AirPrime - HL78xx - AT Commands Interface Guide - Rev12 PDF

AirPrime HL78xx
AT Commands Interface Guide
41111821
12
August 04, 2020
Important Notice
Due to the nature of wireless communications, transmission and reception of data can never be
guaranteed. Data may be delayed, corrupted (i.e., have errors) or be totally lost. Although significant
delays or losses of data are rare when wireless devices such as the Sierra Wireless modem are used
in a normal manner with a well-constructed network, the Sierra Wireless modem should not be used
in situations where failure to transmit or receive data could result in damage of any kind to the user or
any other party, including but not limited to personal injury, death, or loss of property. Sierra Wireless
accepts no responsibility for damages of any kind resulting from delays or errors in data transmitted or
received using the Sierra Wireless modem, or for failure of the Sierra Wireless modem to transmit or
receive such data.
Safety and Hazards

Do not operate the Sierra Wireless modem in areas where cellular modems are not advised without
proper device certifications. These areas include environments where cellular radio can interfere such
as explosive atmospheres, medical equipment, or any other equipment which may be susceptible to
any form of radio interference. The Sierra Wireless modem can transmit signals that could interfere
with this equipment. Do not operate the Sierra Wireless modem in any aircraft, whether the aircraft is
on the ground or in flight. In aircraft, the Sierra Wireless modem MUST BE POWERED OFF. When
operating, the Sierra Wireless modem can transmit signals that could interfere with various onboard
systems.
Note: Some airlines may permit the use of cellular phones while the aircraft is on the ground and the door
is open. Sierra Wireless modems may be used at this time.
The driver or operator of any vehicle should not operate the Sierra Wireless modem while in control of
a vehicle. Doing so will detract from the driver or operator’s control and operation of that vehicle. In
some states and provinces, operating such communications devices while in control of a vehicle is an
offence.
Limitations of Liability
This manual is provided “as is”. Sierra Wireless makes no warranties of any kind, either expressed or
implied, including any implied warranties of merchantability, fitness for a particular purpose, or
noninfringement. The recipient of the manual shall endorse all risks arising from its use.
The information in this manual is subject to change without notice and does not represent a
commitment on the part of Sierra Wireless. SIERRA WIRELESS AND ITS AFFILIATES
SPECIFICALLY DISCLAIM LIABILITY FOR ANY AND ALL DIRECT, INDIRECT, SPECIAL,
GENERAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES INCLUDING,
BUT NOT LIMITED TO, LOSS OF PROFITS OR REVENUE OR ANTICIPATED PROFITS OR
REVENUE ARISING OUT OF THE USE OR INABILITY TO USE ANY SIERRA WIRELESS
PRODUCT, EVEN IF SIERRA WIRELESS AND/OR ITS AFFILIATES HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES OR THEY ARE FORESEEABLE OR FOR CLAIMS BY ANY
THIRD PARTY.
Notwithstanding the foregoing, in no event shall Sierra Wireless and/or its affiliates aggregate liability
arising under or in connection with the Sierra Wireless product, regardless of the number of events,
occurrences, or claims giving rise to liability, be in excess of the price paid by the purchaser for the
Sierra Wireless product.
41111821 Rev 12 August 04, 2020 2

Patents
This product may contain technology developed by or for Sierra Wireless Inc.
This product is manufactured or sold by Sierra Wireless Inc. or its affiliates under one or more patents
licensed from MMP Portfolio Licensing.
Copyright
© 2019 Sierra Wireless. All rights reserved.
Trademarks
Sierra Wireless®, AirPrime®, AirLink®, AirVantage®, WISMO®, ALEOS® and the Sierra Wireless and
Open AT logos are registered trademarks of Sierra Wireless, Inc. or one of its subsidiaries.
Watcher® is a registered trademark of NETGEAR, Inc., used under license.
Windows® and Windows Vista® are registered trademarks of Microsoft Corporation.
Macintosh® and Mac OS X® are registered trademarks of Apple Inc., registered in the U.S. and other
countries.
QUALCOMM® is a registered trademark of QUALCOMM Incorporated. Used under license.
Other trademarks are the property of their respective owners.
Contact Information
Sales information and technical support, including Web: sierrawireless.com/company/contact-us/
warranty and returns Global toll-free number: 1-877-687-7795
6:00 am to 5:00 pm PST
Corporate and product information Web: sierrawireless.com
41111821 Rev 12 August 04, 2020 3

Document History
Version Date Updates
1.0 May 21, 2018 Creation

Added:
• 2.5 &F Command: Restore Factory Settings
• 2.6 &V Command: Display Current Configuration
• 2.7 &W Command: Write Current Configuration
• 2.8 Z Command: Reset and Restore User Configuration
• 2.9 +IPR Command: Set Fixed Local/DTE Rate
• 3.6 +KGSN Command: Request Product Serial Number and
Software Version
• 5.8 +KSREP Command: Mobile Start-up Reporting
• 5.16 +CEDRXS Command: eDRX Setting
• 5.21 +KGPIO Command: Hardware IO Control
• 5.22 +KGPIOCFG Command: GPIO Configuration
• 5.23 +KCELL Command: Cell Environment Information
• 5.30 +KCARRIERCFG Command: Set Operator
• 8.2 +CGACT Command: PDP Context Activate or Deactivate
• 9.12 UDP Specific Commands
• 14.1 Command Timeout and Other Information
• 14.6 How to Use UDP Specific Commands
Updated:
• 2.4 &K Command: Flow Control Option
• 3.5 +CGSN Command: Request Product Serial Number
Identification (IMEI)
2.0 July 13, 2018
• 3.7 +CSCS Command: Set TE Character Set
• 4.3 +CMEE Command: Report Mobile Termination Error
• 5.1 +CCLK Command: Real Time Clock
• 5.4 +CFUN Command: Set Phone Functionality
• 5.5 +CPIN Command: Enter Pin
• 5.10 +CCHO Command: Open Logical Channel
• 5.11 +CCHC Command: Close Logical Channel
• 5.12 +CRSM Command: Restricted SIM Access
• 5.14 +CTZR Command: Time Zone Reporting
• 6.1 +CLCK Command: Facility Lock
• 6.2 +CPWD Command: Change Password
• 6.4 +COPS Command: Operator Selection
• 6.5 +CPOL Command: Preferred PLMN List
• 6.6 +CREG Command: Network Registration
• 6.7 +CPLS Command: Select Preferred PLMN List
• 6.8 +CEREG Command: EPS Network Registration Status
• 7.9 +CNMI Command: New Message Indication
• 7.11 +CSMP Command: Set Text Mode Parameters
• 8.9 +CGEREP Command: Packet Domain Event Reporting
• 9.11.5 +KTCPCLOSE Command: Close Current TCP Operation
• 14.2 Result Codes and Unsolicited Messages
• 10 AVMS Commands
41111821 Rev 12 August 04, 2020 4

Deleted:
• 1.2.3 Multiple AT Commands on the Same Command Line
2.0 July 13, 2018
• 5.4 CMER Command: Mobile Equipment Event Reporting
• 5.6 +CCID Command: Request SIM Card Identification
Added:
• 2.10 &C Command: Set Data Carrier Detect (DCD) Function Mode
• 2.11 &D Command: Set Data Terminal Ready (DTR) Function Mode
• 2.12 &S Command: DSR Option
• 2.13 &R Command: RTS/CTS Option
• 2.15 S4 Command: Set Response Formatting Character
• 3.11 +CMUX Command: Multiplexer
• 3.12 +WPPP Command: PDP Context Authentication Configuration
• 5.17 +CEDRXRDP Command: eDRX Read Dynamic Parameters
• 5.24 +KSLEEP Command: Power Management Control
• 5.25 +KRIC Command: Ring Indicator Control
• 5.26 +CPOF Command: Power Off
• 5.27 +CPWROFF Command: Power Off
3.0 July 31, 2018 • 5.28 +WIMEI Command: IMEI Write and Read
• 5.29 +KSYNC Command: Application Synchronization Signal
• 8.7 +CGCONTRDP Command: PDP Context Read Dynamic
Parameter
• 8.8 +CGSCONTRDP Command: Secondary PDP Context Read
Dynamic Parameter
• 9.9 SSL Configuration
• 9.10 SSL Certificate Manager
• 9.11.9 +KTCP_IND Notification: TCP Status
• 9.11.10 +KTCPSTART Command: Start a TCP Connection in Direct
Data Flow
• 10.1 +WDSC Command: Device Services Configuration
Updated:
• <cnx cfg> in 9 Protocol Specific Commands
• 10.5 +WDSI Command: Device Services Indications
Added:
• 1.4 SIM Application Toolkit
• 4.1 D Command: Dial Number
• 5.2 +CCID Command: Request SIM Card Identification
Updated:
• 2.5 &F Command: Restore Factory Settings
• 2.6 &V Command: Display Current Configuration
4.0 October 02, 2018 • 2.7 &W Command: Write Current Configuration
• 3.6 +KGSN Command: Request Product Serial Number and
Software Version
• 5.14 +CTZR Command: Time Zone Reporting
• 5.19 +KBNDCFG Command: Set Configured LTE Band(s)
• 5.20 +KBND Command: Get Active LTE Band(s)
• 5.21+KGPIO Command: Hardware IO Control
41111821 Rev 12 August 04, 2020 5

Updated:
• 9.3 Session ID
October 02, 2018 • 9.8.3 +KIPOPT Command: General Options Configuration
4.0 • 9.9 SSL Configuration
• 9.10.1 +KCERTSTORE Command: Store Root CA and Local
Certificates to Internal Storage
• 9.10.2 +KPRIVKSTORE Command: Store Private Key Associated
to a Local Certificate
• 10 AVMS Commands
• Table 4 Command Timeout
Updated:
4.1 October 03, 2018 • 1.4 SIM Application Toolkit
4.2 October 04, 2018 Updated 5.19 +KBNDCFG Command: Set Configured LTE Band(s)
Added:
• 2.16 +IFC Command: DTE-DCE Local Flow Control
• 3.13 +HWREV Command: Request Hardware Revision
• 5.31 +KMON Command: Enable/Disable Monitor Mode
Updated:
• 3.1 I Command: Request Identification Information
• 5.7 +CSQ Command: Signal Quality
• 5.8 +KSREP Command: Mobile Start-up Reporting
• 5.15 +CPSMS Command: Power Saving Mode Setting
5.0 October 29, 2018
• 5.17 +CEDRXRDP Command: eDRX Read Dynamic Parameters
• 8.11 +CGSMS Command: Select Service for MO SMS Messages
• 9.11.1 +KTCPCFG Command: TCP Connection Configuration
• 9.12.1 +KUDPCFG Command: UDP Connection Configuration
• 10.6 +WDSR Command: Device Services Reply
• 10.7 +WDSS Command: Device Services Session
5.1 October 30, 2018 Updated 6.4 +COPS Command: Operator Selection
Added:
6.0 November 27, 2018 • 5.32 +KSRAT Command: Set Radio Access Technology
• 11 Test Commands
41111821 Rev 12 August 04, 2020 6

Updated:
• 2.10 &C Command: Set Data Carrier Detect (DCD) Function Mode
• 2.11 &D Command: Set Data Terminal Ready (DTR) Function Mode
• 2.12 &S Command: DSR Option
• 3.7 +CSCS Command: Set TE Character Set
• 4.2 +CEER Command: Extended Error Report
• 5.6 +CPAS Command: Phone Activity Status
• 5.18 +CESQ Command: Extended Signal Quality
6.0 November 27, 2018
• 9.4 Connection of PDP Contexts
• 9.8.3 +KIPOPT Command: General Options Configuration
• 9.9 SSL Configuration
• 9.12.2 +KUDPRCV Command: Receive Data through a UDP
Connection
• 14.3.2 CEER Error Codes
Deleted:
• 6.3 CNUM Command: Subscriber Number
• 7 Phone Book Management
Updated:
6.1 December 04, 2018 • 5.16 +CEDRXS Command: eDRX Setting
• 2.13 &R Command: RTS/CTS Option
Added:
• 3.14 +KALTCFG: Set and Get Custom Configuration
• 3.15 +KHWIOCFG: Enable and Disable IO Features
• 5.33 +KNWSCANCFG Command: Configure Network Scan Policy
• 5.34 +CRCES Command: Read Coverage Enhancement Status
• 5.35 +KADC Command: Analog Digital Converter
7.0 February 28, 2019 • 5.36 +WESHDOWN Command: Emergency Shutdown
• 5.37 +KCELLMEAS Command: Request Network Coverage
Information
• 8.12 +CSODCP Command: Send Originating Data via the Control
Plane
• 8.13 +CRTDCP Command: Report Terminating Data via the Control
Plane
• 9.11.10 +KTCPSTAT Command: Get TCP Socket Status
Added:
• 10.8 +WDSTPF Command: Device Services Third Party FOTA
7.0 February 28, 2019
• 12 GNSS Commands
• 13 NV Commands
41111821 Rev 12 August 04, 2020 7

Updated:
• 2.14 S2 Command: Set Character for the Escape Sequence (Data
to Command Mode)
• 3.1 I Command: Request Identification Information
• 5.26 +CPOF Command: Power Off
• 5.27 +CPWROFF Command: Power Off
• 7.2 +CMGD Command: Delete Message
• 8.5 +CGDCONT Command: Define PDP Context
• 9.7.6 +KCNXUP Command: Bring the PDP Connection Up
• 9.8.2 +KURCCFG Command: Enable or Disable the URC from
Protocol Commands
• 9.8.3 +KIPOPT Command: General Options Configuration
• 9.11.2 +KTCPCNX Command: Start TCP Connection
• 9.11.8 +KTCP_DATA Notification: Incoming Data through a TCP
Connection
• 9.12.2 +KUDPRCV Command: Receive Data through a UDP
Connection
• 10.5 +WDSI Command: Device Services Indications
• 14.6.1 Client Mode
Updated:
7.1 March 06, 2019
• 5.36 +WESHDOWN Command: Emergency Shutdown
• 8.7 +CGCONTRDP Command: PDP Context Read Dynamic
Parameter
• 11 Test Commands
41111821 Rev 12 August 04, 2020 8

Added:
• 5.38 +KSIMSEL Command: SIM Selection
• 5.39 +KSIMDET Command: SIM Detection
• 5.40 +KUSBCOMP Command: Enable/Disable USB Mode
• 6.10 +CNUM Command: Subscriber Number
• 9.13 HTTP Client Specific Commands
• 9.14 FTP Client Specific Commands
• 14.4 FTP Reply Codes
• 14.7 Switch Data/Command Mode DTR +++ ATO Behavior Table
Updated:
8.0 April 18, 2019 • 5.23 +KCELL Command: Cell Environment Information
• 5.33 +KNWSCANCFG Command: Configure Network Scan Policy
• 5.35 +KADC Command: Analog Digital Converter
• 5.36 +WESHDOWN Command: Emergency Shutdown
Information
• 6.9 +CEMODE Command: UE Modes of Operation for EPS
• 8.10 +CGPADDR Command: Show PDP Address
• 9.3 Session ID
• 9.8.1 +KPATTERN Command: Custom End of Data Pattern
• 12.3 +GNSSNMEA Command: Configure NMEA Frames Flow
8.1 April 23, 2019 Updated 9.14.3 +KFTPRCV Command: Receive FTP Files
Updated:
9.0 July 22, 2019
• 14.3.1 CME Error Codes
Added 5.41 +KTEMPMON Command: Temperature Monitor
9.1 August 27, 2019
Updated Table 4 Command Timeout
Updated:
• 5.41 +KTEMPMON Command: Temperature Monitor
9.2 September 11, 2019
• 12.4 +GNSSCONF Command: Configure the Location Service and
GNSS Receiver
Updated:
9.3 September 18, 2019 • 5.25 +KRIC Command: Ring Indicator Control
Information
• 9.7.1 +KCNXCFG Command: GPRS Connection Configuration
41111821 Rev 12 August 04, 2020 9

Added:
• 5.42 +KCIOTOPT Command: UE Network Capability Information
Configuration
Updated:
• 3.16 +WDSD Command: Device Services Local Download
• 5.25 +KRIC Command: Ring Indicator Control5.27 +CPWROFF
Command: Power Off
• 5.32 +KSRAT Command: Set Radio Access Technology
10 February 2020
• 5.41 +KTEMPMON Command: Temperature Monitor
• 8.2 +CGACT Command: PDP Context Activate or Deactivate
• 9.12.7 +KUDP_DATA Notification: Incoming Data through a UDP
Connection
• 9.14.1 +KFTPCFG Command: FTP Connection Configuration
• 9.14.2 +KFTPCNX Command: Start FTP Connection
• 9.14.5 +KFTPDEL Command: Delete FTP Files
• 9.14.9 +KFTPLS Command: List File Size of a Specific File
• 14.1 Command Timeout and Other Information Table 4 Command
Timeout
Added:
• 5.43 +KEDRXCFG Command: Configure eDRX
• 8.14 +KNMPSD Command: No More PS Data
Updated:
11 April 17, 2020 • 5.41 +KTEMPMON Command: Temperature Monitor
• 9.9.1 +KSSLCRYPTO Command: Cipher Suite Configuration
• 9.10.3 +KCERTDELETE Command: Delete Local Certificate from
the Index
• 13.3 +NVBU Command: NV Backup Status and Control
41111821 Rev 12 August 04, 2020 10

Added:
• 5.44 +KSELACQ Command: Configure Preferred Radio Access
Technology List (PRL)
• 5.45 +KDRXCFG Command: Configure LTE DRX
• 9.11.12 +KTCP_ACK Notification: Status Report for Latest TCP
Data Session
Updated:
• 3.11 +CMUX Command: Multiplexer
• 5.8 +KSREP Command: Enable/Disable Startup URC; Set UART
Enable Timeout
• 5.32 +KSRAT Command: Set Radio Access Technology
12 August 04, 2020 • 5.37 +KCELLMEAS Command: Request LTE Network Coverage
Information and Configure URC on Wakeup
• 5.38 +KSIMSEL Command: SIM Selection
• 5.43 +KEDRXCFG Command: Configure eDRX
• 9.9.1 +KSSLCRYPTO Command: Cipher Suite Configuration
• 9.10.3 +KCERTDELETE Command: Delete Local Certificate from
the Index
• 9.11.4 +KTCPSND Command: Send Data through a TCP
Connection
• 9.11.11 +KTCPSTART Command: Start a TCP Connection in Direct
Data Flow
• 12.2 +GNSSSTOP Command: Stop the GNSS Session
41111821 Rev 12 August 04, 2020 11

Contents
1. INTRODUCTION ................................................................................................ 20
1.1. Reference Configuration....................................................................................................20
1.2. AT Command Principles ....................................................................................................20
1.2.1. Parameters ..............................................................................................................21
1.2.2. Answers and Responses .........................................................................................21
1.2.3. AT Commands on Separate Lines...........................................................................21
1.3. Unsolicited Result Codes (URCs) .....................................................................................21
1.4. SIM Application Toolkit ......................................................................................................21
1.5. Document Modification ......................................................................................................21
1.6. Abbreviations .....................................................................................................................22
2. V25TER AT COMMANDS .................................................................................. 26

2.1. +++ Command: Switch from Data Mode to Command Mode ...........................................26
2.2. O Command: Switch from Command Mode to Data Mode ...............................................26
2.3. E Command: Enable Echo Command ..............................................................................27
2.4. &K Command: Flow Control Option ..................................................................................27
2.5. &F Command: Restore Factory Settings...........................................................................27
2.6. &V Command: Display Current Configuration ...................................................................28
2.7. &W Command: Write Current Configuration .....................................................................29
2.8. Z Command: Reset and Restore User Configuration........................................................30
2.9. +IPR Command: Set Fixed Local/DTE Rate .....................................................................30
2.10. &C Command: Set Data Carrier Detect (DCD) Function Mode ........................................31
2.11. &D Command: Set Data Terminal Ready (DTR) Function Mode......................................31
2.12. &S Command: DSR Option ...............................................................................................31
2.13. &R Command: RTS/CTS Option .......................................................................................32
2.14. S2 Command: Set Character for the Escape Sequence (Data to Command Mode) ........32
2.15. S4 Command: Set Response Formatting Character .........................................................33
2.16. +IFC Command: DTE-DCE Local Flow Control ................................................................33
3. GENERAL AT COMMANDS .............................................................................. 35

3.1. I Command: Request Identification Information ................................................................35
3.2. +CGMI/+GMI Command: Request Manufacturer Identification ........................................37
3.3. +CGMM/+GMM Command: Request Model Identification ................................................38
3.4. +CGMR/+GMR Command: Request Revision Identification.............................................38
3.5. +CGSN Command: Request Product Serial Number Identification (IMEI) .......................39
3.6. +KGSN Command: Request Product Serial Number and Software Version ....................40
3.7. +CSCS Command: Set TE Character Set ........................................................................41
3.8. +CIMI Command: Request International Mobile Subscriber Identity ................................42
3.9. +GSN Command: Request Product Serial Number (IMEI) ...............................................43
41111821 Rev 12 August 04, 2020 12

3.10. +GCAP Command: Request Complete TA Capability List................................................43

3.11. +CMUX Command: Multiplexer .........................................................................................43
3.12. +WPPP Command: PDP Context Authentication Configuration .......................................45
3.13. +HWREV Command: Request Hardware Revision ..........................................................46
3.14. +KALTCFG: Set and Get Custom Configuration...............................................................47
3.15. +KHWIOCFG: Enable and Disable IO Features ...............................................................48
3.16. +WDSD Command: Device Services Local Download .....................................................51
4. CALL CONTROL COMMANDS ......................................................................... 52

4.1. D Command: Dial Number ................................................................................................52
4.2. +CEER Command: Extended Error Report .......................................................................53
4.3. +CMEE Command: Report Mobile Termination Error .......................................................53
5. MOBILE EQUIPMENT CONTROL AND STATUS COMMANDS....................... 54

5.1. +CCLK Command: Real Time Clock .................................................................................54
5.2. +CCID Command: Request SIM Card Identification .........................................................54
5.3. +CLAC Command: List Available AT Commands .............................................................55
5.4. +CFUN Command: Set Phone Functionality .....................................................................56
5.5. +CPIN Command: Enter Pin .............................................................................................56
5.6. +CPAS Command: Phone Activity Status .........................................................................57
5.7. +CSQ Command: Signal Quality .......................................................................................58
5.8. +KSREP: Enable/Disable Startup URC; Set UART Enable Timeout ................................59
5.9. +CSIM Command: Generic SIM Access ...........................................................................60
5.10. +CCHO Command: Open Logical Channel ......................................................................60
5.11. +CCHC Command: Close Logical Channel ......................................................................61
5.12. +CRSM Command: Restricted SIM Access ......................................................................61
5.13. +CTZU Command: Automatic Time Zone Update ............................................................63
5.14. +CTZR Command: Time Zone Reporting .........................................................................63
5.15. +CPSMS Command: Power Saving Mode Setting ...........................................................64
5.16. +CEDRXS Command: eDRX Setting ................................................................................65
5.17. +CEDRXRDP Command: eDRX Read Dynamic Parameters...........................................66
5.18. +CESQ Command: Extended Signal Quality ....................................................................67
5.19. +KBNDCFG Command: Set Configured LTE Band(s) ......................................................69
5.20. +KBND Command: Get Active LTE Band(s) .....................................................................71
5.21. +KGPIO Command: Hardware IO Control ........................................................................72
5.22. +KGPIOCFG Command: GPIO Configuration ..................................................................73
5.23. +KCELL Command: Cell Environment Information ...........................................................75
5.24. +KSLEEP Command: Power Management Control ..........................................................78
5.25. +KRIC Command: Ring Indicator Control .........................................................................80
5.26. +CPOF Command: Power Off ...........................................................................................82
5.27. +CPWROFF Command: Power Off...................................................................................82
41111821 Rev 12 August 04, 2020 13

5.28. +WIMEI Command: IMEI Write and Read.........................................................................83

5.29. +KSYNC Command: Application Synchronization Signal .................................................84
5.30. +KCARRIERCFG Command: Set Operator ......................................................................85
5.31. +KMON Command: Enable/Disable Monitor Mode...........................................................86
5.32. +KSRAT Command: Set Radio Access Technology.........................................................88
5.33. +KNWSCANCFG Command: Configure Network Scan Policy .........................................89
5.34. +CRCES Command: Read Coverage Enhancement Status ............................................91
5.35. +KADC Command: Analog Digital Converter ....................................................................92
5.36. +WESHDOWN Command: Emergency Shutdown ...........................................................93
5.37. +KCELLMEAS Command: Request LTE Network Coverage Information and Configure
URC on Wakeup ................................................................................................................94
5.38. +KSIMSEL Command: SIM Selection ...............................................................................97
5.39. +KSIMDET Command: SIM Detection ..............................................................................99
5.40. +KUSBCOMP Command: Enable/Disable USB Mode ...................................................100
5.41. +KTEMPMON Command: Temperature Monitor ............................................................102
5.42. +KCIOTOPT Command: UE Network Capability Information Configuration...................104
5.43. +KEDRXCFG Command: Configure eDRX ....................................................................106
5.44. +KSELACQ Command: Configure Preferred Radio Access Technology List (PRL) ......108
5.45. +KDRXCFG Command: Configure LTE DRX .................................................................111
6. NETWORK SERVICE RELATED COMMANDS .............................................. 113

6.1. +CLCK Command: Facility Lock .....................................................................................113
6.2. +CPWD Command: Change Password ..........................................................................114
6.3. +COPN Command: Read Operator Name ......................................................................115
6.4. +COPS Command: Operator Selection...........................................................................115
6.5. +CPOL Command: Preferred PLMN List ........................................................................116
6.6. +CREG Command: Network Registration .......................................................................118
6.7. +CPLS Command: Select Preferred PLMN List..............................................................119
6.8. +CEREG Command: EPS Network Registration Status .................................................119
6.9. +CEMODE Command: UE Modes of Operation for EPS ................................................121
6.10. +CNUM Command: Subscriber Number .........................................................................122
7. SMS COMMANDS............................................................................................ 123

7.1. Parameters Definition ......................................................................................................123
7.1.1. Message Storage Parameters ...............................................................................123
7.1.2. Message Data Parameters ....................................................................................124
7.2. +CMGD Command: Delete Message ..............................................................................125
7.3. +CMGF Command: Set Message Format .......................................................................126
7.4. +CMGL Command: List Messages .................................................................................127
7.5. +CMGR Command: Read Message................................................................................127
7.6. +CMGS Command: Send Message ................................................................................128
7.7. +CMGW Command: Write Message to Memory .............................................................129
41111821 Rev 12 August 04, 2020 14

7.8. +CMSS Command: Send Message from Storage ..........................................................130

7.9. +CNMI Command: New Message Indication ..................................................................130
7.10. +CSCA Command: Service Center Address ...................................................................132
7.11. +CSMP Command: Set Text Mode Parameters .............................................................132
7.12. +CSMS Command: Select Message Service ..................................................................133
7.13. +CPMS Command: Preferred Message Storage ............................................................133
7.14. +CSDH Command: Show Text Mode Parameters ..........................................................134
7.15. +CMT Notification: Received SMSPP Content ...............................................................135
8. PACKET DOMAIN COMMANDS ..................................................................... 136

8.1. +CGATT Command: PS Attach or Detach ......................................................................136
8.2. +CGACT Command: PDP Context Activate or Deactivate .............................................136
8.3. +CGCMOD Command: Modify PDP Context ..................................................................137
8.4. +CGTFT Command: Traffic Flow Template ....................................................................138
8.5. +CGDCONT Command: Define PDP Context ................................................................139
8.6. +CGDSCONT Command: Define Secondary PDP Context............................................142
8.7. +CGCONTRDP Command: PDP Context Read Dynamic Parameter ............................143
8.8. +CGSCONTRDP Command: Secondary PDP Context Read Dynamic Parameter .......145
8.9. +CGEREP Command: Packet Domain Event Reporting ................................................146
8.10. +CGPADDR Command: Show PDP Address .................................................................147
8.11. +CGSMS Command: Select Service for MO SMS Messages ........................................148
8.12. +CSODCP Command: Send Originating Data via the Control Plane .............................149
8.13. +CRTDCP Command: Report Terminating Data via the Control Plane..........................150
8.14. +KNMPSD Command: No More PS Data .......................................................................151
9. PROTOCOL SPECIFIC COMMANDS.............................................................. 152

9.1. Preliminary Comments ....................................................................................................152
9.2. IP Address Format in AT Commands ..............................................................................152
9.3. Session ID .......................................................................................................................152
9.4. Connection of PDP Contexts ...........................................................................................152
9.5. Buffer Length of AT Commands ......................................................................................153
9.6. Parameter Format of AT Commands ..............................................................................153
9.7. Connection Configuration ................................................................................................153
9.7.1. +KCNXCFG Command: GPRS Connection Configuration ...................................153
9.7.2. +KCNXTIMER Command: Connection Timer Configuration .................................155
9.7.3. +KCNXPROFILE Command: Current Profile Connection Configuration ..............156
9.7.4. +KCGPADDR Command: Display PDP Address ..................................................157
9.7.5. +KCNX_IND Notification: Connection Status Notification .....................................158
9.7.6. +KCNXUP Command: Bring the PDP Connection Up ..........................................158
9.7.7. +KCNXDOWN Command: Bring the PDP Connection Down ...............................159
9.8. Common Configuration....................................................................................................160
9.8.1. +KPATTERN Command: Custom End of Data Pattern.........................................160
9.8.2. +KURCCFG Command: Enable or Disable the URC from Protocol Commands ..161
41111821 Rev 12 August 04, 2020 15

9.8.3. +KIPOPT Command: General Options Configuration ...........................................162

9.9. SSL Configuration ...........................................................................................................164
9.9.1. +KSSLCRYPTO Command: Cipher Suite Configuration ......................................164
9.9.2. +KSSLCFG Command: SSL Configuration ...........................................................166
9.10. SSL Certificate Manager .................................................................................................167
9.10.1. +KCERTSTORE Command: Store Root CA and Local Certificates to Internal
Storage ..................................................................................................................167
9.10.2. +KPRIVKSTORE Command: Store Private Key Associated to a Local Certificate
...............................................................................................................................168
9.10.3. +KCERTDELETE Command: Delete Local Certificate from the Index .................169
9.10.4. +KPRIVKDELETE Command: Delete Private Key from the Index ........................170
9.11. TCP Specific Commands ................................................................................................170
9.11.1. +KTCPCFG Command: TCP Connection Configuration .......................................170
9.11.2. +KTCPCNX Command: Start TCP Connection .....................................................172
9.11.3. +KTCPRCV Command: Receive Data through a TCP Connection ......................173
9.11.4. +KTCPSND Command: Send Data through a TCP Connection ...........................174
9.11.5. +KTCPCLOSE Command: Close Current TCP Operation ....................................175
9.11.6. +KTCPDEL Command: Delete a Configured TCP Session ..................................176
9.11.7. +KTCP_SRVREQ Notification: Incoming Client Connection Request ..................176
9.11.8. +KTCP_DATA Notification: Incoming Data through a TCP Connection ...............178
9.11.9. +KTCP_IND Notification: TCP Status....................................................................178
9.11.10. +KTCPSTAT Command: Get TCP Socket Status .................................................178
9.11.11. +KTCPSTART Command: Start a TCP Connection in Direct Data Flow ..............179
9.11.12. +KTCP_ACK Notification: Status Report for Latest TCP Data Session ................180
9.12. UDP Specific Commands ................................................................................................181
9.12.1. +KUDPCFG Command: UDP Connection Configuration ......................................181
9.12.2. +KUDPRCV Command: Receive Data through a UDP Connection .....................183
9.12.3. +KUDPSND Command: Send Data through a UDP Connection ..........................184
9.12.4. +KUDPCLOSE Command: Close Current UDP Operation ...................................185
9.12.5. +KUDPDEL Command: Delete a Configured UDP Session .................................186
9.12.6. +KUDP_IND Notification: UDP Status ...................................................................186
9.12.7. +KUDP_DATA Notification: Incoming Data through a UDP Connection...............186
9.13. HTTP Client Specific Commands ....................................................................................187
9.13.1. +KHTTPCFG Command: HTTP Connection Configuration ..................................187
9.13.2. +KHTTPCNX Command: Start HTTP Connection ................................................189
9.13.3. +KHTTPHEADER Command: Set HTTP Request Header ...................................189
9.13.4. +KHTTPGET Command: Get HTTP Server Information .......................................190
9.13.5. +KHTTPHEAD Command: Get HTTP Headers ....................................................191
9.13.6. +KHTTPPOST Command: Send Data to HTTP Server ........................................192
9.13.7. +KHTTP_IND Notification: HTTP Status ...............................................................193
9.13.8. +KHTTPCLOSE Command: Close HTTP Connection ..........................................193
9.13.9. +KHTTPDEL Command: Delete a Configured HTTP Connection ........................194
9.13.10. +KHTTPPUT Command: Perform HTTP PUT.......................................................194
9.13.11. +KHTTPDELETE Command: Perform HTTP Delete ............................................195
9.14. FTP Client Specific Commands.......................................................................................196
9.14.1. +KFTPCFG Command: FTP Connection Configuration........................................196
9.14.2. +KFTPCNX Command: Start FTP Connection .....................................................198
41111821 Rev 12 August 04, 2020 16

9.14.3. +KFTPRCV Command: Receive FTP Files ...........................................................199

9.14.4. +KFTPSND Command: Send FTP Files ...............................................................201
9.14.5. +KFTPDEL Command: Delete FTP Files ..............................................................202
9.14.6. +KFTP_IND Notification: FTP Status ....................................................................203
9.14.7. +KFTPCLOSE Command: Close Current FTP Connection ..................................204
9.14.8. +KFTPCFGDEL Command: Delete a Configured FTP Session ...........................204
9.14.9. +KFTPLS Command: List File Size of a Specific File ...........................................205
10. AVMS COMMANDS ......................................................................................... 207

10.1. +WDSC Command: Device Services Configuration .......................................................207
10.2. +WDSE Command: Device Services Error .....................................................................209
10.3. +WDSG Command: Device Services General Status.....................................................211
10.4. +WDSI Command: Device Services Indications .............................................................212
10.5. +WDSR Command: Device Services Reply ....................................................................215
10.6. +WDSS Command: Device Services Session ................................................................216
10.7. +WDSTPF Command: Device Services Third Party FOTA ............................................217
11. TEST COMMANDS .......................................................................................... 220

11.1. +WMTXPOWER Command: Test RF Tx ........................................................................220
11.2. +WMRXPOWER Command: Test RF Rx........................................................................222
12. GNSS COMMANDS ......................................................................................... 225

12.1. +GNSSSTART Command: Start or Restart the GNSS Session .....................................225
12.2. +GNSSSTOP Command: Stop the GNSS Session ........................................................226
12.3. +GNSSNMEA Command: Configure NMEA Frames Flow .............................................227
12.4. +GNSSCONF Command: Configure the Location Service and GNSS Receiver ...........229
12.5. +GNSSTTFF Command: Report Calculated TTFF of the Last Run ...............................230
12.6. +GNSSLOC Command: Report Latest Known Position Fix ............................................231
12.7. +GNSSEV Notifications: Location Service Events Notification .......................................233
13. NV COMMANDS .............................................................................................. 234

13.1. Auto Generation of NV Backup Files ...............................................................................234
13.2. Auto Recovery from NV Backup Files .............................................................................234
13.3. +NVBU Command: NV Backup Status and Control ........................................................235
14. APPENDIX ....................................................................................................... 239

14.1. Command Timeout and Other Information ......................................................................239
14.2. Result Codes and Unsolicited Messages ........................................................................244
14.3. Error Codes .....................................................................................................................244
14.3.1. CME Error Codes ..................................................................................................244
14.3.2. CEER Error Codes ................................................................................................247
14.3.3. CMS Error Codes ..................................................................................................248
14.3.4. GPRS Error Codes ................................................................................................250
14.4. FTP Reply Codes ............................................................................................................251
14.5. How to Use TCP Commands ..........................................................................................252
41111821 Rev 12 August 04, 2020 17

14.5.1. Client Mode ............................................................................................................252

14.5.2. Server Mode ..........................................................................................................253
14.6. How to Use UDP Specific Commands ............................................................................254
14.6.1. Client Mode ............................................................................................................254
14.6.2. Use Cases for KTCP_DATA and KUDP_DATA (with/without data auto retrieval) 255
14.7. Switch Data/Command Mode DTR +++ ATO Behavior Table ........................................257
41111821 Rev 12 August 04, 2020 18

List of Tables
Table 1. Types of Extended AT Commands ................................................................................. 20
Table 2. AT+KSLEEP Command Description ............................................................................... 79
Table 3. Supported Cipher Suites ............................................................................................... 165
Table 4. Command Timeout ........................................................................................................ 239
41111821 Rev 12 August 04, 2020 19

1. Introduction
This document presents the AT command set for the AirPrime HL78xx series of embedded modules.
1.1. Reference Configuration
Figure 1. Reference Configuration
The User Equipment (UE) consists of the mobile equipment (ME) and the (U)SIM messages may be
stored in either, but the present document does not distinguish between messages stored in the
(U)SIM or in the ME. The management of message storage in the two parts of the UE is a matter for
the UE implementation.
1.2. AT Command Principles

The "AT" or "at" prefix must be set at the beginning of each line. To terminate a command line, a
<CR> character must be inserted.
Commands are usually followed by a response that includes ‘<CR><LF><response><CR><LF>’.
Throughout this document, only the responses are indicated, the <CR> and <LF> characters are
omitted intentionally.
Four kinds of extended AT commands are implemented as listed in the table below.
Table 1. Types of Extended AT Commands
Command Type Syntax Definition
The equipment returns the list of parameters and values

Test Command AT+CXXX=? ranges set with the corresponding Write command or by
internal processes
Read Command AT+CXXX? This command returns the currently set value of parameters
Write Command AT+CXXX=<…> This command sets user-related parameter values
AT+CXXX The execution command reads non-variable parameters

Execution command
affected by internal processes in the equipment
41111821 Rev 12 August 04, 2020 20

AT Commands Interface Guide Introduction
1.2.1. Parameters
In this document, default parameters are underlined and optional parameters are enclosed in square
brackets.
Optional parameters or sub-parameters can be omitted unless they are followed by other parameters.
A parameter in the middle of a string can be omitted by replacing it with a comma.
When the parameter is a character string, the string must be enclosed in quotation marks.
All space characters will be ignored when using strings without quotation marks.
1.2.2. Answers and Responses

There is always an answer sent by the TA to an AT command line (except the special case of a TA
setup for no answer).
The answer is always terminated by an indication of success or failure. However, the message may
be different depending on the setup of the TA (using AT commands).
Classical messages OK or ERROR

Extended Error message (see AT+CMEE) +CME ERROR: <n>
(See Appendix for the different values for <n>)
Numeric Mode <n> with: <n> = 0  OK or <n> is an error code
1.2.3. AT Commands on Separate Lines

When a series of AT commands are entered on separate lines, it is strongly advised to leave a pause
between the preceding and the following command until the final answer (OK or Error message)
appears. This avoids sending too many AT commands at a time without waiting for a response for
each.
1.3. Unsolicited Result Codes (URCs)

Unsolicited result codes (URCs) are sent simultaneously to all channels (UART) configured in AT
command mode.
URCs are not sent to channels configured in Data/Traces modes.
1.4. SIM Application Toolkit

SIM Toolkit modes cannot be managed by AT commands. By default, SIM Toolkit is active and in
silent mode.
1.5. Document Modification

The commands described in this document are only to be used for usual AT command use.
Information provided for the commands are subject to change without notice.
41111821 Rev 12 August 04, 2020 21

1.6. Abbreviations
Abbreviation Definition
ACM Accumulated Call Meter

ADC Analog Digital Converter
ADN Abbreviated Dialing Number (Phonebook)
AMR Adaptive Multi-Rate
AMR-FR AMR Full Rate (full rate speech version 3)
AMR-HR AMR Half Rate (half rate speech version 3)
AOC Advice of Charge
APN Access Point Name
ARN Address Resolution Protocol
ARFCN Absolute Radio Frequency Channel Number
ASCII American Standard Code for Information Interchange
AT Attention; Hayes Standard AT command Set
BCCH Broadcast Channel
BER Bit Error Rate
BM Broadcast Message Storage
CBM Cell Broadcast Message
CB Cell Broadcast
CCK Corporate Control Key
CCM Current Call Meter
CHV Card Holder Verification
CHAP Challenge handshake Authentication Protocol
CI Cell Identifier
CLI Client Line Identification
CNL Cooperative Network List
CODEC Coder Decoder
COLP Connected Line Identification Presentation
CPHS Common PCN Handset Specification
CPU Central Processing Unit
CSD Circuit Switched Data
CSP Customer Service Profile
CTM Cellular Text telephone Modem
CTS Clear to Send signal
CUG Closed User Group
DAC Digital to Analog Converter
DCS Digital Cellular System
DCE Data Circuit Equipment
DCD Data Carrier Detect
DLC Data Link Connection
DLCI Data Link Connection Identifier
DM Device Management
DNS Domain Name System
DSR Data Set Ready
41111821 Rev 12 August 04, 2020 22

DTE Date Terminal Equipment

DTMF Dual Tone Multi-Frequency
DTR Data Terminal Ready
ECC Emergency Call Codes
ECM Error Correction Mode
ECT Explicit Call Transfer
EDGE Enhanced Data rates for GSM Evolution
EEPROM Electrically Erasable Programming Only Memory
EF Elementary Files
EFR Enhanced Full Rate (full rate speech version 2)
EGPRS Enhanced GPRS
ENS Enhanced Network Selection
E-ONS Enhanced Operator Name Service
ERMES European Radio Messaging System
ETSI European Telecommunications Standards Institute
FD FIFO depth
FDN Fixed Dialing Number (Phonebook)
FR Full Rate (full rate speech version 1)
GERAN GSM EDGE Radio Access Network
GPIO General Purpose Input Output
GPRS General Packet Radio Service
GSM Global System for Mobile communication
HDLC High-level Data Link Control
HFR High Frequency Regeneration
HLR Home Location Register
HR Half Rate (half rate speech version 1)
ID Identifier
IETF Internet Engineering Task Force
IMEI International Mobile Equipment Identity
IMSI International Mobile Subscriber Identity
IN/OUT/IN_OUT In, out or in/out
I/O Input/Output
IP Internet Protocol
LAC Local Area Code
LED Light Emitting Diode
LND Last Number Dialed
LP Language Preferred
LPI Lines Per Inch
M Mandatory
MCC Mobile Country Code
ME Mobile Equipment
MMI Man Machine Interface
MNC Mobile Network Code
MNP Microcom Networking Protocol
41111821 Rev 12 August 04, 2020 23

MO Mobile Originated
MOC Mobile Originated Call (outgoing call)
MS Mobile Station
MSB Most Significant Bit
MSISDN Mobile Station International ISDN Number
MT Mobile Terminal
MTC Mobile Terminated Call (incoming call)
N.A. Not applicable
NCK Network Control Key
NITZ Network Information and Time Zone
NSCK Network Subset Control Key
NTC Negative Temperature Coefficient
N.U. Not used
O Optional
OA Outgoing Access
OPL Operator PLMN List
OS Operating System
OTA Over the Air
PAD Portable Application Description
PAP Password Authentication Protocol
PC Personal Computer
PCCP PC character set Code Page
PCK Personalization Control Key
PCL Power Control Level
PCM Protection Circuit Module
PCN Personal Communication Network
PCS 1900 Personal Communication Service
PDP Packet Data Protocol
PDU Protocol Description Unit
PIN Personal Identification Number
PLMN Public Land Mobile Networks
PNN PLMN Network Name
PPP Point-to-Point Protocol/Peer to Peer
PSTN Public Switched Telephone Network
PTS Product Technical Specification
PUCT Price per Unit and Currency Table
PUK PIN Unlock Key
PWM Pulse Width Modulation
QoS Quality of Service
RAM Random Access Memory
RDMS Remote Device Management Services
RI Ring Indicator
RIL Radio Interface Layer
RLP Radio Link Protocol
41111821 Rev 12 August 04, 2020 24

RSSI Received Signal Strength Indication

RTS Ready to Send signal
RX Reception
SAP Service Access Point
SC Service Center
SDU Service Data Unit
SIM Subscriber Information Module
SMSR Short Message Status Report
SMS Short Message Service
SS Supplementary Services
SPCK Service Provider Control Key
SPN Service Provider Name
STK SIM ToolKit
SVN Software Version Number
TA Terminal Adaptor
TBF Temporary Block Flow
TE Terminal Equipment
TTY TeleTYpe
TON/NPI Type of Number/Numbering Plan Identification
TX Transmission
UART Universal Asynchronous Receiver Transmitter
UCS2 Universal Character Set 2 Character table (2-byte coding)
UDUB User Determined User Busy
UIH Unnumbered Information with Header check
USB Universal Serial Bus
USSD Unstructured Supplementary Service Data
41111821 Rev 12 August 04, 2020 25

2. V25ter AT Commands
2.1. +++ Command: Switch from Data Mode to

Command Mode
HL78xx
Execute command
Syntax Response
+++ OK
Reference Notes
V.25Ter • This command is only available during data mode. The +++ character
sequence suspends the data flow over the AT interface and switches to
command mode. This allows entering AT commands while maintaining the data
connection to the remote device.
• To return to data mode, use ATO[n].
• Line needs one second silence before and one second after (do not end with
terminating character).
• The "+" character may be changed with ATS2.
• The +++ characters are not transmitted in the data flow.
2.2. O Command: Switch from Command Mode to

Data Mode
HL78xx
Test command
Syntax Response
ATO[<n>] TA returns to data mode from command mode:
CONNECT <text>
If connection is not successfully resumed:

NO CARRIER
Parameter
<n> 0 Switch from command mode to data mode
1 – 200 Session ID
Reference Notes
V.25Ter ATO is the alternative command to the +++ escape sequence described in section 2.1.
When a data call has been established and TA is in command mode, ATO causes the TA
to resume the data connection and return to data mode.
41111821 Rev 12 August 04, 2020 26

AT Commands Interface Guide V25ter AT Commands
2.3. E Command: Enable Echo Command

HL78xx
Execute command
Syntax Response
ATE[<value>] OK
or
+CME ERROR: <err>
Parameter
<value> 0 Echo OFF
1 Echo ON
Notes • This setting determines whether the TA echoes characters received from the
TE in the command state.
• <value> is set for all AT ports.
2.4. &K Command: Flow Control Option

HL78xx
Execute command
Syntax Response
AT&K[<mode>] OK
Parameter
<mode> 0 Disable all flow control
3 Enable RTS/CTS flow control
Reference Notes
Rockwell Rev4 Sierra Wireless recommends the use of hardware flow control.
2.5. &F Command: Restore Factory Settings

HL78xx
Execute command
Syntax Response
AT&F[<value>] OK
Parameter
<value> 0 or Omitted Restore parameters to factory settings
41111821 Rev 12 August 04, 2020 27

HL78xx
Reference Notes
V.25Ter • See also AT&V.
• Restore factory settings to active profile.
• Default factory settings for HL78xx are:
E1 Q0 V1 X4 &C1 &D1 &R1 &S0 +IFC=2,2 &K3 +IPR=115200 +FCLASS0
S00:0 S01:0 S03:13 S04:10 S05:8 S07:255 S08:0 S10:1
Examples AT&F
OK
AT&F0
OK
AT&F1
ERROR
2.6. &V Command: Display Current Configuration

HL78xx
Execute command
Syntax Response
AT&V[<value>] ACTIVE PROFILE:
<current configuration>
STORED PROFILE 0:
<user0 default configuration>
STORED PROFILE 1:
<user1 default configuration>
OK
Parameter
<value> 0 or Omitted All Profiles
Reference Notes
Sierra Wireless • At startup, the latest profile stored with AT&W is restored to the Active profile (no
Proprietary restoration if AT&W has not been used).
• The configuration is a text string on multiple lines as shown in the example
below. This string may vary depending on the manufactory, the product and the
user setup.
• AT&V lists +IFC and S01 parameters which are directly editable. +IFC answer
reflects the flow control parameters set by AT&K.
Example E1 Q0 V1 X4 &C1 &D1 &R1 &S0 +IFC=2,2 &K3 +IPR=115200 +FCLASS0
S00:0 S01:0 S03:13 S04:10 S05:8 S07:255 S08:0 S10:1
This command indicates the result of certain actions as shown below:

Active Profile
ATZ AT&F
AT&W
Stored profile Default Settings
41111821 Rev 12 August 04, 2020 28

2.7. &W Command: Write Current Configuration

HL78xx
Execute
command
Response
Syntax OK
AT&W[<value>]
Parameter
<value> 0 or Omitted Save in STORED PROFILE 0
1 Save in STORED PROFILE 1
Reference Notes
V.25Ter • This command saves the current configuration in a non-erasable place.
• See also AT&V.
Configuration saved:
E Echo
Q Set result code presentation mode
V Verbose
X Extended result code
&C DCD control
&D DTR behavior
&R RTS control
&S DSR control
+IFC Reflect Flow Control set by AT&K
&K Flow control
+IPR Set Fixed Local/DTE Rate
FCLASS FCLASS
S0 Set number of rings before automatically answering the call
S3 Write command line termination character
S4 Set response formatting character
S5 Write command line editing character
S7 Set number of seconds to wait for connection completion
S8 Comma dial modifier time
S10 Automatic disconnect delay
Example AT&W // Save current configuration to Profile 0
OK
AT&W0 // Save current configuration to Profile 0

OK
AT&W1 // Save current configuration to Profile 1

OK
41111821 Rev 12 August 04, 2020 29

2.8. Z Command: Reset and Restore User

Configuration
HL78xx
Execute command
Syntax Response
ATZ[<value>] OK
Parameter
<value> 0 Reset and restore user configuration with profile 0
1 Reset and restore user configuration with profile 1
Reference Notes
V.25ter See also AT&V
2.9. +IPR Command: Set Fixed Local/DTE Rate

HL78xx
Test command
Syntax Response
AT+IPR=? +IPR: (list of supported auto-detectable <rate>s)[,(list of fixed-only <rate>s)]
OK
Read command
Syntax Response
AT+IPR? +IPR: <rate>
OK
Write command
Syntax Response
AT+IPR=<rate> OK
or
ERROR
Parameter
<rate> Rate in bits per second
1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 (default value), 230400, 460800,
921600
Reference Notes
ITU-T V.250 • Configuration is saved in non-volatile memory using AT&W.
• Once the OK response is received, the new <rate> is effective after about 2s.
41111821 Rev 12 August 04, 2020 30

2.10. &C Command: Set Data Carrier Detect (DCD)

Function Mode
HL78xx
Execute command
Syntax Response
AT&C<value> OK
Parameter
<value> 0 DCD line is always active
1 DCD line is active in the presence of data carrier only (data call
ongoing)
Reference Notes
V.25ter See data stored by &W for default value.
2.11. &D Command: Set Data Terminal Ready (DTR)

Function Mode
HL78xx
Execute command
Syntax Response
AT&D<value> OK
Parameters
<value> 0 TA ignores status on DTR
1 DTR drops from active to inactive - change to command mode
while retaining the connected data call
2 DTR drop from active to inactive - disconnect data call, change to
command mode.
Reference Notes
2.12. &S Command: DSR Option

HL78xx
Execute command
Syntax Response
AT&S OK
[<override>]
Parameter
<override> 0 or Omitted DSR signal is always active
1 DSR signal is always inactive
41111821 Rev 12 August 04, 2020 31

HL78xx
Reference Notes
2.13. &R Command: RTS/CTS Option

HL78xx
Execute command
Syntax Response
AT&R<option> OK
Parameter
<option> 1 Only for compatibility. See AT&K for hardware handshaking.
Reference Notes
2.14. S2 Command: Set Character for the Escape

Sequence (Data to Command Mode)
HL78xx
Read command
Syntax Response
ATS2? <n>
OK
Write command
Syntax Response
ATS2=<n> OK
Parameter
<n> 0-255
Reference Notes
V.25ter • It is mandatory to keep the “+” default character (n=43) for protocol specific
commands (TCP, UDP, FTP, HTTP, etc.)
• Parameters are not saved in non-volatile memory.
41111821 Rev 12 August 04, 2020 32

2.15. S4 Command: Set Response Formatting

Character
HL78xx
Read command
Syntax Response
ATS4? <n>
OK
Write command
Syntax Response
ATS4=<n> OK
Parameter
<n> 10 Response formatting character <LF>: line feed.
Reference Notes
V.25ter • <n> determines the character recognized by TA to terminate answer line. The
value is set to 10 and cannot be changed.
• See data stored by &W for default value.
2.16. +IFC Command: DTE-DCE Local Flow Control

HL78xx
Test command
Syntax Response
AT+IFC=? +IFC: (list of supported <DCE_by_DTE>s),(list of supported <DTE_by_DCE>s)
OK
Read command
Syntax Response
AT+IFC? +IFC: <DCE_by_DTE>,<DTE_by_DCE>
OK
Write command
Syntax Response
AT+IFC= OK
<DCE_by_DTE>,
<DTE_by_DCE> Parameters
<DCE_by_DTE> Local flow control parameter
0 None
2 RTS (default value)
<DTE_by_DCE> Local flow control parameter

0 None
2 CTS (default value)
41111821 Rev 12 August 04, 2020 33

HL78xx
Reference Notes
Sierra Wireless • Hardware flow control is only effective for AT UART.
Proprietary • Configuration is saved in non-volatile memory using AT&W.
• The valid pairs of values for AT+IFC are '0,0' and '2,2' as only 'Auto RTS CTS -
Hardware' flow control or no flow control are supported.
• +IFC response reflects the flow control parameters set by the AT&K command.
Examples AT+IFC=?
+IFC: (0,2),(0,2)
OK
// Possible settings:
AT+IFC=0,0
OK
AT+IFC?
+IFC: 0,0
OK
AT+IFC=2,2
OK
AT+IFC?
+IFC: 2,2
OK
41111821 Rev 12 August 04, 2020 34

3. General AT Commands
3.1. I Command: Request Identification

Information
HL78xx
Execute
command
Response
Syntax // depends on <n>
ATI[<n>] OK
Parameters
<n> 0 or Omitted Display model information (equivalent to +CGMM/+GMM)
3 Display revision identification (equivalent to +CGMR/+GMR)
8 Display modem software version
9 Display component details:
<modem SW version>
<Long revision identification>
<Build Date and Time>
IMEI-SV: <IMEI-SV version>
Legato RTOS: <Legato RTOS version and binary date>
SBUB: <SBUB>
SBFW: <SBFW>
RPuK: <RPuK>
FPuK: <FPuK>
RBUB: <RB>
RBFW: <RB>
<Component>: <Component version>
…
<Long revision identification> ASCII string
<Build Date and Time> YYYY/MM/DD HH:MM:SS
<Legato RTOS version and binary date> ASCII string
<IMEI-SV version> 16 digits IMEISV (8 digits for TAC + 6 digits for SNR + 2 SVN
digits)
<SBUB> Secure boot activation status for the bootloader

0 Secure boot not activated
1 Secure boot activated
<SBFW> Secure boot activation status for the firmware package

0 Secure boot not activated
1 Secure boot activated
41111821 Rev 12 August 04, 2020 35

AT Commands Interface Guide General AT Commands
HL78xx
<RPuK> CRC32 checksum of the root public key in OTP (empty if secure boot is
not active for the bootloader), displayed in hexadecimal.
<FPuK> CRC32 checksum of the firmware package public key (empty if secure
boot is not active for the firmware package), displayed in hexadecimal.
<RBUB> anti-rollback counter for the bootloader image, displayed in decimal
<RBFW> anti-rollback counter for the modem package, displayed in decimal
<Component> Embedded software component type; ASCII string

"atSwi"
"UBOOT"
"Apps"
"Modem Apps"
"MAC"
"PHY"
"PMP"
<Component version> Version of the software component; ASCII string

Reference Notes
V.25ter • ATI3 is identical to AT+GMR and AT+CGMR.
• ATI is identical to AT+GMM and AT+CGMM.
Examples ATI
HL7800 // When using an HL7800 module; model identification can be
// customer dependent
OK
ATI0
HL7800
OK
ATI3
AHL7800.1.2.0.20171116
OK
ATI8
HL7800.1.2.3
OK
// If secure boot is not activated on the device:

ATI9
HL7800.2.3.0
AHL78xx.2.3.0.0.RK_02_01_01_00_18.20190207
2019/02/07 09:54:54
IMEI-SV: 0123456789012301
Legato RTOS: 18.09.0.ALT1250-10-g919c693 2019/01/30 16:39:25
atSwi: 08.00
UBOOT: 01.03
Apps: RKAPP_02_01_01_00_17__52a2801313924544b18fb0cd20d894d22b8a3140
Modem Apps: ALT1250_02_01_01_00_17_MA
MAC: ALT1250_02_01_01_00_17_FW
41111821 Rev 12 August 04, 2020 36

HL78xx
PHY: 12.50.202571
PMP: 202576
SBUB: 0
SBFW: 0
RPuK:
FPuK:
RBUB: 0
RBFW: 0
OK
// If secure boot is active on the device:

ATI9
HL7800.2.3.0
AHL78xx.2.3.0.0.RK_02_01_01_00_18.20190207
2019/02/07 09:27:33
IMEI-SV: 0123456789012301
Legato RTOS: 18.09.0.ALT1250-10-g919c693 2019/01/30 16:39:25
atSwi: 08.00
UBOOT: 01.03
Apps: RKAPP_02_01_01_00_17__52a2801313924544b18fb0cd20d894d22b8a3140
Modem Apps: ALT1250_02_01_01_00_17_MA
MAC: ALT1250_02_01_01_00_17_FW
PHY: 12.50.202571
PMP: 202576
SBUB: 1
SBFW: 1
RPuK: 42BA7F7D
FPuK: 4A14BD70
RBUB: 8
RBFW: 6
OK
3.2. +CGMI/+GMI Command: Request

Manufacturer Identification
HL78xx
Test command
Syntax Response
AT+CGMI=? OK
AT+GMI=?
Execute command
Syntax Response
AT+CGMI Sierra Wireless
AT+GMI OK
41111821 Rev 12 August 04, 2020 37

HL78xx
Examples AT+CGMI
Sierra Wireless
OK
AT+GMI
Sierra Wireless
OK
3.3. +CGMM/+GMM Command: Request Model

Identification
HL78xx
Test command
Syntax Response
AT+CGMM=? OK
AT+GMM=?
Execute command
Syntax Response
AT+CGMM <model>
AT+GMM OK
Parameter
<model> Model indentification text; maximum of 2048 characters (including line
terminators)
Notes This command is identical to ATI and ATI0.
Examples AT+CGMM
HL7800 //When using an HL7800 module
OK
AT+GMM
HL7800 //When using an HL7800 module
OK
3.4. +CGMR/+GMR Command: Request Revision

Identification
HL78xx
Test command
Syntax Response
AT+CGMR=? OK
AT+GMR=?
41111821 Rev 12 August 04, 2020 38

HL78xx
Execute command
Syntax Response
AT+CGMR <SW release>
AT+GMR OK
Parameter
<SW release> Software release
Notes This command is identical to ATI3.
Examples AT+CGMR
AHL7800.1.2.3.1.20171211
OK
AT+GMR
AHL7800.1.2.3.1.20171211
OK
3.5. +CGSN Command: Request Product Serial

Number Identification (IMEI)
HL78xx
Test command
Syntax Response
AT+CGSN=? +CGSN: (list of supported <snt>s)
OK
Execute command
Syntax Response
AT+CGSN When <snt>=0 (or omitted) and command is successful:
[=<snt>] <sn>
OK
When <snt>=1 and command is successful:

+CGSN: <imei>
OK

+CGSN: <imeisv>
OK

+CGSN: <svn>
OK
or
+CME ERROR: <err>
Parameters
<snt> 0 Returns the IMEI
1 Returns the IMEI
2 Returns the IMEISV
3 Returns the SVN
41111821 Rev 12 August 04, 2020 39

HL78xx
<sn>, <imei> International Mobile Station Equipment Identity
<imeisv> International Mobile Station Equipment Identity and Software Version

Number
<svn> Software Version Number

Reference Notes
27.007 Rev13 • This command can work with or without a SIM.
• See also AT+KGSN.
3.6. +KGSN Command: Request Product Serial

Number and Software Version
HL78xx
Test command
Syntax Response
AT+KGSN=? +KGSN: (list of supported <number type>s)
OK
Execute command
Syntax Response
AT+KGSN= If <number type> = 0:
<number type> +KGSN: <IMEI>
OK
If <number type> = 1:
+KGSN: <IMEISV>
OK
+KGSN: <IMEISV_STR>
OK
+KGSN: <FSN>
OK
If <number type> = 4
+KGSN: <CSN>
OK
Parameters
<IMEI> 15-digit IMEI (8 digits for TAC + 6 digits for SNR + 1 check digit)
<IMEISV> 16-digit IMEISV (8 digits for TAC + 6 digits for SNR + 2 SVN digits)
<IMEISV_STR> Formatted string: <14 digits>-<Check digit> SV: <Software

version>
41111821 Rev 12 August 04, 2020 40

HL78xx
<FSN> 14-digit Serial Number
<CSN> Customer Serial Number (limited to 2048 characters)

Reference Notes
Sierra Wireless This command is used to get the IMEI (International Mobile Equipment Identity) and the
Proprietary software revision.
Examples AT+KGSN=0
+KGSN: 351578000023006
OK
AT+KGSN=1
+KGSN: 3515780000230001
OK
AT+KGSN=2
+KGSN: 35157800002300-6 SV:01
OK
AT+KGSN=3
+KGSN: T5640400011101
OK
AT+KGSN=4
+KGSN: 00000000000000
OK
3.7. +CSCS Command: Set TE Character Set

HL78xx
Test command
Syntax Response
AT+CSCS=? +CSCS: (list of supported <chset>s)
OK
Read command
Syntax Response
AT+CSCS? +CSCS: <chset>
OK
or
+CME ERROR: <err>
41111821 Rev 12 August 04, 2020 41

HL78xx
Write command
Syntax Response
AT+CSCS= OK
[<chset>]
or
+CME ERROR: <err>
Parameter
<chset>
"UCS2" 16-bit universal multiple-octet coded character set (ISO/IEC 10646)
"8859-1" ISO 8859 Latin 1-character set
"IRA" International reference alphabet
"HEX" Character strings only consist of hexadecimal numbers from 00 to FF. For
example, “032FE6” equals three 8-bit characters with decimal values 3, 47
and 230. No converstions to the original MT character set shall be done
"PCCP437" PC character set code page 437
Reference Notes
27.007 Rev8 • This command only affects SMS AT commands.
• The value of <chset> is saved in non-volatile memory.
3.8. +CIMI Command: Request International

Mobile Subscriber Identity
HL78xx
Test command
Syntax Response
AT+CIMI=? OK
Execute command
Syntax Response
AT+CIMI <IMSI>
OK
or
+CME ERROR: <err>
Parameter
<IMSI> International Mobile Subscriber Identity
Reference 27.007 Rev12
41111821 Rev 12 August 04, 2020 42

3.9. +GSN Command: Request Product Serial

Number (IMEI)
HL78xx
Test command
Syntax Response
AT+GSN=? OK
Execute command
Syntax Response
AT+GSN <IMEI> (identification text for determination of the individual ME)
OK
Reference Notes
27.007 Rev13 • This command can work with or without a SIM.
• See also AT+KGSN.
3.10. +GCAP Command: Request Complete TA

Capability List
HL78xx
Execute command
Syntax Response
AT+GCAP +GCAP: +CLTE-M1
OK
Reference ITU-T V.250
3.11. +CMUX Command: Multiplexer

HL78xx
Test command
Syntax Response
AT+CMUX=? +CMUX: (list of supported <mode>s),(list of supported <subset>s),(list of supported
<port_speed>s),(list of supported <N1>s),(list of supported <T1>s), (list of supported
<N2>s),(list of supported <T2>s),(list of supported <T3>s),(list of supported <k>s)
OK
Read command
Syntax Response
AT+CMUX? +CMUX: <mode>,<subset>,<port speed>,<N1>,<T1>,<N2>,<T2>,<T3>[,<k>]
OK
41111821 Rev 12 August 04, 2020 43

HL78xx
Write command
Syntax Response
AT+CMUX= OK
<mode>
[,[<subset>] or
[,[<port_speed>]
[,[<N1>][,[<T1>] +CME ERROR: <error>
[,[<N2>][,[<T2>] OK
[,[<T3>][,[<k>]
]]]]]]]] Parameters
<mode> Multiplexer Transparency Mechanism
0 Basic option
1 Advanced option (not supported)
<subset> 0 UIH frames used only

1 UI frames used only; currently not supported
2 I frames used only; currently not supported
<port_speed> Transmission rate

1 9 600 bit/s
2 19 200 bit/s
3 38 400 bit/s
4 57 600 bit/s
5 115 200 bit/s
6 230 400 bit/s
7 460 800 bit/s
8 1 Mbit/s
<N1> 1 – 255 Maximum frame size
<T1> 1 – 255 Acknowledgement timer in units of ten milliseconds; default value =

10 (100 ms)
<N2> 0 – 100 Maximum number of re-transmissions; default value = 3. Note that

currently, only range 0 – 5 is supported
<T2> 2 – 255 Response timer for the multiplexer control channel in units of ten
milliseconds; default value = 30 (300 ms). Note that <T2> must be longer than <T1>.
<T3> 1 – 255 Wake up response timer in seconds; default value = 10. This
parameter is currently not supported. In case of read command, 0 is returned.
<k> 1 – 7 Window size for Advanced operation with Error Recovery options; default
value = 2. This parameter is currently not supported. In case of read command, 0 is
returned.
Reference Notes
[27.007] § 5.7 • This command enables the multiplexing protocol control channel as defined in
3GPP GSM27.010. It sets parameters for the Control Channel (DLC0). If
optional parameters are left out, the default values are used except for <port
speed>; the current baudrate for the communication channel will remain (the
read command provides current baudrate). The final response code OK or CME
ERROR: <err> is returned using the old interface speed; the parameters
become active only after sending OK.
41111821 Rev 12 August 04, 2020 44

HL78xx
• The module handles the frame data step by step in CMUX mode. If there are
any wrong data in the frame, e.g., wrong CRC, nothing will be returned to the
terminal, and the module will wait for a valid frame data.
• If AT+CFUN is entered with <rst>=1, all open CMUX channels will be closed and
the module will reset.
• There is no activity timeout to return to AT mode after entering MUX mode.
• MUX DLC ports are not persistent over power cycles. After a power cycle, DLC
ports need to be re-established.
• When an established MT call is hanged up from the caller side, NO CARRIER
will only be sent to the port on which the call was established (i.e. the port on
which ATD/ATA was sent).
3.12. +WPPP Command: PDP Context

Authentication Configuration
HL78xx
Test command
Syntax Response
AT+WPPP=? +WPPP: (list of supported <Auth>s),(list of supported <cid>s)
OK
Read command
Syntax Response
AT+WPPP? +WPPP: <Auth>,[<cid>],[<username>],[<password>]
OK
Write command
Syntax Response
AT+WPPP= OK
<Auth>,[<cid>],
[<username>], or
[<password>]
+CME ERROR <err>
Parameters
<Auth> Type of authentication supported
0 None
1 PAP
2 CHAP
<cid> PDP context identifier used in +CGDCONT.

If this parameter is omitted, the <Auth> setting applies to all PDP contexts. In this case,
there must be at least one PDP context defined in AT+CGDCONT.
If this parameter is present, the <Auth> setting applies to this PDP context.
In both cases, the parameters are saved into non-volatile memory.
<username> Login for the APN. String type, up to 64 characters
<password> Password for the APN. String type, up to 64 characters
41111821 Rev 12 August 04, 2020 45

HL78xx
Reference Notes
Sierra Wireless • The write command can be used only if the module has no PDP context activated.
Proprietary To set the parameters, it is required to deactivate the context or switch the radio off
Command before sending the write command and reactivate or switch the radio on after.
• If credentials <username> and/or <password> are modified while the radio is off
(CFUN=0 or CFUN=4), the device must be reset to take them into account.
Examples AT+WPPP=?
+WPPP: (0-2),(1-5)
OK
AT+WPPP=1,1,“myusername”,“mypassword”
OK
AT+WPPP?
+WPPP: 1,1,“myusername”,“mypassword”
OK
3.13. +HWREV Command: Request Hardware

Revision
HL78xx
Test command
Syntax Response
AT+HWREV=? OK
Execute command
Syntax Response
AT+HWREV +HWREV: <hardware revision>
OK
Parameter
<hardware revision> Module hardware revision represented by 2 digits,
separated by a decimal point
Reference Note
Sierra Wireless • This command gives the module’s hardware revision.
Proprietary • This command is available even if SIM is not inserted.
Command
Examples AT+HWREV=?
OK
AT+HWREV
+HWREV: 1.0
OK
41111821 Rev 12 August 04, 2020 46

3.14. +KALTCFG: Set and Get Custom

Configuration
HL78xx
Test command
Syntax Response
AT+KALTCFG=? +KALTCFG: (list of supported <mode>s),(list of supported <param>s)
OK
Write command
Syntax Response
AT+KALTCFG= OK
<mode>,
<param> or
[,<value>]
+CME ERROR: <err>
Parameters
<mode> 0 Set configuration
1 Get configuration
<param>
“RRC_INACTIVITY_TIMER” Inactivity timer for RRC state mismatch recovery
“PS_DEV_MOB_TYPE” Configure optimizations for mobility purpose
<value>
Value when <param> = “RRC_INACTIVITY_TIMER”:
0 – Disable RRC inactivity timer
1 – 10800 (timer in seconds).
Default – 35.
Value when <param> = “PS_DEV_MOB_TYPE”:
1 Mobile (default)
2 Static
Reference Notes
Sierra Wireless • <value> is not relevant when <mode>=1.
Proprietary • Important: When <param> = "RRC_INACTIVITY_TIMER", the value on the
device side must be longer than the inactivity timer running on the network side.
• “RRC_INACTIVITY_TIMER” value is persistent after reset and Firmware
upgrade.
• “PS_DEV_MOB_TYPE” value is persistent after reset and Firmware upgrade.
Examples // Set parameter RRC_INACTIVITY_TIMER to default value (35 seconds)
AT+KALTCFG=0,"RRC_INACTIVITY_TIMER"
OK
// Set parameter RRC_INACTIVITY_TIMER to 15 seconds

AT+KALTCFG=0,"RRC_INACTIVITY_TIMER",15
OK
// Get value of RRC_INACTIVITY_TIMER

AT+KALTCFG=1,"RRC_INACTIVITY_TIMER"
+KALTCFG: 15
OK
41111821 Rev 12 August 04, 2020 47

HL78xx
// Disable RRC_INACTIVITY_TIMER
AT+KALTCFG=0,"RRC_INACTIVITY_TIMER",0
OK
// Set parameter PS_DEV_MOB_TYPE to default value (mobile)

AT+KALTCFG=0,"PS_DEV_MOB_TYPE"
OK
// Get value of PS_DEV_MOB_TYPE

AT+KALTCFG=1,"PS_DEV_MOB_TYPE"
+KALTCFG: 1
OK
// Set parameter PS_DEV_MOB_TYPE to static value

AT+KALTCFG=0,"PS_DEV_MOB_TYPE",2
OK
3.15. +KHWIOCFG: Enable and Disable IO Features

HL78xx
Test command
Syntax Response
AT+KHWIOCFG= +KHWIOCFG: (list of supported <featureID>s),(list of supported <mode>s)
? +KHWIOCFG: (list of supported <featureID>s),(list of supported <mode>s),(list of
supported <IO>s)
OK
Read command
Syntax Response
AT+KHWIOCFG? + KHWIOCFG: <featureID>,<mode>
[…]
+ KHWIOCFG: 3,<mode>,<IO>
OK
41111821 Rev 12 August 04, 2020 48

HL78xx
Write command
Syntax Response
AT+KHWIOCFG= OK
<featureID>,
<mode> [,<IO>] or
+CME ERROR: <err>
Parameters
<featureID> 0 Power On button
1 32kHz clock output
2 26MHz clock output
3 Low power mode monitoring
4 External RF voltage control
5 TX_ON indicator
<mode> 0 Disabled (default)

1 Enabled
<IO> 6 GPIO6 reserved for low power monitoring (cannot be changed)

8 GPIO8 reserved for external RF voltage control (cannot be
changed)
Other IOs are reserved.
Reference Notes
Sierra Wireless • This command can be issued without a SIM card inserted.
Proprietary • <IO> is only relevant for low power mode monitoring (<featureID>=3) and
external RF voltage control (<featureId>=4).
• When 32kHz and/or 26MHz feature is enabled:
 The 32kHz and 26MHz features allow generating 32 kHz and/or
26 MHz signals on the module's output clock pins.
 Parameters are saved in non-volatile memory and reloaded at startup.
• When the Power On feature is enabled:
 If the power button is in the Off position at startup, the module will be
in Off mode. As soon as the power button is switched to the On
position, the module boots normally.
 If AT+CPOF is executed and the power button is in the On position, the
module returns OK and will only go in Off mode when the power button
is switched to the Off position.
• When Low Power Mode Monitoring feature is enabled:
 GPIO6 is the only I/O pin that is used for this feature.
 GPIO6 cannot be used by AT+KGPIOCFG or AT+KGPIO commands.
 GPIO6 is pulled low if the module is:
 Configured in hibernate or lite hibernate mode, and
 eDRX mode has been configured and successfully
negotiated, and
 The application processor is ready to enter Low Power Mode.
GPIO6 will be set high when the module wakes up. (Note that tracking
area updates (TAUs) will not wake the module from sleep mode.)
 If AT+CEDRXS is used to update the eDRX parameters, the module
must be rebooted for the low power mode monitoring feature to
behave as expected.
• When the External RF Voltage Control feature is enabled:
 GPIO8 is the only I/O pin that is used for this feature.
 GPIO8 is dedicated to output an active high signal during the period
from ~400 µs before the Rx or Tx window to ~400 µs after the Rx or
41111821 Rev 12 August 04, 2020 49

HL78xx
Tx window to enable control to an external DCDC for VBATT RF.

Otherwise, when this feature is disabled, GPIO8 can be used as a
regular GPIO.
 The module must be reset for changes to take effect after the mode of
this feature is changed.
• When the TX_ON indicator feature is enabled:
 TX_ON is dedicated to output an active high signal during the period
from ~30 µs before the Tx window to the end of the Tx window.
 The module must be reset for changes to take effect after the mode of
this feature is changed.
• Configuration is saved in non-volatile memory and is therefore still effective
after a power cycle.
Examples at+khwiocfg?
+KHWIOCFG: 0,1
+KHWIOCFG: 1,1
+KHWIOCFG: 2,0
+KHWIOCFG: 3,0,6
+KHWIOCFG: 4,1,8
+KHWIOCFG: 5,0
OK
41111821 Rev 12 August 04, 2020 50

3.16. +WDSD Command: Device Services Local
Download
HL78xx
Test command
Syntax Response
AT+WDSD=? +WDSD: (list of supported <Size>s)
OK
Write command
Syntax Response
AT+WDSD= <NACK>
<Size> // User sends data
OK
or
+CME ERROR: <err>
Parameter
<Size> 1 – <maximum size> Package size in bytes
Reference Notes
Sierra Wireless • This command is available when the module has finished its initialization.
Proprietary • The response to AT+WDSD=<Size> is the <NACK> character when the device
is ready to receive data using the 1K-Xmodem or 128-Xmodem protocol.
• No reset is made during the package download.
• A timeout will happen (and a +CME ERROR: 3 is returned) if no data is sent to
the device in 5 minutes.
• When +WDSD completes (all data is received by the module), a +WDSI: 3
notification will be received requesting a user agreement to install the package.
The only supported +WDSR reply is AT+WDSR=4 (accept the install) – installs
cannot be delayed.
• The +WDSR option 5 (Delay the Install) does not apply to this command.
Examples AT+WDSD=?
+WDSD: (1-24643584)
OK
AT+WDSD=1024 //download a 1kBytes package

<NACK> //the device is ready to receive data
//send data
OK //All data are well received by the module
+WDSI: 3 //A package is ready to install (see +WDSI and +WDSR)
AT+WDSR=4 //Install the package
41111821 Rev 12 August 04, 2020 51

AT Commands Interface Guide Call Control Commands
4. Call Control Commands
4.1. D Command: Dial Number

HL78xx
Test command
Syntax Response
ATD=? 1234567890*#+ABCDPTW,@!
OK
Read command
Syntax Response
ATD? 1234567890*#+ABCDPTW,@!
OK
Execute command
Syntax Response
ATD[<n>] OK If successfully connected
CONNECT Connection has been established
RING The DCE has detected an incoming call signal from the network
NO CARRIER The connection cannot be established
BUSY Engaged (busy) signal detected
NO ANSWER If no hang up is detected after a fixed network timeout
CONNECT <data rate> Same as CONNECT but includes the data rate
RING CTM The MS has detected an incoming CTM call signal from the
network; this code is proprietary
CONNECT FAX Same as CONNECT but includes the indication related to a fax call
Parameter
<n> String of dialing digits and optionally V.25ter modifiers (dialing digits): 0-9, * , #, +,
A, B, C, D, P, T, W, ,, @, ! (maximum length: 20 digits)
Reference Notes
V.25Ter • This command may generally be aborted when receiving an ATH command
during execution.
• Response OK may arrive just after the ATD command or after the call is active
(see AT+COLP).
• <n> is ignored when it is set to ",", "T", "!", "W" or "@"
• When an established MT call is hanged up from the caller side, NO CARRIER
will only be sent to the port on which the call was established (i.e. the port on
which ATD was sent).
Examples ATD*99***3#
CONNECT
~ÿ}#À!}!}!} }4}"}&} } } } }%}&R}8}0D}'}"}(}"ná~~ÿ}#À!}!}!} }4}"}&} } } } }%}&R}8}0D}'}
"}(}"ná~~ÿ}#À!}!}!} }4}"}&} } } } }%}&R}8}0D}'}"}(}"ná~~ÿ}#À!}!}!} }4}"}&} } } } }%}&R
}8}0D}'}"}(}"ná~~ÿ}#À!}!}!} }4}"}&} } } } }%}&R}8}0D}'}"}(}"ná~~ÿ}#À!}!}!} }4}"}&} } }
} }%}&R}8}0D}'}"}(}"ná~~ÿ}#À!}!}!} }4}"}&} } } } }%}&R}8}0D}'}"}(}"ná~~ÿ}#À!}!}!} }4}
"}&} } } } }%}&R}8}0D}'}"}(}"ná~~ÿ}#À!}!}!} }4}"}&} } } } }%}&R}8}0D}'}"}(}"ná~~ÿ}#À
!}!}!} }4}"}&} } } } }%}&R}8}0D}'}"}(}"ná~
NO CARRIER
ATD=?
41111821 Rev 12 August 04, 2020 52

AT Commands Interface Guide Call Control Commands
HL78xx
1234567890*#+ABCDPTW,@!
OK
4.2. +CEER Command: Extended Error Report

HL78xx
Test command
Syntax Response
AT+CEER=? OK
Write command
Syntax Response
AT+CEER +CEER: <report>
OK
Parameter
<report> Error information given by the network in text format. Empty if no report is
available. Possible <report> values are listed in 14.3.2 CEER Error Codes.
4.3. +CMEE Command: Report Mobile Termination

Error
HL78xx
Test command
Syntax Response
AT+CMEE=? +CMEE: (list of supported <n>s)
OK
Read command
Syntax Response
AT+CMEE? +CMEE: <n>
OK
Execute command
Syntax Response
AT+CMEE=[<n>] OK
Parameter
<n> 0 Disable +CME ERROR: <err> result code and use ERROR instead
1 +CME ERROR: <err> result code and use numeric <err> values
41111821 Rev 12 August 04, 2020 53

5. Mobile Equipment Control and
Status Commands
5.1. +CCLK Command: Real Time Clock

HL78xx
Test command
Syntax Response
AT+CCLK=? OK
Read command
Syntax Response
AT+CCLK? +CCLK: <time>
or
+CME ERROR: <err>
Write command
Syntax Response
AT+CCLK= OK
<time>
or
+CME ERROR: <err>
Parameter
<time> String type value with format "yy/MM/dd,hh:mm:ss±zz", where characters
indicate year (last two digits), month, day, hour, minutes, seconds and time zone
(indicates the difference, expressed in quarters of an hour, between the local time and
GMT; range = -96 to +96). E.g. 6th of May 1994, 22:10:00 GMT+2 hours equals to
"94/05/06,22:10:00+08"
Reference Notes
27.007 Rev12 • <time> is not retained after a power cycle or software reset and it cannot be
updated by NITZ or SIB16.
5.2. +CCID Command: Request SIM Card

Identification
HL78xx
Test command
Syntax Response
AT+CCID=? OK
41111821 Rev 12 August 04, 2020 54

Mobile Equipment Control and Status
AT Commands Interface Guide Commands
HL78xx
Read command
Syntax Response
AT+CCID? +CCID: <ICCID>
OK
or
+CME ERROR: <error>
Execute command
Syntax Response
AT+CCID +CCID: <ICCID>
OK
or
+CME ERROR: <error>
Parameter
<ICCID> Integrated Circuit Card ID of the SIM card
5.3. +CLAC Command: List Available AT

Commands
HL78xx
Execute command
Syntax Response
AT+CLAC <AT command 1>
[<CR><LF><AT command 2>[..]]
OK
or
+CME ERROR: <err>
Parameter
<AT command> AT command (including the prefix “AT”)
Notes This command provides the AT command list available for the user.
41111821 Rev 12 August 04, 2020 55

5.4. +CFUN Command: Set Phone Functionality

HL78xx
Test command
Syntax Response
AT+CFUN=? +CFUN: (list of supported <fun>s), (list of supported <rst>s)
OK
or
+CME ERROR: <err>
Read command
Syntax Response
AT+CFUN? +CFUN: <fun>
OK
or
+CME ERROR: <err>
Write command
Syntax Response
AT+CFUN=<fun> OK
[,<rst>]
or
+CME ERROR: <err>
Parameters
<fun> 0 Minimum functionality
1 Full functionality
4 Disable phone both transmit and receive RF circuits
5 – 127 Not supported
<rst> 0 Do not reset the MT before setting it to <fun> power level

1 Reset the MT before setting it to <fun> power level.
Reference Notes
27.007 Rev11 • AT+CFUN=4,1 is not supported
• After a reset, the module always starts in CFUN=1, even after AT+CFUN=0,1.
• If <fun>=0 and the SIM is waiting for the PIN to be entered, AT+CFUN=1 will
return ERROR.
• If the AT+CFUN=1 command returns ERROR, the command should be retried
for successful execution.
5.5. +CPIN Command: Enter Pin

HL78xx
Test command
Syntax Response
AT+CPIN=? OK
41111821 Rev 12 August 04, 2020 56

HL78xx
Read command
Syntax Response
AT+CPIN? +CPIN: <code>
OK
or
+CME ERROR: <err>
Write command
Syntax Response
AT+CPIN=<pin> OK
[,<newpin>]
or
+CME ERROR: <err>
Parameters
<code> READY MT is not pending for any password
SIM PIN MT is waiting for SIM PIN to be given
SIM PUK MT is waiting for SIM PUK to be given
SIM PIN2 MT is waiting for SIM PIN2 to be given (this <code> is
recommended to be returned only when the last executed
command resulted in PIN2 authentication failure (i.e. +CME
ERROR: 17); if PIN2 is not entered right after the failure, it
is recommended that MT does not block its operation)
SIM PUK2 MT is waiting for SIM PUK2 to be given (this <code> is
recommended to be returned only when the last executed
command resulted in PUK2 authentication failure (i.e. +CME
ERROR: 18); if PUK2 and new PIN2 are not entered right
after the failure, it is recommended that ME does not block
its operation).
PH-SIM PIN MT is waiting for the phone-to-SIM card password to be
given
PH-NET PIN MT is waiting for the network personalization password to
be given
<pin>, <newpin> String type values

5.6. +CPAS Command: Phone Activity Status

HL78xx
Test command
Syntax Response
AT+CPAS=? +CPAS: (list of supported <pas>es)
OK
or
+CME ERROR: <err>
41111821 Rev 12 August 04, 2020 57

HL78xx
Execute command
Syntax Response
AT+CPAS +CPAS: <pas>
OK
or
+CME ERROR: <err>
Parameter
<pas> 0 Ready (ME allows commands from TA/TE)
Reference Notes
27.007 Rev12 This command reflects the data connection status.
5.7. +CSQ Command: Signal Quality

HL78xx
Test command
Syntax Response
AT+CSQ=? +CSQ: (list of supported <rssi>s),(list of supported <ber>s)
OK
Execute command
Syntax Response
AT+CSQ +CSQ: <rssi>,<ber>
OK
or
+CME ERROR: <err>
Parameters
<rssi> Received signal strength indication
0 -113 dBm or less
1 – 30 -111 to -53 dBm
31 -51 dBm or greater
99 Not known or not detectable
<ber> Integer type; channel bit error rate (in percent)

0–7 As RXQUAL values in the table in 3GPP TS 45.008 [20] subclause 8.2.4
41111821 Rev 12 August 04, 2020 58

5.8. +KSREP Command: Enable/Disable Startup

URC; Set UART Enable Timeout
HL78xx
Test command
Syntax Response
AT+KSREP=? +KSREP: (supported <act>s),(supported <timeout>s)
OK
Read command
Syntax Response
AT+KSREP? +KSREP: <act>,<stat>,<timeout>
OK
Write command
Syntax Response
AT+KSREP= OK
<act>
[,<timeout>] Parameters
<act> Indicates if the module must send a +KSUP URC during the startup
0 Disabled – Module does not send the URC
1 Enabled – Module sends the URC
<stat> Module status

0 Module is ready to receive commands for the TE. No access code is required.
1 Module is waiting for an access code. (The AT+CPIN? command can be used
used to determine it.)
2 SIM card is not present
3 Module is in “SIMlock” state
4 Unrecoverable error
5 Unknown state
6 Inactive SIM
<timeout> Maximum time between boot (wakeup/reset) and UART interface being
enabled
Supported values:
0 – UART interface is enabled as soon as UART configuration (e.g. baud rate,
parity, etc.) is applied.
4000 (Default), 30000 – If module has not fully booted (i.e. all subsystems
initialized) by this time, the UART interface will be enabled immediately.
Note – Until the module is fully booted (i.e. all module subsystems initialized,
including UART), full AT command functionality is not guaranteed.
Unsolicited Response
Notification +KSUP: <stat>
Reference Notes
Sierra Wireless • Current configuration is kept in non-volatile memory after reset.
Proprietary • The unsolicited notification is sent once after the boot process, and after waking
up from Lite Hibernate or Hibernate.
41111821 Rev 12 August 04, 2020 59

5.9. +CSIM Command: Generic SIM Access

HL78xx
Test command
Syntax Response
AT+CSIM=? OK
Write command
Syntax Response
AT+CSIM= +CSIM: <length>,<response>
<length>, OK
<command>
or
+CME ERROR: <err>
Parameters
<length> Integer type; length of the characters that are sent to TE in <command> or
<response>
<command> Command passed on by MT to the SIM in hexadecimal format
<response> Response to the command passed on by the SIM to the MT in

hexadecimal format
Reference Notes
27.007 Rev12 Compared to +CRSM, the definition of +CSIM allows the TE to take more control over the
SIM-ME interface. The locking and unlocking of the interface may be done by a special
<command> value or automatically by TA/ME (by interpreting the <command>
parameter). In case the TE application does not use the unlock command (or does not
send a <command> causing automatic unlock) in a certain timeout value, ME may
release the locking.
5.10. +CCHO Command: Open Logical Channel

HL78xx
Test command
Syntax Response
AT+CCHO=? OK
41111821 Rev 12 August 04, 2020 60

HL78xx
Write command
Syntax Response
AT+CCHO= <session_id>
<dfname> OK
or
+CME ERROR: <err>
Parameters
<dfname> All selectable applications in the UICC are referenced by a DF name
coded on 1 – 16 bytes
<sessionid> Session ID to target a specific application on the USIM using logical

channels mechanisms.
5.11. +CCHC Command: Close Logical Channel

HL78xx
Test command
Syntax Response
AT+CCHC=? OK
Write command
Syntax Response
AT+CCHC= OK
<session_id>
or
+CME ERROR: <err>
Parameter
<sessionid> Session ID to target a specific application on the USIM using logical
channels mechanisms.
5.12. +CRSM Command: Restricted SIM Access

HL78xx
Test command
Syntax Response
AT+CRSM=? OK
Write command
41111821 Rev 12 August 04, 2020 61

HL78xx
Syntax Response
AT+CRSM= +CRSM: <sw1>,<sw2>[,<response>]
<command> OK
[,<fileid>[,<P1>,
<P2>,<P3>
[,<data> or
[,<pathid>]]]] +CME ERROR: <err>
Parameters
<command> 176 READ BINARY
178 READ RECORD
192 GET RESPONSE
214 UPDATE BINARY
220 UPDATE RECORD
242 STATUS
203 RETRIEVE DATA
219 SET DATA
<fileid> Integer type; this is the identifier of an elementary data file on the SIM.
Mandatory for every command except STATUS.
<P1>, <P2>, <P3> Integer type defining the request. These parameters are mandatory
for every command, except GET RESPONE and STATUS. The values are described in
3GPP TS 51.011 [28]
<data> Information to be written to the SIM
<pathid> String type that contains the path of an elementary file on the SIM/USIM in
hexadecimal format as defined in ETSI TS 102 221 (e.g. "7F205F70" in SIM and USIM
case). This parameter will only be used in the mode "select by path from MF" as defined
in ETSI TS 102 221 [60].
<sw1>, <sw2> Integer type containing from information the SIM about the
execution of the actual command. These parameters are delivered to the TE in either
successful or failed executions of the command.
<response> Response of successful completion of the command previously issued.

STATUS and GET RESPONSE returns data, which gives information about the current
elementary data field. This information includes the type of file and its size (refer to
3GPP TS 51.011 [28]). After READ BINARY, READ RECORD or RETRIEVE DATA
commands, the requested data will be returned. <response> is not returned after a
successful UPDATE BINARY, UPDATE RECORD or SET DATA command.
Reference Notes
27.007 Rev12 By using this command instead of the generic SIM access command, +CSIM, the DTE
application has an easier but more limited access to the SIM database.
41111821 Rev 12 August 04, 2020 62

5.13. +CTZU Command: Automatic Time Zone

Update
HL78xx
Test command
Syntax Response
AT+CTZU=? +CTZU: (list of supported <onoff>s)
OK
Read command
Syntax Response
AT+CTZU? +CTZU: <onoff>
OK
Write command
Syntax Response
AT+CTZU OK
=<onoff>
or
+CME ERROR: <err>
Parameter
<onoff> 0 Disable automatic time zone update via NITZ
1 Enable automatic time zone update via NITZ
5.14. +CTZR Command: Time Zone Reporting

HL78xx
Test command
Syntax Response
AT+CTZR=? +CTZR: (list of supported <reporting>s)
OK
Read command
Syntax Response
AT+CTZR? +CTZR: <reporting>
OK
Write command
Syntax Response
AT+CTZR= OK
<reporting>
or
+CME ERROR: <err>
Parameters
41111821 Rev 12 August 04, 2020 63

HL78xx
<reporting> 0 Disable time zone change event reporting

1 Enable time zone change event reporting with URC +CTZV: <tz>
2 Enable time zone change event reporting with URC
+CTZE: <tz>,<dst>,[<time>]
<tz> Sum of the local time zone (difference between the local time and GMT
expressed in quarters of an hour) plus daylight saving time. The format is "±zz",
expressed as a fixed width, 2-digit integer with range -48 to +56. To maintain a fixed
width, numbers in the range -9 to +9 are expressed with a leading zero, e.g. "-09", "+00"
and "+09".
<dst> 0 <tz> includes no adjustment for Daylight Saving Time

1 <tz> includes +1 hour (equals 4 quarters in <tz>) adjustment for Daylight
Saving Time
2 <tz> includes +2 hours (equals 8 quarters in <tz>) adjustment for Daylight
Saving Time
<time> Local time in format "YYYY/MM/DD,hh:mm:ss", expressed as integers

representing year (YYYY), month (MM), date (DD), hour (hh), minute (mm) and second
(ss). Local time can be derived by the MT from information provided by the network at
the time of delivering time zone information and will be present in the unsolicited result
code for extended time zone and local time reporting if the universal time is provided by
the network.
Reference Notes
27.007 Rev12 • <reporting> is saved into non-volatile memory when the write command is sent.
• URCs are enabled on all AT ports, including CMUX DLC.
5.15. +CPSMS Command: Power Saving Mode

Setting
HL78xx
Test command
Syntax Response
AT+CPSMS=? +CPSMS: (list of supported <mode>s),
(list of supported <Requested_Periodic-RAU>s),
(list of supported <Requested_GPRS-READY-timer>s),
(list of supported <Requested_Periodic-TAU>s),
(list of supported <Requested_Active-Time>s)
Read command
Syntax Response
AT+CPSMS? +CPSMS: <mode>,
[<Requested_Periodic-RAU>],
[<Requested_GPRS-READY-timer>],
[<Requested_Periodic-TAU>],
[<Requested_Active-Time>]
41111821 Rev 12 August 04, 2020 64

HL78xx
Write command
Syntax Response
AT+CPSMS= OK
[<mode>
[,<Requested_ Parameters
Periodic-RAU> <mode> Indication to disable or enable the use of PSM in the UE; integer type
[,<Requested_
GPRS-READY- 0 Disable the use of PSM
timer> 1 Enable the use of PSM
[,<Requested_
Periodic-TAU> <Requested_Periodic-RAU> Requested extended periodic RAU. String type; one
[,<Requested_ byte in an 8 bit-format
Active-Time>]]]]]
<Requested_GPRS-READY-timer> Requested GPRS READY timer value
(T3314) to be allocated to the UE in GERAN/UTRAN. String type; one byte in an 8-bit
format
<Requested_Periodic-TAU> Requested extended periodic TAU value (T3412) to

be allocated to the UE in E-UTRAN. String type; one byte in an 8-bit format.
<Requested_Active-Time> Requested Active Time value (T3324) to be allocated

to the UE. String type; one byte in an 8-bit format.
5.16. +CEDRXS Command: eDRX Setting

HL78xx
Test command
Syntax Response
AT+CEDRXS=? +CEDRXS: (range of supported <mode>s),(range of supported <AcT-type>s),(range of
supported <Requested_eDRX_value>s)
Note: The range of supported <Requested_eDRX_value>s depends on the current

RAT — Cat-M1 ("0000"-"1101") / NB-IoT ("0000"-"1111").
Read command
Syntax Response
AT+CEDRXS? [+CEDRXS: <AcT-type>, <Requested_eDRX_value>
[<CR><LF>+CEDRXS: <AcT-type>, <Requested_eDRX_value>
[…]]]
OK
Write command
Syntax Response
+CEDRXS= OK
[<mode>
[,<AcT-type> Parameters
[,<Requested_ <mode> Integer type, indicates to disable or enable the use of eDRX in the UE
eDRX_value>]]]
0 Disable the use of eDRX
1 Enable the use of eDRX
41111821 Rev 12 August 04, 2020 65

HL78xx
2 Enable the use of eDRX and enable the unsolicited result code
+CEDRXP: <AcT-type>[,<Requested_eDRX_value>
[,<NW-provided_eDRX_value>[,<Paging_time_window>]]]
3 Disable the use of eDRX and discard all parameters for eDRX
<AcT-type> Integer type, indicates the type of access technology

0 Access technology is not using eDRX
4 E-UTRAN (WB-S1 mode)
5 E-UTRAN (NB-S1 mode)
<Requested_eDRX_value> Integer type in Write command, or string type (half a

byte in a 4-bit format) in Read/Write/Test commands. The eDRX value refers to bits 4 to
1 of octet 3 of the Extended DRX parameters information element.
For example:
Test command shows string value range as ("0000"-"1111")
Read command shows a string value from that range (e.g. "0110")
Write command accepts 0−15 or "0000"−"1111")
Note: The actual supported range varies by RAT — CAT-M1 (0-13); NB-IoT (0-15).
<NW-provided_eDRX_value> String type; half a byte in a 4-bit format. The eDRX

value refers to bit 4 to 1 of octet 3 of the Extended DRX parameters information element
<Paging_time_window> String type; half a byte in a 4-bit format. The paging time
window referes to bit 8 to 5 of octet 3 of the Extended DRX parameters information
element
Reference Notes
27.007 Rev13 • Important: To enable/disable/configure eDRX, use only +KEDRXCFG or
+CEDRXS. Do not use a combination of both commands.
• If the ability to configure the eDRX Paging Time Window (PTW) is required, use
+KEDRXCFG instead of +CEDRXS.
• Configuration is saved in non-volatile memory and is therefore still effective after a
power cycle.
5.17. +CEDRXRDP Command: eDRX Read Dynamic

Parameters
HL78xx
Test command
Syntax Response
AT+ OK
CEDRXRDP=?
41111821 Rev 12 August 04, 2020 66

HL78xx
Read command
Syntax Response
AT+CEDRXRDP +CEDRXRDP: <AcT-type>[,<Requested_eDRX_value[,<NW-
provided_eDRX_value>[,<Paging_time_window>]]]
OK
Parameters
<AcT-type> Indicates the type of access technology
0 Access technology does not use eDRX
<Requested_eDRX_value> String type; half a byte in a 4-bit format. The eDRX

value refers to bit 4 to 1 of octet 3 of the Extended DRX parameters information element.
<NW-provided_eDRX_value> String type; half a byte in a 4-bit format. The eDRX

value refers to bit 4 to 1 of octet 3 of the Extended DRX parameters information element
<Paging_time_window> String type; half a byte in a 4-bit format. The paging time
window refers to bit 8 to 5 of octet 3 of the Extended DRX parameters information
element
Reference Notes
TS 27.007 Rev13 This command is used to specify the relationship between the type of access technology
and the requested eDRX value.
5.18. +CESQ Command: Extended Signal Quality

HL78xx
Test command
Syntax Response
AT+CESQ=? +CESQ: (list of supported <rxlev>s),(list of supported <ber>s),(list of supported
<rscp>s),(list of supported <ecno>s),(list of supported <rsrq>s),(list of supported
<rsrp>s)
OK
Execute command
Syntax Response
AT+CESQ +CESQ: <rxlev>,<ber>,<rscp>,<ecno>,<rsrq>,<rsrp>
OK
Parameters
<rxlev> Integer type; received signal strength level (see 3GPP TS 45.008 [20]
subclause 8.1.4)
0 rssi < -110 dBm
1 -110 dBm ≤ rssi < -109 dBm
2 -109 dBm ≤ rssi < -108 dBm
…
61 -50 dBm ≤ rssi < -49 dBm
62 -49 dBm ≤ rssi < -48 dBm
41111821 Rev 12 August 04, 2020 67

HL78xx
63 -48 dBm ≤ rssi

99 not known or not detectable
<ber> Integer type; channel bit error rate (in percent)

0–7 As RXQUAL values in the table in 3GPP TS 45.008 [20] subclause 8.2.4
<rscp> Integer type; received signal code power (see 3GPP TS 25.133 [95]
subclause 9.1.1.3 and 3GPP TS 25.123 [96] subclause 9.1.1.1.3)
<ecno> Integer type; ratio of the received energy per PN chip to the total received
power spectral density (see 3GPP TS 25.133 [95] subclause)
<rsrq> Integer type; reference signal received quality (see 3GPP TS 36.133 [96]
subclause 9.1.7)
0 rsrq < -19.5 dB
1 -19.5 dB ≤ rsrq < -19 dB
2 -19 dB ≤ rsrq < -18.5 dB
…
32 -4 dB ≤ rsrq < -3.5 dB
33 -3.5 dB ≤ rsrq < -3 dB
34 -3 dB ≤ rsrq
<rsrp> Integer type; reference signal received power (see 3GPP TS 36.133 [96]
subclause 9.1.4)
0 rsrp < -140 dBm
1 -140 dBm ≤ rsrp < -139 dBm
2 -139 dBm ≤ rsrp < -138 dBm
…
95 -46 dBm ≤ rsrp < -45 dBm
96 -45 dBm ≤ rsrp < -44 dBm
97 -44 dBm ≤ rsrp
Reference Notes
27.007 Rev12 • If the current serving cell is not a GERAN cell, <rxlev> and <ber> are set to
value 99.
• If the current serving cell is not a UTRA FDD or UTRA TDD cell, <rscp> is set
to 255.
• If the current serving cell is not a UTRA FDD cell, <ecno> is set to 255.
• If the current serving cell is not an E-UTRA cell, <rsrq> and <rsrp> are set to
255.
• Consequently, the HL78xx will return:
 99 for <rxlev> and <ber>
 255 for <rscp> and <ecno>
41111821 Rev 12 August 04, 2020 68

5.19. +KBNDCFG Command: Set Configured LTE

Band(s)
Warning: RF bands must be set prior to using the module. It is highly recommended to limit the number of
enabled RF bands to lessen power consumption. Additionally, the number of enabled RF bands
should be limited to avoid prolonged scanning operations. Scanning operations take place
regardless of number of RF bands enabled but will take longer if too many bands are enabled.
Refer to section 5 of AirPrime HL78XX Customization Guide Application Note (reference number:
2174213) for details.
HL78xx
Test command
Syntax Response
AT+KBNDCFG=? +KBNDCFG: <RAT>,(list of supported <bnd bitmap>s)
OK
Read command
Syntax Response
AT+KBNDCFG? +KBNDCFG: <RAT>,(list of configured <bnd bitmap>s)
OK
Write command
Syntax Response
AT+KBNDCFG +KBNDCFG: <RAT>,(<bnd bitmap>s to configure)
=<RAT>,<bnd OK
bitmap>
Parameters
<RAT> Radio Access Technology
0 CAT-M1
1 NB-IoT (HL7800/HL7802 only)
2 GSM (for HL7802 only)
<bnd bitmap> Band bitmap in hexadecimal format without the 0x prefix. This is
the logical representation of 1<<(BandNumber -1).
(Currently only used for RAT CAT-M1 and NB-1.)
0000 00000000 00000000 Not available

0000 00000000 00000001 LTE Band 1 (2000 MHz)
0000 00000000 00000002 LTE Band 2 (1900 MHz)
0000 00000000 00000004 LTE Band 3 (1800 MHz)
0000 00000000 00000008 LTE Band 4 (1700 MHz)
0000 00000000 00000010 LTE Band 5 (850 MHz)
0000 00000000 00000080 LTE Band 8 (900MHz)
0000 00000000 00000100 LTE Band 9 (1900MHz)
0000 00000000 00000200 LTE Band 10 (2100MHz)
0000 00000000 00000800 LTE Band 12 (700 MHz)
0000 00000000 00001000 LTE Band 13 (700 MHz)
0000 00000000 00010000 LTE Band 17 (700 MHz)
0000 00000000 00020000 LTE Band 18 (800MHz)
0000 00000000 00040000 LTE Band 19 (800MHz)
41111821 Rev 12 August 04, 2020 69

HL78xx
0000 00000000 00080000 LTE Band 20 (800MHz)

0000 00000000 01000000 LTE Band 25 (1900MHz)
0000 00000000 02000000 LTE Band 26 (800 MHz)
0000 00000000 04000000 LTE Band 27 (800 MHz)
0000 00000000 08000000 LTE Band 28 (700MHz)
0002 00000000 00000000 LTE Band 66 (1800MHz)
Reference Notes
Sierra Wireless • This command sets the configured LTE band(s) on which the module can
Proprietary operate.
• The module must be reset (power cycle, reset input, or AT+CUN=1,1) for any
changes to the band configuration to take effect.
• When using the write command, the answer will return the entered <bnd
bitmap>.
• To get the list of configured band(s), use AT+KBNDCFG?.
• To get the list of supported band(s), use AT+KBNDCFG=?.
• Only bands returned by +KBNDCFG=? for available RAT can be configured.
• To avoid a long scanning duration, it is necessary to limit the number of bands
to the targeted network.
• Switching RAT is possible with the +KSRAT command.
Examples AT+KSRAT?
+KSRAT: 0 // Get active RAT: CAT-M1
OK
AT+KBNDCFG=0,7 // Set LTE Bands 1, 2, 3 selected; no 0x prefix for CAT-M1

+KBNDCFG: 0,7
OK
AT+CFUN=1,1 // Force initialization of radio to consider new configured bands
AT+KBNDCFG? // Get configured network bands

+KBNDCFG: 0,00000000000000000007 // LTE bands 1, 2, 3 for CAT-M1
+KBNDCFG: 1,0
+KBNDCFG: 2,0
OK
AT+KBNDCFG=? // Get supported network bands

+KBNDCFG: 0,0002000000000F0F1B9F // bands 1, 2, 3, 4, 5, 8, 9, 10, 12, 13,
// 17, 18, 19, 20, 25, 26, 27, 28, 66
// for CAT-M1
+KBNDCFG: 1,0002000000000B0F189F // bands 1, 2, 3, 4, 5, 8, 12, 13, 17,
// 18, 19, 20, 25, 26, 28, 66 for NB-IoT
+KBNDCFG: 2,0
OK
AT+KBNDCFG=0,0 // Not defined

+CME ERROR: 3
AT+KBNDCFG=0,189F // Set LTE Bands 1, 2, 3, 4, 5, 8, 12, 13 for CAT-M1

+KBNDCFG: 0,189F
OK
AT+KSRAT=1,1 // Set RAT to NB-IoT and reboot module

OK
41111821 Rev 12 August 04, 2020 70

HL78xx
AT+KSRAT? // Get active RAT

+KSRAT: 1 // Active RAT is NB-IoT
OK
AT+KBNDCFG? // Get configured network bands

+KBNDCFG:0,0
+KBNDCFG:1,0000000000000000000E // LTE bands 1,2,3 for NB-IoT
+KBNDCFG:2,0
OK
5.20. +KBND Command: Get Active LTE Band(s)

HL78xx
Read command
Syntax Response
AT+KBND? +KBND: <RAT>,(the active <bnd bitmap>)
OK
Parameters
<RAT> Radio Access Technology
0 CAT-M1 (this is the only RAT available on the HL7800-M)
1 NB-IoT
<bnd bitmap> Band bitmap in hexadecimal format without the 0x prefix. This is
the logical representation of 1<<(BandNumber -1).
(Currently only used for RAT CAT-M1 or NB-IoT)
0000 00000000 00000000 Not available

0000 00000000 00000001 LTE Band 1 (2000 MHz)
0000 00000000 00000002 LTE Band 2 (1900 MHz)
0000 00000000 00000004 LTE Band 3 (1800 MHz)
0000 00000000 00000008 LTE Band 4 (1700 MHz)
0000 00000000 00000010 LTE Band 5 (850 MHz)
0000 00000000 00000080 LTE Band 8 (900MHz)
0000 00000000 00000100 LTE Band 9 (1900MHz)
0000 00000000 00000200 LTE Band 10 (2100MHz)
0000 00000000 00000800 LTE Band 12 (700 MHz)
0000 00000000 00001000 LTE Band 13 (700 MHz)
0000 00000000 00010000 LTE Band 17 (700 MHz)
0000 00000000 00020000 LTE Band 18 (800MHz)
0000 00000000 00040000 LTE Band 19 (800MHz)
0000 00000000 00080000 LTE Band 20 (800MHz)
0000 00000000 01000000 LTE Band 25 (1900MHz)
0000 00000000 02000000 LTE Band 26 (800 MHz)
0000 00000000 04000000 LTE Band 27 (800 MHz)
41111821 Rev 12 August 04, 2020 71

HL78xx
0000 00000000 08000000 LTE Band 28 (700MHz)

0002 00000000 00000000 LTE Band 66 (1800MHz)
Reference Notes
Sierra Wireless • This command returns the LTE band that the module is currently using and the
Proprietary corresponding RAT.
• If there is no current active band, the returned bitmap is 0.
• +CME_ERROR: 3 is returned is case of bad syntax.
• When using AT+KBNDCFG=<RAT>,<bnd bitmap>, radio re-initialization is
necessary to consider new configured band(s). Otherwise, AT+KBND? won’t be
functional. This can be done by resetting the module (AT+CFUN=1,1).
• Switching RAT is possible with the +KSRAT command.
Examples AT+KBND? // Get the activated network band: LTE band 66 for CAT-M1
+KBND: 0,00020000000000000000
OK
AT+KBND? // Get the activated network band: no active band

+KBND: 0,00000000000000000000
OK
5.21. +KGPIO Command: Hardware IO Control

HL78xx
Test command
Syntax Response
AT+KGPIO=? +KGPIO: (list of supported <IO>s),(list of supported <cde>s)
OK
Read command
Syntax Response
AT+KGPIO? OK
41111821 Rev 12 August 04, 2020 72

HL78xx
Write command
Syntax Response
AT+KGPIO=<IO>, If <cde> = 2:
<cde> +KGPIO: <IO>, <current_value>
OK
Else
OK
Parameters
<IO> 1-8, 10, 11, 14, 15 Selected IO
<cde> 0 Reset the selected IO

1 Set the selected IO
2 Request the current value of the IO
<current_value> 0 GPIO is Low

1 GPIO is High
Notes • The current configuration is saved in non-volatile memory after a reset.
• Check the configuration of +KGPIOCFG when +CME ERROR: 3 issued.
• AT+KGPIO=? returns a dynamic list of supported GPIO. GPIOs assigned to a
specific purpose are not listed.
• This command can be used without SIM.
Examples AT+KGPIO=?
+KGPIO: (1,2,3,4,5,6,7,8,10,11,14,15),(0-2)
OK
AT+KGPIO?
OK
AT+KGPIOCFG=1,0,2
OK
AT+KGPIO=1,1
OK
AT+KGPIO=1,0
OK
5.22. +KGPIOCFG Command: GPIO Configuration

HL78xx
Test command
Syntax Response
AT+KGPIOCFG= +KGPIOCFG: (list of supported <n>s),(list of supported <dir>s), (list of supported <pull
? mode>s)
OK
41111821 Rev 12 August 04, 2020 73

HL78xx
Read command
Syntax Response
AT+KGPIOCFG? +KGPIOCFG: <n>,<dir>,<pull mode>[<CR><LF>
+KGPIOCFG: <n>,<dir>,<pull mode>
[...]]
OK
Write command
Syntax Response
AT+KGPIOCFG= OK
<n>,<dir>,
<pull mode> Parameters
<n> 1-8, 10, 11, 14, 15 GPIO number
<dir> Direction
0 Output
1 Input
<pull mode> 0 Pull down. Internal pull down resistor available. Only used in input
mode.
1 Pull up. Internal pull up resistor available. Only used in input mode.
2 No pull. Internal pull up/down resistor NOT available. Only used in
output mode.
Notes • The current configuration is saved in non-volatile memory before a reset.
• Pull down/up mode provides a stable input level.
• AT+KGPIOCFG=? and AT+KGPIOCFG? return a dynamic list of supported
GPIOs. GPIOs assigned to a specific purpose are not listed.
Examples AT+KGPIOCFG=?
+KGPIOCFG: (1,2,3,4,5,6,7,8,10,11,14,15),(0-1),(0-2)
OK
AT+KGPIOCFG?
+KGPIOCFG: 1,0,2
+KGPIOCFG: 2,0,2
+KGPIOCFG: 3,0,2
+KGPIOCFG: 4,0,2
+KGPIOCFG: 5,0,2
+KGPIOCFG: 6,0,2
+KGPIOCFG: 7,0,2
+KGPIOCFG: 8,0,2
+KGPIOCFG: 10,0,2
+KGPIOCFG: 11,0,2
+KGPIOCFG: 14,0,2
+KGPIOCFG: 15,0,2
OK
AT+KGPIOCFG=1,0,2
OK
AT+KGPIOCFG=1,1,1
OK
41111821 Rev 12 August 04, 2020 74

5.23. +KCELL Command: Cell Environment

Information
HL78xx
Test command
Syntax Response
AT+KCELL=? +KCELL: (list of supported <revision>s)
OK
Read command
Syntax Response
AT+KCELL? OK
Write command
Syntax (for Response for AT+KCELL=0 (LTE mode)

<revision>=0)) +KCELL: 0
AT+KCELL=0 +KCELL: 0
+KCELL: <nbLTEcells>[,<cell_type>,<PLMN>,<LTE_CI>,<PhyCellInd>,
Syntax (for <trackingAreaCode>,<RSRPResult>,<RSRQResult>,<LTE_TA>][<cell_type>,
<revision>=2)) [[Earfcn>,[<PhyCellID>,[<RSRPResult>,[<RSRQResult>]]]]][…]]
AT+KCELL=2,<ru OK
n_scan>[,<rich_s
can_config>] Response for AT+KCELL=0 (GSM mode)
+KCELL: <nbGSMcells>[,<cell_type>,<ARFCN>,<BSIC>,<PLMN>,<LAC>,
<GSM_CI>,<RSSI>,<GSM_TA>][,<cell_type>,<ARFCN>,<BSIC>,<PLMN>,
<LAC>,<CI>,<RSSI>][…]]
+KCELL: 0
+KCELL: 0
OK
Response for AT+KCELL=2,0

// Previous results returned as a single command response, not as
// individual URCs
+KCELL: <Earfcn>,<PhyCellInd>,<LTE_CI>,<PLMN>,<RSRPResult>,
<trackingAreaCode>
[…]
OK
Response for AT+KCELL=2,1[,<rich_scan_config>]

OK
// After scan completes, separate URCs are received for each discovered cell,
// followed by +KCELL: 0 which indicates there are no further URCs to receive.
+KCELL: <Earfcn>,<PhyCellInd>,<LTE_CI>,<PLMN>,<RSRPResult>,
<trackingAreaCode>
[…]
+KCELL: 0
Parameters
<revision> 0 Camped cell (pre-4.5.0.0)
2 All surrounding cells
41111821 Rev 12 August 04, 2020 75

<run_scan> 0 Get previous results. Returned directly in the command

response.
1 Obtain new results. Individual URCs returned for each discovered
cell.
<rich_scan_config>
0 Normal scan (Default) – Returns the strongest cell on
each <Earfcn>.
1 Rich scan – Returns all cells on each <Earfcn> (i.e. the strongest
cell plus all intracells). Note that this increases power consumption
and scan time as compared to a normal scan.
Note – This parameter is supported only for <run_scan> =1. The

command will return an error if used for <run_scan> = 0.
<nbGSMcells> 0 ≤ i ≤ 10 Number of base stations available
<cell_type> 0 GSM serving cell

1 GSM neighbor cell
2 UMTS serving cell (Not supported)
3 UMTS neighbor cell (Not supported)
4 UMTS detected cell (Not supported)
5 LTE serving cell
6 LTE neighbor cell
<ARFCN> 0 – 1023 Absolute Radio Frequency Channel Number
<BSIC> 0 – 63 Base Station Identity Code
<PLMN> PLMN identifiers (3 bytes) in hexadecimal format, made of MCC (Mobile

Country Code), and MNC (Mobile Network Code)
<LAC> Location Area in hexadecimal format
<GSM_CI> Cell ID, 4 hexadecimal digits, e.g. ABCD
<RSSI> (Serving Cell) 0 – 63 Received signal level of the BCCH carrier. Add -110
to convert value to dBm.
(Neighbor Cell) 0 – 63 Add -110 to convert value to dBm.
<GSM_TA> 0 – 63 Timing advance; only available for serving cell
<nbLTEcells> 0 ≤ k ≤ 20 Number of LTE base stations available
<LTE_CI> Cell Identity in 8 hexadecimal digits with length = 28 bits. (Ref: 3GPP TS
36.331, 6.3.4, CellIdentity IE)
<PhyCellInd> 0 – 503 Physical Cell ID (Ref: 3GPP TS 36.331, 6.3.4,

PhysCellId IE)
<TrackingAreacode> 0 – 65535 Tracking Area Code (Ref: 3GPP TS 36.331,

6.3.4, Tracking AreaCode IE)
<RSRPResult> 0 – 97 Reference Signal Received Power (Ref: 3GPP TS 36.331,

6.3.5, RSRP-Range IE)
<RSRQResult> 0 – 34 Reference Signal Received Quality (Ref: 3GPP TS 36.331,

6.3.5, RSRQ-Range IE)
41111821 Rev 12 August 04, 2020 76

HL78xx
<LTE_TA> 0 – 63 Timing advance. Available only when the module is in

connected state.
<Earfcn> 0 – 0xFFFF Carrier frequency of the neighbor cell

designated by the EUTRA Absolute Radio Frequency Channel Number (EARFCN) (Ref:
3GPP TS 36.101, 5.7.3)
Notes • This command provides information related to the network environment and
can be used, for example, for localization calculation.
• The second query response line is for UMTS cells, which are not supported so
+KCELL: 0.
• For AT+KCELL=0, this command can only be used with a SIM and while the UE
is attached to a network.
• For AT+KCELL=2,1:
o Feature is not currently supported on GSM
o Module must be in RRC IDLE state before running scan
o Module may deregister following a scan if a Sierra Wireless Smart SIM
is being used
41111821 Rev 12 August 04, 2020 77

HL78xx
Examples AT+KCELL=?
+KCELL: (0,2),(0-1),(0-1)
OK
// Original functionality – LTE Mode

AT+KCELL=0
+KCELL: 0
+KCELL: 0
+KCELL: 3,5, 54f460, c437406,322,54140,34,14,0,6,1424,266,32,9,6,1424,28,30,5
OK
// Original functionality – GSM Mode

AT+KCELL=0
+KCELL: 2,0,178,22,030227,2008,2a87,60,1,1,233,17,030227,2008,bdb3,13
+KCELL: 0
+KCELL: 0
OK
// Normal scan
at+kcell=2,1
OK
+CEREG: 4
+KCELL: 5070,30,061FEC0A,030227,78,35080
+KCELL: 5145,376,01AE180A,030222,60,11006
+KCELL: 0
+CEREG: 5,"2AFE","01AE180A",7
// Rich scan
AT+KCELL =2,1,1
OK
+CEREG: 4
+KCELL: 5145,376,01AE180A,030222,64,11006
+KCELL: 5070,30,061FEC0A,030227,80,35080
+KCELL: 5070,46,061FEC0C,030227,93,35080
+KCELL: 0
+CEREG: 5,"2AFE","01AE180A",7
5.24. +KSLEEP Command: Power Management

Control
AirPrime HL78xx modules offer 3 types of power saving management:
• Hardware controlled (DTR signal) – sleep mode permission is driven by a HW signal (DTR),
together with the WAKEUP signal. If either signal is active (low DTR or high WAKEUP), the
module doesn’t enter sleep mode.
• Standalone – standalone sleep mode. The module decides by itself when it enters sleep
mode.
• Forbidden – sleep mode always disabled.
41111821 Rev 12 August 04, 2020 78

And 3 levels of power saving mode (from lightest to deepest):

• Sleep
• Lite Hibernate
• Hibernate
For more details, refer to AirPrime HL7800 Low Power Modes Application Note (reference number:
2174229).
Table 2. AT+KSLEEP Command Description
HL78xx
Test command
Syntax Response
AT+KSLEEP=? +KSLEEP: (list of supported <mngt>s)[,(list of supported <level>s)[,(list of supported
<delay>s)]
OK
Read command
Syntax Response
AT+KSLEEP? +KSLEEP: <mngt>[,<level>[,<delay>]]
OK
Write command
Syntax Response
AT+KSLEEP= OK
<mngt>[,<level>
[,<delay>]] Parameters
<mngt> Defines how the module enter and leave power saving mode
0 Sleep mode permission is driven by a HW signal (DTR). If the signal is active (low
level), the module doesn’t enter sleep mode.
1 Standalone sleep mode. The module decides by itself when it enters sleep mode.
2 Sleep mode is always disabled
<level> Defines the lowest power saving mode that the module can enter. This
parameter is mandatory when <mngt>=0 or 1; not allowed for <mngt>=2.
0 Sleep
1 Lite Hibernate
2 Hibernate
<delay> 0 – 99 Duration of delay before the module enters power saving

mode after reboot in seconds
Reference Notes
Sierra Wireless • Current configuration is kept in non-volatile memory after reset.
Proprietary • Only hardware signals (e.g. WAKEUP and UART_DTR) impact power saving
management (modem signals over MUX will not).
• The actual power saving level applied to the Sleep state may be less than the
configured level due to other subsystem requirements and hardware limitations.
Examples AT+KSLEEP=?
+KSLEEP: (0-2)[,(0-2)[,(0-99)]]]
OK
41111821 Rev 12 August 04, 2020 79

HL78xx
AT+KSLEEP?
+KSLEEP: 0,0,0
OK
AT+KSLEEP=1,2
OK
AT+KSLEEP?
+KSLEEP: 1,2,0
OK
AT+KSLEEP=2
OK
AT+KSLEEP?
+KSLEEP: 2
OK
AT+KSLEEP=0,1,10
OK
AT+KSLEEP?
+KSLEEP: 0,1,10
OK
5.25. +KRIC Command: Ring Indicator Control

HL78xx
Test command
Syntax Response
AT+KRIC=? +KRIC: (list of supported <masks>s),(list of supported <shape>s),(list of supported
<pulse duration>s),(list of supported <Ri inverse gpio>s),(list of supported <pull>s)
OK
Read command
Syntax Response
AT+KRIC? +KRIC: <mask>,<shape>,<pulse duration>,<RI inverse gpio>,<pull>
OK
41111821 Rev 12 August 04, 2020 80

HL78xx
Write command
Syntax Response
AT+KRIC= OK
<mask>
[,<shape> Parameters
[,<pulse
duration>[,<RI <mask> Use of RI signal; bit field type. To set several activation triggers, sum up
inverse the values
gpio>[,<pull>]]]] 0 RI not used (Default)
2 RI activated on SMS (+CMT, +CMTI)
16 RI activated on network state (+CEREG)
32 RI activated on TCP connection request (+KTCP_SRVREQ)
64 RI activated on TCP Data reception (+KTCP_DATA)
128 RI activated on UDP Data reception (+KUDP_DATA)
<shape> Signal shape – only available for incoming calls

0 Repeat pulses. The total length of the pulse is equivalent to the transfer of the
RING or CRING notification
<pulse duration> 1 – 5 RI pulse durations in seconds (Default is 1)
<RI inverse gpio> GPIO number to notify event instead of RI

0 Event notified on RI pin (Default)
2 Event notified on GPIO2
<pull> Internal pull resistor state

0 Disabled (Default)
1 Pull-down enabled
Reference Notes
Sierra Wireless • The current configuration is kept in non-volatile memory after a reset.
Proprietary • Write command is only sent once to define the RI behavior.
• Do not use the command during an incoming call, etc.
• This command can be used without a SIM.
• When the event is notified on GPIO2 instead of the RI pin, the GPIO is active
high so the pulse goes from low voltage level to high voltage level then low
voltage level. Whereas when the RI pin is active low, the pulse on RI goes from
high voltage level to low voltage level then high voltage level.
• Recommendation – Use the internal pull-down to prevent voltage spikes when
entering hibernate mode. Note that enabling the pull-down may increase
current consumption while the GPIO is asserted, depending on external
hardware connections.
41111821 Rev 12 August 04, 2020 81

HL78xx
Examples AT+KRIC=?
+KRIC: (0-240),(0),(1-5),(0,2),(0,1)
OK
AT+KRIC?
+KRIC: 0,0,1,0 // RI deactivated
OK
AT+KRIC=192 // activation of RI for TCP and UDP data reception (64+128)

OK
AT+KRIC?
+KRIC: 192,0,1,0
OK
5.26. +CPOF Command: Power Off

HL78xx
Execute command
Syntax Response
AT+CPOF OK
Notes • This command powers the module off.
• OK is immediately returned before the power off sequence.
• The only way to wake the module up is to set the WAKEUP pin high.
• When the Power On feature (+KHWIOCFG) is enabled and the power button is
ON, +CPOF will return OK and the module will power off as soon as the power
button is switched OFF.
5.27. +CPWROFF Command: Power Off

HL78xx
Test command
Syntax Response
AT+CPWROFF=? OK
41111821 Rev 12 August 04, 2020 82

HL78xx
Execute command
Syntax Response
AT+CPWROFF OK
[=<mode>]
or
ERROR
Parameter
<mode> Power down mode
1 Fast power down mode
Notes • Not specifying a parameter value for the execute command will perform normal
IMSI detach before powering down.
• <mode>=1 will perform fast power down without an IMSI detach request being
sent to the network.
• The only way to wake the module up is to set the WAKEUP pin high. The
WAKEUP pin must be de-asserted within 1 second of executing
AT+CPWROFF to power off properly.
• When the Power On feature (+KHWIOCFG) is enabled and the power button is
ON, +CPWROFF will return OK and the module will power off as soon as the
power button is switched OFF.
5.28. +WIMEI Command: IMEI Write and Read

HL78xx
Test command
Syntax Response
AT+WIMEI=? OK
Read command
Syntax Response
AT+WIMEI? +WIMEI: <IMEI>
OK
Write command
Syntax Response
AT+WIMEI= +WIMEI: <IMEI>
<IMEI> OK
Parameter
<IMEI> 14 or 15-digit IMEI as defined in GSM 23.003
41111821 Rev 12 August 04, 2020 83

HL78xx
Notes • The default IMEI is 012345678901237.

• The write command can only be used once for IMEI programming.
• The IMEI to be written must be different from the default IMEI.
• If a 14-digit IMEI is entered, the 15th checksum digit is automatically calculated.
• Customers take on the responsibility of adhering to 3GPP TS 22.016, Section 2
– General requirements when using this command. This includes ensuring that
each IMEI is within the allocated range and is unique to the ME in which it
resides, as well as ensuring that detailed records of produced and delivered
MEs are kept.
Examples // Default IMEI
at+wimei?
+WIMEI: 012345478901237
OK
// Enter 15-digit IMEI

at+wimei=354610060035829
OK
at+wimei?
+WIMEI: 354610060035829
OK
// Enter 14-digit IMEI

at+wimei=35461006003582
OK
at+wimei?
+WIMEI: 354610060035829
OK
5.29. +KSYNC Command: Application

Synchronization Signal
HL78xx
Test command
Syntax Response
AT+KSYNC=? +KSYNC: (list of supported <mode>),(list of supported <IO>s)
OK
Read command
Syntax Response
AT+KSYNC? +KSYNC: <mode>,<IO>
OK
Write command
Syntax Response
AT+KSYNC= +KSYNC: <IO>, <current_value>
<mode>,<IO> OK
41111821 Rev 12 August 04, 2020 84

HL78xx
Parameters
<mode> Synchronization signal mode
0 Disable the generation of synchronization signal
2 Manage the generation of signal according to network status:
Permanently ON – The module is powered on, but not registered in the network
Slow flash (LED is ON for 200ms, OFF for 2s) – The module is powered on
and registered in the network
OFF – The module is either switched off or the flash LED has been disabled by
the user
<IO> 1-8, 10, 11, 14, 15, 20 Defines which GPIO is used as output to indicate the
network status
Notes • <mode> and <IO> settings are automatically saved.
• This command will force the GPIO pins as output, regardless of the
AT+KGPIOCFG configuration.
• Only one GPIO signal can be generated at any time.
• AT+KSYNC=? returns a dynamic list of supported GPIOs. GPIOs assigned to a
specific purpose are not listed.
• This command can be used without a SIM.
Examples AT+KSYNC=?
+KSYNC: (0,2),(1,2,3,4,5,6,7,8,10,11,14,15,20)
OK
AT+KSYNC=2,1
OK
AT+KSYNC?
+KSYNC: 2,1
OK
AT+KSYNC=2,1
OK
5.30. +KCARRIERCFG Command: Set Operator

Warning: Operator must be set prior to using the module. Refer to section 6 of AirPrime HL7800-M MNO and
RF Band Customization at Customer Production Site Application Note (reference number:
2174213) for details.
HL78xx
Test command
Syntax Response
AT+ +KCARRIERCFG: (list of supported <operator_idx>es)
KCARRIERCFG= OK
?
Read command
Syntax Response
AT+ +KCARRIERCFG: <operator_idx>
KCARRIERCFG? OK
Write command
41111821 Rev 12 August 04, 2020 85

HL78xx
Syntax Response
AT+ OK
KCARRIERCFG
=<operator_idx> Parameter
<operator_idx> 0 Default
1 Verizon
2 CMCC
3 RJIL
4 KDDI
5 AT&T
6 USCC
7 Docomo
8 Softbank
9 LGU+
10 KT
11 T-Mobile
12 SKT
13 TELSTRA
14 China Telecom
15 Sierra Wireless
Reference Notes
Sierra Wireless Configuration is saved immediately in non-volatile memory. The answer to the write
Proprietary command is therefore displayed a few seconds after it is sent. However, the new
configuration is only taken into account on the next reboot.
Examples AT+KCARRIERCFG=?
+KCARRIERCFG: (0-15)
OK
AT+KCARRIERCFG?
+KCARRIERCFG: 0 // Default configuration selected
OK
AT+KCARRIERCFG=1 // Set Verizon configuration

OK
5.31. +KMON Command: Enable/Disable Monitor

Mode
HL78xx
Test command
Syntax Response
AT+KMON=? +KMON: (0-2)
OK
41111821 Rev 12 August 04, 2020 86

HL78xx
Read command
Syntax Response
AT+KMON? +KMON: <n>
OK
Write command
Syntax Response
AT+KMON=<n> OK
or
+CME ERROR: 3
Parameter
<n> Monitor mode configuration
0 Monitor mode disabled (automatic reboot when a crash occurs)
1 Monitor mode enabled (no automatic reboot, backtrace provided for analysis)
2 Mixed monitor mode (backtrace is provided before automatic reboot)
Reference Notes
Sierra Wireless • This command provides the ability to deactivate monitor mode for customer
Proprietary configurations.
• Monitor mode (<n>=1):
o This is a special state that the module enters when a software
exception happens. The module displays the backtrace and all low-
level information needed for debug. Monitor mode prevents the
module from rebooting since it must be manually reset.
o When deploying devices, <n>=0 or 2 are recommended. If <n>=1 is
selected, the device will not automatically reboot in the event of a
crash, and will require the user to manually reboot.
o Is not persistent over power cycle (cold boot). When the module boots,
if <n>=1, the mode changes automatically to 2 (the default value).
• If the Write command is used and the requested configuration is the same as
the current configuration, nothing changes.
• If the Write command is used and the requested configuration is different than
the current configuration:
o The requested configuration is written into flash
o The configuration change is persistent (does not have to be re-entered
after each module reboot), except for <n>=1 as noted above.
Examples AT+KMON=?
+KMON: (0-2)
OK
AT+KMON?
+KMON: 0
OK
AT+KMON=0 // disable monitor mode

OK
AT+KMON=1 // enable monitor mode

OK
41111821 Rev 12 August 04, 2020 87

5.32. +KSRAT Command: Set Radio Access

Technology
HL78xx
Test command
Syntax Response
AT+KSRAT=? +KSRAT: (supported <mode>s),(supported <reboot>s)
OK
Read command
Syntax Response
AT+KSRAT? +KSRAT: <mode>
OK
Write command
Syntax Response
AT+KSRAT= OK
<mode>
[,<reboot>] Parameter
<mode> 0 In the Write format, <mode>=0 is used to switch to the first RAT
in the preferred RAT list (PRL), and fall back to subsequent RATS
in the PRL if cell coverage is lost. If the PRL is empty, switch to
CAT-M1. To set the PRL, see AT+KSELACQ.
In the Read response, '0' indicates CAT-M1.)
1 NB-IoT (HL7800/HL7802 only)

<reboot> Reboot required to switch to <mode> RAT

0 Switch without reboot (Default)
1 Switch with reboot (Legacy behavior)
Warning - <reboot>=1 clears the PRL.
Examples // HL7800
AT+KSRAT=? // Available modes and reboot values
+KSRAT: (0-1),(0-1) // CAT-M1 and NB-IoT RATs available. Reboot values 0 and 1.
OK
// HL7800-M
+KSRAT: (0),(0-1) // CAT-M1 RAT available. Reboot values 0 and 1.
OK
// HL7802
+KSRAT: (0-2),(0-1) // CAT-M1, NB-IoT and GSM RATs available. Reboot values 0 and
1.
OK
AT+KSRAT? // Display current mode

+KSRAT: 0 // CAT-M1 current RAT
OK
41111821 Rev 12 August 04, 2020 88

HL78xx
AT+KSRAT=1,1 // Set NB-IoT RAT, clear PRL and reboot module

OK
AT+KSRAT=1 //Switch to NB-IoT without reboot

OK
AT+KSRAT? // Display current mode

+KSRAT: 1 // NB-IoT current RAT
OK
Reference Notes
Sierra Wireless • To use automatic RAT switching, use AT+KSELACQ to set the PRL and do not
Proprietary use AT+KSRAT at all.
• <mode> is persistent after reset if:
o <reboot> = 1, or
o <reboot> = 0 and PRL is empty
• If <reboot> = 0 and the PRL is not empty, the module will follow the PRL on
boot.
5.33. +KNWSCANCFG Command: Configure

Network Scan Policy
HL78xx
Test command
Syntax Response
AT+ +KNWSCANCFG: (list of supported <mode>s),(list of supported <scheme>s),(list of
KNWSCANCFG= supported <min>s),(list of supported <max>s),(list of supported <step>s)
? OK
Read command
Syntax Response
AT+ +KNWSCANCFG: <mode0>,<scheme0>,<min0>,<max0>[,<step0>]
KNWSCANCFG? +KNWSCANCFG: <mode1>,<scheme1>,<min1>,<max1>[,<step1>]
OK
41111821 Rev 12 August 04, 2020 89

HL78xx
Write command
Syntax Response
AT+ OK
KNWSCANCFG
=<mode> or
[,<scheme>,
<min>,<max> +CME ERROR <err>
[,<step>]]
Parameters
<mode> 0 Out of coverage network scan
1 Initial scan
Other values Reserved for future use
<scheme> 0 Linear scheme

1 Exponential scheme (default configuration for both modes)
<min> 2 – 65535 Minimum interval in seconds between scans
<max> 2 – 65535 Maximum interval in seconds between scans.

Default value = 30
<step> 2 – 32767 Interval incrementation in seconds between scans for linear

mode. Mandatory for <scheme>=0, not allowed for <scheme>=1.
Reference Notes
Sierra Wireless • By default, configuration is exponential scheme with min=2s, max=30s.
Proprietary Interval starts with the current value = min seconds, and step is increased by
power of 2. When the max interval value is achieved, it is then always used.
This default configuration applies to all scenarios.
• Initial scan defines the scenario when the module has not attached to any
network. It applies when the module resets or wakes up from sleep. +CFUN=0
or +CFUN=1 also applies to this scenario. Scan initiated by +COPS=? is not
applied to this scenario.
• Out of Coverage scenario applies when the module is attached to the network
and loses network connectivity or cell coverage. This is usually marked by
change of registration state to unknown (+CEREG: 4).
• The parameter ranges are same for all scenarios.
• AT+KNWSCANCFG=<mode> resets <min>, <max> and <scheme> to default
values (2s, 30s and exponential, respectively). <mode> can be 0 or 1.
• When <scheme>=0 (linear scheme), interval starts with min seconds and is
incremented by step seconds until the maximum is reached.
• Exponential scheme works by adding Tmin+2exponent where exponent is equal to
scan times.
• The configuration is saved in non-volatile Memory (NVM) and persists across
reboots.
Examples AT+KNWSCANCFG=? // Available values
+KNWSCANCFG: (0-1),(0-1),(2-65535),(2-65535),(2-32767)
OK
AT+KNWSCANCFG?
+KNWSCANCFG: 0,1,2,30 // OOC scan: Default configuration
+KNWSCANCFG: 1,0,10,100,10 // Initial scan: linear scheme, min=10s, max=100s,
//step=10s
OK
41111821 Rev 12 August 04, 2020 90

HL78xx
AT+KNWSCANCFG=0,0,3,90,2 // Set for OOC scan scenario a linear scheme with

// min=3s, max=90s, step=2s.
OK
AT+KNWSCANCFG?
+KNWSCANCFG: 0,0,3,90,2 // OOC scan: linear scheme, min=3s, max=90s,
// step=2s
+KNWSCANCFG: 1,0,10,100,10 // Initial scan: linear scheme, min=10s,
// max=100s, step=10s
OK
AT+KNWSCANCFG=1,0,15,150 // Set for initial scan scenario an expo scheme with

// min=15s, max=150s
OK
AT+KNWSCANCFG?
+KNWSCANCFG: 0,0,3,90,2 // linear scheme, min=3s, max=90s, step=2s
+KNWSCANCFG: 1,0,15,150 // Initial scan: expo scheme, min=15s, max=150s
OK
//Setting default configuration:

//Mode 0:
AT+KNWSCANCFG=0
OK
AT+KNWSCANCFG?
+KNWSCANCFG: 0,1,2,30 // OOC scan: expo scheme, min=2s, max=30s
+KNWSCANCFG: 1,0,15,150 // Initial scan: expo scheme, min=15s, max=150s
OK
//Mode 1:
AT+KNWSCANCFG=1
OK
AT+KNWSCANCFG?
+KNWSCANCFG: 0,1,2,30 // OOC scan: expo scheme, min=2s, max=30s
+KNWSCANCFG: 1,1,2,30 // initial scan: expo scheme, min=2s, max=30s
OK
5.34. +CRCES Command: Read Coverage

Enhancement Status
HL78xx
Test command
Syntax Response
AT+CRCES=? OK
41111821 Rev 12 August 04, 2020 91

HL78xx
Execute command
Syntax Response
AT+CRCES +CRCES:<AcT>,<CE_level>,<CC>
OK
Parameters
<AcT> Integer type; access technology of the serving cell
0 Serving cell has no coverage enhancement
1 E-UTRAN
2 EC-GSM-IoT (A/Gb mode)
<CE_level> Integer type; Coverage Enhancement (CE) level of the MT in the serving
cell. Applicable only if <Act>=1 (E-UTRAN) or <Act>=3 (E-UTRAN (NB-S1 mode)).
0 No Coverage Enhancement in the serving cell
1 Coverage Enhancement level 0
<CC> Integer type; Coverage Class (CC) of the MT in the serving cell. Applicable only if
<Act>=2 (EC-GSM-IoT).
0 No Coverage Class in the serving cell
1 Coverage Class 1
2 Coverage Class 2
3 Coverage Class 3
4 Coverage Class 4
5 Coverage Class 5
Reference 27.007 Rel 14
5.35. +KADC Command: Analog Digital Converter

HL78xx
Test command
Syntax Response
AT+KADC=? +KADC: (list of supported <Meas id>s),(list of supported <Meas time>s)
OK
Write command
Syntax Response
AT+KADC= For <Meas id>= 2:
<Meas id>, +KADC: <Meas result>,<Meas id>,<Meas time>[,<Temperature>]
<Meas time>
For other values of <Meas id>:
+KADC: <Meas result>,<Meas id>,<Meas time>
OK
or
+CME ERROR: <err>
41111821 Rev 12 August 04, 2020 92

HL78xx
Parameters
<Meas id> Measurement ID
2 THERM (internal CTN)
4 ADC0
7 ADC1
<Meas time> Measurement time

3 No constraint
<Meas result> Measurement result in µV
<Temperature> Temperature in °C
Reference Notes
Sierra Wireless • Only ADC0 (<Meas id>=4) and ADC1 (<Meas id=7) are available as external
Proprietary input.
• Available range for input ADC0 and ADC1 is [0; 1.8] V.
• If <Meas result> is not available, the answer will display this field as empty.
• This AT command does not require a SIM card.
Examples AT+KADC=2,3
+KADC: ,2,3,25 // no µV measurement available; temperature on internal CTN is 25°C
OK
5.36. +WESHDOWN Command: Emergency

Shutdown
HL78xx
Test command
Syntax Response
AT+WESHDOWN +WESHDOWN: (list of supported <mode>s),(list of supported <gpio_index>s)
=? OK
Read command
Syntax Response
AT+WESHDOWN +WESHDOWN: <mode>, <gpio_index>
? OK
Write command
Syntax Response
AT+WESHDOWN OK
=<mode>
[,<gpio_index>] or
+CME ERROR: <err>
Parameters
<mode> 0 Disable emergency shutdown feature by GPIO
1 Enable emergency shutdown feature by GPIO
2 Trigger emergency shutdown
41111821 Rev 12 August 04, 2020 93

HL78xx
<gpio_index> 1-8, 10, 11, 14, 15 Defines which GPIO will be used as input to trigger
the emergency shutdown on the falling edge. Default value = 4.
Reference Notes
Sierra Wireless • <gpio_index> is not needed when <mode>=0 or 2.
Proprietary • Configuration is saved in non-volatile memory and is therefore still effective
• GPIOs may already be assigned to other commands such as +KRIC or
+KSYNC. <gpio_index> must be an unassigned GPIO.
• AT+WESHDOWN=? returns a dynamic list of supported GPIOs. GPIOs assigned
to a specific purpose are not listed.
• It might occasionally happen that the OK response to AT+WESHDOWN=2 is not
received on the serial link by the application due to quick shutdown.
• This command performs fast power down without an IMSI detach request being
sent to the network.
• Only one GPIO at a time can be configured for emergency shutdown. The only
way to wake the module up is to set the WAKEUP pin high.
Examples AT+WESHDOWN=?
+WESHDOWN: (0-2),(1,2,3,4,5,6,7,8,10,11,14,15)
OK
AT+WESHDOWN?
+WESHDOWN: 0 // Emergency shutdown by GPIO is not active
OK
AT+WESHDOWN=1,4 // Activate emergency shutdown on GPIO4

OK
AT+WESHDOWN?
+WESHDOWN: 1,4 // A falling edge on GPIO4 will shut down the module
OK
AT+WESHDOWN=0 // Deactivate emergency shutdown by GPIO

OK
AT+WESHDOWN=2 // Module shutdown

OK
5.37. +KCELLMEAS Command: Request LTE

Network Coverage Information and Configure
URC on Wakeup
HL78xx
Test command
Syntax Response
AT+KCELLMEAS +KCELLMEAS: (supported <revision>s),(supported <timeout>s)
=? OK
41111821 Rev 12 August 04, 2020 94

HL78xx
Read command
Syntax Response
AT+KCELLMEAS +KCELLMEAS: <timeout>
? OK
Write command
Syntax Response
AT+KCELLMEAS For <revision>=0, <timeout> is not supported:
=<revision> +KCELLMEAS: <RSRP>,<Downlink Path Loss>,<PUSCH Tx Power>,<PUCCH Tx
[,<timeout>] Power>,<SiNR>
OK
or when out of service:

+KCELLMEAS: ,,,,, // empty or invalid response
For <revision>=1, with <timeout> omitted (e.g. AT+KCELLMEAS=1):

+KCELLMEAS: <RSRP>,<Downlink Path Loss>,<PUSCH Tx Power>,<PUCCH Tx
Power>,<SiNR>,<CE Level>,<UL Repetition Factor>
OK
For <revision>=1, with <timeout> (e.g. AT+KCELLMEAS=1,10):

+KCELLMEAS: <timeout>
OK
Parameters
<revision> Revision of network information.
0 Standard cell coverage details
1 Extended cell coverage details or timeout value
<timeout> Duration to attempt to camp on cell when waking from sleep/hibernate in

PSM (in seconds)
0 – Disabled
1−1200 – Time to camp on cell.
If attempt is successful, a +KCELLMEAS URC will be produced with
<revision>=1 data. For more details, see AirPrime HL78xx
AT+KCELLMEAS URC Application Note (Doc# 217490).
If attempt is unsuccessful, an empty +KCELLMEAS URC will be produced.

See Examples section below.
<RSRP> Reference Signals Received Power (dBm)

Range = -140.0 dBm to 0.0 dBm (Note: Decimal portion always displays as ".0")
<Downlink Path Loss> Downlink Path Loss (dBm)

<PUSCH Tx Power> Last Tx Power used on PUSCH channel (dBm)

Range = -50.0 dBm to 100.0 dBm (Value always displays one significant digit.
e.g. "-129.3")
<PUCCH Tx Power> Last Tx Power used on PUCCH channel (dBm)

41111821 Rev 12 August 04, 2020 95

HL78xx
<SINR> Signal to Interference plus Noise Ratio (dBm)

Range = -128.0 dBm to 40.0 dBm (Note: Decimal portion always displays as ".0".)
<CE Level> Coverage enhancement level assigned to UE by serving cell

Range = 1−4. See AT+CRCES for details.
<UL Repetition Factor> Number of times that mobile-originated (MO) data will be
retransmitted
Supported ranges depend on UE state and RAT:
For UE state = IDLE/RACH:
CAT-M: 1-128
NB-IoT: 1-2048
For UE state = Connected:
CAT-M: 1-2048
NB-IoT: 1-2048
(Note – UL repetition factor values will be higher for higher CE levels.)
Notes • Do not use this command in GSM. The command applies to LTE only.
• This command only returns valid radio measurements if the device has a SIM
and is in RRC connected state.
• +KCELLMEAS URC notes:
o Triggered by setting the WAKEUP pin high.
o Disabled automatically after any data transmission (including TAU) and
remains disabled until the Active Timer (T3324) expires and a
+CREG: 4 URC is received.
If the WAKEUP pin is low when +CREG: 4 is received, module returns
to sleep.
o If no data transmission, but wakup pin is set high and a +CEREG:1 or 5
URC is received, then setting the WAKEUP pin low allows the module
to return to sleep.
Examples AT+KCELLMEAS=?
+KCELLMEAS: (0-1),(0-1200)
OK
AT+KCELLMEAS=0
+KCELLMEAS: -85.0,68.0,-6.3,9.0,23.0
OK
AT+KCELLMEAS=1,10
+KCELLMEAS: 10 // URC received after successful camping attempt
OK
AT+KCELLMEAS=1,10
+KCELLMEAS: ,,,,,,, // URC received after unsuccessful camping attempt
OK
41111821 Rev 12 August 04, 2020 96

5.38. +KSIMSEL Command: SIM Selection

HL78xx
Test command
Syntax Response
AT+KSIMSEL=? +KSIMSEL: (list of supported <mode>s)
OK
Read command
Syntax Response
AT+KSIMSEL? +KSIMSEL: <mode>[, <GPIO>[, <sim_used>]]
OK
Write command
Syntax Response
AT+KSIMSEL= [+KSIMSEL: 4, <sim1_pres>, <sim2_pres>, <sim3_pres>]
<mode>
[,<GPIO>] Parameters
<mode> SIM selection mode
0 Force to select external SIM (default value if there is no embedded SIM)
4 Read SIM presence status
9 Select internal SIM if present. The presence of an external SIM will be ignored
20 Select external SIM if present, else select internal SIM (default value if embedded
SIM is present)
<GPIO> Not supported currently. Parameter has no effect.
<sim1_pres> 0 External SIM1 is not present

1 External SIM1 is present
<sim2_pres> 0 External SIM2 is not present (currently not supported)

1 External SIM2 is present (currently not supported)
<sim3_pres> -1, 0 Internal SIM is not present (only possible values without embedded
SIM)
1 Internal SIM is present (only possible value with embedded SIM)
<sim_used> 1 External SIM1 is used

2 External SIM2 is used (currently not supported)
3 Embedded SIM is used
Reference Notes
Sierra Wireless • Only one SIM is active at a time (DSSS: Dual SIM Single Standby).
Proprietary • This command can be supported even without a SIM card.
• Currently, GPIO based external SIM switching is not supported; <GPIO> has no
effect.
• Fallback mode and embedded SIM can only be selected if embedded SIM is
detected at bootup.
• <mode>=4 and <mode>=20 are not available when SIM detection is disabled
(AT+KSIMDET=0).
• The default policy is to select External SIM slot on bootup.
• Settings are kept after module reboot.
41111821 Rev 12 August 04, 2020 97

5.39. +KSIMDET Command: SIM Detection

HL78xx
Test command
Syntax Response
AT+KSIMDET=? +KSIMDET: (list of supported <mode>s)
OK
Read command
Syntax Response
AT+KSIMDET? +KSIMDET: <mode>
OK
Write command
Syntax Response
AT+KSIMDET=< +KSIMDET: <mode>
mode> OK
Parameter
<mode> Status of unsolicited SIM notification events
0 Disable SIM detection
1 Enable SIM detection
Notification +SIM: <status>
Parameter
<status> Event status
0 Removed
1 Inserted
Reference Notes
Sierra Wireless • This command can be supported even without a SIM card.
Proprietary • This command is only applicable to external SIM card detection.
• Disabling SIM detection is not allowed when +KSIMSEL <mode>=20.
• UIM1_DET (GPIO 3) is used for SIM1 detection. When SIM detection is
disabled, GPIO 3 will be free for customer use via the +KGPIO command.
• Settings are kept after module reboot.
Examples // Enable SIM detection URC indications
AT+KSIMDET=1
OK
// SIM card is removed

+SIM: 0
// SIM card is inserted

+SIM: 1
// No URC indication when SIM card is removed or inserted

AT+KSIMDET=0
OK
41111821 Rev 12 August 04, 2020 99

HL78xx
// Read current setting

AT+KSIMDET?
+KSIMDET: 0
OK
// Test command
AT+KSIMDET=?
+KSIMDET: (0-1)
OK
5.40. +KUSBCOMP Command: Enable/Disable USB

Mode
HL78xx
Test command
Syntax Response
AT+KUSBCOMP +KUSBCOMP: (supported <mode>s), (supported <acm0>s), (supported <acm1>s),
=? (supported <acm2>s)
OK
Read command
Syntax Response
AT+KUSBCOMP +KUSBCOMP: <mode>,<acm0>,<acm1>,<acm2>
? OK
41111821 Rev 12 August 04, 2020 100

HL78xx
Write command
Syntax Response
AT+KUSBCOMP OK
=<mode>[,<acm0
>[,<acm1>[,<acm or
2>]]]
+CME ERROR: 3
Parameter
<mode> USB mode config
0 USB disabled (default)
1 CDC-ACM mode (PID: 0xC001) — Three interfaces supported.
If no optional <acm#> parameters are specified, the default interface assignments
are:
USB-ACM0 — AT port
USB-ACM1 — AT/PPP data port
USB-ACM2 — NMEA data port
If any optional <acm#> parameters are specified, then any <acm> that is not
specified will be assigned 0 (none).
<acm0> Port type to enable on USB ACM0

0 None
1 AT
2 AT_PPP
3 NMEA
4 SFP_LOGGER
5 MAC_VIA_MAP
0 None
1 AT
2 AT_PPP
3 NMEA
4 SFP_LOGGER
5 MAC_VIA_MAP
0 None
1 AT
2 AT_PPP
3 NMEA
4 SFP_LOGGER
5 MAC_VIA_MAP
Reference Notes
Sierra Wireless • The current configuration is kept in flash.
Proprietary • New configuration will only be activated after module reboots.
• If USB is enabled with all three ACM parameters set to 0 or NULL, the default
interface assignments for each ACM will be used.
• Any service (port type) can be enabled on only one ACM or UART port at a time.
For example:
• By default, UART1 is used for AT_PPP. Enabling AT_PPP over USB
disables it over UART1.
• If FW Log is enabled over the UART port, enabling MAC_VIA_MAP over
USB will disable FW Log over UART.
41111821 Rev 12 August 04, 2020 101

HL78xx
Examples // Show command format

AT+KUSBCOMP=?
+KUSBCOMP: (0-1),(0-5),(0-5),(0-5)
OK
// Disable USB and restore UART port type changes, if any

AT+KUSBCOMP=0
OK
AT+KUSBCOMP?
+KUSBCOMP: 0,0,0,0 // All ACMs = 0 because USB is disabled
OK
// Enable USB, all ACMs to use default assignments

AT+KUSBCOMP=1,,,
OK
AT+KUSBCOMP? // ACMs set to default assignments (1,2,3 respectively)

+KUSBCOMP:1,1,2,3
OK
// Enable USB, ACM0 uses 0 (none), and ACM1/ACM2 use specified assignments
AT+KUSBCOMP=1,,1,2
OK
AT+KUSBCOMP?
+KUSBCOMP:1,0,1,2 // ACM0 uses port 0, ACM1/ACM2 use specified ports
OK
5.41. +KTEMPMON Command: Temperature

Monitor
HL78xx
Test command
Syntax Response
AT+KTEMPMON +KTEMPMON: (list of supported <mode>s),(list of supported <temperature>s),(list of
=? supported <urcMode>s),(list of supported <action>s),(list of supported <hystTime>s),
(list of supported <repGPIO>s)
OK
Read command
Syntax Response
AT+KTEMPMON +KTEMPMON: <mode>,<temperature>,<urcMode>,<action>,<hystTime>,<repGPIO>
? OK
Write command
Syntax Response
AT+KTEMPMON +KTEMPMON: <level>,<value>
=<mode>, OK
[<temperature>
[,<urcMode>
41111821 Rev 12 August 04, 2020 102

HL78xx
[,<action> Parameters
[,<hystTime> <mode> 0 Disable the module’s internal temperature monitor
[,<repGPIO>]]]]] 1 Enable the module’s internal temperature monitor
<temperature> Set a single user-defined temperature threshold at which the

specified <action> occurs. (Note – Additional non-configurable threshold <level>s are
monitored and can be reported by enabling event reporting with <urcMode>.)
<urcMode> 0 Disable temperature monitor event reporting

1 Enable temperature monitor event reporting via URCs:
+KTEMPMEAS: <level>,<value>
A URC will be received each time the temperature crosses a
threshold (i.e. when the <level> changes).
<action> 0 No action
1 Automatic shut down when the temperature is beyond
<temperature>
2 The output pin <repGPIO> is tied HIGH when <temperature> is
reached; when the temperature is normal, the output pin <repGPIO>
is tied LOW.
Note that if this parameter is required, it is mandatory to set the <repGPIO> parameter.
<hystTime> 0 – 255 Hysteresis time in seconds. All <action> will only happen if
<temperature> is maintained for at least this period. If value is set to 0, it means <action>
will be taken immediately. Default value = 30.
<repGPIO> 1 – 15 (platform dependent), 255 (no GPIO used) Reporting GPIO —

Defines which GPIO is allocated as an output pin to report the event. This parameter is
mandatory if <action>=2 is specified. Default value = 255 (since default <action> is 0).
When <action> changes from 2, the previously allocated reporting GPIO (for <action>=2)
is deallocated.
<level> Threshold level

-2 Extreme temperature lower bound (-40°C)
-1 Operating temperature lower bound (-20°C). Reserved; to be implemented
in a future revision.
0 Normal temperature
1 Operating temperature upper bound (+55°C)
2 Extreme temperature upper bound (temperature limit set in
AT+KTEMPMON, default = +85°C)
<value> Current temperature expressed in degrees Celsius.

Notes • Due to temperature measurement uncertainty there is a tolerance of ± 2°C.
• Check available GPIOs with +KGPIOCFG when using this command.
• This command will return ERROR if the selected GPIO is already being used by
another feature. Check GPIO availability with other related commands
+KSIMDET, +KSIMSEL, +KSYNC, +KJAM, +GSMAD, +GNSSAD, and +KTEMPMON
when using this command.
Examples //test command
AT+KTEMPMON=?
+KTEMPMON: (0-1),(0-120),(0),(0-2),(0-255),(1,2,4,5,6,7,8,10,11,14,15,255)
OK
//default setting
AT+KTEMPMON?
41111821 Rev 12 August 04, 2020 103

HL78xx
+KTEMPMON: 0,90,0,0,30,255
OK
//enable temperature monitor, set threshold to 70 degrees

AT+KTEMPMON=1,70
+KTEMPMON: 0,30
OK
AT+KTEMPMON?
+KTEMPMON: 1,70,0,0,30,255
OK
//set hysteresis time to 20 seconds

AT+KTEMPMON=1,70,0,0,20
+KTEMPMON: 0,29
OK
AT+KTEMPMON?
+KTEMPMON: 1,70,0,0,20,255
OK
//set action to output HIGH on GPIO 1

AT+KTEMPMON=1,70,0,2,20,1
+KTEMPMON: 0,30
OK
AT+KTEMPMON?
+KTEMPMON: 1,70,0,2,20,1
OK
5.42. +KCIOTOPT Command: UE Network

Capability Information Configuration
HL78xx
Test command
Syntax Response
AT+KCIOTOPT= +KCIOTOPT: (list of supported <opt_item>s),(list of supported <val>s)[,(list of supported
? <act>s)]
OK
Read command
Syntax Response
AT+KCIOTOPT? +KCIOTOPT:
<opt_item=0>,<val_act_0>,<val_act_1>
OK
41111821 Rev 12 August 04, 2020 104

HL78xx
Write command
Syntax Response
AT+KCIOTOPT= OK
<opt_item>,
<val> Parameters
[,<act>]
<opt_item> CIOT optimization/support item (Specific elements of Network Attach
Request Octet 8 (3GPP TS 24.301))
0 Extended PCO IE (Octet 8, bit 8)
1−3 Not implemented, reserved for future use
<val> Value
<val_act_0>, <val_act_1> Values for Cat-M1 and NB-IoT, respectively
0 Disabled
1 Enabled
<act> Access Control technology

0 Cat-M1
1 NB-IoT (default)
Notes • Functionality depends on network/carrier-level support for this feature.
• If <opt_item>=0 (Extended PCO IE) is enabled, sending of regular PCO
information in the NAS Attach Request is automatically disabled.
Examples //test command

AT+KCIOTOPT=?
+KCIOTOPT: (0-3),(0,1)[,(0-1)]
OK
//default setting
AT+KCIOTOPT?
+KCIOTOPT: 0,0,0
+KCIOTOPT: 1,0,0
+KCIOTOPT: 2,0,0
+KCIOTOPT: 3,0,0
OK
//enable ePCO for Cat-M1

AT+KCIOTOPT=0,1,0
OK
AT+KCIOTOPT?
+KCIOTOPT: 0,0,0
+KCIOTOPT: 1,0,0
+KCIOTOPT: 2,0,0
+KCIOTOPT: 3,0,0
OK
OK
41111821 Rev 12 August 04, 2020 105

5.43. +KEDRXCFG Command: Configure eDRX

HL78xx
Test command
Syntax Response (up to two lines, for supported <ACT-type>s)

AT+KEDRXCFG= +KEDRXCFG: (range of supported <mode>s), <AcT-type>, (range of supported
? <Requested_eDRX_value>s) ,(range of supported <Requested_PTW_value>s)
+KEDRXCFG: (range of supported <mode>s), <AcT-type>, (range of supported

<Requested_eDRX_value>s) ,(range of supported <Requested_PTW_value>s)
Read command
Syntax Response (up to two lines, for supported <ACT-type>s)

AT+KEDRXCFG? +KEDRXCFG: <mode>, <AcT-type>, <Requested_eDRX_value>,
<NW-provided_eDRX_value>, <Requested_PTW_value>,
<NW-provided_PTW_value>
+KEDRXCFG: <mode>, <AcT-type>, <Requested_eDRX_value>,

<NW-provided_eDRX_value>, <Requested_PTW_value>,
<NW-provided_PTW_value>
OK
Write command
Syntax Response
+KEDRXCFG= OK
[<mode>]
[,[<AcT-type>] Parameters
[,[<Requested_e <mode> Integer type, indicates to disable or enable the use of eDRX in the UE
DRX_value>]
[,[<Requested_P 0 Disable the use of eDRX
TW_value>]]]] 1 Enable the use of eDRX. (Also enables 3GPP standard +CEDRXP URC.)
2 Enable the use of eDRX and enable the unsolicited result code
+CEDRXP: <AcT-type>[,<Requested_eDRX_value>
[,<NW-provided_eDRX_value>[,<NW-provided_PTW_value>]]]
3 Disable the use of eDRX and discard all parameters for eDRX to the factory
default values.
<AcT-type> Integer type, indicates the type of access technology

<Requested_eDRX_value> eDRX cycle length value requested by the module. Integer

type (and string type (half a byte in a 4-bit format) is also allowed in the Write command
format). The eDRX value refers to bits 4 to 1 of octet 3 of the Extended DRX parameters
information element. (For details, refer to 3GPP TS 24.008 v14.7.0 Table 10.5.5.32.)
For example:
Test command shows integer value range (i.e. 0−15)
Read command shows integer value
Write command accepts 0−15 or "0000"−"1111"
The actual supported range varies by <AcT-type>:
4 (CAT-M1) = 0-13
5 (NB-IoT) = 2-3, 5, 9-15
eDRX cycle length (in seconds) calculation: 5.12 * 2^<eDRX-cycle>
If <requested_eDRX_value> is:
14-15 for CAT-M1 – Cycle length used is 2621.44 seconds
4 or 6-8 for NB-IoT – Cycle length used is 20.48 seconds
41111821 Rev 12 August 04, 2020 106

HL78xx
<NW-provided_eDRX_value> eDRX cycle length value provided by the network.

Integer type (in Read response) or string type (in +CEDRXP URC; half a byte in a 4-bit
format). The eDRX value refers to bitS 4 to 1 of octet 3 of the Extended DRX parameters
information element. Value is empty when eDRX is not enabled.
<Requested_PTW_value> PTW length value requested by the module (Valid

range: 0-15) corresponding to:
• CAT-M1 – actual PTW length = 1.28 sec × (1 + PTW)
• NB-IoT – actual PTW length = 2.56 sec × (1 + PTW)
Integer type (and string type (half a byte in a 4-bit format) is also allowed in the Write
command format). The PTW value refers to bits 8 to 5 of octet 3 of the Extended DRX
parameters information element. (For details, refer to 3GPP TS 24.008 v14.7.0 Table
10.5.5.32.)
For example:
Test command shows integer value range (i.e. 0−15)
Read command shows integer value
Write command accepts 0−15 or "0000"−"1111"
<NW-provided_PTW_value> Integer type (in Read response) or string type (in

+CEDRXP URC; half a byte in a 4-bit format). The paging time window refers to bits
8 to 5 of octet 3 of the Extended DRX parameters information element
Notes • Important: To enable/disable/configure eDRX, use only +KEDRXCFG or
+CEDRXS. Do not use a combination of both commands.
• This command expands upon AT+CEDRXS by including configuration of the eDRX
Paging Time Window (PTW).
• Configurations persist across power cycles.
• The Read command response shows details for the <AcT-type>s that are supported
by the module.
• PTW change does not trigger a TAU immediately, but will take effect in the next
TAU or ATTACH request.
• Default values for parameters that are not specified:
o <ACT-type> – If not specified, default is currently active <AcT-type>.
o Other parameters – If not specified, defaults are the values in the previous
configuration for the <AcT-type>.
41111821 Rev 12 August 04, 2020 107

HL78xx
Examples // Test command for HL7800

AT+KEDRXCFG=?
+KEDRXCFG: (0-3),4,(0-13),(0-15)
+KEDRXCFG: (0-3),5,(2-3,5,9-15),(0-15)
// Enable eDRX with previously configured parameters for currently active RAT
AT+KEDRXCFG=1
OK
// Disable eDRX for currently active RAT

AT+KEDRXCFG=0
OK
// Enable eDRX for Cat-M1 with T(eDRX)=81.92s and T(PTW)=1.28s

AT+KEDRXCFG=1,4,5,0
OK
// Enable eDRX for NB-IOT with T(eDRX)=81.92s and T(PTW)=2.56s

AT+KEDRXCFG=1,5,5,0
OK
// Enable eDRX for Cat-M1 with previously configured T(eDRX), and T(PTW)=2.56s
AT+KEDRXCFG=1,4,,1
OK
// Disable eDRX for Cat-M1 and change T(PTW) to 3.84s

AT+KEDRXCFG=0,4,,2
OK
// Configure T(PTW) for the currently active RAT (Cat-M1 or NB-IOT)

AT+KEDRXCFG=,,,2
OK
5.44. +KSELACQ Command: Configure Preferred

Radio Access Technology List (PRL)
HL78xx
Test command
Syntax Response
AT+KSELACQ=? +KSELACQ: (supported <mode>s),(supported <RAT1>s),( supported <RAT2>s),
(supported <RAT3>s)
OK
Read command
Syntax Response
AT+KSELACQ? +KSELACQ: <RAT1>[,<RAT2>[,<RAT3>]]
OK
Write command
41111821 Rev 12 August 04, 2020 108

HL78xx
Syntax Response
+KSELACQ= OK
[<mode>] or
[,<RAT1> ERROR
[,<RAT2>
[,<RAT3>]]]
Parameters
<mode> Integer type, configure option
0 Configure PRL
1 Reserved
<RAT1>,<RAT2>,<RAT3> - Preferred RATs in positions 1, 2, 3 of the PRL

0 Clear the PRL and disable automatic RAT switching
If used in the Write command format, use only <RAT1>. If <RAT2> / <RAT3> are
entered, the command returns ERROR.
1 Set PRL entry to CAT-M
2 Set PRL entry to NB-IoT
3 Set PRL entry to GSM
Notes • Reboot is required for the Write command to take effect, but Read command
returns the most recently written values.
• Duplicate RATs will be written to the PRL but will not be processed when
automatically switching RATs in case of lost cell coverage.
Reference Sierra Wireless proprietary
41111821 Rev 12 August 04, 2020 109

HL78xx
Examples //(HL7802) Show available parameter values

AT+KSELACQ=?
+KSELACQ: (0),(0-3),(1-3),(1-3)
OK
// Available mode is 0. RAT values up to 3 (GSM) are supported – RAT1 can be 0-3,
RAT2 can be 1-3, RAT3 can be 1-3.
//(HL7800) Show available parameter values

AT+KSELACQ=?
+KSELACQ: (0),(0-2),(1-2),(1-2)
OK
// Available mode is 0. RAT values up to 2 (NB-IoT) are supported – RAT1 can be 0-2.
RAT2 can be 1-2, RAT3 can be 1-2.
//(HL7800-M) Show available parameter values

AT+KSELACQ=?
+KSELACQ: (0),(1),(1),(1)
OK
// Available mode is 0. RAT values up to 1 (CAT-M) are supported – RAT1, RAT2, and
RAT3 will all be 1.
// In mode 0, set RAT1 to 1 (CAT-M), RAT2 to 2 (NB-IoT), and RAT3 to 3 (GSM). After
manually rebooting, the module will begin scanning for CAT-M cells first. If no cells are
found, module will fallback first to NB-IoT, then GSM, then restart from the beginning of
the PRL.
AT+KSELACQ=0,1,2,3
OK
// In mode 0, clear PRL. After manually rebooting, the module will enter, in order of
priority, either
• the RAT last set with AT+KSRAT (if set when PRL was empty), or
• the RAT that was the first item in the previous PRL.
AT+KSELACQ=0,0
OK
// Display current PRL: RAT1 is CAT-M, RAT2 is NB-IoT, RAT3 is GSM

AT+KSELACQ?
+KSELACQ: 1,2,3
OK
// Display current PRL: PRL is empty

AT+KSELACQ?
+KSELACQ: 0
OK
41111821 Rev 12 August 04, 2020 110

5.45. +KDRXCFG Command: Configure LTE DRX

HL78xx
Test command
Syntax Response
AT+KDRXCFG=? +KDRXCFG: (range of supported <DRX_value>s)
Read command
Syntax Response
AT+KDRXCFG? +KDRXCFG: <DRX_value>
OK
Write command
Syntax Response
+KDRXCFG= OK
<DRX_value>]
Parameters
<DRX_value> Integer type, DRX cycle length
0 No preference (network-assigned)
6 320 ms
7 640 ms
8 1280 ms
9 2560 ms
Notes • This command allows the user to configure the LTE DRX cycle length used by
the module. This value is transmitted to the network as part of the Attach
process. If the module is already attached to the network, a Tracking Area
Update will update the network with the a newly configured value.
A longer DRX cycle provides improved power consumption. A shorter DRX

cycle allows for better latency on mobile-terminated requests such as MT-SMS
or MT-voice (if voice is supported). The optimal DRX value will be highly
dependent on customer power & latency requirements for their system.
Most commercial networks will use one of the longer DRX values (1.28s or
2.56s) if the module does not specify a preference. It is mandatory for the
network to accept the DRX value requested by the module.
• Configurations persist across power cycles.
Reference Sierra Wireless proprietary
41111821 Rev 12 August 04, 2020 111

HL78xx
Examples // No module preference, use the value assigned by the network

AT+KDRXCFG=0
OK
// Use 320 ms DRX cycle

AT+KDRXCFG=6
OK
// Use 1.28 s DRX cycle

AT+KDRXCFG=8
OK
// Display current setting (in this case, 1.28s

AT+KDRXCFG?
+KDRXCFG: 8
OK
41111821 Rev 12 August 04, 2020 112

6. Network Service Related
Commands
6.1. +CLCK Command: Facility Lock

HL78xx
Test command
Syntax Response
AT+CLCK=? +CLCK: (list of supported <fac>s)
OK
or
+CME ERROR: <err>
Write command
Syntax Response
AT+CLCK=<fac>, If <mode> = 2 and command is successful
<mode> OK
[,<passwd> +CLCK: <status>[,<class1>[<CR>,<LF>
[,<class>]] +CLCK: <status>,class2…]]
or
+CME ERROR: <err>
Parameters
<fac> Values reserved by the present document:
"PS" PH-SIM (lock Phone to SIM/UICC card installed in the currently selected
card slot) (MT asks for the password when other than current SIM/UICC
card is inserted; MT may remember certain previously used cards thus not
requiring password when they are inserted)
"SC" SIM (lock SIM/UICC card) (SIM/UICC asks password in MT power-up and
when this lock command issued)
"PN" Network Personalization
"PU" Network subset Personalization
<mode> 0 Unlock
1 Lock
2 Query status
<status> 0 Not active

1 Active
<passwd> String type; shall be the same as password specified for the facility from
the ME user interface or with command +CPWD
<classx> Sum of integers each representing a class of information (default value = 7)

2 Data (refers to all bearer services; with <mode>=2 this may refer only to some
bearer service if TA does not support values 16, 32, 64 and 128)
4 Fax (facsimile services)
41111821 Rev 12 August 04, 2020 113

AT Commands Interface Guide Network Service Related Commands
HL78xx
8 Short message service

16 Data circuit sync
32 Data circuit async
64 Dedicated packet access
128 Dedicated PAD access
6.2. +CPWD Command: Change Password

HL78xx
Test command
Syntax Response
AT+CPWD=? +CPWD: list of supported (<fac>,<pwdlength>)s
OK
Write command
Syntax Response
AT+CPWD= OK
<fac>,<oldpwd>,
<newpwd>
or
+CME ERROR: <err>
Parameters
<fac> "PS" PH-SIM (lock Phone to SIM/UICC card installed in the currently selected
card slot) (MT asks for the password when other than current SIM/UICC
card is inserted; MT may remember certain previously used cards thus not
requiring password when they are inserted)
"P2" SIM PIN2 password specified for the facility from the user interface or with
a command.
"SC" SIM (lock SIM/UICC card) (SIM/UICC asks password in MT power-up and
when this lock command issued)
"PN" Network Personalization
"PU" Network subset Personalization
<oldpwd> String type containing the old password
<newpwd> String type containing the new password
<pwdlength> Length of password

41111821 Rev 12 August 04, 2020 114

6.3. +COPN Command: Read Operator Name

HL78xx
Test command
Syntax Response
AT+COPN=? OK
Execute command
Syntax Response
AT+COPN +COPN: <numeric1>,<alpha1>[<CR><LF>
+COPN: <numeric2>,<alpha2>
[...]]
OK
or
+CME ERROR: <err>
Parameters
<numeric> String type; operator in numeric format (see +COPS)
<alpha> String type; operator in long alphanumeric format (see +COPS)

6.4. +COPS Command: Operator Selection

HL78xx
Test command
Syntax Response
AT+COPS=? +COPS: [list of supported (<stat>, long alphanumeric <oper>, short alphanumeric
<oper>, numeric <oper>[,< AcT>])s][,,(list of supported <mode>s),(list of supported
<format>s)]
OK
or
+CME ERROR: <err>
Read command
Syntax Response
AT+COPS? +COPS: <mode>[,<format>,<oper>[,<AcT>]]
OK
or
+CME ERROR: <err>
41111821 Rev 12 August 04, 2020 115

HL78xx
Write command
Syntax Response
AT+COPS= OK
[<mode>
[,<format>
or
[,<oper>
[,< AcT>]]]] +CME ERROR: <err>
Parameters
<mode> 0 Automatic; in this case other fields are ignored, and registration is
done automatically by ME
1 Manual (other parameters like format and operator need to be
passed)
2 Deregister from network
3 Sets <format> value. In this case <format> becomes a mandatory
input
<format> 0 Long alphanumeric; if network name is not available it displays a

combination of MCC and MNC in string format
1 Short alphanumeric
2 Numeric
<oper> String type given in format <format>; this field may be up to 16 character
long for long alphanumeric format, up to 8 characters for short alphanumeric format and
5 characters long for numeric format (MCC/MNC codes)
<stat> 0 Unknown networks

1 Network available
2 Current (registered)
3 Forbidden network
<AcT> 7 E-UTRAN
Reference Notes
27.007 Rev12 AT+COPS=? is only available when the device is not in RRC Connected state (when it
still has data to transmit or receive). AT+COPS=? will return ERROR if the device is in
RRC Connected state. To ensure that the device is not in RRC Connected state, the
device can be explicitly detached from the network using AT+CGATT=0, for example.
6.5. +CPOL Command: Preferred PLMN List

HL78xx
Test command
Syntax Response
AT+CPOL=? +CPOL: (list of supported <index>es),(list of supported <format>s)
OK
or
+CME ERROR: <err>
41111821 Rev 12 August 04, 2020 116

HL78xx
Read command
Syntax Response
AT+CPOL? +CPOL: <index1>,<format>,<oper1>[,<GSM_AcT1>,<GSM_Compact_AcT1>,
<UTRAN_AcT1>,<E-UTRAN_AcT1>][<CR><LF>
+CPOL: <index2>,<format>,<oper2>[,<GSM_AcT2>,<GSM_Compact_AcT2>,
<UTRAN_AcT2>,<EUTRAN_AcT2>][...]]
OK
or
+CME ERROR: <err>
Write command
Syntax Response
+CPOL=[<index>] OK
[,<format>
[,<oper> or
[,<GSM_AcT>,
<GSM_Compact_ +CME ERROR: <err>
AcT>,
<UTRAN_AcT>, Parameters
<EUTRAN_AcT>] <indexn> Integer type; order number of operator in the SIM/USIM preferred operator
]] list
<format> 0 Long format alphanumeric <oper>

1 Short format alphanumeric <oper>
2 Numeric <oper>
<opern> String type; <format> indicates if the format is alphanumeric or numeric
<GSM_AcTn> Integer type; GSM access technology

0 Access technology not selected
1 Access technology selected
<GSM_Compact_AcTn> Integer type; GSM compact access technology

<UTRAN_AcTn> Integer type; UTRAN access technology

<E-UTRAN_AcTn> Integer type; E-UTRAN access technology

41111821 Rev 12 August 04, 2020 117

6.6. +CREG Command: Network Registration

HL78xx
Test command
Syntax Response
AT+CREG=? +CREG: (list of supported <n>s)
OK
Read command
Syntax Response
AT+CREG? +CREG: <n>,<stat>[,[<lac>],[<ci>],[<AcT>][,<cause_type>,<reject_cause>]]
OK
Write command
Syntax Response
AT+CREG=[<n>] OK
or
+CME ERROR: <err>
Parameters
<n> 0 Disable network registration unsolicited result code
1 Enable network registration unsolicited result code +CREG: <stat>
2 Enable network registration and location information unsolicited result
code +CREG: <stat>[,<lac>,<ci>[,<Act>]]
3 Enable network registration, location information and cause value
information unsolicited result code
+CREG:<stat>[,[<lac>],[<ci>],[<AcT>][,<cause_type>,
<reject_cause>]]
<stat> Circuit mode registration status

0 Not registered, ME is not currently searching a new operator to register to
1 Registered, home network
2 Not registered, but ME is currently searching a new operator to register to
3 Registration denied
4 Unknown
5 Registered, roaming
<lac> String-type; 2-byte location area code in hexadecimal format (e.g. "00C3")
<ci> String-type; 4-byte cell ID in hexadecimal format
<AcT> 0 GSM
7 E-UTRAN
<cause_type> Type of <reject_cause>

0 <reject_cause> contains an MM cause value (see 3GPP TS 24.008 [8] Annex G)
1 <reject_cause> contains a manufacturer specific cause
<reject_cause> Cause of the failed registration

41111821 Rev 12 August 04, 2020 118

6.7. +CPLS Command: Select Preferred PLMN List

HL78xx
Test command
Syntax Response
AT+CPLS=? +CPLS: (list of supported < list>s)
OK
Read command
Syntax Response
AT+CPLS? +CPLS: < list>
OK
Write command
Syntax Response
AT+CPLS= OK
[<cpls_list>]
or
+CME ERROR: <err>
Parameter
<list> 0 User controlled PLMN selector with Access Technology EFPLMNwAcT. If not
found in the SIM/UICC, then the PLMN preferred list is EFPLMNsel (this file
is only available in SIM card or GSM application selected in UICC)
1 Operator controlled PLMN selector with Access Technology EFOPLMNwAcT
2 HPLMN selector with Access Technology EFHPLMNwAcT
6.8. +CEREG Command: EPS Network

Registration Status
HL78xx
Test command
Syntax Response
AT+CEREG=? +CEREG: (list of supported <n>s)
OK
Read command
Syntax Response
AT+CEREG? when <n>=0, 1, 2 or 3 and command is successful:
+CEREG: <n>,<stat>[,[<tac>],[<ci>],[<AcT>[,<cause_type>,<reject_cause>]]]
OK
when <n>=4 or 5 and command is successful:

+CEREG: <n>,<stat>[,[<lac>],[<ci>],[<AcT>][,[<cause_type>],[<reject_cause>]
[,[<Active-Time>],[<Periodic-TAU>]]]]
OK
41111821 Rev 12 August 04, 2020 119

HL78xx
Execute command
Syntax Response
AT+CEREG= OK
[<n>]
or
+CME ERROR: <err>
Parameters
<n> 0 Disable network registration unsolicited result code
1 Enable network registration unsolicited result code +CEREG: <stat>
2 Enable network registration and location information unsolicited result
code +CEREG: <stat>[,[<tac>],[<ci>],[<AcT>]]
3 Enable network registration, location information and EMM cause value
information unsolicited result code
+CEREG: <stat>[,[<tac>],[<ci>],[<AcT>][,<cause_type>,
<reject_cause>]]
4 For a UE that wants to apply PSM, enable network registration and
location information unsolicited result code
+CEREG: <stat>[,[<tac>],[<ci>],[<AcT>][,,[,[<Active-
Time>],[<Periodic-TAU>]]]]
5 For a UE that wants to apply PSM, enable network registration, location
information and EMM cause value information unsolicited result code
+CEREG: <stat>[,[<tac>],[<ci>],[<AcT>][,
[<cause_type>],[<reject_cause>][,[<Active-Time>],
[<Periodic-TAU>]]]]
<stat> Indicates the EPS registration status

0 Not registered; MT is currently not searching for an operator to register to
1 Registered, home network
2 Not registered but MT is currently trying to attach or searching for an operator to
register to
3 Registration denied
4 Unknown (e.g. out of E-UTRAN coverage)
5 Registered, roaming
6 Registered for "SMS only", home network (not applicable)
7 Registered for "SMS only", roaming (not applicable)
8 Attached for emergency bearer services only
9 Registered for "CSFB not preferred", home network (not applicable)
10 Registered for "CSFB not preferred", roaming (not applicable)
<tac> 2-byte tracking area code in hexadecimal format (e.g. "00C3" equals 195 in
decimal)
<ci> String-type; 4-byte E-UTRAN cell ID in hexadecimal format
<AcT> Access technology of the serving cell

0 GSM (not applicable)
1 GSM Compact (not applicable)
2 UTRAN (not applicable)
3 GSM with EGPRS (not applicable)
4 UTRAN with HSDPA (not applicable)
5 UTRAN with HSUPA (not applicable)
6 UTRAN with HSDPA and HSUPA (not applicable)
7 E-UTRAN
41111821 Rev 12 August 04, 2020 120

HL78xx
<cause_type> Indicates the type of <reject_cause>

0 <reject_cause> contains an EMM cause value (see 3GPP TS 24.301 [83] Annex A)
1 <reject_cause> contains a manufacturer-specific cause
<reject_cause> Cause of the failed registration
<Active-Time> 1-byte in an 8-bit format. Indicates the Active Time value (T3324)
allocated to the UE in E-UTRAN. The Active Time value is coded as one byte (octet 3) of
the GPRS Timer 2 information element coded as bit format (e.g. "00100100" equals 4
minutes). For the coding and the value range, see the GPRS Timer 2 IE in 3GPP TS
24.008 [8] Table 10.5.163/3GPP TS 24.008. Also see 3GPP TS 23.682 [149] and 3GPP
TS 23.401 [82].
<Periodic-TAU> 1-byte in an 8-bit format. Indicates the extended periodic TAU value
(T3412) allocated to the UE in E-UTRAN. The extended periodic TAU value is coded as
one byte (octet 3) of the GPRS Timer 3 information element coded as bit format (e.g.
"01000111" equals 70 hours). For the coding and the value range, see the GPRS Timer
3 IE in 3GPP TS 24.008 [8] Table 10.5.163a/3GPP TS 24.008. Also see 3GPP TS
23.682 [149] and 3GPP TS 23.401 [82].
6.9. +CEMODE Command: UE Modes of Operation

for EPS
HL78xx
Test command
Syntax Response
AT+CEMODE=? +CEMODE: (list of supported <mode>s)
OK
Read command
Syntax Response
AT+CEMODE? +CEMODE: <mode>
OK
Write command
Syntax Response
AT+CEMODE= OK
[<mode>]
or
+CME ERROR: <err>
Parameter
<mode> Indicates mode of operation
0 PS mode 2 of operation
1 CS/PS mode 1 of operation
2 CS/PS mode 2 of operation
3 PS mode 1 of operation
41111821 Rev 12 August 04, 2020 121

HL78xx
Reference Notes
27.007 Rev12 In NB-IoT, only <mode>=0 is supported.
6.10. +CNUM Command: Subscriber Number

HL78xx
Test command
Syntax Response
AT+CNUM=? OK
Execute command
Syntax Response
AT+CNUM +CNUM: [<alpha1>],<number1>,<type1>[,<speed>,<service>[,<itc>]][<CR><LF>
+CNUM: [<alpha2>],<number2>,<type2>[,<speed>,<service>[,<itc>]][...]]
OK
or
+CME ERROR: <err>
Parameters
<alphax> Optional alphanumeric string associated with <numberx>; used character set
should be the one selected with command +CSCS
<numberx> String type phone number of format specified by <typex>
<typex> Type of address octet in integer format
<speed> As defined in 27.007 sub clause 6.7, corresponding to +CBST setting
<service> Service related to the phone number

0 Asynchronous modem
1 Synchronous modem
2 PAD Access (asynchronous)
3 Packet Access (synchronous)
5 Fax
<itc> Information transfer capability

0 3.1kHz
1 UDI
41111821 Rev 12 August 04, 2020 122

7. SMS Commands
7.1. Parameters Definition

The following parameters are used in the subsequent clauses which describe all commands. The
formats of integer and string types referenced here are defined in V.25ter.
The default values are for command parameters, not for result code parameters.
7.1.1. Message Storage Parameters

<index> Integer type; value in the range of location numbers supported by the associated memory
<mem1> String type; memory from which messages are read and/or deleted (by commands
+CMGL, +CMGR and +CMGD); defined values are as follows:
"BM" Broadcast message storage

"ME" ME message storage
"MT" Any of the storages associated with ME
"SM" (U)SIM message storage; default value
"TA" TA message storage
"SR" Status report storage
<mem2> String type; memory to which writing and sending operations are made (commands
+CMSS and +CMGW); refer to <mem1> for defined values. Default value is “SM”.
<mem3> String type; preferred memory to which received SMs are to be stored (unless forwarded
directly to TE; refer to +CNMI); refer <mem1> for defined values; received CBMs are
always stored in "BM" (or some manufacturer specific storage) unless directly forwarded
to TE; received status reports are always stored in "SR" (or some manufacturer specific
storage) unless directly forwarded to TE. Default value is “SM”.
<stat> Status of message in memory. Integer type in PDU mode, or string type in text mode.
Available values are as follows:
0 "REC UNREAD" Received unread message (i.e. new message)
1 "REC READ" Received read message
2 "STO UNSENT" Stored unsent message (only applicable to SMs)
3 "STO SENT" Stored sent message (only applicable to SMs)
4 "ALL" All messages (only applicable to +CMGL command)
<total1> Integer type; total number of message locations in <mem1>
<used1> Integer type; number of messages currently in <mem1>
41111821 Rev 12 August 04, 2020 123

AT Commands Interface Guide SMS Commands
7.1.2. Message Data Parameters

<ackpdu> RP-User-Data element of RP-ACK PDU; format is same as for <pdu> in case of SMS,
but without SC address field and parameter shall be bounded by double quote characters
like a normal string type parameter.
<alpha> String type alphanumeric representation of <da> or <oa> corresponding to the entry
found in MT phonebook; implementation of this feature is manufacturer specific; used
character set should be the one selected with +CSCS.
<cdata> Command data in text mode responses; ME/TA converts each 8-bit octet into two IRA
character long hexadecimal number (e.g. octet with integer value 42 is presented to TE
as two characters 2A (IRA 50 and 65)).
<ct> Command type in integer format (default value = 0).
<da> Address value in string format. BCD numbers (or GSM 7-bit default alphabet characters)
are converted to characters of the currently selected TE character set (refer to +CSCS).
Type of address is given by <toda>.
<data> In the case of user data in text mode responses; format:
• if <dcs> indicates that GSM 7-bit default alphabet is used and <fo> indicates that
user data header indication is not set
 if TE character set other than "HEX" (refer to +CSCS): ME/TA converts GSM
alphabet into current TE character set
 if TE character set is "HEX": ME/TA converts each 7-bit character of GSM 7-
bit default alphabet into two IRA character long hexadecimal number (e.g.
character Π (GSM 7-bit default alphabet 23) is presented as 17 (IRA 49 and
55))
• if <dcs> indicates that 8-bit or UCS2 data coding scheme is used, or <fo> indicates
that user data header indication is set: ME/TA converts each 8-bit octet into two
IRA character long hexadecimal number (e.g. octet with integer value 42 is
presented to TE as two characters 2A (IRA 50 and 65))
In the case of CBS: CBM Content of Message in text mode responses; format:
• if <dcs> indicates that GSM 7-bit default alphabet is used
 if TE character set other than "HEX" (refer to +CSCS); ME/TA converts GSM
alphabet into current TE character set
 if TE character set is "HEX"; ME/TA converts each 7-bit character of the GSM
7-bit default alphabet into two IRA character long hexadecimal number
• if <dcs> indicates that 8-bit or UCS2 data coding scheme is used; ME/TA converts
each 8-bit octet into two IRA character long hexadecimal number
<length> Integer type vlayue indicating the length of the actual TP data unit in octets in PDU mode.
This is 140 characters long according to 8-bit GSM coding scheme.
In text mode, the maximum length of an SMS depends on the used coding scheme (160
characters if 7-bit).
<mid> CBM Message Identifier in integer format
<mn> TP-Message-Number in integer format
<mr> Message reference in integer format
<oa> Origiantion address address value field in string format; BCD numbers (or GSM 7-bit
default alphabet characters) are converted to characters of the currently selected TE
character set (refer to +CSCS); type of address given by <tooa>
<page> CBM Page Parameter bits 4-7 in integer format
41111821 Rev 12 August 04, 2020 124

<pages> CBM Page Parameter bits 0-3 in integer format

<pdu> GSM 04.11 SC address followed by GSM 03.40 TPDU in hexadecimal format
In the case of CBS, TPDU in hexadecimal format
<pid> Protocol identifier in integer format. Default value is 0
<ra> Recipient address address value in string format; BCD numbers (or GSM 7-bit default
alphabet characters) are converted to characters of the currently selected TE character
set (refer to +CSCS); type of address is given by <tora>
<sca> String value enclosed in quotes indicating the service center address. Note that BCD
numbers are converted to characters; type of address is given by <tosca>
<scts> Service centre time stamp in time-string format (refer to <dt>)
<sn> CBM Serial Number in integer format
<st> Status in integer format
<toda> Type of address octet in integer format. Default value is 145 if the first character of <da>
is “+”; otherwise, default value is 129
<tooa> Originating address type of address octet in integer format (refer to <toda> for the default
value)
<tora> Recipient address type of address octet in integer format (refer to <toda> for the default
value)
<tosca> SC address type of address octet in integer format (refer to <toda> for the default value)
<vp> Depending on SMS-SUBMIT <fo> setting: TP-Validity-Period either in integer format
(default value = 167) or in time-string format (refer to <dt>)
<vp> Validity period in either integer format (default value = 167) or in time-string format
depending on <fo> settings
<dcs> SMS Data Coding Scheme (default value = 0), or Cell Broadcast Data Coding Scheme in
integer format
<dt> Discharge time in time-string format “yy/MM/dd,hh:mm:ss+zz” where the characters
indicate year, month, day, hour, minutes, seconds and time zone.
For example, May 6, 1994, 10:10 pm GMT+2 hours is equals to “94/05/06,22:10:00+08”
<fo> First octet of SMS-DELIVER, SMS-SUBMIT (default value = 17), SMS-STATUS-
REPORT, or SMS-COMMAND (default value = 2) in integer format depending on
command or result code
7.2. +CMGD Command: Delete Message

HL78xx
Test command
Syntax Response
AT+CMGD=? +CMGD: (list of supported <index>es)[,(list of supported <delflag>s)]
OK
Write command
Syntax Response
AT+CMGD= OK
<index>
[,<delflag>]
41111821 Rev 12 August 04, 2020 125

HL78xx
or
+CMS ERROR: <err>
or
+CME ERROR: <err>
Parameter
<delflag> Integer indicating multiple message deletion request
0 (or omitted) Delete the message specified in <index>
1 Delete all read messages from preferred message storage, leaving
unread messages and stored mobile originated messages (whether sent
or not) untouched
2 Delete all read messages from preferred message storage and sent
mobile originated messages, leaving unread messages and unsent mobile
originated messages untouched
3 Delete all read messages from preferred message storage, sent and
unsent mobile originated messages leaving unread messages untouched
4 Delete all messages from preferred message storage including unread
messages
Notes Execution command deletes message from preferred message storage <mem1>,
location <index>. If <delflag> is present and not set to 0 then the ME shall ignore
<index> and follow the rules for <delflag> shown above.
7.3. +CMGF Command: Set Message Format

HL78xx
Test command
Syntax Response
AT+CMGF=? +CMGF: (list of supported <mode>s)
OK
Read command
Syntax Response
AT+CMGF? +CMGF: <mode>
OK
Execute command
Syntax Response
AT+CMGF= OK
[<mode>]
or
+CMS ERROR: err>
Parameter
<mode> 0 PDU mode (default when implemented)
1 Text mode
Notes <mode> is saved in non-volatile memory per AT port over module reboot.
41111821 Rev 12 August 04, 2020 126

7.4. +CMGL Command: List Messages

HL78xx
Test command
Syntax Response
AT+CMGL=? +CMGL: (list of supported <stat>s)
OK
Execute command
Syntax Response
AT+CMGL If in text mode, command is successful and SMS-SUBMITs and/or SMS-DELIVERs:
[=<stat>] +CMGL: <index>,<stat>, <oa/da>,[<alpha>], [<scts>][,<tooa/toda>,<length>]
<CR><LF><data>[<CR><LF>
+CMGL: <index>,<stat>, <da/oa>,[<alpha>], [<scts>][,<tooa/toda>, <length>]
<CR><LF><data>
[...]]
If in text mode, command is successful and SMS-STATUS-REPORTs:

+CMGL: <index>, <stat>,<fo>, <mr>, [<ra>], [<tora>], <scts>, <d-t>,<st>[<CR><LF>
+CMGL: <index>, <stat>, <fo>, <mr>,[<ra>], [<tora>],<scts>,<d_t>,<st>[...]]
If in text mode, command is successful and SMS-COMMANDs:

+CMGL: <index>,<stat>,<fo>,<ct> [<CR><LF>
+CMGL: <index>,<stat>, <fo>,<ct>[...]]
If in text mode, command is successful and CBM storage:

+CMGL: <index>,<stat>,<sn>, <mid>, <page>,<pages>
<CR><LF><data>[<CR><LF>
+CMGL: <index>,<stat>,<sn>, <mid>,<page>,<pages><CR><LF><data>[...]]
If in PDU mode and command is successful:

+CMGR: <stat>,[<alpha>],<length><CR><LF><pdu>
or
+CMS ERROR: <err>
Parameters
For parameter information and values, refer to section 7.1 Parameters Definition.
7.5. +CMGR Command: Read Message

HL78xx
Test command
Syntax Response
AT+CMGR=? OK
41111821 Rev 12 August 04, 2020 127

HL78xx
Write command
Syntax Response
AT+CMGR= If text mode (+CMGF=1), command is successful, and SMS-DELIVER:
<index> +CMGR: <stat>,<oa>,[<alpha>],<scts>[,<tooa>,<fo>,<pid>,<dcs>,<sca>,<tosca>,
<length>]<CR><LF><data>
if text mode (+CMGF=1), command is successful, and SMS-SUBMIT:

+CMGR: <stat>,<da>,[<alpha>][,<toda>,<fo>,<pid>,<dcs>,[<vp>],<sca>,<tosca>,
<length>]<CR><LF><data>
if text mode (+CMGF=1), command is successful, and SMS-STATUS-REPORT:

+CMGR: <stat>,<fo>,<mr>,[<ra>], [<tora>],<scts>,<d_t>,<st>
if text mode (+CMGF=1), command is successful, and SMS-COMMAND:

+CMGR: <stat>, <fo>,<ct>[, <pid>,[<mn>],[<da>],[<toda>],<length>
<CR><LF><cdata>]
if text mode (+CMGF=1), command is successful, and CBM storage:

+CMGR: <stat>,<sn>, <mid>,<dcs>,<page>,<pages><CR><LF><data>
if PDU mode (+CMGF=0) and command is successful:

+CMGR: <stat>,[<alpha>],<length><CR><LF><pdu>
or
+CMS ERROR: <err>
Parameters
7.6. +CMGS Command: Send Message

HL78xx
Test command
Syntax Response
AT+CMGS=? OK
Write command
Syntax Response
If text mode If text mode (+CMGF=1) and sending is successful:
(+CMGF=1): [+CMGS: <mr>[,<scts>]]
AT+CMGS=<da> OK
[,<toda>]<CR>
text is entered
if PDU mode (+CMGF=0) and sending is successful:
<ctrl-Z/ESC>
[+CMGS: <mr>]
OK
or
+CMS ERROR: <err>
41111821 Rev 12 August 04, 2020 128

HL78xx
If PDU mode
(+CMGF=0): Parameters
AT+CMGS= For parameter information and values, refer to section 7.1 Parameters Definition.
<length><CR>
PDU is given
<ctrl-Z/ESC>
Notes • The TA shall send a four-character sequence
<CR><LF><greater_than><space> (IRA 13, 10, 62, 32) after command line is
terminated with <CR>; after that PDU can be given from TE to ME/TA.
• The PDU shall be hexadecimal format (similarly as specified for <pdu>) and
given in one line; ME/TA converts this coding into the actual octets of PDU.
• When the length octet of the SMSC address (given in the PDU) equals zero,
the SMSC address set with +CSCA is used; in this case the SMSC Type-of-
Address octet shall not be present in the PDU, i.e. TPDU starts right after
SMSC length octet.
• Sending can be cancelled by giving <ESC> character.
• <ctrl-Z> must be used to indicate the ending of PDU.
• +CMGS: <mr>[,<scts>] is not available in +CMGS intermediate response as
SMS is sent over IMS using 3GPP2 SMS PDU format and protocol.
7.7. +CMGW Command: Write Message to Memory

HL78xx
Test command
Syntax Response
AT+CMGW=? OK
Write command
Syntax Response
If text mode +CMGW: <index>
(+CMGF=1): OK
AT+CMGW[=
<oa/da>
or
[,<tooa/toda>
[,<stat>]]]<CR> +CMS ERROR: <err>
text is entered
<ctrl-Z/ESC> Parameters
If PDU mode
(+CMGF=0):
AT+CMGW=
<length>[,<stat>]
<CR>
PDU is given
<ctrl-Z/ESC>
Notes • Execution command stores a message to memory storage <mem2>, and
memory location <index> of the stored message is returned.
• By default, message status will be set to 'stored unsent', but parameter <stat>
also allows other status values to be given. (ME/TA manufacturer may choose
to use different default <stat> values for different message types.)
• Entering of PDU is done similarly as specified in +CMGS.
41111821 Rev 12 August 04, 2020 129

7.8. +CMSS Command: Send Message from

Storage
HL78xx
Test command
Syntax Response
AT+CMSS=? OK
Write command
Syntax Response
AT+CMSS= If text mode (+CMGF=1) and sending is successful:
<index>[,<da> +CMSS: <mr>[,<scts>]
[,<toda>]]
If PDU mode (+CMGF=0) and sending is successful:
+CMSS: <mr>
OK
or
+CMS ERROR: <err>
Parameters
Notes • Execution command sends message with location value <index> from
message storage <mem2> to the network (SMS-SUBMIT or SMS-COMMAND).
If new recipient address <da> is given for SMS-SUBMIT, it shall be used
instead of the one stored with the message.
• Reference value <mr> is returned to the TE on successful message delivery.
Optionally (when +CSMS <service> value is 1 and network supports the
feature), <scts> is returned in text mode.
7.9. +CNMI Command: New Message Indication

HL78xx
Test command
Syntax Response
AT+CNMI=? +CNMI: (list of supported <mode>s), (range of supported <mt>s), (list of supported
<bm>s), (range of supported <ds>es), (range of supported <bfr>s)
OK
Read command
Syntax Response
AT+CNMI? +CNMI: <mode>,<mt>,<bm>,<ds>,<bfr>
OK
41111821 Rev 12 August 04, 2020 130

HL78xx
Write command
Syntax Response
+CNMI=[<mode> OK
[,<mt>[,<bm>
[,<ds>[,<bfr>]]]]] or
+CMS ERROR: <err>
or
ERROR
Parameters
<mode> 1 Discard indication and reject new received message unsolicited
result codes when TA-TE link is reserved. Otherwise forward them
directly to the TE.
2 Buffer unsolicited result codes in the TA when TA-TE link is
reserved (e.g. in on-line data mode) and flush them to the TE after
reservation. Otherwise forward them directly to the TE.
<mt> 0 No indications are routed to the TE.

1 Result code is sent when ME does not have any other display device
other than the AT interface
2 Acknowledgement command must be sent when +CSMS <service> = 1
and ME does not have any other display device other than the AT
interface
<bm> 0 No CBM indications are routed to the TE.

2 New CBMs are routed directly to the TE using unsolicited result code:
+CBM: <length><CR><LF><pdu> (PDU mode enabled); or
+CBM: <sn>,<mid>,<dcs>,<page>,<pages><CR><LF><data> (text
mode enabled)
<ds> 0 No SMS-STATUS-REPORTs are routed to the TE.

1 SMS-STATUS-REPORTs are routed to the TE using unsolicited result
code: +CDS: <length><CR><LF><pdu> (PDU mode enabled) or
+CDS: <fo>,<mr>,[<ra>],[<tora>],<scts>,<dt>,<st> (text
mode enabled)
2 If SMS-STATUS-REPORT is stored in ME/TA, indication of the memory
location is routed to the TE using unsolicited result code:
+CDSI: <mem>,<index>
<bfr> 0 TA buffer of unsolicited result codes defined within this command is

flushed to the TE when <mode> = 1 – 3 is entered
1 TA buffer of unsolicited result codes defined within this command is
cleared when <mode> = 1 – 3 is entered
Notes <mode>, <mt>, <bm> and <ds> are saved in non-volatile memory over module reboot;
URC is available on the port that executes the command.
Examples AT+CNMI=1 // Write command
OK
AT+CNMI=? // Test command

+CNMI: (1,2),(0-2),(0,2),(0-2),(0-1)
OK
AT+CNMI? // Read command

+CNMI: 1,0,0,0,0
OK
41111821 Rev 12 August 04, 2020 131

7.10. +CSCA Command: Service Center Address

HL78xx
Test command
Syntax Response
AT+CSCA=? OK
Read command
Syntax Response
AT+CSCA? +CSCA: <sca>,<tosca>
OK
Write command
Syntax Response
AT+CSCA=<sca> OK
[,<tosca>]
or
+CMS ERROR: <err>
Parameters
7.11. +CSMP Command: Set Text Mode Parameters

HL78xx
Test command
Syntax Response
AT+CSMP=? +CSMP: (list of supported <fo>s), (list of supported <vp>s), (list of supported <pid>s,
(list of supported <dcs>s)
OK
Read command
Syntax Response
AT+CSMP? +CSMP: <fo>,<vp>,<pid>,<dcs>
OK
Write command
Syntax Response
AT+CSMP=[<fo> OK
[,<vp>[,<pid>
[,<dcs>]]]]
Parameters
41111821 Rev 12 August 04, 2020 132

HL78xx
Read command
Syntax Response
AT+CPMS? +CPMS:
<mem1>,<used1>,<total1>,<mem2>,<used2>,<total2>,<mem3>,<used3>,<total3>
OK
or
+CMS ERROR: <err>
Write command
Syntax Response
AT+CPMS= +CPMS: <used1>,<total1>,<used2>,<total2>,<used3>,<total3>
<mem1> OK
[,<mem2>
[,<mem3>]]
or
+CMS ERROR: <err>
Parameters
Notes <mem1>, <mem2> and <mem3> are saved in non-volatile memory over module reboot.
7.14. +CSDH Command: Show Text Mode

Parameters
HL78xx
Test command
Syntax Response
AT+CSDH=? +CSDH: (list of supported <show>s)
OK
Read command
Syntax Response
AT+CSDH? +CSDH: <show>
OK
Write command
Syntax Response
AT+CSDH= OK
[<show>]
or
+CME ERROR: <err>
41111821 Rev 12 August 04, 2020 134

HL78xx
Parameter
<show> 0 Do not show header values defined in commands +CSCA and
+CSMP (<sca>, <tosca>, <fo>, <vp>, <pid> and <dcs>) nor
<length>, <toda> or <tooa> in +CMGL, +CMGR result codes for
SMS-DELIVERs and SMS-SUBMITs in text mode; for SMS-
COMMANDs in +CMGR resultcode, do not show <pid>, <mn>,
<da>, <toda>, <length> or <cdata>
1 Show values in result codes
7.15. +CMT Notification: Received SMSPP Content

HL78xx
Notification +CMT: [<alpha>], <length><CR><LF><pdu>
+CMT: <oa>,[<alpha>],<scts>[,<tooa>,<fo>,<pid>,<dcs>,<sca>,<tosca>,<length>]
<CR> <LF> <data>
Reference Notes
[27.005] • All parameters are extracted from received message.
• Detailed header information is shown in text mode result codes according to
+CSDH.
41111821 Rev 12 August 04, 2020 135

8. Packet Domain Commands
8.1. +CGATT Command: PS Attach or Detach

HL78xx
Test command
Syntax Response
AT+CGATT=? +CGATT: (list of supported <state>s)
OK
Read command
Syntax Response
AT+CGATT? +CGATT: <state>
OK
Write command
Syntax Response
AT+CGATT= OK
[<state>]
or
ERROR
Parameter
<state> State of PS attachment
0 Detached
1 Attached
8.2. +CGACT Command: PDP Context Activate or

Deactivate
HL78xx
Test command
Syntax Response
AT+CGACT=? +CGACT: (list of supported <state>s)
OK
Read command
Syntax Response
AT+CGACT? [+CGACT: <cid>,<state>]
[<CR><LF>+CGACT: <cid>,<state>
[...]]
OK
41111821 Rev 12 August 04, 2020 136

AT Commands Interface Guide Packet Domain Commands
HL78xx
Write command
Syntax Response
AT+CGACT= OK
[<state>[,<cid>
[,<cid>[,...]]]]
or
+CME ERROR: <err>
Parameters
<state> Indicates the state of PDP context activation
0 Deactivated
1 Activated
<cid> Numeric parameter which specifies a particular PDP context definition

Reference Notes
27.007 Rev12 • Be aware that the module includes an internal stack that may automatically
activate or deactivate PDP context.
• Important: Deactivating all PDP contexts (e.g. by using AT+CGACT=0 with no
<cid> parameters) also causes the device to detach from the network
(equivalent to AT+CGATT=0).
• Important: The command will not allow you to deactivate the last active PDP
context without another PDP context active (it will return ERROR). To
deactivate your last PDP context (or all of them), you must detach with
AT+CGATT=0 or AT+CGACT=0.
• You must reattach with AT+CGATT=1 before reactivating any PDP contexts.
8.3. +CGCMOD Command: Modify PDP Context

HL78xx
Test command
Syntax Response
AT+CGCMOD=? +CGCMOD: (list of <cid>s addociated with active contexts)
OK
Write command
Syntax Response
AT+CGCMOD= OK
[<cid>[,<cid>
[,...]]]
or
+CME ERROR: <err>
Parameter
<cid> Numeric parameter which specifies a particular PDP context definition (see
+CGDCONT and +CGDSCONT)
41111821 Rev 12 August 04, 2020 137

8.4. +CGTFT Command: Traffic Flow Template

HL78xx
Test command
Syntax Response
AT+CGTFT=? +CGTFT: <PDP_type>, (list of supported <packet filter identifier>s) , (list of supported
<evaluation precedence index>s), (list of supported <source address and subnet
mask>s), (list of supported <protocol number (ipv4) / next header (ipv6)>s), (list of
supported <destination port range>s), (list of supported <source port range>s), (list
of supported <ipsec security parameter index (spi)>s), (list of supported <type of
service (tos) (ipv4) and mask / traffic class (ipv6) and mask>s), (list of supported
<flow label (ipv6)>s), (list of supported <direction>s)
[<CR><LF>+CGTFT: <PDP_type>, (list of supported <packet filter identifier>s), (list
of supported <evaluation precedence index>s), (list of supported <source address
and subnet mask>s), (list of supported <protocol number (ipv4) / next header
(ipv6)>s), (list of supported <destination port range>s),(list of supported <source port
range>s), (list of supported <ipsec security parameter index (spi)>s), (list of
supported <type of service (tos) (ipv4) and mask / traffic class (ipv6) and mask>s),
(list of supported <flow label (ipv6)>s), (list of supported <direction>s)[...]]
Read command
Syntax Response
AT+CGTFT? +CGTFT: <cid>, <packet filter identifier>,<evaluation precedence index>, <source
address and subnet mask>, <protocol number (ipv4) / next header (ipv6)>,
<destination port range>, <source port range>, <ipsec security parameter index
(spi)>, <type of service (tos) (ipv4) and mask / traffic class (ipv6) and mask>, <flow
label (ipv6)>, <direction>
[<CR><LF>+CGTFT: <cid>, <packet filter identifier>, <evaluation precedence
index>, <source address and subnet mask>, <protocol number (ipv4) / next
header (ipv6)>, <destination port range>, <source port range>, <ipsec security
parameter index (spi)>, <type of service (tos) (ipv4) and mask / traffic class (ipv6)
and mask>, <flow label (ipv6)>, <direction>
[...]]
Execute command
Syntax Response
AT+CGTFT= OK
[<cid>,[<packet
filter identifier>,
or
<evaluation
precedence ERROR
index> [,<source
address and Parameter
subnet mask> <cid> Numeric parameter which specifies a particular PDP context definition (see
[,<protocol +CGDCONT and +CGDSCONT)
number (ipv4) /
next header
(ipv6)> <packet filter identifier> Numeric parameter with value range from 1 to 16
[,<destination
port range> <evaluation precedence index> Numeric parameter with value range from 0 to 255
[,<source port
range>
<source address and subnet mask> String tpe given as a dot-separated numeric
[,<ipsec security
(0 – 255) parameter of the form "a1.a2.a3.a4.m1.m2.m3.m4" for IPv4 or
parameter index
"a1.a2.a3.a4.a5.a6.a7.a8.a9.a10.a11.a12.a13.
(spi)> [,<type of
a14.a15.a16.m1.m2.m3.m4.m5.m6.m7.m8.
service (tos)
m9.m10.m11.m12.m13.m14.m15.m16" for IPv6
(ipv4) and mask /
traffic class
(ipv6) and mask>
41111821 Rev 12 August 04, 2020 138

HL78xx
[,<flow label <protocol number (ipv4) / next header (ipv6)> Numeric parameter with value range
(ipv6)>, from 0 to 255
<direction>
]]]]]]]]]] <destination port range> String type given as a dot-separated numeric (0 – 65535)
parameter on the form ‘f.t.’
<source port range> String type given as a dot-separated numeric (0 – 65535)

parameter on the form ‘f.t.’
<ipsec security parameter index (spi)> Numeric value in hecadecimal format with
value range from 00000000 to FFFFFFFF
<type of service (tos) (ipv4) and mask / traffic class (ipv6) and mask> String type
given as a dot-separated numeric (0 – 255) parameter on the form ‘t.m.’
<flow label (ipv6)> Numeric value in hecadecimal format with value range from 00000
to FFFFF. Valid for IPv6 only
<direction> Specifies the transmission direction in which the packet filter shall be
applied
1 Uplink
2 Downlink
3 Birectional (up and downlink; default if omitted)
Reference Notes
27.007 Rev12 • Some of the listed attributes above may coexist in a Packet Filter while others
mutually exclude each other. For the list of possible combinations, refer to
3GPP TS 23.060.
• +CGTFT=<cid> causes all packet filters in the TFT for context number <cid> to
become undefined.
8.5. +CGDCONT Command: Define PDP Context

HL78xx
Test command
Syntax Response
AT+CGDCONT=? +CGDCONT: (range of supported <cid>s),<PDP_type>,,,(list of supported
<d_comp>s),(list of supported <h_comp>s),(list of supported <IPv4AddrAlloc>s),(list
of supported <request_type>s),(list of supported <P-CSCF_discovery>s),(list of
supported <IM_CN_Signalling_Flag_Ind>s),(list of supported <NSLPI>s),(list of
supported <securePCO>s),(list of supported <IPv4_MTU_discovery>s),(list of
supported <Local_Addr_Ind>s),(list of supported <Non-IP_MTU_discovery>s),(list of
supported <Reliable_Data_Service>s)
[<CR><LF>+CGDCONT: (range of supported <cid>s),<PDP_type>,,,(list of supported
<d_comp>s),(list of supported <h_comp>s),(list of supported <IPv4AddrAlloc>s),(list
of supported <request_type>s),(list of supported <P-CSCF_discovery>s),(list of
supported <IM_CN_Signalling_Flag_Ind>s),(list of supported <NSLPI>s),(list of
supported <securePCO>s),(list of supported <IPv4_MTU_discovery>s),(list of
supported <Local_Addr_Ind>s),(list of supported <Non-IP_MTU_discovery>s),(list of
supported <Reliable_Data_Service>s) [...]]
OK
41111821 Rev 12 August 04, 2020 139

HL78xx
Read command
Syntax Response
AT+CGDCONT? [+CGDCONT:
<cid>,<PDP_type>,<APN>,<PDP_addr>,<d_comp>,<h_comp>[,<IPv4AddrAlloc>
[,<request_type>[,<P-CSCF_discovery>[,<IM_CN_Signalling_Flag_Ind>[,<NSLPI>
[,<securePCO>[,<IPv4_MTU_discovery>[,<Local_Addr_Ind>
[,<Non-IP_MTU_discovery>[,<Reliable_Data_Service>]]]]]]]]]]]
[<CR><LF>+CGDCONT:<cid>,<PDP_type>,<APN>,<PDP_addr>,<d_comp>,
<h_comp>[,<IPv4AddrAlloc>[,<request_type>[,<P-CSCF_discovery>
[,<IM_CN_Signalling_Flag_Ind>[,<NSLPI>[,<securePCO>[,<IPv4_MTU_discovery>
[,<Local_Addr_Ind>[,<Non-IP_MTU_discovery>[,<Reliable_Data_Service>]]]]]]]]]]
OK
Execute command
Syntax Response
AT+CGDCONT= OK
[<cid>[,<PDP_
type>[,<APN> or
[,<PDP_addr>
[,<d_comp> ERROR
[,<h_comp>
[,<IPv4Addr Parameters
Alloc> <cid> PDP Context Identifier. A numeric parameter which specifies a particular PDP
[,<request_type> context definition. The parameter is local to the TE-MT interface and is used in other
[,<P-CSCF_ PDP context-related commands. The range of the permitted values (minimum value = 1)
discovery>[,<IM_ is returned by the test command.
CN_Signalling_
Flag_Ind>
<PDP_type> Packet Data Protocol type
[,<NSLPI>
[,<securePCO> "IP" Internet Protocol
[,<IPv4_MTU_ "IPV6" Internet Protocol version 6
discovery>] "IPV4V6" Virtual <PDP_type>introduced to handle dual IP stack UE capability
[,<Local_Addr_ “Non-IP” Transfer of non-IP data to external packet data network
Ind>][,<Non-
IP_MTU_
discovery>] <APN> Access Point Name
[,<Reliable_Data String parameter which is a logical name that is used to select the GGSN or the external
_Service>] packet data network. If the value is null or omitted, then the subscription value will be
]]]]]]]]]]]] requested.
<PDP_addr> String parameter that identifies the MT in the address space applicable to
the PDP. If the value is null or omitted then a value may be provided by the TE during
the PDP startup procedure or, failing that, a dynamic address will be requested. The
read command will continue to return the null string even if an address has been
allocated during the PDP startup procedure. The allocated address may be read using
+CGPADDR.
Note that IPv6 address obtained on LTE will be prefixed with a constant 8-byte address
"FE.80.00.00.00.00.00.00" if the network has not provided any.
Currently, this parameter is omitted.
<d_comp> PDP data compression (applicable for SNDCP only)

0 Off (default if value is omitted)
<h_comp> PDP header compression

0 Off (default if value is omitted)
41111821 Rev 12 August 04, 2020 140

HL78xx
<IPv4AddrAlloc> Numeric parameter that controls how MT/TA requests to get IPv4
address information
0 IPv4 address allocated through NAS signalling
1 IPv4 address allocated through DHCP
<request_type> Integer type; indicates the type of PDP context activation request for
the PDP context
0 PDP context is for new PDP context establishment or for handover from a non-
3GPP access network
1 PDP context is for emergency bearer services
2 PDP context is for new PDP context establishment
3 PDP context is for handover from a non-3GPP access network
4 PDP context is for handover of emergency bearer services from a non-3GPP
access network
<P-CSCF_discovery> Numeric parameter that influences how the MT/TA requests

get the P-CSCF address
0 Preference of P-CSCF address discovery not influenced by +CGDCONT
1 Preference of P-CSCF address discovery through NAS signalling
2 Preference of P-CSCF address discovery through DHCP
<IM_CN_Signalling_Flag_Ind> Numeric parameter used to indicate whether the PDP

context is for IM CN subsystem related signaling only or not
0 UE indicates that the PDP context is not for IM CN subsystem-related signaling
only
1 UE indicates that the PDP context is for IM CN subsystem-related signaling only
<NSLPI> Integer type; indicates the NAS signalling priority requested for this PDP
context
0 Indicates that this PDP context is to be activated with the value for the low priority
indicator configured in the MT
1 Indicates that this PDP context is is to be activated with the value for the low
priority indicator set to "MS is not configured for NAS signalling low priority".
<securePCO> Integer type. Specifies if security protected transmission of PCO is

requested or not (applicable for EPS only)
0 Security protected transmission of PCO is not requested
1 Security protected transmission of PCO is requested
<IPv4_MTU_discovery> Integer type; influences how the MT/TA requests get the
IPv4 MTU size
0 Preference of IPv4 MTU size discovery not influenced by +CGDCONT
1 Preference of IPv4 MTU size discovery through NAS signalling
<Local_Addr_Ind> Integer type; indicates to the network whether the MS supports

local IP address in TFTs
0 Indicates that the MS does not support local IP address in TFTs
1 Indicates that the MS supports local IP address in TFTs
<Non-IP_MTU_discovery> Integer type; influences how the MT/TA requests get the
non-IP MTU size.
0 Preference of non-IP MTU size discovery not influenced by +CGDCONT
1 Preference of non-IP MTU size discovery through NAS signalling
41111821 Rev 12 August 04, 2020 141

HL78xx
<Reliable_Data_Service> Integer type; indicates whether the UE is using Reliable

Data Service for a PDN connection or not.
0 Reliable Data Service is not being used for the PDN connection
1 Reliable Data Service is being used for the PDN connection
Reference Notes
27.007 Rev14 • If the command is only used with one parameter, <cid>, it means that the
corresponding PDP context becomes undefined.
• The APN Control List (ACL) will only be checked if a USIM is inserted. Before
performing context definition, it will check if the ACL-service is enabled and
activated. If yes, all APNs from the ACL of EF-ACL of the USIM will be read out
and compared with the requested APN.
 If the requested APN is listed in the ACL, the context definition will be
performed.
 If the requested APN is empty ("") and ACL contains "network provided
APN", the context definition will also be requested.
 If the APN is not listed in the ACL, the command returns error.
 If the ACL-service is not enabled or not activated in the USIM or a GSM-
SIM is inserted, the context definition will be performed without any checks.
• Parameters are saved in non-volatile memory over module reboot.
• Parameters like available CIDs might vary depending on operator configuration
set by +KCARRIERCFG . Refer to Table 2 Device Configuration of AirPrime
HL7800-M MNO and RF Band Customization at Customer Application Site
Application Note (reference number 2174213) for configuration description.
8.6. +CGDSCONT Command: Define Secondary

PDP Context
HL78xx
Test command
Syntax Response
AT+CGDSCONT= +CGDSCONT: (range of <cid>s),(list of <cid>s for defined primary contexts),
? <PDP_type>,,,(list of supported <d_comp>s),(list of supported <h_comp>s),(list of
supported <IM_CN_Signalling_Flag_Ind>s)
[<CR><LF>+CGDSCONT: (range of <cid>s),(list of <cid>s for defined primary
contexts),
<PDP_type>,,,(list of supported <d_comp>s),(list of supported <h_comp>s),(list of
supported <IM_CN_Signalling_Flag_Ind>s)
[...]]
OK
Read command
Syntax Response
AT+CGDSCONT? [+CGDSCONT: <cid>, <p_cid>, <d_comp>, <h_comp>
[,<IM_CN_Signalling_Flag_Ind>]]
[<CR><LF>+CGDSCONT: <cid>, <p_cid>, <d_comp>,<h_comp>
[,<IM_CN_Signalling_Flag_Ind>]]
[...]]]
OK
41111821 Rev 12 August 04, 2020 142

HL78xx
Execute command
Syntax Response
AT+CGDSCONT= OK
[<cid>,<p_cid>
[,<d_comp> or
[,<h_comp>
ERROR
[,<IM_CN_
Signalling_Flag_
Ind>]]]] Parameter
<cid> PDP Context Identifier. A numeric parameter that specifies a particular PDP
context definition. The parameter is local to the TE-MT interface and is used in other
PDP context-related commands. The range of the permitted values (minimum value = 1)
is returned by the test command.
<p_cid> Primary PDP Context Identifier. Numeric parameter that specifies a

particular PDP context definition which has been specified by +CGDCONT. The
parameter is local to the TE-MT interface. The list of permitted values is returned by the
test command.
<d_comp> PDP data compression (applicable for SNDCP only)

0 Off (default value if omitted)
1 On (manufacturer preferred compression)
2 V.42 bis
<h_comp> PDP header compression

0 Off (default value if omitted)
1 On (manufacturer preferred compression)
2 RFC1144 (applicable for SNDCP only)
3 RFC2507
4 RFC3095 (applicable for PDCP only)
<IM_CN_Signalling_Flag_Ind> Numeric parameter used to indicate whether the PDP

context is for IM CN subsystem related signaling only or not
0 UE indicates that the PDP context is not for IM CN subsystem-related signaling only
1 UE indicates that the PDP context is for IM CN subsystem-related signaling only
8.7. +CGCONTRDP Command: PDP Context Read

Dynamic Parameter
HL78xx
Test command
Syntax Response
+CGCONTRDP=? +CGCONTRDP: (list of <cid>s associated with active contexts)
OK
41111821 Rev 12 August 04, 2020 143

HL78xx
Execute command
Syntax Response
+CGCONTRDP [+CGCONTRDP: <cid>,<bearer_id>,<apn>[,<local_addr and subnet_mask>
[=<cid>] [,<gw_addr>[,<DNS_prim_addr>[,<DNS_sec_addr>[,<P-CSCF_prim_addr>
[,<P-CSCF_sec_addr>[,<IM_CN_Signalling_Flag>[,<LIPA_indication>[,<IPv4_MTU>
[,<WLAN_Offload>[,<Local_Addr_Ind>[,<Non-IP_MTU>
[,<Serving_PLMN_rate_control_value>[,<Reliable_Data_Service]]]]]]]]]]]]]]]
[<CR><LF>+CGCONTRDP: <cid>,<bearer_id>,<apn>[,<local_addr and
subnet_mask>[,<gw_addr>[,<DNS_prim_addr>[,<DNS_sec_addr>[,<P-
CSCF_prim_addr>[,<P-CSCF_sec_addr>[,<IM_CN_Signalling_Flag>
[,<LIPA_indication>[,<IPv4_MTU>[,<WLAN_Offload>[,<Local_Addr_Ind>
[,<Non-IP_MTU>[,<Serving_PLMN_rate_control_value>
[,<Reliable_Data_Service]]]]]]]]]]]]]]
[...]]
OK
or
ERROR
Parameters
<cid> Integer type; specifies a particular non-secondary PDP context definition. The
parameter is local to the TE-MT interface and is used in other PDP context-related
commands (see +CGDCONT and +CGDSCONT).
<bearer_id> Numeric parameter which identifies the bearer; EPS Bearer in EPS
<apn> Access Point Name; string parameter which is a logical name that is used to
select the GGSN or the external packet data network. If the value is null or omitted, then
the subscription value will be requested.
<local_addr and subnet_mask> String type; shows the IP address and subnet mask
of the MT. The string is given as dot-separated numeric (0-255) parameters.
<gw_addr> String type; shows the Gateway Address of the MT. The string is given as
dot-separated numeric (0-255) parameters.
<DNS_prim_addr> String parameter which shows the IP Address of the primary DNS
Server
<DNS_sec_addr> String parameter which shows the IP address of the secondary

DNS Server
<P_CSCF_prim_addr> String parameter which shows the IP Address of the primary

P-CSCF Server
<P_CSCF_sec_addr> String parameter which shows the IP Address of the

secondary P-CSCF Server
<IM_CN_Signalling_Flag> Shows whether the PDP context is for IM CN subsystem-

related signalling only or not.
0 PDP context is not for IM CN subsystem-related signalling only
<LIPA_indication> Indicates that the PDP context provides connectivity using a LIPA
PDN connection. This parameter cannot be set by the TE.
0 Indication not received that the PDP context provides connectivity using a LIPA
PDN connection
1 Indication received that the PDP context provides connectivity using a LIPA PDN
connection
41111821 Rev 12 August 04, 2020 144

HL78xx
Parameters
<cid> Integer type; specifies a particular active secondary PDP context or Traffic Flows
definition. The parameter is local to the TE-MT interface and is used in other PDP
context-related commands (see +CGDCONT and +CGDSCONT).
<p_cid> Integer type; specifies a particular PDP context definition or default EPS
context Identifier which has been specified by +CGDCONT. The parameter is local to the
TE-MT interface (see +CGDSCONT)
<bearer_id> Numeric parameter which identifies the bearer; EPS Bearer in EPS
<IM_CN_Signalling_Flag> Shows whether the PDP context is for IM CN subsystem-

related signalling only or not.
0 PDP context is not for IM CN subsystem-related signalling only
1 PDP context is for IM CN subsystem-related signalling only
8.9. +CGEREP Command: Packet Domain Event

Reporting
HL78xx
Test command
Syntax Response
AT+CGEREP=? +CGEREP: (list of supported <mode>s),(list of supported <bfr>s)
OK
Read command
Syntax Response
AT+CGEREP? +CGEREP: <mode>, <bfr>
OK
or
ERROR
Write command
Syntax Response
AT+CGEREP= OK
[<mode>[,<bfr>]]
or
ERROR
Parameters
<mode> 0 Buffer unsolicited result codes in the MT; if MT result code buffer is
full, the oldest ones can be discarded. No codes are forwarded to
the TE.
1 Discard unsolicited result codes when MT-TE link is reserved (e.g.
in on-line data mode); otherwise forward them directly to the TE
2 Buffer unsolicited result codes in the MT when MT-TE link is
reserved (e.g. in on-line data mode) and flush them to the TE when
MT-TE link becomes available; otherwise forward them directly to
the TE (2 is the default value)
41111821 Rev 12 August 04, 2020 146

HL78xx
<bfr> 0 MT buffer of unsolicited result codes defined within this command

is cleared when <mode> 1 or 2 is entered
1 MT buffer of unsolicited result codes defined within this command
is flushed to the TE when <mode> 1 or 2 is entered (OK response
shall be given before flushing the codes)
Notification +CGEV: NW DETACH The network has forces a PS detach
+CGEV: NW CLASS <class> The network has forced a change of MT class
+CGEV: ME CLASS <class> The mobile termination has forced a change of MT class
+CGEV: ME PDN ACT <cid>[,<reason>] The mobile termination has activated a
context
+CGEV: NW ACT <p_cid>, <cid>, <event_type> The network has activated a context
+CGEV: ME ACT <p_cid>, <cid>, <event_type> The network has responded to an
ME initiated context activation
+CGEV: NW PDN DEACT <cid> The network has deactivated a context
+CGEV: ME PDN DEACT <cid> The mobile termination has deactivated a context
+CGEV: NW DEACT <p_cid>, <cid>, <event_type> The network has deactivated a
context
+CGEV: ME DEACT <p_cid>, <cid>, <event_type> The network has responded to
an ME initiated context
deactivation request
+CGEV: NW MODIFY <cid>, <change_reason>, <event_type> The network has
modified a context
+CGEV: ME MODIFY <cid>, <change_reason>, <event_type> The mobile
termination has
modified a context
Parameters
<reason> 0 IPv4 only allowed
1 IPv6 only allowed
2 Single address bearers only allowed
3 Single address bearers only allowed and MT initiated context
activation for a second address type bearer was not successful
<event_type> 0 Informational event

1 Information request, acknowledgement required
<change_reason> 0 TFT only changed

1 QoS only changed
2 Both TFT and QoS changed
8.10. +CGPADDR Command: Show PDP Address

HL78xx
Test command
Syntax Response
AT+CGPADDR=? +CGPADDR: (list of supported <cid>s)
OK
41111821 Rev 12 August 04, 2020 147

HL78xx
Write command
Syntax Response
AT+CGPADDR= +CGPADDR: <cid>[,<PDP_addr_1>[,<PDP_addr_2>]]
[<cid>,<cid> [<CR><LF>
[,...]]]
+CGPADDR: <cid>[,<PDP_addr_1>[,<PDP_addr_2>]]][...]]
OK
Parameters
<cid> Numeric parameter which specifies a particular PDP context definition (see
+CGDCONT and +CGDSCONT). If no <cid> is specified, the addresses for all activated
contexts are returned.
<PDP_addr_1>, <PDP_addr_2> String that identifies the MT in the address space

applicable to the PDP. The address may be static or dynamic. For a static address, it will
be the one set by +CGDCONT and +CGDSCONT when the context was defined.
For a dynamic address it will be the one assigned during the last PDP context activation
that used the context definition referred to by <cid>.
Both <PDP_addr_1> and <PDP_addr_2> are omitted if none are available.
Both <PDP_addr_1> and <PDP_addr_2> are included when both Ipv4 and Ipv6
addresses are assigned, with <PDP_addr_1> containing the IPv4 address and
<PDP_addr_2> containing the IPv6 address.
The string is given as dot-separated numeric (0 – 255) parameter of the form:
a1.a2.a3.a4 for IPv4 and a1.a2.a3.a4.a5.a6.a7.a8.a9.a10.a11.a12.a13.a14.a15.a16 for
IPv6.
8.11. +CGSMS Command: Select Service for MO

SMS Messages
HL78xx
Test command
Syntax Response
AT+CGSMS=? +CGSMS: (list of currently available <service>s)
OK
Read command
Syntax Response
AT+CGSMS? +CGSMS: <service>
OK
Write command
Syntax Response
AT+CGSMS= OK
[<service>]
or
ERROR
41111821 Rev 12 August 04, 2020 148

HL78xx
Parameter
<service> Indicates the service or service preference to be used
0 Packet Domain
1 Circuit Switched
Reference Notes
27.007 Rev12 In 4G RAT, Packet Domain service means IMS messaging on EPS bearers and Circuit
Switched service means transmission on Signalling Gateways.
8.12. +CSODCP Command: Send Originating Data

via the Control Plane
HL78xx
Test command
Syntax Response
AT+CSODCP=? +CSODCP: (range of supported <cid>s),(maximum number of octets of user data
indicated by <cpdata_length>),(list of supported <RAI>s),(list of supported
<type_of_user_data>s)
OK
Write command
Syntax Response
AT+CSODCP= OK
<cid>,
<cpdata_length>,
or
<cpdata>[,<RAI>
[,<type_of_user_ +CME ERROR: <err>
data>]]
Parameters
<cid> Integer type. A numeric parameter which specifies a particular PDP context or
EPS bearer context definition. This parameter is local to the TE-MT interface and
identifies the PDP or EPS bearer contexts which have been setup via AT command (see
the +CGDCONT and +CGDSCONT commands).
<cpdata_length> Integer type. Indicates the number of octets of the <cpdata>

information element. When there is no data to transmit, the value is zero.
<cpdata> String of octets. Contains the user data container contents (refer to 3GPP
TS 24.301 [83] subclause 9.9.4.24). When there is no data to transmit, <cpdata> should
be an empty string (""). This parameter is not subject to conventional character
conversion as per +CSCS.
<RAI> Integer type. Indicates the value of the release assistance indication; refer to
3GPP TS 24.301 [83] subclause 9.9.4.25.
0 No information available
1 The MT expects that exchange of data will be completed with the transmission of
the ESM DATA TRANSPORT message.
2 The MT expects that exchange of data will be completed with the receipt of an
ESM DATA TRANSPORT message.
41111821 Rev 12 August 04, 2020 149

HL78xx
<type_of_user_data> Integer type. Indicates whether the user data that is

transmitted is regular or exceptional
0 Regular data
1 Exception data
Reference Notes
27.007 Rev14 The set command is used by the TE to transmit data over the control plane to the
network via MT. Context identifier <cid> is used to link the data to a particular context.
8.13. +CRTDCP Command: Report Terminating

Data via the Control Plane
HL78xx
Test command
Syntax Response
AT+CRTDCP=? +CRTDCP: (list of supported <reporting>s),(range of supported <cid>s),(maximum
number of octets of user data indicated by <cpdata_length>)
OK
Read command
Syntax Response
AT+CRTDCP? +CRTDCP: <reporting>
OK
Write command
Syntax Response
AT+CRTDCP= OK
[<reporting>]
or
+CME ERROR: <err>
Parameters
<reporting> Integer type; controls reporting of mobile terminated control plane data
events
0 Disable reporting of MT control plane data.
1 Enable reporting of MT control plane data by the unsolicited result code
+CRTDCP
<cid> Integer type. A numeric parameter which specifies a particular PDP context or
EPS bearer context definition. This parameter is local to the TE-MT interface and
identifies the PDP or EPS bearer contexts which have been setup via AT command (see
the +CGDCONT and +CGDSCONT commands).
<cpdata_length> Integer type. Indicates the number of octets of the <cpdata>

information element. When there is no data to transmit, the value is zero.
<cpdata> String of octets. Contains the user data container contents (refer to 3GPP
TS 24.301 [83] subclause 9.9.4.24). When there is no data to transmit, the <cpdata>
should be an empty string (""). This parameter is not subject to conventional character
conversion as per +CSCS.
41111821 Rev 12 August 04, 2020 150

HL78xx
Reference Notes
27.007 Rev14 The write command is used to enable and disable reporting of data from the network to
the MT that is transmitted via the control plane in downlink direction. If reporting is
enabled, the MT returns the following unsolicited result code when data is received from
the network: +CRTDCP: <cid>,<cpdata_length>,<cpdata>.
8.14. +KNMPSD Command: No More PS Data

HL78xx
Write command
Syntax Response
AT+KNMPSD OK
Parameters
None
Notes
• Command indicates to the module that there is no more data to transmit or
receive.
• Important: This command should be used only when there is no more data
expected to transmit or receive. Otherwise, additional signaling will be required
to reestablish the radio connection and additional power will be consumed.
• This command brings the LTE RRC layer to the Idle state immediately, rather
than waiting for a network-controlled timeout (typically 10 – 20 seconds).
41111821 Rev 12 August 04, 2020 151

9. Protocol Specific Commands
9.1. Preliminary Comments

Sierra Wireless has developed a set of proprietary AT Commands to simplify data exchanges with the
following protocols:
• TCP
• UDP
• HTTP
• FTP
9.2. IP Address Format in AT Commands

Unless specified elsewhere, the following format is used for IP address field in AT commands
described in this chapter when using the HL78xx embedded module:
• IPv4 address: Consists of dot-separated decimal (0 – 255) parameters of the form
a1.a2.a3.a4
• IPv6 address: Consists of colon-separated hexadecimal (0 – FFFF) parameters of the form
a1:a2:a3:a4:a5:a6:a7:a8 with abbreviations
9.3. Session ID
Protocol specific AT commands share the same range of session IDs. A session ID, <session_id>, is
a unique number and ranges from 1 to 6.
9.4. Connection of PDP Contexts

A PDP connection will be started when a session becomes active (e.g. +KTCPCNX) and will only be
stopped if all sessions are closed or all sessions request to stop the connection. In case of session
errors, the PDP connection deactivation behavior can be configured by +KIPOPT with <option_id>=3.
The default setting after the module boot-up is that a PDP connection is requested to stop only when
a session is closed by an Internet AT command (e.g. +KTCPCLOSE).
When a PDP context is active, the configuration of +KCNXCFG must be consistent with the configuration
of +CGDCONT; otherwise, an error will be returned when creating a connection with +KCNXUP, +KTCPCNX
or +KUDPCFG. Therefore, with an active PDP context, in +KCNXCFG:
• <af> must be consistent with +CGDCONT <PDP_type>, and
• <APN> must be identical to +CGDCONT <APN> or must be set to the empty string “”.
41111821 Rev 12 August 04, 2020 152

AT Commands Interface Guide Protocol Specific Commands
9.5. Buffer Length of AT Commands

In AT command mode, the maximum length of an AT command is 1023 characters; any AT command
input longer than this limit will produce an error response. If the maximum length of a parameter is not
specified in this manual, it may vary but still bound by this limit.
In AT data mode, the terminal receive buffer size is limited to 32000 bytes; the terminal driver will stop
the receive flow at 16000 bytes if hardware handshaking is used.
9.6. Parameter Format of AT Commands

Double quotation marks are optional in the parameter input of protocol specific AT commands.
If the AT command does not meet the following conditions, the AT parser will regard it as an error and
will not go to the corresponding AT command handler. It will immediately return +CME ERROR: 3.
This means that it will not process any action further or return any specific error code.
• If double quotation marks are used to enclose parameters, double quotation marks must
appear at both the head and tail of the parameter.
• The total number of parameter input (including empty parameters) in the AT commands must
be within the minimum and maximum required number of parameters.
9.7. Connection Configuration
9.7.1. +KCNXCFG Command: GPRS Connection

Configuration
HL78xx
Test command
Syntax Response
AT+KCNXCFG=? +KCNXCFG: (list of possible <cnx conf>s),"GPRS",(range of possible length of
<apn>),(range of possible length of <login>),(range of possible length of <password>),
<af>,<ip>,<dns1>,<dns2>,<ip_v6>,<dns1_v6>,<dns2_v6>
OK
Read command
Syntax Response
AT+KCNXCFG? +KCNXCFG: <cnx cnf>, "GPRS", <apn>,<login>,<password>,<af>,<ip>,<dns1>,
<dns2>[,<ip_v6>,<dns1_v6>,<dns2_v6>],<state>
[...]>
OK
41111821 Rev 12 August 04, 2020 153

HL78xx
Write command
Syntax Response
AT+KCNXCFG= OK
<cnx cnf>,
"GPRS",<apn> Parameters
[,[<login>]
[,[<password>] <cnx cnf> PDP context configuration. Numeric parameter which specifies a particular
[,<af> [,[<ip>] PDP context configuration
[,[<dns1>]
[,<dns2>]]]] <apn> (Access Point Name) a string parameter (max size 63 bytes), logical name
[,[<ip_v6>] used to select the GGSN or the external packet data network.
[,[<dns1_v6>]
[,<dns2_v6>]]]]]] <login> string type (max size 24 bytes), indicates the username of the cnx
<password> string type (max size 24 bytes), indicates the password of the cnx
<af> Address family used for the connection (up to 3GPP Release 7 compliant)
IPV4 IPv4 only
IPV6 IPv6 only
IPV4V6 IPv4 and IPv6
<ip> String type. Static IP not supported only dynamic address supported, the value
should be “0.0.0.0” or an empty string.
<dns1>, <dns2> String type. If the mobile is supposed to work with dynamic DNS
addresses, the value should be “0.0.0.0” or an empty string.
<ip_v6> IPV6 String type. If the mobile is supposed to work with a dynamic
address, the value should be “::” or an empty string.
<dns1_v6>, <dns2_v6> IPV6 String type. If the mobile is supposed to work with
dynamic DNS addresses, the value should be “::” or an empty string.
<state> Connection state

0 Disconnected
1 Connecting
2 Connected
3 Idle, down counting for disconnection
4 Disconnecting
41111821 Rev 12 August 04, 2020 154

HL78xx
Reference Notes
Sierra Wireless • <ip> IP static not supported
Proprietary • This AT command is used to configure the bearer to be used for the future IP
services.
• By default, the IP and DNS address are dynamic (those values would be
affected by the network during the PDP connection).
• This connection will be used by the module to access to the IP services
described in subsequent chapters. AT+KCNXCFG is only defined to set the
current parameters. The defined connection will be automatically opened when
needed by the IP services (e.g. UDP service).
• The use of IPV4 and/or IPV6 addresses is configured by PDP context
configuration.
• <cnx cfg> values correspond to PDP context ID.
• When the connection is up, the read command returns the actual values used
by the connection interface.
• If reuse of existing activated PDP context is required, <apn> can be set as an
empty string or as the existing APN string returned by +CGDCONT read
command.
• Settings are only restored if the TCP server or UDP server is restored.
9.7.2. +KCNXTIMER Command: Connection Timer

Configuration
HL78xx
Test command
Syntax Response
AT+KCNXTIMER +KCNXTIMER: (list of supported <cnx cnf>s),(list of supported <tim1>s),(list of
=? supported <nbtrial>s),(list of supported <tim2>s) ,(list of supported <idletime>s)
OK
Read command
Syntax Response
AT+KCNXTIMER +KCNXTIMER: <cnx cnf>,<tim1>,<nbtrial>,<tim2>,<idletime>
? […]
OK
41111821 Rev 12 August 04, 2020 155

HL78xx
Write command
Syntax Response
AT+KCNXTIMER OK
=<cnx cnf>[,
[<tim1>][, Parameters
[<nbrtrial>]
[,<tim2>] <cnx cnf> PDP context configuration. Numeric parameter which specifies a particular
[,<idletime>]]]] PDP context configuration
<tim1> 1 – 120 s (30 s by default) If the module fails to activate the PDP context,
a timer of <tim1> will be started. When this timer expires, it will try to activate the PDP
context again.
<nbtrial> Attempt times from1 – 4 (2 by default). The module will try to activate the
PDP context for a maximum of <nbtrial> times.
<tim2> 0 – 300s (60 s by default)

0 Deactivated (connection will not close by itself)
For client sockets, module will try to connect to the server within <tim2>s; if <tim2>
expires, it will give up the connection.
<idletime> 0 – 1800 s (30 s by default) When all sessions are closed, the idle timer
starts with the idle time. When this timer expires, it will try to deactivate the PDP context.
Before the timer expires, connecting any session will stop this timer and the PDP context
is reused.
Reference Notes
Sierra Wireless This command will only have impact on TCP and UDP.
Proprietary
9.7.3. +KCNXPROFILE Command: Current Profile

Connection Configuration
HL78xx
Test command
Syntax Response
AT+ +KCNXPROFILE: (list of possible <cnx cnf>s)
KCNXPROFILE OK
=?
Read command
Syntax Response
AT+ +KCNXPROFILE: <cnx cnf>
KCNXPROFILE? OK
41111821 Rev 12 August 04, 2020 156

HL78xx
Write command
Syntax Response
AT+ OK
KCNXPROFILE=
<cnx cnf> Parameter
<cnx cnf> PDP context configuration. Numeric parameter which specifies a particular
PDP context configuration
Reference Notes
Sierra Wireless This command sets the default PDP context configuration ID for +KTCPCFG and
Proprietary +KUDPCFG, if <cnx cnf> parameter is not given in these commands.
9.7.4. +KCGPADDR Command: Display PDP Address
HL78xx
Test command
Syntax Response
AT+KCGPADDR +KCGPADDR: (list of possible <cnx_cnf>s)
=? OK
Write command
Syntax Response
For all +KCGPADDR: <cnx cnf>, <PDP_addr_1>
<cnx_cnf>s: [[+KCGPADDR: <cnx cnf>, <PDP_addr_2>]
AT+KCGPADDR …]
OK
For specific
<cnx_cnf>s: Parameters
AT+KCGPADDR= <cnx cnf> PDP context configuration. Numeric parameter which specifies a particular
<cnx_cnf> PDP context configuration
<PDP_addr> A string that identifies the MT in the address space applicable to the PDP
Reference Notes
Sierra Wireless • This AT command can be used after +KTCPCNX, +KUDPCFG, etc. to display the
Proprietary local IP address of the module
• For IPv6, more than one PDP addresses corresponding to the interface may be
displayed.
41111821 Rev 12 August 04, 2020 157

9.7.5. +KCNX_IND Notification: Connection Status

Notification
HL78xx
Notification +KCNX_IND: <cnx cnf>,<status>,<af> (for <status> = 0, 1)
+KCNX_IND: <cnx cnf>,<status>,<attempt>,<nbtrial>,<tim1> (for <status> = 2)
+KCNX_IND: <cnx cnf>,<status> (for <status> = 3,6)
+KCNX_IND: <cnx cnf>,<status>,<attempt> (for <status> = 4)
+KCNX_IND: <cnx cnf>,<status>,<idletime> (for <status> = 5)
Parameters
PDP context configuration
<status> PDP connection status

0 Disconnected due to network
1 Connected
2 Failed to connect, <tim1> timer is started if <attempt> is less than <nbtrail>
3 Closed
4 Connecting
5 Idle time down counting started for disconnection
6 Idle time down counting canceled
<af> 0 IPV4
1 IPV6
<tim1> Refer to +KCNXTIMER
<attempt> Current attempt of bringing up of PDP connection
<nbtrial> Refer to +KCNXTIMER
<idletime> Refer to +KCNXTIMER

Reference Sierra Wireless Proprietary
9.7.6. +KCNXUP Command: Bring the PDP Connection

Up
HL78xx
Test command
Syntax Response
AT+KCNXUP=? +KCNXUP: (list of possible <cnx_cnf>s)
OK
41111821 Rev 12 August 04, 2020 158

9.8. Common Configuration
9.8.1. +KPATTERN Command: Custom End of Data

Pattern
HL78xx
Test command
Syntax Response
AT+KPATTERN OK
=?
Read command
Syntax Response
AT+KPATTERN? +KPATTERN: <EOF pattern>
OK
Write command
Syntax Response
AT+KPATTERN OK
=<EOF pattern>
or
+CME ERROR <err>
Parameter
<EOF pattern> String type (max size 128 bytes). This is a pattern used to notify the
end of data (or file) during data or file transfer. This string doesn’t have to be human-
readable (not printable characters are allowed).
Reference Notes
Sierra Wireless • The default value of the pattern is: "--EOF--Pattern--".
Proprietary • It is the responsibility of the user to select an appropriate pattern according to
the data transferred (i.e. numeric pattern for text files and Readable string for
binary files).
• The <EOF pattern> pattern is detected within 100ms or higher timeout. The
timeout value is equal to <wait_time> of +KIPOPT.
• The received data is stored with buffer size <send size v4> or <send size v6>
so that the <EOF pattern> with size larger than it is not detected. The user
application should ensure that the value of <send size v4> or <send size v6> is
larger than the size of <EOF pattern>.
41111821 Rev 12 August 04, 2020 160

9.8.2. +KURCCFG Command: Enable or Disable the URC

from Protocol Commands
HL78xx
Test command
Syntax Response
AT+KURCCFG=? +KURCCFG: (list of supported <protoopt>s),(list of supported <noti_act>s),(list of
supported <indi_act>s)
OK
Read command
Syntax Response
AT+KURCCFG? +KURCCFG: list of supported (<protoopt>,<noti_act>,<indi_act>)
OK
Write command
Syntax Response
AT+KURCCFG= OK
<protoopt>,
<noti_act> Parameters
[,<indi_act>]
<protoopt> Protocol option to enable/disable URC
"TCPC" TCP client session
"TCPS" TCP server session
"UDPC" UDP client session
"UDPS" UDP server session
“FTP” FTP client session
“HTTP” HTTP client session
“HTTPS” HTTPS client session
"TCP" Both TCP client and TCP server sessions
"UDP" Both UDP client and UDP server sessions
<noti_act> 1 Enable URC (like +KTCP_NOTIF)

0 Disable URC
<indi_act> 1 Enable URC (like +KTCP_SRVREQ, +KTCP_IND, +KTCP_DATA,

+KUDP_DATA, +KUDP_RCV, +KFTP_IND)
0 Disable URC
Reference Notes
Sierra Wireless • Enabling or disabling +KTCP_NOTIF unsolicited messages is only useful when
Proprietary in polling mode with +KTCPSTAT.
• If set to "disable", URCs are discarded and not stored.
• Can be used in 07.10 multiplexer.
Examples To disable URC:
AT+KURCCFG=“TCP”,0
OK
Test and read command:

AT+KURCCFG=?
+KURCCFG:
("TCPC","TCPS","UDPC","UDPS","FTP","HTTP","HTTPS","TCP","UDP"),(0,-1),
(0-1)
OK
41111821 Rev 12 August 04, 2020 161

HL78xx
AT+KURCCFG?
+KURCCFG: "TCPC",1,1
+KURCCFG: "TCPS",1,1
+KURCCFG: "UDPC",1,1
+KURCCFG: "UDPS",1,1
+KURCCFG: "FTP",1,1
+KURCCFG: "HTTP",1,1
+KURCCFG: "HTTPS",1,1
OK
9.8.3. +KIPOPT Command: General Options

Configuration
HL78xx
Test command
Syntax Response
AT+KIPOPT=? +KIPOPT: 0,<UDP>,(1-100),(8-1472),(8-1452)
+KIPOPT: 0,<TCP-based>,(0-100),(0,8-1460),(0,8-1440)
+KIPOPT: 3,(0-1),(0-1)
OK
Read command
Syntax Response
AT+KIPOPT? +KIPOPT: 0,<proto>,<wait time>,<send size v4>,<send size v6>]
[...]
+KIPOPT: 3,<stop_on_error>, <stop_on_peer>
OK
Write command
Syntax Response
If <option_id>=0 OK
AT+KIPOPT=
<option_id>, or
<proto>,<wait +CME ERROR<err>
time>
[,<send size v4>
[,<send size Parameters
v6>]] <option_id> Option ID
0 Wait time, send size threshold configuration
If <option_id>=1 1 Internal use or compatibility purposes
AT+KIPOPT= 2 Internal use or compatibility purposes
<option_id> 3 PDP connection deactivated behavior
4 Internal use or compatibility purposes
If <option_id>=2
AT+KIPOPT= <proto> Protocol, string type
<option_id> “TCPC” TCP client session
“TCPS” TCP server session
“UDPC” UDP client session
41111821 Rev 12 August 04, 2020 162

HL78xx
If <option_id>=3 “UDPS” UDP server session

AT+KIPOPT= “FTP” FTP client session
<option_id>, “HTTP” HTTP client session
<stop_on_error>, “HTTPS” HTTPS client session
<stop_on_peer>
“TCP” Both client and server TCP sessions
“UDP” Both client and server UDP sessions
If<option_id>=4
AT+KIPOPT=
<option_id>, <wait time> Timeout for configuring the packet segmentation on the IP network side; it
<ssl_ver> specifies the timeout after which the buffered data will be sent to the peer irrespective of
data packet size. Value is in 100 ms units.
Range:
For UDP: 1 – 100, default value = 2
For TCP: 0 – 100, default value = 1. Note that value = 0 has the same effect as having
value = 1 due to the limitation from +KPATTERN detection timing
<send size v4> Data packet size for IPv4 sessions. This parameter specifies the
minimum data packet size that needs to be sent to the peer.
Range:
For TCP: 0, 8 – 1460, default value = 0 (disabled)
<send size v6> Data packet size for IPv6 sessions. This parameter specifies the
minimum data packet size that needs to be sent to the peer.
Range:
For TCP: 0, 8 – 1440, default value = 0 (disabled). Note that value = 0 uses a wait time
of 100 ms.
<stop_on_error> PDP connection deactivation behavior when a session is closed

due to any error
0 Do not request to stop the connection
1 Request to stop the connection
<stop_on_peer> PDP connection deactivation behavior when a session is closed by

a peer/server
0 Do not request to stop the connection
1 Request to stop the connection
Reference Notes
Sierra Wireless • The default setting of <option_id>=3 is (<stop_on_error>=0,
Proprietary <stop_on_peer>=0) after module boot-up; this means that a PDP connection is
requested to stop only when a session is closed by an Internet AT command
(e.g. +KTCPCLOSE).
• Thresholds <send size v4> and <send size v6> control the minimum size of
data received from the AT terminal to be buffered within timeout <wait time>.
When the threshold is reached or after timeout, the buffered data are sent to
the socket layer for transmission.
For UDP: data is sent as a UDP packet
For TCP based protocol: data is copied to socket first-in-first-out buffer
for transmission, but packet segmentation is
not guaranteed to be <send size>
• The range for <send_size_v4> and <send_size_v6> are given for a maximum
transmission unit (MTU) of 1500 bytes, but the network operator can set a lower
value. In this case the upper limit of the minimum data packet size will be the
one set by the operator. For instance, on the Telstra network, MTU is 1358 so
max <send_size_v4> for TCP is 1318.
• <send size v4> and <send size v6> impacts the detection of <EOF pattern>.
Refer to the notes of +KPATTERN for more information.
41111821 Rev 12 August 04, 2020 163

9.9. SSL Configuration
9.9.1. +KSSLCRYPTO Command: Cipher Suite

Configuration
HL78xx
Test command
Syntax Response
AT+ +KSSLCRYPTO: <profile_id>,<mkey_Algo>,<auth_algo>,<enc_algo>,<mac_algo>,
KSSLCRYPTO=? <tls_ver>,<auth>,<root_cert_idx>
OK
Read command
Syntax Response
AT+ +KSSLCRYPTO: <profile_id>,<mkey_algo>,<auth_algo>,<enc_algo>,<mac_algo>,
KSSLCRYPTO? <tls_ver>,<auth>,<root_cert_idx>
[…]]
OK
Write command
Syntax Response
AT+ OK
KSSLCRYPTO=
<profile_id>, Parameters
<mkey_Algo>,
<auth_algo>, <profile_id> Index of a set of parameters for configuring one SSL profile
<enc_algo>,
<mac_algo>, <mkey_algo> Key exchange algorithm selection
<tls_ver>,<auth>[ 1 RSA
,<root_cert_idx>] 8 ECDHE
<auth_algo> Authentication algorithm selection

1 RSA
2 ECDSA
<enc_algo> Encryption algorithm selection

16 AES-128-CCM
32 AES-256-CCM
64 AES-128-CBC
256 AES-128-CCM-8
512 AES-256-CCM-8
8192 AES-128-GCM
16384 AES-256-GCM
<mac_algo> Message authentication code algorithm selection

0 NULL
4 SHA256
8 SHA384
<tls_ver> Cipher suite version selection.

4 TLS 1.2
41111821 Rev 12 August 04, 2020 164

HL78xx
<auth> Authentication
1 Authenticate server (Default)
3 Mutual authentication
<root_cert_idx > Root certificate index

0 – 3 Stored root certificate index
Refer to the following table for the list of cipher suites supported by the AirPrime HL78xx.
Table 3. Supported Cipher Suites
NIST Name <mkey_algo> <auth_algo> <enc_algo> <mac_algo>
TLS-RSA-WITH-AES-128-GCM-
RSA RSA AES-128-GCM SHA256
SHA256
TLS-RSA-WITH-AES-256-GCM-
RSA RSA AES-256-GCM SHA384
SHA384
TLS-RSA-WITH-AES-128-CCM RSA RSA AES-128-CCM NULL
TLS-RSA-WITH-AES-256-CCM RSA RSA AES-256-CCM NULL
TLS-RSA-WITH-AES-128-CCM-8 RSA RSA AES-128-CCM-8 NULL
TLS-RSA-WITH-AES-256-CCM-8 RSA RSA AES-256-CCM-8 NULL
TLS-ECDHE-RSA-WITH-AES-128-
ECDHE RSA AES-128-CBC SHA256
CBC-SHA256
TLS-ECDHE-RSA-WITH-AES-128-
ECDHE RSA AES-128-GCM SHA256
GCM-SHA256
TLS-ECDHE-ECDSA-WITH-AES-
ECDHE ECDSA AES-128-CBC SHA256
128-CBC-SHA256
ECDHE ECDSA AES-128-GCM SHA256
128-GCM-SHA256
ECDHE ECDSA AES-256-GCM SHA384
256-GCM-SHA384
ECDHE ECDSA AES-128-CCM NULL
128-CCM
ECDHE ECDSA AES-256-CCM NULL
256-CCM
ECDHE ECDSA AES-128-CCM-8 NULL
128-CCM-8
ECDHE ECDSA AES-256-CCM-8 NULL
256-CCM-8
41111821 Rev 12 August 04, 2020 165

9.9.2. +KSSLCFG Command: SSL Configuration
HL78xx
Test command
Syntax Response
AT+KSSLCFG=? +KSSLCFG: <option id>,<option>
OK
Read command
Syntax Response
AT+KSSLCFG? +KSSLCFG: 0,<TLS Version>
+KSSLCFG: 2,<Session Mode>
OK
Write command
Syntax Response
AT+KSSLCFG If <option_id> = 0:
=<option id>, AT+KSSLCFG=<option_id>,<TLS Version>
<option> OK
If <option_id> = 1:
AT+KSSLCFG=<option_id>,<Random Seed>
OK
If <option_id> = 2:
AT+KSSLCFG=<option_id>,<Session Mode>
OK
Parameters
<option id> 0 Specify a TLS version to be used for hand shake
1 Setup random seed
2 Specify session mode
<TLS Version> 0 Highest possible

3 TLS 1.2
<Random Seed> String to be added into the entropy of the random number
generator
<Session Mode> 0 Automatic

1 Always start a new session (not supported)
41111821 Rev 12 August 04, 2020 166

9.10. SSL Certificate Manager
9.10.1. +KCERTSTORE Command: Store Root CA and

Local Certificates to Internal Storage
HL78xx
Test command
Syntax Response
AT+ +KCERTSTORE: (list of possible <data_type>s),(range of possible lengths of
KCERTSTORE=? <NbData>),(list of possible <index>es)
OK
Read command
Syntax Response
AT+ CONNECT
KCERTSTORE? [root_cert,<index>,<NbData><CR><LF>
<File_data><CR><LF>]
[local_cert,<index>,<NbData><CR><LF>
<File_data> <CR><LF>]
[...]
OK
or
+CME ERROR: <err>
Write command
Syntax Response
AT+ CONNECT
KCERTSTORE= OK
<data_type>
[,<NbData>
or
[,<index>]]
+CME ERROR: <err>
Parameters
<data_type> 0 Root certificate
1 Local certificate
<NbData> 1 – 4096 Number of bytes to read/write
<index> Stored root/local certificate index. If a root/local certificate is already

stored at the index, it will be overloaded
Value range:
0 – 3 If <data_type> = 0
<File_data> File data in bytes
41111821 Rev 12 August 04, 2020 167

HL78xx
Reference Notes
Sierra Wireless • The <index> parameter is the link between a local certificate and a private key
Proprietary (refer to +KPRIVKSTORE and +KCERTDELETE for more information).
• The data session is automatically ended when <ndata> data bytes are
sent/received, and the module returns to command state and returns OK.
• The data session can also be ended by <EOF pattern>, +++ or DTR.
• ATO is not available for this command.
• It is highly recommended to configure the module for hardware flow control
before using this command.
9.10.2. +KPRIVKSTORE Command: Store Private Key

Associated to a Local Certificate
HL78xx
Test command
Syntax Response
AT+ +KPRIVKSTORE: (list of possible <index>s),( range of possible lengths of <NbData>)
KPRIVKSTORE OK
=?
Read command
Syntax Response
AT+ CONNECT
KPRIVKSTORE? private_key,<index>,<NbData><CR><LF>
<File_data> <CR><LF>
OK
or
+CME ERROR: <err>
Write command
Syntax Response
AT+ CONNECT
KPRIVKSTORE= OK
<index>
[,<NbData>]
or
+CME ERROR: <err>
Parameters
<index> 0 – 2 Index of the stored local certificate associated to this private key
<NbData> 1 – 4096 Number of bytes to read/write (mandatory for both reading

and writing)
<File_data> File data in bytes
41111821 Rev 12 August 04, 2020 168

HL78xx
Reference Notes
Sierra Wireless • The data session is automatically ended when <ndata> data bytes are
Proprietary sent/received, and the module returns to command state and returns OK.
before using this command.
9.10.3. +KCERTDELETE Command: Delete Local

Certificate from the Index
HL78xx
Test command
Syntax Response
AT+ +KCERTDELETE: (list of possible <data_type>s),(list of possible <index>s)
KCERTDELETE OK
=?
Read command
Syntax Response
AT+ +KCERTDELETE:
KCERTDELETE? OK
or
+CME ERROR: <err>
Write command
Syntax Response
AT+ OK
KCERTDELETE=
<data_type> or
[,<index>]
+CME ERROR: <err>
Parameters
<data_type> 0 Root certificate
1 Local certificate
<index> Stored root/local certificate index

Value range:
41111821 Rev 12 August 04, 2020 169

9.10.4. +KPRIVKDELETE Command: Delete Private Key

from the Index
HL78xx
Test command
Syntax Response
AT+ +KPRIVKDELETE: (list of possible <index>es)
KPRIVKDELETE
OK
=?
Write command
Syntax Response
AT+ OK
KPRIVKDELETE=
<index>
or
+CME ERROR: <err>
Parameter
<index> 0 – 2 Stored private key index
9.11. TCP Specific Commands
9.11.1. +KTCPCFG Command: TCP Connection

Configuration
HL78xx
Test command
Syntax Response
AT+KTCPCFG=? +KTCPCFG: (list of possible <cnx_cnf>s),(list of possible <mode>s),
<remote-name/ip>,(list of possible <tcp_port >s),(list of possible <source_port>s),(list
of possible <data_mode>s),(list of possible <URC-ENDTCP-enable>s),(list of possible
<af>s),<cipher_index>,(list of possible <restore_on_boot>s)
OK
Read command
Syntax Response
AT+KTCPCFG? +KTCPCFG: <session_id>,<status>,<cnx cnf>,<mode>[,<serverID>],
<tcp remote address>,<tcp_port>[,<source_port>],<data_mode>,
<URC-ENDTCP-enable>,<af>,<cipher_index>[,<restore_on_boot>]
[…]]
Write command
Syntax Response
AT+KTCPCFG= +KTCPCFG: <session_id>
[<cnx cnf>], OK
<mode>,
41111821 Rev 12 August 04, 2020 170

HL78xx
[<tcp remote
address>],<tcp_ Parameters
port>[,[<source_ <cnx cnf> Index of a set of parameters for configuring one TCP session (see
port>][,[<data_ +KCNXCFG)
mode>][,[<URC-
ENDTCP- <session_id> TCP session index
enable>][,[<af>][,
[<cipher_suite>]
[,[<restore_on_ <mode> 0 Client
boot>]]]]]]]] 1 Server
2 Child (generated by server sockets)
3 Secure client
<tcp remote address> IP address string or explicit name of the remote server.
Maximum length – 127 characters. For server configuration, this parameter is left blank
<tcp_port> TCP port number; numeric parameter with range 1 – 65535. This
parameter is the listening port for a server configuration.
<status> Connection state of the selected socket

0 Disconnected
1 Connected
<serverID> Server session ID index. Only for sockets in Child mode
<source_port> Numeric parameter (0-65535). Specifies the local TCP port

number. This parameter is left blank for a server configuration.
<data_mode> 0 Do not display <data> in URC (default setting)

1 Display <data> in URC (not supported)
<URC-ENDTCP-enable> 0 Do not display URC +KTCP_ACK

1 Display URC +KTCP_ACK
<af> Address family used for the connection.
0 IPV4
1 IPV6
<cipher_index> Cipher suite profile index to use for a secured socket; defined by
+KSSLCRYPTO
<restore_on_boot> Restore session on boot

0 Session is not restored on boot
1 Session is restored on boot
41111821 Rev 12 August 04, 2020 171

HL78xx
Reference Notes
Sierra Wireless • Maximum <session_id> is 6.
Proprietary • If the socket is defined as a <CLIENT> socket, <tcp_port> and <tcp remote
address> define the port and the IP address of the remote server we want to
connect.
• <URC_ENDTCP-enable> is not available for secure clients (secure clients will
not show the +KTCP_ACK URC).
• For child session, the property <data_mode> will be kept the same as the
server socket’s setting.
• This command can be used before setting up +KCNXCFG. Note however that
the latter is required to start the connection properly.
• The connection timeout for TCP socket is about 9 seconds with 3
retransmissions with 3 seconds delay.
• For <restore_on_boot>, only the first session is restored.
• For a restored client session (e.g. after a reset or exiting hibernation),
+KTCPCNX must be used to establish a connection before sending/receiving
any data.
9.11.2. +KTCPCNX Command: Start TCP Connection
HL78xx
Test command
Syntax Response
AT+KTCPCNX=? +KTCPCNX: (list of possible <session_id>s)
OK
41111821 Rev 12 August 04, 2020 172

HL78xx
Write command
Syntax Response
AT+KTCPCNX= OK
<session_id>
or
+CME ERROR: <err>
+KTCP_NOTIF: <session_id>, <tcp_notif>
Parameters
<session_id> TCP session index
<tcp_notif> Integer type. Indicates the cause of the TCP connection failure
0 Network error
1 No more sockets available; max. number already reached
2 Memory problem
3 DNS error
4 TCP disconnection by the server or remote client
5 TCP connection error
6 Generic error
7 Fail to accept client request’s
8 Data sending is OK but +KTCPSND was waiting for more or less characters
9 Bad session ID
10 Session is already running
11 All sessions are used
12 Socket connection timeout error
13 SSL connection error
14 SSL initialization error
Reference Notes
Sierra Wireless • This command is used for connecting to a remote server or listening to a bound
Proprietary port, depending on the selected mode of <session_id>.
• The socket connection will not be requested when the concerned PDP is active
and the configuration of +KCNXCFG is not the same as +CGDCONT.
9.11.3. +KTCPRCV Command: Receive Data through a

TCP Connection
HL78xx
Test command
Syntax Response
AT+KTCPRCV=? +KTCPRCV: (list of possible <session_id>s),(list of possible <ndata>s)
OK
Write command
Syntax Response
AT+KTCPRCV= CONNECT
<session_id>, …<EOF pattern>
<ndata> OK
41111821 Rev 12 August 04, 2020 173

HL78xx
or
+KTCP_NOTIF: <session_id>,<tcp_notif>
Parameters
<ndata> Number of bytes the device wants to receive (max value 4294967295)
<tcp_notif> See command AT+KTCPCNX

Reference Notes
Sierra Wireless • This function is used to receive <ndata> data bytes through a previously
Proprietary opened TCP socket.
• <ndata> indicates the max data number that the terminal wishes to receive. If
the TCP socket contains more data than <ndata> bytes then only <ndata>
bytes will be received. If the TCP socket contains less data than <ndata> bytes
then only TCP socket’s data will be received.
• <EOF pattern> would be added at the end of data automatically.
• When <ndata> (max value) bytes or only available data in the TCP socket have
been received, the module returns to command state and returns OK.
using AT&K3 before using this command.
• Refer to AT&D for the behavior of DTR drop.
9.11.4. +KTCPSND Command: Send Data through a TCP

Connection
HL78xx
Test command
Syntax Response
AT+KTCPSND=? +KTCPSND: (list of possible <session_id>s),(list of possible <ndata>s)
OK
Write command
Syntax Response
AT+KTCPSND= CONNECT
<session_id>, OK
<ndata>
or
NO CARRIER
+CME ERROR: <err>
+KTCP_NOTIF: <session_id>,<tcp_notif>
Parameters
<ndata> Number of bytes (max value = 4294967295)
<tcp_notif> See command AT+KTCPCNX
41111821 Rev 12 August 04, 2020 174

HL78xx
Reference Notes
Sierra Wireless • All the data will be sent out ignoring <ndata>. If data sent is not equal to
Proprietary <ndata> then +KTCP_NOTIF will be displayed.
• <ndata> is the data size without <EOF pattern>.
• The data session can be ended by <EOF pattern>, +++ or DTR.
• The +KTCP_ACK URC appears when the data session is ended by
<EOF pattern> or by +++.
9.11.5. +KTCPCLOSE Command: Close Current TCP

Operation
HL78xx
Test command
Syntax Response
AT+KTCPCLOSE +KTCPCLOSE: (list of possible <session_id>s), (list of possible <closing_type>s)
=? OK
Write command
Syntax Response
AT+KTCPCLOSE OK
=<session_id>
[,<closing_type>] or
+CME ERROR: <err>
NO CARRIER
+KTCP_NOTIF: <session_id>, <tcp_notif>
Parameters
<closing_type> 1 The TCP connection is properly closed, which means that

data sent to the module by AT+KTCPSND will be sent to
the TCP server and acknowledged before the socket is
closed.
<tcp_notif> See AT+KTCPCNX

Reference Notes
Sierra Wireless • This function first closes the TCP socket and if there is no other session running
Proprietary then the PDP context is released.
• AT+KTCPDEL=<session_id> can be used to delete the socket configuration
after it’s been closed.
41111821 Rev 12 August 04, 2020 175

9.11.6. +KTCPDEL Command: Delete a Configured TCP

Session
HL78xx
Test command
Syntax Response
AT+KTCPDEL=? +KTCPDEL: (list of possible <session_id>s)
OK
Write command
Syntax Response
AT+KTCPDEL= OK
<session_id>
or
+CME ERROR: <err>
Parameter
Reference Notes
Sierra Wireless The session must be closed (using +KTCPCLOSE) before using this command.
Proprietary
9.11.7. +KTCP_SRVREQ Notification: Incoming Client

Connection Request
HL78xx
Notification +KTCP_SRVREQ: <session_id>,<subsession_id>,<client_ip>,<client_port>
Parameters
<subsession_id> Newly created TCP session index
<client_ip> IP address string of the incoming socket
<client_port> Numeric parameter (0-65535); port of the incoming client

Examples Configure the module to TCP servers
AT+KCNXCFG=0,"GPRS","szsjmc.gd";
+KTCPCFG=0,1,,179
+KTCPCFG: 1
OK
AT+KCNXCFG=0,"GPRS","szsjmc.gd";
+KTCPCFG=0,1,,180
+KTCPCFG: 2
OK
41111821 Rev 12 August 04, 2020 176

HL78xx
Start the TCP servers

AT+KTCPCNX=1 //listen on port 179
OK
AT+KTCPCNX=2 //listen on port 180

OK
Show the TCP servers’ IP address

AT+KCGPADDR
+KCGPADDR: 0,"192.168.1.49"
OK
//Incoming connection request from remote client, shows ip address and port of remote
//client
+KTCP_SRVREQ: 1,3,"192.168.0.32",4614
//incoming a connection request from “192.168.0.32” via listening port 179, the remote
//port is 4614
+KTCP_SRVREQ: 2,4,"10.10.10.110",4665
//port is 4665
+KTCP_SRVREQ: 2,5,"10.10.10.110",4668
//incoming a connection request from the same ip via the same listening port, the remote
//port is 4668
+KTCP_SRVREQ: 1,6,"192.168.1.117",1739
//port is 1739
+KTCP_NOTIF: 4,4
//the connection of sub session id 4 (on listening port 180) is closed.
+KTCP_SRVREQ: 2,4,"10.10.10.8",4672
//incoming a connection request from “10.10.10.8” via listening port 180, the remote port
//is 4672
Reference Notes
Sierra Wireless • This notification is sent when a client requests a connection to the server. The
Proprietary connection is automatically accepted.
• The created session is driven as any other TCP session with its own session
ID. Use +KTCPSND, +KTCPRCV, +KTCPCLOSE, etc. to provide the service
associated to this TCP server.
• The TCP server corresponding to the session ID is still able to receive
connection requests from other clients. These requests are notified with
+KTCP_SRVREQ.
• The client IP address and port can also be checked using AT+KTCPCFG? after
the client is connected to the TCP server.
41111821 Rev 12 August 04, 2020 177

9.11.8. +KTCP_DATA Notification: Incoming Data through

a TCP Connection
HL78xx
Notification +KTCP_DATA: <session_id>,<ndata available>[,<data>]
Parameters
<ndata available> For <data_mode> = 0, maximum number of bytes to be read in the

TCP receive buffer; for <data_mode> = 1, maximum number of bytes to be read in
<data>
<data> Data in octet. The length of data is specified by <ndata_available>

Reference Notes
Sierra Wireless • As soon as the connection is established, the module can receive data through
Proprietary the TCP socket. This notification is sent when data are available in the receive
buffer.
• This notification is sent for each TCP packet received sequentially; notification
of the following received packet is sent only when the current +KTCP_DATA has
been read with a +KTCP_RCV command.
• When <data_mode> is set to 1, <ndata_available> will range from 1 to 1500 in
the URC. If the user application sends over 1500 bytes of data to the module,
the module will display those data with several URCs.
9.11.9. +KTCP_IND Notification: TCP Status
HL78xx
Notification +KTCP_IND: <session_id>,<status>
Parameters
<status> TCP session status. 1 session is set up and ready for operation
9.11.10. +KTCPSTAT Command: Get TCP Socket Status
HL78xx
Test command
Syntax Response
AT+KTCPSTAT= OK
?
41111821 Rev 12 August 04, 2020 178

HL78xx
Read command
Syntax Response
AT+KTCPSTAT? OK
Write command
Syntax Response
For all TCP +KTCPSTAT: <session_id>,<status>,<tcp_notif>,<rem_data>,<rcv_data>
session IDs: […]
AT+KTCPSTAT OK
or or
AT+KTCPSTAT= +KTCPSTAT: <status>,<tcp_notif>,<rem_data>,<rcv_data>
<session_id> OK
Parameters
<status> TCP socket state

0 Socket not defined, use +KTCPCFG to create a TCP socket
1 Socket is only defined but not used
2 Socket is opening and connecting to the server, cannot be used
3 Connection is up, socket can be used to send/receive data
4 Connection is closing, it cannot be used, wait for status 5
5 Socket is closed
<tcp_notif> -1 if socket/connection is OK, <tcp_notif> if an error has happened (see

AT+KTCPCNX)
<rem_data> Remaining bytes in the socket buffer, waiting to be sent
<rcv_data> Received bytes, can be read with +KTCPRCV command

Reference Notes
Sierra Wireless This command returns +CME ERROR: 910 (Bad Session ID) for undefined
Proprietary <session_id>s.
9.11.11. +KTCPSTART Command: Start a TCP

Connection in Direct Data Flow
HL78xx
Test command
Syntax Response
AT+KTCPSTART OK
=?
Read command
Syntax Response
AT+KTCPSTART OK
?
41111821 Rev 12 August 04, 2020 179

HL78xx
Write command
Syntax Response
AT+KTCPSTART CONNECT
=<session_id> OK
or
+CME ERROR: an error occurs, syntax error
+KTCP_NOTIF: <session_id>,<tcp_notif> : an error occurs
Parameters
<tcp_notif> See AT+KTCPCNX

Reference Notes
Sierra Wireless • This function is used to send and receive data bytes through a TCP socket.
Proprietary • It is highly recommended to configure the module for hardware flow control
• Only one +KTCPSTART session can be used.
• Can be used in 07.10 multiplexer.
• If the session is successfully connected by +KTCPCNX, this command does not
restart the connection and the module directly enters direct data flow.
• The data session can be ended by <EOF pattern>, +++ or DTR.
• The +KTCP_ACK URC appears when the data session is ended by the
<EOF pattern> but not by +++.
• If data session is ended by +++, the +KTCP_ACK parameters <ackdBytes> and
<sentBytes> persist (i.e. are not reset).
9.11.12. +KTCP_ACK Notification: Status Report for Latest

TCP Data Session
HL78xx
Notification +KTCP_ACK: <session_id>,<ackdBytes>,<sentBytes>
Parameters
<ackdBytes> Number of bytes received by remote side of connection
<sentBytes> Number of bytes sent to remote side of connection

Reference Notes
Sierra Wireless • This URC is enabled or disabled by the <URC-ENDTCP-enable> parameter of
Proprietary the +KTCPCFG command. The URC is disabled by default.
41111821 Rev 12 August 04, 2020 180

9.12. UDP Specific Commands
9.12.1. +KUDPCFG Command: UDP Connection

Configuration
HL78xx
Test command
Syntax Response
AT+KUDPCFG=? +KUDPCFG: (list of possible <cnx cnf>s),(list of possible <mode>s),(list of possible
<port>s),(list of possible <data_mode>s),<remote-name/ip>,(list of possible
<udp_port>s),(list of possible <af>s),(list of possible <restore_on_boot>s)
OK
Read command
Syntax Response
AT+KUDPCFG? +KUDPCFG: <session_id>,<cnx cnf>,<mode>,<port>,<data_mode>,<udp remote
address>,<udp_port>,<af>,<restore_on_boot>
[…]
OK
41111821 Rev 12 August 04, 2020 181

HL78xx
Write command
Syntax Response
AT+KUDPCFG= +KUDPCFG: <session_id>
[<cnx cnf>], OK
<mode>[,[<port>]
[,[<data_mode>]
or
[,[<udp remote
address>][,[<udp +CME ERROR: <err>
_port>][,[<af>][, +KUDP_NOTIF: <session_id>, <udp_notif>
[<restore_on_
boot>]]]]]]] Parameters
<session_id> UDP session index
<mode> 0 Client
1 Server
<port> 0 – 65535 Port (0 = random)
PDP context configuration.
<udp_notif> Integer type. Indicates the cause of the UDP connection failure.
0 Network error
1 No more sockets available; max number already reached
2 Memory problem
3 DNS error
5 UDP connection error (host unreachable)
6 Generic error
8 Data sending is OK but +KUDPSND was waiting more or less characters
9 Bad session ID
11 All sessions are used
13 UDP SSL connection error
15 Bad server mode
<data_mode> 0 Do not display <data> in URC (Default setting)

1 Display <data> in URC (not supported)
<udp remote address> IP address string or explicit name of the remote host,
Default is empty (given by +KUDPSND).
<udp_port> 0 – 65535 UDP peer port; given by +KUDPSND
<af> Address family used for the connection.

0 IPV4
1 IPV6
<restore_on_boot> Restore session on boot

0 Session is not restored on boot
1 Session is restored on boot
41111821 Rev 12 August 04, 2020 182

HL78xx
Reference Notes
Sierra Wireless • For UDP socket in server mode, it is bound to a defined port number, incoming
Proprietary connection are notified by +KUDP_DATA. If remote address and port are given,
they are saved for use in +KUDPSND.
• Maximum <session_id> is 6.
• +KCNXCFG configuration should be set up to start the connection properly.
• The socket connection will not be requested when the concerned PDP is active
and the configuration of +KCNXCFG is not the same as +CGDCONT.
• For <restore_on_boot>, only the first session is restored.
9.12.2. +KUDPRCV Command: Receive Data through a

UDP Connection
HL78xx
Test command
Syntax Response
AT+KUDPRCV=? +KUDPRCV: (list of possible <session_id>s),(list of possible <ndata>s)
OK
Write command
Syntax Response
AT+KUDPRCV= CONNECT
<ndata> OK
+KUDP_RCV: <udp remote address>,<udp remote port>
or
NO CARRIER
+CME ERROR: <err>
+KUDP_NOTIF: <session_id>, <udp_notif>
Parameters
<ndata> Number of bytes the device wants to receive (max value 4294967295)
<udp remote address> IP address string of the remote host
<udp remote port> 0 – 65535 Remote UDP port
<udp_notif> See AT+KUDPCFG
41111821 Rev 12 August 04, 2020 183

HL78xx
Reference Notes
Sierra Wireless • This function is used to receive <ndata> data bytes through a previously
Proprietary opened UDP socket.
• <ndata> indicates the max data number that the terminal wishes to receive. If
the UDP socket contains more data than <ndata> bytes, then only <ndata>
bytes will be received, and more data can be read by running this command
again.
• <EOF pattern> would be added at the end of data automatically.
• When <ndata> (max value) bytes or only available data in the UDP socket have
been received, the module returns to command mode.
9.12.3. +KUDPSND Command: Send Data through a UDP

Connection
HL78xx
Test command
Syntax Response
AT+KUDPSND=? +KUDPSND: (list of possible <session_id>s),<remote-name/ip>,(list of possible
<udp_port>s),(list of possible <ndata>s)
OK
Write command
Syntax Response
AT+KUDPSND= CONNECT
<session_id>, OK
<udp remote
address>, or
<udp_port>, NO CARRIER
<ndata>
+CME ERROR: <err>
+KUDP_NOTIF: <session_id>,<udp_notif>
Parameters
<udp remote address> IP address string or explicit name of the remote host
<udp_port> 1 – 65535 UDP peer port
<ndata> Number of bytes (max value 4294967295)
41111821 Rev 12 August 04, 2020 184

HL78xx
Reference Notes
Sierra Wireless • All data will be sent out ignoring <ndata>. If data sent is not equal to <ndata>
Proprietary then +KUDP_NOTIF will be displayed.
• <ndata> is the data size without <EOF pattern>.
• The maximum transmission unit (MTU) is 1500 Bytes.
• The <udp remote address> and <udp_port> are saved internally such that they
can be omitted in subsequent calls of +KUDPSND.
• The packet segmentation is controlled by +KIPOPT with <option_id>=0, and
the maximum UDP packet size is limited by <send size v4> (1472 bytes) or
<send size v6> (1452 bytes). Default value for both parameters is 1020 bytes.
9.12.4. +KUDPCLOSE Command: Close Current UDP

Operation
HL78xx
Test command
Syntax Response
AT+KUDPCLOSE +KUDPCLOSE: (list of possible <session_id>s),(list of possible <keep_cfg>s)
=? OK
Write command
Syntax Response
AT+KUDPCLOSE OK
=<session_id>
[,<keep_cfg>] or
+KUDP_NOTIF: <session_id>, <udp_notif>
Parameters
<keep_cfg> Specifies whether to delete the session configuration after closing it or not
0 Delete the session configuration
1 Keep the session configuration
Reference Notes
Sierra Wireless • This function closes the UDP session. If there is no other session running, the
Proprietary PDP context will be released.
• This function will delete the session configuration if <keep_cfg> = 0.
41111821 Rev 12 August 04, 2020 185

9.12.5. +KUDPDEL Command: Delete a Configured UDP

Session
HL78xx
Test command
Syntax Response
AT+KUDPDEL=? +KUDPDEL: (list of possible <session_id>s)
OK
Write command
Syntax Response
AT+KUDPDEL= OK
<session_id>
or
+CME ERROR: <err>
Parameters
Reference Notes
Sierra Wireless The session must be closed (using +KUDPCLOSE) before using this command.
Proprietary
9.12.6. +KUDP_IND Notification: UDP Status
HL78xx
Notification +KUDP_IND: <session_id>,<status>
Parameters
<status> UDP session status.

1 Session is set up and ready for operation
9.12.7. +KUDP_DATA Notification: Incoming Data through

a UDP Connection
HL78xx
Notification +KUDP_DATA: <session_id>,<ndata available>[,<udp remote address>,<udp
remote port>,<data>]
41111821 Rev 12 August 04, 2020 186

HL78xx
Parameters
<ndata available> Number of bytes to be read
<udp remote address> IP address string of the remote host
<udp remote port> 0 – 65535 Remote UDP port
<data> Data in octet. The length of data is specified by <ndata_available>.

Reference Notes
Sierra Wireless • As soon as the UDP socket is created, the module can receive data through
Proprietary this socket. This notification is sent when data are available in the receive
buffer.
• This notification will be sent one time. When <data_mode> was set to 0 (do not
display data in URC), the controlling software must read the buffer with
+KUDPRCV to activate the notification again.
• When <data_mode> is set to 1, the maximum <data> length the module can
receive is 1500 bytes. If the user application sends >1500 bytes of data, the
first 1500 bytes are included in the URC and the remainder is truncated (lost).
• When <data_mode> is set to 1, URC +KUDP_RCV will not be displayed after
+KUDP_DATA.
• When <data_mode> is set to 1, the fields <udp remote address> and <udp
remote port> will be displayed in URC +KUDP_DATA. When <data_mode> is set
to 0, they will be displayed in URC +KUDP_RCV.
9.13. HTTP Client Specific Commands
9.13.1. +KHTTPCFG Command: HTTP Connection

Configuration
HL78xx
Test command
Syntax Response
AT+KHTTPCFG +KHTTPCFG: (list of possible <cnx_cnf>s),<server-name/ip>,(list of possible
=? <http_port>s),(list of possible <http_version>s),(range of possible length of <login>),
(range of possible length of <password>),(list of possible <started>s),(list of possible
<af>s,(list of <cipher_index>es))
OK
Read command
Syntax Response
AT+KHTTPCFG? +KHTTPCFG: <session_id>,<cnx cnf>,<http_server>,<http_port>,<http_version>,
<login>,<password>,<started>,<af>,<cipher_index>
OK
41111821 Rev 12 August 04, 2020 187

HL78xx
Write command
Syntax Response
AT+KHTTPCFG= +KHTTPCFG: <session_id>
<cnx cnf>, OK
<http_server>
[,<http_port>
[,<http_version> or
[,<login> +CME ERROR: <err>
[,<password>
[,<start> Parameters
[,<af> <cnx cnf> PDP context configuration; numeric parameter which specifies a particular
[,<cipher_index>] PDP context configuration (see +KCNXCFG)
]]]]]]
Note that the maximum number of simultaneous connections is limited to 2.
<session_id> HTTP session index
<http_server> IP address string or explicit name of the remote server
<http_port> 1 – 65535 Numeric parameter; default value = 80
<http_version> 0 HTTP 1.1

2 HTTP 1.1 over TLS (HTTPS)
<login> String type, indicates the user name to be used during the HTTP
connection
<password> String type, indicates the password to be used during the HTTP
connection
<start> Specifies whether to start the HTTP connection immediately or not

0 Start the HTTP connection later using +KHTTPCNX
1 Start the HTTP connection immediately
<started> Specifies whether the HTTP connection has been started

0 The HTTP connection has not been started yet
1 The HTTP connection has already been started
<af> Address family used for the connection. Default is IPV4.

0 IPV4
1 IPV6
<cipher_suite> Cipher suite profile index to use for a secured socket; defined by
+KSSLCRYPTO
Reference Notes
Sierra Wireless • <http_port> and <http_server> define the port and the IP address of the remote
Proprietary server to connect to.
• This command can be used before setting up +KCNXCFG. Note however that
the latter is required to start the connection properly.
• For <af> = 1 (IPV6), server address <http_server> in the IP address string
format can be optionally quoted with square brackets “[]”.
e.g. [FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]
41111821 Rev 12 August 04, 2020 188

9.13.2. +KHTTPCNX Command: Start HTTP Connection
HL78xx
Test command
Syntax Response
AT+KHTTPCNX= +KHTTPCNX: (list of possible <session_id>s)
? OK
Write command
Syntax Response
AT+KHTTPCNX= OK
<session_id>
or
+CME ERROR: <err>
+KHTTP_ERROR: <session_id>,<http_notif>
Parameters
<http_notif> Integer type. Indicates the cause of the HTTP connection failure
4 DNS error
5 HTTP connection error due to internal trouble
6 HTTP connection timeout
7 Flash access trouble
8 Flash memory full
9 Triple plus (+++) error (switch to command mode)
10 HTTP has no data
11 HTTP has partial data
Reference Notes
Sierra Wireless • This command is used to start the HTTP connection created by +KHTTPCFG
Proprietary with <start>=0.
• +KHTTPGET, +KHTTPHEAD and +KHTTPPOST automatically starts the
connection if it has not been started before using AT+KHTTPCNX.
9.13.3. +KHTTPHEADER Command: Set HTTP Request

Header
HL78xx
Test command
Syntax Response
AT+ +KHTTPHEADER: (list of possible <session_id>s),<local_uri>
KHTTPHEADER OK
=?
Read command
Syntax Response
AT+ +KHTTPHEADER: <session_id>,<count>
KHTTPHEADER? […]
41111821 Rev 12 August 04, 2020 189

HL78xx
Write command
Syntax Response
AT+ CONNECT
KHTTPHEADER= …<EOF pattern>
<session_id> OK
[,<local_uri>]
or
+CME ERROR: <err>
Parameters
<local_uri> This argument must be empty. It is reserved for compatibility of command

syntax.
<count> HTTP headers count

Reference Notes
Sierra Wireless User must use <EOF pattern> to finish sending; the module will then return to command
Proprietary mode.
9.13.4. +KHTTPGET Command: Get HTTP Server

Information
HL78xx
Test command
Syntax Response
AT+KHTTPGET +KHTTPGET: (list of possible <session_id>s),<request_uri >,(list of possible
=? <show_resp>s)
OK
Write command
Syntax Response
AT+KHTTPGET= CONNECT
<request_uri> OK
[,<show_resp>]
or
NO CARRIER
+CME ERROR: <err>
Parameters
<request_uri> String type, indicates the information url to get during the HTTP
connection
41111821 Rev 12 August 04, 2020 190

HL78xx
<http_notif> Integer type. Indicates the cause of the HTTP connection failure
4 DNS error
5 HTTP connection error due to internal trouble
6 HTTP connection timeout
8 Flash memory full
9 Triple plus (+++) error (switch to command mode)
10 HTTP got no data
11 HTTP got partial data
<show_resp> Whether to show HTTP response and HTTP headers

0 Do not show response and headers
1 Show response and headers (default)
Reference Notes
Sierra Wireless • The user can abort the download by sending “End of Data pattern” from the
Proprietary host. In this case, the module will end the transfer by transmitting the EOF
followed by NO CARRIER.
• Download can also be aborted (disconnected) by +++ or DTR as specified in
section 14.7 Switch Data/Command Mode DTR +++ ATO Behavior Table.
9.13.5. +KHTTPHEAD Command: Get HTTP Headers
HL78xx
Test command
Syntax Response
AT+KHTTPHEAD +KHTTPHEAD: (list of possible <session_id>s),<request_uri>
=? OK
Write command
Syntax Response
AT+KHTTPHEAD CONNECT
=<session_id>, …<EOF pattern>
<request_uri> OK
or
NO CARRIER
+CME ERROR: <err>
Parameters
<request_uri> String type, indicates the information URL to get during HTTP
connection
<http_notif> Refer to +KHTTPGET
41111821 Rev 12 August 04, 2020 191

HL78xx
Reference Notes
Sierra Wireless • This method is identical to +KHTTPGET except that the server MUST NOT
Proprietary return a message-body in the response. The meta-information contained in the
HTTP headers in response to a HEAD request SHOULD be identical to the
information sent in response to a GET request.
• HTTP does not support DTR1.
• HTTP does not support ATO.
9.13.6. +KHTTPPOST Command: Send Data to HTTP

Server
HL78xx
Test command
Syntax Response
AT+KHTTPPOST +KHTTPPOST: (list of possible <session_id>s),<local_uri>,<request_uri>,(list of
=? possible <show_resp>s)
OK
Write command
Syntax Response
AT+KHTTPPOST CONNECT
=<session_id>, …<EOF pattern>
<local_uri>, OK
<request_uri>
[,<show_resp>]
or
NO CARRIER
+CME ERROR: <err>
Parameters
<local_uri> This argument must be empty. It is reserved for compatibility of

command syntax.
<request_uri> String type, the request data of the HTTP connection
<show_resp> Whether to show HTTP headers

0 Do not show HTTP headers – show HTTP body only
1 Show HTTP headers and body
Reference Notes
Sierra Wireless • Before using this command, it is highly recommended to configure the module
Proprietary for hardware flow control using command AT&K3.
• Upload can be ended (disconnected) by +++ or DTR as specified in section
14.7 Switch Data/Command Mode DTR +++ ATO Behavior Table.
41111821 Rev 12 August 04, 2020 192

9.13.7. +KHTTP_IND Notification: HTTP Status
HL78xx
Notification +KHTTP_IND: <session_id>,<status>[,<data_len>,<st_code>,<st_reason>]
Parameters
<status> Status of the HTTP session

0 Session is diconnected
3 The last HTTP command is executed successfully
<data_len> Byte length of data downloaded/uploaded to/from the terminal (using

+KHTTPHEAD, +KHTTPGET or +KHTTPPOST)
<st_code> HTTP response status code
<st_reason> HTTP response status reason string

9.13.8. +KHTTPCLOSE Command: Close HTTP

Connection
HL78xx
Test command
Syntax Response
AT+ +KHTTPCLOSE: (list of possible <session_id>s), (list of possible <keep_cfg>s)
KHTTPCLOSE=? OK
Write command
Syntax Response
AT+ OK
KHTTPCLOSE=
<session_id> or
[,<keep_cfg>]
+CME ERROR: <err>
Parameters
<keep_cfg> 0 Delete the session configuration

41111821 Rev 12 August 04, 2020 193

9.13.9. +KHTTPDEL Command: Delete a Configured HTTP

Connection
HL78xx
Test command
Syntax Response
AT+KHTTPDEL +KHTTPDEL: (list of possible <session_id>s)
=? OK
Write command
Syntax Response
AT+KHTTPDEL= OK
<session_id>
or
+CME ERROR: <err>
Parameter
Reference Notes
Sierra Wireless The HTTP session must be closed (using +KHTTPCLOSE) before using this command.
Proprietary
9.13.10. +KHTTPPUT Command: Perform HTTP PUT
HL78xx
Test command
Syntax Response
AT+KHTTPPUT= +KHTTPPUT: (list of possible <session_id>s),<local_uri>,<request_uri>,(list of
? possible <show_resp>s)
OK
Write command
Syntax Response
AT+KHTTPPUT= CONNECT
<local_uri>, OK
<request_uri>
[,<show_resp>]
or
NO CARRIER
+CME ERROR: <err>
Parameters
<local_uri> This parameter must be empty; it is reserved for compatibility of

command syntax
41111821 Rev 12 August 04, 2020 194

HL78xx
<request_uri> String type, request data of the HTTP connection
<show_resp> Indicated whether to show HTTP header

0 Do not show header – show HTTP body only
1 Show HTTP header and body
Reference Notes
Sierra Wireless • Before using this command, it is highly recommended to configure the module
Proprietary for hardware flow control using command AT&K3.
• Uploading can be ended (disconnected) using +++ or DTR as specified in
9.13.11. +KHTTPDELETE Command: Perform HTTP Delete
HL78xx
Test command
Syntax Response
AT+ +KHTTPDELETE: (list of possible <session_id>s),<request_uri>,(list of possible
KHTTPDELETE= <show_resp>s)
? OK
Write command
Syntax Response
AT+ CONNECT
KHTTPDELETE= …<EOF pattern>
<session_id>, OK
<request_uri>
[,<show_resp>]
or
NO CARRIER
+CME ERROR: <err>
Parameters
<request_uri> String type, indicates the information URL to get during the HTTP
connection
<show_resp> Indicates whether to show HTTP response and HTTP headers

0 Do not show
1 Show
41111821 Rev 12 August 04, 2020 195

HL78xx
Reference Notes
Sierra Wireless • The user can abort downloading by sending “End of Data pattern” from the
Proprietary host. In this case, the module will end the transfer by transmitting the EOF
followed by NO CARRIER.
• Downloading can also be aborted (disconnected) using +++ or DTR as
specified in section 14.7 Switch Data/Command Mode DTR +++ ATO Behavior
Table.
9.14. FTP Client Specific Commands
9.14.1. +KFTPCFG Command: FTP Connection

Configuration
HL78xx
Test command
Syntax Response
AT+KFTPCFG=? +KFTPCFG: (list of possible <cnx cnf>s),<server-name/ip>,(range of possible length of
<login>),(range of possible length of <password>),(list of possible <port_number>s),
(list of possible <mode>s),(list of possible <start>s),(list of possible <af>s)
OK
Read command
Syntax Response
AT+KFTPCFG? +KFTPCFG: <session_id>,<cnx cnf>,<server_name>,<login>,<password>,
<port_number>,<mode>,<started>,<af>
OK
Write command
Syntax Response
AT+KFTPCFG= +KFTPCFG:<session_id>
[<cnx cnf>], OK
<server_name>
[,<login> or
[,<password>
[,<port_number> +KFTP_ERROR: <session_id>,<ftp cause>
[,<mode>]
[,<start>] Parameters
[,<af>]]]] <cnx cnf> Index of a set of parameters for configuring one FTP session (see
+KCNXCFG)
<session_id> FTP session index
<server_name> IP address string of the ftp server or domain name of the server
<login> String type, indicates the username to be used during the FTP
connection
41111821 Rev 12 August 04, 2020 196

HL78xx
<password> String type, indicates the password to be used during the FTP
connection. (Note: The password does not appear in the Read response. The field
displays as "".)
<port_number> 1 – 65535 Indicates the remote command port

(default value = 21)
<mode> Numeric number. Indicates the initiator of the FTP connection

0 Active. The server is the initiator of the FTP data connection
1 Passive. The client is the initiator of the FTP data connection in order to avoid the
proxy filtrate. The passive data transfer process “listens” on the data port for a
connection from the active transfer process in order to open the data connection
Note that only passive mode is currently supported, active mode is internally switched to
passive.
<start> Specifies whether to start the FTP connection immediately

0 Start the FTP connection later using +KFTPCNX
1 Start the FTP connection immediately
<started> Specifies whether to the FTP connection has been started

0 FTP connection has not been started yet
1 FTP connection has been started
<af> Address family used for the connection

0 IPV4
1 IPV6
<ftp_cause> Integer type. Indicates the cause of the FTP connection failure
0 Sending or retrieving was impossible due to request timeout
1 Impossible to connect to the server due to DNS resolution failure
2 Impossible to download a file due to connection troubles
3 Download was impossible due to connection timeout
4 No network available
6 Flash memory full
7 Network error
XXX 3-digit reply code from the FTP server. See section 14.4 FTP Reply Codes
Reference Notes
Sierra Wireless • Write command sets the server name, login, password, port number and mode
Proprietary for ftp operations.
• This command (with <start> = 0) can be used before setting up +KCNXCFG
configuration. Note however that the latter is required to start the connection
properly.
• The connection timeout for TCP socket is about 9 seconds with 3
retransmissions with a 3-second delay.
• The result of the FTP connection is indicated by URC.
• The default timeout for FTP is 180 seconds.
• The password does not appear in the Read response. The field displays as "".
Examples AT+KFTPCFG=1,"ftp.connect.com","username","password",21,1
+KFTPCFG: 1
OK
AT+KFTPCFG =?
+KFTPCFG: (1),<remote-name/ip>,(0-65),(0-65),(1-65535),(0-1),(0-1),(0-1)
OK
41111821 Rev 12 August 04, 2020 197

HL78xx
AT+KFTPCFG?
+KFTPCFG: 1,1,”ftp.connect.com”,”username”,"",21,1,0,0
OK
9.14.2. +KFTPCNX Command: Start FTP Connection
HL78xx
Test command
Syntax Response
AT+KFTPCNX=? +KFTPCNX: (list of possible <session_id>s)
OK
Read command
Syntax Response
AT+KFTPCNX? ERROR
Write command
Syntax Response
AT+KFTPCNX= OK
<session_id>
or
NO CARRIER
+CME ERROR: <err>
+KFTP_ERROR: <session_id>,<ftp cause>
Parameters
<ftp_cause> Integer type. Indicates the cause of the FTP connection failure.
2 Impossible to download a file due to connection troubles
6 Flash memory full
7 Network error
Reference Notes
Sierra Wireless • This command is used to start the FTP connection created by +KFTPCFG with
Proprietary <start>=0.
Examples AT+KFTPCNX=?
+KFTPCNX: (1-6)
OK
AT+KFTPCNX=1
ERROR
+KFTP_ERROR: 1,2
41111821 Rev 12 August 04, 2020 198

HL78xx
AT+KFTPCNX=?
+KFTPCNX: (1-6)
OK
AT+KFTPCNX=1
OK
+KCNX_IND: 1,1,0
+KFTP_IND: 1,1
9.14.3. +KFTPRCV Command: Receive FTP Files
HL78xx
Test command
Syntax Response
AT+KFTPRCV=? +KFTPRCV: (list of possible <session_id>s),<local_uri>,<server_path>,<file_name>,
(list of possible <type_of_file>s),(list of possible <offset>s),(list of possible <size>s)
OK
Read command
Syntax Response
AT+KFTPRCV? ERROR
Write command
Syntax Response
AT+KFTPRCV= CONNECT
<session_id>, <EOF_pattern>
[<local_uri>], OK
[<server_path>],
<file_name>
[,<type_of_file> or
[,<offset>] +CME ERROR<err>
[,<size>]] NO CARRIER
Parameters
<local_uri> This argument must be empty. It is reserved for compatibility of

command syntax.
<server_path> String type. Indicates the path of the file to be downloaded. An

empty string or no string indicates the downloading is done from the path given by the
FTP server
<file_name> String type. Indicates the name of the file to download
<type_of_file> Numeric type. Indicates the type of file (ASCII or binary) to transfer
0 Binary (default value)
1 ASCII (not supported)
41111821 Rev 12 August 04, 2020 199

HL78xx
<offset> 0 – 4294967295 Indicates the offset to “resume transfer”. When

downloading file and transmitting to serial link, module will use the <offset> value and
“resume transfer” from this position.
<size> 0 – 4294967295 Indicates the size to “resume transfer”. When

downloading file and transmitting to serial link, module will use the <size> value to
indicate how many bytes to receive.
<EOF_pattern> End of file notification. See +KPATTERN for values
2 Impossible to download a file due to connection troubles.
6 Flash memory full
7 Network error
Reference Notes
Sierra Wireless • An FTP connection must have been achieved using AT+KFTPCFG before using
Proprietary this command.
• The user will receive the entire data stream after sending +KFTPRCV.
• The user can abort the download by sending the “end of data pattern” from the
host. In this case, the module will end the transfer by transmitting the EOF
followed by OK.
• Download can also be aborted by +++.
• If AT&C1 is set, DCD will be ON after CONNECT, and DCD will be OFF after
the download is done.
• If the FTP server does not support the resume feature, the module will output
+KFTP_ERROR. The <ftp_cause> will be in the sets {500, 501, 502, 421, 530}.
See section section 14.4 FTP Reply Codes for details.
Examples AT+KFTPRCV?
ERROR
AT+KFTPRCV=?
+KFTPRCV: (1-6),<local_uri>,<server_path>,<file_name>,(0),(0-4294967295) ,(0-
4294967295)
OK
AT+KFTPRCV=1,,,"filename.txt"
CONNECT
…data…
OK
+KFTP_IND: 1,2,10
41111821 Rev 12 August 04, 2020 200

9.14.4. +KFTPSND Command: Send FTP Files
HL78xx
Test command
Syntax Response
AT+KFTPSND=? +KFTPSND: (list of possible <session_id>s),<local_uri>,<server_path>,<file_name>,
(list of possible <type of file>s),(list of possible <append>s),(list of possible <offset>s),
(list of possible <size>s)
OK
Read command
Syntax Response
AT+KFTPSND? ERROR
Write command
Syntax Response
AT+KFTPSND= CONNECT
<session_id>, data … | OK
[<local_uri>], <EOF pattern>
[<server_path>],
<file_name> OK
[,<type of file>]
[,<append>] or
[,<offset>][,<size +CME ERROR <err>
>] NO CARRIER
Parameters
<local_uri> This argument must be empty. It is reserved for compatibility of command

syntax.
<server_path> String type. Indicates the path of the file to be uploaded. An empty
string or no string indicates the uploading is done from the path given by the FTP server
<file_name> String type. Indicates the name of the file to upload
<type of file> Numeric type. Indicates the type of file (ASCII or binary) to transfer
0 Binary
<append> Numeric type. Indicates using "append" or not when uploading.

0 Do not use "append". (default value) If the file already exists then the file will be
overridden
1 Use "append". If the file already exists, then the data will be appended at the end
of the file; otherwise the file will be created
<offset> 0 – 4294967295 Indicates the offset to “resume transfer”. When

transmitting to serial link and sending file, module will use the <offset> value and
“resume transfer” from this position.
<size> 0 – 4294967295 Indicates the size to “resume transfer”. When

transmitting to serial link and sending file, module will use the <size> value to indicate
how many bytes to send.
41111821 Rev 12 August 04, 2020 201

HL78xx
<EOF pattern> End of file notification. See +KPATTERN for values
<ftp_cause> Integer type. Indicates the cause of the FTP connection failure.
2 Impossible to download a file due to connection troubles.
6 Flash memory full
7 Network error
Reference Notes
• After sending the command, the host must send the entire data stream of the
file after sending +KFTPSND.
• Upload can also be ended (disconnected) by +++ or DTR as specified in
• ATO is not available for this command
• If AT&C1 is set, DCD will be ON after CONNECT, and it will be OFF after the
upload is done.
Examples AT+KFTPSND=?
+KFTPSND: (1-6),<local_uri>,<server_path>,<file_name>,(0),(0-1),(0-4294967295),
(0-4294967295)
OK
9.14.5. +KFTPDEL Command: Delete FTP Files
HL78xx
Test command
Syntax Response
AT+KFTPDEL=? +KFTPDEL: (list of possible <session_id>s),<server_path>,<file_name>,(list of
possible <type>s)
OK
Read command
Syntax Response
AT+KFTPDEL? ERROR
Write command
Syntax Response
AT+KFTPDEL= OK
<session_id>,
[<server_path>], or
<file_name>
[,<type>] +CME ERROR <err>
NO CARRIER
41111821 Rev 12 August 04, 2020 202

HL78xx
Parameters
<server_path> String type. Indicates the path of the file to be deleted. An empty
string or no string indicates the deleting is done from the path given by the FTP server
<file_name> String type. Indicates the name of the file to delete
<type> Numeric type. Indicates the type of file (ASCII or binary) to transfer
0 Binary
1 ASCII (Not supported)
2 Impossible to delete a file due to connection troubles
3 Deleting was impossible due to connection timeout
Reference Notes
Examples AT+KFTPDEL=?
+KFTPDEL: (1-6),<server_path>,<file_name>,(0)
OK
9.14.6. +KFTP_IND Notification: FTP Status
HL78xx
Notification +KFTP_IND: <session_id>,<status>[,<data_len>]
Parameters
<status> Status of the FTP session

2 The last FTP command is executed successfully
<data_len> Byte length of data downloaded/uploaded to/from the terminal (using

+KFTPRCV/+KFTPSND)
41111821 Rev 12 August 04, 2020 203

9.14.7. +KFTPCLOSE Command: Close Current FTP

Connection
HL78xx
Test command
Syntax Response
AT+KFTPCLOSE +KFTPCLOSE: (list of possible <session_id>s),(list of possible <keep_cfg>s)
=? OK
Write command
Syntax Response
AT+KFTPCLOSE OK
=<session_id>
[,<keep_cfg>] Parameters
<keep_cfg> Specifies whether to delete the session configuration after closing it

0 Delete the session configuration
Reference Notes
Sierra Wireless This command will close the connection to the FTP server.
Proprietary
Examples AT+KFTPCLOSE=?
+KFTPCLOSE: (1-6),(0-1)
OK
AT+KFTPCLOSE=1,1
OK
9.14.8. +KFTPCFGDEL Command: Delete a Configured

FTP Session
HL78xx
Test command
Syntax Response
AT+ +KFTPCFGDEL: (list of possible <session_id>s)
KFTPCFGDEL=? OK
Write command
Syntax Response
AT+ OK
KFTPCFGDEL=
<session_id> or
+CME ERROR: <err>
Parameters
41111821 Rev 12 August 04, 2020 204

HL78xx
Reference Notes
Sierra Wireless The session must be closed (using +KFTPCLOSE) before using this command.
Proprietary
Examples AT+KFTPCFGDEL=?
+KFTPCFGDEL: (1-6)
OK
AT+KFTPCFGDEL=1
OK
9.14.9. +KFTPLS Command: List File Size of a Specific

File
HL78xx
Test command
Syntax Response
AT+KFTPLS=? +KFTPLS: (list of possible <session_id>s),<server_path>,<file_name>,(list of possible
<type>s)
OK
Write command
Syntax Response
AT+KFTPLS= OK
<session_id>,
[<server_path>], or
<file_name>
[,<type>] +CME ERROR <err>
NO CARRIER
Parameters
<server_path> String type. Indicates the path of the file to be deleted. An empty
string or no string indicates the deleting is done from the path given by the FTP server
<file_name> String type. Indicates the name of the file to list size
<type> Numeric type. Indicates the type of file (ASCII or binary) to transfer
0 Binary
2 Impossible to delete a file due to connection troubles
3 Deleting was impossible due to connection timeout
XXX 3-digit reply codes from the FTP server. See section 14.4 FTP Reply Codes
41111821 Rev 12 August 04, 2020 205

HL78xx
Reference Notes
Examples AT+KFTPLS=?
+KFTPLS: (1-6),<server_path>,<file_name>,(0)
OK
AT+KFTPLS=1,,"filename.txt"
+KFTPLS: filename.txt 24
OK
41111821 Rev 12 August 04, 2020 206

10. AVMS Commands
Note: Two IP sessions are required during an AVMS FOTA session (connection to AirVantage and FOTA
upgrade). Refer to section 9.3 Session ID for session ID details.
10.1. +WDSC Command: Device Services

Configuration
HL78xx
Test command
Syntax Response
AT+WDSC=? +WDSC: (0-2,5,6),(list of supported <State>s)
+WDSC: 3,(list of supported <State>s)
+WDSC: 4,(list of supported <Timer_1>s),(list of supported <Timer_2>s),(list of
supported <Timer_3>s),(list of supported <Timer_4>s),(list of supported <Timer_5>s),
(list of supported <Timer_6>s),(list of supported <Timer_7>s),(list of supported
<Timer_8>s)
OK
Read command
Syntax Response
AT+WDSC? +WDSC: 0,<State>
+WDSC: 1,<State>
+WDSC: 2,<State>
+WDSC: 3,<State>
+WDSC: 4,<Timer_1>[[,<Timer_2>]...[,<Timer_n>]]
+WDSC: 5,<State>
+WDSC: 6,<State>
OK
Write command
Syntax Response
For <Mode>= 0, 1, OK
2, 3, 5, 6:
AT+WDSC= or
<Mode>,<State> +CME ERROR <err>
For <Mode>=4: Parameters

AT+WDSC= <Mode> 0 User agreement for AVMS connection
<Mode>,
<Timer_1> When this mode is activated, an indication (see +WDSI for more
[[,<Timer_2>]... information) is returned by the embedded module to request for an
[,<Timer_n>]] agreement before connecting to the server
1 User agreement for package download
When this mode is activated, an indication (see +WDSI for more
information) is returned by the embedded module to request for an
agreement before downloading any package
2 User agreements for package install
agreement before installing any package
41111821 Rev 12 August 04, 2020 207

AT Commands Interface Guide AVMS Commands
HL78xx
3 Polling mode
The embedded module will initiate a connection to the Device
Services server according to the defined timer
4 Retry mode
If an error occurs during a connection to the Device Services
server (WWAN DATA establishment failed, http error code
received), the embedded module will initiate a new connection
according to the defined timers. This mechanism is persistent to
the reset.
5 User agreements for device reboot
agreement before rebooting the device
6 User agreements for application uninstall (SW update)
agreement before uninstalling an application.
<State> Status of the mode

For <Mode> = 0, 1, 2, 5 or 6:
0 Disabled (default value)
1 Enabled
For <Mode> = 3:
Range = 0 – 525600 (units:min)
0 The polling mode is deactivated
<Timer_1> Timer between the first failed connection and the next attempt.
Range = 0 – 20160 (units: min).
0 The retry mode is deactivated
15 Default value
<Timer_n> Timer between the nth failed attempt connection and the (n+1)th
connection (n ≤ 7). Range = 1 – 20160 (units: min)
Default values:
<Timer_2>=60
<Timer_3>=240
<Timer_4>=960
<Timer_5>=2880
<Timer_6>=10080
<Timer_7>=10080
<Timer_8>=not used
Reference Notes
Sierra Wireless • This command is available when the embedded module has finished the Device
Proprietary Services initialization (see +WDSI) and when the AVMS services are in
Command prohibited state (see +WDSG).
• Parameters <State> and <Timer_1> to <Timer_n> are stored in non-volatile
memory without sending the &W command. The &F command has no impact on
these values.
• The network registration is considered as “failed” when all connections
configured by the retry mode have failed. This registration is forbidden while the
APN is not set by +WDSS.
41111821 Rev 12 August 04, 2020 208

HL78xx
Examples AT+WDSC=?
+WDSC:(0-2,5,6),(0-1)
+WDSC:3,(0-525600)
+WDSC:4,(0-20160),(1-20160),(1-20160),(1-20160),(1-20160),(1-20160),(1-20160)
OK
AT+WDSC?
// All modes are deactivated except retry mode which is used with default timers
+WDSC: 0,0
+WDSC: 1,0
+WDSC: 2,0
+WDSC: 3,0
+WDSC: 4,15,60,240,960,2880,10080,10080
+WDSC: 5,0
+WDSC: 6,0
OK
AT+WDSC=0,1
OK
AT+WDSC?
+WDSC: 0,1
+WDSC: 1,0
+WDSC: 2,0
+WDSC: 3,0
+WDSC: 4,15,60,240,960,2880,10080,10080
+WDSC: 5,0
+WDSC: 6,0
OK
10.2. +WDSE Command: Device Services Error

HL78xx
Execute command
Syntax Response
AT+WDSE [+WDSE:<HTTP_Status>]
OK
+CME ERROR <err>
Parameter
<HTTP_Status> Integer type – Last HTTP response received by the module
100 Continue
101 Switching Protocols
200 OK
201 Created
202 Accepted
203 Non-Authoritative Information
204 No Content
205 Reset Content
206 Partial content
41111821 Rev 12 August 04, 2020 209

HL78xx
300 Multiple Choices

301 Moved Permanently
302 Found
303 See Other
304 Not Modified
305 Use Proxy
307 Temporary Redirect
400 Bad Request
401 Unauthorized
402 Payment Required
403 Forbidden
404 Not Found
405 Method Not Allowed
406 Not Acceptable
407 Proxy Authentication Required
408 Request time-out
409 Conflict
410 Gone
411 Length Required
412 Precondition Failed
413 Request Entity too large
414 Request URI too large
415 Unsupported Media type
416 Request range unsatisfiable
417 Expectation failed
500 Internal server error
501 Not implemented
502 Bad Gateway
503 Service unavailable
504 Gateway time-out
505 HTTP version not supported
If no session was made with the server, AT+WDSE only returns OK, without +WDSE:
<HTTP_Status> intermediary response.
Reference Notes
Sierra Wireless This command is available when the embedded module has finished the Device
Proprietary Services initialization (see +WDSI) and when the AVMS services are in activated state
Command (see +WDSG).
Examples AT+WDSS=1,1 //A session was made with the server
OK
AT+WDSE
+WDSE: 200 //The last HTTP response received is “OK”
OK
41111821 Rev 12 August 04, 2020 210

10.3. +WDSG Command: Device Services General

Status
HL78xx
Test command
Syntax Response
AT+WDSG=? OK
Write command
Syntax Response
AT+WDSG +WDSG: <Indication>,<State>
[+WDSG: <Indication>,<State>[…]]
OK
or
+CME ERROR <err>
Parameters
<Indication> Integer type
0 Device services activation state
1 Session and package indication
<State> Status of indication

For <Indication>=0
0 Device services are prohibited. Devices services will never be activated.
1 Device services are deactivated. Connection parameters to a device services
must be provisioned.
2 Device services must be provisioned. NAP parameters must be provisioned.
3 Device services are activated.
If a device has never been activated (first use of device services on this device), <State>
is set to 1. The connection parameters are automatically provisioned, no action is
needed from the user.
For <Indication>=1
0 No session or package
1 A session is under treatment
2 A package is available on the server.
3 A package was downloaded and ready to install
When a package was installed or a recovery was made, <State> is set to 0.
Reference Notes
Sierra Wireless This command is available when the embedded module has finished the Device
Proprietary Services initialization (see +WDSI).
Command
Examples AT+WDSG=?
OK
AT+WDSG
+WDSG: 0,3 //Device services are activated,
+WDSG: 1,0 //No session to the server, no patch to download or to install
OK
41111821 Rev 12 August 04, 2020 211

10.4. +WDSI Command: Device Services

Indications
HL78xx
Test command
Syntax Response
AT+WDSI=? +WDSI: (list of supported <Level>s)
OK
Read command
Syntax Response
AT+WDSI? [+WDSI: <Level>]
OK
Write command
Syntax Response
AT+WDSI= OK
<Level>
or
+CME ERROR <err>
Parameters
<Level> Indication level, bit field (default value = 0)
Bit set to 0 Indication deactivated
Bit set to 1 Indication activated
0 No indication
1 Activate the initialization end indication (<Event> = 0)
2 Activate the server request for a user agreement indication (<Event> = 1, 2, 3, 24
and 25)
4 Activate the authentication indications (<Event> = 4 and 5)
8 Activate the session indication (<Event> = 6, 7, 8)
16 Activate the package download indications (<Event> = 9, 10 and 11)
32 Activate the certified downloaded package indication (<Event> = 12 and 13)
64 Activate the update indications (<Event> = 14, 15 and 16)
256 Activate download progress indication (<Event> = 18)
2048 Reserved
4096 Activate Bootstrap event indications (<Event> = 23)
<Event> 0 Device services are initialized and can be used. The device is
configured to be able to authenticate with the AV server.
1 The Device Services server requests the device to make a
connection. The device requests a user agreement to allow the
module to make the connection. The response can be sent using
+WDSR and this indication can be returned by the device if the user
has activated the user agreement for connection.
2 The Device Services server requests the device to make a package
download. The device requests a user agreement to allow the
module to make the download. The response can be sent
using +WDSR and this indication can be returned by the
device if the user has activated the user agreement for download.
3 The device has downloaded a package. The device requests a
user agreement to install the downloaded package. The response
41111821 Rev 12 August 04, 2020 212

HL78xx
can be sent using +WDSR and this indication can be returned by

the device if the user has activated the user agreement for install.
4 The embedded module starts authentication with the server
5 Authentication with the server failed. This event is sent when the
server rejects the device authentication request. Example of
rejection cause: authentication keys mismatch.
6 Authentication has succeeded, and session with the server started.
7 Session with the server failed. This event is sent when the server
rejects the device connection request. Example of rejection cause:
device not registered on server side.
8 Session with the server is finished. Example of session termination
cause: connection loss, user initiated using +WDSS=1,0 or reboot.
9 A package is available on the server and can be downloaded by
the module. A <Data> parameter is returned indicating the
package size in kB
10 A package was successfully downloaded and stored in flash
11 An issue happens during the package download. If the download

has not started (+WDSI: 9 was not returned), this indication
indicates that there is not enough space in the device to download
the update package. If the download has started (+WDSI: 9 was
returned), a flash problem implies that the package has not been
saved in the device
12 Downloaded package is certified to be sent by the AirPrime
Management Services server
13 Downloaded package is not certified to be sent by the AirPrime
Management Services server
14 Update will be launched
15 OTA update client has finished unsuccessfully
16 OTA update client has finished successfully
17 Reserved
18 Download progress. This event is returned without <Data>
parameter to indicate that a download starts. During the download,
a percentage progress is indicated in <Data> parameter
19 Reserved
20 Reserved
21 Reserved
22 Reserved
23 Session type (only in LWM2M protocol)
24 The Device Services server requests the device to make a reboot.
The device requests a user agreement to allow the embedded
module to reboot. The response can be sent using +WDSR and this
indication can be returned by the device if the user has activated
the user agreement for connection.
25 The Device Services server requests the device to uninstall a SW
application. The device requests a user agreement to allow the
embedded modeule to uninstall an application. The response can
be sent using +WDSR and this indication can be returned by the
device if the user has activated the user agreement for uninstall.
<Data> Specific data for some <Event>

For <Event>=9, <Data> indicates the package size in bytes, which will be downloaded
For <Event>=11, <Data> indicates the reason of the download failure

0 The download fails due insufficient memory in the device to save the firmware
update package. The package was not downloaded
1 An HTTP/HTTPS error occurs. Please refer to +WDSE
41111821 Rev 12 August 04, 2020 213

HL78xx
2 Corrupted firmware update package; did not store correctly. Detected, for
example, by mismatched CRCs between actual and expected or signature check
error.
3 RAM issue (resume is possible but suggests rebooting the platform before the
resume)
4 Download issue but the package download could be resumed
5 Flash issue during package download
For <Event>=18, <Data> indicates the download progress in percentage (without %)
For <Event>=23, <Data> indicates the session event

0 Bootstrap session
1 Device management session
Notification +WDSI: <Event>[,<Data>]
Reference Notes
Sierra Wireless • This command is available when the embedded module has finished its
Proprietary initialization.
Command • To receive +WDSI indications, the Device Services should be in activated state
(see +WDSG for more information).
• In case when user agreement for connection is enabled, the connection will not
be disconnected (with notification +WDSI: 8) without the user's explicit action
(AT+WDSS=1,0).
Examples AT+WDSI=?
+WDSI: (0-127,256-383,4096-4223,4352-4479)
OK
AT+WDSI?
+WDSI: 0 // All indications are deactivated
OK
AT+WDSI=207
OK
+WDSI: 1 // The devices services server requests a connection to the
// embedded module
AT+WDSR=1 // Accept the connection

OK
+WDSI: 4 // The embedded module will send the first data to the
// AirPrime Management Services server
+WDSI: 6 // The authentication succeeded
+WDSI: 8 // The session with the server is over
+WDSI: 9,1000 // A package will be downloaded, the size is 1kbytes
+WDSI: 18,1 // 1% was downloaded
+WDSI: 18,100 // The whole package was downloaded
+WDSI: 10 // The whole package was stored in flash
After the firmware was successfully installed, a connection to AirVantage server

needs to be established to update the AirVantage server about the installation status.
If the user agreement for connection is enabled, we will see the following:
+WDSI: 1 // connection needs to be enabled

AT+WDSR=1 // user issues the command to enable the connection
OK
41111821 Rev 12 August 04, 2020 214

HL78xx
+WDSI: 4 // displays the current state of authentication notification

+WDSI: 6 // displays that the session has succeeded and has started
+WDSI: 23,1 // displays that the target has successfully connected to the
// AirVantage Service
10.5. +WDSR Command: Device Services Reply

HL78xx
Test command
Syntax Response
AT+WDSR=? +WDSR: (list of supported <Reply>s),(list of supported <Timer>s)
OK
Write command
Syntax Response
AT+WDSR= OK
<Reply>
[,<Timer>] or
+CME ERROR <err>
Parameters
<Reply> Reply to user agreement request (see +WDSI)
0 Delay the connection to the server
1 Accept the connection to the server
2 Delay the download
3 Accept the download
4 Accept the install
5 Delay the install
6 Accept the device reboot
7 Delay the device reboot
8 Accept the application uninstall
9 Delay the application uninstall
<timer> Timer until a new User agreement request is returned by the module. This
parameter is only available for <Reply>=0, 2, 5, 7 or 9. Units: minutes. Range is from 0
to 1440. Default value = 30.
Reference Notes
Proprietary Services initialization (see +WDSI) and when the AVMS services are in
Command activated state (see +WDSG)
• It is not possible to refuse:
 an install request (AT+WDSR=5,0) and will return +CME ERROR: 3.
 a device reboot request (AT+WDSR=7,0) and will return +CME ERROR: 3.
 an uninstall request (AT+WDSR=9,0) and will return +CME ERROR: 3.
• After an install delay if the embedded module is powered down until after the
delay, it is not powered on and the new user agreement request should be
returned at the newt start up.
Examples AT+WDSR=?
+WDSR: (0-9),(0-1440)
41111821 Rev 12 August 04, 2020 215

HL78xx
OK
+WDSI: 1 //The device Services server requests the device to make a connection to
//the server. The user is requested to allow the connection.
AT+WDSR=1
OK
+WDSI: 3 //A user agreement is requested to install a package
AT+WDSR=5,10 //A delay of 10 minutes is requested

OK
+WDSI: 3 //10 minutes later, a new user agreement is requested to install a package
AT+WDSR=4 //The install is requested

OK
10.6. +WDSS Command: Device Services Session

HL78xx
Test command
Syntax Response
AT+WDSS=? +WDSS: 1,(list of supported <Action>s for this <Mode>)
+WDSS: 2,(range of supported PDP context identifiers)
OK
Read command
Syntax Response
AT+WDSS? [+WDSS: 1,<Action>]
[+WDSS: 2,<Cid>]
OK
Write command
Syntax Response
For <mode>=1 OK
AT+WDSS=
<Mode>, or
<Action> +CME ERROR <err>
For <mode>=2 Parameters

AT+WDSS= <Mode> 0 Deprecated and cannot be used anymore. Instead, use <Mode>=2
<Mode>, to set the profile to be used, and configure it using AT+CGDCONT.
<Cid>
1 User initiated connection to the Device Services server
2 PDP context identifier configurations for Device Services
<Action> For <Mode>=1 only

0 Release the current connection to the Device Services server
1 Establish a connection to the Device Services server
<Cid> For <Mode>=2 only, PDP context identifier
41111821 Rev 12 August 04, 2020 216

HL78xx
Reference Notes
Proprietary Services initialization (see +WDSI)
Command • AT+WDSS? command only returns OK if no APN is defined.
• When a request is sent to the embedded module to resume an inexistent or
unsuspended session, +CME ERROR: 3 is returned.
• When a request is sent to the embedded module to release an inexistent
session, +CME ERROR: 3 is returned.
• When the PDP context cannot be activated because of bad AirPrime

Management Services NAP configuration, the embedded module will use a
NAP defined by +CGDCONT to activate the dedicated PDP context (but the initial
NAP configuration is not erased).
• The activation is done if the embedded module is registered on the network. If
the embedded module is not registered when the command is performed, the
activation will be done at the next network registration (even if the embedded
module resets).
Examples AT+WDSS?
OK
AT+WDSS=?
+WDSS: 1,(0-1)
+WDSS: 2,(1-1)
OK
AT+WDSS=1,1 //Initiation of a connection to the Device Services server

OK
AT+WDSS=1,0 //Release connection to the Device Services server

OK
10.7. +WDSTPF Command: Device Services Third

Party FOTA
HL78xx
Test command
Syntax Response
AT+WDSTPF=? +WDSTPF: 0,(<addr> length range)
+WDSTPF: 1
OK
Read command
Syntax Response
AT+WDSTPF? +WDSTPF: 0,<addr>
+WDSTPF: 1,<state>
OK
41111821 Rev 12 August 04, 2020 217

HL78xx
Write command
Syntax Response
When <mode>=0: OK
AT+WDSTPF=
<mode>,<addr> Parameters
<mode> Mode of operation
When <mode>=1: 0 Set the package URL. This address is stored in memory and is persistent to
AT+WDSTPF= reset
<mode> 1 Start FOTA operation. When this mode is activated, download starts depending
on user agreement configuration (see +WDSC)
<addr> String parameter containing the package address with format

“<url>[:port>]” maximum length = 255
<url> String parameter containing the package URL
<port> String parameter with maximum length = 5. Optional parameter. Default

value = 80
<state> FOTA operation status

0 Not started
1 Started
Notes • The user agreements for download and install are applicable for the third-party
FOTA service. These user agreements are controlled by +WDSC and +WDSR.
• User agreement for reboot is not supported for +WDSTPF.
• Refuse a download is not supported for +WDSTPF.
• +WDSI is available under third-party FOTA service. The sent indications notify
the different states of FOTA.
• FOTA from the Sierra Wireless server must not be used simultaneously with
this third-party FOTA update. Cross effects are not guaranteed.
Examples AT+WDSTPF=?
+WDSTPF: 0,(1-255)
+WDSTPF: 1
OK
AT+WDSTPF?
+WDSTPF: 0,"http://abcd.net:80/1234"
+WDSTPF: 1,0
OK
AT+WDSC?
+WDSC: 0,1
+WDSC: 1,0
+WDSC: 2,1
+WDSC: 3,0
+WDSC: 4,15,60,240,480,1440,2880,0,0
+WDSC: 5,0
+WDSC: 6,0
AT+WDSTPF=1 // Set start download

OK
+WDSI: 9,<package Size>
+WDSI: 18,1
41111821 Rev 12 August 04, 2020 218

HL78xx
+WDSI: 18,5
+WDSI: 18,70
+WDSI: 18,100
+WDSI: 12
+WDSI: 10
+WDSI: 14
+WDSI: 16
41111821 Rev 12 August 04, 2020 219

11. Test Commands
Note: +WMTXPOWER and +WMRXPOWER are available for CAT-M1 but not for NB-IoT.
11.1. +WMTXPOWER Command: Test RF Tx

HL78xx
Test command
Syntax Response
AT+ +WMTXPOWER: (list of supported <ENABLE>s),(list of supported<BAND>s),(list of
WMTXPOWER=? supported<CHANNEL>s),(list of supported<POWER_LEVEL>s),(list of supported
<TX_TYPE>s),(list of supported <BANDWIDTH>s)
OK
Read command
Syntax Response
AT+ +WMTXPOWER: <ENABLE>[,<BAND>,<CHANNEL>,<POWER_LEVEL>,
WMTXPOWER? <TX_TYPE>[,<BANDWIDTH>]]
OK
Note that parameters <BAND>, <CHANNEL>, <POWER_LEVEL> and <TX_TYPE> are

only available if <ENABLE>=1.
<BANDWIDTH> is only available if <ENABLE>=1 and if <TX_TYPE>=0
Write command
Syntax Response
AT+ OK
WMTXPOWER=
<ENABLE> Parameters
[,<BAND>, <ENABLE> 0 Stop the burst emission
<CHANNEL>, 1 Start the burst emission
<POWER_
LEVEL>, <BAND> Tx burst band emission. This is a mandatory parameter if <ENABLE>=1,
<TX_TYPE> but is not allowed if <ENABLE>=0.
[,<BANDWIDTH>]
1 Band 1
]
2 Band 2
3 Band 3
4 Band 4
5 Band 5
8 Band 8
9 Band 9
10 Band 10
12 Band 12
13 Band 13
17 Band 17
18 Band 18
19 Band 19
20 Band 20
25 Band 25
26 Band 26
27 Band 27
41111821 Rev 12 August 04, 2020 220

AT Commands Interface Guide Test Commands
HL78xx
28 Band 28
66 Band 66
<CHANNEL> Tx burst channel emission. This is a mandatory parameter if

<ENABLE>=1, but is not allowed if <ENABLE>=0
If <BAND>=1 18000 – 18599
If <BAND>=2 18600 – 19199
If <BAND>=3 19200 – 19949
If <BAND>=4 19950 – 20399
If <BAND>=5 20400 – 20649
If <BAND>=8 21450 – 21799
If <BAND>=9 21800 – 22149
If <BAND>=10 22150 – 22749
If <BAND>=12 23010 – 23179
If <BAND>=13 23180 – 23279
If <BAND>=17 23730 – 23849
If <BAND>=18 23850 – 23999
If <BAND>=19 24000 – 24149
If <BAND>=20 24150 – 24449
If <BAND>=25 26040 – 26689
If <BAND>=26 26690 – 27039
If <BAND>=27 27040 – 27209
If <BAND>=28 27210 – 27659
If <BAND>=66 131972 – 132671
<POWER_LEVEL> Absolute output power. This is a mandatory parameter if

<ENABLE>=1, but is not allowed if <ENABLE>=0.
Range: 0 (0 dBm) to 2300 (23 dBm) for all bands
<TX_TYPE> defines the type of transmitted signal. This parameter is not allowed if
<ENABLE>=0.
0 SC-FDMA
1 CW (continuous waveform). For customers, which don’t have CMW tester but
only a spectrum analyzer.
<BANDWIDTH>
For SC-FDMA only, defines the bandwidth of Tx burst emissions. This parameter is not
allowed if <ENABLE>=0 or if <TX_TYPE>=1.
0 1.4M
Reference Notes
Sierra Wireless • Before using this command, it is necessary to verify that the configured LTE
Proprietary band(s) on which the module can operate is correctly set by using either
AT+KBNDCFG to read the configured band(s), or AT+KBNDCFG to set the
configured LTE band(s) .
• This command is not available if AT+WMRXPOWER is enabled.
• The module must be restarted after using this command.
Examples AT+WMTXPOWER=?
+WMTXPOWER: (0-1),(1,2,3,4,5,8,9,10,12,13,17,18,19,20,25,26,27,28,66),(18000–
18599,18600–19199,19200–19949,19950–20399,20400–20649,21450–21799,21800-
22149,22150-22749,23010–23179,23180–23279, 23730-23849,23850–23999,24000–
24149,24150–24449,26040-26689,26690–27039,27040-27209,27210–27659,131972-
132671),(0-2300),(0-1),(0)
OK
41111821 Rev 12 August 04, 2020 221

HL78xx
AT+WMTXPOWER=1,2,18600,2300,0,0 // A Tx is emitted at Earfcn 18600 with a

// power level of 23dbm and with a SC-FDMA
// Tx type and with a bandwidth of 1.4Mhz
OK
AT+WMTXPOWER=1,2,18600,2300,1 // A Tx is emitted at Earfcn 18600 with a

// power level of 23dbm and with a continuous
// waveform Tx type
OK
AT+WMTXPOWER=0
OK
11.2. +WMRXPOWER Command: Test RF Rx

HL78xx
Test command
Syntax Response
AT+ +WMRXPOWER: (list of supported <ENABLE>s),(list of supported <BAND>s), (list of
WMRXPOWER=? supported <CHANNEL>s)
OK
Read command
Syntax Response
AT+ +WMRXPOWER: <ENABLE>[,<BAND>,<CHANNEL>]
WMRXPOWER? OK
Note that parameters <BAND> and <CHANNEL> are only available if <ENABLE>=1.
Write command
Syntax Response
AT+ +WMRXPOWER: <POWER1>
WMRXPOWER= OK
<ENABLE>
[,<BAND>,
<CHANNEL>] Parameters
<ENABLE> 0 Stop the Rx measurement
1 Start the Rx measurement
<BAND> Rx band to read. This is a mandatory parameter if <ENABLE>=1, but is

not allowed if <ENABLE>=0.
1 Band 1
2 Band 2
3 Band 3
4 Band 4
5 Band 5
8 Band 8
9 Band 9
10 Band 10
12 Band 12
41111821 Rev 12 August 04, 2020 222

HL78xx
13 Band 13
17 Band 17
18 Band 18
19 Band 19
20 Band 20
25 Band 25
26 Band 26
27 Band 27
28 Band 28
66 Band 66
<CHANNEL> Rx channel to read. This is a mandatory parameter if <ENABLE>=1, but is

not allowed if <ENABLE>=0.
If <BAND>=1 0 – 599
If <BAND>=2 600 – 1199
If <BAND>=3 1200 – 1949
If <BAND>=4 1950 – 2399
If <BAND>=5 2400 – 2649
If <BAND>=8 3450 – 3799
If <BAND>=9 3800 – 4149
If <BAND>=10 4150 – 4749
If <BAND>=12 5010 – 5179
If <BAND>=13 5180 – 5279
If <BAND>=17 5730 – 5849
If <BAND>=18 5850 – 5999
If <BAND>=19 6000 – 6149
If <BAND>=20 6150 – 6449
If <BAND>=25 8040 – 8689
If <BAND>=26 8690 – 9039
If <BAND>=27 9040 – 9209
If <BAND>=28 9210 – 9659
If <BAND>=66 66436 – 67335
<POWER1> Received power at primary antenna in dBm

Reference Notes
Sierra Wireless • Before using this command, it is necessary to verify that the configured LTE
Proprietary band(s) on which the module can operate is correctly set by using either
AT+KBNDCFG to read the configured band(s), or AT+KBNDCFG to set the
configured LTE band(s).
• This command is not available if AT+WMTXPOWER is enabled.
• For Rx tests, the 2 followings waveforms can be applied to the UE antenna:
 a continuous waveform, in which case it is recommended to use a 1Mhz
offset to central frequency to avoid DC interference.
 an LTE signal, in which case it is recommended to use a continuous FDD
radio frame, which occupies all subcarriers including the ones dedicated
for PBCH/PSC/SSC.
41111821 Rev 12 August 04, 2020 223

HL78xx
Examples AT+WMRXPOWER=?
+WMRXPOWER: (0-1),(1,2,3,4,5,8,9,10,12,13,17,18,19,20,25,26,27,28,66),(0–599,600-
1199,1200–1949,1950-2399, 2400–2649,3450–3799,3800-4149,4150-4749,5010-
5179,5180–5279,5730-5849,5850–5999,6000–6149, 6150–6449,8040-8689,8690–
9039,9040-9209,9210–9659,66436-67335)
OK
AT+WMRXPOWER=1,4,1950 // Read Earfcn 1950

+WMRXPOWER: -95.0 // Rx power -95.0 dBm at antenna
OK
41111821 Rev 12 August 04, 2020 224

12. GNSS Commands
12.1. +GNSSSTART Command: Start or Restart the

GNSS Session
HL78xx
Test command
Syntax Response
AT+GNSSSTART +GNSSSTART: (list of supported <start_mode>s)
=? OK
Read command
Syntax Response
AT+GNSSSTART +GNSSSTART: <start_mode>
? OK
Write command
Syntax Response
AT+GNSSSTART OK
=<start_mode>
Parameter
<start_mode> Start mode requested/start mode of the last successfully initiated
GNSS session since power up
0 ‘AUTO’ START – All previous stored data is used. This is used for normal
operations.
1 ‘WARM’ START – For test purposes only. All previously stored data except
Ephemeris is used.
2 ‘COLD’ START – For test purposes only. No previous stored data except
Almanac and Extended Ephemeris is used. Time and last location are unknown.
3 ‘FACTORY’ START – For test purposes only. Uses no previously stored data.
Uses factory default data.
Notification +GNSSEV: 1,<status>
Parameter
0 The action has failed.
1 The action has been successfully completed
Reference Notes
Sierra Wireless • This command starts or restarts a GNSS session.
Proprietary • If no session was previously started, the read command returns
<start_mode> = 0.
• If a <start_mode> other than AUTO is selected, some or all previous location
information is forgotten by the module.
• Start modes other than AUTO are intended for test purposes only.
41111821 Rev 12 August 04, 2020 225

AT Commands Interface Guide GNSS Commands
HL78xx
Examples AT+GNSSSTART=1
OK
+GNSSEV: 1,1
// or
+GNSSEV: 1,0
AT+GNSSSTART=?
+GNSSSTART: (0-3)
OK
AT+GNSSSTART?
+GNSSSTART: 1 //The current starting mode is “WARM” start
OK
12.2. +GNSSSTOP Command: Stop the GNSS

Session
HL78xx
Test command
Syntax Response
AT+GNSSSTOP= OK
?
Read command
Syntax Response
AT+GNSSSTOP? +GNSSSTOP: <status>
OK
Execute command
Syntax Response
AT+GNSSSTOP OK
Parameter
<status> Status of the last AT+GNSSSTOP request
0 GNSS is still running
1 GNSS is stopped
Notification +GNSSEV: 2,<status>
Parameter
0 Action has failed
1 Action has been successfully completed
Reference Notes
Sierra Wireless • This command stops an ongoing GNSS session.
Proprietary • Execute command returns ERROR if user attempts to stop a session when
there is no session active.
41111821 Rev 12 August 04, 2020 226

HL78xx
Examples AT+GNSSSTOP
OK
+GNSSEV: 2,1
// or
+GNSSEV: 2,0
AT+GNSSSTOP=?
OK
12.3. +GNSSNMEA Command: Configure NMEA

Frames Flow
HL78xx
Test command
Syntax Response
AT+GNSSNMEA= +GNSSNMEA: (list of supported <output>s),(list of supported <rate>s),(list of supported
? <profile_mask>s),(list of supported <nmea_mask>s)
OK
Read command
Syntax Response
AT+GNSSNMEA +GNSSNMEA: <output>,<rate>,<profile_mask>,<nmea_mask>
? OK
Write command
Syntax Response
AT+GNSSNMEA= OK
[<output>],
[<rate>],[[<profile Parameters
_mask>],
<nmea_mask>] <output> Specifies the port which will be used by the application to transmit NMEA
frames.
0x00 NMEA frames are not output
0x01 NMEA frames are output on dedicated NMEA port over USB
0x03 NMEA frames are output on UART1
0x04 NMEA frames are output on the same port the +GNSSNMEA was received on.
0x05 NMEA frames are output on CMUX DLC1
Same output is applicable to all NMEA profiles. If omitted, the last requested output will
be used.
<rate> Specifies the rate at which the NMEA sentences are output on the requested port
in milliseconds. Same rate is applicable to all NMEA profiles. If omitted, the last
requested rate will be used.
41111821 Rev 12 August 04, 2020 227

HL78xx
<profile_mask> Specifies the NMEA profiles (Talker ID) for which the requested
NMEA sentences mask shall be applied such as GP, GL, GA, GN etc.
Range:
0 All supported NMEA profiles; the requested NMEA mask will be applied to all
sentences
<nmea_mask> Defines the list of NMEA sentences to be enabled as a bit mask. A

sentence is enabled if its bit position is set to 1 and disable if it’s set to 0.
Bit 0 – GGA
Bit 1 – GSA
Bit 2 – GSV
Bit 3 – RMC
Bit 4 – VTG
Bit 5 – GNS
Bit 6 – GST
Bit 7 – GLL
Bit 8 – ZDA
Bit 9 – GRS
Bit 10 – DTM
Reference Notes
Sierra Wireless • This command configures the enabled NMEA sentences, NMEA output rate
Proprietary and the output port.
• The command can be used to configure multiple profiles using a single
command with the profiles as a bitmask. A profile is enabled if its bit position is
set to 1. If the profile mask is 0 or omitted, the requested NMEA mask will be
applied to all sentences.
If a requested NMEA sentence is supported only for some but not all profiles,
the command will simply ignore these sentences for the profiles for which it’s
not supported, i.e. the command will not return ERROR. For example, if a single
command is requested to enable GPGSA and GAGSA but the device only
supports GPGSA, the command will only enable GPGSA and GAGSA will be
ignored.
• When this command is issued for output 4, the current port will switch to DATA
mode. +++ can be sent on the port to switch back to command mode.
Examples AT+GNSSNMEA=?
+GNSSNMEA: (0,3-8),(1000),(0),(1FF)
OK
AT+GNSSNMEA?
+GNSSNMEA: 4,1000,0,1FF
OK
AT+GNSSNMEA=1,1000,0,1FF
OK
//or
+CME ERROR:<error>
AT+GNSSNMEA=,,,1FF
OK
//or
+CME ERROR:<error>
41111821 Rev 12 August 04, 2020 228

HL78xx
AT+GNSSNMEA=0,1000
OK
//or
+CME ERROR:<error>
AT+GNSSNMEA=4
CONNECT
$GPGGA,235436.00,4910.3542,N,12304.2419,W,0,00,1.2,-0.4,M,-17.6,M,,*7B
$GPGSA,A,1,,,,,,,,,,,,,2.1,1.2,1.7*36
$GPGGA,235437.00,4910.3542,N,12304.2419,W,0,00,1.2,-0.4,M,-17.6,M,,*7A
$GPGSA,A,1,,,,,,,,,,,,,2.1,1.2,1.7*36
$GPGGA,235438.00,4910.3542,N,12304.2419,W,0,00,1.2,-0.4,M,-17.6,M,,*75
$GPGSA,A,1,,,,,,,,,,,,,2.1,1.2,1.7*36
$GPGGA,235439.00,4910.3542,N,12304.2419,W,0,00,1.2,-0.4,M,-17.6,M,,*74
$GPGSA,A,1,,,,,,,,,,,,,2.1,1.2,1.7*36
// +++ received here
OK
AT+GNSSNMEA=
OK
12.4. +GNSSCONF Command: Configure the

Location Service and GNSS Receiver
HL78xx
Test command
Syntax Response
AT+GNSSCONF= +GNSSCONF: <config_type>,(list of supported <config_value_1>s)
? [+GNSSCONF: <config_type>,(list of supported <config_value_1>s)]
OK
Read command
Syntax Response
AT+GNSSCONF? +GNSSCONF: <config_type>,<config_value_1>
[+GNSSCONF: <config_type>,<config_value_1>]
OK
Write command
Syntax Response
AT+GNSSCONF= OK
<config_type>,
<config_value_ Parameters
1>
<config_type> Specifies the configuration on which the configuration value is
applied
1 Sets the LNA type
10 Configures enabled satellite constellations (GPS, GLONASS)
41111821 Rev 12 August 04, 2020 229

HL78xx
<config_value_1> Requested value 1 of the configuration type

For <config_type>=1:
0 LNA_EN output signal is always OFF
1 LNA_EN output signal is automatically driven
For <config_type>=10:
0 GPS only
1 GPS and GLONASS
Reference Notes
Sierra Wireless This command configures various GNSS configurations such as satellite constellations.
Proprietary
Examples AT+GNSSCONF=?
+GNSSCONF: 1,(0-1)
+GNSSCONF: 10,(0-1)
OK
AT+GNSSCONF?
+GNSSCONF: 1,0
+GNSSCONF: 10,0
OK
AT+GNSSCONF=1,1
OK
AT+GNSSCONF=10,0
OK
// or
+CME ERROR: <error>
12.5. +GNSSTTFF Command: Report Calculated

TTFF of the Last Run
HL78xx
Test command
Syntax Response
AT+GNSSTTFF= OK
?
Read command
Syntax Response
AT+GNSSTTFF? +GNSSTTFF: <2D_time>,<3D_time>
OK
Parameters
<2D_time> 2-dimensional position time to first fix, defined in ms
<3D_time> 3-dimensional position time to first fix, defined in ms
41111821 Rev 12 August 04, 2020 230

HL78xx
Reference Notes
Sierra Wireless • This command queries the 2D and/or 3D time to first fix.
Proprietary • When the TTFF of 2D vs 3D is not available, the same TTFF value is returned
for both 2D and 3D.
Examples AT+GNSSTTFF?
+GNSSTTFF: 32051,32051
OK
// or
+CME ERROR: <error>
AT+GNSSTTFF?
+GNSSTTFF: -30,-30 //The current run is not fixed or TTFF is not available
OK
AT+GNSSTTFF=?
OK
12.6. +GNSSLOC Command: Report Latest Known

Position Fix
HL78xx
Test command
Syntax Response
AT+GNSSLOC=? OK
Read command
Syntax Response
AT+GNSSLOC? +GNSSLOC:
Latitude: <latitude>
Longitude: <longitude>
GpsTime: <GPS Time>
FixType: <fix_type>
HEPE: <hepe>
Altitude: <altitude>
AltUnc: <Altitude uncertainty>
Direction: <Heading direction>
HorSpeed: <horizontal speed>
VerSpeed: <vertical speed>
OK
// or
+GNSSLOC:
FIX NOT AVAILABLE
OK
Parameters
<latitude> Latitude at last position fix. Example: “49 Deg 10 Min 21.49 Sec N
41111821 Rev 12 August 04, 2020 231

HL78xx
<longitude> Latitude at last position fix. Example: “123 Deg 4 Min 14.76 Sec W
<GPS Time> GPS time and date of the fix in “yyyy mm dd hh:mm:ss” format.
Example: “2009 01 30 4 20:27:18”
<FixType> Fix type 2D or 3D

2D 2-dimensional
3D 3-dimensional
<HEPE> Horizontal Estimated Position Error. Example: “8.485 m”
<altitude> Altitude in meters. Example: “-1 m”
<Altitude uncertainty> Altitude/vertical uncertainty. Example: “3.0 m”
<heading direction> Direction the UE is headed. Example: “0.0 deg”
<horizontal speed> Horizontal velocity in m/s. Example: “0.0 m/s”
<vertical speed> Vertical velocity in m/s. Example: “0.0 m/s”

Reference Notes
Sierra Wireless • Queries the latest known position fix (even if it’s not current).
Proprietary • If the value for any field is not available, it will be left blank.
Examples AT+GNSSLOC?
+GNSSLOC:
Latitude: 49 Deg 10 Min 23.88 Sec N
Longitude: 123 Deg 4 Min 8.64 Sec W
GpsTime: 2018 12 11 1 00:02:23
FixType: 3D
HEPE: 129.711 m
Altitude: -29 m
AltUnc: 104.4 m
Direction: 0.0 deg
HorSpeed: 0.0 m/s
VerSpeed: 0.0 m/s
OK
// or
FIX NOT AVAILABLE
41111821 Rev 12 August 04, 2020 232

12.7. +GNSSEV Notifications: Location Service

Events Notification
HL78xx
Notification +GNSSEV: <eventType>,<eventStatus>
Parameters
<eventType> Event type
0 Initialization event
1 GNSS START event
2 GNSS STOP event
3 GNSS Position event
<eventStatus> Event status. Valid range varies depending on the event type.
Initialization event (<eventType>= 0):
This event specifies the status of internal GNSS context initialization.
0 GNSS Initialization failed
1 GNSS is successfully initialized
GNSS START event (<eventType>=1):

0 GNSS failed to start
1 GNSS started
GNSS STOP event (<eventType>=2):

0 GNSS failed to stop
1 GNSS stopped
GNSS Position events (<eventType>=3):

0 The GNSS fix is lost or not available yet
1 An estimated GNSS (predicted) position is available
2 A 2-dimensional GNSS position is available
3 A 3-dimensional position is available
4 GNSS fix has been changed to invalid position
Reference Notes
Sierra Wireless • Notifies the client of any events or change in position state.
Proprietary • This is not a command that can be issued to the device.
41111821 Rev 12 August 04, 2020 233

13. NV Commands
13.1. Auto Generation of NV Backup Files

There are 3 NV partitions in flash used by the Firmware:
• Static calibrated partition
• Static config parameters partition
• Dynamic default parameters partition
The NV backup feature only backs up calibrated and static config partitions together. The dynamic
partition is never backed up, although it is reset to the default configuration when a backup recovery is
performed.
The firmware automatically generates NV backup files from existing NV data (calibration and static
config parameters only) at ~6 seconds after boot if one of the following conditions is met:
• NV backup does not exist.
• NV backup has been corrupted unexpectedly.
An automatic backup file generation is notified with +NVBU_IND with <status>=0 on all AT ports.
13.2. Auto Recovery from NV Backup Files

NV recovery is automatically done if an NV corruption is detected during NV initialization at boot.
The firmware automatically recovers NV data from available NV backup when:
• The calibrated partition is corrupted.
• The static config partition is corrupted.
• A file in the dynamic partition is missing.
This is notified with +NVBU_IND with <status>=3 on all AT ports.

Manual NV data restores all data from the backup file to the original NV partition.
If the modem firmware crashes with 10 consecutive loops and a full restore has not been performed
before, the firmware performs a full restore of all NV data items. Only consecutive crashes that
happened within 12 seconds after the module boots are relevant for this reset loop detection.
41111821 Rev 12 August 04, 2020 234

AT Commands Interface Guide NV Commands
13.3. +NVBU Command: NV Backup Status and

Control
HL78xx
Test command
Syntax Response
AT+NVBU=? +NVBU: (0-4)
OK
Read command Returns list of NV backup with the format:
+NVBU: <file id>,<backup date>,<backup firmware version>
Syntax Response
AT+NVBU? [+NVBU:0,<backup date>,<backup firmware version>]
OK
Error case
ERROR when no backup available
Parameters
<file id> Backup file ID corresponding to one NV partition in non-volatile memory
<backup date> Generation date of the NV backup
<backup firmware version> Firmware version used to generate the NV backup

Write command
Syntax Response
For <mode>=0 or For <mode>=0 or 1:
1: OK
AT+NVBU=
<mode>
[,<parti_id>]
For <mode>=2: For <mode>=2 and <clear>=0:

AT+NVBU= <log data 0>
<mode>[,<clear>] [<log data 1>]
…
[<log data n>]
OK
For <mode>=2 and <clear>=1:

OK
For <mode>=3: For <mode>=3:

AT+NVBU= OK
<mode>[,<auto>]
For <mode>=4: For <mode>=4:

AT+NVBU= OK
<mode>
41111821 Rev 12 August 04, 2020 235

HL78xx
Parameters
<mode> 0 Generate backup of both static calibrated and static config NV data
to NV backup partition
1 Restore all NV data from the NVM backup partition and default
dynamic parameters
2 List logs of NV backup operations
3 Configure NVBU mode (manual or automatic)
4 Erase all NV backup logs
<log data> NV backup operations log data
<parti_id> 0 Static calibrated and static config NV

1 Same as 0; for retro compatibility purposes only
<clear log> 0 Read log

1 Clear log
<auto> 0 +NVBU operates in manual mode (Default)

1 +NVBU operates in automatic mode
41111821 Rev 12 August 04, 2020 236

HL78xx
Notification +NVBU_IND:<status>,<file id>,<errcode>
For <status>=0:
+NVBU_IND:<status>,<file id>,<errcode>,<backup date>,<backup firmware
version>
For <status>=1 and 2:

+NVBU_IND:<status>,<file id>,<errcode>,<cause>,<backup date used for
restoration>,<backup firmware version used for restoration>
Parameters
<status> NV backup status
0 NV backup generation
1 NV backup restoration
2 Backup data restored (when NV corruption is detected during NV initialization)
<errcode> Error code

0 No error
1 General error
2 Reserved
3 Flash erase error
4 Backup file corrupted
5 Flash read / write error
<cause> Root cause

0 User request
1 Modem firmware problem
2 Whole NV partition structure corrupted
3 NV Calibrated partition corrupted
4 NV Static config partition corrupted
5 NV dynamic parameter missing
<backup date> NV backup generation date
<backup firmware version> Firmware version used to generate the NV backup
<backup date used for restoration> Generation date of the NV backup that was
used for the NV restore
<backup firmware version used for restoration> Firmware version used to

generate the NV backup that was used for the NV restore
41111821 Rev 12 August 04, 2020 237

HL78xx
Examples # automatic backup files generation, notified by +NVBU_IND

+NVBU_IND: 0,0,0,"2015/07/22-04:23:33","
BHL78xx.1.7.12.0.RK_02_00_00_00_82.20181213"
# manual generation of backup files from existing NV partitions

AT+NVBU=0,3
OK
+NVBU_IND: 0,0,0,"2015/07/22 04:23:39","
BHL78xx.1.7.12.0.RK_02_00_00_00_82.20181213"
# manual restoration of backup files to original NV partitions

AT+NVBU=1,3
OK
+NVBU_IND: 1,0,0,0,"2015/07/22 04:23:39","
BHL78xx.1.7.12.0.RK_02_00_00_00_82.20181213"
<module reboots automatically>
# to retrieve the list of NV related operations done by the Firmware

at+nvbu=2
[15/07/22 04:23:39-0] Creating backup
NVB generation success - backup id: 0 - date: 15/07/22 04:23:39-0 - version:
BHL78xx.1.7.12.0.RK_02_00_00_00_82.20181213
[15/07/22 04:25:00-0] Restoring backup id 0
Backup entry found. Date: 15/07/22 04:23:39-0 - version:
BHL78xx.1.7.12.0.RK_02_00_00_00_82.20181213
Backup restore success.
Reference Notes
Sierra Wireless • Status of operations for <mode>=0 and <mode>=1 is notified by +NVBU_IND
Proprietary unsolicited notifications with <status>=0 and <status>=1 respectively on the AT
port that executed the write command.
• Execution of the write command with <mode>=1 is followed by a modem reboot
automatically; NVs are restored to their default values during the boot
sequence.
• The log file is limited to 4ko.
• No SIM card is required for this command.
• The backup date and the backup firmware are displayed only when available
(i.e. backup not corrupted).
• <mode>=2 is for retrieving log for R&D analysis and not fully documented.
41111821 Rev 12 August 04, 2020 238

14. Appendix
14.1. Command Timeout and Other Information

The following table provides additional information for commands supported by the HL78xx modules.
Cells in the following table are color-coded to indicate the recommended timeout for AT commands;
note that time is subject to change depending on several factors such as SIM cards, networks or
amount of data to be written in non-volatile memory.
Legend:
2 seconds
5 seconds
30 seconds
60 seconds
120 seconds
No advised timeout: Data size dependent
 Command can be written in non-volatile memory
Table 4. Command Timeout
Chapter Command Description HL78xx
V25TER AT Commands
2.1 +++ Command: Switch from Data Mode to Command Mode 2
2.2 O Command: Switch from Command Mode to Data Mode 2
2.3 E Command: Enable Command Echo 2
2.4 &K Command: Flow Control Option 2
2.5 &F Command: Restore Manufactory Configuration 2
2.6 &V Command: Display Current Configuration 2
2.7 &W Command: Save Stored Profile  30
2.8 Z Command: Reset and Restore User Configuration 5
2.9 +IPR Command: Set Fixed Local Rate  2
2.10 &C Command: Set Data Carrier Detect (DCD) Function Mode 2
2.11 &D Command: Set Data Terminal Ready (DTR) Function Mode 2
2.12 &S Command: DSR Option 2
2.13 &R Command: RTS/CTS Option 2
2.14 S2 Command: Set Character for the Escape Sequence (Data to Command Mode) 2
2.15 S4 Command: Set Response Formatting Character 2
2.16 +IFC Command: DTE-DCE Local Flow Control 2
General AT Commands
3.1 I Command: Request Identification Information 2
3.2 +CGMI/+GMI Command: Request Manufacturer Identification 2
3.3 +CGMM/+GMM Command: Request Model Identification 2
3.4 +CGMR/+GMR Command: Request Revision Identification 2
3.5 +CGSN Command: Request Product Serial Number Identification (IMEI) 2
41111821 Rev 12 August 04, 2020 239

AT Commands Interface Guide Appendix
+KGSN Command: Request Product Serial Number Identification and Software

3.6 2
Version
3.7 +CSCS Command: Set TE Character Set  2
3.8 +CIMI Command: Request International Subscriber Identity 2
3.9 +GSN Command: Request Product Serial Number Identification (IMEI) 2
3.10 +GCAP Command: Request Complete TA Capability List 2
3.11 +CMUX Command: Multiplexer 2
3.12 +WPPP Command: PDP Context Authentication Configuration 2
3.13 +HWREV Command: Request Hardware Revision 2
3.14 +KALTCFG: Set and Get Custom Configuration 2
3.15 +KHWIOCFG: Enable and Disable IO Features 2
3.16 +WDSD Command: Device Services Local Download 2
Call Control Commands
4.2 +CEER Command: Extended Error Report 2
4.3 +CMEE Command: Report Mobile Termination Error  2
Mobile Equipment Control and Status Commands
5.1 +CCLK Command: Real Time Clock 30
5.2 +CCID Command: Request SIM Card Identification 2
5.3 +CLAC Command: List All Available AT Commands 2
5.4 +CFUN Command: Set Phone Functionality 30
5.5 +CPIN Command: Enter PIN 60
5.6 +CPAS Command: Phone Activity Status 2
5.7 +CSQ Command: Signal Quality 2
5.8 +KSREP Command: Mobile Start-Up Reporting  2
5.9 +CSIM Command: Generic SIM Access 5
5.10 +CCHO Command: Open Logical Channel 5
5.11 +CCHC Command: Close Logical Channel 5
5.12 +CRSM Command: SIM Restricted Access 5
5.13 +CTZU Command: Automatic Time Zone Update  2
5.14 +CTZR Command: Time Zone Reporting  2
5.15 +CPSMS Command: Power Saving Mode setting 2
5.16 +CEDRXS Command: eDRX setting 2
5.17 +CEDRXRDP Command: eDRX Read Dynamic Parameters 5
5.18 +CESQ Command: Extended Signal Quality 2
5.19 +KBNDCFG Command: Set Configured LTE Band(s)  2
5.20 +KBND Command: Get Active LTE Band(s)  2
5.21 +KGPIO Command: Hardware IO Control  2
5.22 +KGPIOCFG Command: User GPIO Configuration  2
5.23 +KCELL Command: Cell Environment Information 30
5.24 +KSLEEP Command: Power Management Control  2
5.25 +KRIC Command: Ring Indicator Control 2
5.26 +CPOF Command: Power Off 120
5.27 +CPWROFF Command: Power Off 120
5.27 +CPWROFF Command: Power Off (when +CPWROFF=1) 2
41111821 Rev 12 August 04, 2020 240

5.28 +WIMEI Command: IMEI Write and Read  2

5.29 +KSYNC Command: Application Synchronization Signal  2
5.30 +KCARRIERCFG Command: Set operator  5
5.31 +KMON Command: Enable/Disable Monitor Mode  2
5.32 +KSRAT Command: Set Radio Access Technology  2
5.33 +KNWSCANCFG Command: Configure Network Scan Policy  2
5.34 +CRCES Command: Read Coverage Enhancement Status  2
5.35 +KADC Command: Analog Digital Converter 2
5.36 +WESHDOWN Command: Emergency Shutdown  2
5.37 +KCELLMEAS Command: Request Network Coverage Information 30
5.38 +KSIMSEL Command: SIM Selection
5.39 +KSIMDET Command: SIM Detection
5.40 +KUSBCOMP Command: Enable/Disable USB Mode
5.41 +KTEMPMON Command: Temperature Monitor 
5.42 +KCIOTOPT Command: UE Network Capability Information Configuration 
5.43 +KEDRXCFG Command: Configure eDRX 
5.44 +KSELACQ Command: Configure Preferred Radio Access Technology List (PRL) 
Network Service Related Commands
6.2 +CPWD Command: Change Password 2
6.3 +COPN Command: Read Operator Name 30
6.4 +COPS Command: Operator Selection 120
6.5 +CPOL Command: Preferred PLMN List  2
6.6 +CREG Command: Network Registration  2
6.7 +CPLS Command: Selection of Preferred PLMN List 2
6.8 +CEREG Command: EPS Network Registration Status  2
6.9 +CEMODE Command: UE Modes of Operation for EPS 2
6.10 +CNUM Command: Subscriber Number
SMS AT Commands
7.2 +CMGD Command: Delete SMS Message 2
7.3 +CMGF Command: Select SMS Message Format  2
7.4 +CMGL Command: List SMS Messages from Preferred Storage 30
7.5 +CMGR Command: Read SMS Message 30
7.6 +CMGS Command: Send SMS Message 30
7.7 +CMGW Command: Write SMS Message to Memory 30
7.8 +CMSS Command: Send SMS Message from Storage 30
7.9 +CNMI Command: New SMS Message Indication  2
7.10 +CSCA Command: SMS Service Center Address  2
7.11 +CSMP Command: Set SMS Text Mode Parameters 2
7.12 +CSMS Command: Select Message Service 2
7.13 +CPMS Command: Preferred Message Storage 2
7.14 +CSDH Command: Show Text Mode Parameters 2
7.15 +CMT Notification: Received SMSPP Content 2
41111821 Rev 12 August 04, 2020 241

Packet Domain Commands

8.1 +CGATT Command: PS Attach or Detach 60
8.2 +CGACT Command: PDP Context Activate or Deactivate 60
8.3 +CGCMOD Command: Modify PDP Context 60
8.4 +CGTFT Command: Traffic Flow Template
8.5 +CGDCONT Command: Define PDP Context 5
8.6 +CDGSCONT Command: Define Secondary PDP Context
8.7 +CGEREP Command: GPRS Event Reporting  2
8.10 +CGPADDR Command: Show PDP Address 2
8.11 +CGSMS Command: Select Service for MO SMS Messages 2
8.12 +CSODCP Command: Send Originating Data via the Control Plane 2
8.13 +CRTDCP Command: Report Terminating Data via the Control Plane 2
8.14 +KNMPSD Command: No More PS Data
Protocol Specific Commands – Connection Configuration
9.7.1 +KCNXCFG Command: GPRS Connection Configuration 2
9.7.2 +KCNXTIMER Command: Connection Timer Configuration 2
9.7.3 +KCNXPROFILE Command: Connection Current Profile Configuration 2
9.7.4 +KCGPADDR Command: Show PDP Address 2
9.7.5 +KCNX_IND Notification: Connection Status Notification 2
9.7.6 +KCNXUP Command: Bring the PDP Connection Up
9.7.7 +KCNXDOWN Command: Bring the PDP Connection Down
Protocol Specific Commands – Common Configuration
9.8.1 +KPATTERN Command: Custom End Of Data Pattern 2
9.8.2 +KURCCFG Command: Enable or Disable the URC from TCP Commands 2
9.8.3 +KIPOPT Command: General Options Configuration
TCP Specific Commands
9.11.1 +KTCPCFG Command: TCP Connection Configuration 2
9.11.2 +KTCPCNX Command: TCP Connection 30
9.11.3 +KTCPRCV Command: Receiving Data through a TCP Connection 60
9.11.4 +KTCPSND Command: Sending Data through a TCP Connection 60
9.11.5 +KTCPCLOSE Command: Closing Durrent TCP Operation 60
9.11.6 +KTCPDEL Command: Delete a Configured TCP Session 2
9.11.7 +KTCP_SRVREQ Notification: Incoming client’s connection request 2
9.11.8 +KTCP_DATA Notification: Incoming Data through a TCP Connection 60
9.11.9 +KTCP_IND Notification: TCP Status 2
9.11.10 +KTCPSTAT Command: Get TCP Socket Status 2
9.11.11 +KTCPSTART Command: Start a TCP Connection in Direct Data Flow 2
9.11.12 +KTCP_ACK Notification: Status Report for Latest TCP Data Session
UDP Specific Commands
9.12.1 +KUDPCFG Command: UDP Connection Configuration 2
9.12.2 +KUDPRCV Command: Receive data through an UDP Connection 60
41111821 Rev 12 August 04, 2020 242

9.12.3 +KUDPSND Command: Send data through an UDP Connection 60

9.12.4 +KUDPCLOSE Command: Close current UDP operation 60
9.12.5 +KUDPDEL Command: Delete a Configured UDP Session
9.12.6 +KUDP_IND Notification: UDP Status
9.12.7 +KUDP_DATA Notification: Incoming data through a UDP Connection
HTTP Client Specific Commands
9.13.1 +KHTTPCFG Command: HTTP Connection Configuration
9.13.2 +KHTTPCNX Command: Start HTTP Connection
9.13.3 +KHTTPHEADER Command: Set HTTP Request Header
9.13.4 +KHTTPGET Command: Get HTTP Server Information
9.13.5 +KHTTPHEAD Command: Get HTTP Headers
9.13.6 +KHTTPPOST Command: Send Data to HTTP Server
9.13.7 +KHTTP_IND Notification: HTTP Status
9.13.8 +KHTTPCLOSE Command: Close HTTP Connection
9.13.9 +KHTTPDEL Command: Delete a Configured HTTP Connection
9.13.10 +KHTTPPUT Command: Perform HTTP PUT
9.13.11 +KHTTPDELETE Command: Perform HTTP Delete
FTP Client Specific Commands
9.14.1 +KFTPCFG Command: FTP Connection Configuration
9.14.2 +KFTPCNX Command: Start FTP Connection
9.14.3 +KFTPRCV Command: Receive FTP Files
9.14.4 +KFTPSND Command: Send FTP Files
9.14.5 +KFTPDEL Command: Delete FTP Files
9.14.6 +KFTP_IND Notification: FTP Status
9.14.7 +KFTPCLOSE Command: Close Current FTP Connection
9.14.8 +KFTPCFGDEL Command: Delete a Configured FTP Session
9.14.9 +KFTPLS Command: List File Size of a Specific File
AVMS Commands
10.1 +WDSC Command: Device Services Configuration 2
10.2 +WDSE Command: Device Services Eerror 2
10.3 +WDSG Command: Device Services General Status 2
10.4 +WDSI Command: Device Services Indications 2
10.5 +WDSR Command: Device Services Reply 2
10.6 +WDSS Command: Device Services Session 2
10.7 +WDSTPF Command: Device Services Third Party FOTA
Test Commands
11.1 +WMTXPOWER Command: Test RF Tx
11.2 +WMRXPOWER Command: Test RF Rx
GNSS Commands
12.1 +GNSSSTART Command: Start or Restart the GNSS Session
12.2 +GNSSSTOP Command: Stop the GNSS Session
12.3 +GNSSNMEA Command: Configure NMEA Frames Flow
12.4 +GNSSCONF Command: Configure the Location Service and GNSS Receiver
41111821 Rev 12 August 04, 2020 243

12.5 +GNSSTTFF Command: Report Calculated TTFF of the Last Run

12.6 +GNSSLOC Command: Report Latest Known Position Fix
12.7 +GNSSEV Notifications: Location Service Events Notification
NV Commands
13.3 +NVBU Command: NV Backup Status and Control
14.2. Result Codes and Unsolicited Messages

Verbose Result Code Numeric Type Description
+CME ERROR: <err> Like verbose Final

+CMS ERROR: <err> Like verbose Final or unsolicited
+CBM Like verbose Unsolicited
+CDS Like verbose Unsolicited
+COLP: <number>,<type>
Like verbose Intermediate
[,<subaddr>,<satype>[,<alpha>]]
+CR: <type> Like verbose Intermediate
+CREG: <stat>[,<lac>,<ci>] Like verbose Unsolicited
BUSY 6 Final
Connection has been
CONNECT 1 Intermediate
established
Like CONNECT but
Manufacturer manufacturer specific <text>
CONNECT <text> Intermediate
specific gives additional information
(e.g. connection data rate)
ERROR 4 Final Command not accepted
NO ANSWER 7 Final Connection completion timeout
NO CARRIER 3 Final Connection terminated
Acknowledges execution of a
OK 0 Final
command line
Incoming call signal from
RING 2 Unsolicited
network
14.3. Error Codes
14.3.1. CME Error Codes
<err> Code Meaning
0 Phone failure
1 No connection to phone
2 Phone-adapter link reserved
3 Operation not allowed
41111821 Rev 12 August 04, 2020 244

<err> Code Meaning
4 Operation not supported

5 PH-SIM PIN required
6 PH-FSIM PIN required
7 PH-FSIM PUK required
10 SIM not inserted
11 SIM PIN required
12 SIM PUK required
13 SIM failure
14 SIM busy
15 SIM wrong
16 Incorrect password
17 SIM PIN2 required
18 SIM PUK2 required
20 Memory full
21 Invalid index
22 Not found
23 Memory failure
24 Text string too long
25 Invalid characters in text string
26 Dial string too long
27 Invalid characters in dial string
30 No network service
31 Network timeout
32 Network not allowed - emergency call only
40 Network personalization PIN required
41 Network personalization PUK required
42 Network subset personalization PIN required
43 Network subset personalization PUK required
44 Service provider personalization PIN required
45 Service provider personalization PUK required
46 Corporate personalization PIN required
47 Corporate personalization PUK required
48 Hidden key required
49 EAP method not supported
50 Incorrect parameters
60 Internal system failure
99 Resource limitation
100 Unknown
103 Illegal MS
106 Illega lME
107 GPRS services not allowed
111 PLMN not allowed
112 Location area not allowed
113 Roaming not allowed in this location area
41111821 Rev 12 August 04, 2020 245

<err> Code Meaning
132 Service option not supported

133 Requested service option not subscribed
134 Service option temporarily out of order
148 Unspecified GPRS error
149 PDP authentication failure
150 Invalid mobile class
201 Alternate SIM conflict
500 CTS Handover on Progress
501 Cellular Protocol Stack Out of service state
502 CTS Unspecified Error
650 General AVMS error
651 Communication error
652 Session in progress
654 RDMS services are in “deactivated” state
655 RDMS services are in “prohibited” state
656 RDMS services are in “to be provisioned” state; no available NAP
800 SIM Security unspecified error
902 No more sockets available; the maximum number has been reached
903 Memory problem
904 DNS error
905 TCP disconnection by the server
906 TCP/UDP connection error
907 Generic error
908 Fail to accept client request's
909 Data send by KTCPSND/KUDPSND are incoherent
910 Bad session ID
912 No more sessions can be used (maximum session is 6)
913 Socket connection timer timeout
914 Control socket connection timer timeout
915 A parameter is not expected
916 A parameter has an invalid range of values
917 A parameter is missing
918 Feature is not supported
919 Feature is not available
920 Protocol is not supported
921 Error due to invalid state of bearer connection
922 Error due to invalid state of session
923 Error due to invalid state of terminate port data mode
924 Error due to session busy, retry later
925 Failed to decode HTTP header's name, missing ':'
926 Failed to decode HTTP header's value, missing 'cr/lf'
927 HTTP header's name is an empty string
928 HTTP header's value is an empty string
41111821 Rev 12 August 04, 2020 246

<err> Code Meaning
929 Format of input data is invalid

930 Content of input data is invalid or not supported
931 The length of a parameter is invalid
932 The format of a parameter is invalid
14.3.2. CEER Error Codes
<report>
IMSI_UNKNOWN_IN_HLR
ILLEGAL_UE
ILLEGAL_ME
EPS_SERVICES_NOT_ALLOWED
EPS_AND_NON_EPS_SERVICES_NOT_ALLOWED
UE_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK
IMPLICITLY_DETACHED
PLMN_NOT_ALLOWED
TRACKING_AREA_NOT_ALLOWED
ROAMING_NOT_ALLOWED_IN_THIS_TRACKING_AREA
EPS_SERVICES_NOT_ALLOWED_IN_THIS_PLMN
NO_SUITABLE_CELLS_IN_TRACKING_AREA
MSC_TEMPORARILY_NOT_REACHABLE
NETWORK_FAILURE
CS_DOMAIN_NOT_AVAILABLE
MAC_FAILURE
SYNCH_FAILURE
CONGESTION
UE_SECURITY_CAPABILITIES_MISMATCH
SECURITY_MODE_REJECTED_UNSPECIFIED
NOT_AUTHORIZED_FOR_THIS_CSG
SEMANTICALLY_INCORRECT_MESSAGE
INVALID_MANDATORY_INFORMATION
MESSAGE_TYPE_NON_EXISTENT
MESSAGE_TYPE_NOT_COMPATIBLE_WITH_THE_PROTOCOL_STAT
INFORMATION_ELEMENT_NOT_EXISTENT
CONDITIONAL_IEI_ERROR
MESSAGE_NOT_COMPATIBLE_WITH_THE_PROTOCOL_STATE
PROTOCOL_ERROR_UNSPECIFIED
OPERATOR_DETERMINED_BARRING
INSUFFICIENT_RESOURCES
UNKNOWN_OR_MISSING_APN
UNKNOWN_PDN_TYPE
USER_AUTHENTICATION_FAILED
41111821 Rev 12 August 04, 2020 247

<report>
ACTIVATION_REJECTED_BY_SERVING_GW_OR_PDN_GW
ACTIVATION_REJECTED_UNSPECIFIED
SERVICE_OPTION_NOT_SUPPORTED
REQUESTED_SERVICE_OPTION_NOT_SUBSCRIBED
SERVICE_OPTION_TEMPORARILY_OUT_OF_ORDER
PTI_ALEARDY_IN_USE
REGULAR_DEACTIVATION
EPS_QoS_NOT_ACCEPTED
NETWORK_FAILURE
FEATURE_NOT_SUPPORTED
SEMANTIC_ERROR_IN_THE_TFT_OPERATION
SYNTACTICAL_ERROR_IN_THE_TFT_OPERATION
UNKNOWN_EPS_BEARER_CONTEXT
SEMANTIC_ERRORS_IN_PACKET_FILTERS
SYNTACTICAL_ERRORS_IN_PACKET_FILTERS
EPS_BEARER_CONTEXT_WITHOUT_TFT_ALREADY_ACTIVATED
PTI_MISMATCH
LAST_PDN_DISCONNECTION_NOT_ALLOWED
PDN_TYPE_IPV4_ONLY_ALLOWED
PDN_TYPE_IPV6_ONLY_ALLOWED
SINGLE_ADDRESS_BEARERS_ONLY_ALLOWED
ESM_INFORMATION_NOT_RECEIVED
PDN_CONNECTION_DOES_NOT_EXIST
MULTIPLE_PDN_CONNECTIONS_FOR_APN_NOT_ALLOWED
COLLISION_WITH_NETWORK_REQUEST
INVALID_PTI_VALUE
ESM_SEMANTICALLY_INCORRECT_MESSAGE
ESM_INVALID_MANDATORY_INFORMATION
MESSAGE_TYPE_NON_EXISTENT_OR_NOT_IMPLEMENTED
MESSAGE_TYPE_NOT_COMPATIBLE_WITH_THE_PROTOCOL_STATE
INFORMATION_ELEMENT_NON_EXISTENT_OR_NOT_IMPLEMENTED
CONDITIONAL_IE_ERROR
ESM_MESSAGE_NOT_COMPATIBLE_WITH_THE_PROTOCOL_STATE
ESM_PROTOCOL_ERROR_UNSPECIFIED
APN_RESTRICTION_VALUE_INCOMPATIBLE_WITH_ACTIVE_EPS_BEARER_CONTEXT
14.3.3. CMS Error Codes
<err> Code Meaning
1 Unassigned (unallocated) number

8 Operator determined barring
10 Call barred
41111821 Rev 12 August 04, 2020 248

<err> Code Meaning
21 Short message transfer rejected

27 Destination out of service
28 Unidentified subscriber
29 Facility rejected
30 Unknown subscriber
38 Network out of order
41 Temporary failure
42 Congestion
47 Resources unavailable, unspecified
50 Requested facility not subscribed
69 Requested facility not implemented
81 Invalid short message transfer reference value
95 Invalid message, unspecified
96 Invalid mandatory information
97 Message type non-existent or not implemented
98 Message not compatible with short message protocol state
99 Information element non-existent or not implemented
111 Protocol error, unspecified
127 Interworking, unspecified
128 Telematic interworking not supported
129 Short message Type 0 not supported
130 Cannot replace short message
143 Unspecified TP-PID error
144 Data coding scheme (alphabet) not supported
145 Message class not supported
159 Unspecified TP-DCS error
160 Command cannot be executed
161 Command unsupported
175 Unspecified TP-Command error
176 TPDU not supported
192 SC busy
193 No SC subscription
194 SC system failure
195 Invalid SME address
196 Destination SME barred
197 SM Rejected-Duplicate SM
198 TP-VPF not supported
199 TP-VP not supported
208 D0 SIM SMS storage full
209 No SMS storage capability in SIM
210 Error in MS
211 Memory Capacity Exceeded
212 SIM Application Toolkit Busy
213 SIM data download error
41111821 Rev 12 August 04, 2020 249

<err> Code Meaning
255 Unspecified error cause

300 ME failure
301 SMS service of ME reserved
302 Operation not allowed
303 Operation not supported
304 Invalid PDU mode parameter
305 Invalid text mode parameter
310 SIM not inserted
311 SIM PIN required
312 PH-SIM PIN required
313 SIM failure
314 SIM busy
315 SIM wrong
316 SIM PUK required
317 SIM PIN2 required
318 SIM PUK2 required
320 Memory failure
321 Invalid memory index
322 Memory full
330 SMSC address unknown
331 no network service
332 Network timeout
340 NO +CNMA ACK EXPECTED
500 Unknown error
606 ME Busy – CM server request already pending
14.3.4. GPRS Error Codes
<err> Code Meaning
Errors related to a failure to Perform an Attach

103 Illegal MS
106 Illegal ME
107 GPRS services not allowed
111 PLMN not allowed
112 Location area not allowed
113 Roaming not allowed in this location area
Errors related to a failure to Activate a Context
132 Service option not supported
133 Requested service option not subscribed
134 Service option temporarily out of order
149 PDP authentication failure
Other GPRS Errors
41111821 Rev 12 August 04, 2020 250

<err> Code Meaning
148 Unspecified GPRS error

150 Invalid mobile class
Other values in the range 101 - 150 are reserved for use by GPRS.
14.4. FTP Reply Codes

FTP Reply
Description
Code
110 Restart marker reply

120 Service ready in nnn minutes
125 Data connection already open: transfer starting
150 File status okay; about to open data connection
200 Command okay
202 Command not implemented, superfluous at this site
211 System status or system help reply
212 Directory status
213 File status
214 Help message
215 NAME system type
220 Service ready for new user
Service closing control connection. Logged out if appropriate. Unassigned (unallocated)
221
number
225 Data connection open; no transfer in progress
Closing data connection. Requested file action successful (for example, file transfer or file
226
abort)
227 Entering Passive Mode (<comma-separated IP address>,<comma-separated port>)
22 User logged in, proceed
250 Requested file action okay, completed
257 "PATHNAME" created
331 Username okay, need password
332 Need account for login
350 Requested file action pending further information
Service not available, closing control connection. This may be a reply to any command if the
421
service knows it must shut down
425 Can't open data connection
426 Connection closed; transfer aborted
450 Requested file action not taken. File unavailable (e.g., file busy)
451 Requested action aborted: local error in processing
452 Requested action not taken. Insufficient storage space in system
500 Syntax error, command unrecognized. This may include errors such as command line too long
501 Syntax error in parameters or arguments
502 Command not implemented
41111821 Rev 12 August 04, 2020 251

FTP Reply
Description
Code
503 Bad sequence of commands

504 Command not implemented for that parameter
530 Not logged in
532 Need account for storing files
550 Requested action not taken. File unavailable (e.g., file not found, no access)
551 Requested action aborted: page type unknown
552 Requested file action aborted. Exceeded storage allocation (for current directory or dataset)
553 Requested action not taken. File name not allowed
14.5. How to Use TCP Commands
14.5.1. Client Mode

AT&K3 Hardware flow control activation
OK
AT+KCNXCFG=1,"GPRS","APN","log","password",“IPV4”,"0 Set GPRS parameters (APN, login,

.0.0.0","0.0.0.0","0.0.0.0" password)
OK
AT+KTCPCFG=1,0,"www.google.com",80 Set IP address and port number

+KTCPCFG: 1 Returns session ID
OK
AT+KTCPCNX=1 Initiate the connection

OK
+KTCP_IND: 1,1 Successful connection
AT+KTCPSND=1,18 Send data with KPATTERN string at the

end. e.g. “GET / HTTP/1.0
CONNECT
…Data send…
OK --EOF--Pattern--"
+KTCP_DATA: 1,1380
AT+KTCPRCV=1, 1380
CONNECT
HTTP/1.0 200 OK
Cache-Control: private, max-age=0 DATA read
… a lot of data…
--EOF--Pattern--
OK
+KTCP_DATA: 1,1380 +KTCP_DATA notification
41111821 Rev 12 August 04, 2020 252

AT+KTCPRCV=1,1380
CONNECT
er{padding-bottom:7px !important}#gbar,#guser{font- DATA read
… a lot of data…
--EOF--Pattern--
OK
+KTCP_DATA: 1,1380
AT+KTCPCLOSE=1,1 Close session 1

OK
AT+KTCPDEL=1 Delete session 1

OK
AT+KTCPCFG? No session is available

OK
14.5.2. Server Mode

A daytime server is emulated in the following example. The server listens to port 13, and returns the
date for each connection.
OK
AT+KCNXCFG=1,"GPRS","APN","log","password",“IPV4”,"0 Set GPRS parameters (APN, login,

.0.0.0","0.0.0.0","0.0.0.0" password)
OK
AT+KTCPCFG=1,1,,13 Set TCP listener and port number

+KTCPCFG: 1 Returns session 1
OK
AT+KTCPCNX=1 Initiate the server

OK
AT+KCGPADDR Get the IP address to initiate a connection

+KCGPADDR: 1,"10.35.125.89" request with a client
OK
+KTCP_SRVREQ: 1,2,”192.168.2.1”,47792 A client requests a connection

(subsession 2)
AT+KTCPSND=2,15
CONNECT
…Date and time… Data is sent to the client read (based on
subsession 2)
OK
+KTCP_SRVREQ: 1,3,”192.168.37.19”,39840 Another client requests a connection

(subsession 3); child mode for session 3
41111821 Rev 12 August 04, 2020 253

+KTCP_NOTIF: 2, 4 Client (subsession 2) closes the

connection
AT+KTCPSND=3,15
CONNECT
…Date and time… Data is sent to the client
OK
+KTCP_DATA: 3,6 Data received from client (subsession 3)
AT+KTCPRCV=3,6 Read data received from client

CONNECT
… Data… --EOF--Pattern--
OK
AT+KTCPCLOSE=3,1 Close client subsession 3 and then

OK subsession 3 is deleted automatically
AT+KTCPCLOSE=1,1 Close server session 1

OK
AT+KTCPDEL=1 Delete session 1

OK
14.6. How to Use UDP Specific Commands
14.6.1. Client Mode

OK
AT+KCNXCFG=1,"GPRS","APN" Set the GPRS parameters

OK
AT+KUDPCFG=1,0 Create a new UDP socket (returned session 1) with

the parameters associated to the connection profile id
+KUDPCFG: 1 number 1
OK
+KCNX_IND: 1,1,0
+KUDP_IND: 1,1
AT+KUDPSND=1,”213.41.22.60”,32,10 Send UDP data after “CONNECT”

CONNECT
…Data Sent…
--EOF--Pattern--
41111821 Rev 12 August 04, 2020 254

OK
Received notification that indicates the presence of
10 bytes in the socket
+KUDP_DATA: 1,10
Try to read 5 bytes from session 1

AT+KUDPRCV=1,5
CONNECT
12345--EOF—Pattern--
OK
+KUDP_RCV: "213.41.22.60",32
Received notification that indicates the presence of 5
+KUDP_DATA: 1,5 bytes in the socket
AT+KUDPRCV=1,5 Try to read 5 bytes from session 1

CONNECT
67890--EOF—Pattern--
OK
+KUDP_RCV: “213.41.22.60”,32
AT+KUDPCLOSE=1
OK Close the UDP session 1
AT+KUDPDEL=1
OK Delete session 1
14.6.2. Use Cases for KTCP_DATA and KUDP_DATA

(with/without data auto retrieval)
1) Previous features are kept (ascending compatibility of the AT commands) - Client mode
AT+KCNXCFG=1,"GPRS","CMNET"
OK
AT+KTCPCFG=1,0,"202.170.131.76",2000
+KTCPCFG: 1
OK
AT+KTCPCNX=1 Connect to TCP server

OK
+KTCP_IND: 1,1 Connection successful
+KTCP_DATA: 1,10 URC tells us that 10 bytes arrived
AT+KTCPRCV=1,10 Use KTCPRCV command to receive those

10 bytes
CONNECT
41111821 Rev 12 August 04, 2020 255

0123456789--EOF--Pattern--
OK
AT+KUDPCFG=1,0 Open a UDP socket

+KUDPCFG: 2
OK
+KUDP_DATA: 2,8 URC tells us that 8 bytes arrived
AT+KUDPRCV=2,8 Use command to receive those 8 bytes

CONNECT
01234567--EOF--Pattern--
OK
+KUDP_RCV: "202.170.131.76",2001
2) New optional feature: URC takes out the data - Client mode
AT+KCNXCFG=1,"GPRS","CMNET"
OK
AT+KTCPCFG=1,0,"202.170.131.76",2000,,1 Extend a parameter for the new feature

When setting to 1, data will be received by
the URC “+KTCP_DATA:”
+KTCPCFG: 1
OK
AT+KTCPCNX=1 Connect to TCP server

OK
+KTCP_IND: 1,1 Successful connection
+KTCP_DATA: 1,10,0123456789 10 bytes arrived. The URC takes them out

directly
AT+KUDPCFG=1,0,3000,1 Extend a parameter for the new feature
When setting to 1, data will be received by
the URC “+KUDP_DATA:”
+KUDPCFG: 2
OK
+KUDP_DATA: 2,8,"202.170.131.76",2001,01234567 8 bytes arrived. The URC takes them out
directly
41111821 Rev 12 August 04, 2020 256

14.7. Switch Data/Command Mode DTR +++ ATO

Behavior Table
The table shows the behavior when trying to switch mode:
Case1: +++ is used to switch from data mode to command mode, and the service is suspended.
Case2: If AT&D1 is set, "DTR drop" is used to switch from data mode to command mode, but the
service is suspended.
Case3: If AT&D2 is set, "DTR drop" is used to switch from data mode to command mode, and the
service is stopped.
Case4: If AT&D0 is set, "DTR drop" has no impact on the mode switch.
Case5: ATO[n] is used to switch from command mode to data mode.
Case1/Case5 Case2/Case5 Case3/Case5 Case4/Case5

+++/ATO[n] DTR1/ATO[n] DTR2/ATO[n] DTR0
TCP/UDP:
+KTCPSND: Send data
+KTCPRCV: Receive data NO CARRIER /
OK/CONNECT OK/CONNECT NO CARRIER NO IMPACT
+KUDPSND: Send data
(disconnect)
+KUDPRCV: Receive data
+KTCPSTART: Direct data flow
FTP: OK / OK / NO CARRIER /
+KFTPRCV: Download FTP files NO CARRIER NO CARRIER NO CARRIER NO IMPACT
+KFTPSND: Upload FTP files (disconnect) (disconnect) (disconnect)
HTTP:
+KHTTPGET: Get information
+KHTTPHEAD: Get head of OK / OK / NO CARRIER /
information NO CARRIER NO CARRIER NO CARRIER NO IMPACT
+KHTTPPOST: Send data (disconnect) (disconnect) (disconnect)
+KHTTPHEADER: Set the HTTP
Request Header
NO CARRIER /
Data mode ATD*99… (use ATO or
OK/CONNECT OK/CONNECT NO CARRIER NO IMPACT
ATO0)
(disconnect)
SSL: OK / NO OK / NO NO CARRIER /
+KCERTSTORE: Store root CA CARRIER CARRIER NO CARRIER NO IMPACT
+KPRIVKSTORE: Store private key (abort) (abort) (abort)
41111821 Rev 12 August 04, 2020 257

AirPrime - HL78xx - AT Commands Interface Guide - Rev12 PDF

Uploaded by

Copyright:

Available Formats

AirPrime - HL78xx - AT Commands Interface Guide - Rev12 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

AirPrime - HL78xx - AT Commands Interface Guide - Rev12 PDF

Uploaded by

Copyright:

Available Formats

AirPrime HL78xx

AT Commands Interface Guide

Safety and Hazards

41111821 Rev 12 August 04, 2020 2

Corporate and product information Web: sierrawireless.com

41111821 Rev 12 August 04, 2020 3

1.0 May 21, 2018 Creation

41111821 Rev 12 August 04, 2020 4

Version Date Updates

41111821 Rev 12 August 04, 2020 5

Version Date Updates

41111821 Rev 12 August 04, 2020 6

Version Date Updates

41111821 Rev 12 August 04, 2020 7

Version Date Updates

41111821 Rev 12 August 04, 2020 8

Version Date Updates

41111821 Rev 12 August 04, 2020 9

Version Date Updates

41111821 Rev 12 August 04, 2020 10

Version Date Updates

41111821 Rev 12 August 04, 2020 11

2. V25TER AT COMMANDS .................................................................................. 26

3. GENERAL AT COMMANDS .............................................................................. 35

41111821 Rev 12 August 04, 2020 12

3.10. +GCAP Command: Request Complete TA Capability List................................................43

4. CALL CONTROL COMMANDS ......................................................................... 52

5. MOBILE EQUIPMENT CONTROL AND STATUS COMMANDS....................... 54

41111821 Rev 12 August 04, 2020 13

5.28. +WIMEI Command: IMEI Write and Read.........................................................................83

6. NETWORK SERVICE RELATED COMMANDS .............................................. 113

7. SMS COMMANDS............................................................................................ 123

41111821 Rev 12 August 04, 2020 14

7.8. +CMSS Command: Send Message from Storage ..........................................................130

8. PACKET DOMAIN COMMANDS ..................................................................... 136

9. PROTOCOL SPECIFIC COMMANDS.............................................................. 152

41111821 Rev 12 August 04, 2020 15

9.8.3. +KIPOPT Command: General Options Configuration ...........................................162

41111821 Rev 12 August 04, 2020 16

9.14.3. +KFTPRCV Command: Receive FTP Files ...........................................................199

10. AVMS COMMANDS ......................................................................................... 207

11. TEST COMMANDS .......................................................................................... 220

12. GNSS COMMANDS ......................................................................................... 225

13. NV COMMANDS .............................................................................................. 234

14. APPENDIX ....................................................................................................... 239

41111821 Rev 12 August 04, 2020 17

14.5.1. Client Mode ............................................................................................................252

41111821 Rev 12 August 04, 2020 18

41111821 Rev 12 August 04, 2020 19

1.1. Reference Configuration

Figure 1. Reference Configuration

1.2. AT Command Principles

Table 1. Types of Extended AT Commands

Command Type Syntax Definition

The equipment returns the list of parameters and values

Write Command AT+CXXX=<…> This command sets user-related parameter values

AT+CXXX The execution command reads non-variable parameters

41111821 Rev 12 August 04, 2020 20

1.2.2. Answers and Responses