the number on module internal phonebook. Note See page 547 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

548 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.1.29 #ECAM - Ex tended Call Monitoring #ECAM - Extended Call Monitoring This command enables/disables the call monitoring function in the ME. AT#ECAM= [] Parameter: 0 - disables call monitoring function (factory default) 1 - enables call monitoring function; the ME informs about call events, such as incoming call, connected, hang up etc. using the following unsolicited indication: #ECAM: ,,,,, [,] where - call ID - call status 0 - idle 1 - calling (MO) 2 - connecting (MO) 3 - active 4 - hold 5 - waiting (MT) 6 - alerting (MT) 7 - busy - call type 1 - voice 2 - data - called number (valid only for =1 ) - type of 129 - national number 145 - international number NO Note: the unsolicited indication is sent along with usual codes ( OK , CARRIER ...). BUSY , Read command reports whether the extended call monitoring function is AT#ECAM? currently enabled or not, in the format: #ECAM: Test command returns the list of supported values for AT#ECAM=? page 548 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

549 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.1.30 #SMOV - SMS Overflow #SMOV - SMS Overflow Set command enables/disables the SMS overflow signalling function. AT#SMOV= [] Parameter: 0 - disables SMS overflow signaling function (factory default) 1 - enables SMS overflow signalling function; when the maximum storage capacity has reached, the following network initiated notification is send: #SMOV: Read command reports whether the SMS overflow signalling function is AT#SMOV? currently enabled or not, in the format: #SMOV: Test command returns the supported range of values of parameter AT#SMOV=? . 3.7.5.1.31 #CODEC - Audio Codec #CODEC - Audio Codec Set command sets the audio codec mode. AT#CODEC= [] Parameter: 0 - all the codec modes are enabled (factory default) 1..31 - value obtained as sum of the following values, each of them representing a specific codec mode: 1 - FR , full rate mode enabled 2 - EFR , enhanced full rate mode enabled 4 - HR , half rate mode enabled AMR-FR 8 - , AMR full rate mode enabled 16 - , AMR half rate mode enabled AMR-HR Note: the setting 0 is equivalent to the setting 31. Note: The codec setting is saved in the profile parameters. page 549 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

550 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Read command returns current audio codec mode in the format: AT#CODEC? #CODEC: Test command returns the range of available values for parameter AT#CODEC=? AT#CODEC=14 Example OK sets the codec modes HR (4), EFR (2) and AMR-FR (8) ndsfree Echo Canceller 3.7.5.1.32 #SHFEC - Ha #SHFEC - Handsfree Echo Canceller Set command enables/disables the echo canceller function on audio AT#SHFEC= handsfree output. [] Parameter: 0 - disables echo canceller for handsfree mode (factory default) 1 - enables echo canceller for handsfree mode Note: This setting returns to default after power off. Read command reports whether the echo canceller function on audio AT#SHFEC? handsfree output is currently enabled or not, in the format: #SHFEC: Test command returns the supported range of values of parameter AT#SHFEC=? . 3.7.5.1.33 #HFMICG - Ha ndsfree Microphone Gain #HFMICG - Handsfree Microphone Gain Set command sets the handsfree microphone input gain AT#HFMICG= [] Parameter: : handsfree microphone input gain 0..7 - handsfree microphone gain (+6dB/step) Read command returns the current handsfree microphone input gain, in the AT#HFMICG? format: #HFMICG: returns the supported range of values of parameter Test command AT#HFMICG=? . page 550 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

551 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.1.34 #HSMICG - Ha ndset Microphone Gain #HSMICG - Handset Microphone Gain Set command sets the handset microphone input gain AT#HSMICG= [] Parameter: : handset microphone input gain 0..7 - handset microphone gain (+6dB/step) Read command returns the current handset microphone input gain, in the AT#HSMICG? format: #HSMICG: Test command returns the supported range of values of parameter . AT#HSMICG=? 3.7.5.1.35 #SHFSD - Set Headset Sidetone #SHFSD - Set Headset Sidetone Set command enables/disables the sidetone on headset audio output. AT#SHFSD= [] Parameter: 0 - disables the headset sidetone (factory default) 1 - enables the headset sidetone. Note: This setting returns to default after power off. Read command reports whether the headset sidetone is currently enabled AT#SHFSD? or not, in the format: #SHFSD: Test command returns the supported range of values of parameter AT#SHFSD=? . 3.7.5.1.36 #/ - Repeat Last Command #/ - Repeat Last Command Execute command is used to execute again the last received AT#/ command. page 551 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

552 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.1.37 #NITZ - Network Timezone #NITZ - Network Timezone Set command enables/disables automatic date/time updating and Network AT#NITZ= Timezone unsolicited indication. [ Date and time information may be sent by the network after GSM [,]] registration or after GPRS attach. Parameters: 0 - disables automatic set (factory default) 1 - enables automatic set 0 - disables unsolicited message (factory default) 1 - enables unsolicited message; after date and time updating the following unsolicited indication is sent: #NITZ: “yy/MM/dd,hh:mm:ss” where: yy - year MM - month (in digits) - day dd hh - hour mm - minute ss - second Read command reports whether automatic date/time updating is currently AT#NITZ? enabled or not, and whether Network Timezone unsolicited indication is enabled or not, in the format: #NITZ: , . Test command returns supported values of parameters and AT#NITZ=? 3.7.5.1.38 #BND - Select Band #BND - Select Band Set command selects the current band. AT#BND= [] Parameter : 0 - GSM 900MHz + DCS 1800MHz 1 - GSM 900MHz + PCS 1900MHz 2 - GMS 850MHz + PCS 1800MHz (available only on quadri-band modules) 3 - GMS 850MHz + PCS 1900MHz (available only on quadri-band modules) page 552 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

553 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Note: This setting is maintained even after power off. Read command returns the current selected band in the format: AT#BND? #BND: . Test command returns the supported range of values of parameter AT#BND=? Note: the range of values differs between triband modules and quadric-band modules #AUTOBND - Au tomatic Band Selection 3.7.5.1.39 #AUTOBND - Automatic Band Selection Set command enables/disables the automatic band selection at power-on. AT#AUTOBND= [] Parameter: : 0 - disables automatic band selection at power-on (factory default) 1 - enables automatic band selection at power-on; +COPS=0 is necessary condition to effectively have automatic band selection at next power-on; the automatic band selection stops as soon as a GSM cell is found. Note: if automatic band selection is enabled the band changes every about 90 seconds through available bands until a GSM cell is found. Read command returns whether the automatic band selection is enabled or AT#AUTOBND? not in the form: #AUTOBND: Test command returns the range of supported values for parameter AT#AUTOBND=? . 3.7.5.1.40 #SKIPESC - Skip Escape Sequence #SKIPESC - Skip Escape Sequence while +++ Set command enables/disables skipping the escape sequence AT#SKIPESC= transmitting during a data connection. [] Parameter: 0 - doesn’t skip the escape sequence; its transmission is enabled (factory default). 1 - skips the escape sequence; its transmission is not enabled. Note: in case of an FTP connection, the esca q e se p uence is not page 553 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

554 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 transmitted, regardless of the command setting. Read command reports whether escape sequence skipping is currently AT#SKIPESC? enabled or not, in the format: #SKIPESC: Test command reports supported range of values for parameter . AT#SKIPESC=? pe Sequence Guard Time 3.7.5.1.41 #E2ESC - Esca #E2ESC - Escape Sequence Guard Time Set command sets a guard time in seconds for the escape sequence in AT#E2ESC= GPRS to be considered a valid one (and return to on-line command mode). [] Parameter: 0 - no guard time (factory default) 1..10 - guard time in seconds Note: if the Escape Sequence Guard Time is set to a value different from . S12 zero, it overrides the one set with Read command returns current value of the escape sequence guard time, AT#E2ESC? in the format: #E2ESC: Test command returns the result code. OK AT#E2ESC=? 3.7.5.1.42 #GAUTH - PPP-GPRS Co nnection Authentication Type #GAUTH - PPP-GPRS Connection Authentication Type Set command sets the PPP-GPRS connection authentication type. AT#GAUTH= [] Parameter 0 - no authentication 1 - PAP authentication (factory default) 2 - CHAP authentication Note: for GSM connection is fixed to PAP Read command reports the current PPP-GPRS connection authentication AT#GAUTH? type, in the format: #GAUTH: Test command returns the ran pp arameter p e of su g orted values for AT#GAUTH=? page 554 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

555 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 . 3.7.5.1.43 #RTCSTAT - RTC Status #RTCSTAT - RTC Status Set command resets the RTC status flag. AT#RTCSTAT= [] Parameter: RTC HW OK 0 - Set RTC Status to Note: the initial value of RTC status flag is RTC HW Error and it doesn’t change until a command AT#RTCSTAT=0 is issued. Note: if a power failure occurs and the buffer battery is down the RTC AT#RTCSTAT=0 1 is . It doesn’t change until command status flag is set to issued. Read command reports the current value of RTC status flag, in the format: AT#RTCSTAT? #RTCSTAT: Test command returns the range of supported values for parameter AT#RTCSTAT=? page 555 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

556 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.2 FTP AT Commands 3.7.5.2.1 #FTPTO - FTP Time-Out #FTPTO - FTP timeout Set command sets time-out for FTP operations. AT#FTPTO= [] Parameter: - time-out in 100 ms units 100..5000 - hundreds of ms (factory default is 100) Note: The parameter is not saved in NVM. Read command returns the current FTP operations time-out, in the format: AT#FTPTO? #FTPTO: Test command returns the range of supported values for parameter AT#FTPTO=? 3.7.5.2.2 #FTPOPEN - FTP Open #FTPOPEN - FTP Open Execution command opens an FTP connection toward the FTP server. AT#FTPOPEN= [, Parameters: , - string type, address and port of FTP server (factory default , port 21). ] - string type, authentication user identification string for FTP. - string type, authentication password for FTP. 0 - active mode (factory default) 1 - passive modex Note: Before opening FTP connection the GPRS must been activated with AT#GPRS=1 Test command returns the OK result code. AT#FTPOPEN=? 3.7.5.2.3 #FTPCLOSE - FTP Close #FTPCLOSE - FTP Close Execution command closes an FTP connection. AT#FTPCLOSE Test command returns the OK result code. AT#FTPCLOSE=? page 556 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

557 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.2.4 #FTPPUT - FTP Put #FTPPUT - FTP Put Execution command, issued during an FTP connection, opens a data AT#FTPPUT= connection and starts sending file to the FTP server. [] indication is sent, otherwise If the data connection succeeds, a CONNECT indication is sent. a NO CARRIER Parameter: - string type, name of the file. to close the data connection. +++ Note: use the escape sequence result code to be returned if no ERROR Note: The command causes an FTP connection has been opened yet. Test command returns the OK result code. AT#FTPPUT=? 3.7.5.2.5 #FTPPUTPH - FTP Put Photo #FTPPUTPH - FTP Put Photo Execution command, issued during an FTP connection, opens a data AT#FTPPUTPH= connection and starts sending to the FTP server the last photo taken issuing [] #TPHOTO . Parameter: - string type, name of the file on the FTP server side. Note: the file transfer type has to be binary in order to send the photo the ). right way (see command #FTPTYPE ERROR result code to be returned if no Note: The command causes an FTP connection has been opened yet. result code. Test command returns the OK AT#FTPPUTPH=? at#gprs=1 Example +IP: ###.###.###.### OK at#camon OK at#tphoto OK , at#ftpopen="xxx.xxx.xxx.xxx", ,0 OK at#ftptype=0 page 557 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

558 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #FTPPUTPH - FTP Put Photo OK at#ftpputph="photo.jpg" OK at#ftpclose OK 3.7.5.2.6 #FTPGET - FTP Get #FTPGET - FTP Get Execution command, issued during an FTP connection, opens a data AT#FTPGET= connection and starts getting a file from the FTP server. [] indication is sent, otherwise a If the data connection succeeds a CONNECT NO CARRIER indication is sent. The file is received on the serial port. Parameter: - file name, string type. Note: The command causes an ERROR result code to be returned if no FTP connection has been opened yet. Test command returns the OK result code. AT#FTPGET=? 3.7.5.2.7 #FTPTYPE - FTP Type #FTPTYPE - FTP Type Set command, issued during an FTP connection, sets the file transfer type. AT#FTPTYPE= [] Parameter: - file transfer type: 0 - binary 1 - ascii result code to be returned if no Note: The command causes an ERROR FTP connection has been opened yet. Read command returns the current file transfer type, in the format: #FTPTYPE? #FTPTYPE: : Test command returns the range of available values for parameter #FTPTYPE=? #FTPTYPE: (0,1) page 558 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

559 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.2.8 #FTPMSG - FTP Read Message #FTPMSG - FTP Read Message Execution command returns the last response from the server. AT#FTPMSG Test command returns the OK result code. AT#FTPMSG=? 3.7.5.2.9 #FTPDELE - FTP Delete #FTPDELE - FTP Delete Execution command, issued during an FTP connection, deletes a file from AT#FTPDELE= the remote working directory. [] Parameter: - string type, it’s the name of the file to delete. result code to be returned if no ERROR Note: The command causes an FTP connection has been opened yet. Test command returns the OK result code. AT#FTPDELE=? 3.7.5.2.10 #FTPPWD - FTP Print Working Directory #FTPPWD - FTP Print Working Directory Execution command, issued during an FTP connection, shows the current AT#FTPPWD working directory on FTP server. ERROR Note: The command causes an result code to be returned if no FTP connection has been opened yet. Test command returns the OK result code. AT#FTPPWD=? 3.7.5.2.11 #FTPCWD - FTP Change Working Directory #FTPCWD - FTP Change Working Directory Execution command, issued during an FTP connection, changes the AT#FTPCWD= working directory on FTP server. [] Parameter: - string type, it’s the name of the new working directory. ERROR Note: The command causes an result code to be returned if no FTP connection has been opened yet. Test command returns the OK result code. AT#FTPCWD=? page 559 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

560 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.2.12 #FTPLIST - FTP List #FTPLIST - FTP List Execution command, issued during an FTP connection, opens a data AT#FTPLIST[= connection and starts getting from the server the list of contents of the []] specified directory or the properties of the specified file. Parameter: - string type, it’s the name of the directory or file. ERROR Note: The command causes an result code to be returned if no FTP connection has been opened yet. Note: issuing AT#FTPLIST opens a data connection and starts getting from the server the list of contents of the working directory. Test command returns the OK result code. AT#FTPLIST=? page 560 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

561 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.3 Enhanced Easy GPRS® Extension AT Commands 3.7.5.3.1 #USERID - Au thentication User ID #USERID - Authentication User ID Set command sets the user identification string to be used during the AT#USERID= authentication step. [] Parameter: - string type, it’s the authentication User Id; the max length for this (factory value is the output of Test command, AT#USERID=? default is the empty string “”). Read command reports the current user identification string, in the format: AT#USERID? #USERID: Test command returns the maximum allowed length of the string parameter AT#USERID=? . AT#USERID="myName" Example OK AT#USERID? #USERID: "myName" OK thentication Password 3.7.5.3.2 #PASSW - Au #PASSW - Authentication Password Set command sets the user password string to be used during the AT#PASSW= authentication step. [] Parameter: - string type, it’s the authentication password; the max length for this value is the output of Test command, AT#PASSW=? (factory default is the empty string “”). Test command returns the maximum allowed length of the string parameter AT#PASSW=? . AT#PASSW="myPassword" Example OK page 561 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

562 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.3.3 #PKTSZ - Packet Size #PKTSZ - Packet Size Set command sets the default packet size to be used by the TCP/UDP/IP AT#PKTSZ= stack for data sending. [] Parameter: - packet size in bytes 0 - automatically chosen by the device 1..512 - packet size in bytes (factory default is 300) Read command reports the current packet size value. AT#PKTSZ? AT#PKTSZ=0 , the Read command reports the Note: after issuing command value automatically chosen by the device. Test command returns the allowed values for the parameter . AT#PKTSZ=? AT#PKTSZ=100 Example OK AT#PKTSZ? #PKTSZ: 100 OK AT#PKTSZ=0 OK AT#PKTSZ? #PKTSZ: 300 -> value automatically chosen by device OK 3.7.5.3.4 #DSTO - Data Sending Time-Out #DSTO -Data Sending Time-Out Set command sets the maximum time that the module awaits before AT#DSTO= sending anyway a packet whose size is less than the default one. [] Parameter: - packet sending time-out in 100ms units (factory default is 50) 0 - no time-out, wait forever for packets to be completed before send. 1..255 hundreds of ms Note: In order to avoid low performance issues, it is suggested to set the data sending time-out to a value greater than 5. Note: this time-out applies to data whose size is less than packet size and whose sending would have been delayed for an undefined time until new data to be sent had been received and full packet size reached. Read command reports the current data sending time-out value. AT#DSTO? page 562 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

563 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #DSTO -Data Sending Time-Out Test command returns the allowed values for the parameter . AT#DSTO=? AT#DSTO=10 ->1 sec. time-out Example OK AT#DSTO? #DSTO: 10 OK 3.7.5.3.5 #SKTTO - Soc ket Inactivity Time-Out #SKTTO - Socket Inactivity Time-Out Set command sets the maximum time with no data exchanging on the AT#SKTTO= socket that the module awaits before closing the socket and deactivating [] the GPRS context. Parameter: - socket inactivity time-out in seconds units 0 - no timeout. 1..65535 - time-out in sec. units (factory default is 90). Note: this time-out applies when no data is exchanged in the socket for a long time and therefore the socket connection has to be automatically closed and the GPRS context deactivated. Read command reports the current socket inactivity time-out value. AT#SKTTO? Test command returns the allowed values for parameter . AT#SKTTO=? AT#SKTTO=30 ->(30 sec. time-out) Example OK AT#SKTTO? #SKTTO: 30 OK 3.7.5.3.6 #SKTSET - Socket Definition #SKTSET - Socket Definition AT#SKTSET= Set command sets the socket parameters values. [, , Parameters: , - socket protocol type [], 0 - TCP (factory default) []] 1 - UDP - remote host port to be opened 0..65535 - port number (factory default is 0) page 563 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

564 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - address of the remote host, string type. This parameter can be either: - any valid IP address in the format: xxx.xxx.xxx.xxx - any host name to be solved with a DNS query in the format: (factory default is the empty string “”) - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) 255 - local host closes after an escape sequence ( +++ ) - local host port to be used on UDP socket 0..65535 - port number Note: parameter is valid only for TCP socket type, for UDP sockets shall be left unused. parameter is valid only for UDP socket type, for TCP Note: sockets shall be left unused. Note: The resolution of the host name is done when opening the socket, #SKTSET therefore if an invalid host name is given to the command, then an error message will be issued. Note: the DNS Query to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT - the authentication parameters are set (#USERID , #PASSW ) - the GPRS coverage is enough to permit a connection. Read command reports the socket parameters values, in the format: AT#SKTSET? AT#SKTSET: ,,, , Test command returns the allowed values for the parameters. AT#SKTSET=? AT#SKTSET=0,1024,"123.255.020.001" Example OK AT#SKTSET=0,1024,"www.telit.net" OK 3.7.5.3.7 #SKTOP - Socket Open #SKTOP - Socket Open Execution command activates the context number 1, proceeds with the AT#SKTOP authentication with the user ID and password previously set by #USERID and #PASSW commands, and opens a socket connection with the host specified in the #SKTSET command. Eventually, before opening the socket connection, it issues automatically a DNS query to solve the IP address of the host name. If the connection succeeds a NO indication is sent, otherwise a CONNECT page 564 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

565 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 indication is sent. CARRIER Test command returns the result code. OK AT#SKTOP=? AT#SKTOP Example ..GPRS context activation, authentication and socket open.. CONNECT 3.7.5.3.8 #QDNS - Query DNS #QDNS - Query DNS Execution command executes a DNS query to solve the host name into an AT#QDNS= IP address. [] Parameter: - host name, string type. If the DNS query is successful then the IP address will be reported in the result code: #QDNS:"", Note: the command has to activate the GPRS context if it was not previously activated. In this case the context is deactivated after the DNS query. Note: is in the format: xxx.xxx.xxx.xxx Test command returns the OK result code. AT#QDNS=? Note This command requires that the authentication parameters are correctly set and that the GPRS network is present. TCP Connection Time-Out 3.7.5.3.9 #SKTCT - Socket #SKTCT - Socket TCP Connection Time-Out Set command sets the TCP connection time-out for the first CONNECT AT#SKTCT= answer from the TCP peer to be received. [] Parameter: - TCP first CONNECT answer time-out in 100ms units 10..1200 - hundreds of ms (factory default value is 600). Note: this time-out applies only to the time that the TCP stack waits for the answer to its connection request. CONNECT Note: The time for activate the GPRS and resolvin g the name with the DNS page 565 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

566 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 query (if the peer was specified by name and not by address) is not counted in this timeout. Read command reports the current TCP connection time-out. AT#SKTCT? Test command returns the allowed values for parameter . AT#SKTCT=? AT#SKTCT=600 Example OK socket first connection answer timeout has been set to 60 s. 3.7.5.3.10 #SKTSAV - So cket Parameters Save #SKTSAV - Socket Parameters Save Execution command saves the actual socket parameters in the NVM of the AT#SKTSAV device. The socket parameters to store are: - User ID - Password - Packet Size - Socket Inactivity Time-Out - Data Sending Time-Out - Socket Type (UDP/TCP) - Remote Port - Remote Address - TCP Connection Time-Out OK Test command returns the result code. AT#SKTSAV=? AT#SKTSAV Example OK socket parameters have been saved in NVM If some parameters have not been previously specified then a default value Note will be stored. 3.7.5.3.11 #SKTRST - Socket Parameters Reset Command #SKTRST - Socket Parameters Reset Command Execution command resets the actual socket parameters in the NVM of the AT#SKTRST device to the default ones. The socket parameters to reset are: - User ID - Password - Packet Size - Socket Inactivity Timeout page 566 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

567 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 - Data Sending Timeout - Socket Type - Remote Port - Remote Address - TCP Connection Time-Out Test command returns the OK result code. AT#SKTRST=? AT#SKTRST Example OK socket parameters have been reset 3.7.5.3.12 #GPRS - GP RS Context Activation #GPRS - GPRS Context Activation Execution command deactivates/activates the GPRS context, eventually AT#GPRS= #PASSW proceeding with the authentication with the parameters given with [] #USERID and . Parameter: - GPRS context activation mode 0 - GPRS context deactivation request 1 - GPRS context activation request In the case that the GPRS context has been activated, the result code OK is preceded by the intermediate result code: +IP: reporting the local IP address obtained from the network. Read command reports the current status of the GPRS context, in the AT#GPRS? format: #GPRS: where: 0 - GPRS context deactivated 1 - GPRS context activated 2 - GPRS context activation pending. . Test command returns the allowed values for parameter AT#GPRS=? AT#GPRS=1 Example +IP: 129.137.1.1 OK Now GPRS Context has been activated and our IP is 129.137.1.1 AT#GPRS=0 page 567 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

568 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #GPRS - GPRS Context Activation OK Now GPRS context has been deactivated, IP is lost. 3.7.5.3.13 #SKTD - Socket Dial #SKTD - Socket Dial Set command opens the socket towards the peer specified in the AT#SKTD= parameters. [, , Parameters: , - socket protocol type [], 0 - TCP (factory default) []] 1 - UDP - remote host port to be opened 0..65535 - port number (factory default is 0) - address of the remote host, string type. This parameter can be either: - any valid IP address in the format: xxx.xxx.xxx.xxx (factory default is the empty string “”) - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) 255 - local host closes after an escape sequence ( +++ ) - local host port to be used on UDP socket 0..65535 - port number Note: parameter is valid only for TCP socket type, for UDP sockets shall be left unused. Note: parameter is valid only for UDP socket type, for TCP sockets shall be left unused. Note: the resolution of the host name is done when opening the socket, command, then an therefore if an invalid host name is given to the #SKTD error message will be issued. Note: the command to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT #PASSW , - the authentication parameters are set (#USERID ) the GPRS coverage is enough to permit a connection AT#GPRS=1 - the GPRS has been activated with Note: If all parameters are omitted then the behaviour of Set command is the same as Read command. page 568 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

569 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTD - Socket Dial Read command reports the socket dial parameters values, in the format: AT#SKTD? AT#SKTD: ,,, , Test command returns the allowed values for the parameters. AT#SKTD=? AT#SKTD=0,1024,"123.255.020.001",255 Example OK AT#SKTD=1,1024,"123.255.020.001", ,1025 OK In this way my local port 1025 is opened to the remote port 1024 AT#SKTD=0,1024,"www.telit.net", 255 OK Note The main difference between this command and #SKTOP is that this command does not interact with the GPRS context status, leaving it ON or #GPRS setting, therefore when the connection made OFF according to the with is closed the context (and hence the local IP address) is #SKTD maintained. 3.7.5.3.14 #SKTL - Socket Listen #SKTL - Socket Listen Execution command opens/closes the socket listening for connection AT#SKTL requests. =[, , Parameters: , - socket mode []] 0 - closes socket listening 1 - starts socket listening - socket protocol type 0 - TCP - local host input port to be listened 0..65535 - port number - socket closure behaviour for TCP 0 - local host closes immediately when remote host has closed (default) +++ 255 - local host closes after an escape sequence ( ) Command returns the OK result code if successful. Note: the command to be successful requests that: - the GPRS context 1 is correctly set with +CGDCONT , ) #PASSW #USERID - the authentication parameters are set ( - the GPRS coverage is enough to permit a connection page 569 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

570 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTL - Socket Listen - the GPRS has been activated with AT#GPRS=1 When a connection request comes on the input port, if the sender is not #FRWL ), an unsolicited code filtered by the internal firewall (see command is reported: +CONN FROM: Where: - host address of the remote machine that contacted the device. When the connection is established the CONNECT indication is given and the modem goes into data transfer mode. #GPRS=0 On connection close or when context is closed with the socket is closed and no listen is anymore active. rk while in listening, the socket is If the context is closed by the netwo closed, no listen is anymore active and an unsolicited code is reported: #SKTL: ABORTED Read command returns the current socket listening status and the last AT#SKTL? settings of parameters and , in the format: #SKTL: ,, Where - socket listening status 0 - socket not listening 1 - socket listening Test command returns the allowed values for parameters AT#SKTL=? . and type> , Activate GPRS Example AT#GPRS=1 +IP: ###.###.###.### OK Start listening AT#SKTL=1,0,1024 OK or AT#SKTL=1,0,1024,255 OK Receive connection requests +CONN FROM: 192.164.2.1 page 570 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

571 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SKTL - Socket Listen CONNECT exchange data with the remote host send escape sequence +++ NO CARRIER Now listen is not anymore active to stop listening AT#SKTL=0,0,1024, 255 OK The main difference between this command and Note #SKTD is that #SKTL does not contact any peer, nor does any interaction with the GPRS context setting, therefore according to the or OFF status, leaving it ON #GPRS when the connection made with is closed the context (and hence #SKTL the local IP address) is maintained. et Listen Ring Indicator 3.7.5.3.15 #E2SLRI - Sock #E2SLRI - Socket Listen Ring Indicator Set command enables/disables the Ring Indicator pin response to a Socket AT#E2SLRI=[] Listen connect and, if enabled, the duration of the negative going pulse generated on receipt of connect. Parameter: - RI enabling 0 - RI disabled for Socket Listen connect (factory default) 50..1150 - RI enabled for Socket Listen connect; a negative going pulse is generated on receipt of connect and is the duration in ms of this pulse. Read command reports whether the Ring Indicator pin response to a Socket AT#E2SLRI? Listen connect is currently enabled or not, in the format: #E2SLRI: Test command returns the allowed values for parameter . AT#E2SLRI=? 3.7.5.3.16 #FRWL - Firewall Setup #FRWL - Firewall Setup Execution command controls the internal firewall settings. AT#FRWL= [, Parameters: , - command action ] 0 - remove selected chain 1 - add an chain ACCEPT page 571 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

572 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #FRWL - Firewall Setup 2 - remove all chains ( everything); and DROP has no meaning in this case. chain; string ACCEPT - remote address to be added into the type, it can be any valid IP address in the format: xxx.xxx.xxx.xxx - mask to be applied on the ; string type, it can be any valid IP address mask in the format: xxx.xxx.xxx.xxx Command returns OK result code if successful. Note: the firewall applies for incoming (listening) connections only. Firewall general policy is DROP , therefore all packets that are not included chain rule will be silently discarded. into an ACCEPT incoming_IP When a packet comes from the IP address , the firewall chain rules will be scanned for matching with the following criteria: incoming_IP & = & If criteria is matched, then the packet is accepted and the rule scan is finished; if criteria is not matched for any chain the packet is silently dropped. chain rules registered in the Read command reports the list of all ACCEPT AT#FRWL? Firewall settings in the format: #FRWL: , #FRWL: , ... OK . Test command returns the allowed values for parameter AT#FRWL=? Let assume we want to accept connections only from our Example devices which are on the IP addresses ranging from 197.158.1.1 to 197.158.255.255 We need to add the following chain to the firewall: AT#FRWL=1,"197.158.1.1","255.255.0.0" OK For outgoing connections made with #SKTOP Note and #SKTD the remote host is dynamically inserted into the ACCEPT chain for all the connection #FRWL duration. Therefore the command shall be used only for defining the #SKTL behaviour, deciding which hosts are allowed to connect to the local device. Rules are not saved in NVM, at start-up the rules list will be empty. page 572 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

573 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.4 Easy Camera® Management AT Commands 3.7.5.4.1 #CAMEN - Camera ON/OFF #CAMEN - Camera ON/OFF . ON/OFF Execution command turns camera AT#CAMEN= [] Parameter: - camera status 0 - turns camera OFF 1 - turns camera ON Note: for the GPS product (GE863-GPS) if the camera is turned off while GPS or VAUX pin is enabled they’ll both also be powered off. Read command reports the current camera status and, if the camera is ON , AT#CAMEN? the current camera model, in the format: if camera is #CAMEN: 0 OFF #CAMEN: 1, if camera is ON where: - camera model 2 - TRANSCHIP camera Test command returns the allowed values for parameter . AT#CAMEN=? 3.7.5.4.2 #SELCAM - Camera Model #SELCAM - Camera Model Set command selects current camera model AT#SELCAM= [] Parameter: - camera model 0 - automatic detection (factory default) 2 - TRANSCHIP camera 3 - reserved for future us 4 - reserved for future use 5 - reserved for future use Note: If GPS is present it’s not possible to set AT#SELCAM=1 Read command reports the current camera model in the format: AT#SELCAM? #SELCAM: Test command returns the allowed values for parameter AT#SELCAM=? page 573 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

574 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.4.3 #CAMRES - Camera Resolution #CAMRES - Camera Resolution Set command sets current camera resolution AT#CAMRES= [] Parameter: - camera resolution 0 - VGA photo output,640x480 (factory default) 1 - QVGA photo output, 320x240 2 - QQVGA photo output, 160x120 3 - reserved for future use 4 - reserved for future use Read command reports the current value of the parameter in format: AT#CAMRES? #CAMRES: . Test command returns the allowed values for parameter AT#CAMRES=? 3.7.5.4.4 #CAMCOL - Ca mera Colour Mode #CAMCOL - Camera Colour Mode Set command sets current colour mode AT#CAMCOL= [] Parameter: - camera colour mode 0 - colour mode (factory default) 1 - Black&White mode Read command reports the current colour mode, in the format: AT#CAMCOL? #CAMCOL: . . Test command returns the allowed values for parameter AT#CAMCOL=? 3.7.5.4.5 #CAMQUA - Camera Photo Quality #CAMQUA - Camera Photo Quality Set command sets the quality of the photo. AT#CAMQUA= [] Parameter: - photo quality 0 - low quality of picture, high Jpeg compression 1 - medium quality of picture, medium Jpeg compression 2 - high quality of picture, low Jpeg compression (factory default) Note: increasing the photo quality increases its size. Read command reports the current photo quality, in the format: AT#CAMQUA? page 574 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

575 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CAMQUA - Camera Photo Quality #CAMQUA: . Test command returns the allowed values for parameter AT#CAMQUA=? 3.7.5.4.6 #CMODE - Camera Exposure #CMODE - Camera Exposure Set command sets the camera exposure. AT#CMODE= [] Parameter: - camera exposure 0 - daylight mode, short exposure (factory default) 1 - nightlight mode, long exposure Read command reports the current camera exposure in the format: AT#CMODE? #CMODE: . Test command returns the allowed values for parameter AT#CMODE=? 3.7.5.4.7 #CAMZOOM - Camera Zoom #CAMZOOM - Camera Zoom Set command sets current zoom. AT#CAMZOOM= [] Parameter: - camera zoom 0 - no zoom, x1 (factory default) 1 - zoom, x2 2 - zoom, x4 3 - reserved for future use Read command reports the current zoom setting, in the format: AT#CAMZOOM? #CAMZOOM: . Test command returns the allowed values for parameter AT#CAMZOOM=? 3.7.5.4.8 #CAMTXT - Came ra Time/Date Overprint #CAMTXT - Camera Time/Date Overprint Set command sets time/date overprinting. AT#CAMTXT= [] Parameter: - time/date overprinting mode 0 - no overprinting (factory default) 1 - time info printed at the bottom of picture 2 - date info printed at the bottom of picture page 575 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

576 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3 - time&date info printed at the bottom of picture 4 - reserved for future use Read command reports the current time/date overprinting mode, in the AT#CAMTXT? format: #CAMTXT: . Test command returns the allowed values for parameter AT#CAMTXT=? 3.7.5.4.9 #TPHOTO - Camera Take Photo #TPHOTO - Camera Take Photo Execution command is used to take the photo and to store it in the AT#TPHOTO MODULE memory. Test command returns the result code. OK AT#TPHOTO=? AT#TPHOTO Example OK ... the camera has taken the photo and it is now stored on the MODULE memory. Note The photo is kept in the MODULE RAM memory, therefore after a power off it is lost. There's only 1 position for the photo, every photo will overwrite the previous. The photo is taken during IDLE time, if the mobile is busy on network operations, (e.g. during a call) the photo cannot be taken. 3.7.5.4.10 #RPHOTO - Camera Read Photo #RPHOTO - Camera Read Photo Execution command is used to flushing the photo stored in the MODULE AT#RPHOTO RAM memory to the serial line, ending it with the sequence: OK result code. OK Test command returns the AT#RPHOTO=? AT#RPHOTO Example (binary digits of the JPEG image) xxxxxxxxxxxx OK the photo has been flushed to the serial line Note The photo is flushed as hexadecimal characters in the format selected. The baudrate is fixed at 115200, using hardware flow control. 3.7.5.4.11 #OBJL - Object List #OBJL- Object List Execution command reports the list of the objects stored in the MODULE AT#OBJL memory. page 576 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

577 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #OBJL- Object List The output format is: #OBJL: , where: - name of the object; it is always “Snapshot” - size of the object in bytes result code. Test command returns the OK AT#OBJL=? AT#OBJL Example #OBJL: Snapshot,47224 OK 3.7.5.4.12 #OBJR - Object Read #OBJR - Object Read Execution command is used to flushing the photo stored in the MODULE AT#OBJR= RAM memory to the serial line. [, "Snapshot"] output #OBJR The difference between this command and #RPHOTO is that ends without the sequence: OK Parameter: - type of objects to be listed, string type “IMG” - Image object Note: is the only name of the object. "Snapshot" result code. Test command returns the OK AT#OBJR=? AT#OBJR="IMG","Snapshot" Example xxxxxxxxxxxx (binary digits of the JPEG image) ... the photo has been flushed to the serial line. The photo is flushed as hexadecimal characters in the format selected. The Note baudrate is fixed at 115200, using hardware flow control. page 577 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

578 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.5 Email Management AT Commands 3.7.5.5.1 #ESMTP - E-mail SMTP Server #ESMTP - E-mail SMTP Server Set command sets the SMTP server address, used for E-mail sending. AT#ESMTP= SMTP server can be specified as IP address or as nick name. [] Parameter: - SMTP server address, string type. This parameter can be either: any valid IP address in the format: xxx.xxx.xxx.xxx - - any host name to be solved with a DNS query in the format: (factory default is the empty string “”) Note: the max length for is the output of Test command. Read Command reports the current SMTP server address, in the format: AT#ESMTP? #ESMTP: Test command returns the max length for the parameter . AT#ESMTP=? AT#ESMTP="smtp.mydomain.com" Example OK Note The SMTP server used shall be inside the APN space (the smtp server provided by the network operator) or it must allow the Relay, otherwise it will refuse to send the email. 3.7.5.5.2 #EADDR - E-mail Sender Address #EADDR - E-mail Sender Address Set command sets the sender address string to be used for sending the e- AT#EADDR= mail. [] Parameter: - sender address, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) Read command reports the current sender address, in the format: AT#EADDR? #EADDR: Test command returns the maximum allowed length of the string parameter AT#EADDR=? . AT#EADDR="[email protected]" Example OK AT#EADDR? #EADDR: "[email protected]" page 578 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

579 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #EADDR - E-mail Sender Address OK 3.7.5.5.3 #EUSER - E-mail Authentication User Name #EUSER - E-mail Authentication User Name Set command sets the user identification string to be used during the AT#EUSER= authentication step of the SMTP. [] Parameter: - email authentication User ID, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) parameter shall be Note: if no authentication is required then the empty "". Read command reports the current user identification string, in the format: AT#EUSER? #EUSER: Test command returns the maximum allowed length of the string parameter AT#EUSER=? . AT#EUSER="myE-Name" Example OK AT#EUSER? #EUSER: "myE-Name" OK It is a different user field than the one used for GPRS authentication (see Note #USERID ). 3.7.5.5.4 #EPASSW - E-mail Authentication Password #EPASSW - E-mail Authentication Password Set command sets the password string to be used during the authentication AT#EPASSW= step of the SMTP. [] Parameter: - email authentication password, string type. - any string value up to max length reported in the Test command. (factory default is the empty string “”) parameter shall be Note: if no authentication is required then the empty "". page 579 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

580 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #EPASSW - E-mail Authentication Password Test command returns the maximum allowed length of the string parameter AT#EPASSW=? . AT#EPASSW="myPassword" Example OK It is a different password field than the one used for GPRS authentication Note (see #PASSW ). 3.7.5.5.5 #SEMAIL - E-mail Sending With GPRS Context Activation #SEMAIL - E-mail Sending With GPRS Context Activation Execution command activates a GPRS context, if not previously activated AT#SEMAIL= , and sends an e-mail message. The GPRS context is #EMAILACT by [,, deactivated when the e-mail is sent. [,]] Parameters: - destination address, string type. - subject of the message, string type. - attached image flag 0 - don't attach any image 1 - attach the last snapshot taken - image name (default is “snapshot.jpg”) The device responds to the command with the prompt ' > ' and awaits for the message body text. To complete the operation send Ctrl-Z char ( 0x1A hex); to exit without writing the message send ESC char ( 0x1B hex). If e-mail message is successfully sent, then the response is . OK If message sending fails for some reason, an error code is reported Note: Care must be taken to ensure that during the command execution, no other commands are issued. To avoid malfunctions is suggested to wait for the OK or ERROR / +CMS ERROR: response before issuing further commands. Note: if GPRS context was previously activated by #GPRS it’s not possible to successfully send the e-mail message and the response is the result code activation failed . Note: sending an e-mail with an image attachment can take quite a long time since it can be over 50Kb to send and can take more than 1 minute. result code. OK Test command returns the AT#SEMAIL=? [email protected] ","subject of the mail",1 AT#SEMAIL=" Example page 580 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

581 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #SEMAIL - E-mail Sending With GPRS Context Activation >message body... this is the text of the mail message... CTRL-Z ..wait.. OK Message has been sent. 3.7.5.5.6 #EMAILACT - E-mail GPRS Context Activation #EMAILACT - E-mail GPRS Context Ativation Execution command deactivates/activates the GPRS context, eventually AT#EMAILACT= #PASSW proceeding with the authentication with the parameters given with [] #USERID and . Parameter: - GPRS context activation mode 0 - GPRS context deactivation request 1 - GPRS context activation request Read command reports the current status of the GPRS context for the e- AT#EMAILACT? mail, in the format: #EMAILACT: where: 0 - GPRS context deactivated 1 - GPRS context activated Test command returns the allowed values for parameter . AT#EMAILACT=? AT#EMAILACT=1 Example OK Now GPRS Context has been activated AT# EMAILACT=0 OK Now GPRS context has been deactivated. page 581 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

582 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.5.7 #EMAILD - E-mail Sending #EMAILD - E-mail Sending Execution command sends an e-mail message if GPRS context has already AT#EMAILD= been activated with AT#EMAILACT=1 . [, , Parameters: [,]] - destination address, string type. - subject of the message, string type - attached image flag 0 - don't attach any image 1 - attach the last snapshot taken - image name (default is “snapshot.jpg”) > ' and awaits for The device responds to the command with the prompt ' the message body text. To complete the operation send Ctrl-Z char ( 0x1A hex); to exit without writing the message send hex). 0x1B char ( ESC OK . If e-mail message is successfully sent, then the response is If message sending fails for some reason, an error code is reported Note: Care must be taken to ensure that during the command execution, no other commands are issued. To avoid malfunctions is suggested to wait for the OK or ERROR / +CMS ERROR: response before issuing further commands. Note: sending an e-mail with an image attachment can take quite a long time since it can be over 50Kb to send and can take more than 1 minute. OK result code. Test command returns the AT#EMAILD=? [email protected] ”,”subject of the mail”,1 AT#EMAILD=” Example >message body... this is the text of the mail message... CTRL-Z ..wait.. OK Message has been sent. #SEMAIL Note The only difference between this command and the is that this command does not interact with the GPRS context status, leaving it ON or #EMAILACT setting, thus, when the connection made OFF according to the #EMAILD with is closed, the context status is maintained. page 582 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

583 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.5.8 #ESAV - Email Parameters Save #ESAV - Email Parameters Save Execution command saves the actual e-mail parameters in the NVM of the AT#ESAV device. The values stored are: - E-mail User Name - E-mail Password - E-mail Sender Address - E-mail SMTP server Test command returns the result code. OK AT#ESAV=? If some parameters have not been previously specified then a default value Note will be taken. 3.7.5.5.9 #ERST - E-mail Parameters Reset #ERST - E-mail Parameters Reset Execution command resets the actual e-mail parameters in the NVM of the AT#ERST device to the default ones. The values reset are: - E-mail User Name - E-mail Password - E-mail Sender Address - E-mail SMTP server Test command returns the OK result code. AT#ERST=? 3.7.5.5.10 #EMAILMSG -SMTP Read Message #EMAILMSG - SMTP Read Message Execution command returns the last response from SMTP server. AT#EMAILMSG Test command returns the OK result code. AT#EMAILMSG=? page 583 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

584 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.6 Easy Scan® Extension AT Commands 3.7.5.6.1 #CSURV - Network Survey #CSURV - Network Survey Execution command allows to perform a quick survey through channels AT#CSURV[= command issue, starting from belonging to the band selected by last #BND [,]] to channel channel , a full band scan is AT#CSURV . Issuing performed. AT*CSURV[= [,]] Parameters: (both syntax are - starting channel possible) - ending channel After issuing the command the device responds with the string: Network survey started... and, after a while, a list of informations, one for each received carrier, is reported, each of them in the format: (For BCCH-Carrier) arfcn: bsic: rxLev: ber: mcc: mnc: lac: cellId: cellStatus: numArfcn: arfcn: [ ..[ ]] [numChannels: array: [ ..[]] [pbcch: [nom: rac: spgc: pat: nco: t3168: t3192: drxmax: ctrlAck: bsCVmax: alpha: pcMeasCh: ]]] where: - C0 carrier assigned radio channel (BCCH - Broadcast Control Channel) - base station identification code; if #CSURVF last setting is 0, is a decimal number, else it is a 2-digits octal number - decimal number; it is the receiption level (in dBm) - decimal number; it is the bit error rate (in %) - hexadecimal 3-digits number; it is the mobile country code - hexadecimal 2-digits number; it is the mobile network code - location area code; if #CSURVF last setting is 0, is a decimal number, else it is a 4-digits hexadecimal number - cell identifier; if #CSURVF last setting is 0, is a decimal number, else it is a 4-digits hexadecimal number - string type; it is the cell status ..CELL_SUITABLE - C0 is a suitable cell. PRIORITY - the cell is low based on the received y riorit p _ _ LOW CELL page 584 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

585 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURV - Network Survey system information. CELL_FORBIDDEN - the cell is forbidden. CELL_BARRED - the cell is barred based on the received system information. CELL_LOW_LEVEL - the cell is low. CELL_OTHER - none of the above e.g. exclusion timer running, no BCCH available...etc. - number of valid channels in the Cell Channel Description is in n - arfcn of a valid channel in the Cell Channel Description ( 1.. ) the range - decimal number; it is the number of valid channels in the Cell Channel Description - decimal number; it is the arfcn of a valid channel in the Cell Channel Description ( n is in the range 1.. ) - decimal number; it is the number of valid channels in the BCCH Allocation list; the output of this information for non- setting: #CSURVEXT serving cells depends on last this information is displayed only for #CSURVEXT=0 7. if serving cell 8. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. - decimal number; it is the arfcn of a valid channel in the BA list ( is in the range 1.. ); the output of this #CSURVEXT information for non-serving cells depends on last setting: this information is displayed only for 8. if #CSURVEXT=0 serving cell 9. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. (The following informations will be printed only if GPRS is supported in the cell) - 0 1 > - network operation mode - routing area code 0..255 - - SPLIT_PG_CYCLE support ..0 - SPLIT_PG_CYCLE is not supported on CCCH on this cell ..1 - SPLIT_PG_CYCLE is supported on CCCH on this cell - priority access threshold 0 - 3..6 - page 585 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

586 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURV - Network Survey - network control order 0..2 - - timer 3168 - timer 3192 - discontinuous reception max time (in seconds) - packed control ack - blocked sequenc countdown max value - alpha parameter for power control type of channel which shall be used for downlink - measurements for power control 0 - BCCH 1 - PDCH (For non BCCH-Carrier) arfcn: rxLev: where: - decimal number; it is the RF channel - decimal number; it is the receiption level (in dBm) The last information from #CSURV depends on the last #CSURVF setting: #CSURVF=1 #CSURVF=0 or The output ends with the string: Network survey ended #CSURVF=2 the output ends with the string: Network survey ended (Carrier: BCCh: ) where - number of scanned frequencies - number of found BCCh AT#CSURV Example Network survey started... arfcn: 48 bsic: 24 rxLev: -52 ber: 0.00 mcc: 610 mnc: 1 lac: 33281 cellId: 3648 cellStatus: CELL_SUITABLE numArfcn: 2 arfcn: 30 48 numChannels: 5 array: 14 19 22 48 82 arfcn: 14 rxLev: 8 page 586 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

587 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURV - Network Survey Network survey ended OK The command is executed within max. 2 minute. Note 3.7.5.6.2 #CSURVC - Networ k Survey (Numeric Format) #CSURVC - Network Survey (Numeric Format) Execution command allows to perform a quick survey through channels AT#CSURVC[= #BND belonging to the band selected by last command issue, starting from [,]] channel , a full band scan AT#CSURVC . Issuing to channel is performed. AT*CSURVC[= [=,]] Parameters: - starting channel (both syntax are - ending channel possible) After issuing the command the device responds with the string: Network survey started... and, after a while, a list of informations, one for each received carrier, is reported, each of them in the format: (For BCCH-Carrier) ,,,,,,,, ,[, ..[ ]] [,[, ..[]] [ [ ]]] where: - C0 carrier assigned radio channel (BCCH - Broadcast Control Channel) last setting is 0, - base station identification code; if #CSURVF is a decimal number, else it is a 2-digits octal number - decimal number; it is the receiption level (in dBm) - decimal number; it is the bit error rate (in %) - hexadecimal 3-digits number; it is the mobile country code - hexadecimal 2-digits number; it is the mobile network code - location area code; if #CSURVF last setting is 0, is a decimal number, else it is a 4-digits hexadecimal number #CSURVF is a decimal last setting is 0, - cell identifier; if number, else it is a 4-digits hexadecimal number written authorization - All Right reserved page 587 of 614 Reproduction forbidden without Telit Communications S.p.A.

588 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) - string type; it is the cell status ..0 - C0 is a suitable cell (CELL_SUITABLE). 1 - the cell is low priority based on the received system information (CELL_LOW_PRIORITY). 2 - the cell is forbidden (CELL_FORBIDDEN). 3 - the cell is barred based on the received system information (CELL_BARRED). is low (CELL_LOW_LEVEL). 4 - the cell 5 - none of the above e.g. exclusion timer running, no BCCH available...etc.. (CELL_OTHER). - decimal number; it is the number of valid channels in the Cell Channel Description > ) - decimal number; it is the number of valid channels in the BCCH Allocation list; the output of this information for non- #CSURVEXT setting: serving cells depends on last 9. if this information is displayed only for #CSURVEXT=0 serving cell 10. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. n > ); the output of this #CSURVEXT information for non-serving cells depends on last setting: this information is displayed only for 10. if #CSURVEXT=0 serving cell 11. if #CSURVEXT=1 or 2 this information is displayed also for every valid scanned BCCH carrier. (The following informations will be printed only if GPRS is supported in the cell) - 0 1 - network operation mode 1 2 3 - routing area code 0..255 - > - SPLIT_PG_CYCLE support 0 - 3..6 - page 588 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

589 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) - network control order 0..2 - - timer 3168 - timer 3192 - discontinuous reception max time (in seconds) - packed control ack - blocked sequenc countdown max value - alpha parameter for power control type of channel which shall be used for downlink - measurements for power control 0 - BCCH 1 - PDCH (For non BCCH-Carrier) , where: - decimal number; it is the RF channel - decimal number; it is the receiption level (in dBm) The last information from #CSURVC depends on the last #CSURVF setting: #CSURVF=1 #CSURVF=0 or The output ends with the string: Network survey ended #CSURVF=2 the output ends with the string: Network survey ended (Carrier: BCCh: ) where - number of scanned frequencies - number of found BCCh AT#CSURVC Example Network survey started... 48,24,-52,0.00,610,1,33281,3648,0,2,30 48,5,14 19 22 48 82 14,8 Network survey ended page 589 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

590 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVC - Network Survey (Numeric Format) OK Note The command is executed within max. 2 minute. The information provided by #CSURVC is the same as that provided by #CSURV #CSURVC is in numeric . The difference is that the output of format only. 3.7.5.6.3 #CSURVU - Network Surv ey Of User Defined Channels #CSURVU - Network Survey Of User Defined Channels Execution command allows to perform a quick survey through the given AT#CSURVU=[ channels. The range of available channels depends on the last #BND [,[,... issue. [,]]]] The result format is like command . #CSURV AT*CSURVU=[ [,[,... Parameters: [,]]]] - channel number (arfcn) (both syntax are possible) must be in a increasing order. n >

591 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 User Defined Channels (Numeric 3.7.5.6.4 #CSURVUC - Network Survey Of Format) #CSURVUC - Network Survey Of User Defined Channels (Numeric Format) Execution command allows to perform a quick survey through the given AT#CSURVUC=[ #BND channels. The range of available channels depends on the last [,[,... issue. [,]]]] The result format is like command . #CSURVC AT*CSURVUC=[ [,[,... Parameters: [,]]]] n (both syntax are possible) must be in a increasing order. > Note: the ] The survey stops as soon as BCCH carriers are found. The result format is like command #CSURV . Parameter: - number of desired BCCH carriers 1..M Test command reports the range of values for parameter in the format: AT#CSURVB=? page 591 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

592 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CSURVB - BCCH Network Survey (1-M) is the maximum number of available frequencies depending on last where M selected band. 3.7.5.6.6 #CSURVBC - BCCH Netw ork Survey (Numeric Format) #CSURVBC - BCCH Network Survey (Numeric Format) M (maximum Execution command performs a quick network survey through AT#CSURVBC= number of available frequencies depending on last selected band) channels. [] BCCH carriers are found. The survey stops as soon as format and is like command The result is given in numeric . #CSURVC Parameter: - number of desired BCCH carriers 1..M Test command reports the range of values for parameter in the format: AT#CSURVBC=? (1-M) is the maximum number of available frequencies depending on last M where selected band. 3.7.5.6.7 #CSURVF - Network Survey Format #CSURVF - Network Survey Format Set command controls the format of the numbers output by all the Easy AT#CSURVF= Scan® [] Parameter: - numbers format 0 - Decimal 1 - Hexadecimal values, no text 2 - Hexadecimal values with text Read command reports the current number format, as follows: AT#CSURVF? #CSURVF: Test command reports the supported range of values for the parameter AT#CSURVF=? . page 592 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

593 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.6.8 #CSURVNLF - Removing On Easy Scan® Commands Family #CSURVNLF - Removing On Easy Scan® Commands Family Set command enables/disables the automatic removing from AT#CSURVNLF= each information text line. [] Parameter: 0 - disables removing; they’ll be present in the information text (factory default) from imformation text 1 - remove Note: if parameter is omitted the behaviour of Set command is the same as Read command. removing is currently Read command reports whether automatic AT#CSURVNLF? enabled or not, in the format: . Test command reports the range of values for parameter AT#CSURVNLF=? 3.7.5.6.9 #CSURVEXT - Ex tended Network Survey #CSURVEXT - Extended Network Survey Set command enables/disables extended network survey. AT#CSURVEXT [=] Parameter: 0 - disables extended network survey (factory default) all the network survey execution 1 - enables extended network survey; commands ( #CSURV , #CSURVC , #CSURVU , #CSURVUC , ) display the BAList for every valid scanned #CSURVB , #CSURVBC BCCh carrier all the network survey execution 2 - enables extended network survey; , #CSURVC , #CSURVU , #CSURVUC , #CSURV commands ( #CSURVB , #CSURVBC ) display the BAList for every valid scanned BCCh carrier and, if GPRS is supported in the cell, they report some GPRS informations carried by the System Information 13 of the BCCh Note: if parameter is omitted the behaviour of Set command is the same as Read command. Read command reports whether extended network survey is currently AT#CSURVEXT? enabled or not, in the format: Test command reports the range of values for parameter . AT#CSURVEXT=? page 593 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

594 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.7 Jammed Detect & Report AT Commands 3.7.5.7.1 #JDR - Jammed Detect & Report #JDR - Jammed Detect & Report Set command allows to control the Jammed Detect & Report feature. AT#JDR= [ The MODULE can detect if a communication Jammer is active in its range [,, and give indication to the user of this condition either on the serial line with ]] an unsolicited code or on a dedicated GPIO by rising it. The MODULE can also report to the network the Jammed status condition, even if normal communications are inhibited by the Jammer, by using a unique message. Parameters: - behaviour mode of the Jammed Detect & Report 0 - disables Jammed Detect & Report (factory default) 1 - enables the Jammed Detect; the Jammed condition is reported on pin GPIO2/JDR - Normal Operating Condition LOW GPIO2/JDR GPIO2/JDR - Jammed Condition. HIGH 2 - enables the Jammed Detect; the Jammed condition is reported with a single unsolicited result code on serial line, in the format: #JDR: where: JAMMED - Jammed condition detected OPERATIVE - Normal Operating condition restored. This code will be shown only after a jammed condition has occurred. 3 - enables the Jammed Detect; the MODULE will make both the actions and =2 =1 . as for 4 - enables the Jammed Detect; the Jammed condition is reported with an unsolicited code every 3s on serial line, in the format: #JDR: where: JAMMED - Jammed condition detected OPERATIVE - Normal Operating condition restored. This code will be shown only after a jammed condition has occurred. 5 - enables the Jammed Detect; the MODULE will make both the actions . =4 as for =1 and - Maximum Noise Power Level 0..127 - Disturbed Channel Minimum Number 0..254 page 594 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

595 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #JDR - Jammed Detect & Report Read command reports the current behaviour mode, Maximum Noise AT#JDR? Power Level and Disturbed Channel Minimum Number, in the format: #JDR: ,, Test command reports the supported range of values for the parameters AT#JDR=? and , AT#JDR=2 Example OK ...jammer enters in the range... #JDR: JAMMED ...jammer exits the range... #JDR: OPERATIVE Note It is suggested not to change the default setting for Maximum Noise Power Level and Disturbed Channel Minimum Number. If the device is installed in a particular environment where the default values permit to are not satisfactory the two parameters and adapt the detection to all conditions. page 595 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

596 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.8 Easy Script® Extension - Python 8 interpreter, AT Commands 3.7.5.8.1 #WSCRIPT - Write Script #WSCRIPT - Write Script Execution command inserts a script text and save it with the name AT#WSCRIPT= in the NVM of the module supporting the Python extension. [, , [,]] The script text should be sent using Raw Ascii file transfer. It is important to set properly the port settings. In particular: Baud rate: 115200 bps Flow control: hardware. Parameters: - file name, string type (max 16 chars, case sensitive). - file size in bytes - file hidden attribute (default). #RSCRIPT 0 - file content is readable with #RSCRIPT 1 - file content is hidden, command will report empty file. >>> ' and waits for The device responds to the command with the prompt ' the script file text for bytes. The operations completes when all the bytes are received. If script writing ends successfully, the response is OK ; otherwise an error code is reported Note: The script name should be passed between quotes and all .py extension - Script names are Case Executable Scripts files must have sensitive. Note: When sending the script be sure that the line terminator is and that your terminal program does not change it. Note: with the hidden attribute it is possible to protect your script from being viewed and copied, only the file name can be viewed, its content is hidden even if the file is still being run correctly. It's your care to maintain knowledge on what the script file contains. AT#WSCRIPT="First.py ",54,0 Example >>> here receive the prompt; then type or send the script, sized 54 bytes OK 8 PYTHON is a registered trademark of the Python Software Foundation. page 596 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

597 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #WSCRIPT - Write Script Script has been stored Note This command can also be used to write any text file in the MODULE- PYTHON memory (not script files only), for example application data or . .py settings files with a different extension than 3.7.5.8.2 #ESCRIPT - Select Active Script #ESCRIPT - Select Active Script Set command selects the name of the script that will be executed by the AT#ESCRIPT= Easy Script® interpreter at the start-up. The script will be executed at start- [] LOW during initial start-up (that is: COM is up only if the DTR line is found not open on a PC), otherwise the Easy Script® interpreter will not execute extension will behave normally and the module supporting the Python answering only to AT commands on the serial port. Parameter: - file name, string type (max 16 chars, case sensitive). Note: all script files must have .py extension. Note: The must match with a file name written with the #WSCRIPT in order to have it run. Note: the command does not check whether the script does exist in the NVM of the module supporting the Python extension or is not present at the start-up then the Script not. If the file Interpreter will not execute. Read command reports the name of the script, as a quoted string, that will AT#ESCRIPT? be executed by the Easy Script® interpreter at the start-up. AT#ESCRIPT="First.py " Example OK ps u Script First.py will be executed at the next start- if DTR is found LOW. 3.7.5.8.3 #RSCRIPT - Read Script #RSCRIPT - Read Script . Execution command reports the content of script file AT#RSCRIPT= [] Parameter: - file name, string type (max 16 chars, case sensitive). page 597 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

598 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #RSCRIPT - Read Script <<< ', followed by the The device responds to the command with the prompt ' script file text. was saved with the hidden attribute, then an Note: if the file empty file is reported with the result code. OK Note: If the file is not present an error code is reported. AT#RSCRIPT="First.py " Example hereafter receive the prompt; then the script is displayed, immediately after the prompt <<,... [#LSCRIPT: ,]] #LSCRIPT: free bytes: where: - file name, quoted string type (max 16 chars, case n sensitive) - size of script in bytes - size of available NVM memory in bytes OK result code. returns Test command AT#LSCRIPT=? Example AT#LSCRIPT? #LSCRIPT: “First.py”,51 #LSCRIPT: “Second.py”,178 #LSCRIPT: “Third.py”,95 #LSCRIPT: free bytes: 20000 OK page 598 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

599 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.8.5 #DSCRIPT - Delete Script #DSCRIPT - Delete Script Execution command deletes a script file from NVM memory. AT#DSCRIPT= [] Parameter: - name of the script file to delete, string type (max 16 chars, case sensitive) Note: if the file is not present an error code is reported. AT#DSCRIPT="Third.py" Example OK 3.7.5.8.6 #REBOOT - Reboot #REBOOT - Reboot Execution command reboots immediately the unit. AT#REBOOT It can be used to reboot the system after a remote update of the script in order to have the new one running. AT#REBOOT Example ... Module Reboots ... Note This command does not return result codes. 3.7.5.8.7 #CMUXSCR - CMUX Script Enable #CMUXSCR - CMUX Script Enable Set command enables/disables the use of CMUX interface since the start of AT#CMUXSCR= a Python script and specifies the DTE speed at which the device sends and ,[] receives CMUX frames (used to fix the DTE-DCE interface speed). Parameters: - enables/disables CMUX script. 0 - disables CMUX script (factory default) 1 - enables CMUX script 300 1200 2400 4800 9600 19200 38400 57600 page 599 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

600 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 #CMUXSCR - CMUX Script Enable 115200 (default) If is omitted the value is unchanged and values are saved in NVM #CMUXSCRIPT parameters in Read command returns the current value of ? AT#CMUXSCR the format: #CMUXSCRIPT: , Test command reports the range for the parameters and AT#CMUXSCR =? page 600 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

601 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.9 GPS AT Commands Set 3.7.5.9.1 $GPSP - GPS cont roller power management $GPSP - GPS controller power management Execution command allows to manage power-up or down of the GPS AT$GPSP= controller Parameter: 0 - GPS controller is powered down 1 - GPS controller is powered up (default) Note: for the GPS product (GE863-GPS): if the GPS controller is powered down while camera or VAUX pin is enabled they’ll both also be also powered off. Read command reports return the current status AT$GPSP? Test command returns the range of values accepted (0-1) AT$GPSP=? Example AT$GPSP=0 OK Note If a camera is used with the module and it is powered on, the command will be not executed due to the fact the supply voltage is in common between the 2 devices. $GPSR - GPS Reset 3.7.5.9.2 $GPSR - GPS Reset Execution command allows to manage allows to reset the GPS AT$GPSR= controller. Parameter: 0 - Hardware reset: The GPS receiver is reset and restarts by using the values stored in the internal memory of the GPS receiver. (1 1 - Coldstart (No Almanac, No Ephemeris) : This option clears all data that is currently stored in the internal memory of the GPS receiver including position, almanac, ephemeris, and time. The stored clock drift however, is retained (1 : This option clears all initialization 2 - Warmstart (No ephemeris) data in the GPS receiver and subsequently reloads the data that is currently displayed in the Receiver Initialization Setup screen. The almanac is retained but the ephemeris is cleared. (1 3 - Hotstart (with stored Almanac and Ephemeris) : The GPS receiver restarts b g y usin the values stored in the internal memor of y page 601 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

602 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSR - GPS Reset the GPS receiver; validated ephemeris and almanac. Read command that provides the range of accepted values (0-3) AT$GPSR=? AT$GPSR=0 Example OK (1 Available only in Controlled mode. (SW reset) Note 3.7.5.9.3 $GPSD - GPS Device Type Set $GPSD - GPS Device Type Set Set command defines which GPS device is connected to the module. It AT$GPSD= dedicates the Serial port #1 of the module (TRACE) to receive the GPS strings from the GPS module. Parameter: 0 - none (Serial port not connected to GPS device) 2 - Controlled Mode (Modem serial port connected to GPS serial port – default) (1 Read command that returns the current status AT$GPSD? Test command that provides the range of accepted values for the AT$GPSD=? parameter (0-3) AT$GPSD=0 Example OK AT$GPSD=0 (1 AT$GPSSAV must be executed after to store this setting in memory Note (the new functionality will be available after the next power_on) 3.7.5.9.4 $GPSSW - GPS Software Version $GPSSW - GPS Software Version Execution command provides GPS Module software version in the AT$GPSSW format: $GPSSW: Example AT$GPSSW $GPSSW: GSW3.1.1_3.1.00.07-C23P1.00 OK Antenna Type Definition 3.7.5.9.5 $GPSAT – GPS $GPSAT – Configure GPS Antenna Type Set command selects the GPS antenna used. AT$GPSAT= Parameter: page 602 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

603 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSAT – Configure GPS Antenna Type 0 - GPS Antenna not supplied by the module 1 - GPS Antenna supplied by the module (default) Read command returns the current status AT$GPSAT? Test command provides the range of accepted values (0-1) AT$GPSAT=? Example AT$GPSAT=1 OK Note AT$GPSSAV must be executed to save this configuration If set to 0 the Antenna current and Voltage readout are not available. Refer to the HW user guide for the compatible GPS antennas 3.7.5.9.6 $GPSAV – GPS Ante nna Supply Voltage Readout $GPSAV – GPS Antenna Readout Voltage Read command returns the measured GPS antenna’s supply voltage in AT$GPSAV? mV AT$GPSAV? AT$GPSAV? $GPSAV:3800 OK Note Not available if antenna Type set to 0 3.7.5.9.7 $GPSAI – GPS Antenna Current Readout $GPSAI - GPS Antenna Current Monitor Read command reports the GPS antenna’s current consumption in AT$GPSAI? the format: (1 $GPSAI:[,] where: - the measured current in mA (1 < status> - 0 - GPS antenna OK 1 - GPS antenna consumption out of the limits Example AT$GPSAI? $GPSAI:040,0 OK (1 Available only if antenna protection is activated (see $GPSAP) Note page 603 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

604 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 3.7.5.9.8 $GPSAP – GPS Antenna Protection $GPSAP - GPS Antenna Protection Write command that allows to activate an automatic protection in AT$GPSAP=[,] case of high current consumption of GPS antenna. The protection disables the GPS antenna supply voltage. Parameters: 0 - deactivate current antenna protection (default) 1 - activate current antenna protection - the antenna current limit value in mA (000-200) parameter =0 If parameter is omitted Read command that returns the current antenna limit value in the AT$GPSAP? format: $GPSAP:, and Test command that returns the available ranges for AT$GPSAP=? AT$GPSAP=0 Example OK Note : no SW control on antenna st atus (HW current limitation only) (1 AT$GPSAP=1,25 OK activate current antenna protection with related current limit (1 AT$GPSAP? $GPSAP:1,050 OK Antenna protection activated with 50mA limit (1 Note AT$GPSSAV must be executed to save this configuration The module is already provided of an Hardware protection for the high current consumption that is automatically activated if the consumption exceeds 50mA page 604 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

605 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Data Configuration $GPSNMUN – Unsolicited NMEA 3.7.5.9.9 $GPSNMUN – Unsolicited NMEA Data Configuration Set command permits to activate an Unsolicited streaming of GPS data AT$GPSNMUN= (in NMEA format) through the standard GSM serial port (AT) and defines [,,,,< (1 which NMEA sentences will be available GSV>,,] Parameters: 0 - NMEA data stream de-activated (default) 1 - NMEA data stream activated 2 - NMEA data stream activated with the following unsolicited response syntax: 3 - dedicated NMEA data stream; it is not possible to send AT commands; with the escape sequence ‘+++’ the user can return to command mode - Global Positioning System Fix Data 0 - disable 1 - enable - Geographical Position - Latitude/Longitude 0 - disable 1 - enable - GPS DOP and Active Satellites 0 - disable 1 - enable - GPS Satellites in View 0 - disable 1 - enable - recommended Minimum Specific GPS Data 0 - disable 1 - enable - Course Over Ground and Ground Speed 0 - disable 1 - enable DEFAULT: <0,0,0,0,0,0> The unsolicited response sintax for =1 is: $GPSNMUN: Note: If all parameters are omitted then the behaviour of Set command is the same as Read command Read command returns whether the unsolicited GPS NMEA data AT$GPSNMUN? streaming is currently enabled or not, along with the NMEA sentences availability status, in the format: page 605 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

606 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSNMUN – Unsolicited NMEA Data Configuration ,,,, $GPSNMUN:,, Test command returns the supported range of values for parameters AT$GPSNMUN=? , ,,,,, Example AT$GPSNMUN=1,0,0,1,0,0,0 OK These sets the GSA as available sentence in the unsolicited message AT$GPSNMUN=0 OK Turn-off the unsolicited mode AT$GPSNMUN? $GPSNMUN: 1,0,0,1,0,0,0 OK Give the current frame selected (GSA) The unsolicited message will be: $GPSNMUN: $GPGSA,A,3,23,20,24,07,13,04,02,,,,,,2.4,1.6,1.8* 3C Reference NMEA 01803 Specifications (1 AT$GPSSAV must be executed to save this configuration Note The command is available in “Controlled Mode” only The available NMEA Sentences are depending on the GPS receiver used In GE863-GPS and GM862-GPS the fields PDOP and VDOP are not available Use NMEA serial port instead if full DOP info are needed 3.7.5.9.10 $GPSACP – Get Acquired Position $GPSACP - Get Acquired position information Read command returns information about the last GPS position in the AT$GPSACP format: $GPSACP: ,,,,, ,, ,,, where: - UTC time (hhmmss) referred to GGA sentence - ddmm.mmmm N/S (referred to GGA sentence) page 606 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

607 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSACP - Get Acquired position information Values: dd (degrees) 00 to 90 mm.mmmm (minutes) 00,0000 to 59.9999 N/S: North / South - dddmm.mmmm E/W (referred to GGA sentence) Values: ddd (degrees) 00 to 180 mm.mmmm (minutes) 00,0000 to 59.9999 E/W: East / West - x.x - Horizontal Diluition of Precision (referred to GGA sentence) - xxxx.x Altitude - mean-sea-level (geoid) in meters (referred to GGA sentence) - referred to GSA sentence 1 - Invalid Fix 2 - 2D fix 3 - 3D fix - ddd.mm - Course over Ground (degrees, True) (referred to VTG sentence) Values: ddd: 000 to 360 degrees mm 00 to 59 minutes - xxxx.x Speed over ground (Km/hr) (referred to VTG sentence) - xxxx.x- Speed over ground (knots) (referred to VTG sentence) - ddmmyy Date of Fix (referred to RMC sentence) Values: dd (day) 01 to 31 mm (month) 01 to 12 yy (year) 00 to 99 (2000 to 2099) - nn - Total number of satellites in view (referred to GSV sentence) AT$GPSACP Example $GPSACP:080220,4542.82691N,01344.26820E,259.07,3,2.1 ,0.1,0.0,0.0,270705,09 OK $GPSSAV – Save G PS Parameters Configuration 3.7.5.9.11 $GPSSAV – Save GPS Parameters Execution command saves the current configuration in the non volatile AT$GPSSAV EEPROM memory of the module. page 607 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

608 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 $GPSSAV – Save GPS Parameters Example AT$GPSSAV OK Note The module must be restarted to use the new configuration 3.7.5.9.12 to Default GPS Parameters $GPSRST – Restore $GPSRST – Restore all GPS Parameters Execution command restores the GPS parameters to “Factory Default” AT$GPSRST configuration and stores them in the non volatile EEPROM memory of the module. AT$GPSRST Example OK Note The module must be restarted to use the new configuration page 608 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

609 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 SAP AT Commands Set 3.7.5.10 3.7.5.10.1 #RSEN – Remote Sim Enable #RSEN – Remote SIM Enable Set command is used to enable/disable the remote SIM Feature. AT#RSEN = , [] Parameters: 0 - Disable 1 - Enable 0 - Remote Sim Client ( Default ) 1 – Remote Sim Server ( Unsupported ) Note: If the module has a SIM inserted, when it receive the enable Command: - Terminate all pending call - De-register from the actual network - De-initialize the current SIM. Note: The OK message is not returned until this procedure is not completed. Note: The Remote Sim Protocol is enabled only on the Serial Port Instance where this command is executed. If other instance already started the SAP the latest receive an error. Note: Command return Error if requested on a non multiplexed Interface Return the Enable status of Remote Sim Feature AT#RSEN? Test command returns all supported values of Remote Sim Enable AT#RSEN=? Command 3.7.5.10.2 Sim message (Unsolicited) #RSM: – Remote #RSM: – Remote Sim Message This Message is generated by the module every time it need to access AT#RSM: , the remote SIM. It is automatically enabled as soon as the Remote Sim ,[],[ Feature is Enabled and displayed only on the serial port dedicated to ] the SAP. Parameters: page 609 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

610 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 A sequential number from 0 to 65535 incremented for every unsolicited message sent. It is reset to 0 at the first SAP enable Optional field, it is used only with some specific command Look at Table Command on chapter 5 Optional field, it is used only with some specific command Number of Bytes trasmited with Data Field Optional field, it is used only with some specific command Data field format in Hexadecimal 3.7.5.10.3 te Sim message Command AT#RSM – Remo #RSM – Remote Sim Message This command is used to answer to request generated by the module AT#RSM=, with the unsolicited message. ,[],[ ] Parameters: A sequential number from 0 to 65535, shall be the same of the Request we are answering Look at Table Command on chapter 5 Optional field, it is used only with some specific command Number of Bytes trasmited with Data Field Optional field, it is used only with some specific command Data field format in Hexadecimal Not supported AT#RSM? Test command returns all supported values of Remote Sim message AT#RSM=? Command page 610 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

611 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 te Sim Status Command 3.7.5.10.4 AT#RSS – Remo #RSS: – Remote Sim Status This command is used to inform the Remote SIM client of the status of AT#RSS= the SIM 0 – Not Inserted 1 – Inserted 2 – De-inserted Not supported AT#RSS? Test command returns all supported values of Remote Sim Status AT#RSS=? Command Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved page 611 of 614

612 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 4 List of acronyms Absolute Radio Frequency Channel Number ARFCN Attention command AT BCCH Allocation BA Broadcast Control Channel BCCH Cell Allocation CA Cell Broadcast Message CBM Cell Broadcast Service CBS Current Call Meter CCM Calling Line Identification Restriction CLIR Clear To Send CTS Closed User Group CUG Data Carrier Detect DCD Data Communication Equipment DCE Digital Cellular System DCS Differential GPS, the use of GPS measurements, which are differentially DGPS corrected Domain Name System Server DNS Data Set Ready DSR Data Terminal Equipment DTE Dual Tone Multi Fraquency DTMF Data Terminal Ready DTR GPS Fix data GGA Geographic Position – Latitude/Longitude GLL Global positioning system maintained by the Russian Space Forces GLONASS GMT Greenwich Mean Time Any single or combined satellite navigation system (GPS, GLONASS and GNSS combined GPS/GLONASS) Global Packet Radio Service GPRS Global Positioning System GPS GPS DOP and Active satellites GSA Global System Mobile GSM GPS satellites in view GSV High Level Data Link Control HDLC Horizontal Dilution of Precision HDOP International Mobile Equipment Identity IMEI International Mobile Subscriber Identity IMSI Internet Protocol IP International Reference Alphabet IRA Interworking Function IWF page 612 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

613 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 Mobile Originated MO Mobile Terminal MT National Marine Electronics Association NMEA Non Volatile Memory NVM Personal Communication Service PCS Packet Data Protocol PDP Packet Data Unit PDU Personal Identification Number PIN Point to Point Protocol PPP Pin Unblocking Code PUK Radio Link Protocol RLP Recommended minimum Specific data RMC Request To Send RTS SIM Access Profile SAP Service Center Address SCA Short Message Service SMS Short Message Service Center SMSC Simple Mail Transport Protocol SMTP Terminal Adapter TA Transmission Control Protocol TCP Terminal Equipment TE User Datagram Protocol UDP Unstructured Supplementary Service Data USSD Coordinated Universal Time UTC Vertical dilution of precision VDOP Course over ground and ground speed VTG Wide Area Augmentation System WAAS page 613 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

614 AT Commands Reference Guide 80000ST10025a Rev. 0 - 04/08/06 5 Document Change Log e g R e v s i o n D a s t e C h a n i t D i a R s s e i e C o h a n n v g e ISSUE #0 04/08/06 Initial release page 614 of 614 Reproduction forbidden without Telit Communications S.p.A. written authorization - All Right reserved

Related documents