CM52 at Command Manual Rev R1D

Confidential USERS MANUAL
Document number Revision
1(158)
1/198 17-4/FCP 101 3045 Uen

Prepared by Date
SEM/BMDSB DAVID DUGUID

Contents responsible if other than preparer
2006-03-24
Remarks
This document is managed in metaDoc.

Approved by
SEM/BMDG (JEREMY ROTH)
CM52
Software Users Guide and AT Command Manual
The AT Command Manual is a reference of all the AT Commands that are supported by SEMC in the CM52 module.
Note: Any hard copy of this document is for reference only. Due to template and application dependencies the header and footer may fail to display correct data. It is the responsibility of the user to ensure that they have a correct and valid version. Any outdated hard copy is invalid and must be removed from possible use.

2(158)
1/198 17-4/FCP 101 3045 Uen
Table of Contents 1 Introduction to the Users Guide Command Manual ________________________________________ 14

1.1 1.2 1.3
1.3.1 1.3.2
Overview _______________________________________________________________________________ 14 How to read the manual __________________________________________________________________ 14 Service and Support______________________________________________________________________ 14
Technical Assistance ____________________________________________________________________________ 15 Change Requests _______________________________________________________________________________ 15
1.4
Abbreviations ___________________________________________________________________________ 15
2 3
Overview of the CM52 Module __________________________________________________________ 17 Functional Description ________________________________________________________________ 17

3.1 3.2 3.3 3.4
3.4.1 3.4.2 3.4.3 3.4.4
Voice Calls______________________________________________________________________________ 17 Subscriber Call features __________________________________________________________________ 17 Over The Air Service Provisioning (OTA) ___________________________________________________ 18 Service _________________________________________________________________________________ 19
NAM ________________________________________________________________________________________ 19 Scanning______________________________________________________________________________________ 19 Roaming______________________________________________________________________________________ 20 Registration ___________________________________________________________________________________ 20
3.5
E911 or Emergency Calls _________________________________________________________________ 20
3.5.1 Phase I _______________________________________________________________________________________ 20 3.5.1.1 E911 Scanning ____________________________________________________________________________ 20 3.5.2 Phase 2 or Location Determination _________________________________________________________________ 21
3.6 3.7
Short Message Service ____________________________________________________________________ 21 Data Functionality _______________________________________________________________________ 22
3.7.1 Async data ____________________________________________________________________________________ 22 3.7.2 Quick Net Connect (QNC)________________________________________________________________________ 22 3.7.3 1xRTT _______________________________________________________________________________________ 23 3.7.3.1 Verizons Retry Logic During Service Option 33 Access Attempts ____________________________________ 23 3.7.4 Data Rates ____________________________________________________________________________________ 23
3.8
3.8.1 3.8.2 3.8.3
Application Wake-up _____________________________________________________________________ 24

Details _______________________________________________________________________________________ 24 Behavior______________________________________________________________________________________ 24 Ring Indicator Notes ____________________________________________________________________________ 25
3.9 3.10 3.11 3.12
Real Time Clock (RTC) ___________________________________________________________________ 25 Serial Port Multiplexer ___________________________________________________________________ 25

Module Device Driver (MDD) __________________________________________________________________ 25
3.10.1
Aeris MicroBurst ________________________________________________________________________ 26 Power Down ____________________________________________________________________________ 26

Power Down Registration ______________________________________________________________________ 26 Wait for Notification __________________________________________________________________________ 26
3.12.1 3.12.2
AT Commands_______________________________________________________________________ 27
4.1 General description of AT commands _______________________________________________________ 27
4.1.1 Overview _____________________________________________________________________________________ 27 4.1.2 Command types ________________________________________________________________________________ 27 4.1.3 Command Format and Syntax _____________________________________________________________________ 28 4.1.3.1 Alphabet _________________________________________________________________________________ 28

3(158)
1/198 17-4/FCP 101 3045 Uen
4.1.3.2 4.1.3.3 4.1.3.4 4.1.3.5 4.1.3.6
Command-line editing_______________________________________________________________________ 28 Input Command Syntax______________________________________________________________________ 28 Output Response Syntax _____________________________________________________________________ 29 Unsolicited Message Syntax __________________________________________________________________ 30 Parameter Defaults _________________________________________________________________________ 30
4.2
Information and Identification Commands __________________________________________________ 31
4.2.1 AT (Attention Command) ________________________________________________________________________ 31 4.2.2 AT+GMI (Request Manufacturer Identification)_______________________________________________________ 31 4.2.3 AT+GMM (Request Model Identification) ___________________________________________________________ 31 4.2.4 AT+GMR (Revision Identification)_________________________________________________________________ 32 4.2.5 AT+GSN (Request Product Serial Number Identification) _______________________________________________ 32 4.2.6 AT+CPAS (Phone Activity State) __________________________________________________________________ 33 4.2.7 AT+CSQ (Signal Quality) ________________________________________________________________________ 33 4.2.8 AT+GCAP (Capabilities)_________________________________________________________________________ 34 4.2.9 AT*EIDSUM (Fixed-Format Module Identification Summary) ___________________________________________ 35 4.2.10 AT*EUNSOLM (Numeric or Verbose Unsolicited Messages)__________________________________________ 35 4.2.11 AT*EUNSOL (Control Unsolicited Messages)______________________________________________________ 36 4.2.11.1 Message Waiting Unsolicited Response _______________________________________________________ 37 4.2.11.2 Call Waiting Unsolicited Response __________________________________________________________ 37 4.2.11.3 Service Indicator Unsolicited Response _______________________________________________________ 37 4.2.11.4 RSSI change unsolicited response ___________________________________________________________ 38 4.2.11.5 Caller ID unsolicited response ______________________________________________________________ 38 4.2.11.6 Internal Call State unsolicited response _______________________________________________________ 39 4.2.11.7 Indication of Service State unsolicited response_________________________________________________ 39 4.2.11.8 Call end status unsolicited response __________________________________________________________ 39 4.2.11.9 Mode unsolicited response _________________________________________________________________ 40 4.2.11.10 SMS submit status unsolicited response _______________________________________________________ 41 4.2.11.11 Display unsolicited response________________________________________________________________ 42 4.2.11.12 User Zone unsolicited response _____________________________________________________________ 42 4.2.11.13 OTA programming status unsolicited response _________________________________________________ 43 4.2.11.14 Notification of forwarded incoming calls ______________________________________________________ 43 4.2.11.15 Privacy Mode unsolicited response___________________________________________________________ 43 4.2.11.16 Internal Registration unsolicited response _____________________________________________________ 43 4.2.11.17 Notification of no space to save SMS messages _________________________________________________ 44 4.2.11.18 Timestamp message ______________________________________________________________________ 44 4.2.11.19 DTMF message__________________________________________________________________________ 44 4.2.11.20 FLASH message _________________________________________________________________________ 45 4.2.12 Forced Unsolicited Messages ___________________________________________________________________ 45 4.2.12.1 Startup Unsolicited Message________________________________________________________________ 45 4.2.12.2 Shutdown Unsolicited Message _____________________________________________________________ 46 4.2.12.3 Shutdown Unsolicited Message (RTC Mode) __________________________________________________ 46 4.2.12.4 RING Unsolicited Message ________________________________________________________________ 46 4.2.12.5 Offline Unsolicited Message________________________________________________________________ 46 4.2.12.6 Async Data Communication Established Unsolicited Message _____________________________________ 46 4.2.12.7 NV Restored Unsolicited Message ___________________________________________________________ 47 4.2.13 AT$QCPREV (Display Current CDMA Protocol Revision)____________________________________________ 47 4.2.14 AT*ENETTIME (CDMA Network Time) _________________________________________________________ 47 4.2.15 AT*ECALLERID (Query Caller ID) _____________________________________________________________ 49 4.2.16 AT*ECSTAT (Query Call Status)________________________________________________________________ 49
4.3
4.3.1 4.3.2 4.3.3 4.3.4 4.3.5
NAM Programming ______________________________________________________________________ 50

AT*ESCAN (Stop/Start Scanning) _________________________________________________________________ 50 AT*ERNAM (NAM Programming) ________________________________________________________________ 51 AT*ERPRL (Preferred Roaming List)_______________________________________________________________ 55 AT*ESSE (Select NAM1 or NAM2)________________________________________________________________ 57 AT*EOTAPAS (Prevent/Allow an OTAPA Session) ___________________________________________________ 57
4.4
4.4.1 4.4.2 4.4.3
Call Control ____________________________________________________________________________ 58

ATA (Answer) _________________________________________________________________________________ 58 ATH (Hook Control) ____________________________________________________________________________ 58 ATD Dial command ___________________________________________________________________________ 58

4(158)
1/198 17-4/FCP 101 3045 Uen
4.4.4 4.4.5 4.4.6 4.4.7
ATD Overdial (DTMF Tones) ___________________________________________________________________ 59 ATD! Hook Flash _____________________________________________________________________________ 59 AT+COS (Operating Service) _____________________________________________________________________ 60 AT+CSS (Read Serving System) ___________________________________________________________________ 62
4.5
4.5.1 4.5.2 4.5.3
Registration_____________________________________________________________________________ 62
AT*EREGC (Registration Control) _________________________________________________________________ 62 AT*EREGF (Forced Registration)__________________________________________________________________ 63 AT*EREGT (Retain Registration Time) _____________________________________________________________ 63
4.6
4.6.1 4.6.2 4.6.3
Audio Control ___________________________________________________________________________ 64

AT*EAMS (Audio Mode Selection) ________________________________________________________________ 64 AT*EPCMR (PCM audio Routing) ________________________________________________________________ 65 AT*ENESC (Network Echo Suppression)____________________________________________________________ 65
4.7
4.7.1 4.7.2
Mode Management_______________________________________________________________________ 66
AT+CAD (Query Analog or Digital Service) _________________________________________________________ 66 AT*EPMOD (Preferred Mode) ___________________________________________________________________ 66
4.8
Interface Commands _____________________________________________________________________ 67
4.8.1 ATS0 (Automatic Answer Control) _________________________________________________________________ 67 4.8.2 ATS2 (Escape Sequence Character) ________________________________________________________________ 68 4.8.3 ATS3 (Command Line Termination Character) _______________________________________________________ 68 4.8.4 ATS4 (Response Formatting Character) _____________________________________________________________ 68 4.8.5 ATS5 (Command Line Editing Character) ___________________________________________________________ 69 4.8.6 ATS6 (Pause before Blind Dialing) _________________________________________________________________ 69 4.8.7 ATS7 (Connection Completion Timeout) ____________________________________________________________ 69 4.8.8 ATS8 (Comma Time) ___________________________________________________________________________ 70 4.8.9 ATS9 (Carrier Detect Threshold)___________________________________________________________________ 70 4.8.10 ATS10 (Automatic Disconnect Delay) ____________________________________________________________ 70 4.8.11 ATS11 (DTMF Duration and Spacing Setting) ______________________________________________________ 71 4.8.12 AT&C (DCD Control)_________________________________________________________________________ 72 4.8.13 AT&D (DTR Response) _______________________________________________________________________ 72 4.8.14 ATE (Command Echo) ________________________________________________________________________ 72 4.8.15 AT+IFC (DTE-DCE Local Flow Control) _________________________________________________________ 73 4.8.16 AT+IPR (DTE Rate) __________________________________________________________________________ 73 4.8.17 AT*EMUX (Setup Multiplexer) ***Future Implementation*** ________________________________________ 74 4.8.17.1 Multiplexer Packet Format _________________________________________________________________ 74
4.9
Module Status and Controls _______________________________________________________________ 76
4.9.1 AT+CFUN (Set Functionality Level) _______________________________________________________________ 76 4.9.1.1 Real Time Clock (RTC) Unsolicited Response; in RTC wake mode ___________________________________ 79 4.9.1.2 Real Time Clock (RTC) Unsolicited Response; RTC holding host_en_pwr_b ___________________________ 80 4.9.2 AT*ERTCT (Set RTC Time)______________________________________________________________________ 80 4.9.2.1 Real Time Clock (RTC) Unsolicited Response, Date not set _________________________________________ 81 4.9.2.2 Real Time Clock (RTC) Unsolicited Response, RTC Power On ______________________________________ 81 4.9.3 AT*EWAKESET (Set Wakeup Notifications) ________________________________________________________ 81 4.9.4 AT*EWAKE (Query Wakeup Event) _______________________________________________________________ 82
4.10 4.11
Error Control ___________________________________________________________________________ 83

AT+CMEE (Report Mobile Equipment Error) ______________________________________________________ 83 AT+CMUX (Select Multiplex Option) ____________________________________________________________ 85 AT$QCMIP (Mobile IP Capability) ______________________________________________________________ 85 AT$QCMDR (Set Medium Data Rate) ____________________________________________________________ 86
4.10.1 4.11.1 4.11.2 4.11.3
Data Capability__________________________________________________________________________ 84
4.12
SMS Handling___________________________________________________________________________ 86
4.12.1 AT+CSSM (Send Short Message)________________________________________________________________ 86 4.12.1.1 *ESMSACK (Alert on Delivery) ____________________________________________________________ 89 4.12.2 AT*ESMSFULL (SMS Storage Space Full) ________________________________________________________ 89 4.12.3 AT+CSLM (List Messages)_____________________________________________________________________ 90 4.12.3.1 Unsolicited Message +CSLM _______________________________________________________________ 90

5(158)
1/198 17-4/FCP 101 3045 Uen
4.12.4 AT+CSDM (Delete Message) __________________________________________________________________ 90 4.12.5 AT+CSRI (Receive Message Indications)__________________________________________________________ 90 4.12.5.1 Unsolicited Message +CSTD (Message Notification With Data) ___________________________________ 91 4.12.5.2 Unsolicited Message +CSTI (Message Notification)_____________________________________________ 93 4.12.6 AT+CSRM (Read Message) ____________________________________________________________________ 93 4.12.7 AT*ESMSFLTR (SMS Filter)___________________________________________________________________ 93
4.13
Location Determination___________________________________________________________________ 94
4.13.1 AT*EPDMOD (Position Determination Mode) _____________________________________________________ 94 4.13.2 AT*EPDCF (Location Determination Call Flow) ____________________________________________________ 94 4.13.3 AT*EPDRL (Request Location) _________________________________________________________________ 95 4.13.3.1 *EPDLR (Location Response) ______________________________________________________________ 95 4.13.3.2 *EPDTR (Time Response) _________________________________________________________________ 97 4.13.4 AT*EPDPR (Provide Pseudorange Measurement) ___________________________________________________ 98 4.13.4.1 *EPDPR (Request Pseudorange Measurement) _________________________________________________ 99 4.13.5 AT*EPDREJ (Reject A Request) _______________________________________________________________ 100
4.14
Antenna Capabilities ____________________________________________________________________ 100
4.14.1 AT*EASW (Antenna Switch) __________________________________________________________________ 100 4.14.2 AT*EAFF (Antenna Fail Flag) _________________________________________________________________ 101 4.14.2.1 Antenna failure unsolicited response ________________________________________________________ 102 4.14.3 AT*EANTDIAG (Antenna Diagnostic command) __________________________________________________ 102 4.14.4 AT*EANTLIM (Antenna Limits command)_______________________________________________________ 102 4.14.4.1 Unsolicited Message Antenna Diagnostic Status Change_________________________________________ 103
4.15
Protocol Testing ________________________________________________________________________ 104

AT*EPREV (Protocol Version) ________________________________________________________________ 104 AT*EMRUCLR (Clear the current NAM MRU) __________________________________________________ 104 AT*ESNAP (Display Channel Parameter Snapshot) ________________________________________________ 105 AT+CRM (RM Interface Protocol) ______________________________________________________________ 106 AT$QCMIPP (Select Mobile IP Profile)__________________________________________________________ 107 AT$QCMIPEP (State of Current Mobile IP Profile)_________________________________________________ 107 AT$QCMIPGETP (Mobile IP Profile Content) ____________________________________________________ 108 AT$QCMIPNAI (NAI) _______________________________________________________________________ 108 AT$QCMIPMASS (AAA Shared Secret) _________________________________________________________ 109 AT$QCMIPMHSS (HA Shared Secret) __________________________________________________________ 109 AT$QCMIPRT (Reverse Tunneling) ____________________________________________________________ 110 AT$QCMIPMASPI (AAA SPI) ________________________________________________________________ 110 AT$QCMIPMHSPI (HA SPI) __________________________________________________________________ 111 AT$QCMIPPHA (Primary HA IP) ______________________________________________________________ 111 AT$QCMIPSHA (Secondary HA IP) ____________________________________________________________ 112 AT$QCMIPHA (Home IP) ____________________________________________________________________ 112 AT$QCQNC (Enables/Disables Quick Net Connect) ________________________________________________ 112 AT+CTA (Packet Data Inactivity Timer) _________________________________________________________ 113 AT$QCSCRM (Supplementary Channel Supported) ________________________________________________ 113 AT$QCTRTL (Slow down data at high CPU utilization) _____________________________________________ 114 AT$QCPKND (Scan serial link for PPP packets) ___________________________________________________ 114 AT$QCSO (Data Service Option Selection) _______________________________________________________ 114
4.15.1 4.15.2 4.15.3
4.16
Data Testing ___________________________________________________________________________ 106
4.16.1 4.16.2 4.16.3 4.16.4 4.16.5 4.16.6 4.16.7 4.16.8 4.16.9 4.16.10 4.16.11 4.16.12 4.16.13 4.16.14 4.16.15 4.16.16 4.16.17 4.16.18 4.16.19
4.17
Depreciated Commands _________________________________________________________________ 115
4.17.1 AT*ENSERV (Display Current Service State) _____________________________________________________ 115 4.17.2 AT*ECAM (Call Monitoring) __________________________________________________________________ 115 4.17.2.1 *ECAV (Call Monitoring Event) ___________________________________________________________ 116 4.17.3 AT+CIMI (Read Cellular International Mobile Identity Number) ______________________________________ 116 4.17.4 AT+CLVL (Loudspeaker Volume Level) ________________________________________________________ 117 4.17.5 AT+CMUT (Mute Control) ___________________________________________________________________ 117 4.17.6 AT*EAGVS (AGC/AVC Select) _______________________________________________________________ 118 4.17.7 AT+CUDAH (Default User Destination Address Info)_______________________________________________ 118 4.17.8 AT+CSDCN (Default Call-back Number) ________________________________________________________ 118 4.17.9 AT+CSDSH (Default SMS Header) _____________________________________________________________ 119

6(158)
1/198 17-4/FCP 101 3045 Uen
4.17.10 4.17.11 4.17.12 4.17.13
AT+CSDUH (Default User Data Header) _________________________________________________________ 119 AT+CRC (Cellular Result Codes) _______________________________________________________________ 120 AT+WS46 (Sets the Cellular Protocol Mode) ______________________________________________________ 120 AT*ECPREV (Display Current CDMA Protocol Revision) ___________________________________________ 121
Aeris MicroBurst Feature_____________________________________________________________ 121

5.1
5.1.1 5.1.2 5.1.3 5.1.4 5.1.5
General Information ____________________________________________________________________ 121

Factory Configuration __________________________________________________________________________ 121 System Selection ______________________________________________________________________________ 121 Supported MicroBurst Paging Methods_____________________________________________________________ 121 I/O Pins _____________________________________________________________________________________ 121 Support for Multiple MINs ______________________________________________________________________ 122
5.2
MicroBurst Commands __________________________________________________________________ 122

AT*EDCLR Set MicroBurst Default Values ________________________________________________________ 122 AT*EDCTR Thirty-Two Bit Internal Counter/Register ________________________________________________ 123 AT*EDMFE MicroBurst Function Enable __________________________________________________________ 123 AT*EDFMTP Set Page Match Parameters __________________________________________________________ 125 AT*EDMIN Enter and Display MicroBurst MINs ____________________________________________________ 125 AT*EDWDG Write Dial Digit Buffer _____________________________________________________________ 126 AT*EDMBIO Monitor Binary Input Enable/Disable __________________________________________________ 127 AT*EDSDG Send Current Dial Digit Buffer Contents ________________________________________________ 127 AT*EDRDG Read Current Dial Digit Buffer State ___________________________________________________ 128 AT*EDFREG Force Registration ______________________________________________________________ 129 AT*EDRLP Read Last MicroBurst/Configuration Page _____________________________________________ 129 AT*EDTXS Read Transmit Buffer Status ________________________________________________________ 130 AT*EDSERV MicroBurst Service Search ________________________________________________________ 130 AT*EDSCTR Send Thirty-two Bit Counter Register ________________________________________________ 131 MICRO,1 Unsolicited MIN Page Response ________________________________________________________ 131 MICRO,2 Unsolicited Configuration Packet Page Response ___________________________________________ 131 MICRO,3 Unsolicited MicroBurst Service Detection_________________________________________________ 131 MICRO,4 Unsolicited MicroBurst TX Done _______________________________________________________ 132 MICRO,5 Unsolicited MicroBurst TX Failure ______________________________________________________ 132 MICRO,6 Unsolicited MicroBurst Service SID Change ______________________________________________ 132 MICRO,7 Unsolicited MicroBurst I/O Pin A Change ________________________________________________ 132 MICRO,8 Unsolicited MicroBurst I/O Pin B Change_________________________________________________ 132 MICRO,9 Unsolicited No MicroBurst Service Detected ______________________________________________ 132 MICRO,11 Unsolicited Forward Data Packet Application Data ______________________________________ 133 MICRO,12 Unsolicited Forward Data Packet SDRR Data___________________________________________ 133 MICRO,13 Unsolicited SMS Application Data ___________________________________________________ 133 MICRO,14 Unsolicited SMS SDRR Data _______________________________________________________ 133 MICRO,95 Origination Disallowed ____________________________________________________________ 133 MICRO,96 Unsolicited Forward Data Packet Page Response, Error Detected ___________________________ 133 MICRO,97 Unsolicited SMS Page Response, Error Detected ________________________________________ 133 MICRO,98 Unsolicited MIN Page Response, Error Detected ________________________________________ 134 MICRO,99 Unsolicited Configuration Page Response, Error Detected _________________________________ 134
5.2.1 5.2.2 5.2.3 5.2.4 5.2.5 5.2.6 5.2.7 5.2.8 5.2.9 5.2.10 5.2.11 5.2.12 5.2.13 5.2.14
5.3
MicroBurst Unsolicited Messages _________________________________________________________ 131
5.3.1 5.3.2 5.3.3 5.3.4 5.3.5 5.3.6 5.3.7 5.3.8 5.3.9 5.3.10 5.3.11 5.3.12 5.3.13 5.3.14 5.3.15 5.3.16 5.3.17 5.3.18
User scenarios ______________________________________________________________________ 134

6.1 6.2 6.3 6.4
6.4.1 6.4.2
Configuring HyperTerminal______________________________________________________________ 134 Setup CM52 for serial communication _____________________________________________________ 135 Proper Shutdown procedure______________________________________________________________ 135 Acquiring Cellular Service _______________________________________________________________ 136
Over the Air Programming (OTA)_________________________________________________________________ 136 Manual Activation _____________________________________________________________________________ 136
6.5
6.5.1
NAM Programming _____________________________________________________________________ 137

Enter NAM programming mode __________________________________________________________________ 137

7(158)
1/198 17-4/FCP 101 3045 Uen
6.5.2 6.5.3 6.5.4 6.5.5 6.5.6
Read NAM ___________________________________________________________________________________ 138 Write NAM __________________________________________________________________________________ 138 Writing a PRL ________________________________________________________________________________ 139 Reading a PRL ________________________________________________________________________________ 139 Exit NAM programming mode ___________________________________________________________________ 139
6.6 6.7
6.7.1 6.7.2 6.7.3 6.7.4
Unsolicited Messages ____________________________________________________________________ 140 Call Processing _________________________________________________________________________ 140

Call origination _______________________________________________________________________________ 140 Answer Incoming Call __________________________________________________________________________ 140 Hang Up Call _________________________________________________________________________________ 140 DTMF tones while on a call______________________________________________________________________ 140
6.8
6.8.1 6.8.2 6.8.3 6.8.4
Subscriber Calling Features ______________________________________________________________ 140

Caller ID_____________________________________________________________________________________ 141 Call Forward _________________________________________________________________________________ 141 Call Waiting __________________________________________________________________________________ 141 Three-way calling _____________________________________________________________________________ 142
6.9
SMS __________________________________________________________________________________ 142
6.9.1 Mobile Originated (MO) Messages ________________________________________________________________ 142 6.9.1.1 Sending Text Data to MIN __________________________________________________________________ 142 6.9.1.2 Sending binary data ________________________________________________________________________ 142 6.9.1.3 Sending Text to Email Address_______________________________________________________________ 142 6.9.2 Mobile Terminated (MT) Messages________________________________________________________________ 143 6.9.2.1 Temporarily store SMS Messages_____________________________________________________________ 143
6.10
Data Communication ____________________________________________________________________ 143

Prepare CM52 for Data services ________________________________________________________________ 143 CM52 Windows NT PC Installation Procedure ___________________________________________________ 143 To Make an Asynchronous Data Call (CSD)_______________________________________________________ 144 To Make a QNC Data Call (Packet over Circuit Switched) ___________________________________________ 144 To Make a 1x HSPD Call, Simple IP only on Verizon _______________________________________________ 144 To Make a 1x HSPD Call, Mobile IP Preferred on Verizon ___________________________________________ 145 External GPS _______________________________________________________________________________ 145 Internal GPS _______________________________________________________________________________ 146 Single Event Case ___________________________________________________________________________ 146 Multiple Event Case _________________________________________________________________________ 147 RTC Event Case ____________________________________________________________________________ 147
6.10.1 6.10.2 6.10.3 6.10.4 6.10.5 6.10.6
6.11
Location Determination Call Flows ________________________________________________________ 145
6.11.1 6.11.2
6.12
Application Wake-up Examples ___________________________________________________________ 146
6.12.1 6.12.2 6.12.3
6.13
RTC Examples _________________________________________________________________________ 148
6.13.1 Ring Indicator Example_______________________________________________________________________ 148 6.13.2 Application Wakeup RTC Example _____________________________________________________________ 149 6.13.2.1 Module not powered on __________________________________________________________________ 150 6.13.2.2 Module powered on _____________________________________________________________________ 150 6.13.2.3 Module powered on and currently powering down______________________________________________ 150
Test Scenarios ______________________________________________________________________ 151

7.1 7.2 7.3 7.4 7.5 Running CAIT/QXDM with the CM52 _____________________________________________________ 151 Programming the correct PRL using External Tools _________________________________________ 151 MOB_P_REV __________________________________________________________________________ 151 Modifying the Service ___________________________________________________________________ 151 Set Voice Privacy _______________________________________________________________________ 151
CM-42 Software Compatibility _________________________________________________________ 151

8(158)
1/198 17-4/FCP 101 3045 Uen
8.1 8.2 8.3
Features _______________________________________________________________________________ 152 AT Command Differences________________________________________________________________ 152 Unsolicited Message Differences___________________________________________________________ 157

9(158)
1/198 17-4/FCP 101 3045 Uen
Revision History
RELEASE PA1 PA2 PA3 PA4 PA5 PA6 DATE 6/22/04 7/6/04 7/7/04 8/13/04 9/1/04 SUMMARY OF CHANGES
Initial Release of AT command manual. Editorial Changes Editorial changes made by Dave Hoover Document review changes made Style and format changes NAM tag 50 parameters modified to complement AT*EPMOD. Updates to unsolicited messages to more closely resemble the CM-42 when applicable. Clarification of AT*ENSERV results AT*ESNAP added back into document under protocol commands. Additional documentation to the SMS handling section. Additional documentation to the SERVICE STATE unsolicited message Added a new Service header to detail general service, scanning, roaming, etc in one centralized location. Cleared up +CMEE implementation Removed Result Code tables from the AT commands since every AT command has a result code of either OK or ERROR, it was completely redundant information that is now explained in the AT command syntax section. Removing 14 data commands; commands are not used by our customers. The commands are advanced functionality not needed by most applications. Fixed data user scenarios, changed to few SEMC AT commands to Qualcomm equivalent. Corrected the format of the validity period in AT+CSSM Replaced the parameter descriptions for +CSTD with a reference to AT+CSSM Spelling correction in AT*EOTAPAS Added additional information to the call back number parameter in AT+CSSM Changed any occurrence of AT*ECMUX to AT*EMUX. Clarification of a-key contents Added AT+CSLM, AT+CSRM, AT+CSRI, AT+CSDM, & +CSTI. Added BUFFERFULL unsolicited message for SMS Removed AT$SPNAI since it is a Sprint only function. Added AT$QCMDR back into document. Removed AT+CXT & AT+CFG Removed AT*EGODIAG; refer to PRI for setting Removed AT*EAPCS; Power class controlled by 3watt hardware feature. Removed AT*ECARRIER & AT$PZID; currently only supporting Verizon. Added service options 32, 54, & 55 to AT+COS command. Updates to AT+COS Reflecting the fact that ATS0 is now persistent Removed E911 read option in AT*EPMOD Reflected the fact that nid is returned with SERVICE unsolicited message Removed COS=8 from AT+COS command (table explains how to set up packet data call Clarifications made to the user scenarios Parameters associated with AT+IFC are NOT persistent AT*EOTAPAS is issued against the current NAM and not both NAMs Changed the default setting of AT+CTA from 20 to 30 seconds to match Verizon specification.
PA7
9/9/04
PA8
9/10/04
PA9
9/22/04
PA10
10/7/04
PA11
10/15/04
PA12 PA13
10/21/04 10/27/04

10(158)
1/198 17-4/FCP 101 3045 Uen
RELEASE PA14
DATE 11/09/04
SUMMARY OF CHANGES
Changed the default email addressing for SMS to MAIL AT+CSLM will free up the AT port for command processing before all messages are reported (+CSLM: EOL signifies the end of the list). Clarification that AT*EPMOD will return ERROR if the module is on a call. Fixed AT*ESNAP to reflect the correct service options (refer to AT+COS). Clarifications to *EUNSOL: RSSI and AT+CSQ Added descriptions for RING, Restart, CONNECT, and OFFLINE unsolicited messages. Clarification of asynchronous data calls Added error message text to AT+CMEE Clarification about the A and T being required for command echoing purposes (added a small comment about responses from module if a command character is lost). Clarification on size limits for SMS messages Corrected defaults for AMPS Home SID and system preference. Adding a section that describes the compatibility with the CM-42. Adding a few requested CM-42 backward compatibility AT commands (it is encouraged these commands not be used but will be fully supported) Enhancing the User Scenarios, adding more detail. Added a Test Scenarios section to assistance common external tests. Updated the support section. Clarification on AT+COS Clarification on AT+CSSM Removed Calling option from AT*ECAM (*ECAV) Changed document name to S/W Users Guide and AT Command Manual Added an explanation of the NV Restore feature Added an explanation of the Multiplexer feature Added unsolicited messages to the CM-42 compatibility section Added more unsolicited message to the CM-42 compatibility section Changed the default display option for AT+CSRI Updated AT*ESCAN description to indicate that the NO SERVICE message is displayed only when the module has service at the time the command is issued. Reformatted Table of Contents AT+CSLM parameter no longer optional to CM-42 compatibility Changed AT&D default from 0 to 2 Changed AT&C default from 1 to 2 Corrected grammatical errors Updated the Data User scenarios Clarifications in +CSTD & AT+CSSM Added Ring Indicator handling Added RTC handling Added Shutdown Complete unsolicited messages Added the TIMESTAMP unsolicited message Clarification to SYS_PREF NAM entry Modified 3-way calling user scenario (Verizon changed how it is done) Several changes to the RTC usage and AT+CFUN=10 Added CRC into the manual Modified the behavior of AT*EPMOD if parameters are not specified.
PA15
11/10/04
PA16
11/24/04
PA17 PA18
12/12/04 12/15/04
PA19 PA20 PA21 PA22 PB1
12/15/04 12/16/04 12/17/04 12/20/04 1/13/05
PB2
1/25/05

11(158)
1/198 17-4/FCP 101 3045 Uen
RELEASE PB3
DATE 2/1/05
SUMMARY OF CHANGES
Adds Aeris Microburst descriptions, commands, and error codes Adds of comment on AT*EREGC disabling by MicroBurst enable. Adds bit 0x80 to AT*EREGC for Parameter Based Registration Adds command difference entries for AT*OACQPRL, AT*OACQTYPE, AT*EDMBIO, AT*EDSCTR, AT*EDMFE Adds Unsolicited message differences for MICRO,7, MICRO,8, MICRO,10, MICRO,96, MICRO,97 messages Corrected a few section headers (incorrect font) Consistent usage of hex-coded and TBCD phrases Added a Julian Date/Time option to AT*ENETTIME Added location determination unsolicited message *EPDTR Verizon clarification to AT$QCMIPNAI Comment to MIP user scenario regarding the MDN Changed units of measure for <timezone> in AT*ENETTIME Added FLASH & DTMF unsolicited messages to AT*EUNSOL Added AT+WS46 for CM-42 backward compatibility Changed defaults for AT+CSRI to match the code Note in AT command compatibility section suggesting the parameters associated with AT commands be reviewed in addition to the AT command. Clarification to service indicators in AT*EWAKESET Removed unnecessary, and confusing, parameters from unsolicited message *EPDPR Clarification to AT*EUNSOL regarding the use of the <control> parameter. AT Command difference table sorted alphabetically by command and updated to include information about parameter differences Added conversion example for AT+GSN command SMS submit unsolicited message had incorrect message number for DTC has been disconnected by the module; it was 32778 but should be 32779. Set RTC wakeup to minute granularity Binary SMS MO example had one to many commas Port mapping and DMU data now saved in backup/restore feature Adding AT*ESMSFLTR for application control over SMS message types received. Noting the Ring Indicator pin assert time is configurable in the PRI. Adding Antenna failures and antenna diagnostics to the Ring Indicator settings. Added clarification of a race condition where an application was notified of an incoming call by the Ring Indicator, but the call was dropped before the application queried the module for the wakeup reason. Added AT*ECALLERID to poll for the caller ID Modification to AT*EANTDIAG to query both Antennas if hardware supports a two antenna configuration. Clarification that the RTC should be defined as UTC time. Clarification to AT*EWAKE regarding issuing AT*EWAKE just before application powers down to clear the wake reason settings. Added Application wake-up functional description section Added Application wake-up examples to the user scenarios Added more details regarding the RTC (functional description) Fixed the RTC unsolicited message format Clarification regarding a scan to Digital only when sending SMS messages Escape sequence clarified RTC time/date updates clarified Added some details regarding registration to the functionality section Added details regarding Verizon throttling of 1x data retry attempts Moved OTA description from User Scenarios to Functional Description
PB4
2/1/05
PB5 PB6 PB7 PB8
2/15/05 3/1/05 3/2/05 3/11/05
PB9
4/11/05

12(158)
1/198 17-4/FCP 101 3045 Uen
RELEASE PB10
DATE 4/15/05
SUMMARY OF CHANGES
Syntax correction to manual to reflect software (antenna unsolicited messages) A few clarifications to OTASP (providing all OTA status & dropping the call aborting the OTA process). Updated documentation to reflect the SMS timestamp parameter Added some details to the TIMESTAMP unsolicited message Explanation of ATH to terminate an incoming call without first answering it Adding a comment about AT+CFUN=99 CALL END terse mode values changed to match module Details regarding the CM52 timing out of a wait for answer state Minor grammatical corrections throughout document Added AT*ECSTAT command Added information regarding an extended error code when using AT*ECALLERID Added AT*EREGT Removing REGISTRATION TIMER (ON | OFF) unsolicited messages Note regarding the negative SID/NID requiring the module to be restarted Minor grammatical corrections throughout the document Documented module behavior for an OTA SPC failure Documented the keep awake option, AT+CFUN=20 Change to reflect the modules capability to determine when the RTC was powering the module down and the host application is power the module up. Changed the message time for RTC,WAKETIME from 3 to 5.12 seconds to match the sleep cyclekeeps power consumption low Note regarding RI and unsolicited message correlations Changed the name of the RTC keep awake unsolicited message to RTC,AWAKE Replacing AT*ECPREV? with AT$QCPREV. Moving some data commands out of the general AT commands as they apply more to system/network testing and debugging and should not be designed into an external application. Added a small description that the module supports two NAMs Changed No requirement to Not Supported in the CM-42 compatibility table Grammar change in AT*ECSTAT DTMF unsolicited message clarification SERVICE unsolicited message clarification Updated the module behavior for an OTA SPC failure with references to the expected unsolicited message Updated the AT+CSRI command description to indicate that message buffer space is required to receive messages Updated AT*EREGC command regarding ordered registrations. Updated data testing commands to include additional commands as required by Verizon. Also updated the data testing command section with information regarding defaults versus carrier (Verizon) defaults. Updated all fields, TOC Grammatical Updates Added informational chapter regarding proper shutdown Added informational chapter regarding the validity of RI pin at power-up. Updated sections describing AT$QCMIPMASS and AT$QCMIPMHSS with information regarding default settings.
PB11 PB12
4/29/05 5/12/05
PB13
5/20/05
PC1
8/10/05
PC2 PC3 PC4 PC5
8/17/05 9/14/05 9/15/05 9/16/2005

13(158)
1/198 17-4/FCP 101 3045 Uen
RELEASE PC6
DATE 9/19/2005
SUMMARY OF CHANGES
Reviewed document for consistency Updated grammatical errors. Updated formatting inconsistencies Added tables for parameter information that was in paragraph form Recast command descriptions to be in the active present tense Replaced all instances of CM-52 with CM52, per SEMC marketing material. Updated table formatting for readability & consistency. Added indication that AT*EMUX command is NOT currently supported. Added information regarding the function of AT*EPMOD when a digital-only or AMPS-only PRL is loaded. Added information about the possible differences between CM42 and CM52 audio settings. Added information regarding AT*ESCAN command and E911call interaction. Added note regarding guard times to ATS2 command description Added information regarding ERROR to be returned when AT commands are issued that attempt to use features that are not supported via hardware or software feature flags, including these commands: o AT*EAFF o AT+CFUN=10 o AT+CFUN=20 o AT*ERTC o AT*EASW o All Microburst commands Added information regarding the impact of OFFLINE mode on the AT*EPMOD command Released as formal release C. No changes Updated AT+CSQ? command with clarifications on when the command is valid Updated AT*EPMOD command with information regarding its ability to cope with multiple issuance of the command (M2M00123896). Updated AT+CFUN=0 command with information regarding Fatal Errors (M2M00124208) and information regarding all CFUN shutdowns being proper shutdowns (M2M00124264). Updated AT+CSRM & *EUNSOL: SMS_SUBMIT commands to use message reference instead of index based on VZW feedback (M2M00124290). Updated the Power down chapter to include information regarding the power down registration timeout and information regarding waiting for the shutdown complete message. Removed an invalid reference to the DTR pin
PC7
10/05/2005
PC8
10/25/2005
C PD1
12/29/2005
PD2 PD3
2/15/2006 3/23/2006

14(158)
1/198 17-4/FCP 101 3045 Uen
1
1.1
Introduction to the Users Guide Command Manual

Overview
AT commands are used for communication between the CM52 module and an application. All the AT commands that are supported by CM52 are described in this AT command manual. The CM52 Integrators manual, which is provided with the CM52 module, contains information on the CM52 hardware, mechanics, Developers Kit and how to get started in general. This manual assumes that the CM52 module is connected properly as defined in the Integrators manual and is ready to start AT command communication.
1.2
How to read the manual
This manual is divided into five chapters. Chapter 1 provides a general overview of the AT command manual. This chapter contains abbreviations used throughout the AT command manual and also contains information concerning Service and Support. Chapter 2 is a brief overview of the CM52 module. Detailed information about CM52 and the Developers kit can be found in the CM52 Integrators Manual. Chapter 3 describes the main functions and capabilities of the CM52 module. Chapter 4 contains all of the AT commands that are supported by the CM52 module. Each AT command has a description of its function and of its parameters. Examples are provided for some of the commands. In addition to the descriptions of each AT command, the chapter begins with a description on how to use AT commands in general. Chapter 5 provides additional information about how to use the AT commands. This chapter contains user scenarios for a variety of features. Chapter 6 provides descriptions and examples on how to use many of the features that are supported by the CM52. Examples are provided throughout this manual to clarify the text descriptions. All AT command examples are written in Courier font. To differentiate AT commands from the host controller and responses from the CM52 module, the responses are written in gray color.
1.3
Service and Support
Please visit the Sony Ericsson M2M web pages for more information about where you can purchase Sony Ericsson modules or for recommendations regarding accessories and components. The web address is: http://www.sonyericsson.com/m2m To register for product news and announcements or for product questions, contact the Sony Ericsson modules Technical Support group: Phone Number: (919) 472-1122 (staffed Monday-Friday 9:00 AM 5:00 PM EST) E-mail: mailto:modules.supportUSA@SonyEricsson.com

15(158)
1/198 17-4/FCP 101 3045 Uen
1.3.1 Technical Assistance When you request technical assistance from SEMC, there are several pieces of information that will help to resolve your issue. If the issue is a software issue, please provide the following information (all statements may not apply): Whether the testing was done on a live network and/or Communication Analyzer. If the testing was done on a live network, provide all relevant information about the account (carrier, features, etc). Additionally, please provide the SID and channel that the module is camped on and indicate whether the SID is associated with the Carrier the account is with. What level of hardware and software is being used? This information can be retrieved from the module by issuing the following command: AT*EIDSUM? Provide an AT command log of the issue that is actually occurring. SEMC prefers all unsolicited messages to be enabled, and AT commands and responses should be time stamped if possible. It can be helpful to both SEMC and its customers if the issue can be recreated on the SEMC development board. Doing so removes any involvement with the customer application. Have any configuration changes been done to the module since it was received? For example, has the PRL been updated? If the module has been configured, provide the new settings. Please provide the CDMA protocol revision. This information can be retrieved by issuing the following command: AT*ECPREV? A QXDM/CAIT log is always helpful in resolving issues. If providing such a log please capture at least one minute of log data both before and after the issue. Also, please note the approximate time in the log where the issue occurred.
1.3.2
Change Requests
It is recommended that any request for a change be made to the sales or project department within SEMC. The request for a change must be documented. SEMC recommends that the customer complete the Change Request form supplied by SEMC.
1.4
AAA AEC AKEY AFLT AFMS ATMS AT CDMA CFU CFNA CFB CSD CTS DCD DTR ESEC EFR ERI ESN
Abbreviations
Authentication, Authorization, and Accounting Acoustic Echo canceller Authentication key Advanced Forward Link Trilateration Audio From Mobile Station (refers to audio pins on the system connector) Audio To Mobile Station (refers to audio pins on the system connector) Attention command Code Division Multiple Access Call Forward Unconditional Call Forward on No Answer Call Forward on Busy Circuit Switched Data Clear To Send Data Carrier Detect Data Terminal Ready Ear Seal Echo Canceller Enhanced Full Rate (speech coding) Enhanced Roaming Indicator Electronic Serial Number

16(158)
1/198 17-4/FCP 101 3045 Uen
FCC GPS GSM HA HSPD IA5 IP IRA ISDN ISO LD ME MIP MO MRU MS MSB MT NAM NAI NID NV OEM OTA OTASP OTAPA PCM PDE PIN PPP PR PRI PRL QNC Rate Set 1 Rate Set 2 RF RI RLP RTC RM RS RTS S3 S5
Federal Communications Commission Global Positioning System Global System for Mobile Communications Home Agent High Speed Packet Data T.50 International Alphabet 5 Internet Protocol International Reference Alphabet Integrated Services Digital Network International Standards Organization Location Determination Mobile Equipment Mobile IP Mobile Originated Most Recently Used Mobile Station Most Significant Bit Mobile Terminated Number Assignment Module Network Access Identifier Network Identifier Non-Volatile memory Original Equipment Manufacturer Over the Air Programming Over the Air Service Provisioning Over the Air Parameter Administration Pulse Code Modulation Position Determination Equipment Personal Identification Number Point to Point Protocol PseudoRange Product Revision Information Preferred Roaming List Quick Net Connect (9600, 4800, 2400, 1200), over the air link rate is up to 9600 bps (14400, 7200, 3600, 1800), over the air link rate is up to 14400 bps Radio Frequency Ring Indicator Radio Link Protocol Real Time Clock Relay Module Rate Set Request To Send Termination Character Editing Character

17(158)
1/198 17-4/FCP 101 3045 Uen
SEMC SID SLC SMS SO SPC SPI TCP QNC
Sony Ericsson Mobile Communications System Identifier Subsidy Lock Code Short Message Service Service Option Service Programming Code Security Parameter Index Transmission Control Protocol Quick Network Connection
Overview of the CM52 Module
The CM52 is a dual band CDMA/AMPS 800 MHz and CDMA 1900 MHz transceiver module. It is designed for consumer and OEM industrial voice and data applications. At this time, the SEMC customer base requires data only applications; therefore voice capabilities have not been addressed. The CM52 module is intended for mounting into an application developers chassis to provide wireless communication capability for the product. The target chassis may take a wide variety of forms, such as a residential electric meter, a point of sale terminal, an alarm panel, or an automobile console. All initial configuration, mode control, and operational commands are issued to the CM52 module over an RS-232 serial port using a flexible AT command format. This manual provides a description of the software features available and all of the AT commands that are supported in the CM52 and how to use them. For more information about the CM52 module refer to the Integrators Manual.
Functional Description
This chapter describes the functional capability of the CM52 module. The module performs a set of telecom services according to TIA/EIA/IS-2000. AT commands are used for communication with CM52.
3.1
Voice Calls
Basic voice calls are supported over CDMA and AMPS according to the following specifications: Telephony according to TIA/EIA/IS-2000. Emergency according to TIA/EIA/IS-2000. An incoming call is indicated by an unsolicited response code (RING indicator). The module must be registered with the network before the network will send an incoming call to the module. Due to power saving algorithms, the CM52 will time out of the wait-for-answer state after approximately 22 RING attempts. After the timeout occurs, the module will tear down the call. In addition, the carrier implementation usually limits the time duration for ringing. Thus the actual number of RING indications could be limited by the network. When this limit is reached, the network will initiate tearing down the call. An outgoing call can be made before the module has registered with the network. An outgoing call is considered an implicit registration: the network has been made aware of the module through the call request. The audio input and output signals in the interface (AFMS and ATMS) will carry analog speech in full duplex (transmitting and receiving simultaneously).
3.2
Subscriber Call features
The CM52 module supports the following Subscriber Call features: Caller ID. Enables/disables the callers ID from being sent to the called party.

18(158)
1/198 17-4/FCP 101 3045 Uen
Call Forwarding. Permits the called module to have the network send incoming calls to a desired phone number. Call Waiting. Permits the module to be notified of an incoming call during an active call. For example, if the module is engaged in an active call, the module can accept, reject or ignore the incoming call. 3-Party Conference Calls. Permits the module to maintain simultaneous communication with more than one party. Voice Mail. Permits the module to activate/deactivate voice mail. In addition, the module can retrieve voice mail held for the user. Note: Some subscriber call features, such as Call Forwarding and Call Waiting, may vary depending on your service providers network. Subscriber call features are activated and deactivated via the ATD command using specific codes. These codes might vary depending on the service provider. Consult your service provider for additional information.
3.3
Over The Air Service Provisioning (OTA)
The CM52 supports TIA/EIA/IS-683-A: Over-the-Air Service Provisioning of Mobile Stations in Spread Spectrum Systems. Over the air programming is a mechanism that enables service providers to program mobile equipment (ME) to match their network requirements. For the CM52, OTA is typically used to update NAM values, download a PRL, update the A-key, etc. OTA will not write the updates until all desired data has been downloaded into the module. This prevents incomplete or inconsistent data from being written when the connection is prematurely terminated and OTA did not complete all the programming. OTA has two variants: OTA Service Provisioning (OTASP) and OTA Parameter Administration (OTAPA). OTASP is used to initially program the ME. OTASP is initiated from the ME. OTAPA is used to apply updates to an ME that is already provisioned. OTAPA is initiated from the service provider. OTAPA is transparent to the user/application of the ME. If an OTAPA session is in progress and an outgoing call is placed, OTAPA will continue to program the phone in the background. The progress of the OTA programming is reported by using the *EUNSOL unsolicited responses. See the AT*EUNSOL command for more information. Note: the CM52 provides more status information than some Carriers feel should be provided to handset users. It is left to the host application to determine what status data to provide to the user, keeping the Carriers requirements in mind. Initiating OTASP is done via a call to *228xx; where xx indicates the frequency range: xx 00 01 02 03 04 05 06 07
Frequency
800 MHz, A-Band 800 MHz, B-Band 1.8 GHz, A Block 1.8 GHz, B Block 1.8 GHz, C Block 1.8 GHz, D Block 1.8 GHz, E Block 1.8 GHz, F Block

19(158)
1/198 17-4/FCP 101 3045 Uen
Therefore, ATD*22800 will initiate an OTASP call to the 800 MHz A-band. If the module is locked onto the correct frequency as it relates to the service provider, the frequency does not need to be specified in the dial command. Therefore, ATD*228 will connect to the service provider as defined by the current PRL for the module. It may not necessarily be the current serving system. Depending on the service provider, there could be additional frequency numbers. Refer to your service provider for more information. Some of the frequency numbers act on the data found in the PRL, or more accurately the scan list. Keep in mind the command AT*EPMOD affects the behavior of the PRL/scan list, and depending on its setting, may affect the outcome of the OTASP session. The network can initiate an OTAPA session. Currently, you cannot trigger the network to perform an OTAPA session. As a result, OTAPA cannot be tested on a live network (SEMC uses RACAL test boxes to test OTAPA functionality). Several notes of interest: Not all carriers support OTA. Contact your service provider to determine if OTA is supported. Each Carrier handles how OTA is done. For example, Verizon uses an automated system; therefore the user must listen to the menu and follow the instructions. To simulate key presses, use the ATD command to over dial DTMF tones. OTA is performed with a digital signal. If the module is set to Analog mode, the module will switch to a digital signal for OTA then return back to an Analog signal. If, however, a digital signal is not available when OTA is initiated, the call to the network will be completed, but OTA cannot be performed. If the OTA call is disconnected before the data is committed to NV or the NAM, the programming session is aborted. Once the data has started to be written to the NAM or permanent storage, the data will be committed even if the call is terminated. If the OTA programming should fail the SPC verification 15 consecutive times, the module will provide an unsolicited message indicating excessive SPC verification failures (see section 4.2.11.13) and then shutdown. This is in accordance to Verizons OTA specification. The host application must prevent the module from restarting for 1 minute when this condition occurs.
3.4
Service
The module will attempt to camp on the most preferred service available, where most preferred service is defined by the PRL. AT*EPMOD and the NAM can potentially alter what service the CM52 will camp on despite the PRL. 3.4.1 NAM The CM52 supports two fully capable and independent NAMs with associated PRLs. The module provides external application access to the NAM parameters with the exception of being able to read the A-key. As reference above, OTA programming can populate the current NAM. The primary purpose for using two NAMs is so the module can have two independent cellular accounts. Because the NAMs are independent, authentication and other account specific data is stored independently of the other NAM. Therefore, the two NAMs should not be used interchangeably with a single cellular account 3.4.2 Scanning If the CM52 is not on the most preferred service in the PRL, the CM52 will periodically rescan looking for better service. Note: the SID/NID list in the latest Qualcomm code no longer designates the most preferred service. A rescan for the most preferred service also will occur any time a traffic channel has been released if the last used SID was not the most preferred. The CM52 supports a ten entry deep Most Recently Used channel table (MRU) that assists with the scanning.

20(158)
1/198 17-4/FCP 101 3045 Uen
3.4.3 Roaming The CM52 will report whether the unit is home or roaming. The roaming indicator is read from the PRL. The AMPS Home SID and CDMA SID/NID list entries are considered home and take precedence over the PRL value. Carriers may alter what the roam indicator in the PRL is defined to be: home or roam. The CM52, however, will always report the roaming indicator as follows: 0 Indicates the module is home 1 Indicates the module is roaming 2 Indicates the module is flashing x For ERI purposes, this value is retrieved directly from the PRL 3.4.4 Registration When the module has found service, it will register in accordance to the registration information sent from the network, such as how often to register or whether a power down registration should occur. The CM52 provides several AT commands to customize the registration. Note: the resulting behavior needs to be approved by the host carrier. If a rescan results in the same service on which the module was previously camped, then it will not re-register. This is true even when forcing the module to different modes. For example, if the module is set to Digital preferred mode, is currently camped on AMPS service (because no digital signal could be found), an application forces the module to AMPS only mode and the previous AMPS service is found, the module will NOT re-register. When the module acquires service for the first time after a power cycle, the module will wait for 20 seconds before registering according to the IS-2000 standard. During the time duration between acquiring service and registering, outgoing calls can be made. However, because the module has not informed the network of its presence, it will not be paged for incoming calls. After the module registers, incoming pages will be sent by the network.
3.5
E911 or Emergency Calls
The CM52 has three hard coded E911 values; 911, *911, and #911. In addition, the CM52 has three programmable emergency numbers. Programmable numbers could be E911 equivalents in other countries, or could be a vendors private E911 numbers. The CM52 handles all E911 numbers in the same manner. The three programmable emergency numbers are stored in NAM; therefore NAM programming is necessary to set and read the values. Refer to the AT*ERNAM command for more details. NAM 1 and NAM 2 use the same set of emergency numbers.
3.5.1
Phase I After the completion of an emergency call the module will not rescan. Should the call center need to call the CM52 back, the module will still have service on what could be a channel that is not normally allowed. A rescan will occur after one of the following occurs: Five minutes has expired since the last emergency call was placed. The user makes a non-emergency call. The CM52 will rescan before attempting to establish the outgoing call. 3.5.1.1 E911 Scanning If the CM52 does not have service and an emergency call is placed, the module will perform an exhaustive scan looking for any CDMA or AMPS service. This scan is completely independent of the PRL. The rescan looks for service on every channel. The algorithm is defined by Qualcomm and scans more frequently on commonly used channels.

21(158)
1/198 17-4/FCP 101 3045 Uen
3.5.2
Phase 2 or Location Determination
The CM52 can support location determination, primarily to satisfy an FCC requirement for E911 phase 2 support. The CM52 is not a GPSOne solution, but rather provides the network the GPS data from a standalone GPS receiver (note the GPS receiver has to provide pseudorange data). The GPS receiver can be external to the CM52 or the CM52 can be ordered with a Sony 2951 GPS receiver on board. If the GPS receiver is external, the application is responsible for providing the GPS pseudorange data via the AT*EPDPR command. The module will request the application for the data by an unsolicited message (*EPDPR). The CM52 is responsible for acquiring any CDMA related information, most notably the CDMA pilot phase measurement data to support AFLT and hybrid measurements. If the GPS receiver is embedded in the CM52, location determination will be completely handled by the CM52. There are no software requirements placed upon the customer application. Because the current focus is on data only solutions, the location determination technique has not been certified by any carrier at this time.
3.6
Short Message Service
The module provides the functional capability to create and send text messages (MO), as well as receive text messages (MT) across the air interface. The data format can be either string data represented as printable IRA characters, or binary data represented as hex-coded octets. The maximum length of data sent in an SMS transmission is 255 bytes, though typically the carrier further reduces the allowable size to something less. The actual user data is directly dependent on how much message overhead is present. Therefore, a significant number of optional SMS header data fields could substantially reduce the user data space. According to IS2000, SMS messages can be sent either on the access channel or on a traffic channel; SMS messages can be received either on the paging channel or on a traffic channel. The carrier/network controls the medium used for SMS traffic. If sending an SMS message on the access channel fails, the module will always try to send the message on a traffic channel. As a best practice, enable the SMS MO status unsolicited message. The unsolicited messages indicate the status of the outgoing message. SMS messages can be sent and received while a traffic channel is present for other uses besides SMS. For example; if a voice call is active, SMS messages can be handled simultaneously. An outgoing SMS message can be sent before the module has registered with the network. An outgoing SMS message is considered an implicit registration: the network has been made aware of the module through the SMS request. The following services are provided by the module for short message control: Message formatting The module formats short messages for transmission over the air interface. Message reference assignment The module assigns message reference numbers to new short messages that are transmitted over the air interface. Privacy Management The module supports privacy criteria. Message reporting The module reports incoming messages that are received over the air interface. The CM52 is not designed to store SMS messages. Message storage is a requirement that is handled by the application. Therefore, the CM52 will not store outgoing messages at all. Because the module does not store messages, it does not provide a retry mechanism. Instead, the module indicates to the application that the

22(158)
1/198 17-4/FCP 101 3045 Uen
submission of the message to the network failed. The application can then determine whether to retry based on its specific requirements. The outgoing SMS message is processed in the background. Until the message is received by the network a new MO message CANNOT be queued. SMS messages received from the network are passed directly to the external application and are not stored within the module. That said, there is a mechanism to temporarily store messages under certain conditions, such as when the external application is powered off. In this situation, it is the external applications responsibility to immediately read the messages; when a message is read from memory it is removed from the memory of the CM52. Per Qualcomm design, the software will perform a rescan to digital only service when attempting to send an SMS message. After the message has been sent, successfully or not, the module will rescan back to the current setting in accordance to AT*EPMOD. The intent is to try and make every attempt to send the message. Since digital service is required for sending SMS, a scan to digital only service is performed. Therefore, it is possible that the module may be currently camped on AMPS and rescan to Digital when an SMS message is going to be sent. Note that even if the module has been defined as AMPS Only through AT*EPMOD, the module will still scan to digital, send the message, then rescan back to AMPS.
3.7
Data Functionality
CM52 supports the following three kinds of data transfer mechanisms: Async data Quick Net Connect (QNC) 1xRTT (Packet data) Applications such as file transfer, Internet browser, and dial-up networking are running on top of these data transfer mechanisms through a CDMA wireless network. The data transfer mechanisms are based on the standard TIA/EIA Interim Standard, Data Service Options for Wideband Spread Spectrum Systems (TIA/EIA/IS-707), which is designed to provide async data and packet data transfer at various data rates. An outgoing data call can be made before the module has registered with the network. An outgoing data call is considered an implicit registration: the network has been made aware of the module through the data call origination request. For incoming data calls, the module must register with the network before the network will send mobile terminated requests. 3.7.1 Async data Async data is data communication over a dedicated traffic channel. The host application/user communicates with CM52 by using AT commands to set up the data link and switch to on-line mode once the communication is established. The escape sequence of +++ is used to switch to off-line mode. Note the escape sequence has a guard time of 1 second before and after the +++ is issued, otherwise the unit will NOT switch to off-line mode. 3.7.2 Quick Net Connect (QNC) This service was developed by Qualcomm and the infrastructure vendors as a way to have some of the benefits of packet data service while still making circuit switched calls between mobile and infrastructure. (It started as an intermediate step to full packet data service on CDMA). A QNC call is made from a mobile to the infrastructure, uses a circuit switched service option but is designated as quick net connect so that the typical circuit-switched modem setup and response negotiation is bypassed. The connection takes around 2 seconds as opposed to 20 seconds for typical modem negotiation that would take place to route the call into a circuit switched connection. The data transport of a QNC call is performed like a packet data service in that the full TCP/IP stack is not duplicated in the mobile as it would be in a circuit switched call (circuit switched calls are referred

23(158)
1/198 17-4/FCP 101 3045 Uen
to as dual-stack async in CDMA parlance). The packets received at the mobile (from the connecting laptop) are forwarded to the internet inter-working function at the IP level of the stack. QNC is not a true packet data call because a dormant mode of operation is not supported For example, this connection is always considered fully attached to the network (in this manner it is more like a circuit switched connection).
The air interface is still async data on a dedicated traffic channel but a user will not see any difference from a packet data communication session. The PPP communication is between the CM52 and the host application, but to a user it could just as well be between the host application and the internet application. 3.7.3 1xRTT 1xRTT (HSPD or High Speed Packet Data) is referred to as the real packet data communication. There is no dedicated traffic channel. There is a shared packet data channel upon which several users are sending packets. The interface between CM52 and the host application is PPP, just as it was in the QNC case, but the air interface is different. Both Simple IP and Mobile IP are 1xRTT services. The implementation of both may vary from carrier to carrier. Currently, the module supports Simple IP and Mobile IP in accordance to Verizons specifications. 3.7.3.1 Verizons Retry Logic During Service Option 33 Access Attempts
It is the strong desire of Verizon Wireless to limit the number of ineffective call attempts encountered by the network. The number of allowable access attempts will depend on several factors including the type of application and the nature of the error encountered by the device. Verizon requires that when establishing a data call, the module performs data retries internally in accordance to Verizons data retry strategy. Refer to Verizon documentation (Reqs-1XRTTDataServices.doc) for details that describe the exact implementation. The application is responsible for ensuring that manual retries are in accordance with the Verizon data retry strategy. Please refer to Verizon documentation (Reqs-1XRTTDataServices.doc) for more information. 3.7.4 Data Rates The following CDMA data service options are supported: CDMA Data Service Async Data Async Data Async Data Low Speed Packet Data Low Speed Packet Data Low Speed Packet Data High Speed Packet Data High Speed Packet Data 1x High Speed Packet Data Service Option 4 4100 12 7 4103 15 22 25 33 Rate 9600 Default Rate set 1 Default rate set 2 Default Rate set 1 Rate Set 1 (default) or Rate Set 2 Default Rate set 2 Default Rate set 1 Rate set 2 Up to 153 kbps
Note: Rate Set 1: (9600, 4800, 2400, 1200), over the air link rate is up to 9600 bps Rate Set 2: (14400, 7200, 3600, 1800), over the air link rate is up to 14400 bps

24(158)
1/198 17-4/FCP 101 3045 Uen
3.8
Application Wake-up
The wake-up mechanism is a feature provided by the CM52 where the CM52 can remain powered on and function as a module without the host application being powered on. This type of configuration is primarily done for power consumption purposes. The CM52 will assert a hardware line when events previously specified by the application occur within the module. The hardware line is a trigger for the host application to power up and process the event. 3.8.1 Details The host application can indicate to the CM52 which events it wishes to be notified of by using AT*EWAKESET. The host application can then power down, leaving the CM52 powered on. The host application needs to monitor the CM52s Ring Indicator (RI) hardware pin. The RI is asserted when the module is handling an event that the host application specified. When the RI is asserted, the host application should power up and immediately query for the wakeup reason by using AT*EWAKE. Given the reason for wakeup, the host application can process the event(s) accordingly: In the case of an incoming call (voice or data), the call can be immediately answered. Note an incoming call will remain active only for a limited period if it is not answered. It is recommended not to delay answering because the call could go to voicemail. If the caller ID is used in determining whether to answer the call, the module can be queried for the caller ID using AT*ECALLERID. In the case of an incoming SMS message, the host application can query for temporarily stored SMS messages using AT+CSLM. AT+CSLM will return all stored messages. If the host application is interested only in a specific message type, such as text or binary, and should not be woken up for other message types, SMS filtering can be used. Refer to AT*ESMSFLTR for more details. In the case of an Antenna failure, the host application must use AT*EAFF to correct the situation. In the case of Antenna Diagnostic notification, the host application can use AT*EANTDIAG to determine the current state of the antenna and take appropriate action (for instance switching to the other antenna). In the case of the RTC cycle completion, the host application can handle as needed. In the case of voice mail notification, the host application can handle as needed. In the case of service change (including no service) notification, the host application can handle as needed.
All the necessary information to address the wakeup events can be accounted for, either in the event itself or retrieved by querying the module. There is no relevant historical data (unsolicited messages) that would be of benefit to addressing the wakeup events. 3.8.2 Behavior After an event has triggered the RI, the event will NOT be reset if the event is canceled. An example would be when an incoming call triggers the RI, but then the call is dropped. The application has to account for the case where the event may no longer be valid. Multiple event types can occur between the first event and when the application queries for the event reason. All event types will be ORed together. As a result, querying for the wakeup reason could produce more than one action. Once wakeup events are specified by that application, the RI and wakeup reason will be set for any event regardless of whether the application is powered on. The CM52 has cannot detect when the application is not powered on; therefore, the application must control the setting, actually resetting the wakeup reason. The issue is that the application must ensure the wakeup reason is set to zero before the application powers down. Otherwise, when the application powers on, events from the last power cycle could be present. This can easily be accomplished by querying the wakeup reasons immediately before powering down (AT*EWAKE resets the wakeup reason to zero or none)

25(158)
1/198 17-4/FCP 101 3045 Uen
If application wakeup events are used in combination with the modules RTC sleep/wake cycle capabilities, the module will disregard the <wake> period to power down and remain powered on. At this point it is expected the application will start communicating with the module. The first action the application should perform is an instruction to disable the RTC mode (AT+CFUN=1). 3.8.3 Ring Indicator Notes The ring indicator pin assert-time can be configured via the PRI. It is not configurable through an AT command. As indicated by the CM52 Integrators Manual, the RI pin signal should not be considered valid at power up until after the Restart unsolicited message is received by the application.
3.9
Real Time Clock (RTC)
The real time clock is a feature provided by the CM52 that allows the module to sleep and wakeup for a definable number of cycles, as configured by the host application. This feature is an optional hardware feature that is controlled by software. The module/RTC can be programmed so that the module will sleep and be awake at definable times without continuous application intervention. The RTC is typically used for applications that have sleep times where no activity is necessary for a specified length of time. Activities that involve the module happen on a scheduled basis (for instance, a meter reading application). Such an application may only need to wake up once a month to provide the current meter value to a network application. The module and the network are synchronized to the same time schedule. Another application usage would be to use the RTC in combination with the application wake-up feature. The module could be programmed to a wake/sleep cycle and perform typical network functions during the wake time. Specific events could trigger the host application to wake up. The host application can remain powered down to reduce power consumption. The RTC will share the MODULE_PWR_EN_B pin with the host application to wakeup and reset the module. As a result, there are a few scenarios that are described in AT+CFUN that need to be adhered to. Minimum sleep times have been defined to eliminate cases where the module and host application could get into a suspended state. The RTC currently has a time granularity of 1 minute, meaning the solution is not aware of seconds. As a result, if the RTC is to wake the module up in 2 minutes and the current time is 10:10:40, the module will actually wake up in 1:20 because the 40 seconds is not accounted for. From an application standpoint, it is recommended that the wakeup, scan and securing service be considered when determining when the next module wakeup should occur. The time between powering on the module and going idle will vary depending upon the MRU, PRL and surrounding service. Observations indicate that going idle could take up to 45 seconds in worst case scenarios. Accounting for the module startup time will ensure that the module is idle during the defined interval where it is to be waiting for incoming requests.
3.10
Serial Port Multiplexer
The multiplexer provides the following three logical communication channels on the serial port: AT commands, data, and unsolicited messages. Each channel can be in use at all times. As a result, the AT commands can be issued and unsolicited messages can be received while the module is on a data call. The multiplexer also provides optional CRC error checking and retransmission. Upon request, SEMC can provide sample multiplexer source code that can be used on the host application.
3.10.1
Module Device Driver (MDD)
SEMC also provides a higher-layer product, the Module Device Driver or MDD, which builds on the functionality of the multiplexer. MDD can be compiled into the host application. MDD provides a complete

26(158)
1/198 17-4/FCP 101 3045 Uen
Application Programming Interface (API) to the module through synchronous communication, module interoperability and unsolicited message callback functions. See the MDD Users Manual for more information.
3.11
Aeris MicroBurst
The CM52 supports Aeris MicroBurst. This service leverages existing cellular networks and the Internet to provide a cost-effective, wireless data link to an expanding host of fixed and mobile applications. For more information about MicroBurst, contact the Aeris Corporation (see www.aeris.net). For details about MicroBurst from the CM52 perspective refer to the MicroBurst chapter in this document.
3.12
Power Down
The CM52 supports the following two power-down methods: (1) Software shutdown method by using the AT+CFUN command or (2) Hardware shutdown method by using the Module_PWR_EN_B signal on pin 12 of the system connector. At power-down, the CM52 must complete a variety of housekeeping functions. For example, the Most Recently Used (MRU) list is written to non-volatile memory. This helps in acquiring service at the next power on. Various calibration data is written to non-volatile memory. The CM52 implements a number of learning algorithms that self calibrate the module over time as conditions change. Because of the activities that must be completed at shutdown, it is imperative that the application provide the CM52 with a proper shutdown procedure. After the hardware or software method of shutdown has been employed, the application should wait for the Shutdown Complete message to be received from the CM52 before removing the VCC_MAIN power supply. 3.12.1 Power Down Registration During the shutdown procedure the module will perform a power down registration sequence if the host network specifies that mobile devices provide notification of powering down. The power down registration could be the most time consuming task associated with shutting the module down. Depending upon network configurations the power down sequence could take up to eight minutes. Time duration of eight minutes would be considered abnormal; however in following with the power down requirements of the CM52 waiting for the shutdown complete message before power can be removed can be costly in terms of power consumption. The CM52 has implemented a power down registration timeout. If a power down registration acknowledgement from the network is not received in X seconds, the power down registration attempt will be aborted and the module power down sequence will continue. Such a timeout was introduced to control the length of the power down sequence in networks where the power down registration delay could be considered costly to the end solution. X was defined to be 45 seconds. The value of 45 seconds was concluded by looking at typical network maximums and providing a large safety buffer to account for non-typical networks. The network has built in mechanisms to account for conditions where a mobile device is unable to notify the network that the device is powering down. As a result, if a power down registration sequence is aborted due to the timeout value, the network will clean up the modules status with no long term effects. The timeout value can be set as part of the PRI process should there be a justifiable need to reduce, or increase, the timeout value associated with the power down registration sequence. 3.12.2 Wait for Notification As noted above, applications must wait for the Shutdown Complete message, or the defined state change on the shutdown pin, before removing power. Failure to wait for the module to shutdown is a violation of the CM52s defined usage. How long to wait for the shutdown notification could vary; however SEMC is recommending a time of one minute (based on a power down registration timeout of 45 seconds). If the host application does not receive

27(158)
1/198 17-4/FCP 101 3045 Uen
notification that the CM52 has successfully shut down; the CM52 is in an unknown failure state. SEMC can not provide any guidance, for the module is in an unaccountable state. Should power be removed after this failure point, it is recommended that the module be power cycled before declaring the CM52 has failed. The CM52 has several backup/restore mechanisms that should successfully restore the module to its previous working condition, however, since this error state is undefined, it is not possible to guarantee that the unit will boot-up properly.
AT Commands
The first part of this chapter, 4.1 General description of AT commands, provides an overview of how to use AT commands on a CM52 module. The rest of this chapter provides detailed descriptions of the AT commands supported by CM52. The functionality and syntax as well as expected result codes and responses are documented for each command.
4.1
General description of AT commands
The purpose of this chapter is to describe how the AT commands are used in CM52. 4.1.1 Overview AT commands are commonly used to communicate with modem equipment. For the CM52, the AT commands are used for communication over the serial link between the CM52 and a host application. The format of the AT commands is ASCII strings that always start with AT and end with a defined set of characters. The format is defined in detail later on in this chapter. The communication from the host application to CM52 is synchronous: the host application has to wait for a result code before issuing the next command. The behavior of the CM52 is undefined if a new command is issued before the previous commands result code is returned. The communication from CM52 to the host application is both synchronous and asynchronous. A result code is always returned when a command from the host application has executed. There are also unsolicited responses are sent to the host application when a certain event has occurred. SEMC supports only the AT commands listed in this document. Other AT commands may be functional as a result of the baseline code, but they will not be supported by SEMC. The status of undocumented commands should not be assumed. It is recommended that only the listed AT commands be used in an application. Note: the test command option associated with AT commands may also be present for several AT commands. SEMC will not support the test command feature within the CM52. 4.1.2 Command types The AT command manual uses the following terminology for the different kinds of communication strings: AT command This is referred to as a command from the host application to CM52 with a request to perform a service. Result code This is an immediate response to a command, informing the host application whether the execution of the command succeeded or failed. The strings OK or ERROR are the only two Result Codes available. A result code is always returned after an AT command has been sent to the CM52. Extended Reason Code If enabled, (see AT+CMEE), CM52 responds with a detailed reason code string in addition to OK or ERROR. The reason code is returned before the commands result code. Extended reason codes are only provided when the result code is ERROR.

28(158)
1/198 17-4/FCP 101 3045 Uen
Response A response contains data that has been requested via an AT command. A response is returned before the result code of the command. A response is provided only when the result code is OK. Unsolicited response An unsolicited response is sent by CM52 when a specific event occurs. Some unsolicited responses can be turned on and off via an AT command (refer to AT*EUNSOL for more details). Some unsolicited responses are always turned on.
AT commands are divided into the following three types of commands: Action command Action commands are used to perform an event. Typically, action commands are used to change the value of a setting in CM52, send data, or perform advanced queries that require input data. Read command Read commands typically end with a ?. Most read commands do not have any input parameters; however, in some cases an input parameter provides options for the response format. The read command are used for reading values of certain settings in CM52. Test command Test commands are not supported in the CM52. Command Format and Syntax
4.1.3
4.1.3.1 Alphabet The T.50 International Alphabet 5 (IA5) is used in this manual. Only the low-order seven bits of each character are significant to CM52. Any eighth or higher-order bit(s) are ignored for the purpose of identifying commands and parameters. Lower-case characters (IA5 values from 0x61 to 0x7A) are considered identical to their upper-case equivalents (IA5 values from 0x41 to 0x5A) when received by CM52 from the host application. Result codes from CM52 shall be in upper case. All commands must begin with the characters A and T. If the A and T are not received by the software, the remaining characters will not be processed. This is important; should the A or T be lost in communication or not supplied, none of the characters sent to the module will be echoed back until an AT sequence is observed. Because RS232 communications could possibly lose characters, it is important to understand that if a character is lost, the command may return ERROR or execute the wrong command because the intended command is misspelled. As a best practice, application should analyze what is echoed back from the module to the application; doing so will confirm what the CM52 software has received and processed. 4.1.3.2 Command-line editing The character defined by the command ATS5, chapter 4.8.5, (default, backspace [IA5 0x08]) is intended to be interpreted as a request from the host application to the CM52 to delete the previous character. Any control characters (IA5 0x00 through 0x1F, inclusive) that remain in the command line after receipt of the termination character are ignored by the CM52. Before checking for other characters, the CM52 checks characters from the host application to see if they match the termination character (S3), then it checks to see if they match the editing character (S5). This ensures that these characters will be properly recognized even if they are set to values that the CM52 uses for other purposes. If S3 and S5 are set to the same value, a matching character will be treated as matching S3 (S3 is checked before S5). 4.1.3.3 Input Command Syntax A command line is made up of the following three elements: the prefix, the body, and the termination character.

29(158)
1/198 17-4/FCP 101 3045 Uen
AT*ESCAN=1<CR> In the example above, AT is the prefix. The CM52 module expects all commands to begin with the letters AT or at. If the host application inadvertently begins a command with characters other than AT or at, the CM52 ignore the characters and will not echo them. The CM52 will continue to ignore input until the characters AT or at are received. In the example above, the body, *ESCAN=1, includes commands and parameters. The termination character cannot appear in the body. The termination character may be selected using the ATS3 command. For more information, see chapter 4.8.3. The default value is CR (IA5 0x0D). In addition, the CM52 supports multiple AT commands embedded in a signal AT command string request. However it is recommended that this feature be used with care. Response from the CM52 to multiple AT commands embedded in a single AT command string can be confusing. The module will only return the status of the last instructional command of the string. Other syntax that is used in this manual: <> [] Name enclosed in angle brackets is a syntactical element. Do not use the angle brackets when entering a command line. Square brackets are used to indicate an optional parameter of a command or an optional part of a response. Do not use the brackets when entering a command. Note: In many cases the commas separating parameters are NOT optional when delimiting a list of optional parameters. The commas are necessary to provide parameter matching with the CM52 parser. Example: The following command sends SMS messages. It has several optional parameters, which under normal circumstances do not need to be used. However, if an optional parameter is going to be specified, the correct number of commas must be present to ensure the parameter that is specified lines up with the correct parameter position.
AT+CSSM=<da>,<message>,[<msg_ref>],[<type>],[<udheader>],[<smheader>],[<callback>], [<valPer>],[<defDel>],[<alert>],[<lang>]
AT+CSSM=1234567890,Hello World,,,,,,,,1
This example of the AT+CSSM command has provided the correct number of parameter placeholders for the alert parameter to be specified. Also note that no additional commas are necessary because there were no other parameters after the alert. 4.1.3.4 Output Response Syntax The two characters defined in ATS3 (the terminating character) and ATS4 (Response formatting character) are used in all responses, reason codes, and result codes. The default values are <CR> (IA5 0x0D) and <LF> (IA5 0x0A) respectively. The following examples illustrate how S3 and S4 are used with their default values. Response with data (CM52 response in gray)

30(158)
1/198 17-4/FCP 101 3045 Uen
AT+GMI<CR> <CR><LF>SONY ERICSSON<CR><LF>

<CR><LF>OK<CR><LF>
Result code only:

AT<CR> <CR><LF>OK<CR><LF>
4.1.3.5 Unsolicited Message Syntax The CM52 cannotify the application of events as they occur. There are two types of unsolicited messages: those that the module will always report and those that are optional. The optional unsolicited messages are controlled by the AT command EUNSOL (see chapter 4.2.11). The format for unsolicited messages that are always reported is: <CR><LF>RESTART<CR><LF> The format for the *EUNSOL unsolicited messages is: *EUNSOL: STATE, DCC, IDLE<CR><LF> As a general rule, unsolicited messages are not be embedded in an AT command response. The unsolicited message may be returned after an AT command is issued and before the AT command response, but not in the middle. Therefore, the following is NOT possible: AT+GMI<CR> <CR><LF>SONY ERI<CR><LF>RING<CR><LF>CSSON<CR><LF>
<CR><LF>OK<CR><LF>
However, the following is possible: AT+GMI<CR> <CR><LF>RING<CR><LF> <CR><LF>SONY ERICSSON<CR><LF>

<CR><LF>OK<CR><LF>
EUNSOL unsolicited messages also have the option of verbose or terse format. Refer to AT*EUNSOLM for information on how to set this. The verbose mode is a more grammatical response, whereas the terse mode provides a sequence of numbers. The number format provides shorter messages and simpler parsing. 4.1.3.6 Parameter Defaults When applicable, this document identify default parameter values. Note that within the CM52 module, parameter values can be either persistent or not persistent. Parameter settings that are NOT persistent are not saved over a power cycle; therefore, for every power cycle this type of parameter will be reset back to a predefined value. This predefined value is the listed default. Values that are persistent are in fact saved over a power cycle. Therefore the value when the module is powered on will be set to the value during the previous power cycle. The default value that is listed for persistent parameters is the value the module defaults to when the module is created at the factory. It should be noted that Sony Ericsson provides a process to customers where the persistent parameters can be modified at the factory. As a result, the parameter values might not correspond with this documentation. The

31(158)
1/198 17-4/FCP 101 3045 Uen
factory customization is available on a per variant basis, and for all variants EXCEPT the generic variant. For more information regarding how to customize the persistent values at the factory refer to the PRI document.
4.2
4.2.1
Information and Identification Commands

AT (Attention Command) Syntax AT Possible responses OK
Description Checks the contact between CM52 and a host
The Attention command is used to determine the presence of CM52. The result code OK is returned if the module is ready to receive AT commands. If the module is not ready, there is no response.
4.2.2
AT+GMI (Request Manufacturer Identification) Syntax AT+GMI Possible responses +GMI: <manufacturer> OK
Description Reads the manufacturers name
This command returns the name of the manufacturer. Example (CM52 response in gray)
AT+GMI +GMI: SONY ERICSSON OK
Parameter
<manufacturer> SONY ERICSSON
Description
The name of the manufacturer.
4.2.3
AT+GMM (Request Model Identification) Syntax AT+GMM Possible responses +GMM: <model> OK
Description Read the model identification
This command returns the model identification of the specific module. Example (CM52 response in gray)
AT+GMM +GMM: CM52 OK
Parameter
Description

32(158)
1/198 17-4/FCP 101 3045 Uen
Parameter <model> CM52
Description Module name
4.2.4
AT+GMR (Revision Identification) Syntax AT+GMR Possible responses +GMR: <time> <revision> OK
Description Reads software revision identification.
This command returns the software revision in the CM52. The only possible result code is OK. Example (CM52 response in gray)
AT+GMR +GMR: DEC 06 2004 19:45:00 R1A00 OK
Parameter
<time> String <revision> String
Description
The format of the time is MMM DD YYYY HH:MM:SS where Y=Year, M=Month, D=Day, H=hours, M=Minutes, and S=seconds 5 characters
4.2.5
AT+GSN (Request Product Serial Number Identification)
Description Reads the serial number
Syntax AT+GSN
Possible responses +GSN: <serial number> OK
This command returns a string with the serial number (ESN) of the specific CM52. Example (CM52 response in gray) AT+GSN +GSN: 922DC6CF OK Parameter <serial number> String Description Serial number represented as ASCII hex coded octets. The first two hex digits are the manufactures ID (92 hex = 146 decimal). The remainder is the individual serial number (2DC6CF hex = 03000015 decimal)

33(158)
1/198 17-4/FCP 101 3045 Uen
4.2.6
AT+CPAS (Phone Activity State) Syntax AT+CPAS=<value> Possible responses +CPAS: <state> OK
Description Reads the activity status
Execution of this command returns the activity state <state> of the CM52. This command can be used to interrogate the CM52 before issuing a request. Parameter <value> 0 <state> 0 2 3 6 20 Description Report <state> only Activity state Idle Origination Connected Incoming Call Scanning
4.2.7
AT+CSQ (Signal Quality) Syntax AT+CSQ? Possible responses +CSQ: <rssi>,<ber> OK
Description Reads received signal strength.
Execution of this command returns the received signal strength indication <rssi> and channel bit error rate <ber>. This command displays the signal strength as an integer in the range of 0-31, where 0 represents signals less than or equal to 113 dBm, and 31 represents signals greater than or equal to 51 dBm. The integer values of 1-30 represent 2 dBm steps between these two extremes. Example (CM52 response in gray) AT+CSQ? +CSQ: 16,99 Signal strength = -81 dBm and bit error rate is unknown OK Note: CDMA RSSI reporting consists of the receive channel power and the pilot energy (Ec/Io). To receive the above response, a communication analyzer would be set as follows: Communication Analyzer downlink level = Communication Analyzer Pilot Offset = -74 dBm -7 dB (typical default setting)
Additionally, the BER value is only valid under the following conditions: Must be In CDMA mode Must be in conversation state Frames actually had to have been sent

34(158)
1/198 17-4/FCP 101 3045 Uen
Note: AMPS RSSI reporting consists of the receive channel power only. The valid AMPS RSSI reporting range is as follows: -113 dBm to -81 dBm, which equates to a CSQ range of 0 to 16
Parameter <rssi> 0 1 2 to 30 31 99 <ber> 0 1 2 3 4 5 6 7 99
Description Received signal strength indication -113 dBm or less -111 dBm -109 to -53 dBm, 2 dBm steps. -51 dBm or greater RSSI is not known or is not detectable. Bit error rate ber <0.01% 0.01%<ber<0.1% 0.1%<ber<0.5% 0.5%<ber<1% 1%<ber<2% 2%<ber<4% 4%<ber<8% ber>8% Not known or not detectable
4.2.8
AT+GCAP (Capabilities) Syntax AT+GCAP Possible responses +GCAP: +CIS707-A, +MS, +ES, +DS OK
Description Requests complete capability list
This command returns the capabilities of the specific CM52 module. Example (CM52 response in gray) AT+GCAP +GCAP: +CIS707-A, +MS, +ES, +DS OK
Capabilities +CIS707-A +MS +ES +DS
Description TIA/EIA/IS-707-A.3 Table 7.4.1-1-4 Modulation control: +MS, +MR commands Error control: +ES, +EB, +ER, +EFCS, +ETBM Data Compression: +DS and +DR

35(158)
1/198 17-4/FCP 101 3045 Uen
4.2.9
AT*EIDSUM (Fixed-Format Module Identification Summary) Syntax AT*EIDSUM? Possible Responses *EIDSUM: <fixed_string> OK
Description Display fixed-format module identification summary
This command displays all of the module identification parameters in a single fixed-format response. Example (CM52 response in gray) AT*EIDSUM?
*EIDSUM: KRD 104 1004/01 P1J 01W09 PR1G02 CM52 Sony Ericsson Transceiver
OK The string is created from the following fields: KRD 104 1004/vv hhh ddddd ssssss CM52 Sony Ericsson Transceiver
The bold text is fixed and the non-bold characters will vary between versions of CM52. The variable fields are described in the table below. Each variable is of fixed length and always starts in the same position. The position where each field starts is shown in the following chart: *EIDSUM: KRD 104 1004/01 P1J 01W09 R1A00 CM52 1 10 14 18 26 30 36 43 Sony Ericsson Transceiver 51
KRD string parts /vv hhh Ddddd ssssss
Description Variant of the model. / + 2 characters HW revision. Length 3. Date when HW was produced. Length 5. yyWww (y=year, w=week number) SW revision
4.2.10
AT*EUNSOLM (Numeric or Verbose Unsolicited Messages) Syntax AT*EUNSOLM=<setting> AT*EUNSOLM? Possible Responses OK *EUNSOLM: <setting> OK
Description Sets the feature Reads the current setting
The unsolicited messages can be reported in a verbose mode (textual strings) or defined as numeric for simplified parsing. Note: This command does not control any commands that are NOT prefixed with *EUNSOL; therefore, the RING unsolicited message does not have a numeric equivalent. The parameter is persistent. As a result, it is saved across a power cycle.

36(158)
1/198 17-4/FCP 101 3045 Uen
Parameter <setting> 0 1
Description Specify output type Numeric representation String representation
4.2.11
AT*EUNSOL (Control Unsolicited Messages) Syntax AT*EUNSOL=<control>,<filter> AT*EUNSOL? Possible Responses OK *EUNSOL: 1,<filter> OK
Description Sets *EUNSOL unsolicited reports Reads the current setting
This command allows a host application to control (turn on and turn off) several types of unsolicited messages that are generated by the CM52. Unsolicited messages can be output at any time. They can occur between an AT command and the corresponding response. The unsolicited responses that can be controlled with this command are listed in the table below. The unsolicited responses that are sent to the host application are controlled by the <filter> parameter. The filter is a bitmap controlling the display of specific messages according to the values as given in the table below. It is possible to turn on several filters by ORing all the bitmaps for the individual filters. The read command always returns those <filters> that are enabled. When setting the value, the preceding zeros in the filter parameter do NOT need to be provided during command execution. Set the <control> parameter to a value of 1 to indicate that the filter bits are to be added to the current mask. Set the <control> parameter to a value of 0 to indicate that the filter bits are to be removed from the current mask. There might be other filters present that are not documented. These filters will not be supported by SEMC and are subject to change without notification. It is recommended that applications use only the values that are defined in this AT command manual. Refer to the unsolicited message user scenarios for examples. The parameters are persistent. As a result they are saved across a power cycle. Parameter <control> 0 1 <filter> 0000 0001 0000 0002 0000 0004 0000 0008 0000 0010 0000 0020 0000 0040 terse Message Control which messages to report Unsolicited messages, according to <filter>, are disabled. Unsolicited messages, according to <filter>, are enabled Bitmaps of messages to report MSG CALL WAITING SERVICE RSSI CALLER ID CALL STATE SERVICE STATE
0 1 2 3 4 5 6

37(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 0000 0080 0000 0100 0000 0200 0000 0400 0000 0800 0000 1000 0000 2000 0000 4000 0000 8000 0001 0000 0002 0000 0004 0000 0008 0000
terse 7 8 9 10 11 12 13 14 15 16 17 18 19
Message CALL END MODE SMS SUBMIT USER ZONE DISPLAY OTA PINGRING PRIVACY REGISTRATION BUFFERFULL TIME STAMP DTMF FLASH
4.2.11.1
Message Waiting Unsolicited Response
This unsolicited response is sent when the network informs CM52 that there are voice mail messages waiting to be retrieved. The format of the unsolicited response is: *EUNSOL: MSG,<voice_mail_count> Parameter <voice_mail_count> 0-255 Description Number of Voice mails The maximum number is carrier dependent
4.2.11.2
Call Waiting Unsolicited Response
This unsolicited response is sent when a call is received while another call is active. The format of the unsolicited response is: *EUNSOL: CALL WAITING[,<caller_id>[,<caller_name>]] Parameter <caller_id> Phone number digits BLOCKED UNKNOWN <caller_name> String 4.2.11.3 Description Phone number or Restriction Phone number of the incoming call The caller ID is being restricted by the network The phone number of the incoming call is not included from the network Name of the calling party Text string (typically the first and last name). Maximum length is 64 bytes.
Service Indicator Unsolicited Response
This unsolicited response is sent when there is a change in the Service mode. The format of the unsolicited response is: *EUNSOL: SERVICE,<service_state>,<roam>,<sid>,<nid>

38(158)
1/198 17-4/FCP 101 3045 Uen
Parameter <service_state> NOSERVICE ANALOG DIGITAL <roam> 0 -255 <sid> 0-32767 <nid> 0-65535
terse 0 1 2
Description Type of service CM52 is not registered on the network CM52 is on Analog service CM52 is on Digital service Roaming status Valid range for the roaming indicator System ID Valid range for the System ID Network ID Valid range for the Network ID
If there is no service the <roam> and <sid> values are not valid and should be ignored. 4.2.11.4 RSSI change unsolicited response
This unsolicited response is sent when the averaged RSSI (Signal strength) level is changed by at least 5 dBm from the last value reported. The module should always produce an initial RSSI value when the module transitions from a NOSERVICE state to a service state. The format of the unsolicited response is: *EUNSOL: RSSI,n Notes: CDMA RSSI reporting consists of the receive channel power and the pilot energy (Ec/Io). See the AT+CSQ command for additional information. AMPS RSSI reporting consists of the receive channel power only. See the AT+CSQ command for additional information.
Parameter
<n>
Description CDMA RSSI, range AMPS RSSI, range -120 to -30 dBm -120 to -81 dBm
-120 to -30
4.2.11.5
Caller ID unsolicited response
This unsolicited response is sent when there is an incoming call and the network provides caller ID or caller name of the calling party. The format of the unsolicited response is: *EUNSOL: CALLER ID[,<caller_id>[,<caller_name>]] Parameter <caller_id> Phone number digits BLOCKED UNKNOWN <caller_name> String Description Phone number or Restriction Phone number of the incoming call The caller ID is being restricted by the network The phone number of the incoming call is not included from the network Name of calling party Text string (typically first and last name). Maximum length is 64 bytes.

39(158)
1/198 17-4/FCP 101 3045 Uen
4.2.11.6
Internal Call State unsolicited response
This unsolicited response is sent when the internal call state of the CM52 changes. The call state is based on the use of a traffic channel. This is important because voice, data, SMS, and OTAPA can all use the traffic channel. As a result, SMS messages can produce call state unsolicited messages. The format of the unsolicited response is: *EUNSOL: CALL STATE,<state_name> Parameter <state_name> IDLE ORIGINATION TERMINATION CONNECT terse 0 1 2 3 Description State Description Service is available, no call is active. Originating a phone call. Receiving an incoming call. Active on a call
4.2.11.7
Indication of Service State unsolicited response
This unsolicited response is sent when service is initially found. When service is initially found, the scanning may or may not continue. If scanning needs to continue, there may be additional SERVICE STATE messages if a more preferred service is found. When scanning is complete, the SERVICE message is provided with all the details of the serving system. Depending upon Carrier-specific scanning requirements, it is possible to be told that service is found only to receive a second message indicating no service. This occurs when service is found, but according to Carrier rules that service is not be allowed. As a result, the module indicates that the invalid service was dropped. For example, this might occur when a requirement by Verizon states that no PCS service can be used if it is not in the PRL. The system acquisition records indicate service to PCS channels. Therefore the module could find PCS service, only to find out the service is not listed in the PRL. If service is NOT initially found, the NOSERVICE state is not reported. The NOSERVICE state is reported when service is lost. The format of the unsolicited response is: *EUNSOL: SERVICE STATE,<service_state> Parameter <service_state> NOSERVICE ANALOG DIGITAL Terse 0 1 2 Description State description CM52 is not registered on the network CM52 is on Analog service CM52 is on Digital service
4.2.11.8
Call end status unsolicited response
This unsolicited response is sent to indicate the cause of a terminated call. The format of the unsolicited response is:

40(158)
1/198 17-4/FCP 101 3045 Uen
*EUNSOL: CALL END,<call_end_status> Parameter

<call_end_status>
terse 0 20 21 22 23 24 25 26 27 28 29 30 31 32 35 36 37 45 46 9999
Description: Phone is offline Phone is CDMA locked until power cycle Phone has no service Call has ended abnormally Received intercept from BS origination only Received reorder from BS origination only Received release from BS no reason given Received release from BS SO reject Received incoming call from BS Received alert stop from BS incoming only Client ended the call Received end activation OTASP call only Main Control aborts the origination/conversation Max access probes transmitted Access attempt already in progress Access failure for reason other than the above Received retry order origination only Ending a GPS call in favor of a user call Ending an SMS call in favor of a user call Reason for call end is not known.
OFFLINE CDMA_LOCK NO_SRV FADE INTERCEPT REORDER REL_NORMAL REL_SO_REJ INCOM_CALL ALERT_STOP CLIENT_END ACTIVATION MC_ABORT MAX_ACCESS_PROBE END_ACC_IN_PROG ACC_FAIL RETRY_ORDER ORIG_DURING_GPS ORIG_DURING_SMS UNKNOWN
4.2.11.9
Mode unsolicited response
This unsolicited response is sent when the module has changed the internal mode state. Refer to AT*EPMOD for more details. The format of the unsolicited response is: *EUNSOL : MODE,<mode>,<band>,<roam> Parameter <mode> AUTO AMPS_ONLY CDMA_ONLY E911 UNKNOWN <band> ANY CELLULAR_A_ONLY CELLULAR_B_ONLY CELLULAR_ONLY PCS_ONLY terse 0 1 2 3 4 0 1 2 3 4 Description Digital Preferred AMPS only CDMA only E911 mode Unknown All bands. Cellular A Cellular B Cellular only PCS Only

41(158)
1/198 17-4/FCP 101 3045 Uen
Parameter UNKNOWN <roam> ANY HOME_ONLY UNKNOWN
terse 5 0 1 2
Description Unknown All indicators Home only Unknown
4.2.11.10
SMS submit status unsolicited response
This command indicates the status of submitted SMS messages. The format of the unsolicited response is: *EUNSOL : SMS SUBMIT,<msg_ref>,<status>,<cause code> Parameter <msg_ref> 1-65565 <status> 0 1 3 4 6 8 9 10 11 <cause code> 0 1 2 3 4 5-31 32 33 34 35 36 37 38 39-47 48-63 64 65 66-95 Description Message reference of the message sent. SMS sent & acknowledged. Module in wrong mode/system (e.g., AMPS). Base station returned an error. Base station did not respond. Message transmission failed. Message length incompatible with system. System does not support SMS. Other The SMS MO message could not be sent via the Access channel, currently sending the message via a Traffic channel. Address vacant. Address translation failure. Network resource shortage. Network failure. The network experienced problems. Invalid Teleservice ID. All values within this range are treated as Other network problem. No page response. Destination busy. No acknowledgement from the Base Station. Destination resource shortage. SMS delivery postponed. Destination out of service. Destination no longer at this address. All values within this range are treated as Other terminal problem. All values within this range are treated as SMS deliver postponed. Radio interface resource shortage. Radio interface incompatibility. All values within this range are treated as Other radio interface problem.

42(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 96 97 98 99 100 102 103 104 105 106 107 108 109 110-255 32770 32772 32773 32774 32775 32777 32779 4.2.11.11
Description Encoding problem or unexpected parameter size. SMS origination denied. SMS termination denied. Supplementary service not supported. SMS not supported. Missing expected parameter. Missing mandatory parameter. Unrecognized parameter value. Unexpected parameter value. User Data size error. Other general problem. Other general problem. Unexpected sequence number. All values within this range are treated as Other general problem. There was no memory buffer available for processing the request. Message was too large to be sent over DTC. Lower layer in SMS stack was not in a ready state for sending a message. Module was not in a ready state for sending a message. Cannot send message in analog mode. Invalid transaction ID. DTC has been disconnected by the module.
Display unsolicited response
Displays unsolicited responses that contain data sent by the base station. The content is transparent to the CM52 and the data is passed on unmodified from the base station. This response does not include User Zone data. The format of the unsolicited response is: *EUNSOL: DISPLAY,<data> Parameter
<data>
Description Display record data from the base station
Text string
4.2.11.12
User Zone unsolicited response
User Zone unsolicited responses containing data sent by the base station that is user zone specific. The format of the unsolicited response is: *EUNSOL: USER ZONE,<data> Parameter
<data>
Description Display record data from the base station
Text string

43(158)
1/198 17-4/FCP 101 3045 Uen
4.2.11.13
OTA programming status unsolicited response
This unsolicited response is sent when OTA (Over the Air) programming is in progress. The format of the unsolicited response is: *EUNSOL: OTA,<value> Parameter <value> 0 1 2 3 10 11 12 13 14 15 16 17 18 20 30 Description Programming successful Programming unsuccessful OTASP in progress OTAPA in progress SPL unlocked OK AkeyEx OK SSD update OK NAM download OK MDN download OK IMSI download OK PRL download OK OTASP Commit OK OTAPA Commit OK Excess SPC failures Initial programming needed (no ESN present)
4.2.11.14
Notification of forwarded incoming calls
This unsolicited response notifies that an incoming call has been forwarded to the location that the user/application provided earlier. Not all networks support this feature. The format of the unsolicited response is: *EUNSOL: PINGRING 4.2.11.15 Privacy Mode unsolicited response
Privacy mode is reported when the privacy mode of an active call changes. The format of the unsolicited response is: *EUNSOL: PRIVACY,<value> Parameter
<value>
terse 0 1
Description Privacy mode has been disabled Privacy mode has been enabled
OFF ON
4.2.11.16
Internal Registration unsolicited response

44(158)
1/198 17-4/FCP 101 3045 Uen
This unsolicited response is sent when registration attempts are made as a means to return the registration results. The format of the unsolicited response is: *EUNSOL: REGISTRATION,<status> Parameter <status> START SUCCESS FAILURE POWERDOWN REJECTED terse 0 1 2 3 4 Description State Description Registration notification sent to the network. Registration was completed successfully. Registration failed, or an ACK was never received by the CM52. Power down registration notification sent to the network, used in place of START when powering down. The base station denied the registration request.
4.2.11.17
Notification of no space to save SMS messages
This unsolicited response indicates that an incoming SMS message cannot be saved because there is no room remaining in the memory on the CM52. Under this condition the CM52 returns a NACK to the network. The network keeps the message and attempts to resend it again at another time. When this unsolicited message is received, all SMS messages stored on the CM52 should be read or deleted. The current size of the SMS buffer on the CM52 is 10 messages. The CM52 SMS message storage feature is intended to provide only a small buffer to temporarily hold a few messages while the host application is performing other actions. The format of the unsolicited response is: *EUNSOL: BUFFERFULL
4.2.11.18
Timestamp message
This unsolicited response is a timestamp heartbeat. The purpose of this unsolicited response is to provide a timestamp that can be used in Diagnostic logs to locate events. This message should NOT be used for anything else. SEMC recommends that customers code the ability to handle this message in their application. By doing so, SEMC and the customer can match diagnostic logs to AT command logs. If timestamp is enabled, the message will be reported every 10 seconds while the module is not in deep sleep mode. When the module is sleeping the time span can vary. The timestamp always matches the timestamp in the diagnostic log. Additionally, if on a digital system, the timestamp is in GMT + the time zone and the module rescans to AMPS after digital service, the time will remain. If the module powers on and locates AMPS service, the timestamp starts at 00:00:00 and keeps relative time from that point until digital service is found, at which point the timestamp will reflect network time. The format of the unsolicited response is: *EUNSOL: TIME STAMP,HH:MM:SS Where hh is 00-23, mm is 00-59, and ss is 00-59. 4.2.11.19 DTMF message
In CDMA mode, this unsolicited response is an indication to the application that a voice call is active and the external application sent over-dial digits through a burst DTMF message to the network. Refer to ATD overdial for more details.

45(158)
1/198 17-4/FCP 101 3045 Uen
Note: In AMPS mode, no such unsolicited message is sent to the application because, in this case, the tones are sent in the audio uplink. The format of the unsolicited response is: *EUNSOL: DTMF,<digits> Parameter <digits> Variable length string terse Description Actual data sent to the network. An exact copy of the data inputted by ATD when on a call
Example (CM52 response in gray) ATD12345 OK *EUNSOL: DTMF,12345 4.2.11.20 FLASH message
This unsolicited response is an indication to the application that a voice call is active and the external application sent flash digits to the network. Refer to ATD! flash for more details. The format of the unsolicited response is: *EUNSOL: FLASH,<digits> Parameter <digits> Variable length string terse Description Actual data sent to the network. An exact copy of the data inputted by ATD! when on a call
Example (CM52 response in gray) ATD!12345 OK *EUNSOL: FLASH,12345 ATD! OK *EUNSOL: FLASH,
4.2.12 Forced Unsolicited Messages There are several unsolicited messages that are not controlled by AT commands. The following section details these messages. 4.2.12.1 Startup Unsolicited Message
The CM52 produces an unsolicited message when the unit initializes and is ready to receive data from the host application. The format of the unsolicited response is: Restart

46(158)
1/198 17-4/FCP 101 3045 Uen
4.2.12.2
Shutdown Unsolicited Message
The CM52 produces an unsolicited message when the unit shuts down to the point that power can safely be removed from the module by releasing the MODULE_PWR_EN_B pin. The format of the unsolicited response is: Shutdown Complete
4.2.12.3
Shutdown Unsolicited Message (RTC Mode)
The CM52 produces an unsolicited message when the unit shuts down to the point that power can safely be removed from the module by releasing the MODULE_PWR_EN_B pin. This is a variation of the original shutdown complete message; the RTC mode shutdown indicates that the module powered down and the RTC enabled to wake the module up at specified times. Refer to AT+CFUN for more details. The format of the unsolicited response is: RTC Shutdown Complete
4.2.12.4
RING Unsolicited Message
The CM52 produces an unsolicited message when a mobile terminated call (voice or data) must be handled by the host application. The message is repeated on a periodic basis until the call is either answered or torn down by the network. The format of the unsolicited response is: RING
4.2.12.5
Offline Unsolicited Message
The CM52 produces an unsolicited message when the unit has been put into an invalid mode and cannot continue to communicate with the network. The module will continue to remain in offline mode until the host application addresses why the module went into offline mode and then restarts the module. The format of the unsolicited response is: OFFLINE Going into offline is usually a result of an invalid NAM setting that the module cannot resolve. For example, if the application requests the module to go to NAM2, and NAM2 has not been configured correctly, chances are the module will go offline. When that happens the module must be set back to the valid NAM and then restarted.
4.2.12.6
Async Data Communication Established Unsolicited Message
The CM52 produces an unsolicited message when an async data communication is established with the other end of the data call.

47(158)
1/198 17-4/FCP 101 3045 Uen
The format of the unsolicited response is: CONNECT Notes: It can take up to 30sec to receive the CONNECT message from the network when connecting. CONNECT is never received if the call end is NOT a modem (cannot accept async data calls).
4.2.12.7
NV Restored Unsolicited Message
The CM52 produces an unsolicited message when the module is forced to restore the NV image. Backup and restore occurs without user interaction. The format of the unsolicited response is: *EUNSOL: NV Restore The goal of the backup system is to restore as much of the lost data as possible in the case of a corruption in the NV file system. This should allow the module to return to an acceptable working state. An acceptable working state would be the ability to resume making voice and data calls. However, it is acceptable for some data to be lost. Currently, the following data cannot be recovered: SMS messages stored in the module Note: The restore capability should not be used in place of the correct power down procedure. 4.2.13 AT$QCPREV (Display Current CDMA Protocol Revision) Syntax AT$QCPREV Possible responses $QCPREV: <revision> OK This command allows an application to query the current CDMA protocol revision that is in use. The revision that is in use is one that the mobile station and base station agree to use when service is established. Parameter
<revision>
Description Reads protocol revision
Description JSTD008 IS95A IS95B IS2000
1 3 4 6
4.2.14
AT*ENETTIME (CDMA Network Time) Syntax AT*ENETTIME= <setting> AT*ENETTIME? When setting is 0 Possible Responses OK *ENETTIME: <GMTtime> OK
Description Set time format Read time

48(158)
1/198 17-4/FCP 101 3045 Uen
Description Read time
Syntax AT*ENETTIME? When setting is 1
Possible Responses *ENETTIME: <GMTtime>,<LeapSec>,<TimeZone>,<DaylightS avings> OK *ENETTIME: <hhmmss>,<yymmdd>,<dw> OK
Read time
AT*ENETTIME? When setting is 2
This command returns the time as defined in the CDMA network. For time to be returned, the module must have CDMA service. Time will be returned in seconds from 1/6/80. The format is a 16 digit hex number, preceded with zeros. If CDMA service is not present the returned time will be 16 zeros (0000000000000000). If trying to read Julian time while not in CDMA service coverage, the query command will return an ERROR. The use of CDMA time when handling E911 location data is strongly discouraged since the CDMA time does not reflect the time the GPS data was retrieved. Furthermore GPS time and CDMA time are not exactly the same time constants. According to IS95A, section 7.7.1.3, local time is calculated by GMTtime LeapSec + TimeZone. Note: Daylight savings time is available, but it is already factored into TimeZone and therefore should not be used in the calculation. The parameter is NOT persistent. As a result it will NOT be saved across a power cycle. Parameter <setting> 0 (default) 1 2 <GMTtime> <TimeZone> <LeapSec> <DaylightSavings> <hhmmss> hh 0 23 mm 0 59 ss 0 59 <yymmdd> Yy 0 99 mm 1 12 dd 1 31 <dw> Description Time format Terse mode, only the GMTtime is returned Verbose mode where GMTtime, TimeZone, and LeapSeconds is returned. Julian time format Time at GMT. Hex value in seconds from 1/6/80 Time zone offset from GMT. Signed decimal value in seconds Leap seconds since 1/1/80 in decimal Daylight saving indicator. 0 = no, 1 = yes Assists in defining an absolute time of the RTC. Time is local time The hour assignment to the RTC valid range The minutes after the hour assignment to the RTC valid range The seconds after the hour assignment to the RTC valid range Assists in defining an absolute date of the RTC. The year assignment to the RTC valid range The month assignment to the RTC valid range The day assignment to the RTC valid range Day of the week

49(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 06
Description Monday is day 0 and Sunday is day 6
4.2.15
AT*ECALLERID (Query Caller ID) Syntax AT*ECALLERID? Possible responses *ECALLERID: <caller_id>[,<caller_name>] OK
Description Reads the caller ID
This command allows an application to query the caller ID of the current incoming call after the first RING indication is presented and before the call is released. If a caller ID was not presented to the module or the query is issued outside the defined location, the AT command returns an ERROR. Notes: When extended error codes are enabled, the module returns OPERATION NOT ALLOWED if the command is issued while not on a call. The caller_name is available only if provided by the network. Parameter <caller_id> 0 999999999 BLOCKED UNKNOWN <caller_name> String Description Phone number or Restriction Phone number of the incoming call The caller ID is being restricted by the network The phone number of the incoming call is not included from the network Name of calling party Text string (typically first and last name). Maximum length is 64 bytes.
4.2.16
AT*ECSTAT (Query Call Status) Syntax AT*ECSTAT? Possible Responses *ECSTAT: <state>,<type> OK
Description Reads the current setting
This command polls the module for the call status. This is useful when the application is not processing unsolicited messages (powered off). This command is typically used in conjunction with AT*EWAKE If you are not on a call, the <type> value is set to the value it was during the last call. For example, the setting is not cleared when the call ends. As a result, the <type> value is valid only if the <state> value is not 0 (IDLE). Parameter <state> 0 Description Idle

50(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 1 2 3 <type> 0 6 7 8 9 20
Description Outgoing call Incoming call Active (on a call) Voice OTAPA OTASP Non-standard OTASP E911 Data
4.3
NAM Programming
This chapter describes the AT commands that are available for NAM programming. Before the NAM programming/write (AT*ERNAM) can start, the module has to be put into suspended mode by issuing AT*ESCAN. When the NAM programming is finished, it is necessary to resume the module by issuing AT*ESCAN. 4.3.1 AT*ESCAN (Stop/Start Scanning) Syntax AT*ESCAN=<setting> Possible Responses *ESCAN: OK *ESCAN: <setting> OK This command controls the scanning of the CM52. Scanning can be temporarily disabled to allow events to occur that affect scanning. When scanning is stopped, the module displays a NO SERVICE unsolicited message (if the appropriate mask is enabled and the module currently has service). The module remains in this state until scanning is resumed or the module is powered off (AT+CFUN). If the module does not have service when the command is issued, the NO SERVICE message will not be displayed. In addition, if a scan is in progress when the command is issued, the scan is immediately be terminated. No active call can be present (voice, data, SMS, OTAPA, etc) when issuing the command; if an active call is in progress, an ERROR is returned. The only valid (fully tested) AT commands that should be issued between stopping and starting the scanning are: AT*ERNAM AT*ERPRL AT+CFUN The primary reason for introducing AT*ESCAN is to enable NAM programming. The function of other commands while in suspended mode is undefined. During an emergency call (i.e., E911 call) the CM52 cannot allow for scanning to cease. FCC requirements state that the module must search for available service and complete the emergency call. Additionally, carrier requirements call for a 5-minute callback period following an E911 call during which the CM52 must remain on the channel used to place the E911 call. Therefore, if AT*ESCAN=0 is issued during an emergency call situation (either while attempting the call or in the callback mode) the CM52 will return ERROR.
Description Writes the setting
Reads the setting
AT*ESCAN?

51(158)
1/198 17-4/FCP 101 3045 Uen
If the CM52 has entered OFFLINE mode (see section 4.2.12.5), the AT*ESCAN? command will produce a value of 0. The scanning mode can not be re-enabled issuing AT*ESCAN=1, an error will be returned. The only way to exit the no-scan mode when the module is offline is to fix the offline issue and power cycle the module. This parameter is NOT persistent. As a result, it will NOT be saved across a power cycle. Parameter <setting> 0 1 (default) Description Stop Start
4.3.2
AT*ERNAM (NAM Programming) Syntax AT*ERNAM=<action>,<NA M_select>,<tag>,<value> AT*ERNAM=<action>,<NA M_select>,<tag> Possible responses OK *ERNAM: <NAM_select>,<tag>,<output_value> OK
Description Writes to the NAM Reads from the NAM
This command is used to read and write to the fields of the NAM. A NAM field can be read from or written to as determined by the <action> parameter. The <NAM_select> parameter selects on which NAM to perform the action. A <tag> identifies each NAM field. The value of the NAM field is specified by <value>. NAM values can be read without issuing AT*ESCAN. To write to the NAM an AT*ESCAN=0 command must be issued first. The following example sets the carrier name string to TEST (CM52 response in gray) AT*ESCAN=0 OK AT*ERNAM=1,1,4,TEST OK AT*ESCAN=1 OK Parameter
<action>
Suspend the CM52 Writes TEST into name tag
Exit suspended mode
Description Read Write NAM 1 NAM 2
0 1
<NAM_select>
0 1
The table below shows the expected output values for reading the NAM and the input values for writing the NAM. Each value is associated with a <tag> number. A description of the parameters is also provided. Information about possible values for each <tag> can be found in a different table, after the table below.

52(158)
1/198 17-4/FCP 101 3045 Uen
Note: If the negative SID/NID list is modified the module must be restarted for the change to take effect. <tag> 1 <output_value> <MIN> <input_value> <MIN> Description Mobile Identification Number (MIN) is the phone number string. Authentication key provided by the service provider. PRL List ID. The PRL list ID denotes the version number of the PRL. Note: This value can only be read. Carrier defined text name SMS Service Select Emergency Number 1 Emergency Number 2 Emergency Number 3 Slot cycle index Mobile Country Code Mobile Network Code Preferred Roaming List CDMA Directory Number. Unlocked SID/NID list Locked (negative) SID/NID list CDMA Primary Channel A. CDMA Secondary Channel A. CDMA Primary Channel B. CDMA Secondary Channel B. CDMA Home System Registration CDMA Foreign SID Registration CDMA Foreign NID Registration AMPS Home SID AMPS Initial Paging Channel Access Overload Class Service Programming Code (note the CM52 does not handle the SPC, it is made available so applications can handle. System Preference True IMSI
2 3
N/A <PRL_List_ID>
<AKEY> N/A
4 5 6 7 8 9 11 12 13 14 15 16 17 18 19 20 21 22 23 25 26 27 28
<Name> <SMS> <Emrgncy_Num_1> <Emrgncy_Num_2> <Emrgncy_Num_3> <Slot_cycle_index> <Mobile_Country_Code> <Mobile_Network_Code> <PRL_Enabled> <CDMA_Dir_Num> <Unlocked_Home_SID/NID> <Locked_Home_SID/NID> <CDMA_Primary_CH_A> <CDMA_Second_CH_A> <CDMA_Primary_CH_B> <CDMA_Second_CH_B> <CDMA_Home_Sys_Reg> <CDMA_Forn_Sys_Reg> <CDMA_Forn_NID_Reg> <AMPS_Home_SID> <AMPS_IPCH> <ACCOLC> ERROR
<Name> <SMS> <Emrgncy_Num_1> <Emrgncy_Num_2> <Emrgncy_Num_3> <Slot_cycle_index> <Mobile_Country_Code> <Mobile_Network_Code> <PRL_Enabled> <CDMA_Dir_Num> <Unlocked_Home_SID/NID> <Locked_Home_SID/NID> <CDMA_Primary_CH_A> <CDMA_Second_CH_A> <CDMA_Primary_CH_B> <CDMA_Second_CH_B> <CDMA_Home_Sys_Reg> <CDMA_Forn_Sys_Reg> <CDMA_Forn_NID_Reg> <AMPS_Home_SID> <AMPS_IPCH> <ACCOLC> <SPC>
50 51
<SYS_PREF> <TIMSI>
<SYS_PREF> <TIMSI>
The table below defines the valid values for each <tag>.

53(158)
1/198 17-4/FCP 101 3045 Uen
Parameter <MIN> 00000000009999999999 <A-key> 6-26 digits
Common for NAM 1 and NAM 2 Different
Description Mobile Identification Number (MIN) is the phone number string. Must supply all 10 digits. The default is 0000000000. Authentication key provided by the service provider. Only digits (0-9) allowed. Service provider provides the default value. Note: The A-Key parameter is actually a combination of the A-Key and the associated A-Key checksum. PRL List ID. The PRL list ID denotes the version number of the PRL. 0 indicates PRL not loaded. Loaded when PRL is activated. Carrier defined text name NAM 1 and NAM 2 are the default values. The value is truncated if length is greater than 12 characters. SMS Service Select Standard SMS disabled: temporary MAIL email addressing. Standard SMS enabled: standard IS-41 addressing. Emergency Number 1 Phone number string, 1-10 digits. Characters 0 9 and * and # valid. Emergency Number 2 Phone number string, 1-10 digits. Characters 0 9 and * and # valid. Emergency Number 3 Phone number string, 1-10 digits. Characters 0 9 and * and # valid. Slot cycle index Mobile Country Code (MCC) Must provide all 3 digits. The default is 000. Mobile Network Code (MNC) Must provide both digits. The default is 00. Preferred Roaming List Disable Preferred Roaming List. Enable Preferred Roaming List. CDMA Directory Number. Must provide all 15 digits. The default is 000000000000000.
Different
<PRL_List_ID> 0 1-65535 <Name> String <SMS> 0 (default) 1 <Emrgncy_Num_1> String (empty is default) <Emrgncy_Num_2> String (empty is default) <Emrgncy_Num_3> String (empty is default) <Slot_cycle_index> 0-7 (default is 2) <Mobile_Country_Co de> 000-999 <Mobile_Network_Co de> 00-99 <PRL_Enabled> 0 1 (default) <CDMA_Dir_Num> 000000000000000999999999999999
1
Different
Different
Different
Common
Common
Common
Common Different
Different
Different
Different
Indicates if the parameter is the same (common) for NAM 1 and NAM 2 or if the parameter is different for the two NAMs.

54(158)
1/198 17-4/FCP 101 3045 Uen
<Unlocked_Home_SI D/NID>2 0:0:0 19:32767:65535 (default is 0:69:65535) X:0:0
Different
<Locked_Home_SID/ NID> 0:0:0 9:32767:65535 (default is 0:0:0) X:0:0
Different
<CDMA_Primary_CH _A> 1-311, 689-694, 10131023 (default is 283) <CDMA_Second_CH _A> 1-311, 689-694, 10131023 (default is 691) <CDMA_Primary_CH _B> 365-644, 739-777 (default is 384) <CDMA_Second_CH _B> 365-644, 739-777 (default is 777) <CDMA_Home_Sys_ Reg> 0 1 (default) <CDMA_Forn_Sys_R eg> 0 1 (default) <CDMA_Forn_NID_R eg> 0 1 (default)
Different
Unlocked SID/NID list. Refer to NAM user scenario for an example. Format of input parameter is: <index>:<sid>:<nid> Up to 20 SID/NID pairs can be specified. If SID/NID pair is entered with SID equal to zero, that SID/NID pair as well as all subsequent pairs from the given index to the maximum list index are set to 0. Locked (negative) SID/NID list. Syntax is the same as the unlocked list. Format of input parameter is: <index>:<sid>:<nid> Up to 10 SID/NID pairs can be specified. If SID/NID pair is entered with SID equal to zero, then that SID/NID pair as well as all subsequent pairs from the given index to the maximum list index are set to 0. CDMA Primary Channel A. Valid channel numbers for primary channel A.
Different
CDMA Secondary Channel A. Valid channel numbers for secondary channel A.
Different
CDMA Primary Channel B. Valid channel numbers for primary channel B.
Different
CDMA Secondary Channel B. Valid channel numbers for secondary channel B.
Different
CDMA Home System Registration Disable registration. Enable registration. CDMA Foreign SID Registration Disable registration. Enable registration. CDMA Foreign NID Registration Disable registration. Enable registration.
Different
Different
If the module is defined at the factory for a Verizon account the module will automatically set the SYS_PREF when the first entry in the SID/NID list is set. If SID is odd, SYS_PREF will be set to Auto A; if the SID is even, SYS_PREF will be set to Auto B. Done to facilitate setting SYS_PREF during OTASP or OTAPA.

55(158)
1/198 17-4/FCP 101 3045 Uen
<AMPS_Home_SID> 0 & 2 32767 <AMPS_IPCH> 1-799,990-1023 <ACCOLC> 0-15 <SPC> 000000-999999 <SYS_PREF>3 0 1 (Default) 2 <TIMSI>
Different
Different Different
Common
Different
Different
000000000000000 999999999999999
AMPS Home SID. Odd numbers are home system in band A and even numbers are home system in band B. The default is 69. AMPS Initial Paging Channel The default is 333 for odd SIDs and 334 for even SIDs Access Overload Class Overload class, default is the least significant digit of the MIN. Service Programming Code Must provide all 6 digits. The default is 000000. Note: The SPC is used by OTASP & OTAPA. System Preference; applicable only if AT*EPMOD roaming parameter is set to ALL. Off. Auto A (Verizon concept). Auto B (Verizon concept). The true IMSI is an identifier that is NOT associated with the MIN based IMSI. It can be 15 or fewer digits (padded most significant bits with zeros). Must provide all 15 digits. The default is 000000000000000.
4.3.3
AT*ERPRL (Preferred Roaming List) Syntax AT*ERPRL=<action>,<NAM _select>,<index>,<size> AT*ERPRL=<action>,<NAM _select>,<packet_number>, <length>,<more>,<data> AT*ERPRL=<action>,<NAM _select> Possible responses *ERPRL: <data>,<remaining> *ERPRL: <status>,<next_packet_number> OK *ERPRL: <status>,<next_packet_number> OK
Description Reads the PRL Writes the PRL
Gets status
This command is used to program the PRL (Preferred Roaming List) fields. There are two PRLs, one per NAM. The maximum size of each PRL list is 8192 bytes (8K). Note: Anytime a PRL is written to a NAM, the most recently used (MRU) table for the NAM is reset. In addition, if a PRL is programmed into the module, the NAM tag of PRL_Enabled is enabled. Usually, the PRL programming is not entered by hand. Instead one of the following methods is used: The PRL programming is already done in the factory and there is no need to change it. If a change is needed, many times the service provider loads the PRL list using OTA (Over the Air) programming (see chapter 6.4.1). Using a tool, such as the MoST tool, provided with the CM52 developers kit.
For information regarding Auto A and Auto B refer to the Verizon specifications. SYS_PREF can be automatically set by the module; refer to the AT*ERNAM Unlock_Home_SID/NID footnote for details.

56(158)
1/198 17-4/FCP 101 3045 Uen
After all the PRL data is sent to the module and before the module saves the PRL, the module verifies the contents of the PRL. If the PRL is not valid, an ERROR is returned as part of the last write. Note: The module allows for any valid CDMA channel to be present in the PRL, even if the channel is not used for a particular carrier. The PRL can be read without suspending the module; however, to write the PRL, the module must be suspended using AT*ESCAN. Parameter <action> 0 1 2 <NAM_select> 0 1 <packet number> 0 .. 65535 <length> 1 120 <more> 0 1 <data> 00 FF Description Read. Write. Status. NAM 1. NAM 2. Notes which number of packet in the sequence of the PRL entry. Number of bytes to write. The <data> field must contain two hex digits for each byte. Boolean denoting if more packet(s) are required to complete the PRL No packets pending. More packets pending. PRL packet content encoded in hex representation. Ex: hex 30 is the encoding of the number 0. For more information regarding the PRL packet content refer to TIA/EIA/IS-683. An even number of hex digits containing the data to be written. Each pair of hex digits represents one byte of data. If more data is entered than the <length> parameter specifies, the additional data is ignored. <index> 0 12287 <size> 0 120 <remaining> 0 12287 <Status> 0 1 2 PRL stored. The PRL has been successfully stored in the module. PRL loading. The PRL is loading and is being buffered. PRL packet size error. Indicates that the module has detected a mismatch between <length> and the actual number of data characters. Could also indicate the length has exceeded 240 bytes. PRL sequence error. Indicates the module received a packet with <packet_number> that is not equal to the expected <packet_number>. PRL invalid error. A bad PRL load is detected. Position within the PRL to start reading from. Maximum number of bytes to read. Number of bytes remaining in the PRL (bytes after the current read location)
3 4

57(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 5 6 7 8
Description PRL size error. Indicates the sum of all the packets data fields exceeds the size of the PRL buffer. PRL memory error. Invalid <more> parameter. Invalid <data> character. Hex characters must be 0 9, or A F.
4.3.4
AT*ESSE (Select NAM1 or NAM2) Syntax AT*ESSE=<nam> AT*ESSE? Possible Responses OK *ESSE: <nam> OK
Description Enter a new value Reads the active NAM identifier
This command selects NAM1 or NAM2 as the active NAM. The change takes effect immediately after the OK is returned. Parameter <nam> 0 (default) 1 Description Identifies NAM1 or NAM2 to be selected. Selects NAM 1 Selects NAM 2
4.3.5
AT*EOTAPAS (Prevent/Allow an OTAPA Session) Syntax AT*EOTAPAS=<setting> AT*EOTAPAS? Possible Responses OK *EOTAPAS: <setting> OK
Description Writes the setting Reads the setting
This command enables an application to prevent or enable OTAPA sessions. Note: this feature applies to the current NAM. This setting is persistent. As a result, it is saved over a power cycle. Parameter <setting> 0 1 (default) Description Availability of OTAPA sessions Prevent all OTAPA session requests OTAPA requests granted.

58(158)
1/198 17-4/FCP 101 3045 Uen
4.4
4.4.1
Call Control
ATA (Answer) Syntax ATA Possible responses OK
Description Answer an incoming call.
This command is used to request the CM52 to answer an incoming call. The command returns NO CARRIER if there is no call in progress. Result Codes OK ERROR NO CARRIER Description The command was executed successfully. The command was not executed successfully (no connection available). There is no call in progress
4.4.2
ATH (Hook Control) Syntax ATH Possible responses OK
Description Terminate an active call.
This command is used to request CM52 to terminate an active call. If there is no call in progress, the command will be ignored but OK will still be returned. If an incoming call is present, but not answered, ATH can be used to terminate the incoming call without answering it first. Note that the behavior observed by the call originator may vary; Verizon will pass the call immediately to voicemail when ATH is presented on the incoming call side. 4.4.3 ATD Dial command Syntax ATD<dial_string> Possible responses OK
Description Dial a call in Idle mode
This command instructs CM52 to originate (dial) a call if no call is already in progress. If a call is in progress, the command is used for sending DTMF tones. Refer to section 4.4.4 for more information about DTMF tones. For ATD to be used for voice call origination, the CM52 has to be in voice mode. It is possible to check what mode the CM52 is currently in by issuing the AT+COS? Command. The first return parameter, Service code, should be in the range of 0-3. For more information about the AT+COS command, see chapter 4.4.6. All characters appearing on the same command line after the D are considered part of the call addressing information to be signaled to the network, or as modifiers used to control the signaling process (collectively known as a dial string), up to the end of the command line. Some characters may be included in the dial string that the CM52 will skip (ignore) when encountered. This permits characters such as parentheses and hyphens to be included that are typically used in formatting of telephone numbers. The length of the <dial string> is between 1 and 32 valid characters (after skipped characters are parsed out).

59(158)
1/198 17-4/FCP 101 3045 Uen
Parameter <dial string> 0123456789*# space ( ) P T W
Description Valid characters for origination. Characters that may appear in <dial string> and are skipped (ignored) by the CM52.
Result Codes OK ERROR NO CARRIER 4.4.4
Description The command was executed successfully. The command was not executed successfully. The CM52 does not currently have service.
ATD Overdial (DTMF Tones) Syntax ATD<overdial> Possible responses OK
Description Transmit DTMF tones during an active call
If a call is in progress, the command is used for sending DTMF tones in the <overdial> string. If not on a call, the command is used to originate a call. Refer to section 4.4.3 for origination requests The <overdial> parameter specifies the <overdial> string that will be issued as DTMF tones. The valid characters for the <overdial> parameter are listed in the parameter table below. The maximum total length of <dial string>,<overdial> is 32. Parameter <overdial> , 0123456789*# 4.4.5 Description Commas encountered within an <overdial> string generate a pause according to the value of the S8 register. Valid characters for DTMF tones.
ATD! Hook Flash Syntax ATD![<data>] Possible responses OK
Description Generate a Flash message
This command sends a Flash message or a Flash with Info message to the network. The command is only valid during a voice call. The Flash and Flash with Info messages are used for supplementary services such as three-way calling, Call Hold and Call Waiting. The information for the flash with info are entered after the !. See example below. Example of 3-way calling, Carrier requirements for completing 3-way calls can vary (the CM52 responses have been omitted in the example):

60(158)
1/198 17-4/FCP 101 3045 Uen
ATD9876543 ATD!1234567 ATD!
Dial the first number Send a Flash with Info message to the network to dial the second number Send another Flash message to activate the call on hold. All three parties should now be active. Description 0 1 2 3 4 5 6 7 8 9 * # are the valid characters for digital data.
Parameter <data> String
4.4.6
AT+COS (Operating Service) Syntax AT+COS=<SC>[,<ORIG_SO>] [,<PAGE_SO>][,<PM>] AT+COS? Possible responses OK
Description Set the CM52 requested service option Read the current setting
+COS: <SC>,<ORIG_SO>, <PAGE_SO>,<PM> OK
This command specifies the service to be requested for incoming and outgoing calls. The settings are valid until changed or the CM52 is restarted. After a power cycle, the settings will be set to the default values. Privacy Mode is persistent across power cycles. The <SC>, service code, and <PM>, privacy mode, have to be the same for incoming and outgoing calls, but the other parameters can be different. The setting of <ORIG_SO> controls next outgoing call and the setting of <PAGE_SO> controls incoming calls. Privacy mode can be requested by the module, however the base station has the final say as to whether or not to enable privacy mode. Therefore it is possible that the module can request privacy and the base station opts not to enable privacy mode. Typically ORIG_SO & PAGE_SO are used for parametric testing and not for day to day usage; therefore from an application standpoint only the first parameter should be used. Parameter <SC> 0 1 2 3 (default) 4 9 10 <ORIG_SO>, <PAGE_SO> -- When <sc> = 0 Description Service Code Request Analog Speech Only. Request Digital Speech Only. Request Analog or Digital Speech Analog Preferred. Request Analog or Digital Speech Digital Preferred. Request Async Data Service. Request Loop-back service Request Markov Service Originating Service option, Mobile Terminating Service Option

61(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 0 (default) -- When <sc> = 1,2,3 0 (default) -- When <sc> = 4 0 (default) 1 2 3 -- When <sc> = 9 0 (default) 1 3 4 -- When <sc> = 10 0 (default) 1 3 5 <PM> 0 1 (default)
Description Service option is not relevant in Analog mode. Enhanced Variable Rate Voice Service (SO-3). Asynchronous Data IS-99 over Rate Set 2 (SO-12). Asynchronous Data IS-99 (SO-4). Asynchronous Data IS-99 over Rate Set 2 (SO-12). Asynchronous Data IS-707 (SO-4100). (SO-2). Loop-back IS-126 (SO-2). Full TDSO (SO-32). Loop-back SO55 (SO-55). (SO-32770). Markov (SO-32770) Markov (SO-32798) Markov (SO-54) Privacy Mode Disable privacy. Enable privacy.
Note on packet data originations ORIG_SO SO-7 SO-15 SO-22 Comment Internet Standard PPP Packet Data Service (IS-657) Internet Standard PPP Packet Data Service (IS-657) over Rate set 2 Medium Data Rate (externally known as High Speed Data) PPP Packet Data Service (IS707A) with rate set 1 forward and reverse. Default Mux = 9 forward 1 reverse Medium Data Rate (externally known as High Speed Data) PPP Packet Data Service (IS707A) with rate set 2 forward and reverse. Default Mux = 10 forward 2 reverse CDMA2000 packet Internet Standard PPP Packet Data Service (IS-707)
SO-25
SO-33 SO-4103
A packet data origination for each service option can be completed by sending a combination of AT commands described as follows: ORIG_SO 7 15 22 25 33 4103 AT$QCMIP 0 0 0 0 0 0 AT$QCQNC 0 0 0 0 0 0 AT$QCMDR 2 2 1 1 3 2 AT$QCSO 0 AT+CMUX 1,1 C,2 1,1 C,2 1,1

62(158)
1/198 17-4/FCP 101 3045 Uen
4.4.7
AT+CSS (Read Serving System) Syntax AT+CSS? Possible Responses +CSS: <Band>,<SID>,<NID> OK
Description Read serving system information
This command returns the information about which system the CM52 is currently camped on. Parameter <Band> A B a b c d e f Z <SID> 0-32767 99999 <NID> 0-65535 99999 Description The mobile station is monitoring with a cellular A band system The mobile station is monitoring with a cellular B band system The mobile station is monitoring with a PCS A block system The mobile station is monitoring with a PCS B block system The mobile station is monitoring with a PCS C block system The mobile station is monitoring with a PCS D block system The mobile station is monitoring with a PCS E block system The mobile station is monitoring with a PCS F block system The mobile station has not located a service provider System ID The mobile station is monitoring the system indicated The mobile station has not located a service provider Network ID The mobile station is monitoring the NID indicated; if no NID is available then the wildcard of 65535 is assumed. The mobile station has not located a service provider
4.5
4.5.1
Registration
AT*EREGC (Registration Control) Syntax AT*EREGC=<nam>,<reg> AT*EREGC=<nam> Possible Responses OK *EREGC: <nam>,<reg> OK
Description Write setting Read setting
This command controls the registration modes in the CM52 Module. Registrations due to SID/NID changes are dependent on the Timer registration selection. All other registrations are independent. System ordered registrations cannot be disabled with this command. Note: The module keeps track of power up registrations. If power up registrations are disabled on a power up and later power up registrations are enabled, the module will immediately send a power up registration to the network. The data is persistent. As a result it is saved over a power cycle. Parameter <nam> 0 Description Selected NAM NAM 1

63(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 1 <reg> 00 01 02 04 08 10 20 40 80
Description NAM 2 Registration control (in hex) All registration types enabled Autonomous (timer) registration disabled SID change registration disabled (not supported) NID change registration disabled (not supported) Power up registration disabled Power down registration disabled Zone registration disabled (CDMA) Distance registration disabled (CDMA) Parameter-based registration disabled (CDMA)
NOTE: If MicroBurst is enabled (Section 0), this command is disabled and all settings are ignored. 4.5.2 AT*EREGF (Forced Registration) Syntax AT*EREGF=<setting> Possible Responses OK
Description Set input source selection
This command forces a registration. If the module is camped on a CDMA network, the input parameter determines what type of registration to perform. On an AMPS network, the input parameter is ignored since all registrations are timer-based. Note: this command will override any registration limitations established by the base station. When the command is issued, the CM52 module will perform a single registration attempt in the network. This command supersedes AT*EREGC. Parameter <Setting> 0 1 2 4 5 6 CDMA Registration Type Timer Based Power Up Zone Based Parameter Change Ordered Distance-Based
4.5.3
AT*EREGT (Retain Registration Time) Syntax AT*EREGT=<setting> AT*EREGT? Possible Responses OK *EREGT: <setting> OK
Description Write setting Read setting
This command enables timer based registration time to be saved over a restart (power cycle); the previous registration time will be used when the module restarts. If the time has expired the module will register when powered up. This behavior is NOT the standard means for handling registration; however when combined with restricting power up and power down registrations (AT*EREGC), it can create a means to reduce the number of registrations occurring if the module is to be powered up and down repetitively during a short timeframe. Consult with your network providers regarding the use of this AT command

64(158)
1/198 17-4/FCP 101 3045 Uen
The time value is saved during a proper shutdown (AT+CFUN=0 or the Shutdown pin); it will not be saved otherwise. Note: The Qualcomm architecture performed this capability when in AMPS mode already; therefore it will be the only behavior regardless of the <setting>. Digital behavior was modified and is controlled by this AT command. The data is persistent. As a result it is saved over a power cycle. Parameter <Setting> 0 (default) 1 Description Disable Enable
4.6
Audio Control
Though the CM52 audio commands are similar to those used in the CM42, it should not be assumed that the same values can be used across the CM42 & CM52. The baseband chipset used on the CM42 and CM52 are different, so the values used for audio settings are not necessarily identical. 4.6.1 AT*EAMS (Audio Mode Selection) Syntax AT*EAMS=[<voice_alg >][,<noise_reduct>][,<si de_tone>][,<echo_sup press>][,<nes_setting>] AT*EAMS? Possible Responses OK
Description Sets the audio mode
Reads the audio mode selection
*EAMS: <voice_alg>,<noise_reduct>,<side_tone>,<short_ec ho_cancellation>,<nes_setting> OK
This command sets the audio mode selection that is available during a call. The settings are persistent. As a result, they are saved over a power cycle. Parameter <voice_alg> 1 2 (default) <noise_reduct> 0 1 (default) <side_tone> 0 (default) <echo_suppress> 0 1 2 Description Semi-Duplex. Full Duplex Off On Off Off VOC_EC_ESEC VOC_EC_HEADSET

65(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 3 (default) 4 <nes_seting> 0 1 (default)
Description VOC_EC_AEC VOC_EC_SPEAKER Network Echo Suppression Off On
4.6.2
AT*EPCMR (PCM audio Routing) Syntax AT*EPCMR=<route> AT*EPCMR? Possible Responses OK *EPCMR: <route> OK
Description Enters a new value for the data input source selection Reads the current data input source selection
This command queries or sets the PCM data source for the PCM circuits in the CM52 Module. The read command always returns the current setting. If set to 1, 1 will also be returned in Idle mode. The setting is persistent. As a result, they are saved over a power cycle. Parameter <route> 1 (default) 3 Description PCM direction in active call. Application analog to RF {normal audio}. Application PCM to RF
4.6.3
AT*ENESC (Network Echo Suppression) Syntax AT*ENESC=<nesRxAttLev>, <nesNeHoTh> AT*ENESC? Possible Responses OK *ENESC: <nesRxAttLev>, <nesNeHoTh> OK
Description Sets network echo suppression parameters Reads current network echo suppression parameter settings
This command sets up the network echo suppression parameters so that the application can achieve optimum audio performance. The settings are persistent. As a result, they are saved over a power cycle. Parameter <nesRxAttLev> 0000 FFFF (hex) <nesNeHoTh> 0000 FFFF (hex) Description Attenuation Level Default value is 2000 (-6 dB) Near Hangover Threshold Default value is 0 (0 ms)

66(158)
1/198 17-4/FCP 101 3045 Uen
4.7
Mode Management
The AT commands in this chapter are related to controlling the mode, where mode refers to wireless standard mode, CDMA and AMPS. 4.7.1 AT+CAD (Query Analog or Digital Service) Syntax AT+CAD? Possible Responses +CAD: <service> OK This command is used to query what type of service is available on the current channel; CDMA, AMPS, or none. Parameter <service> 0 1 3 Description No service is available CDMA digital service is available Analog service is available
Description Queries they type of available service
4.7.2
AT*EPMOD (Preferred Mode) Syntax AT*EPMOD=[<mode>][,[<b and>]][,[<roam>]] AT*EPMOD? Possible Responses OK *EPMOD: <mode>,<band>,<roam> OK
Description Sets the preferred mode of operation Reads the current preferred mode setting
This command is used to set the preferred mode of operation. This affects which systems the CM52 scans for service. Note: The CM52 reports ERROR if this command is issued while the module is on a voice call, is in the process of sending an SMS message, or is on a data call. The mode settings are persistent over a power cycle. CM52 does NOT restart automatically after this command is issued, nor is it necessary to restart the module. The command rebuilds the scan list and initiates a new scan immediately. It should be noted that AT*EPMOD is a post processing command, meaning that the scanning is done after OK is returned to the application. Issuing the command repetitively in rapid succession will delay the module in finding service and ultimately entering idle mode. Note: The function of this command can be incorrect if a CDMA-only or an AMPS-only PRL is loaded in the currently active NAM. For example, if a CDMA-only PRL is loaded into the active NAM and AT*EPMOD is used to select AMPS only (mode = 1), the CM52 has no choice but to revert back to CDMA operation in order to find service as the PRL dictates. Only when a preferred roaming list that includes both CDMA and AMPS systems is loaded in the active NAM is the function of this command as expected and defined. If a parameter is not specified, the current setting in the module is assumed.

67(158)
1/198 17-4/FCP 101 3045 Uen
Example: If the mode = 1, band = 1, and roam = 1, Issuing AT*EPMOD=,,0 Would result in mode = 1, band = 1, and roam = 0. Issuing AT*EPMOD=,0 Would result in mode = 1, band = 0, and roam = 0. Issuing AT*EPMOD=0 Would result in mode = 0, band = 0, and roam = 0. Parameter <mode> 0 1 2 <band> 0 1 2 3 4 <roam> 0 1 Description Automatic AMPS only CDMA only All bands Cellular A Cellular B Cellular Only PCS Only All Home only
4.8
Interface Commands
This chapter contains AT commands that are used for the serial communication between the CM52 and the host application. It also provides configuration information about specific characters. 4.8.1 ATS0 (Automatic Answer Control) Syntax ATS0=<rcnt> ATS0? Possible responses OK <rcnt> OK This command defines the automatic answering features of the module. A non-zero value specifies the number of rings before the call is answered. The values 1-255 are allowed parameters. Because of module and network timeouts, the number of actual rings may not be compatible with the defined timeout range. The network can, for example, send the call to voicemail before the maximum number of rings is reached. This setting is persistent. As a result, it is saved after a power cycle. Parameter <rcnt> 0 (default) 1 255 Description Disables automatic answer. Answers after the specified number of rings.
Description Sets the current setting Reads the current setting.

68(158)
1/198 17-4/FCP 101 3045 Uen
4.8.2
ATS2 (Escape Sequence Character) Syntax ATS2=<esc> ATS2? Possible responses OK <esc> OK
Description Sets the current setting Reads the current setting
This command defines the character to be used as the escape sequence character when switching from online data mode to on-line command mode. This setting is not persistent. As a result, it is not saved after a power cycle. Parameter <esc> 0 to 127 128-255 Description Set Escape sequence character. The default is 43, or the + character. The escape sequence detection is disabled
Note: There are two guard times that should be taken into consideration when using the escape sequence. The defined escape sequence must be completed within a specific window of time. Otherwise it is assumed that the characters are simply part of the data stream and the transfer of data continues: There is a 200ms guard time between the escape characters And a 900ms guard time between the last escape character and the AT command to be issued. 4.8.3 ATS3 (Command Line Termination Character) Syntax ATS3=<value> ATS3? Possible responses OK <value> OK This command sets the character value to be used to terminate an incoming command line. The character value setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0 127 Description Character Value for the line termination character. The default is 13, or the ASCII carriage control character.
Description Sets the current setting Reads the current setting
4.8.4
ATS4 (Response Formatting Character) Syntax ATS4=<value> ATS4? Possible responses OK <value> OK

69(158)
1/198 17-4/FCP 101 3045 Uen
This command sets the value of the TA defined character to be used as line formatting character when formatting the result codes and information text. It is used together with the ATS3 command. The formatting character setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0 127 Description line formatting Decimal values for the line formatting character. The default is 10, or the ASCII line feed character. ATS5 (Command Line Editing Character) Syntax ATS5=<value> ATS5? Possible responses OK <value> OK This command sets the value of the defined character for deleting the immediately preceding character from the command line. The delete character setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0 127 (default is 8) Description backspace character Decimal values for the command line-formatting character.
4.8.5
4.8.6
ATS6 (Pause before Blind Dialing) Syntax ATS6=<value> ATS6? Possible responses OK <value> OK
This command sets the number of seconds to pause before blind dialing register value of V.25 ter. It is provided only for compatibility with the V.25 register command, there is no action performed on the CM52. The pause value setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 2-10 (default is 2) Description Pause value in seconds.
4.8.7
ATS7 (Connection Completion Timeout) Syntax ATS7=<tmo> Possible responses OK
Description Sets the current setting

70(158)
1/198 17-4/FCP 101 3045 Uen
Description Reads the current setting.
Syntax ATS7?
Possible responses <tmo> OK
This command defines the maximum time allowed between completion of dialing and the connection being established. If this time is exceeded then the connection is aborted. The timeout setting is not persistent. As a result, it is not saved after a power cycle.
Parameter
Description Timeout value in seconds.
<tmo> 1 255 (default is 50)
4.8.8
ATS8 (Comma Time) Syntax ATS8=<value> ATS8? Possible responses OK <value> OK
This command sets the number of seconds that the CM52 pauses during DTMF tone generation. The pause time setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0-255 (default is 2) Description Pause when a comma encountered, in seconds.
4.8.9
ATS9 (Carrier Detect Threshold) Syntax ATS9=<value> ATS9? Possible responses OK <value> OK
This command sets the carrier detect threshold in increments of 0.1 seconds. The threshold is the amount of time Carrier Detect stays high. It is provided only for compatibility with the V.25 register command, there is no action performed on the CM52. The carrier detect threshold setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0-255 (default is 6) Description Value (in increments of 0.1 second) for carrier detect threshold.
4.8.10
ATS10 (Automatic Disconnect Delay)

71(158)
1/198 17-4/FCP 101 3045 Uen
Description
Sets the current setting Reads the current setting.
Syntax ATS10=<value> ATS10?
Possible responses OK <value> OK
This command sets the duration of received-line-signal loss that the DCE tolerates. If the duration is exceeded, the DCE disconnects. The duration setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 1-254 (default is 14) 255 Description Disconnect after number of tenths of seconds of received line-signal loss, e.g. for a value of 14 disconnect after 1.4 seconds of received line-signal loss. Ignore received line-signal loss, do not disconnect.
4.8.11
ATS11 (DTMF Duration and Spacing Setting) Syntax ATS11=<value> ATS11? Possible responses OK <value> OK
This command sets the DTMF pulse width (milliseconds) for both burst and continuous DTMF. Burst DTMF (CDMA mode) For burst DTMF, refer to section 2.7.2.3.2.7 Send Burst DTMF Message, TIA/EIA/IS-2000-5. The Digit Time Index is the code that is transmitted in the Send Burst DTMF message to activate the DTMF generator at the base station. The content of register S11 is used to determine the Digit Time Index to be used. Further, the calculated Digit Time Index is used to determine the inter-digit time. Digit Time Index 000 001 010 011 S11 Range 50..149 150..199 200..249 250 DTMF Digit Time 95 150 200 250 DTMF Inter-digit Time 60 100 150 200
Continuous DTMF (CDMA mode) For continuous DTMF, refer to section 2.7.3 Order Messages, TIA/EIA/IS-2000-5. The pulse width is determined by the module via separate DTMF start and stop messages. A Continuous DTMF Tone Order (start) message embedded with the tone code is sent to the base station to trigger the start of a DTMF tone. A Continuous DTMF Tone Order (stop) message is sent to the base station to end the current tone transmission. The continuous DTMF pulse width is calculated as follows: S11 Value 251-255 DTMF Digit pulse width (ms) ( S11_Value 250 ) X 1000
Note: For continuous DTMF, only the first character in an ATD over-dial string (see 4.4.1.3 for ATD Command reference) is transmitted. Any remaining characters are ignored. DTMF (Analog mode)

72(158)
1/198 17-4/FCP 101 3045 Uen
For S11 values <= 250, the digit times and the inter-digit times are derived identically to Burst DTMF. For S11 values > 250, the digit pulse width is derived identically to Continuous DTMF. The DTMF pulse width setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 50-255 (default is 95) 4.8.12 Description Refer to tables above for actual pulse width values. DTMF pulse width.
AT&C (DCD Control) Syntax AT&C<value> Possible responses OK
Description Sets the current setting
This command sets how DCD (circuit 109 in V.24 standard) behaves in response to received network signals. The setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0 1 2 (default) 4.8.13 Description Turn off DCD Turn on DCD when suitable network signals are present. Turn off DCD when suitable network signals are not present. Turn on DCD. AT&D (DTR Response) Syntax AT&D<value> Possible responses OK
Description Controls action on DTR
Controls the behavior of the CM52 when the CM52 detects a change (high to low) on the DTR signal (circuit 108 in V.24 standard). The setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0 1 2 (default) Description CM52 ignores the detection CM52 switches to on-line command mode. For the other states, refer to <value>=2. CM52 disconnects and switch to off-line command mode.
4.8.14
ATE (Command Echo) Syntax ATE<value> Possible responses OK
Description Sets echo enable/disable
This command determines whether CM52 should echo characters received from the host application during command state and on-line command state.

73(158)
1/198 17-4/FCP 101 3045 Uen
The setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0 1 (default) 4.8.15 Description CM52 will not echo characters during command state and on-line command state. CM52 echoes characters during command state and on-line command state. AT+IFC (DTE-DCE Local Flow Control) Syntax AT+IFC=[<DCE_by_DTE >[,<DTE_by_DCE>]] AT+IFC? Possible Responses OK +IFC: <DCE_by_DTE>,<DTE_by_DCE> OK This command is used to set up the local flow control operation between the CM52 and the host application. The value settings are not persistent. As a result, they are not saved after a power cycle. Parameter <DCE_by_DTE> 0 1 2 (default) 3 Description None Sets software flow control on circuit 103, where the flow control characters (XON/XOFF) are not passed on to the remote DCE (modem). Sets hardware flow control using circuit 133 (Ready for Receiving) Sets software flow control on circuit 103, where the flow control characters (XON/XOFF) are passed through to the remote DCE (modem). XON/XOFF will still perform local flow control. None Software flow control on circuit 104, with XON/XOFF as the flow control characters. Hardware flow control using circuit 106 (Clear to send/Ready for sending)
Description Sets the current setting Reads the current settings
<DTE_by_DCE> 0 1 2 (default)
4.8.16
AT+IPR (DTE Rate) Syntax AT+IPR=<value> AT+IPR? Possible Responses OK +IPR: <value> OK
Description Sets data rate Reads current settings
This command sets the current data rate at which the CM52 accepts commands and sends responses. When the setting is modified, the baud rate is changed immediately after the CM52 has responded with OK. The OK is still sent using the previous data rate setting, but any communication after the OK uses the new rate. The setting is persistent. As a result, it is saved after a power cycle. Parameter <value> 9600 (default) 19200 Description Specifies the rate Baud rate 9600 Baud rate 19200

74(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 38400 57600 115200 230400
Description Baud rate 38400 Baud rate 57600 Baud rate 115200 Baud rate 230400
4.8.17
AT*EMUX (Setup Multiplexer) ***Future Implementation*** Syntax AT*EMUX=<setting> AT*EMUX? Possible Responses OK *EMUX: <setting> OK
Description Sets the feature Reads the current setting
The serial port multiplexer functionality is not currently supported in the CM52. There are provisions in place to provide this functionality at a later date, but at the time of this document release the multiplexer functionality is NOT supported. This command enables/disables the multiplexer on the serial port. All communication with the module must be in the form of multiplexer packets when enabled. The CM52 remains in multiplexing mode until the user sends the command AT*EMUX=0 through a multiplexer packet. The CM52 multiplexer provides dedicated channels for AT commands, unsolicited messages, and data. Multiplexing is not persistent. As a result, it is not saved after a power cycle. Parameter <setting> 0 (default) 1 Description Whether multiplexer is active or not. Multiplexer not active Multiplexer active
4.8.17.1
Multiplexer Packet Format Octets 1 1 1 1 0-255 2 1 Notes Always 0x81 See Control Format Table Range: 0x00 0x0F. Required for Flow Control when Frame Type = 2 or 3. Determines data payload size LSB sent first. Required for Error checking when Frame Type = 3. Always 0x81
Parameter Start Flag (0x81) Control Sequence Number Data Length Data Payload 16-Bit CRC End Flag (0x81)
The CRC bits are optional. They are required only if the user requests CRC error checking. CRC Error checking is requested by setting the Frame Type bits to 3 in the Control Octet. See the Table below. Control Octet Format: Parameter Frame Type More Channel
Bits 4 1 3
Notes Description of packet frame. See Frame TypeTable Packet is fragmented. More to come. Channel designation for this frame. See Table below.

75(158)
1/198 17-4/FCP 101 3045 Uen
Frame Type: Parameter 0 1 2 3 4 5 6 7 8 9F Channel Number: Parameter 0 1 2
Notes Empty Frame Frame with No Quality-Of-Service requested Frame with Flow Control requested Frame with Flow Control and CRC Error Checking requested ACK NACK Set Quality-Of-Service Ping Reset the Mux Reserved
Notes AT Commands Unsolicited Messages Data
Sending AT Commands When sending an AT command to the CM52, the Data Payload portion of the frame consists of a 1-octet command number followed by the AT command string. The command number is arbitrary and is returned to the user when the CM52 responds. This allows the user to know to which command the CM52 is responding. It is recommended that the user start with 0 and increment this number, modulo 255, for each successive command. Multiplexer Example To turn off the multiplexer, the user must send the data payload AT*EMUX=0 on the Command Channel. This packet construction is described below. The Start Flag is always 0x81. The Control Flag is 0001 0 000 = 0x10. Frame Type =1, More = 0, Channel = 0. This requests no flow control and no CRC error checking. This frame is not segmented, so the More flag is 0. This is an AT command which must be sent to Channel 0. The Sequence number is 0. This is ignored because Frame Type is 1, which means no flow control. The Data Length = 0x0A, which is 1 byte for the command number plus the length of the string AT*EMUX=0. The command number is arbitrary, choose 0x00. AT*EMUX=0 translates to ASCII 0x41 0x54, 0x2A, 0x45, 0x4D, 0x55, 0x58, 0x3D, 0x30 The CRC is ignored. Set it to 0x00, 0x00. The End Flag is always 0x81. This results in the following packet sent:

76(158)
1/198 17-4/FCP 101 3045 Uen
0x81, 0x10, 0x00, 0x0A, 0x00, 0x41 0x54, 0x2A, 0x45, 0x4D, 0x55, 0x58, 0x3D, 0x30, 0x00, 0x00, 0x81
4.9
4.9.1
Module Status and Controls

AT+CFUN (Set Functionality Level) Possible responses OK OK OK OK OK +CFUN: <fun> OK
Description Powers down Restarts Full Function Powers down, RTC mode
Syntax AT+CFUN=0[,<force>] AT+CFUN=99[,<force>] AT+CFUN=1 AT+CFUN=10,<sleep>,<wake>,<cycle> [,<hhmm>][,<dd>] Holds Host_pwr_en_b AT+CFUN=20[,<duration>] Reads the current functional AT+CFUN? level
This command selects the level of functional capability <fun> in the module. There are two ways of shutting down the CM52 properly. One way is to use this command. The other way is via input pins (see the CM52 Integrators Manual, HW description, on how to do this). Note: If a software fatal error should occur (an unlikely event), the module will shut itself down and in doing so will issue the SHUTDOWN COMPLETE message. The module will NOT automatically restart as it did on the CM42. The reasoning for not automatically restarting is to force the host application to recognize that the module has stopped and to restart it. Getting the host application to restart the module insures that the host application has acknowledged the condition and can reset any nonpersistent settings in the module. This insures that the module is running under the correct host application directed configuration rather than the default configuration. There are (2) types of software shutdowns via this command. All CFUN power downs are considered controlled power downs. That is, a proper CM52 shutdown is completed, thus avoiding the problems that could arise from improper shutdown (NV corruption, etc.): 1. AT+CFUN=0 This is available on all CM52 variants and can be used with the optional parameter of <force>. AT+CFUN=0 should be executed before removing the power or setting the MODULE_PWR_EN_B signal to inactive. The message SHUTDOWN COMPLETE is returned when power is withdrawn. The optional force parameter forces a power down registration regardless of the bit setting in EREGC. Note: The base station can indicate to the module whether to send a power-down registration when powering down and the module will honor that capability. Therefore, if the force power down registration parameter is set, but the base station requested no power down registration, the module will not send the request to the base station. 2. AT+CFUN=10 The AT+CFUN=10 command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Real-time clock The <sleep>, <wake>, and <cycle> parameters must be provided, and <hhmm> and <dd> are optional. This command is utilized to set the module to RTC mode prior to shutdown. The message RTC SHUTDOWN COMPLETE is returned and the MODULE_PWR_EN_B signal should be set to inactive by

77(158)
1/198 17-4/FCP 101 3045 Uen
the application. The CM52 wakes as programmed. If during the wake time a WAKE event occurs, the module toggles the Ring Indicator (RI) output signal according to the WAKE mask setting. See the AT*EWAKESET command for a detailed description of this functionality. Time is defined as UTC time. If a WAKE event occurs according to AT*EWAKESET, the module disregards the <wake> period to power down, toggles the RI pin, and remains powered on. At this point it is expected that the application will start communicating with the module. The first action the application should perform is an instruction to disable the RTC mode (AT+CFUN=1). The application can determine the cause for the WAKE event by using AT*EWAKE. If a WAKE event does not occur, the module remains in the RTC mode and powers off at the end of the <wake> period. When the number of cycles has been exhausted, the module performs one of two actions depending upon the AT*EWAKESET bit mask option for the RTC. If the RTC event is enabled as a WAKE event, the module notifies the application of the WAKE event at the end of the <wake> period by toggling the RI pin and remaining powered on. If the RTC event is NOT enabled as a WAKE, event the module stops the RTC mode and powers off at the end of the <wake> period. The optional parameters of <hhmm> and <dd> can be specified to indicate one of two actions depending upon the <sleep> setting: If <sleep> is greater than zero, <hhmm> and <dd> determine when the first wakeup is to occur. Under many conditions the wake/sleep cycle of the module has to coincide with a remote service. The optional parameters assist the module/application to the correct time cycle by specifying when the first wakeup must occur. If <sleep> is equal to zero, <hhmm> and <dd> determine when every wakeup is to occur. The value of <hhmm> must be at least 2 minutes greater than the current time, otherwise an ERROR is returned. The optional parameters require the RTC time to be set to a valid time. It may be necessary for the application to set the time. Refer to AT*ERTCT for an explanation when the RTC is set and manual intervention. Note: If the RTC time/date is not set, and the optional parameters are specified, the command returns an ERROR with no further action. Because the application could initiate a wakeup completely independent of the RTC wakeup, there are several conditions that must be accounted for: The module is off when the application initiates a wakeup by pulling the MODULE_PWR_EN_B pin low. Under this condition the application can look for the Restart message for confirmation that the module is running. The module is currently powered on and the RTC is holding the MODULE_PWR_EN_B pin low, when the application initiates a wakeup. Under this condition the Restart message may have already been sent (dependent upon when the RTC woke the module up); therefore, the application must look for the AT*EUNSOL: RTC WAKETIME for confirmation that the module is running. The application tries to wake up the module after the module initiated the power down sequence, but before the MODULE_PWR_EN_B pin is released. There is an obvious race condition where the module is in a power down sequence and the application is initiating a power up sequence since MODULE_PWR_EN_B is shared between the application and the onboard RTC. The module must complete the shutdown process and release MODULE_PWR_EN_B; however, if MODULE_PWR_EN_B is still low after the module releases it, the module will assume that the application is holding MODULE_PWR_EN_B low. When the module determines that the host application is holding MODULE_PWR_EN_B low, the module restarts. If the RTC hardware is not present in the module, AT+CFUN=10 returns an error.

78(158)
1/198 17-4/FCP 101 3045 Uen
AT+CFUN=1 must be used during an application driven module wakeup when the module is currently executing in accordance to the defined RTC mode of operation. AT+CFUN=1 disables the RTC mode. Not issuing AT+CFUN=1 allows the module to shutdown after the <wake> time expires or when the application allows MODULE_PWR_EN_B to float. There is no harm done to the module, or its execution if AT+CFUN=1 is called anytime the application powers up the module. If the module was not in the RTC mode, the command is a no-op. When the RTC hardware option is present in the CM52, it is highly recommended that the application always issue AT+CFUN=1 any time the application starts a session with the module. Not issuing AT+CFUN=1 could cause the module to never power down completely or may modify the sleep cycles defined in AT+CFUN=10. From an application standpoint, it is much easier to always issue the command. The AT+CFUN command cannot be issued while on a call (voice, data, or SMS transmission using the traffic channel). AT+CFUN=99 causes the module to restart. It is recommended that restarting be used only for testing purposes. Restarting the module from a normal standpoint does not accomplish anything, though it can be useful in tracking bugs. Note: A restart does not display SHUTDOWN COMPLETE, since power should not be pulled. The restart is similar in behavior to a shutdown; the only difference is restart shuts down all tasks except for one which is needed to start the module back up. AT+CFUN=20 provides the capability for the module to hold the host_pwr_en_b pin to remain awake. This capability removes the requirement from the host application to keep the pin held, thus enabling the host application to power down completely. The AT+CFUN=20 command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Real-time clock The command forces the RTC alarm to trigger, which holds host_pwr_en_b pin low. The alarm is not triggered immediately due to the minute resolution of the alarm itself. Therefore an unsolicited message will be returned when it is safe for the host application to release control of the host_pwr_en_b pin. The <duration> field is optional; if not specified the default is 0 or indefinite. AT+CFUN=11 can be issued at any time, and can be issued more than once. It can also be issued when the alarm is already set. The alarm, once triggered, does not reset when the command is issued again. The only way to reset the alarm is by issuing AT+CFUN=1. The module has the capability to set the wakeup reason and assert the ring indicator pin when in this mode. If the host application requests notification of the duration expiring, the module remains powered waiting for instructions from the host application. If the application does not request notification, the module powers down when the duration expires. Parameter <fun> 0 1 10 11 99 <force> 0 (default) Description Functional capability Module is powered off. Full functional capability. This function will disable the RTC mode. Sets sleep/wake cycle based on relative RTC time Enables the module to hold host_pwr_en_b to remain powered on Restarts the module, should only be used for testing purposes. Force power down registration Module uses the power down bit setting defined in EREGC

79(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 1 <sleep> 0 2 43200 <wake> 1 43200 <cycle>
Description Force the module to perform a power down registration regardless of the power down registration bit setting in EREGC. sleep time in minutes sleep time determined by <wake>, <hhmm> and <dd> settings valid sleep range (43200 minutes = 30 days) wake time in minutes valid range (43200 minutes = 30 days) Maximum number of cycles to remain in RTC mode. A cycle is defined as sleep plus wake time; therefore the cycle count will be incremented when the module powers down after the wake period. valid range If <sleep> > 0 Assists in defining an absolute time when the first wakeup should occur. If <sleep> = 0 Assists in defining an absolute time when every wakeup should occur. If <sleep> > 0 The hour when the first wakeup should occur. If <sleep> = 0 The hour when every wakeup should occur. valid range If <sleep> > 0 The minutes after the hour when the first wakeup should occur. If <sleep> = 0 The minutes after the hour when every wakeup should occur. valid range If <sleep> > 0 Assists in defining an absolute time when the first wakeup should occur. Does not need to be specified if the first wakeup occurs within the same day. If <sleep> = 0 Assists in defining an absolute time when every wakeup should occur. Does not need to be specified if wakeup is to occur every day at <hhmm>. Note: <dd> values to use with caution are 29, 30, and 31. This is due to months with only 30 days and for the month of February (leap year or not). valid range Length of time module hold host_pwr_en_b Module holds pin indefinitely valid range (43200 minutes = 30 days) Real Time Clock (RTC) Unsolicited Response; in RTC wake mode
1 43200 <hhmmss>
Hh 0 23 Mm
0 59 <dd>
1 31 <duration> 0 (default) 1 43200 4.9.1.1
The following unsolicited response is sent when the CM52 is powered on and executing under the RTC mode of operation (AT+CFUN=10). The message is an indication that the application missed the Restart command because the module powered on before the application was listening. EUNSOL: RTC,WAKETIME This unsolicited message is displayed approximately every 5.12 seconds during the RTC mode of operation. Rrefer to AT+CFUN=1 to exit the RTC mode of operation. Three seconds is derived from CDMA sleep time, where the module sleeps to conserve power.

80(158)
1/198 17-4/FCP 101 3045 Uen
4.9.1.2
Real Time Clock (RTC) Unsolicited Response; RTC holding host_en_pwr_b
The following unsolicited response is sent when the CM52 has successfully triggered the RTC alarm such that the module is holding the host_pwr_en_b pin. It is at this point that the host application can release host_pwr_en_b. EUNSOL: RTC,AWAKE 4.9.2 AT*ERTCT (Set RTC Time) Syntax AT*ERTCT=<hhmmss>,<yymmdd> AT*ERTCT? Possible responses OK *ERTCT: <hhmmss>,<yymmdd> OK This command sets or queries the Real Time Clock (RTC) time/date. The RTC time must be set for the module sleep/wake sequence to function correctly. Time is defined as UTC time. The module updates the RTC any time CDMA service is found or the module switches from one digital signal to another digital signal. In addition, the module updates the clock every 12 hours if the module remains camped on the same digital service. If digital service is not found, the clock is not be updated by the module. If the RTC has not been set, the RTC can still perform relative time functions, but absolute time is not possible. If the time/date is set by the application keep in mind that when the first time digital service is found, the clock is updated with the CDMA time. The AT*ERTC command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Real-time clock Refer to *EUNSOL: RTC NOTIME for unsolicited notification the time/date has not been set. Note: By always keeping power to the RTC, the likelihood that the time/date not being set is greatly reduced. Parameter <hhmmss> Hh 0 23 mm 0 59 ss 0 59 <yymmdd> Yy 0 99 mm 1 12 dd 1 31 Description Assists in defining an absolute time of the RTC. The hour assignment to the RTC valid range The minutes after the hour assignment to the RTC valid range The seconds after the hour assignment to the RTC valid range Assists in defining an absolute date of the RTC. The year assignment to the RTC valid range The mouth assignment to the RTC valid range The day assignment to the RTC valid range
Description Sets the RTC time Reads the current RTC time

81(158)
1/198 17-4/FCP 101 3045 Uen
4.9.2.1
Real Time Clock (RTC) Unsolicited Response, Date not set
The following unsolicited response is sent during CM52 power up if the RTC time has not been set by either the application via AT*ERTCT command, or automatically when a CDMA system has been acquired: EUNSOL: RTC,NOTIME It is recommended (required when using AT+CFUN=10 optional parameters) that the time/date be set when this unsolicited message is received. 4.9.2.2 Real Time Clock (RTC) Unsolicited Response, RTC Power On
The following unsolicited response is sent during CM52 power up if the RTC required full initialization. The following unsolicited response is sent when the RTC is powered up: EUNSOL: RTC,POWERON 4.9.3 AT*EWAKESET (Set Wakeup Notifications) Possible responses OK *EWAKESET: <bit mask> OK This command sets or queries the WAKE mask setting. The mask settings indicate which actions will toggle the Ring Indicator (RI) output signal to wake up an application. The RI is pin 40. The bit mask is a logical OR of all the events required. When a specified event occurs, the RI is asserted for a definable length of time then it is de-asserted. If multiple events happen during an assert, the time for assert is not extended, nor does a second assert occur. It is assumed that the external processor is awakened by the first assert. Refer to the CM52 PRI document for more information about the duration of the assert. Consider the following information when using this command: When using the Ring Indicator for SMS notification, be sure to configure the CM52 to store the message; otherwise the actual message is not retrievable. Refer to AT+CSRI. The RTC can cause an assertion when the number of cycles has been met; refer to using the RTC in AT+CFUN command for when this condition can occur. Notification of losing or finding service implies that the module first had service, and then the service changed the triggering the event. If after notification of an incoming call the established call is dropped, the module does not reflect the dropped call in the wakeup status. The dropped call should be handled like a dropped call in the case where the application was monitoring the CM52 all along. For notification of Antenna Diagnostic change the module must be configured for periodic testing as definable in AT*EANTLIM. The setting is persistent. As a result, it is saved after a power cycle. Parameter <bit mask> 00000000 Description Assert Events No notification of any of the events.
Description Syntax Sets the functional level AT*EWAKESET=<bit mask> Reads the current functional AT*EWAKESET? level

82(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 00000001 00000002
00000004 00000008 00000010 00000020 00000040 00000080 00000100 00000200
Description Notification when the service has been lost. i.e. Going from either AMPS or Digital service to NO SERVICE. Notification when service is changed. Three conditions apply: Going from no service to service (either Digital or AMPS) Going from Digital to AMPS service Going from AMPS to Digital service Note: Changing SID and remaining on the same service type will NOT trigger the Ring Indicator. Notification of an incoming voice call Notification of an incoming data call Notification of an incoming SMS message Notification of an incoming voice mail indication Notification that the RTC cycle has completed Notification of an Antenna failure (refer to AT*EAFF) Notification of an Antenna Diagnostic State change (refer to AT*EANTLIM) Notification that the duration for holding the module awake has expired
4.9.4
AT*EWAKE (Query Wakeup Event) Syntax AT*EWAKE? Possible responses *EWAKESET: <bit mask> OK
Description Reads the wakeup event
This command queries the origin of the wakeup. All events that took place from the time the module is powered on until the AT*EWAKE command is issued are ORed in the bit mask. The reason(s) for wakeup is cleared when the AT*EWAKE command is issued or when the module is powered off. In addition, if the RI pin is still set asserted at the time of execution of this command the pin is de-asserted. It is recommended that the application poll the module immediately upon starting up to determine the event that triggered the Ring Indicator. Some events are dependent upon external resources (for example, the network) and may terminate if not handled immediately. For example, if an incoming voice call is not handled in a timely manner, the network will reroute the call to voicemail. It is recommended that the host application issue AT*EWAKE immediately before powering down if the intention is to leave the CM52 powered on. This resets the wakeup reason, and no old events are indicated when in fact they did not happen during the time the host application was powered down. This is necessary because the wakeup reason can be set, and the RI pin asserted during normal execution when the host application is powered on. Refer to AT*EWAKESET for a description of the bit mask parameter. Note: Due to the multitasked nature of the software, the Ring Indicator and the unsolicited messages are not tied to the same task; therefore, it is possible that notification of an event from the RI is not matched exactly to the notification of the event through an unsolicited message.

83(158)
1/198 17-4/FCP 101 3045 Uen
4.10
4.10.1
Error Control
AT+CMEE (Report Mobile Equipment Error) Syntax AT+CMEE=<n> AT+CMEE? Possible responses OK +CMEE: <n> OK
Description Sets the Error Control Reads the current setting.
This command disables or enables the extended error codes reported when there is a failure in executing the AT command. When extended error codes are enabled, a reason is produced when an error occurs. The standard result codes of OK and ERROR are still returned to the application for ease of parsing. The reason code can be set by this AT command to terse or verbose. The reason is returned in the format below: CMEE: <err> Example: AT+CMEE=0 OK AT*ERNAM=1,0,1,1234567890 ERROR AT+CMEE=1 OK AT*ERNAM=1,0,1,1234567890 CMEE: 58, 1 ERROR AT+CMEE=2 OK AT*ERNAM=1,0,1,1234567890 CMEE: Cannot write while scanning, parameter 1 ERROR The setting is persistent. As a result, it is saved after a power cycle. Parameter <n> 0 (default) 1 2 Description Disables CMEE: <err> reason code. Enables CMEE: <err> reason code and uses numeric <err> values Enables CMEE: <err> reason code and uses verbose <err> values

84(158)
1/198 17-4/FCP 101 3045 Uen
The list defined here includes the generic error codes that can occur with any AT command. Refer to the specific AT command for error codes that are specific to that command. <err> (numeric) 1 2 3 4 5 6 51 52 53 54 55 56 57 58 59 101 102 151 152 153 154 201 202 203 204 205 206 207 208 251 252 253 254 255 256 257 258 271 272 <err> (verbose) Memory full Memory failure Read failure Write failure Not found No network service Operation not allowed Bad request: wrong mode Password not set Incorrect password Inconsistent parameters Invalid index Referenced item inactive Cannot write while scanning Invalid roaming list Incorrect number of parameters Unsupported command format Specific length required Text string too long Dial string too long Dial string too short Value not in defined list Value outside range(s) Non-digit character entered Referenced item not supported Invalid dial string character Invalid text string character Invalid password Invalid A-Key The following error codes are associated with the Aeris MicroBurst feature Invalid character for MIN string Odd/Even state does not match Primary MIN MIN0 cannot contain wild cards MIN0 cannot be a global MIN MIN0 cannot be entered as NULL MIN0 does not match internal Primary MIN Entry overlaps an existing MIN Invalid reachback character MIN0 not yet programmed MicroBurst is currently active
4.11
Data Capability
The AT commands below allow for the application of various data alternatives. It is unlikely that these commands will be necessary as the module is by default configured to work out-of-the-box on the appropriate carrier.

85(158)
1/198 17-4/FCP 101 3045 Uen
4.11.1
AT+CMUX (Select Multiplex Option) Syntax AT+CMUX=<forward>,<reverse> AT+CMUX? Possible Responses OK +CMUX: <forward>,<reverse> OK
Description Sets the link configuration Displays the current settings
This command is used to set the number of forward and reverse links for data calls and to indicate whether default service is Rate Set 1 or Rate Set 2. The default setting is +CMUX: C,2. Note: CMUX is used only for pre SO-33. SO-33 and 1x data does not use this setting. The two input parameters <forward> and <reverse> must both be even or odd, otherwise an ERROR is returned. An odd multiplex indicates Rate Set 1. An even multiplex indicates Rate Set 2. The number of links available is the integer result of (parameter + 1) / 2. Therefore, issuing AT+CMUX=B,1 produces 6 forward links and 1 reverse link. Parameter <forward> 1-F <reverse> 1-2 Description Forward link MUX option Number of links and rate set (Hex value) Reverse link MUX option Rate set (Hex value)
4.11.2
AT$QCMIP (Mobile IP Capability) Syntax AT$QCMIP=<value> AT$QCMIP? Possible Responses OK $QCMIP: <value> OK
Description Sets the mobile IP capability Reads the mobile IP capability
This command specifies the behavior of the mobile with respect to Mobile IP. This AT command is primarily used to provision and should not be exposed to the end user. This setting is persistent. As a result, it is saved after a power cycle. Parameter <value> 0 (default) 1 Description Mobile IP disabled, Simple IP only. Mobile IP Preferred. In the initial MIP registration, if the network does not support Mobile IP, then the mobile automatically reverts to Simple IP (force a PPP renegotiation by sending a LCP C-Req). However, if a Mobile IP session is registered and then the mobile enters a network that does not support Mobile IP, the mobile drops the session and informs the upper layers of the failure (for example, by dropping DCD to a laptop).

86(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 2
Description Mobile IP only. The mobile makes data calls only when Mobile IP is supported in the network. During a MIP session, if the mobile hands off to a network that does not support MIP, the mobile drops the session and informs the upper layers of the failure (for example, by dropping DCD to a laptop).
Note: When the AT$QCMIP value is changed to 1 or 2, the value of AT$QCMDR is changed to 3. AT$QCMDR=3 means that the mobile tries Service Option 33 when it is in a cdma2000 network that advertises P_REV6 or higher. When AT$QCMIP >0 and an attempt is made to set AT$QMDR to less than 3, the mobile returns ERROR. 4.11.3 AT$QCMDR (Set Medium Data Rate) Syntax AT$QCMDR=<value> AT$QCMDR? Possible Responses OK $QCMDR: <value> OK This command sets the medium data rate settings. Parameter <value> 0 Description MDR service only. The mobile originates with SO 22 or SO 25. The mobile does not negotiate to any other service option if SO 22 and SO 25 are not available MDR service, if available. The mobile originates with SO 22 or SO 25, but negotiates to a low-speed packet service option if MDR is not available. The mobile does not negotiate to SO 33. LSPD only. The mobile originates a LSPD call only. The mobile does not negotiate to SO 22, SO 25 or SO 33. SO 33 if available. The mobile negotiates to MDR or low speed packet service option if SO 33 is not available
Description Sets the Medium data rate settings Displays the current settings
2 3
4.12
SMS Handling
This chapter defines all the AT commands used for SMS feature. Note: The CM52 does NOT store messages; the only message stored is the message currently being sent. Once the message is sent it is removed from memory of the module. 4.12.1 AT+CSSM (Send Short Message) Syntax AT+CSSM=<da>,<message>[,[<msg_ref>][,[ <type>][,[<udheader>][,[<smheader>][,[<callba ck>][,[<valPer>][,[<defDel>][,[<alert>][,[<lang>] ]]]]]]]]] Possible responses +CSSM: <msg_ref> OK
Description Sends a Short Message
This command originates an SMS submit message to the message center. If non-standard SMS email addressing is active and the message destination is in fact an email address, the

87(158)
1/198 17-4/FCP 101 3045 Uen
message data must be 7-bit coding; otherwise an error is returned. If non-standard SMS email addressing is active the size of the message data must be such that the complete email address can be added into the actual message without exceeding the message data size limit. According to network standards for SMS messaging, an empty message is not valid; therefore, message data should always be present when sending an MO (Mobile Originated) message. If no message data is present, the only indication of failure is from the network status, which is visible when unsolicited message notification for submitting SMS messages is turned on. See below. When an SMS submit message is successfully sent and queued for sending, a successful response (OK) is issued. The send status can be tracked as described in the next paragraph. SMS status can be received only if SMS SUBMIT unsolicited messages are enabled. To enable SMS status reports, set the report filter to include the 0200 mask using the AT*EUNSOL command. The reports are sent in the unsolicited response message *EUNSOL. All carriers limit the size of the payload for SMS messages. The exact size differs per carrier. Refer to the CM52 PRI for size details on a per-carrier basis. The SMS payload is limited, therefore AT+CSSM returns an ERROR if the allowable size has been exceeded. Note: Command options that are added to the command can affect the size of the message. The same is true for email addresses. Therefore, if the message body is within the defined size limit, but due to the options included with the command the total size is exceeded, the command fails. Parameter <da> IRA characters Description Destination address. Refer to <type> for the format of the string. The address shall be comprised of printable IRA characters enclosed between quotes (IRA 2/2). If the encoding field of <type> is 1 and the Number plan is not 1101, all characters except the following shall be ignored: 0 to 9,*, #. If the Number plan field of <type> is 1101, all characters except 0 to 9 and the period shall be ignored. If <udheader> is set to 10 (octets) the <message> shall be a string of hex-coded octets. The string shall not be enclosed between quotes (IRA 2/2). Otherwise the <message> shall be a string of printable IRA characters enclosed between quotes (IRA 2/2). Send the short message using a new message reference. Send the short message using the indicated message reference. <type> = exxxyyyy (hex coded value is encoded as described below, then entered as a decimal value. The default is 129 or 10000001) Encoding Use 8-bit codes using a specified number plan. Set Digit mode=1 over the air. TBCD (Telephone Binary-Coded Decimal). Set Digit mode=0 over the air. Number type Unknown number type International number if present, and Digit mode=1 and number mode=0. Internet protocol (RFC 791) if present, and Digit mode= 1 and number mode=1. See IS-637 specification for detailed description. National number. Network-specific number. Subscriber number.
<message> hex-coded octet IRA characters <msg_ref> null 0 to 65535 <type> e 0 1 (default) xxx 000 (default) 001
010 011 100

88(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 110 111 yyyy 0000 0001 (default) 0011 0100 1001 1101 1110 1111 Integer <udheader> 8 (default) 10 18 <smheader> ppp 000 (default) 001 010 011 uu 00 01 (default) 10 11 d 0 (default) 1 <CallBack> Null (default) mmttppxx[yy]
<valPer> Null (default)
Description Abbreviated number. Reserved for extension. Plan ID Unknown. Telephony or ISDN (ITU-T E.163 and E.164). Data (ITU-T X.121). Telex (ITU-T F.69). Private. Binary Internet address. Alphanumeric Internet address. Reserved for extension. Send the indicated destination address header. Hex-coded octet 7-bit IRA coding with MSB of each character octet set to 0. Hex-coded characters. 7-bit ASCII (ANSI X3.4) with MSB of each character set to 0. hex-coded octet in the format of: pppuud00 Privacy Indicator Unrestricted Restricted Confidential Secret Urgency Indicator Interactive Normal Urgent Emergency Delivery-Ack Request No delivery acknowledgment requested Delivery acknowledgment requested Call back number No callback number specified Provide a Call back number. Where data is represented as hex-coded: mm identifies the digit mode 0 indicates the call back number is defined as 4-bit TBCD digits. 1 indicates the call back number is defined as ASCII characters. tt identifies the number type If the digit mode = 0 then the field is ignored. Otherwise the number type is interpreted like the xxx part of the type parameter described above. pp identifies the number plan If the digit mode = 0 then the field is ignored. Otherwise the number plan is interpreted like the yyyy part of the type parameter described above. xx identifies the length of the call back number. [yy] identifies the call back number. Example: The MIN is 919.472.7000 o If mm set to 00 then the string would be 0000000A090109040702070A0A0A o If mm set to 01 then the string would be 0100010A39313934373237303030 Validity Period, inform the network the timeframe the message is valid. No validity period specified

89(158)
1/198 17-4/FCP 101 3045 Uen
Parameter yymmddhhmmss
<defDel> Null (default) yymmddhhmmss
<alert> Null (default) 0 1 <lang> Null (default) 0 1 2 3 4 5 6 7
Description The time period is defined as absolute time. The syntax is two decimal digits each for the year, month, day, hour, minutes, and seconds. The absolute time is Universal Coordinated Time (UTC). Deferred Delivery, inform the network when to deliver the message to recipient No deferred delivery time specified The time period is defined as absolute time. The syntax is two decimal digits each for the year, month, day, hour, minutes, and seconds. The absolute time is Universal Coordinated Time (UTC). Provide an Alert indication to the receiver No Alert provided No Alert Alert Language setting No language setting provided Unspecified English French Spanish Japanese Korean Chinese Hebrew
4.12.1.1 *ESMSACK (Alert on Delivery) This unsolicited message indicates that the noted SMS message has been delivered to the destination. This unsolicited message is returned when the Delivery-Ack Request field within the SMS header is set. Description Alert on Delivery Unsolicited Response Syntax *ESMSACK: <msg_ref>
Parameter <msg_ref> 0 to 65535 4.12.2
Description Identifier of the message Reference number of the sent message. AT*ESMSFULL (SMS Storage Space Full) Syntax AT*ESMSFULL=<setting> AT*ESMSFULL? Possible responses OK *ESMSFULL: <setting> OK
Description Sets availability Reads current availability
This command enables the application to indicate to the module that there is not sufficient storage for any MT messages. The module informs the basestation that there is no available storage and that the message should be resent at a later time. The basestation has an algorithm that is used to determine when to resend the message. The module cannot influence this algorithm. The setting is not persistent. As a result, it is NOT saved after a power cycle.

90(158)
1/198 17-4/FCP 101 3045 Uen
Parameter <setting> 0 (default) 1
Description availability Space available for SMS messages (the module will notify the application of an MT messages via +CSTD or +CSTI if enabled. See AT+CSRI). No space is available for MT messages; the module will indicate to the base station to resend the message at a later time.
4.12.3
AT+CSLM (List Messages) Syntax AT+CSLM=<in> Possible responses OK
Description Lists short messages
The command initiates reporting of the stored incoming short messages in the MS. The command returns OK immediately and the module lists the messages as unsolicited messages, thereby making the AT command handler available for continued operations since the list command has the potential to take some time processing all the available messages. Refer to +CSLM: EOL for indication that the last entry in the list has been reported. Parameter <in> 2 Description Messages in the in-box (MS) List all the received messages
4.12.3.1
Unsolicited Message +CSLM Unsolicited Response Syntax +CSLM: <msg_ref>,<udheader>,<CR><LF><message>,<CR><LF><smheader>,<time stamp>,<userOrig>,[<callback>],[<valPer>],[<alert>],[<lang>] +CSLM: EOL
Description Message with data
End of List
The unsolicited message is used to report the incoming SMS messages stored in the MS. One unsolicited message is reported for each SMS message. After the message is read/listed it is automatically removed from CM52 storage. The CM52 can store up to 10 MT SMS messages before the CM52 informs the base station that there is no storage space left. When there are no SMS messages left to report EOL is returned to the application. Refer to +CSTD for a description of the parameters. 4.12.4 AT+CSDM (Delete Message) Syntax AT+CSDM=<index> Possible responses OK
Description Delete message
This command deletes a message that has not been read. Typically, messages are deleted after they are read. If a message with the indicated message index is not present the OK response is returned. 4.12.5 AT+CSRI (Receive Message Indications)

91(158)
1/198 17-4/FCP 101 3045 Uen
Description Sets the delivery of unsolicited SMS result codes Reads the current setting
Syntax AT+CSRI=<delivery> [,<store>] AT+CSRI?
Possible responses OK +CSRI: <delivery>,<store> OK
This command controls delivery of unsolicited SMS result codes and associated storage of mobile-terminated short messages.
Note: Even if the storage of SMS messages is turned off (i.e., <store> = 1), at least one open buffer space is required to receive messages. If the message buffer is full (10 messages already stored), no more SMS messages can be received by the CM52. The module will inform the basestation that there is no available storage and that the message should be resent at a later time. If configured to receive unsolicited messages, the buffer full indication will be provided to the application (see section 4.2.11.17). The settings are not persistent. As a result, they are NOT saved after a power cycle. Parameter <delivery> 0 2 (Default) <store> 0 1 (default) Description Disable unsolicited result codes +CSTI and +CSTD. Deliver unsolicited result codes +CSTI and +CSTD. Use +CSTI result code and store incoming message. Use +CSTD result code and do not store the incoming short message within CM52.
4.12.5.1
Unsolicited Message +CSTD (Message Notification With Data) Unsolicited Response Syntax +CSTD: <msg_ref>,<udheader>,<CR><LF><message>,<CR><LF><smheader>,<time stamp><userOrig>,[<callback>],[<valPer>],[<alert>],[<lang>]
Description Message with data
If enabled with the AT+CSRI command, this unsolicited result message reports receipt of an SMS message from the message center. It reports the message reference, content, and other parameters. Note: The commas for the optional parameters are always returned in the unsolicited message. Parameter <msg_ref> 0 to 65535 <udheader> 8 10 18 <message> Description A message reference number, can be used to generate a user acknowledgment message Hex-coded octet 7-bit IRA coding with MSB of each character octet set to 0. Hex-coded characters. 7-bit ASCII (ANSI X3.4) with MSB of each character set to 0.

92(158)
1/198 17-4/FCP 101 3045 Uen
Parameter hex-coded octet IRA characters <smheader> ppp 000 001 010 011 uu 00 01 10 11 d 0 1 <timestamp> yymmddhhiiss
Description If udheader is set to octets (or the value of 10) the <message> shall be a string of hex-coded octets. The string shall not be enclosed between quotes (IRA 2/2). Otherwise the <message> shall be a string of printable IRA characters enclosed between quotes (IRA 2/2). hex-coded octet in the format of: pppuud00 Privacy Indicator Unrestricted Restricted Confidential Secret Urgency Indicator Interactive Normal Urgent Emergency Delivery-Ack Request No delivery acknowledgment requested Delivery acknowledgment requested Message Center Time stamp Where: Yy identifies the year (last two characters) Mm identifies the month Dd identifies the day Hh identifies the hour Ii identifies the minutes Ss identifies the seconds The origination address; the address shall be comprised of printable IRA characters. Call back number Provide a Call-back number, where: mm identifies the digit mode 0 indicates the call back number is defined as 4-bit TBCD digits. 1 indicates the call back number is defined as ASCII characters. tt identifies the number type If the digit mode = 0 then the field is ignored. Otherwise the number type is the xxx part of the type parameter as described in AT+CSSM. pp identifies the number plan If the digit mode = 0 then the field is ignored. Otherwise the number plan is the yyyy part of the type parameter as described in AT+CSSM. xx identifies the length of the call back number. [yy] identifies the call back number Validity Period, inform the network the timeframe the message is valid. The time period is defined as absolute time. The syntax is year, month, day, hour, minutes, and seconds. The absolute time is Universal Coordinated Time (UTC). Received an Alert indication from the sender No Alert Alert Language setting Unspecified English French Spanish
<userOrig> IRA characters <CallBack> mmttppxx[yy]
<valPer> Yymmddhhmmss <alert> 0 1 <lang> 0 1 2 3

93(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 4 5 6 7
Description Japanese Korean Chinese Hebrew
4.12.5.2
Unsolicited Message +CSTI (Message Notification) Unsolicited Response syntax +CSTI: <index>
Description Message received
If enabled with the AT+CSRI command, this unsolicited result reports the receipt of a message from the message center. It reports only the index of the message. 4.12.6 AT+CSRM (Read Message) Syntax AT+CSRM=<msg_ref> Possible responses +CSRM: <msg_ref>, <udheader>,<CR><LF> <message>,<CR><LF>><smheader>,<timestam p>,<userOrig>,[<callback>],[<valPer>],[<alert>],[ <lang>]
Description Reads the Message
Read the SMS message. After the message is read it is automatically removed. Refer to +CSTD for a description of the parameters. 4.12.7 AT*ESMSFLTR (SMS Filter) Syntax AT*ESMSFLTR=<bit mask> AT*ESMSFLTR? Possible responses OK *ESMSFLTR: <bit mask> OK This command sets or queries the SMS filter mask. The mask settings are utilized to determine which SMS messages is discarded by the CM52 and which is passed to the application. For CM52 variants with the RTC option, if an SMS is to be discarded during RTC sleep mode operation the RI is not triggered. If an SMS is to be discarded during normal powered-on operation, the CM52 does not alert the application with unsolicited messages (+CSTD or +CSTI). The bit mask is a logical OR of SMS types to filter. Messages are filtered before being stored. If the buffer space of the CM52 is full, incoming messages that are to be filtered are in fact filtered and not returned to the network to be sent again later. The setting is persistent. As a result, it is saved after a power cycle. Parameter <bit mask> 00000000 (default) Description Filter No SMS messages, binary or text, will be filtered.
Description Sets the SMS filter configuration Reads the SMS filter configuration setting

94(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 00000001 00000002
Description Filter text SMS messages and do not pass them to the application or store them to the SMS buffer. Filter binary SMS messages and do not pass them to the application or store them to the SMS buffer.
4.13
Location Determination
This chapter specifies the AT commands that are available for location determination. These commands are currently provided in the AT command manual for customer design assistance, but are not currently enabled in the module. Please contact Sony Ericsson technical support if you wish to use this functionality. Refer to the User scenarios for several location determination examples and typical call flows. Note: The features that are required for the application to initiate a Location Determination call flow are present in the CM52 command interface. The call flow initiation request, however, is currently rejected by the Carrier. No Carrier has implemented MS initiated call flows. If, and when, the Carriers do implement MS initiated call flows the module is already positioned to handle MS initiated call flows. 4.13.1 AT*EPDMOD (Position Determination Mode) Syntax AT*EPDMOD=<mode> AT*EPDMOD? Possible responses OK *EPDMOD: <mode> OK This command enables the application to set what type of location determination privacy is supported. The setting is persistent. As a result, it is saved after a power cycle. Parameter <mode> 0 (default) 1 Description mode capability Only emergency call (E911) triggers a position determination procedure. This is also referred to as Privacy Flag on. Position determination capabilities available to any feature (Emergency as well as non emergency calls). This is referred to as Privacy Flag off.
Description Sets the functional level Reads the current functional level
4.13.2
AT*EPDCF (Location Determination Call Flow) Syntax AT*EPDCF=<type> AT*EPDCF? Possible Responses OK *EPDCF: <type> OK
Description Sets the call flow type Reads the call flow type
The application can use this AT command to set which technique the module and network use to provide the fix location to the public service system. The setting is persistent. As a result, it is saved after a power cycle.

95(158)
1/198 17-4/FCP 101 3045 Uen
Parameter
<type> 0 1
Description Specify the Location determination call flow Disable location determination Network calculates the fix by the input provided by the module
4.13.3
AT*EPDRL (Request Location) Syntax AT*EPDRL=<request> AT*EPDRL? Possible Responses OK *EPDRL: <request> OK
Description Sets the Location capabilities Reads the current Location capabilities
This AT command is used to inform the CM52 that the application would like the position calculation from the network. The module responds with the unsolicited message of *EPDLR when the fix is available from the network. It may seem obvious that the position would be known by the onboard GPS; however if the GPS is not available, the Base Station generates a position based on the pilot code phase measurements, or cell sector fallback. Carrier testing may also require the value calculated by the network to be reported. The setting is persistent. As a result, it is saved after a power cycle. Parameter
<request> 0 (Default) 1
Description Specify the Location determination session status Do not return the calculated location Return the calculated location
4.13.3.1 *EPDLR (Location Response) This unsolicited message returns the Location Response from the base station. This can be issued as the result of the application requesting location data (AT*EPDRL) or the PDE simply sending this data after the position is calculated. Description Location Response Unsolicited Response Syntax *EPDLR: <TIME_REF_CDMA>,<LAT>,<LONG>,<LOC_UNCRTNTY_ANG>,<LOC_UNCRTN TY_A>,<LOC_UNCRTNTY_P>,<FIX_TYPE>,<VELOCITY_INCL>,<VELOCITY_HO R>,<HEADING>,<VELOCITY_VER>,<CLOCK_INCL>,<CLOCK_BIAS>,<CLOCK_D RIFT>,<HEIGHT_INCL>,<HEIGHT>,< LOC_UNCRTNTY_V>
Parameter <TIME_REF_CDMA> 0 16383 <LAT>
Description CDMA system time at the time the solution is valid The BS shall set this field to [t/50] mod 16384, where t is the CDMA system time in frames, as defined in IS95-B Latitude

96(158)
1/198 17-4/FCP 101 3045 Uen
Parameter -90 to 90
<LONG> -180 to 180
Description This field is set to the twos complement value of the latitude, in units of 180/(2^25) degrees, referenced to the WGS-84 reference ellipsoid, counting positive angles north of the equator and negative angles south of the equator. Longitude This field is set to the twos complement value of the longitude, referenced to the WGS-84 reference ellipsoid, counting positive angles east of the Greenwich meridian and negative angles west of the Greenwich meridian. Angle of axis with respect to True North for position uncertainty The mobile station shall set this field to the angle of the axis for position uncertainty, in units of 5.625 degrees, where 0 degrees is true north and the angle increase toward the east. Standard deviation of axis along angle specified for position uncertainty (in meters) 0.5 0.75 1 1.5 2 3 4 6 8 12 16 24 32 48 64 96 128 192 256 384 512 768 1024 1536 2048 3072 4096 6144 8192 12288 >12288 Not computable Standard deviation of axis perpendicular to tangle specified for position uncertainty (in meters) Defined in LOC_UNCRTNTY_A
<LOC_UNCRTNTY_ANG> 0 to 84.375
<LOC_UNCRTNTY_A> 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 <LOC_UNCRTNTY_P> 0 31

97(158)
1/198 17-4/FCP 101 3045 Uen
Parameter <FIX_TYPE> 0 1 <VELOCITY_INCL> 0 1 <VELOCITY_HOR> 0 to 127.75 <HEADING> 0 to 360 <VELOCITY_VERT> -64 to 63.5 <CLOCK_INCL> 0 1 <CLOCK_BIAS> -13000 to 249.143 <CLOCK_DRIFT> -32768 to 32767 <HEGHT_INCL> 0 1 <HEIGHT> -500 to 15833 <LOC_UNCRTNTY_V> 0-31
Description Fix type 2D fix 3D fix Velocity Information Included Velocity information should be ignored Velocity information is included Horizontal Velocity Magnitude, present only if VELOCITY_INCL is set to 1. This field is set to horizontal velocity, in units of 0.25 m/s. Heading, present only if VELOCITY_INCL is set to 1. This field shall be set to Heading, in units of 360/210 degrees Vertical velocity, present only if VELOCITY_INCL is set & FIX_TYPE is set to 1 Field is set to the twos complement value of Vertical Velocity, in units of 0.5 m/s. Clock Information Included Clock information should be ignored Clock information is included Clock Bias, present only if CLOCK_INCL is set to 1 Field is set in units of 1ns. This parameter is computed as true GPS time minus mobile station time. Clock Drift, present only if CLOCK_INCL is set to 1 Field is set to the twos complement value of the rate of change of clock bias in units of ppb (ns/s). Height Information Included Height information should be ignored Height information is included Height, present only if HEIGHT_INCL is set to 1 Field is set above the WGS-84 reference ellipsoid, in units of 1 meter. Standard deviation of vertical error for position uncertainty, present only if HEIGHT_INCL is set to 1 Defined in LOC_UNCRTNTY_A
4.13.3.2 *EPDTR (Time Response) This unsolicited message returns a time stamp of the PR measurements being set to the network. This time stamp can be used to correlate at the time at which the PR data was acquired so that the associated GPS determined LAT/LONG can be found. The associated LAT/LONG can be compared to the network determined LAT/LONG for distance error measurements. Description Time Response Unsolicited Response Syntax *EPDTR: <TIME_REF>

98(158)
1/198 17-4/FCP 101 3045 Uen
Parameter < TIME_REF > 0 16777215 4.13.4
Description The time of validity of the parameters reported in this Response element t mod 14,400,000 where t is the time of validity in 1ms
AT*EPDPR (Provide Pseudorange Measurement) Syntax AT*EPDPR=<PART_NUM>,<TOTAL_PARTS>,<NUM _PS_RANGES_P>,<TIME_REF>,<TIME_REF_SRC>, <OFFSET_INCL>,<SV_PRN_NUM>,<SV_CNO>,<PS _DOPPLER>,<SV_CODE_PH_WH>,<SV_CODE_PH _FR>,<MUL_PATH_IND>,<PS_RANGE_RMS_ER> Possible Responses OK
Description Provides Pseudorange data
This AT command is the response back to the module from a request action to the application. *EPDPR is the unsolicited message. The external GPS application uses this AT command when it is ready to provide pseudorange measurement data to the CM52. After CM52 receives this command, it creates the IS-801 message Provide Pseudorange Measurement and sends it to the base station. Since there can be multiple iterations of pseudorange data, this command must be issued once for each set of data with a maximum of 8 times. Since the pseudorange data is from an external GPS, the GPS time reference is the only valid time option (TIME_REF). As a result, CDMA pilot offset information (OFFSET_INCL) does not make sense; therefore, this parameter must be set to zero. Note: The solution currently allows for only 8 satellites. If there are more than 8 satellites available, the application should determine which of the set to send. The application must issue AT*EPDPR the exact number of times as denoted in PART_NUM. If any of the AT*EPDPR commands return an ERROR, the CM52 does not report those satellites to the network. DO NOT attempt to send the failing AT commands and associated satellite data again. The only reason for an ERROR from AT*EPDPR would be due to range checking; therefore, ensure that the satellite data is valid before sending it to the CM52 to prevent the satellite from being dropped. If the command is executed and a request for data has not be issued by the module, the command is ignored. In addition, if the location determination service is being handled by the onboard GPS option, any data provided by this command is ignored. Parameter <PART_NUM> 1 to 8 <TOTAL_PARTS> 1 to 8 <NUM_PS_RANGES_P> 1 < TIME_REF > 0 16777215 <TIME_REF_SRC> 0 1 2 <OFFSET_INCL> 0 Description The current instance of pseudorange data parts Value must be in the range of 1 to TOTAL_PARTS Total number of pseudorange data parts Set to the value .. Number of pseudoranges in this AT command Range of number of satellites imbedded in current AT command The time of validity of the parameters reported in this Response element t mod 14,400,000 where t is the time of validity in 1ms Time reference source UTC time reference GPS time reference Other time reference Indication of whether or not offset data should be included Do NOT include REF_PN & MOB_SYS_T_OFFSET

99(158)
1/198 17-4/FCP 101 3045 Uen
Parameter 1 <SV_PRN_NUM> 1 to 37
<SV_CNO> 1 to 63 <PS_DOPPLER> -32768 to 32767 <SV_CODE_PH_WH> 0 to 1022 <SV_CODE_PH_FR> 0 to 1023 <MUL_PATH_IND> 0 1 2 3 <PS_RANGE_RMS_ER> 0x00 to 0x3F
Description Include REF_PN & MOB_SYS_T_OFFSET Satellite PRN number Fied is set to the value of the PRN signal number for which the measured data is valid, where the binary value of the field conveys the satellite PRN number minus one. Satellite C/N0 Field is set to the value of the satellite C/N0, as referenced to the antenna connector, in unit of 1dB-Hz. Measured frequency of satellite signal relative to local oscillator of the mobile Field is set to the measured satellite pseudodoppler, in units of 0.2 Hz in the range of -6553.6 to 6553.4 Satellite code phase whole chip Field is set to the satellite code phase measured as a number of GPS chips, in units of 1 GPS chips Satellite code phase fractional chip Field is set to the residual satellite code phase, in units of the integer representation of 1/(2^10) of GPS chips. Multipath indicator Not specified Error <= 5m 5m < Error <= 43m Error > 43m Pseudorange RMS error A floating point representation is used where the 3 most significant bits constitute the exponent and the 3 least significant bits constitute the mantissa as specified in the following table: Exponent x mantissa y pseudorange value 000 000 0.5 000 001 0.5625 X Y 0.5(1 + Y/8)(2^X) 111 110 112 111 111 not applicable
4.13.4.1 *EPDPR (Request Pseudorange Measurement) This unsolicited message is sent from the CM52 to the external GPS application when it receives an IS-801 message Request Pseudorange Measurement from the base station. Upon receiving this unsolicited message, the external GPS processor should provide the Pseudorange measurement data (AT*EPDPR). Description Request measurement Unsolicited Response Syntax *EPDPR: <PREF_RESP_QUAL>
Parameter <PREF_RESP_QUAL>
Description Time before response element should be sent

Document number
100(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Parameter 0 1 2 3 4 5 6 7
Description 2 seconds 4 seconds 8 seconds 16 seconds 32 seconds 64 seconds 128 seconds 256 seconds
4.13.5
AT*EPDREJ (Reject A Request) Syntax AT*EPDREJ=<REJ_REQ_ TYPE> Possible responses OK
Description Rejects the request
When the external GPS application cannot provide the function or information required by the Request from the base station, the external GPS application can send this AT command to the CM52. The CM52 creates an IS-801 Reject response and sends it to the base station. If the command is executed when a request for data has not be issued by the module, the command is ignored. In addition, if the location determination service is being handled by the onboard GPS option, any data provided by this command is ignored. Parameter
<REJ_REQ_TYPE> 0
Description Set to the Request Element type rejected Request Pseudorange Measurement
4.14
4.14.1
Antenna Capabilities
AT*EASW (Antenna Switch) Syntax AT*EASW=<mode> AT*EASW? Possible Responses OK *EASW: <mode> OK
Description Selects the CDMA antenna Displays the current antenna selection
This command sets the RF1 or RF2 antenna in the CM52 Module. AT*EASW will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Backup antenna The setting is persistent. As a result, it is saved after a power cycle. Parameter <mode> 1 (default) Description RF1 antenna

Document number
101(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Parameter 2
Description RF2 antenna
4.14.2
AT*EAFF (Antenna Fail Flag) Syntax AT*EAFF=0,<antenna> Possible Responses *EAFF: <state> OK *EAFF: <delay> OK
Description Reads the antenna fail flag
Clears the antenna fail flag
AT*EAFF=1,<antenna>
This command clears the antenna fail flag for the selected antenna (see AT*EASW in chapter 4.14.1). The command has two modes: Read (<mode>=0) mode returns the current state of the selected antenna fail flag. Write (<mode>=1) mode clears the antenna fail flag for the selected antenna and returns a 0 for successful clearing or the number of seconds remaining until clearing of the flag is permitted. This command can be utilized in response to a reception of the unsolicited message EUNSOL: FAILURE, ANTENNA. This message is NOT under the control of the AT*EUNSOL settable mask. Example: *EUNSOL: FAILURE, ANTENNA 1 The above message indicates to the application that an antenna failure has been detected during power level 0 or 1 ( > 0.6 W ) AMPS transmission, and that power will be restricted to power level 2 ( <= 0.6 W ) on the failed antenna until the flag is cleared by this command or by cycling power. When the antenna fail flag is cleared, CM52 attempts to transmit at the base station requested power level. AT*EAFF returns an ERROR if the selected antenna does not exist. AT*EAFF will also return ERROR if the features required for this function are not enabled. Features required for this command: o 3W (AMPS Class I) operation o Backup antenna Parameter <mode> 0 1 <antenna> 1 2 ? <state> 0 1 <delay> 0 1-65535 Description Read Write Antenna RF1 Antenna RF2 Displayed when there is an invalid antenna selection condition. State of antenna fail flag for selected antenna Fail flag is not set. No failure has occurred. Fail flag is set. Failure has occurred. The time remaining (in seconds) until clearing of the antenna fail flag is permitted. Clearing of the antenna fail flag was successful. Clearing of the antenna fail flag failed. The value of <delay> indicates number of seconds until a clearing is permitted.

Document number
102(158)
Revision
1/198 17-4/FCP 101 3045 Uen
4.14.2.1
Antenna failure unsolicited response
This unsolicited response is sent when there is a failure in any of the antennas. The unsolicited response is always on and cannot be turned off with the AT*EUNSOL command. Format: *EUNSOL: FAILURE,ANTENNA <failure_status>
Parameter <failure_status> 1 2
Description: Antenna 1 failed Antenna 2 failed
4.14.3
AT*EANTDIAG (Antenna Diagnostic command) Syntax AT*EANTDIAG=0 Possible Responses *EANTDIAG: <statusP>[,<statusS>] OK *EANTDIAG: <valueP>[,< alues>] OK
Description Reads antenna status
Reads antenna value
AT*EANTDIAG=1
This command polls for the antenna status of both antennas, if available. If the module is configured for only one antenna then the second parameter is not returned. The first value returned is always the current antenna and the second value is the other antenna (see AT*EASW for antenna switching details). The return <value> is the actual ADC reading of the antenna diagnostic voltage divider network. Based on the ADC reading, the current antenna <status> can be returned as GOOD, OPEN, or SHORTED. The <status> that is returned is determined by the limits that are set by the AT*EANTLIM command. Notes: A centered ADC return value of 127 indicates a properly connected antenna with a resistance to ground of 10K ohm. Resistance changes of 5% or less per ADC LSB are maintained for the antenna resistance range of 1K ohm to 20K ohm. An unsolicited message is returned on any status change for only the current selected antenna. Parameter <statusP> <statusS> 0 1 2 <valueP> <values> 0-255 Description Status of the primary and secondary Antennas GOOD antenna OPEN antenna SHORTED antenna Current value of the diagnostic voltage divider network Actual ADC reading of the antenna diagnostic voltage divider network
4.14.4
AT*EANTLIM (Antenna Limits command)

Document number
103(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Reads the antenna test limits Sets the antenna test limits Reads the periodic test interval Sets the periodic test interval
Syntax AT*EANTLIM=0,<ant>
Possible Responses *EANTLIM: <open>,<short> OK *EANTLIM: OK *EANTLIM: <interval> OK *EANTLIM: OK
AT*EANTLIM=1,<ant>, <open>,<short> AT*EANTLIM=2
AT*EANTLIM=3,<interval>
This command can read and set the following antenna diagnostic test parameters: OPEN limit SHORTED limit Periodic test interval time These parameters are NV items and are maintained across power cycles. The parameter limits set the GOOD window for antenna diagnostic testing. These limits are values representing ADC voltage readings. Based on the ADC reading from the antenna diagnostic voltage divider network, the current antenna status (GOOD, OPEN, or SHORTED) can be derived from comparison to the these limits. Notes: The current antenna status can be returned via the AT*EANTDIAG command. A centered ADC value of 127 indicates a properly connected antenna with a resistance to ground of 10K ohm. Resistance changes of 5% or less per ADC LSB are maintained for the antenna resistance range of 1K ohm to 20K ohm. An unsolicited message is returned on any status change for only the current selected antenna (see AT*EASW command for antenna switching details). The antenna status check occurs every <interval> seconds. The resistance to ground of the Developer Kit antenna is OPEN, and many communication analyzers have an input resistance to ground of 50 ohms. Therefore, the default values have been selected to effectively disable antenna diagnostic testing. Parameter <ant> 1 2 <open> <short> <interval> 0 2 60 Description Antenna 1 Antenna 2 ADC limit for OPEN status ( > nominal antenna ADC reading ), range 0-255, default value = 255 ADC limit for SHORTED status ( < nominal antenna ADC reading), range 0-255, default value = 0 default value = 0 Disables periodic antenna diagnostic testing Periodic antenna diagnostic test interval ( in seconds )
4.14.4.1
Unsolicited Message Antenna Diagnostic Status Change

Document number
104(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Antenna status change
Unsolicited Response syntax *EUNSOL: ANTENNA,<status>
The unsolicited message is reported to the application in the event the antenna diagnostic feature triggered due to a change to antenna status. Parameter <status> GOOD OPEN SHORTED Description Change to good status Change to open status Change to shorted status
This unsolicited response is always displayed by the CM52 when a change of status occurs for interval values other than 0. There message cannot be suppressed by using the AT*EUNSOL setting.
4.15
Protocol Testing
The AT commands in this section are related to protocol testing. These commands were requested by the network carriers for testing purposes of the module on the respective networks. These commands are typically NOT included in any application (unless requested by the carrier). It is strongly advised that none of these commands be used in an end user application. 4.15.1 AT*EPREV (Protocol Version) Syntax AT*EPREV=<mode> AT*EPREV? Possible Responses *EPREV: <mode> OK This command is used on the CM52 to set the CDMA protocol version capabilities. The command does NOT return the protocol version negotiated between the mobile and the network, refer to AT*ECPREV. CM52 restarts automatically after the command is processed; an OK result message is not returned. The setting is persistent across power cycles. Parameter <mode> 0 (default) 3 5 Description IS2000 (includes compatibility with IS-95A and IS-95B) IS95A IS95B (includes compatibility with IS-95A)
Description Set the CDMA protocol version Read the current protocol version
4.15.2
AT*EMRUCLR (Clear the current NAM MRU) Syntax AT*EMRUCLR Possible Responses OK
Description Clears the current NAM MRU
This command is used on the CM52 to clear the most recently used (MRU) list for the current NAM. It takes no parameters. To use this command, the module must first be suspended using AT*ESCAN; after the command has been issued the module must be instructed to resume scanning by using AT*ESCAN.

Document number
105(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Clearing the MRU should be performed only to achieve specific goals during testing. Clearing the MRU should never be performed during normal execution of the CM52 and host application. 4.15.3 AT*ESNAP (Display Channel Parameter Snapshot) Syntax AT*ESNAP? Example Responses See below OK This command displays the pertinent parameters as a snapshot in time. The values can vary depending upon actions occurring in the module; influences are if the module state is Idle, scanning, no service, or on an active call. It is highly recommended this command not be used as part of an application. This command provides information that may be necessary for network testing, not general module execution. This command can provide unexpected information. Examples:
Digital Control Channel (this would include background scans): *ESNAP: DCC CHN=<band>.<channel>,PNO=<pn>,PAG=<page>,VER=<ver> Digital Traffic Channel: *ESNAP: DTC CHN=<band>.<channel>,PNO=<pn>,COD=<code>,1SO=<p_so>, 2SO=<s_so>,PWR=<power>,VOP=<priv> Analog Control Channel (this would include background scans): *ESNAP: ACC CHN=<band>.<channel>,SCM=<scm> Analog Voice Channel: *ESNAP: AVC CHN=<band>.<channel>,PWR=<power>,SAT=<sat> No Service: *ESNAP: NO SERVICE
Description Displays the channel parameters
Parameter <band> 800 1900 <channel> 1-1023 1-1199 <code> 0 1 2-7 8-31 32 33-63
Description 800 MHz band 1900 MHz band System channel numbers 800 MHz System Channel Number 1900 MHz System Channel Number Pilot channel Paging Channel Paging or Traffic Channels Traffic channels Sync Channel Traffic channels

Document number
106(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Parameter <page> 1-7 <pn> 0-511 <power> 0-7 0-7 <priv> 0 1 <p_so>, <s_so> 1 2 3 4 6 7 12 14 15 18 19 22 23 24 25 4100 4103 32769 32770 65535 <sat> 5970 HZ 6000 HZ 6030 HZ <scm> 0-255 <ver> 3 4 6
Description Paging Channel PN Offset
Digital transmit power level attenuation code Analog transmit power level attenuation code Voice privacy off Voice privacy on Primary Service Option, Secondary Service Option Voice (IS-96A) Loopback (IS-126) Voice EVRC Async Data (IS-99) SMS (IS-637) Packet Data (IS-657) Async Data 13K (IS-99) SMS 13K Packet Data 13K OTAPA RS1 OTAPA RS2 Medium Rate Packet Data RS1 Medium Rate Packet Data RS2 Medium Rate Packet Data RS1 Medium Rate Packet Data RS2 Async Data (IS-707) Packet Data (IS-707) Voice (IS-96) Data Null SAT 1 SAT 2 SAT 3 Station Class Mark
IS-95A Base Station protocol version IS-95B Base Station protocol version IS2000 Base Station protocol version
4.16
Data Testing
These commands are available for testing purposes. Carriers specify how this information is to be programmed into units. Therefore, these commands should not be used in an end-user application. The defaults shown in this section are for a generic, un-customized module. If a module is customized for a specific carrier, such as Verizon, the values may be updated to reflect that carriers requirements. As such, the defaults shown may not apply. 4.16.1 AT+CRM (RM Interface Protocol)

Document number
107(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Sets the current setting Reads the current settings
Syntax AT+CRM=<value> AT+CRM?
Possible Responses OK +CRM: <value> OK
This command is used for setting up the type of interface protocol used in CSD and packet data calls. When AT$QCMIP value is changed to 1 or 2, this modifies the value of AT+CRM to 2. The setting is not persistent. As a result, it is NOW saved after a power cycle. Parameter <value> 0 (default) 1 2 4.16.2 Description Asynchronous Data Packet data service, Relay Layer interface Packet data service, network layer interface , PPP AT$QCMIPP (Select Mobile IP Profile) Syntax AT$QCMIPP=<value> AT$QCMIPP? Possible Responses OK $QCMIPP: <value> OK This command selects one of the MIP user profiles to be the current active profile. It is expected that this AT command will be used by users to configure specific Dial-Up Networking. Note: Currently only profile 0 is set. This setting is persistent. As a result it is saved after a power cycle. Parameter <value> 05 Description Which profile to enable (default is 0)
Description Sets the mobile IP profile Reads the mobile IP profile
4.16.3
AT$QCMIPEP (State of Current Mobile IP Profile) Syntax AT$QCMIPEP=<value> AT$QCMIPEP? Possible Responses OK AT$QCMIPEP: <value> OK
Description Sets the status Reads the status
This command enables and disables the currently active profile. Disabling a profile is not the same as erasing a profile. Disabling a profile results in the profile being unavailable. It takes only a single numeric argument (either 0 or 1), which indicates whether a profile is enabled (0 indicates it should be disabled). This setting is persistent. As a result it is saved after a power cycle. Parameter <value> Description

Document number
108(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Parameter 0 (default) 1
Description Disable current profile Enable current profile
4.16.4
AT$QCMIPGETP (Mobile IP Profile Content) Syntax AT$QCMIPGETP=[<value>] Possible Responses OK
Description Gets the status
This command returns all the information corresponding to the particular profile number entered. If a profile number is not entered then the AT command returns all the information corresponding to the currently active profile. If a profile corresponding to a particular profile number does not exist, then an error is returned. An example of the command (module output in gray):
AT$QCMIPGETP=0 Profile:0 Enabled NAI:9192703897@vzw3g.com Home Addr:0.0.0.0 Primary HA:255.255.255.255 Secondary HA:255.255.255.255 MN-AAA SPI:2 MN-HA SPI:300 Rev Tun:1 MN-AAA SS:Unset MN-HA SS:Unset OK
Parameter <value> 05 Description Profile to display (if parameter not specified the a value of 0 is assumed)
4.16.5
AT$QCMIPNAI (NAI) Syntax AT$QCMIPNAI=<nai>,<commit> Possible Responses OK
Description Sets the status

Document number
109(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Reads the status
Syntax AT$QCMIPNAI?
Possible Responses AT$QCMIPNAI: <nai>,<commit> OK or AT$QCMIPNAI: Unset OK
This command sets the NAI for the currently active profile. The default is no NAI, therefore the result of the read command is Unset. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Note: According to Verizon requirements, the ability to update the NAI is prevented within the module. Therefore, when using Verizon as the carrier, the set option returns ERROR. Parameter <nai> NAI <commit> 0 1 Description String containing the NAI value Do not permanently commit Permanently commit
4.16.6
AT$QCMIPMASS (AAA Shared Secret) Syntax AT$QCMIPMASS=<mn-aaa>,<commit> AT$QCMIPMASS? Possible Responses OK AT$QCMIPMASS: <setting> OK
This command sets the MN-AAA shared secret in the currently active profile. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Parameter <mn-aaa> <commit> 0 1 <setting> Unset (default) Set Description String containing the mn-aaa value Do not permanently commit Permanently commit Value is not currently set. **The default state will be "Unset" until a MIP call has been established, then the default is "Set". Value has been set
4.16.7
AT$QCMIPMHSS (HA Shared Secret)

Document number
110(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Syntax AT$QCMIPMHSS=<mnha>,<commit> AT$QCMIPMHSS?
Possible Responses OK AT$QCMIPMHSS: <setting> OK
This command sets the MN-HA shared secret in the currently active profile. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Parameter <mn-ha> <commit> 0 1 <setting> Unset (default) Set Description String containing the mn-ha value Do not permanently commit Permanently commit Value is not currently set. **The default state will be "Unset" until a MIP call has been established, then the default is "Set". Value has been set
4.16.8
AT$QCMIPRT (Reverse Tunneling) Syntax AT$QCMIPRT=<setting>,<commit> AT$QCMIPRT? Possible Responses OK AT$QCMIPRT: <setting> OK
This command sets the reverse tunneling in the currently active profile. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Parameter <setting> 0 (default) 1 <commit> 0 1 Description Reverse tunneling not active Reverse tunneling active Do not permanently commit Permanently commit
4.16.9
AT$QCMIPMASPI (AAA SPI) Syntax AT$QCMIPMASPI=<setting>,<commit> AT$QCMIPMASPI? Possible Responses OK AT$QCMIPMASPI: <setting> OK

Document number
111(158)
Revision
1/198 17-4/FCP 101 3045 Uen
This command sets the MN-AAA SPI in the currently active profile. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Parameter <setting> 0-4294967295 <commit> 0 1 Description SPI value (default is 0) Do not permanently commit Permanently commit
4.16.10
AT$QCMIPMHSPI (HA SPI) Syntax AT$QCMIPMHSPI=<setting>,<commit> AT$QCMIPMHSPI? Possible Responses OK AT$QCMIPMHSPI: <setting> OK
This command sets the MN-HA SPI in the currently active profile. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Parameter <setting> 0-4294967295 <commit> 0 1 Description SPI value (default is 0) Do not permanently commit Permanently commit
4.16.11
AT$QCMIPPHA (Primary HA IP) Syntax AT$QCMIPPHA=<setting>,<commit> AT$QCMIPPHA? Possible Responses OK AT$QCMIPPHA: <setting> OK
This command sets the primary HA address in the currently active profile. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Parameter <setting> 0.0.0.0 255.255.255.255 <commit> 0 Description IP address (default is 0.0.0.0) Do not permanently commit

Document number
112(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Parameter 1
Description Permanently commit
4.16.12
AT$QCMIPSHA (Secondary HA IP) Syntax AT$QCMIPSHA=<setting>,<commit> AT$QCMIPSHA? Possible Responses OK AT$QCMIPSHA: <setting> OK
This command sets the secondary HA address in the currently active profile. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Parameter <setting> 0.0.0.0 255.255.255.255 <commit> 0 1 Description IP address (default is 0.0.0.0) Do not permanently commit Permanently commit
4.16.13
AT$QCMIPHA (Home IP) Syntax AT$QCMIPHA=<setting>,<commit> AT$QCMIPHA? Possible Responses OK AT$QCMIPHA: <setting> OK
This command sets the home address of the mobile in the currently active profile. The second argument indicates the persistence of the data. If not made persistent, the temporary value is deleted at the end of the call or if $QCMIPP is called. Parameter <setting> 0.0.0.0 255.255.255.255 <commit> 0 1 Description IP address (default is 0.0.0.0) Do not permanently commit Permanently commit
4.16.14
AT$QCQNC (Enables/Disables Quick Net Connect)

Document number
113(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Sets the current setting Displays the current settings
Syntax AT$QCQNC=<value> AT$QCQNC?
Possible Responses OK $QCQNC: <value> OK
This command enables or disables the Quick Net Connect. More information about Quick Net Connect can be found in the user scenarios chapter. The setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0 1 Description Disable QNC capability. This means that packet origination will use the packet data service option number Enable QNC capability. This means that packet origination will use the Async Data Service option number
4.16.15
AT+CTA (Packet Data Inactivity Timer) Syntax AT+CTA=<value> AT+CTA? Possible Responses OK +CTA: <value> OK
Description Sets the current setting Displays the current settings
This command is used to set the timer value that indicates the amount of time for observed inactivity in a packet data connection before release of the traffic channel. Note: A network order may overrule this setting. The setting is not persistent. As a result, it is not saved after a power cycle. Parameter <value> 0 1-255 Description Traffic channel not released during inactivity periods. If module receives an order from the network the module releases the traffic channel regardless of the setting. Release the traffic channel after <value> 1-second intervals have elapsed since last sending or receiving RLP data frames on the interface (the default is 30)
4.16.16 AT$QCSCRM (Supplementary Channel Supported) Description Syntax Possible Responses Sets the current setting AT$QCSCRM=<value> OK Displays the current AT$QCSCRM? $QCSCRM: <value> settings OK This command disables or enables the use of supplementary channels during packet data calls. The setting is persistent. As a result, it is saved after a power cycle.

Document number
114(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Parameter <value> 0 1 (default)
Description Disable Supplementary Channel support. This prevents supplementary channels from being assigned during packet data calls. Enable Supplementary Channel support. This enables supplementary channels to be assigned during packet data calls.
4.16.17 AT$QCTRTL (Slow down data at high CPU utilization) Description Syntax Possible Responses Sets the current setting AT$QCTRTL=<value> OK Displays the current AT$QCTRTL? $QCTRTL: <value> settings OK This command disables or enables the data throttling during periods of high CM52 CPU utilization. The setting is persistent. As a result, it is saved after a power cycle. Parameter <value> 0 1 (default) Description Disable throttling during high CPU utilization. Enable throttling during high CPU utilization.
4.16.18 AT$QCPKND (Scan serial link for PPP packets) Description Syntax Possible Responses Sets the current setting AT$QCPKND=<value> OK Displays the current AT$QCPKND? $QCPKND: <value> settings OK This command is used to enable the scanning of the serial link for PPP packets. When PPP packets are detected, a data call is generated. If this scanning feature is disabled, the module waits for the application to dial #777 before generating a data call and does not scan the serial link for PPP packets. The setting is persistent. As a result, it is saved after a power cycle. Parameter <value> 0 (default) 1 Description Disable scanning of the serial link for PPP packets. This means that module will wait for #777 before executing a data call. Enable scanning of the serial link for PPP packets. This means that a data call will be automatically generated if PPP packets are detected.
Note: In order to set the value of $QCPKND to 1, MIP must be disabled (AT$QCMIP=0). Issuing AT$QCPKND=1 when MIP is enabled results in an error. 4.16.19 AT$QCSO (Data Service Option Selection) Description Syntax Sets the current setting AT$QCSO=<value> Displays the current AT$QCSO? settings
Possible Responses OK $QCSO: <value> OK

Document number
115(158)
Revision
1/198 17-4/FCP 101 3045 Uen
This command is used to select the data service option class to use either IS-707, pre-IS-707, or QCT proprietary. The setting is persistent. As a result, it is saved after a power cycle. Parameter <value> 0 1 2 (default) Description Select pre-IS707 data service options. Select QCT proprietary data service options. Select IS707 data service options.
4.17
Depreciated Commands
The commands in this section are available as a transition from the CM-42 to the CM52. It is highly recommended that these commands NOT be used. Every action here has an equivalent action within the standard CM52 commands. 4.17.1 AT*ENSERV (Display Current Service State) Syntax AT*ENSERV? Possible Responses *ENSERV: <service_type>,<roam>,<sid> OK This command returns information about which system the CM52 is currently camped on. It is very similar to AT+CSS? and AT+CAD? commands. It is recommended that +CSS and +CAD be used rather than this command. Refer to Service Indicator unsolicited response (4.2.11.3) for a detailed description of the roaming indicator value. If the <service_state> indicates there is no service, the <roam> and <sid> values are invalid and, therefore, should not be referenced. Parameter <service_state> 0 1 2 <roam> 0 -255 <sid> 0-32767 Description Type of service CM52 is not registered on the network CM52 is on Analog service CM52 is on Digital service Roaming status Valid range for the roaming indicator System ID Valid range for the System ID
Description Queries the current Service state
4.17.2
AT*ECAM (Call Monitoring)

Document number
116(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Sets the call monitoring status
Syntax AT*ECAM=<onoff>
Possible responses *ECAM: <ccid>,<ccstatus>, <calltype> OK *ECAM: <onoff> OK
Reads the current setting
AT*ECAM?
This command activates or deactivates the Call State monitoring function in CM52. When the log is turned on, the unsolicited response, *ECAV, reports call state changes when they occur. It is recommended that the *EUNSOL unsolicited messages be used instead of *ECAV. When the call state logging is activated using AT*ECAM=1, the current status for the CM52 is returned as a response to this command. After a reset of the module, the call state logging will always be off. Parameter <onoff> 0 (default) 1 <ccid> 1 <ccstatus> 0 2 3 6 20 <calltype> 0 1 2 Description The call log function is disabled (off). The call log function is enabled (on). Indicates internal status information about the call. Idle. Connecting (Mobile Originated). Active Alerting (Mobile Terminating). Scanning. Reported only as an ECAM response if the status is equal to scanning at that time. No call. Voice. Data.
4.17.2.1
*ECAV (Call Monitoring Event)
Description Unsolicited Response syntax Unsolicited response *ECAV: <ccid>,<ccstatus>,<calltype> reporting call state changes. This unsolicited response reports call state changes. It is activated by the AT*ECAM. For a description of the parameters refer to AT*ECAM. 4.17.3 AT+CIMI (Read Cellular International Mobile Identity Number)

Document number
117(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Reads the International MIN stored in the current NAM.
Syntax AT+CIMI
Possible responses +CMIN: <imin> OK
Returns the modules international MIN stored in the current NAM; the preferred mechanism to retrieve the international MIN would be to use the NAM read option and read the country code, network code, and MIN and concatenate the values together. It is recommended that AT*ERNAM be used to retrieve the equivalent data. Parameter <imin> 15 digit String Description Value of the current NAMs international MIN.
4.17.4
AT+CLVL (Loudspeaker Volume Level) Syntax AT+CLVL=<level> AT+CLVL? Possible Responses OK +CLVL: <level> OK
Description Set outgoing audio volume Read current setting
This command is used to select the outgoing audio volume for the CM52 The setting will be maintained over a power cycle. Parameter <level> 0 1 8 (6 is default) Description Volume level Volume off Volume levels, one is lowest and eight is highest setting
4.17.5
AT+CMUT (Mute Control) Syntax AT+CMUT=<n> Possible Responses OK
Description Enable and disable the uplink voice muting during a voice call. Read current settings
AT+CMUT?
+CMUT: <n> OK
This command is used to enable and disable muting during a voice call. It has no effect in Idle mode. It is suggested that the application have its own amplifier to control the audio levels, as a result this command should not be necessary. A new call always starts being un-muted independent of the last setting of this command. Parameter <n> 0 (default) 1 Description mute off mute on

Document number
118(158)
Revision
1/198 17-4/FCP 101 3045 Uen
4.17.6
AT*EAGVS (AGC/AVC Select) Syntax AT*EAGVS=<aagc>[,<aav c>[,<txagc>]] AT*EAGVS? Possible Responses OK *EAGVS: <aagc>,<aavc>,<txagc> OK
Description Set Audio Gain/Volume Read current AGC/AVC setting
This command sets the automatic gain (agc) and/or automatic volume (avc) control. It has been determined that the values preset in the CM52 should not be modified; as a result this command should not be used. The audio automatic gain control <aagc> value is maintained after a power cycle; the audio automatic volume control <aavc> and the transmit automatic gain control <txagc> values are not maintained after a power cycle.
Parameter <aagc> 0 (default) 1 <aavc> 0 (default) 1 <txagc> 0 (default) 1
Description audio automatic gain control agc disabled agc enabled audio automatic volume control avc disabled avc enabled transmit automatic gain control txagc disabled txagc enabled
4.17.7
AT+CUDAH (Default User Destination Address Info) Syntax AT+CUDAH=<type> AT+CUDAH? Possible responses OK +CUDAH: <type> OK
Description Set user destination address Read the current user destination address
This command sets the default user-destination address information on all MO SMS messages. The preferred method for specifying a user destination address is to specify it as a parameter in the send command (ATCSSM). The setting is not persistent and will not be maintained over a power cycle. Refer to <type> in AT+CSSM for a description of the parameter. 4.17.8 AT+CSDCN (Default Call-back Number)

Document number
119(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Sets user callback number Get the current user Callback number
Syntax AT+CSDCN=<address>[,<type>] AT+CSDCN?
Possible responses OK +CSDCN: <address>,<type> OK
This command sets the default call-back number used information on all MO SMS messages. The preferred method for specifying a callback address is to specify it as a parameter in the send command (ATCSSM). The settings are not persistent. As a result, they are not saved after a power cycle. Parameter <address> null (default) IRA chars <type> Description Send no call-back number. Send the indicated call-back-number address. Refer to <type> in AT+CSSM
4.17.9
AT+CSDSH (Default SMS Header) Syntax AT+CSDSH=<smheader> AT+CSDSH? Possible responses OK +CSDSH: <smheader> OK
Description Sets default Short Message Header Reads the current setting
This command sets the default short-message header information on all MO SMS messages. The preferred method for specifying the SMS header data is to specify it as a parameter in the send command (ATCSSM). The setting is not persistent. As a result, it is not saved after a power cycle. Refer to <smheader> in AT+CSSM for parameter description. 4.17.10 AT+CSDUH (Default User Data Header) Syntax AT+CSDUH=<udheader> AT+CSDUH? Possible responses OK +CSDUH: <udheader> OK This command sets the default user-data header of information on all MO SMS messages. The preferred method for specifying the user data header is to specify it as a parameter in the send command (ATCSSM). The setting is not persistent. As a result, it is not saved after a power cycle. Refer to <udheader> in AT+CSSM for parameter description.
Description Sets the default user-data header Reads the current setting

Document number
120(158)
Revision
1/198 17-4/FCP 101 3045 Uen
4.17.11
AT+CRC (Cellular Result Codes) Syntax AT+CRC=<value> AT+CRC? Possible Responses OK +CRC: <value> OK
Description Enables/Disables cellular result codes Reads the current setting
This command enables and disables the reporting of detailed cellular result codes. The format and content of the result code strings are listed in the table below. The setting is not persistent. As a result, it is not saved after a power cycle. Parameter Name <value> 0 (default) 1 Description Disable Cellular result codes Enable Cellular result codes
The following extended result (error) codes are reported when +CRC reporting is enabled: Error Code RING ASYNC RING FAX Description Is returned when there is an incoming Async data call. Is returned when there is an incoming FAX call. Note: The CM52 does not support FAX. Answering a FAX call could produce unpredictable results.
4.17.12
AT+WS46 (Sets the Cellular Protocol Mode) Syntax AT+WS46=<value> AT+WS46? Possible responses OK +WS46: <value> OK
Description Sets the cellular protocol mode Gets the current user Callback number
This command allows the setting of the cellular protocol mode for the CM52. The preferred method for setting the cellular protocol mode is use AT*EPMOD. Note: The command does not behave exactly the same as it did in the CM-42. In the CM52 the command behaves exactly the same as AT*EPMOD. Therefore, the command is NOT a temporary setting that is reset when the call is complete. WS46 changes the setting of AT*EPMOD and is therefore persistent. Parameter <value> 13 243 0 Description CDMA preferred (EPMOD value of 0) AMPS only (EPMOD value of 1) None of the above; can only be returned in a query, it cannot be set

Document number
121(158)
Revision
1/198 17-4/FCP 101 3045 Uen
4.17.13
AT*ECPREV (Display Current CDMA Protocol Revision) Syntax AT*ECPREV? Possible responses *ECPREV: <revision> OK
Description Reads protocol revision
This command allows an application to query the current CDMA protocol revision that is in use. The revision in use is the one that the mobile station and base station agree to use when service is established. Parameter <revision> 1 3 4 6 Description JSTD008 IS95A IS95B IS2000
5
5.1
Aeris MicroBurst Feature

General Information
MicroBurst is a registered trademark of Aeris.net, 1245 S. Winchester Boulevard, San Jose, California 951283908. The information in this document is intended for use in conjunction with other documentation supplied by Aeris.net. (TBD) 5.1.1 Factory Configuration CM52 modules containing the Aeris MicroBurst feature are shipped from the factory with the MicroBurst functions disabled. Because the MicroBurst functions are available only in NAM 2, the module must first be set to NAM 2 using the AT*ESSE command before MicroBurst can be enabled. For information about how to enable MicroBurst, see section 4.3.4. The functions are enabled using the AT*EDMFE command described in Section 0. 5.1.2 System Selection TBD 5.1.3 Supported MicroBurst Paging Methods The CM52 module supports all of the paging methods currently provisioned in the Aeris network, including paging messages that are received in the AMPS overhead message stream, in Configuration Packets, in Forward Data Packets, and in SMS messages. 5.1.4 I/O Pins In the current release, the CM52 does not support general-purpose I/O pins. Therefore, the following I/O functions defined in the Aeris documentation are not available: Controlling the state of output pins Reporting the state of input pins Generating Feature Request messages by detecting input state changes Counting of input state changes

Document number
122(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Some AT commands which are associated with I/O functions have been retained for possible future use, and are defined in this document; however, execution of these commands in the current release of the CM52 generates error messages. 5.1.5 Support for Multiple MINs The CM52 module can be configured with 10 MINs of which the first one, MIN0, is referred to as the Primary MIN. The remaining 9 are referred to as Secondary MINs. The Primary MIN must be the same as the MIN stored in the NAM2 section of NVRAM. If the NAM value is changed after the MicroBurst Primary MIN is programmed, the MicroBurst Primary MIN must be re-entered to correspond to it. The odd or even state of the final digit of all Secondary MINs must match the odd or even state of the final digit of the Primary MIN. AT command AT*EDMIN (Section 0) is used to configure MINs and to set action and control bytes for the MINs. MINs can be entered with wildcard digits, so that a MIN may represent an entire range of numbers. This is explained in detail in the description of the AT*EDMIN command. All actions defined by Aeris are supported except action 10 (Enter low-power sleep). The following message format is used to notify a host via the serial port that a page and action request has been received: *EUNSOL: MICRO, 1, slot, action, control, where slot is the MIN index (0-9), action is the configured action value (0-255), and control is the configured control byte value. If a page was matched by a wildcard MIN, the message format is expanded to include the actual number that was matched: *EUNSOL: MICRO, 1, slot=dddddddddd, action, control. The last paged slot may be obtained and optionally cleared with the AT*EDRLP command described in Section 5.2.11. Note: Only the Primary Min is allowed on the Aeris System at this time. The CM52 module allows Secondary MINs to be configured; however, the Aeris system does not support the use of Secondary MINs at this time.
5.2
MicroBurst Commands
Set MicroBurst Default Values Syntax Possible responses AT*EDCLR <CR> OK
5.2.1 AT*EDCLR Description Resets MicroBurst non-volatile defaults.
This command sets the MicroBurst non-volatile defaults as follows: All MIN slots are cleared to zero (unprogrammed state). The last received MIN page and Configuration Packet page status are cleared. The MicroBurst Digit Buffer is set to the default message. The 32-bit counter/register is reset. The Configuration Packet page match parameters are set to default values (99,10). The scan time for Automatic MicroBurst Service Search is set to 900. The SDCC suppress flag is set to 0 to enable Supplemental Digital Color Codes. The AUTH enable flag is set to 0 to disable authentication. The AT*EDCLR command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst

Document number
123(158)
Revision
1/198 17-4/FCP 101 3045 Uen
5.2.2 AT*EDCTR Description Sets a count in the 32-bit counter register. Displays the current value on the 32-bit counter register.
Thirty-Two Bit Internal Counter/Register Syntax Possible responses AT*EDCTR=<count><CR> OK AT*EDCTR?<CR> *EDCTR: <count>
This command sets the internal 32-bit counter register value to <count>. To clear the 32-bit internal counter register, use <count> = 0. A power on cycle or execution of the AT*EDCLR command sets the 32-bit internal counter register to 0. A specific page command may be sent to the module to cause a power cycle while preserving the current contents of the counter. Defined parameter values: <count> Range of the 32-bit counter register is 0..4294967295. Note: The 32-bit counter is intended to count transitions on a general-purpose input pin. Because the CM52 does not currently support general-purpose I/O pins, this counter functions as a read-write register. The counter value is never transmitted over the network in the current implementation. The counter is retained for possible future use, and for test purposes. The AT*EDCTR command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst 5.2.3 AT*EDMFE Description Sets the MicroBurst mode enable. Displays the MicroBurst mode MicroBurst Function Enable Syntax Possible responses AT*EDMFE=<function>,<re OK g>,<cnt> ERROR AT*EDMFE? *EDMFE: <function>, <reg>,<cnt>,<SDCC suppress>,<AUTH enable>,[,xxx DISABLED]
This command configures the module to operate in the MicroBurst data mode, changes the registration mode, and enables/disables the event counter. This non-volatile value is tested during power on cycle to establish the MicroBurst defaults. When MicroBurst is enabled via the AT*EDMFE command, the AT*EREGC command (Section 4.5.1) is disabled, and all prior settings for the AT*EREGC command are ignored. The registration control functions are overridden by the MicroBurst commands. Parameter <function> 0 1 2 Description OFF. Disables the MicroBurst function. ON. Enables the MicroBurst function including all overhead message paging. ON. Enables the MicroBurst function and all overhead message paging. Note: this setting is retained for backward compatibility. Setting the value 2 results in setting a value of 1 internally, and the displayed value will be 1. Sets autonomous registration to EIA/TIA-553 specification. Sets autonomous registration to Aeriss specification. Note: Currently not supported. Suppresses all autonomous registrations
<reg> 0 1 2

Document number
124(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Parameter <cnt> 0 1
Description Disables the 32-bit counter driven by high-to-low transitions on input pin Enables the 32-bit counter driven by high-to-low transitions on input pin. Note: Because the CM52 does not currently support general-purpose I/O, a value of 1 will not be accepted. Supplemental Digital Color Codes are enabled (default value). Supplemental Digital Color Codes are suppressed. Authentication is disabled (default value). The base station is allowed to set authentication active or inactive. Note: If authentication is enabled and the base station requests that authentication data be transmitted, the total length of the data field transmitted in Feature Requests is limited to 24 digits.
<SDCC supp> 0 1 <AUTH enable> 0 1
Module Disabled States The xxx DISABLED portion of the status display will be present whenever a page message has set a disabled state. The following table summarizes the disabled states. Displayed State CSP DISABLED Cause Receipt of any page generating Action 21 Effect AT*EDSCTR and AT*EDSDG are disabled and will return ERROR. Module continues to register and respond to pages but does not generate any transmissions. AT*EDSCTR and AT*EDSDG are disabled and will return ERROR. Module continues to register and respond to pages but does not generate any transmissions Module is totally quiet on the air. Does not register nor send any data transmissions Module is totally quiet on the air. Does not register nor send any data transmissions How Cleared Receipt of any page generating Action 20, or entering AT*EDMFE=1,x,x,x,x or AT*EDMFE=2,x,x,x,x Receipt of a Configuration Packet page generating Action 22
AERIS DISABLED
Receipt of an Configuration Packet page generating Action 23 CSP SUPERQUIET Receipt of any page generating Action 38 AERIS Receipt of a SUPERQUIET Configuration Packet page generating Action 40 FACTORY Receipt of a DISABLED Configuration Packet page with C=3, D1D2 = 98, and the correct checksum in D3D4
Receipt of any page generating Action 37, or entering AT*EDMFE=1,x,x,x,x or AT*EDMFE=2,x,x,x,x Receipt of a Configuration Packet page generating Action 39
All MicroBurst commands except AT*EDMFE? Are disabled. All module operation in the cellular network is inhibited.
Module must be returned to the factory.
The AT*EDMFE command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst

Document number
125(158)
Revision
1/198 17-4/FCP 101 3045 Uen
5.2.4 AT*EDFMTP Description Sets the Configuration Packet page match parameters, duplicate page timer, and Configuration Packet message timer. Displays the Configuration Packet page match parameters.
Set Page Match Parameters Syntax Possible responses AT*EDFMTP=<nx>,<timeout>, OK <fmpt_timeout> ERROR
AT*EDFMTP?
*EDFMTP: <nx>, <dup_timeout>, <message_timeout>
This command sets the office code prefix identifying Configuration Packet pages that are sent to this module, the duplicate page filter timeout, and the Configuration Packet message timeout. The duplicate page filter prevents the module from recognizing multiple pages (normally two) as separate events. The message timeout indicates how long the module waits for receipt of all portions of a Configuration Packet. When the timer expires, it indicates that the Configuration Packet sequence has not completed, and all page data is discarded. Parameter <nx> <dup_timeout> <message_timeout> Description Special office code digits. Default is 99. Timer to filter duplicate pages. Default is 15 seconds. Timer to detect incomplete Configuration Packet page sequence. Default is 30 seconds.
The AT*EDFMTP command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst 5.2.5 AT*EDMIN Description Sets the MicroBurst MIN. Enter and Display MicroBurst MINs Syntax Possible responses OK AT*EDMIN=<slot>, <mbmin>, <act>,<ctrl><CR> AT*EDMIN?<CR> *EDMIN: <slot>,<mbmin>, <act>, <ctrl>
Displays the MicroBurst MINs.
This command programs the additional MicroBurst MINs that the module must decode. The primary MIN must be programmed before any other MINs are programmed, because the odd/even nature of MINs 1-9 must be the same as the odd/even nature of the primary MIN. An error is indicated under the following conditions: An attempt is made to program MINs 1-9 if the primary MIN is not programmed. If the MINs in any of the slots 1-9 are programmed, and an attempt is made to change the odd/even status of the primary MIN. If the primary MIN entered does not match, digit-for-digit, the MIN string stored in NAM2. This string can be viewed using the AT*ERNAM command described in Section 4.3.2. Entering a W (case insensitive) in any digit position within the 10-digit field for any of the MINs in slots 1-9 specifies a wildcard digit. Any incoming digit will match a wildcard digit except for a wildcard in the low-order digit; in this case, the incoming digit must obey the odd/even rule with respect to the primary MIN in order for a match to be detected. Each new MIN entry is checked against all existing entries to ensure that no entry becomes ineffective due to a range overlap. A new entry is not allowed under the following conditions:

Document number
126(158)
Revision
1/198 17-4/FCP 101 3045 Uen
It is identical to an existing entry. This is a character-by-character check of digits and wildcard characters. The new entry, if allowed, would create a pair of entries where the digits and wildcards match, and the number of wildcards in the entry with the lower slot index is greater than the number of wildcards in the other entry. This would cause the entry at the lower slot index to detect all pages that would otherwise be detected by the entry at the higher slot index, thus rendering the higher slot index entry ineffective.
Note: The second rule is sequence-dependent. This allows the following example entries to exist in the order given: 175-472-WWW1 . . 175-4WW-WWW1 A non-primary MIN may be removed (deprogrammed) by entering 0s (a null MIN) for all of the digit positions. The action and control bytes can be any value, but both must be entered. When viewing the MicroBurst MINs using the AT*EDMIN? command, only the programmed <slot>(s) are displayed. For example, only those slots whose MINs are not all 0s are displayed. Defined parameter values: Parameter <slot> <mbmin> <act>
<ctrl>
Description An index to the intended MicroBurst MIN. A 10-digit directory number (consisting of digits in the range of 0..9, or W or w). An 8-bit value that defines the action that the module will take when the associated MIN is polled. The module processes some values internally according to Aeris specifications. All action values are passed to the serial port host for possible further processing by the application. An 8-bit bit-mask value that defines whether the serial port will transmit notification of pages to this MIN, and whether or not this MIN is a global MIN. The module processes mask values 00000000, 00000001, 000000010, & 00000011.
The AT*EDMIN command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst 5.2.6 AT*EDWDG Description Writes the digit string to the dialed digit buffer. Write Dial Digit Buffer Syntax AT*EDWDG=<dial_digits> <CR>
Possible responses OK
The serial port host formats a MicroBurst <dial_digits> string. Binary data must be converted to its decimal equivalent before sending to the module, i.e., the MicroBurst digit buffer is ready for transmission (including prefix digits) without any modifications by the module. Upon acceptance of the MicroBurst digit string; the <status> of the Dial Digit Buffer, which is defined in the description of AT*EDRDG, is changed to armed. The * prefix MUST be presented in the command. A minimum of 15 and a maximum of 31 dial digits must also be included. NOTE: if authentication is active, an error will be indicated if the length of the buffer exceeds 24 characters and transmission is attempted.

Document number
127(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Parameter <dial_digits> 0..9,*,#
Description String the digits that are represented on a telephone keypad.
The AT*EDWDG command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst 5.2.7 AT*EDMBIO Description Sets the binary input monitoring mode. Displays the binary input monitoring mode. Monitor Binary Input Enable/Disable Syntax Possible responses AT*EDMBIO=<input_num> OK , <mode><CR> AT*EDMBIO?<CR> *EDMBIO: <mode>
This command declares how the module is to process the state transitions on (up to) 2 input port pins. The mode is stored in non-volatile memory; therefore, it retains its pre-set state through a power on cycle. When enabled, the module autonomously transmits information when the I/O pin changes state from HIGH to LOW for a minimum of 200 ms. The input pins are pulled up by an internal resistor, so that they are normally in a HIGH state. Therefore, the monitoring function can be accomplished by driving the line to a logic LOW state via a contact closure to ground or an open-collector transistor connected to ground. When the binary INPUT 1 pin is configured by the AT*EDMFE command as a 32-bit internal counter register input, its level is included in the message requested by action byte value 1 (transmit current reading of 32-bit counter OTA, including the logic level) even though it is used as an internal counter input. Counting occurs on the HIGH to LOW transition of the input pin. Note: The CM52 does not currently support general-purpose I/O. Therefore this command will generate an error message. The description is retained here for possible future use. Parameter <input_num> 1 2 <mode> 0 1 Description Binary input port number: A, which corresponds to INPUT 1 on the system connector. Binary input port number: B, which corresponds to INPUT 2 on the system connector. Off. ON. When ON, a change in the port pin state from HIGH to LOW is reported automatically.
The AT*EDMBIO command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst 5.2.8 AT*EDSDG Description Writes the digit string to the dialed digit buffer and then send it. Sends current dialed digit buffer Send Current Dial Digit Buffer Contents Syntax Possible responses AT*EDSDG=<dial_digits>< *EUNSOL : MICRO,4, TX DONE CR> *EUNSOL : MICRO,5, TX FAILED AT*EDSDG=0<CR> *EUNSOL : MICRO,4, TX DONE *EUNSOL : MICRO,5, TX FAILED

Document number
128(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Description Reads the last transmitted digit buffer
Syntax AT*EDSDG?<CR>
Possible responses *EDSDG: <ascii_string>
This command permits the serial port host to create and send a MicroBurst digit buffer. The module accepts, stores and transmits data with a single command. Binary data must be converted to its decimal equivalent before sending it to the module. For example, the MicroBurst digit buffer is ready for transmission (including prefix digits of *9, as applicable) without any modifications by the module. The module accepts the <dial_digits> string, converts it to hex nibbles, stores it in the digit buffer of the MicroBurst, and initiates an origination. The * prefix MUST be presented in the command. A minimum of 15 and a maximum of 31 dial digits must also be included. Note: When authentication is active, an error is indicated if the length of the buffer exceeds 24 characters and transmission is attempted. Parameter <dial_digits> 0..9,*,# Description String the digits that are represented on a telephone keypad.
The AT*EDSDG command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst 5.2.9 AT*EDRDG Description Reads the contents of the dialed digit buffer. Read Current Dial Digit Buffer State Syntax Possible responses AT*EDRDG?<CR> *EDRDG: <dial_digits>, <status>
The contents of the MicroBurst digit buffer are returned to the serial port host. The <dial_digits> is prefixed with *. For example, *900001751230045, 1. A power-on cycle sets the contents of the dial digit buffer to a default value. Parameter <dial_digits> 0..9,*,# <status> Default Armed ACKed NACKed Pending TX Error 1 2 3 4 5 6 Buffer contains primary MIN. Buffer contains new data. Buffer transmitted and acknowledged (SAT detected). Buffer transmitted but not acknowledged (SAT not detected). Buffer queued for transmission (global page). Transmission incomplete due to DISABLED or QUIET mode, or invalid reach-back character Terse Description String the digits that are represented on a telephone keypad.
The AT*EDRDG command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst

Document number
129(158)
Revision
1/198 17-4/FCP 101 3045 Uen
5.2.10 AT*EDFREG Description Requests the module to initiate an autonomous registration access.
Force Registration Syntax AT*EDFREG<CR>
Possible responses OK
The serial port host requests the module to initiate an autonomous registration access. The AT*EDFREG command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst 5.2.11 AT*EDRLP Description Reads the last MicroBurst page and optionally clear it. Read Last MicroBurst/Configuration Page Syntax Possible responses *EDRLP: <slot>,<act>, <ctrl> AT*EDRLP=<page><CR> *EDRLP: <slot>, <cmd>, <digits>
This command displays the last matched MIN page or Configuration Packet page received. If the last matched page received has been cleared (command value 1 or 3), only the OK response is returned. The slot value and command value for the most recent MIN and Configuration Packet pages are saved in nonvolatile storage so that they may be read after a power interruption. However, for a group of Configuration Packet pages referencing the same MIN slot and command value, only the data elements for the first page in the group are retained in non-volatile storage; the remaining data elements are discarded. The individual MIN values that are matched by wildcard MIN slots are not retained in non-volatile storage for either MIN or Configuration Packet pages. Parameter <page> 0 1 2 3 <slot> 0..9 <cmd> 0..9 <act> 0..255 <ctrl> 0..255 <digits> 0000..9999 Description Read last matched MIN page received. Read and clear last matched MIN page received. Read last matched Configuration Packet page received. Read and clear last matched Configuration Packet page received. The MIN slot of the last MIN page/Configuration Packet message. The command value of the last Configuration Packet page received. The action byte associated with the last paged MIN. The control byte associated with the last paged MIN. The Configuration Packet digits received in last matched Configuration Packet message.
The AT*EDRLP command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst

Document number
130(158)
Revision
1/198 17-4/FCP 101 3045 Uen
5.2.12 AT*EDTXS Description Reads the transmit status
Read Transmit Buffer Status Syntax Possible responses AT*EDTXS *EDTXS: 0 *EDTXS: 1, <timeout> OK
This command reports the current state of the dialed digit buffer. The reported values are as follows: *EDTXS: 0 there is no transmission pending *EDTXS: 1, <timeout> a pending transmission will occur after the displayed timeout
The AT*EDTXS command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst 5.2.13 AT*EDSERV MicroBurst Service Search
Note: This command has no function in the current version of CM52. It is retained for reference and for possible future use. Description Sets the service search mode and scan time interval. Displays the service search mode and scan time interval. Syntax AT*EDSERV=<search>, <scan_time><CR> AT*EDSERV?<CR> Possible responses OK *EDSERV: <search>, <scan_time>,<SID>
This command enables/disables the automatic A/B service search algorithm and sets the time interval for determining if micro burst service is available. The automatic service search does not have any effect unless the module is configured to look at multiple bands. When enabling automatic service search mode it is important to set the home SID either to 0 or to a SID where service is known to be available. This is necessary because if a module detects broadcast SID that matches the configured SID then it will lock on that SID and not switch bands. The AT*EDSERV command can be used to cause an immediate A/B switchover by entering AT*EDSERV=0,0. In this case, the parameter values are not altered. However, the implied timeout value of 0 triggers an immediate changeover. Parameter Description <search> 0 OFF. The automatic MicroBurst A/B service search is disabled. 1 ON. The automatic MicroBurst A/B service search is enabled. <scan_time> 30..1800 The scan time in seconds the module waits for the detection of the MicroBurst service before switching to the alternate band. Default value is 900. 0 indicates an immediate A/B switchover. <SID> 2..32767 The system ID (SID) of the service provider The AT*EDSERV command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst

Document number
131(158)
Revision
1/198 17-4/FCP 101 3045 Uen
5.2.14 AT*EDSCTR Send Thirty-two Bit Counter Register Description Syntax Possible responses Sends the counter value and AT*EDSCTR OK I/O state information This command permits the serial port host to initiate transmission of the contents of the 32-bit internal counter register. The module processes the request as defined for action byte 1 (transmit current reading of internal 32-bit counter OTA, including logic level of I/O pins). Note: Because the CM52 does not currently support general-purpose I/O, this command generates an error message. It is retained for possible future use. The AT*EDSCTR command will return ERROR if the feature required for this function is not enabled. Feature required for this command: o Aeris Microburst
5.3
MicroBurst Unsolicited Messages
The MicroBurst Unsolicited Messages are always active when MicroBurst is enabled. There is no filtering associated with these messages even though they are prefixed with *EUNSOL: 5.3.1 MICRO,1 Unsolicited MIN Page Response Response: *EUNSOL: MICRO,1,<slot>[=dddddddddd],<act>,<ctrl> This response indicates that a MIN has been paged. If the MIN contains wildcards, the dddddddddd field displays the incoming MIN that matched it. Defined values: <slot> <act> <ctrl> 0..9 0..255 0..255 The slot number of the last page MIN. The action byte associated with the paged MIN. The control byte associated with the paged MIN.
5.3.2 MICRO,2 Unsolicited Configuration Packet Page Response Response: *EUNSOL: MICRO,2,<slot>[=dddddddddd],<cmd>,<digits> This response indicates that a Configuration Packet message has been received. If the MIN in the slot referenced by the page contains wildcards, the dddddddddd field displays the incoming MIN that matched it. Defined values: <slot> <cmd> <digits> 0..9 0..5 0000..9999 The MIN that the Configuration Packet referenced. The Configuration Packet command code. The Configuration Packet data.
5.3.3 MICRO,3 Unsolicited MicroBurst Service Detection Response: *EUNSOL: MICRO,3,SERVICE

Document number
132(158)
Revision
1/198 17-4/FCP 101 3045 Uen
This response indicates that MicroBurst service has been detected by receipt of a page to NPA range 175185. 5.3.4 MICRO,4 Unsolicited MicroBurst TX Done Response: *EUNSOL: MICRO,4,TX DONE This response indicates that a MicroBurst transmission has been initiated and a traffic channel assignment has been received, and also indicates that the Feature Request has been accepted by the cellular network. The module continues to process the outgoing call through SAT tone receipt and timeout conditions, until the call is actually terminated and the module goes to CALL STATUS,IDLE state. 5.3.5 MICRO,5 Unsolicited MicroBurst TX Failure Response: *EUNSOL: MICRO,5, TX FAILED This response indicates that a MicroBurst transmission has been sent and a SAT acknowledge or other normal release condition was not detected. 5.3.6 MICRO,6 Unsolicited MicroBurst Service SID Change Response: *EUNSOL: MICRO,6, NEW SID This response indicates that a MicroBurst service has been detected and the service provider has changed. 5.3.7 MICRO,7 Unsolicited MicroBurst I/O Pin A Change Response: *EUNSOL: MICRO,7, I/O A CHG This response indicates that I/O pin A has changed from a high to a low state. NOTE: Because the CM52 does not currently support general-purpose I/O, this message will not be reported. 5.3.8 MICRO,8 Unsolicited MicroBurst I/O Pin B Change Response: *EUNSOL : MICRO,8, I/O B CHG This response indicates that I/O pin B has changed from a high to a low state. NOTE: Because the CM52 does not currently support general-purpose I/O, this message will not be reported. 5.3.9 MICRO,9 Unsolicited No MicroBurst Service Detected
Response: *EUNSOL: MICRO,9, NO SERVICE This response indicates that the automatic A/B service detection algorithm has scanned both bands and has not detected MicroBurst service. This message is reported only once per power on cycle.

Document number
133(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Note: This message is dependent on the AT*EDSERV command, which has no function in the current CM52 implementation. It is retained here for reference.
5.3.10 MICRO,11 Unsolicited Forward Data Packet Application Data Response: EUNSOL: MICRO,11,ddd.ddd It indicates that the CM-42 has received a Forward Data Packet page containing pure application-related data. The ddd.ddd string must be interpreted by the application. 5.3.11 MICRO,12 Unsolicited Forward Data Packet SDRR Data TBD
5.3.12 MICRO,13 Unsolicited SMS Application Data Response: EUNSOL: MICRO,13,hhHHH..HHH It indicates that the CM-42 has received an SMS message containing pure application-related data. The hh field is a hex byte count of the length of the data characters, and the HHHHHH represents the hex data sent in the message. The data must be interpreted by the application. 5.3.13 MICRO,14 Unsolicited SMS SDRR Data TBD
5.3.14 MICRO,95 Origination Disallowed This message is generated whenever a Feature Request message is attempted, but cannot be transmitted. The reason for the failure is indicated in the message, as follows: EUNSOL: MICRO,95,1 Invalid reach-back character (not * or #) EUNSOL : MICRO,95, CSP DISABLED EUNSOL : MICRO,95, AERIS DISABLED EUNSOL : MICRO,95, CSP SUPER QUIET EUNSOL : MICRO,95, AERIS SUPER QUIET EUNSOL : MICRO,95, FACTORY DISABLED 5.3.15 MICRO,96 Unsolicited Forward Data Packet Page Response, Error Detected *EUNSOL : MICRO,96,<type>,<error_code> [,<data>] This indicates that a Forward Data Packet message of the indicated <type> was received, but an error was detected. Possible values and meanings for <error_code> are: 1 Invalid Forward Data Packet message type. 2 Invalid internal message checksum, <data> indicates expected checksum. 3 Invalid characters for the type of message. 4 Length mismatch. 5 Action is invalid: incorrect module state, etc.
Response:
5.3.16 MICRO,97 Unsolicited SMS Page Response, Error Detected Response: *EUNSOL : MICRO,97,<type>,<error_code>

Document number
134(158)
Revision
1/198 17-4/FCP 101 3045 Uen
This indicates that a SMS page message of the indicated <type> was received, but an error was detected. Possible values for <error_code> are: 1 Invalid SMS message type. 2 Invalid internal message checksum, <data> indicates expected checksum. 3 Invalid characters for the type of message. 4 Length mismatch. 5 Action is invalid: incorrect module state, etc. 5.3.17 MICRO,98 Unsolicited MIN Page Response, Error Detected Response: *EUNSOL: MICRO,98,<slot>,<act>,<ctrl> This indicates that a MIN has been paged and an error in the page message has been detected, or the action associated with the MIN is invalid. Defined values: <slot> 0..9 <act> 0..255 <ctrl> 0..255
The slot number of the paged MIN. The action byte associated with the paged MIN. The control byte associated with the paged MIN.
5.3.18 MICRO,99 Unsolicited Configuration Page Response, Error Detected Response: *EUNSOL: MICRO,99,<slot>,<cmd>,<digits> This indicates that a Configuration Packet has been received and an error has been detected in the data, or the action byte associated with the paged MIN is invalid. Defined values: <slot> <cmd> <digits>
0..9 The MIN that the Configuration Packet referenced. 0..5 The Configuration Packet command code. 0000..9999 The Configuration Packet data.
User scenarios
This chapter contains descriptions and examples on how to use many of the features that are supported by the CM52. While the AT command section describes each AT command and its syntax and function, the focus of this chapter is on how the commands are used and how they are related to each other. Each user scenario lists the AT commands that are used in the examples and a reference to the description of the commands in the AT command reference section. It is important to become familiar with the description of the commands before studying the examples. The user scenarios are provided as a supplement to the AT command reference section and do not include all necessary information.
6.1
Configuring HyperTerminal
To get started with the CM52, it is recommended that the module be serially connected to a PC by using an SEMC development board. Connect UART1 with a serial port on the PC. Configure HyperTerminal to the connected serial port. The CM52 serial port is defaulted to 115200 baud; 8 data bits, no parity, 1 stop bit, and flow control is hardware.

Document number
135(158)
Revision
1/198 17-4/FCP 101 3045 Uen
6.2
Setup CM52 for serial communication
This example illustrates how to change the baud rate. Note: The baud rate change is effective immediately after the OK response is issued and is persistent across power cycles. Command/response (in gray)
AT+IPR? +IPR: 115200 OK AT+IPR=19200 OK AT+IPR? +IPR: 19200 OK AT+CFUN=0 OK SHUTDOWN COMPLETE Restart AT*IPR? +IPR: 19200 OK Shut down CM52 Turn off and then turn on CM52 Change baud rate to 19200 OK is returned on 115200 and then changed to 19200 Check current setting with baud rate 19200
Description
Check current baud rate Current baud rate is 115200
Baud rate is now set to 19200
6.3
Proper Shutdown procedure
To ensure the best performance, the CM52 has to be powered down properly. If the power is abruptly removed, unsaved data can be lost. The proper shutdown procedure is to issue the AT+CFUN=0 command, wait for the SHUTDOWN COMPLETE to be returned from the CM52, and then allow the WAKE signal to float HIGH or remove power to the module. The AT command forces the module to perform an orderly shutdown. To restart the module, simply drive the WAKE signal LOW or re-apply power. Applications must always have control of the WAKE signal to the module. The WAKE signal performs a poweron reset of the module. The module reset must be under application control in case the module hangs. If a module detects an unrecoverable internal error it may reset automatically. The application should always monitor for a Restart message from the module and take appropriate recovery action.
Example: Command/response (in gray) AT+CFUN=0 OK SHUTDOWN COMPLETE Description Shutdown command Message indicating it is safe to power down

Document number
136(158)
Revision
1/198 17-4/FCP 101 3045 Uen
6.4
Acquiring Cellular Service
To obtain and activate a commercial account, you will need to supply the cellular operator with the ESN and Model numbers. The ESN can be read from the ESN label on the module or by issuing the AT+GSN command. Often, the service provider asks for additional information to determine the manufacturer and model number of the unit. This information can be obtained by using the commands AT+GMI and AT*EIDSUM. Example: Command/response (in gray) AT+GSN +GSN: 912DC6CF OK AT+GMI +GMI: SONY ERICSSON Description Request ESN Returns ESN
Request Manufacturers name
OK AT*EIDSUM? Request model and description *EIDSUM: KRD 104 1004/01 P1J 01W09 PR1G02 CM52 Sony Ericsson Transceiver OK The programming can be done OTA or manually. If the service provider provides OTA programming, read the next section 6.4.1. If the service provider does not supply OTA programming, enter the data obtained from the service provider manually, as described in section 6.4.2. 6.4.1 Over the Air Programming (OTA) Before OTASP can be initiated the module must first be able to make a call. It is strongly suggested a PRL be present. It is required if issuing ATD*228. A PRL is not required if the band is specified using ATD*228XX. Additionally, because OTASP typically connects to a voice automated system, you must listen to the call to step through the menus. If using a development board, ensure the provided ear-piece is connected. To connect to the carrier on the A-band, enter the following command: ATD*22800 After OTASP is initiated, follow the voice automated instructions. If any user input is needed, use the command ATD to input the required key sequence. If asked to enter the number 1, enter it as ATD1. Verizon has implemented a completely automated option rather than an interactive mode. This can be achieved by dialing *22890. This works only when the current service provider for the phone is the Verizon network. 6.4.2 Manual Activation To manually program CM52 with the information, NAM programming is used. Refer to the next section in the User Scenarios for more information on programming the NAM. In most cases, the default values already programmed into the CM52 in the factory are the correct operating values and the user has to program only the MIN. However, the service provider could decide to use different values, so at least the user should read the parameter values and compare with the values provided by the

Document number
137(158)
Revision
1/198 17-4/FCP 101 3045 Uen
service provider. The table below lists the NAM programming tags that correspond to the necessary information. The tag refers to the tag number in the parameter table in chapter 4.3.2. Information MIN AMPS_Home_SID AMPS_IPCH Unlocked_Home_SID/NID CDMA_Primary_CH_A CDMA_Second_CH_A CDMA_Primary_CH_B CDMA_Second_CH_B Default value 000000<last 4 digits o ESN> 69 333 0:69:65535 283 691 384 777 Tag 1 25 26 15 17 18 19 20 Description 10 digit phone number Home System ID for AMPS operation AMPS Initial Paging channel Home System ID for CDMA operation Primary channel for band A Secondary channel for band A Primary channel for band B Secondary channel for band B
For more information regarding programming the NAM refer to the NAM programming user scenario.
6.5
NAM Programming
NAM programming stands for reading and writing configurable parameters stored in non-volatile memory space of the CM52. The parameters are defined in the AT command reference section together with the description of the AT*ERNAM command that is used for reading and writing the NAM. The purpose of this chapter is to demonstrate the NAM programming mechanism using examples. Before studying the examples, the user has to be familiar with NAM programming. The following AT commands are part of NAM programming: AT*ESCAN AT*ERNAM AT*ERPRL AT*ESSE Suspend/Resume CM52 Read and Write NAM Preferred Roaming List Switch between NAMs
Note: The MoST tool provided by SEMC is used for accessing the NAM. It is recommended that you explore MoST before using it to read from and write to the NAM via AT commands. 6.5.1 Enter NAM programming mode The CM52 has to be in suspended state (no network communication) before any writing to the NAM can be performed. The NAM can be read without going into a suspended mode. When the NAM programming is done, CM52 has to exit suspended state to reinitiate the network communications. The following scenario will take the user through the necessary preparations. While studying this example, it is necessary to know how the NAM AT commands are structured and what the parameters mean. Command/Response (in gray) AT*ESCAN=0 OK Description Set CM52 in suspended state

Document number
138(158)
Revision
1/198 17-4/FCP 101 3045 Uen
CM52 is now able to receive the AT*ERNAM command for writing the NAM and AT*ERPRL for writing the Preferred Roaming List that is also stored in NAM but is accessed via its own AT command. It is recommended that the application wait for the NO SERVICE message before writing to the NAM or PRL. 6.5.2 Read NAM This section provides an example of reading data from the NAM. Each read command specifies what NAM, NAM 1 or NAM 2, to read and the field to be read, which is indicated by the associated tag number. The format and value range of the output parameters are specified as part of the description of the AT*ERNAM command. Some of the fields are the same for NAM 1 and NAM 2 and some are different. The example starts with reading the MIN from NAM1 and from NAM 2. The rest of the example will always read from NAM1. The following information is read: MIN, PRL list ID, Home SID/NID pairs, and CDMA channel. Command/Response (in gray) AT*ERNAM=0,0,1 *ERNAM: 0,1,9191234567 OK AT*ERNAM=0,1,1 *ERNAM: 1,1,9199876543 OK AT*ERNAM=0,0,3 *ERNAM: 0,3,50014 OK AT*ERNAM=0,0,15 *ERNAM: 0,15,0:69:65535 *ERNAM: 0,15,1:0:0 OK AT*ERNAM=0,0,17 *ERNAM: 0,17,283 OK 6.5.3 Write NAM This section provides an example of writing data to NAM. Some of the fields are the same for NAM 1 and NAM2 and some are different. The example below writes the following information to NAM 1 only: CDMA secondary channel for A side, AMPS Home SID and adding a SID/NID pair for Home SID/NID. Command/Response (in gray) Example of changing channel number and SID: AT*ERNAM=1,0,18,691 OK AT*ERNAM=1,0,25,69 OK Change CDMA secondary channel, A side, to 691 Change AMPS Home SID to 69 Description Description Read MIN from NAM 1, tag=1 CM52 returns 0 for NAM1, tag number and the 10 digit phone number stored in the MIN field. Read MIN from NAM 2, tag=1 A different phone number can be programmed if CM52 is used for two separate accounts. Read PRL (Preferred Roaming List) ID Id is 50014
Read Home SID/NID pair list Format is index:SID:NID. Index 0 has SID=69 Index 1 has SID=0, meaning end-of-list
Read CDMA primary channel for A side Channel is 283

Document number
139(158)
Revision
1/198 17-4/FCP 101 3045 Uen
AT*ERNAM=0,0,15 *ERNAM: 0,15,0:69:65535 *ERNAM: 0,15,1:75:10000 *ERNAM: 0,15,2:0:0 OK AT*ERNAM=1,0,15,2:85:11000 OK AT*ERNAM=0,0,15 *ERNAM: 0,15,0:69:65535 *ERNAM: 0,15,1:75:10000 *ERNAM: 0,15,2:85:11000 *ERNAM: 0,15,3:0:0 OK
Read Home SID/NID pair list, index:SID:NID Index 0 and 1 have information SID or NID set 0 indicates rest of list empty
Add an entry We can now see information in index 0, 1 and 2
Index 3 is now end of list
6.5.4 Writing a PRL This section demonstrates how to write a PRL into the module. Creation of the actual PRL data generated is not described here. The PRL data to write in this example is: {0x00, 0x15, 0x00, 0x0B, 0x01, 0x00, 0x80, 0x02, 0x23, 0x10, 0x00, 0x01, 0x40, 0x00, 0x20, 0x00, 0x0E, 0x01, 0x01, 0xB6, 0x05}. The data must be first converted to hexcoded octets since binary data is not valid in AT commands (character interface). For example, 0x15 translates to 0x31 & 0x35 or characters 1 & 5. As a result the data above becomes: 0015000B0100800223100001400020000E0101B605 Command/Response (in gray) AT*ERPRL=1,0,0,42,0,0015000B0100800223100001400020000E0101B605 *ERPRL: 0,0 OK 6.5.5 Reading a PRL This section demonstrates how to read a PRL from the module. Refer to section 4.3.3 for the command description. Command/Response (in gray) Read the PRL after the write from previous example AT*ERPRL=0,0,0,240 *ERPRL: 0015000B0100800223100001400020000E0101B605,0 OK Read a portion of the PRL after the write from the previous example AT*ERPRL=0,0,0,10 *ERPRL: 0015000B010080022310,11 OK 6.5.6 Exit NAM programming mode When the NAM programming (writing and reading) is finished, CM52 has to exit suspended mode using the AT*ESCAN command. The module then rescans for service.

Document number
140(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Example: Command/Response (in gray) AT*ESCAN=1 OK
6.6
Unsolicited Messages
The CM52 has the capability to asynchronously notify the user of events occurring within the module; some message data can be queried via AT command, other information cannot. Unsolicited message reporting on the CM52 is enabled and disabled via the AT*EUNSOL command. The second parameter is a bitwise operator. Refer to the AT command manual for a complete list of unsolicited messages. To enable all unsolicited messages enter AT*EUNSOL=1,FFFFFFFF. To disable all unsolicited messages enter AT*EUNSOL=0,FFFFFFFF. It is recommended that the user turn on all unsolicited messages while becoming familiar with the CM52. A significant amount of useful data is provided by the unsolicited messages, such as caller ID, state changes, service data, etc.
6.7
Call Processing
6.7.1 Call origination Use ATD to dial a number. Ex: ATD9194721379. 6.7.2 Answer Incoming Call Notification of an incoming call is a RING message is presented on the CM52 serial port. Answer the call by entering ATA on the serial port. Auto answer capability can also be used, refer to ATS0. Note: Auto answer is always enabled for loopback test calls. 6.7.3 Hang Up Call Hang up a call by entering ATH. 6.7.4 DTMF tones while on a call When on a call, ATD is used to send DTMF tones. ATD2 is equivalent to pressing the 2 key on a traditional handset. ATD1234 sends tones 1234; use ATS11 to define the duration and spacing of the tones.
6.8
Subscriber Calling Features
Subscriber Calling Features provides voice call services beyond making a single call. The services are to a large extent implemented on the network side and can therefore vary between different operators. The examples below are for the service provider Verizon but should apply for most operators. The typical difference is the Function Code. The services supported by CM52 are: Caller ID Call Forward Call Waiting Three-way calling

Document number
141(158)
Revision
1/198 17-4/FCP 101 3045 Uen
The mechanism used for all services is sending the Flash or Flash with info messages to the network. The ATD! AT command is used for sending the Flash message and ATD!<Function code + information> is used for sending Flash with info. 6.8.1 Caller ID The user can enable or disable the phone number (caller ID) from being sent to the called party. The mechanism is controlled by the service provider. Please contact your service provider for instructions on how to use this service. 6.8.2 Call Forward This service enables the user to forward an incoming call to another phone number or to the mail box. Incoming calls can be specified to be forward on the following conditions: Always forward all calls (CFU) Forward incoming calls only if CM52 is busy (CFB) Forward incoming calls only if they have not been answered within a certain number of rings (CFNA) The Call Forward services are performed using a service provider specific Function code. The example below is for Verizon. For other service providers, please contact the service provider for the correct Function codes. Command/Response (in gray) Description
Example: Activate Call Forward for all calls (Activation Function code for Verizon is *71) ATD*719191234567 OK Activate Call Forward Unconditionally to phone number 9191234567
Example: Deactivate Call Forward (Deactivation Function code for Verizon is *710) ATD*710 OK Deactivate Call Forward
6.8.3 Call Waiting If a call is received while already engaged in a call, an indication will be given of the new incoming call, provided that the Call Waiting service is enabled and the network supports the feature. Contact your service provider to learn how to enable and disable the Call Waiting feature. The new incoming call can be accepted, rejected, or ignored. Example of accepting an additional incoming call: Command/Response (in gray) AT*EUNSOL=1,00000002 OK RING RING ATA OK *EUNSOL: CALL WAITING, 9194721226 ATD! OK ATD! Description Activate unsolicited call waiting message. Call CM52 from another phone.
Answer the first call Call CM52 from yet another phone. Call waiting indication on new incoming call Put the first call on hold and activate the second call Put the second call on hold and activate the first call

Document number
142(158)
Revision
1/198 17-4/FCP 101 3045 Uen
OK 6.8.4 Three-way calling Three-way calling is the service where multiple (3) calls can be active simultaneously. The example below shows how the CM52 originates two separate calls and then connects them all together. Command/response (in gray) ATD1234567 OK ATD!9876543 OK ATD! OK ATD! OK ATH OK Description Dial the first phone number Dial second call using Flash with info and phone no Send a Flash message to activate both calls Disconnect the second party, first party is still active Hang-up call
6.9
SMS
6.9.1 Mobile Originated (MO) Messages Use AT+CSSM to send an SMS message. Note: AT+CSSM has quite a few optional parameters for advanced SMS options. 6.9.1.1 Sending Text Data to MIN Send a text message to MIN 123.456.7890. Note: The default values for the optional parameters are used in this example. AT+CSSM=1234567890,SMS message example +CSSM: 9 OK 6.9.1.2 Sending binary data Send a binary message to MIN 123.456.7890. Note that the user header data is specified to be 10 for hex data. The message is composed of the hex codes for the ASCII sring 135792468. AT+CSSM=1234567890,313335373932343638,,,10 +CSSM: 8 OK 6.9.1.3 Sending Text to Email Address SMS messages can be sent from the CM52 to an email address. Carriers will use either standard or nonstandard email addressing techniques. The CM52 can be configured to enable the technique used by the carrier via NAM programming. If the non-standard addressing is used, refer to the note associated with the AT+CSSM description. This example sets the <type> parameter to 46 to specify an internet address. AT+CSSM=emailaddr@domain.com,email SMS,,46 +CSSM: 64

Document number
143(158)
Revision
1/198 17-4/FCP 101 3045 Uen
OK 6.9.2 Mobile Terminated (MT) Messages MT messages are immediately sent to the application via the unsolicited message of +CSTD. The message is NOT saved in the module. Note: During a data call the multiplexer should be used to prevent an unsolicited message from not reaching the application because there is no channel available to send the data. 6.9.2.1 Temporarily store SMS Messages As a means to explore SMS messages while on a data call without having to write a multiplexing application, SEMC suggests a temporary modification to receiving SMS messages. To test incoming SMS presentation while on data, it is recommended that the SMS message be stored to memory and presented to the user after the data call is complete. Issue AT+CSRI=2,0 to save the messages. Issue AT+CSLM to list all the stored messages. After a message has been read from storage it is removed from storage. Note: The CM52 only stores 10 SMS messages before it indicates to the network that there is no space available to store an incoming message (the CM52 will also produce an unsolicited message to the application that the buffer space is full). To erase the stored messages, list all the available messages (AT+CSLM=2).
6.10
Data Communication
The intent of this section is to provide guidelines on how to set up CDMA data services using a dial-up networking interface on a Windows based PC for the CM52. 6.10.1 Prepare CM52 for Data services To use the data service features on the CM52, the following steps must be taken: 1. Make sure CM52 is set up correctly. Refer to section Acquiring Cellular Service. 2. To make a QNC or a 1xRTT HSPD call on the Verizon network, the account must have one of the NationalAccess plans enabled. If not, call Verizon. 3. Ensure that the RS232 cable between the PC and the module is properly connected. 4. Set up the PC to support the CM52, as described below. 6.10.2 CM52 Windows NT PC Installation Procedure Go to Start->Settings->Control Panel and select the Modems icon. Click the Add button, which will pop up a window titled, Install New Modem. Select check box Dont detect my modem; I will select it from a list. And click Next. Select Have Disk and browse to the CM52 INF file, cm52.inf, and select Open. Select OK on the Install From Disk pop-up window. Select the Sony Ericsson CM52 Modem and click Next. Select the COM port attached to the CM52 and click Next. Select Finish. Now highlight CM52 Modem and select Properties to set up the modem speed. Set Maximum Port Speed to the CM52 baud rate, 115200 by default, and click OK. Close the Modems Properties window. Windows will ask to re-configure Dial-up Networking. Select Yes. The Remote Access Setup Window will pop-up. Select Add. Select the CM52 Modem device and select OK.

Document number
144(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Select Continue. The CM52 device will be installed. It is mandatory to have the baud rate of the modem, dial-up network, and CM52 set to the same value to prevent failure to establish data calls. 6.10.3 To Make an Asynchronous Data Call (CSD) 1) Prepare the CM52 and the PC as described above. 2) Open a terminal program, such as HyperTerminal. 3) Issue the following AT commands: a) On the originating party, AT+COS=4,x where i) for service option 4, x=1 ii) for service option 12, x = 2 (default value) iii) for service option 4100, x = 3 b) On the terminating party, AT+COS=4,0,x where x is described above. 4) Establish the call: a) Either use ATD to originate the call, or b) use ATA to answer an incoming call (or set ATS0=1 for auto-answer) 5) When the CONNECT message is displayed, the data call is established and additional applications can be started. 6) To end the call, a) Issue the escape sequence +++, enter <CR>, and wait for <OK>. b) Then send ATH to release the call 7) Reset the class of service to its default, a) AT+COS=3 6.10.4 To Make a QNC Data Call (Packet over Circuit Switched) 1) Prepare the CM52 and the PC as described above. 2) Depending on what other services the CM52 was previously providing, it may be necessary to issue the following AT commands in this order from a HyperTerminal: a) AT$QCMIP=0 b) AT$QCMDR=2 3) Close HyperTerminal and launch Dial-Up Networking. 4) Configure Dial-Up Networking: a) Dial Using: Sony Ericsson CM52 Modem b) Phone Number: #777 5) At the Verizon network login prompt, enter: a) Username: qnc b) Password: qnc 6.10.5 To Make a 1x HSPD Call, Simple IP only on Verizon 1) Prepare the CM52 and the PC as described above. 2) Depending on what other services the CM52 was previously providing, it may be necessary to issue the following AT commands from a HyperTerminal: a) AT$QCMIP=0 b) AT$QCMDR=3 (default setting upon reset) c) AT$QCSO=2 (default setting upon reset) d) AT+CMUX=C,2 (default setting upon reset) 3) Close HyperTerminal and launch Dial-Up Networking. 4) Configure Dial-Up Networking: a) Dial Using: Sony Ericsson CM52 Modem b) Phone Number: #777 c) Username: <MDN>@vzw3g.com where <MDN> is the CM52s 10-digit Mobile Directory Number. Refer to NAM programming to acquire the MDN if it is not known. d) Password: vzw

Document number
145(158)
Revision
1/198 17-4/FCP 101 3045 Uen
6.10.6 To Make a 1x HSPD Call, Mobile IP Preferred on Verizon 1) Prepare the CM52 and the PC as described above. 2) A DMU file, necessary for Verizon MIP, should have been provisioned by default. 3) The mobile directory number (aka MDN) should have been provisioned, either by the carrier through an over the air provisioning session (*228 call) or through NAM programming (AT*ERNAM=1,0,14,x). 4) Depending on what other services the CM52 was previously providing, it may be necessary to issue the following AT commands from a HyperTerminal: a) AT$QCMIP=1 (default setting upon reset) b) AT$QCSO=2 (default setting upon reset) c) AT+CMUX=C,2 (default setting upon reset) 5) Close HyperTerminal and launch Dial-Up Networking. 6) Configure Dial-Up Networking: a) Dial Using: Sony Ericsson CM52 Modem b) Phone Number: #777 c) Username: <MDN>@vzw3g.com where <MDN> is the CM52s 10-digit Mobile Directory Number. Refer to NAM programming to acquire the MDN if it is not known. d) Password: vzw
6.11
Location Determination Call Flows
Location Determination Call Flows are not currently present within the CM52. The following is our intended design should there be a requirement from a customer. Note: Even if a request from a customer is present, the solution must be agreed upon by the carrier. Location determination capabilities may or may not be a requirement of the application. The CM52 supports location determination in two cases; the CM52 can be configured such that a GPS receiver is present on the CM52 board, or the GPS receiver can be part of the end application. Make note of the persistent settings for whether location determination is required (AT*EPDMOD) and whether the network calculated position is to be returned to the application (AT*EPDRL). 6.11.1 External GPS In the External GPS configuration, the application contains the GPS receiver. Note: the CM52 requests satellite measurements from the application. The application can either provide the data if the data is available, or reject the request if there is no satellite data. If the application rejects the data, the network will fall back to using the base station data that the CM52 provides to the network (AFLT).

Document number
146(158)
Revision
1/198 17-4/FCP 101 3045 Uen
6.11.2 Internal GPS In the Internal GPS configuration, the GPS receiver is part of the CM52. The implementation within the CM52 is such that if there is GPS data available, it is used. If there is no GPS data available, the CM52 does NOT use buffered or saved data; but rather informs the network that there is no GPS data. The network then falls back to using the base station information provided (AFLT).
6.12
Application Wake-up Examples
The following are use cases of several scenarios regarding the wakeup operations. Not every case has been detailed; but rather a few examples are presented to show the flexibility of the functionality. 6.12.1 Single Event Case In this scenario the host application is only interested in receiving notification of mobile terminated SMS and data calls when the host application has been powered down (and the CM52 is left powered up). When an event is processed the application powers back down. An MT voice call is ignored followed by an MT SMS, which is processed. Application Inform module of MT SMS and data call notification: AT*EWAKESET=0018 Ensure the SMS buffer is empty: AT+CSLM=2 Prepare to power down: AT*EWAKE? Power down Module Radio updates NV to store setting Return any outstanding SMS messages AT*EWAKE clears the wakeup reasons Remain powered on

Document number
147(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Application
The change in the RI pin is sensed. Power up Determine wakeup reason: AT*EWAKE? Read the stored message: AT+CSLM=2 Prepare to power down: AT*EWAKE? Power down
Module A MT voice call is received, no action taken. A MT SMS is received Set the wakeup event flag for SMS The ring indicator is asserted Returns wakeup reason: *EWAKE: 0010 Return the received message: +CSLM: x AT*EWAKE clears the wakeup reasons Remain powered on
6.12.2 Multiple Event Case In this scenario the host application is only interested in receiving notification of mobile terminated SMS and data calls when the host application has been powered down (and the CM52 is left powered up). When an event is processed the application powers back down. A MT SMS and MT data call simultaneously occur. Application Inform module of MT SMS and data call notification: AT*EWAKESET=0018 Insure the SMS buffer is empty: AT+CSLM=2 Prepare to power down: AT*EWAKE? Application powers down Module Radio updates NV to store setting Return any outstanding SMS messages AT*EWAKE clears the wakeup reasons Remains powered on A MT SMS is received Set the wakeup event flag for SMS The ring indicator is asserted An incoming data call is received Set the wakeup event flag for a Data call The RI is already asserted so do not assert again Returns wakeup reason: *EWAKE: 0018 Call is connected Return the received message: +CSLM: x Drop the data call AT*EWAKE clears the wakeup reasons Remain powered on
The change in the RI pin is sensed.
Power up Determine wakeup reason: AT*EWAKE? Answer the data call: ATA Read the stored message: AT+CSLM=2 Terminate data call: ATH Prepare to power down: AT*EWAKE? Power down
6.12.3 RTC Event Case In this scenario the host application is only interested in receiving notification of mobile terminated SMS and data calls at periodic time intervals. The application will remain powered down unless an event occurs whereas the module will power up event 10 minutes and remain awake for 1 minute. After the event is processed, the periodic interval cycle is continued. Application Inform module of MT SMS and data call notification: AT*EWAKESET=0018 Ensure the SMS buffer is empty: AT+CSLM=2 Prepare to power down: AT*EWAKE? Query current time to set up RTC mode to trigger at the correct start time AT*ERTCT? Module Radio updates NV to store setting Return any outstanding SMS messages AT*EWAKE clears the wakeup reasons Radio responds with the current time from the RTC *ERTCT: 091345, 050121

Document number
148(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Application Instructs the module of specific RTC mode AT+CFUN=10,9,1,100, 0920 Release the MODULE_PWR_EN_B pin Power down
Module Radio responds when the RTC mode is active RTC SHUTDOWN COMPLETE
The change in the RI pin is sensed. Power up Set MODULE_PWR_EN_B low Terminate RTC mode: AT+CFUN=1 Determine wakeup reason: AT*EWAKE? Read the stored message: AT+CSLM=2 Prepare to power down: AT*EWAKE? Query current time to set up RTC mode to trigger at the correct start time AT*ERTCT? Instructs the module of specific RTC mode AT+CFUN=10,9,1,100, 0940 Release the MODULE_PWR_EN_B pin Power down
RTC pulls MODULE_PWR_EN_B pin low at 09:20:00 Radio detects MODULE_PWR_EN_B low, initiates power on sequence Radio looks for service and goes idle Radio remains powered on for 1 minute Radio shuts down RTC releases MODULE_PWR_EN_B pin RTC pulls MODULE_PWR_EN_B pin low at 09:30:00 Radio detects MODULE_PWR_EN_B low, initiates power on sequence Radio looks for service and goes idle A MT SMS is received Set the wakeup event flag for SMS The ring indicator is asserted Disables RTC mode
Radio terminates RTC mode RTC releases MODULE_PWR_EN_B Returns wakeup reason: *EWAKE: 0010 Return the received message: +CSLM: x AT*EWAKE clears the wakeup reasons Radio responds with the current time from the RTC *ERTCT: 093120, 050121 Radio responds when the RTC mode is active RTC SHUTDOWN COMPLETE
6.13
RTC Examples
6.13.1 Ring Indicator Example In this example the application would like to go into a power savings mode by power cycling the module every 10 minutes. When the module is power cycled the module remains powered on for one minute. In addition the application itself is powers down as well. However, the application would like to be notified if an MT SMS message is received by the module. The wakeup/sleep mode is to run for 1000 minutes. Application Inform module of MT SMS notification: AT*EWAKESET=0010 Instructs the module of specific RTC mode AT+CFUN=10,9,1,100 Release the MODULE_PWR_EN_B pin Module Radio updates NV to store setting Radio responds when the RTC mode is active RTC SHUTDOWN COMPLETE RTC pulls MODULE_PWR_EN_B pin low after 9 minutes

Document number
149(158)
Revision
1/198 17-4/FCP 101 3045 Uen
Application
Ring Indicator triggers application wakeup Set MODULE_PWR_EN_B low Terminate RTC mode AT+CFUN=1 Poll for wake event reason AT*EWAKE?
Module Radio detects MODULE_PWR_EN_B low, initiates power on sequence Radio looks for service and goes idle Radio remains powered on for 1 minute Radio shuts down RTC releases MODULE_PWR_EN_B pin RTC pulls MODULE_PWR_EN_B pin low after 9 minutes Radio detects MODULE_PWR_EN_B low, initiates power on sequence Radio looks for service and goes idle Radio receives an MT SMS msg Radio disables the <wake> period Radio stores the wakeup event Radio toggles the Ring Indicator Radio terminates RTC mode RTC releases MODULE_PWR_EN_B Radio responds with *EWAKE: 0010
6.13.2 Application Wakeup RTC Example In this example the application would like to go into a power savings mode by power cycling the module every 10 minutes. When the module is power cycled the module will remain powered on for one minute. In addition the application itself is going to power down as well. However the application would like to be notified if an MT SMS message is received by the module. The wakeup mode is to run for 1000 minutes. The wakeup times must be coordinated with a remote service on a schedule time table of 10 minute intervals after the hour. The application, however, is forced to start the module due to an external condition. There are three states the module could be in when the application attempts to start the module. The three cases are detailed below. Note there is an initial step that is consistent for the three examples. Application Inform module of MT SMS notification: AT*EWAKESET=0010 Query current time to set up RTC mode to trigger at the correct start time AT*ERTCT? Instructs the module of specific RTC mode AT+CFUN=10,9,1,100, 0920 Release the MODULE_PWR_EN_B pin Module Radio updates NV to store setting Radio responds with the current time from the RTC *ERTCT: 091345, 050121 Radio responds when the RTC mode is active RTC SHUTDOWN COMPLETE RTC pulls MODULE_PWR_EN_B pin low at 09:20:00 Radio detects MODULE_PWR_EN_B low, initiates power on sequence Radio looks for service and goes idle Radio remains powered on for 1 minute Radio shuts down RTC releases MODULE_PWR_EN_B pin

Document number
150(158)
Revision
1/198 17-4/FCP 101 3045 Uen
6.13.2.1
Module not powered on Module Radio detects MODULE_PWR_EN_B low, initiates power on sequence Restart issued (and possibly *EUNSOL: RTC WAKETIME depending upon timing) Radio terminates RTC mode RTC releases MODULE_PWR_EN_B
Application Wake due to external event Pull the MODULE_PWR_EN_B low Observes the Restart message Terminate RTC mode AT+CFUN=1 6.13.2.2 Module powered on
Application
Module RTC pulls MODULE_PWR_EN_B pin low at 09:30:00 Radio detects MODULE_PWR_EN_B low, initiates power on sequence Radio looks for service and goes idle Radio already running *EUNSOL: RTC WAKETIME repeatedly issued when in RTC mode Radio terminates RTC mode RTC releases MODULE_PWR_EN_B
Wake due to external event Pull the MODULE_PWR_EN_B low Observes the *EUNSOL: RTC WAKETIME message (trigger to indicate module is executing) Terminate RTC mode AT+CFUN=1 6.13.2.3
Module powered on and currently powering down Module RTC pulls MODULE_PWR_EN_B pin low at 09:30:00 Radio detects MODULE_PWR_EN_B low, initiates power on sequence Radio looks for service and goes idle Radio remains powered on for 1 minute Radio initiates shuts down, pulls the HW_SD pin low
Application
Wake due to external event Pull the MODULE_PWR_EN_B low Radio completes shutdown and instructs the RTC to release MODULE_PWR_EN_B The radio observes the MODULE_PWR_EN_B is still low so the radio restarts Restart issued (and possibly *EUNSOL: RTC WAKETIME depending upon timing) Radio terminates RTC mode RTC releases MODULE_PWR_EN_B
Observes the Restart message Terminate RTC mode AT+CFUN=1

Document number
151(158)
Revision
1/198 17-4/FCP 101 3045 Uen
7
7.1
Test Scenarios
Running CAIT/QXDM with the CM52
These scenarios evolve more around network and carrier testing.
Qualcomm diagnostic messages are available on either the 2nd UART or the USB connection depending upon the module variant. Diagnostic messages are always enabled on the CM52 and defaulted to 115200 baud. Note: The baud rate cannot be changed via an AT command but can be set at the factory, refer to the PRI. It is recommended that the highest baud rate possible be used; doing so will reduce serial port congestion and reduce the number of dropped messages. Run the CAIT tool (or QXDM), ensuring the COM port is on the correct port.
7.2
Programming the correct PRL using External Tools
The CM52 is configured with a generic PRL; it is recommended that a more purposeful PRL be loaded prior to testing. The PRL can be programmed using AT commands; however, it is recommended that a PRL programming tool be used for convenience and accuracy. The MoST tool, which is supplied with the CM52, is one candidate. QPST is another tool provided by Qualcomm.
7.3
MOB_P_REV
AT*ECPREV? is used to report to the user what the agreed CDMA protocol revision is in use. AT*EPREV can be used to force the CM52 to behave as the specified protocol revision. AT*EPREV=3 will force the CM52 to behave as an IS95A device.
7.4
Modifying the Service
AT*EPMOD can force the module to AMPS, Digital or Digital Preferred (it does NOT restart the CM52 as it did on the CM-42). Note the command is persistent over restarts (power cycles) of the CM52. Analog Only Operation use AT*EPMOD=1. Digital Only Operation use AT*EPMOD=2. Automatic Operation (Digital Preferred) use AT*EPMOD=0.
7.5
Set Voice Privacy
Voice privacy is set using the service option command of AT+COS AT+COS=3,0,0,1 to enable Voice Privacy AT+COS=3,0,0,0 to disable Voice Privacy To query voice privacy mode issue AT+COS? And check the forth parameter returned.
CM-42 Software Compatibility
The CM52 and CM-42 are largely compatible; however, there are differences between the two products. Decisions regarding changes in the CM52 were made based on the following factors: Removing duplicate AT commands Evaluation of features that are better placed in the application and not the modem Evaluation of what featured needed to be present Supporting Qualcomm AT commands over SEMC equivalent AT commands

Document number
152(158)
Revision
1/198 17-4/FCP 101 3045 Uen
8.1
CM-42 SMS
Features
CM52 SMS Notes SMS is supported in the CM52; the implementation is different Fax is not a requirement GPIO is not a requirement Addition of Verizon Mobile IP support
FAX GPIO 1x Async QNC E911 (phase 1) E911 (phase 2) NAM Audio Phonebook Call Barring Calling/Credit card calls Voice Call Control OTASP/OTAPA Subscriber Calling features Unsolicited Messages Antenna Support Registration Control
1x Async QNC E911 (phase 1) E911 (phase 2) NAM Audio
Voice Call Control OTASP/OTAPA Subscriber Calling features Unsolicited Messages Antenna Support Registration Control NV Recovery Serial Multiplexer
Implementation is slightly different AT*ERMMA removed; use AT*ESCAN A few commands have been removed Left to the application No phonebook support Left to the application No call barring support Left to the application No calling card support MSM6025 chipset only supports EVRC vocoder Suspend dialing not supported in the CM52
Enhanced
Not available in the CM-42 Not available in the CM-42
8.2
AT Command Differences
The list indicates what differences can be expected at an AT command level. It is highly recommended that the parameter level be inspected too. There are cases where the parameters associated with AT commands have changed. As stated in the Overview section, the CM52 does not support the test version of the AT commands. CM-42 AT AT$QCMIP AT$QCMIPEP AT$QCMIPGETP AT$QCMIPHA AT$QCMIPMASPI AT$QCMIPMASS AT$QCMIPMHSPI AT$QCMIPMHSS AT$QCMIPNAI AT$QCMIPP AT$QCMIPPHA AT$QCMIPRT AT$QCMIPSHA AT$SPNAI AT&C AT&D CM52 AT AT$QCMDR AT$QCMIP AT$QCMIPEP AT$QCMIPGETP AT$QCMIPHA AT$QCMIPMASPI AT$QCMIPMASS AT$QCMIPMHSPI AT$QCMIPMHSS AT$QCMIPNAI AT$QCMIPP AT$QCMIPPHA AT$QCMIPRT AT$QCMIPSHA AT$QCQNC AT&C AT&D Notes Replaces AT*EQMDR
Replaces AT*EQQNC Not Supported (Sprint support)

Document number
153(158)
Revision
1/198 17-4/FCP 101 3045 Uen
CM-42 AT&F AT&V AT* AT*CSO AT*EAFF AT*EAGVS AT*EAMS AT*EANTDIAG AT*EANTLIM AT*EAPCS AT*EASW AT*ECAM AT*ECARRIER AT*ECBAR AT*ECBAR2 AT*ECDF AT*ECIF AT*ECLOG AT*ECPREV AT*ECURTAG AT*EDISPCMD AT*EDMB AT*EDCLR AT*EDCTR AT*EDFMTP AT*EDFREG AT*EDMBIO AT*EDMFE AT*EDMIN AT*EDRDG AT*EDRLP AT*EDSCTR AT*EDSDG AT*EDSERV AT*EDSN AT*EDTXS AT*EDWDG AT*EECC AT*EECMS AT*EGODIAG AT*EGPI AT*EGPIO AT*EGPIOS AT*EGPO AT*EIDSUM AT*EINCSO AT*ELSI
CM52
Notes Not Supported Not Supported Not Supported Not Supported Not Supported
AT*EAFF AT*EAMS AT*EANTDIAG AT*EANTLIM Part of the CM52 PRI settings AT*EASW AT*ECALLERID AT*ECAM New support for the CM52 CM52 Does not display called number or calling status Not Supported No Call Barring support No Call Barring support No calling card support No calling card support No phonebook support New support for the CM52 Duplicate command Format will be what Qualcomm provides CM52 does not support message boxes CM52 functions as register only, no I/O (MicroBurst) (MicroBurst) (MicroBurst) CM52 does not support I/O, command generates error (MicroBurst) CM52 detects all page types, cannot enable 32-bit counter on I/O (MicroBurst) (MicroBurst) (MicroBurst) (MicroBurst) CM52 does not support I/O, command generates error (MicroBurst) (MicroBurst) Need to convert hex to decimal (MicroBurst) (MicroBurst) Not Supported Not Supported Diagnostics always active on CM52 Not Supported Not Supported Not Supported Not Supported Not Supported No support for locking messages
AT$QCPREV AT*ECSTAT AT*ERNAM=0,0,4 AT*EDMB AT*EDCLR AT*EDCTR AT*EDFMTP AT*EDFREG AT*EDMBIO AT*EDMFE AT*EDMIN AT*EDRDG AT*EDRLP AT*EDSCTR AT*EDSDG AT*EDSERV AT+GSN AT*EDTXS AT*EDWDG
AT*EIDSUM

Document number
154(158)
Revision
1/198 17-4/FCP 101 3045 Uen
CM-42 AT*EMEMUSED AT*EMOD AT*EMRUCLR AT*EMSI AT*ENESC AT*ENETTIME AT*ENSERV AT*EOTAPAS AT*EPCMR AT*EPDCAC AT*EPDLR AT*EPDMOD AT*EPDMS AT*EPDPPM AT*EPDPR AT*EPDREJ AT*EPDRL AT*EPMOD AT*EPREV AT*EQMDR AT*EQQNC AT*EQVAD AT*ERCF AT*ERCLCK AT*ERD AT*ERDCC AT*EREGC AT*EREGF AT*EREGT AT*ERESCAN AT*ERKRC AT*ERMMA AT*ERNAM AT*ERPRL AT*ERRCT AT*ERRLC AT*ERSTCT AT*ESCAN AT*ESCN AT*ESMB AT*ESMSAD AT*ESMUNRD AT*ESNAP AT*ESRB AT*ESSE AT*EUNSOL
CM52 AT*EIDSUM AT*EMRUCLR AT*EMUX AT*ENESC AT*ENETTIME AT*ENSERV AT*EOTAPAS AT*EPCMR AT*EPDCF
Notes No long time message storage on the CM52
No support for locking messages New support for the CM52 CM52 supports several reporting format options Several parameters differ CM52 does not support Bluetooth options New location determination implementation on CM52 New to the CM52 (location determination) New location determination implementation on CM52 New location determination implementation on CM52 New location determination implementation on CM52 New location determination implementation on CM52 CM52 does not use Session flag Several parameters differ Several parameters differ No longer causes the module to restart. Also supports additional optional parameters Duplicate command Duplicate command Not Supported No calling card support No SPC/SLC lock on NAM programming commands Suspending dial was not a requirement No calling card support No home/roam or digital/analog differentiation in CM52 New support for the CM52 Not Supported
AT*EPDPR AT*EPDREJ AT*EPDRL AT*EPMOD AT*EPREV AT$QCMDR AT$QCQNC
AT*EREGC AT*EREGF
AT*EIDSUM AT*ESCAN AT*ERNAM AT*ERPRL
Removed ERMMA because it restarted the module
AT*ERTCT AT*ESCAN
No phonebook support No phonebook support No phonebook support New support for the CM52 No calling card support No long time message storage on the CM52 No long time message storage on the CM52 New support for the CM52 Not Supported Duplicate command (restart msg always displayed) Mask numbers shifted New to the CM52
AT*ESMSFLTR AT*ESNAP AT+IPR AT*ESSE AT*EUNSOL AT*EUNSOLM

Document number
155(158)
Revision
1/198 17-4/FCP 101 3045 Uen
CM-42 AT*EVMUNRD
CM52
AT*EWAKE AT*EWAKESET AT*OACQPRL AT*OACQTYPE AT+CAD AT+CBC AT+CBIP AT+CDR AT+CDS AT+CDV AT+CFC AT+CFG AT+CFUN AT+CGCAP AT+CGMI AT+CGMM AT+CGMR AT+CGSN AT+CHV AT+CIMI AT+CLVL AT+CMEE AT+CMIN AT+CMIP AT+CMUT AT+CMUX AT+COS AT+CPAS AT+CPBF AT+CPBR AT+CPBS AT+CPBW AT+CPIN AT+CQD AT+CRC AT+CRM AT+CSDCN AT+CSDDD AT+CSDH AT+CSDM AT+CSDPI AT+CSDSH AT+CSDUH AT+CSDVP AT+CSLM AT+CSMA AT+CSME AT+CSMH AT+CSMS
Notes Data provided as an unsolicited message, application can store value New support for the CM52 New support for the CM52 CM-42 MicroBurst CM-42 MicroBurst Not Supported Not Supported Not Supported Not Supported Duplicate command Not Supported Not Supported CM52: Added functionality if Real Time Clock is present Duplicate command Duplicate command Duplicate command Duplicate command Duplicate command Duplicate command Involves concatenating several NAM tags Expanded set of error codes including MicroBurst Duplicate command Not Supported
AT+CAD
ATD
AT+CFUN AT+GCAP AT+GMI AT+GMM AT+GMR AT+GSN ATH AT*ERNAM AT+CLVL AT+CMEE AT*ERNAM=0,0,1 AT+CMUT AT+CMUX AT+COS AT+CPAS
Several parameters differ CM52 does not report band/channel/service No phonebook support No phonebook support No phonebook support No phonebook support No user PIN support Not Supported
AT+CRC AT+CRM AT+CSSM AT+CSSM AT+CSSM AT+CSDM AT+CSSM AT+CSSM AT+CSSM AT+CSSM
Use send options Use send options Use send options Use send options Use send options Use send options Use send options Only an inbox is supported on the CM52 (listed messages are then removed from the storage area) Application can build ack message Encoding is defined by the flag in the SMS message No hold box Not applicable (only CDMA support available)
AT+CSSM

Document number
156(158)
Revision
1/198 17-4/FCP 101 3045 Uen
CM-42 AT+CSPC AT+CSQ AT+CSRI AT+CSRM AT+CSS AT+CSSM AT+CSWH AT+CTA AT+CUDAH AT+CXT AT+DR AT+DS AT+EB AT+EFCS AT+ER AT+ES AT+ESR AT+ETBM AT+FCLASS AT+GCAP AT+GMI AT+GMM AT+GMR AT+GSN AT+ICF AT+IFC AT+ILRR AT+IPR AT+MA AT+MR AT+MS AT+MV18R AT+MV18S AT+PZID AT+WS46 ATA ATD ATD! ATD> ATE ATH ATO ATQ ATS0 ATS10 ATS11 ATS2 ATS3 ATS4 ATS5 ATS6 ATS7
CM52 AT+CSSM AT+CSQ AT+CSRI AT+CSRM AT+CSS AT+CSSM AT+CTA AT+CSSM
Notes Use send options CSTD/store option not supported in CM52 Removes message from storage after it is read CM52 adds 99999 indication to NID parameter Format of the optional parameters has changed No hold box Use send options Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported
AT+GCAP AT+GMI AT+GMM AT+GMR AT+GSN Not Supported AT+IFC AT+IPR Not Supported CM52 supports different set of data rates Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported (Sprint support) Duplicate command CM52 handles overdial as subsequent command CM52 does not support semicolon No phonebook support
AT*EPMOD ATA ATD ATD! ATE ATH
Not Supported Not Supported ATS0 ATS10 ATS11 ATS2 ATS3 ATS4 ATS5 ATS6 ATS7

Document number
157(158)
Revision
1/198 17-4/FCP 101 3045 Uen
CM-42 ATS8 ATS9 ATV ATZ
CM52 ATS8 ATS9
Notes
Not Supported Not Supported
8.3
CM-42 Restart RING CONNECT
Unsolicited Message Differences

CM52 Restart RING CONNECT OFFLINE *EUNSOL: MSG *EUNSOL: CALL WAITING *EUNSOL: SERVICE *EUNSOL: RSSI *EUNSOL: CALLER ID Notes
*EUNSOL: MSG *EUNSOL: CALL WAITING *EUNSOL: SERVICE *EUNSOL: RSSI *EUNSOL: CALLER ID *EUNSOL: STATE *EUNSOL: CHANNEL *EUNSOL: CALL END *EUNSOL: SMS SUBMIT *EUNSOL: SMS MOERR *EUNSOL: PHONEBOOK *EUNSOL: DISPLAYEVENT *EUNSOL: OTA *EUNSOL: PINGRING *EUNSOL: SMS BUFFER FULL *EUNSOL: CALL STATE *EUNSOL: REGISTRATION *EUNSOL: ALERT
New for the CM52 SMS messages no longer reported (see AT+CSRI)
Obsolete Obsolete *EUNSOL: CALL END *EUNSOL: SMS SUBMIT Added BS cause code (SMS MOERR) Merged into *EUNSOL: SMS SUBMIT No phonebook feature in CM52 *EUNSOL: DISPLAY *EUNSOL: OTA *EUNSOL: PINGRING *EUNSOL: SMS BUFFERFULL *EUNSOL: CALL STATE *EUNSOL: REGISTRATION *EUNSOL: MODE *EUNSOL: SERVICE STATE *EUNSOL: USER ZONE *EUNSOL: PRIVACY *EUNSOL: FAILURE,ANTENNA *EUNSOL: ANTENNA *EUNSOL: NV Restore *EUNSOL: RTC Suspend dialing not supported in the CM52 New for the CM52 New for the CM52 New for the CM52 New for the CM52
*EUNSOL: FAILURE, ANTENNA *EUNSOL: ANTENNA
New for the CM52 New for the CM52

Document number
158(158)
Revision
1/198 17-4/FCP 101 3045 Uen
CM-42 *EPDSESSION *EPDMS *EPDPPM *EPDRL *EPDPR *EPDLR *EPDREJ *EPDCAC *ECAV +CSTD +CSTI *EUNSOL: MICRO,10,dd *EUNSOL: MICRO,96,<type>,<er ror_code> *EUNSOL: MICRO,97,<type>,<er ror_code> *EUNSOL: MICRO,4,TX DONE *EUNSOL: MICRO,7 *EUNSOL: MICRO,8
CM52
Notes New location determination implementation on CM52 New location determination implementation on CM52 New location determination implementation on CM52 New location determination implementation on CM52
*EPDPR *EPDLR New location determination implementation on CM52 New location determination implementation on CM52 *ECAV +CSTD +CSTI Parameter format change (MicroBurst) no longer supported *EUNSOL: MICRO,96,<type>,<err or_code>[,<data>] *EUNSOL: MICRO,97,<type>,<err or_code>[,<data>] *EUNSOL: MICRO,4,TX DONE (MicroBurst) CM52 adds expected checksum value for <error_code> = 2 (MicroBurst)CM52 adds expected checksum value for <error_code> = 2 (MicroBurst) Clarification of phone state when this message is displayed. (MicroBurst) CM52 does not support I/O (MicroBurst) CM52 does not support I/O

CM52 at Command Manual Rev R1D

Hochgeladen von

Dokumentinformationen

Originalbeschreibung:

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

CM52 at Command Manual Rev R1D

Hochgeladen von

Copyright:

Verfügbare Formate

Confidential USERS MANUAL

Document number Revision

1/198 17-4/FCP 101 3045 Uen

SEM/BMDSB DAVID DUGUID

This document is managed in metaDoc.

SEM/BMDG (JEREMY ROTH)

Confidential USERS MANUAL

1/198 17-4/FCP 101 3045 Uen

Table of Contents 1 Introduction to the Users Guide Command Manual ________________________________________ 14

Overview of the CM52 Module __________________________________________________________ 17 Functional Description ________________________________________________________________ 17

E911 or Emergency Calls _________________________________________________________________ 20

Short Message Service ____________________________________________________________________ 21 Data Functionality _______________________________________________________________________ 22

Application Wake-up _____________________________________________________________________ 24

3.9 3.10 3.11 3.12

Real Time Clock (RTC) ___________________________________________________________________ 25 Serial Port Multiplexer ___________________________________________________________________ 25

Aeris MicroBurst ________________________________________________________________________ 26 Power Down ____________________________________________________________________________ 26

Confidential USERS MANUAL

1/198 17-4/FCP 101 3045 Uen

4.1.3.2 4.1.3.3 4.1.3.4 4.1.3.5 4.1.3.6

Information and Identification Commands __________________________________________________ 31

NAM Programming ______________________________________________________________________ 50

Call Control ____________________________________________________________________________ 58

Confidential USERS MANUAL

1/198 17-4/FCP 101 3045 Uen

4.4.4 4.4.5 4.4.6 4.4.7

Audio Control ___________________________________________________________________________ 64

Interface Commands _____________________________________________________________________ 67

Module Status and Controls _______________________________________________________________ 76

Error Control ___________________________________________________________________________ 83

4.10.1 4.11.1 4.11.2 4.11.3

Confidential USERS MANUAL

1/198 17-4/FCP 101 3045 Uen

Antenna Capabilities ____________________________________________________________________ 100

Protocol Testing ________________________________________________________________________ 104

4.15.1 4.15.2 4.15.3

Data Testing ___________________________________________________________________________ 106

Depreciated Commands _________________________________________________________________ 115

Confidential USERS MANUAL

1/198 17-4/FCP 101 3045 Uen

4.17.10 4.17.11 4.17.12 4.17.13

Aeris MicroBurst Feature_____________________________________________________________ 121

General Information ____________________________________________________________________ 121

MicroBurst Commands __________________________________________________________________ 122

MicroBurst Unsolicited Messages _________________________________________________________ 131

User scenarios ______________________________________________________________________ 134

NAM Programming _____________________________________________________________________ 137

Confidential USERS MANUAL

1/198 17-4/FCP 101 3045 Uen

6.5.2 6.5.3 6.5.4 6.5.5 6.5.6

Unsolicited Messages ____________________________________________________________________ 140 Call Processing _________________________________________________________________________ 140

Subscriber Calling Features ______________________________________________________________ 140

SMS __________________________________________________________________________________ 142

Data Communication ____________________________________________________________________ 143

6.10.1 6.10.2 6.10.3 6.10.4 6.10.5 6.10.6

Location Determination Call Flows ________________________________________________________ 145

Application Wake-up Examples ___________________________________________________________ 146

6.12.1 6.12.2 6.12.3

RTC Examples _________________________________________________________________________ 148

Test Scenarios ______________________________________________________________________ 151

CM-42 Software Compatibility _________________________________________________________ 151

Confidential USERS MANUAL

1/198 17-4/FCP 101 3045 Uen

8.1 8.2 8.3

Overview of the CM52 Module 17 Functional Description ______ 17

Short Message Service 21 Data Functionality ___ 22

Real Time Clock (RTC) _ 25 Serial Port Multiplexer _ 25

Aeris MicroBurst 26 Power Down ____ 26

Unsolicited Messages 140 Call Processing _____ 140