EMnify is hiring. Visit our careers page to see our open positions, and apply today!
See open positions
en
      Start Free Trial Get In Touch
      en
      Jan, 18 2022

      AT Commands Guide for GSM

      Developer Blog
      Written by Constantin Ernst
      AT_new
      We started with a cheat sheet for AT commands and realized that it wasn't enough. After taking a deep dive into the world of AT Commands, we emerged with a list of key questions about the most common AT commands for 2G, 3G and 4G cellular modules, and here are the answers.

      AT Command Guide -
      Table of Contents

      What are AT commands?

      The first step to diving into the Internet of Things is connecting your hardware to a modem. The connection between a modem and your hardware is achieved using AT commands. AT commands are a short text command language dating back to 1981, originally developed for Hayes smart modems and later used in dial-up modems in the 1990s.

      What can AT commands be used for? 

      AT commands enable you to control everything around the modem, device, and SIM:

      • Wake the device or put it in sleep mode
      • Configuration of power-saving modes 
      • Scan for and register to available networks and radio types
      • Get updates about network condition changes 
      • Read/send SMS and USSD
      • Send data (TCP/IP)
      • Get hardware and SIM information (IMEI, IMSI, etc.)
      • and much more 

      To get started, we will talk about the syntax or the types of AT commands that can be sent to the modem.

      What is the syntax of AT commands? 

      AT Commands usually have a standardized syntax rule - most commands have three different types: write, read, and test. And then there are also others that can be executed just to retrieve information. All standard AT commands start with AT+<command>. The response to the commands do not contain AT and only use +<command>:

      1. Write: AT+<x>=<…>

      Sets the user-definable parameter values of the modem
      The expected response is usually only "OK"

      Example: AT+CREG=1 – meaning enable network registration report

      2. Read: AT+<x>?

      Returns the settings of the modem

      Example: AT+CREG?
      Response: +CREG: 1,1 – meaning currently reports are configured to be enabled and the device is registered on the home network

      3. Test: AT+<x>=?

      Checks supported configurations / services of the modem
      Example: AT+CREG=?
      Response: +CREG: (0-2) – meaning that 0,1,2 can be set in the AT+CREG command

      4. Execute: AT+<x>

      Retrieve information or execute command

      Example: AT+CCID
      Response: +CCID:8988303000005737285  - returning the SIM card identifier (ICCID)

      Then there are also reports that can be generated on status changes for several commands often called unsolicited results code (reports). For example when the network registration changes. These reports have a similar format to the read command but sometimes differ on a couple of parameters.   

      Do different modules and vendors have different AT commands?

      Whereas AT commands are standardized in 3GPP TS 27.005 and 27.007 and all manufacturers need to implement them, there can be differences based on the modem type and vendor.
      Based on the modem type - for e.g., some power saving commands are only available on newer versions that also have the functionality. Parameters may also differ because the modem does not support this specific radio type configuration or error code. 

      Often manufacturers introduce additional proprietary AT commands that either have new functionality or enhance existing AT commands. While these commands can be powerful,  considerations for cross-vendor firmware need to be taken.  

      How do I identify proprietary AT-commands for U-Blox, Quectel, Telit, Nordic, Gemalto etc.? 

      Usually vendor proprietary commands are identifiable by a slightly changed command syntax in the beginning.

      1. Quectel - start with AT+Q - e.g. AT+QCFG
      2. U-Blox - start with AT+U - e.g. AT+UDCONF
      3. Telit - start with AT “@”, “#”, “$” or “*” - e.g. AT@CLCK
      4. Nordic - start with AT% - e.g. AT%XSNRSQ
      5. Gemalto/Cinterion - start with AT^  - e.g. AT^SMSO
      6. ZTE - start with AT+Z - e.g. AT+ZCELLINFO

       

      How do I find the AT commands my modem supports?

      Every modem should have a detailed description of its AT commands in an AT command guide. Nevertheless, you can also check the list of available AT commands with an AT command itself: AT+CLAC

      My AT-command only responds with ERROR - how do I get more info?

      In the standard configuration, the AT-Command response is short: OK and ERROR.

      For getting a more detailed output of what caused the error you can use the command AT+CMEE=1 or AT+CMEE=2. 

      The error will then either start with +CMS ERROR: xxx (indicating a network error) or +CME ERROR: xxx (indicating a device error)

      AT+CMEE=1 - each error message includes an error code as described 3GPP TS 27.007 Ch. 9.2. For example, the module will return +CME ERROR: 11 - meaning the SIM PIN is required.

      AT+CMEE=2 - if the modem supports it, then the error message includes a string expression of the error. For example  +CME ERROR: SIM PIN required

      Basic commands to get information about the modem and SIM card 

      The below commands do not have a read or test command and no parameters - they only execute commands that return information. 

      Name

      AT Command

      Description

      Get manufacturer

       AT+CGMI

      Returns string representation of the manufacturer

      Get model 

      AT+CGMM

      Returns the model of the modem. 

      Get firmware

      		 AT+CGMR

      Returns firmware  revision

      Get IMEI

      AT+GSN

      Retrieves the International Mobile Equipment Identity of the module 

      Get IMSI

      AT+CIMI

      Returns the current used IMSI

      GET ICCID

      AT+CCID

      Returns the ICCID of the SIM

      GET MSISDN

      AT+CNUM

       Returns the phone number / MSISDN of the device

      Removing or adding SIM PIN via AT commands 

      EMnify SIMs come with the SIM PIN deactivated so they work in devices that do not have a screen or interface to enter the PIN (e.g. GPS tracker). Below you have examples on how to activate and re-activate the use of the SIM PIN. 

      The two commands used for managing SIM PIN are AT+CPIN and AT+CLCK.

      To remove the check for the SIM PIN:

      AT+CPIN?  // check which PIN required
      +CPIN=SIM PIN   // response = SIM pin code required

      AT+CPIN=1234 // enter current PIN
      OK

      AT+CLCK=”SC”,0,”1234″ // remove SIM PIN request at startup - reboot needed
      OK   

      To add the check for SIM PIN:

      AT+CPIN?  // check if and which PIN required
      +CPIN=Ready   // no PIN required

      AT+CLCK=”SC”,1,”1234″  // PIN activated

      You find more information about the CPIN and CLCK command below. 

      Command Commands and example Parameters
      AT+CPIN

      		 AT+CPIN=<pin>

      Enter the PIN so that the SIM can be used

      Example:
      AT+CPIN="1234”

      <code>
      READY – No PIN required
      SIM PIN – PIN code required
      SIM PUK – PUK code required
      SIM PIN2 – PIN2 code required
      SIM PUK2 – PUK2 code required
      PH-SIM PIN – USIM depersonalization requiredv1.2.x
      PH-NET PIN – Network depersonalization requiredv1.2.x
      PH-NETSUB PIN – Network subset depersonalization requiredv1.2.x
      PH-SP PIN – Service provider depersonalization requiredv1.2.x
      PH-CORP PIN – Corporate depersonalization required

      AT+CPIN?
      Request which PIN code is required

      Response Format:
      +CPIN: <code>
      Example:
      AT+CPIN: READY 
      AT+CLCK

      AT+CLCK=<fac>,<mode>,<passed>, <class>

      Lock or unlock different services on the module.

      Example:
      AT+CLCK =”AO”,2

      <fac> facility 
      “SC” (U)SIM PIN request at startup 
      “AO” Bar All Outgoing Calls
      “OI” Bar Outgoing International Calls)
      “OX” Bar Outgoing International Calls except to Home Country)
      “AI” Bar All Incoming Calls
      “IR” Bar Incoming Calls when Roaming 
      “AB” All Barring services
      “AG” All outgoing barring services
      “AC” All incoming barring services
      “FD” SIM card or active application in the UICC (GSM or USIM)
      “PF” Lock Phone to the very first inserted SIM/UICC card
      “PN” Network Personalization
      “PU” Network Subset Personalization
      “PP” Service Provider Personalization
      “PC” Corporate Personalization 

      <mode> Defines the operation 
      0 - unlock facility
      1 - lock facility
      2 - query status

      <password> Password 

      <class>
      1 Voice
      2 Data
      4 FAX
      7 All telephony except SMS (Default)
      8 Short message service
      16 Data circuit synchronization
      32 Data circuit asynchronization 0 OFF 1 ON

      AT commands for network selection and configuration

      While operator selection is often an automated procedure - there are some configurations that you can do to either enforce or prefer specific operators.

       

      Command

      Commands and examples

      Parameters

      AT+COPS

      Operator
      scan and selection

       

       

      AT+COPS=<mode>,<format>, <oper>,<AcT>

      Forces to register the network
      operator
      Configuration Examples:
      AT+COPS=1,2,"24407"
      AT+COPS=0 or AT+COPS=2
      AT+COPS=1,2,"24407",8

      		 <mode>:
      0 - automatic (<oper> field is ignored)
      1 - manual (<oper> field)
      2 - deregister from network
      3 - set only <format> for AT+COPS?
      4 - manual/automatic (<oper> field shall be present); if manual selection fails, automatic mode (=0) is entered

      <format>
      0 - long alphanumeric – e.g “Telekom.de”
      1 – short alphanumeric e.g “TDG”
      2 – numeric – e.g. “26201”

      <oper> desired operator in <format>

      <AcT> Access technology
      0 - GSM
      1 - GSM Compact
      2 - UTRAN
      3 - GSM w/EGPRS
      4 - UTRAN w/HSDPA
      5 - UTRAN w/HSUPA
      6 - UTRAN w/HSDPA and HSUPA
      7 - E-UTRAN
      8 – LTE-M
      9 - NB-IoT

      If no operator is selected <format>,<oper> <Act> are omitted.

      <stat> Operator status
      0 - unknown
      1 - available
      2 - current
      3 - forbidden

      AT+COPS?
      Returns the current mode, the
      selected operator, and Access Technology.

      Response Format:
      +COPS: <mode>,<format>,<oper>,<AcT>
      Example Response:
      +COPS: 0,0,“ Telekom.de”,0

      AT+COPS=?

      Returns / scans the list of available operators.

      Response Format:
      <stat>, long alphanumeric <oper>,
      short alphanumeric <oper>, numeric <oper>, <AcT>

      Example Response:
      +COPS: (3,"Telekom.de","TDG","26201",2),
      (1,"E-Plus","E-Plus","26203",2),(3,"Vodafone.de","Vodafone", "26202",2),(3,"Telekom.de","TDG","26201",7)
      AT+CPLS

      Preferred PLMN list
      file to be used 

       

       

       

      AT+CPLS=<list>
      Selects which file shall be used for preferred PLMN list

      Example:
      AT+CPLS=0

      On the SIM there are file to manage operator and radio type preference. These can be set by the user, operator or home network. These files usually start with EFxxxx

      <list>: integer type
      0: User controlled PLMN selector with Access Technology EFPLMNwAcT, if not found in the SIM/UICC then PLMN preferred list EFPLMNsel
      1: Operator controlled PLMN selector with Access Technology EFOPLMNwAcT
      2: HPLMN selector with Access Technology EFHPLMNwAcT

      AT+CPLS?
      Returns the selected PLMN selector list from the SIM/USIM.
      Example Response 
      +CPLS: 0

      AT+CPLS=?
      Returns list of supported <list>
      Example response:
      +CPLS: (0-2)

      AT+CPOL

      User Preferred PLMN list
      configuration
      (only when CPLS=0)

       

       

       

      AT+CPOL=<index>,<format>,<oper>,<GSM_AcT>, <GSM_Compact_AcT>,<UTRAN_AcT>,<EUTRAN_AcT>

      Set preferred operator list on the SIM 

      Config example:
      AT+CPOL=50,2,"22210",1,0,1,0

      		 <index> order number of operator list. The first index indicates the highest priority and the nth index indicates the lowest

      <format>:
      0 - long format alphanumeric <oper>
      1 - short format alphanumeric <oper>
      2 - numeric <oper>

      <oper> Operator in defined Format <format>

      For all parameters
      <GSM_AcTn>,
      <GSM_Compact_AcTn>,
      <UTRAN_AcTn>,
      <E-UTRAN_AcTn>:
      0 - access technology not selected
      1 - access technology selected

      AT+CPOL?
      Returns all entries from the SIM/USIM  EFPLMNwAcT or EFPLMNsel
      Response format:
      <index1>,<format>,<oper1>,<GSM_AcT1>,<GSM_Compact_AcT1>,<UTRAN_AcT1>,<E-UTRAN_AcT1>
      Example Response:
      +CPOL: 1,2,"26201",1,0,1,0 +CPOL: 2,2,"21401",1,0,1,0
      …
      AT+COPN


      List all known operators

      AT+COPN
      Lists all the known operators that can be set by AT+CPOL

      Example Reponse
      +COPN: "90114","AeroMobile"
      …
      +COPN: "22210","vodafone IT"

      		  

      AT+CREG
      AT+CGREG
      AT+CEGREG

      Network registration report

      AT+CREG applies to GSM/UMTS CS domain 

      AT+CGREG
      applies for GPRS/UMTS PS domain (GPRS)

      AT+CEREG applies for LTE

      Some LTE only modules may show registration status also for CREG and CGREG based on backwards compatibility

       

       

       

      The syntax for CREG, CGREG, CEGREG is the similar- here explained with AT+CREG

      AT+CREG =<n>
      Set result code output. Triggers status change reports in different formats. 
      For <n>=1: +CREG:<stat>
      For <n>=2: +CREG: <stat><lac>,<ci>,<AcT>
      For <n>=3: +CREG: <stat>,<lac>,<ci>,<AcT>,<cause_type>,<reject_cause>
      For <n>=4 or 5 -       additional parameters modem specific

      Config Example:
      AT+CREG=1

      <n> Report configuration
      0 – Disable network registration unsolicited results code reports
      1 – Enable network registration unsolicited result code reports
      2 – Enable network registration and location information in reports <lac/tac/rac><ci><AcT>
      3 - enable also <cause_type>,<reject_cause> in reports 
      4 / 5 -  dependent on module there can be additional parameters  <rac>, <ActiveTime>,<P-RAU>,<GPRS-READY-timer> (only applies to AT+CGREG and CEREG)

      <stat>:
      0 - not registered, MT is not searching
      1 - registered, home network
      2 - not registered, MT is searching
      3 - registration denied
      4 - unknown (e.g. out of coverage)
      5 - registered, roaming

      <AcT>: Access Type
      0 - GSM      1 - GSM Compact
      2 - UTRAN  3 - GSM w/EGPRS
      4 - HSDPA   5    UTRAN HSUPA
      6 - UTRAN w/HSDPA and HSUPA
      7 - E-UTRAN
      8 – LTE-M
      9 - NB-IoT

      <lac/tac/rac> Location Area / Tracking Area / Routing Area Code
      <ci> Cell ID
      <active time> Active Time value (T3324) for Power Save Mode
      <P-RAU> period to send RAU/TAU

      The syntax for CREG, CGREG, CEGREG is the similar- here explained with AT+CREG

      AT+CREG?
      Return Current Registration Status

      Response Examples:
      For <n>=1: CREG: <n><stat>
      +CREG: 1,1
      for <n>=2: +CREG: <n>,<stat><lac>,<ci>,<AcT>
      +CREG: 2,5,"2387","01DB7C01", 2
      For n=3: +CREG: <n>,<stat>,<lac>,<ci>,<AcT>,<cause_type>,<reject_cause>

      AT+CREG =?
      Returns values supported for <n> result code configuration

      Example Response
      +CREG: (0-3)

      AT commands for radio signal quality analysis

      Command

      Commands and examples

      Parameters
      AT+CSQ

      Signal Quality Reports

      AT+CSQ
      Reads the signal quality for the connected technology.

      Response Format:
      +CSQ: <rssi>,<qual>
      Example Response:
      +CSQ: 21,3

      <rssi> received signal strength RSSI values
      0: 113 dBm or less
      1: 111 dBm
      2...30: 109... 53 dBm
      31: 51 dBm or greater
      99 - not known or not detectable

      <qual> For 2G – Bit Error rate ( ~assumed value)
      0: BER < 0,2 % ~0,14 %
      1: 0,2 % < BER < 0,4 %  ~0,28 %
      2: 0,4 % < BER < 0,8 %  ~0,57 %
      3: 0,8 % < BER < 1,6 %  ~1,13 %
      4: 1,6 % < BER < 3,2 % ~2,26 %
      5: 3,2 % < BER < 6,4 % ~4,53 %
      6: 6,4 % < BER < 12,8 % ~9,05 %
      7: 12,8 % < BER ~18,10 %
      99: not detectable

      <qual> For 3G - EcNo
      0: ECN0_LEV >= 44
      1: 38 <= ECNO_LEV < 44
      2: 32 <= ECNO_LEV < 38
      3..5 14 <= ECNO_LEV < 32
      6: 8 <= ECNO_LEV < 14
      7: ECNO_LEV < 8

      <qual> For LTE/NB-IoT/LTE-M - RSRQ
      0: RSRQ_LEV < 5
      1: 5 <= RSRQ_LEV < 10
      2: 10 <= RSRQ_LEV < 14
      3..5: 14 <= RSRQ_LEV < 26
      6: 26 <= RSRQ_LEV < 30
      7: RSRQ _LEV >= 30

      <rxlev> RSSI with 1dbm steps
      0: less than -110 dBm
      1..62: from -110 to -49 dBm 
      63: -48 dBm or greater

      <ber> - Bit Error Rate as above for 2G

      <rscp> RSCP with 1dBm steps
      0: less than -120 dBm
      1..95: from -120 dBm to -26 dBm 
      96: -25 dBm or greater

      AT+CSQ=?
      Returns list of supported parameters <rssi>,<qual>

      Example Response
      +CSQ: (0-31,99),(0-7,99)

       AT+CESQ

      Extended signal quality 

      AT+CESQ
      Return signal quality for all radio types the module can monitor. 

      Response format: 
      +CESQ: <rxlev>,<ber>,<rscp>,<ecn0>,<rsrq>,<rsrp>

      Example Response:
      +CESQ:99,99,255,255,31,62

      AT+CESQ=?

      Returns list of supported parameters value ranges <rxlev>,<ber>, <rscp>, ecno>, <rsrp>, <rsrq>

      Example Response:
      +CESQ: (0-63,99),(0-7,99),(0-96, 255),(0-49,255),(0-34,255),(0-97, 255)

      AT commands to establish a PDP context / data session

      Command

      Commands and examples

      Parameters
      AT+ CGDCONT

      Define PDP context

      <AT+CGDCONT=<cid>,<PDP_type>,<APN>,<PDP_addr>,<data_comp>,<head_comp>

      Set the parameters for the PDP context.

      Example
      AT+CGDCONT=1,"IP","em",
      "0.0.0.0",0,0

      <cid> PDP context identifier
      <PDP_type> - Packet Data Protocol type as string
      "IP", “PPP” , “IPV6”, “IPV4V6”

      <APN> - Access Point Name string for EMnify "em"

       <PDP_addr> (IP) Address identifying the mobile terminal. EMnify assigns private static IPs - so 0.0.0.0 is fine

       <d_comp> - controls PDP data compression - for SNDCP

      0 OFF
      1 ON
      2 V.42bis
      3 V.44

      <h_comp> - controls PDP header compression
      0 - off
      1 – on
      2 - RFC1144  for SNDCP only
      3 - RFC2507
      4 - RFC3095 (applicable for PDCP only)

       

      AT+CGDCONT?

      Returns list of current PDP definitions

      Response Format:
      +CGDCONT: <cid>,<PDP_type>,<APN>,<PDP_addr>, <data_comp>,<head_comp>

       Example Response:
      +CGDCONT: 1,"IP","em","0.0.0.0",0,0,0,0
      2,"IPV4V6","em", "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0" ,0,0,0,0
      AT+CGACT

      Activate and Deactivate PDP contexts

      AT+CGACT=<state>,<cid>
      Activate or deactivate PDP context 

      Example: 
      AT+CGACT=1,1

      <state>
      0 - deactivate
      1 - activate

      <cid> PDP context ID

       

       

      AT+CGACT?
      Read status of PDP contexts
      Response format
      +CGACT<state>,<cid>
      Example Response:
      +CGACT=1,1

      Final Thoughts

      These were some of the standard AT commands that all modems support. They let you configure and have control over your cellular communication. Many manufacturer-specific AT commands exist which let you optimize the communication. We will talk about these in another blog post.

      /bg-gradient-blue

      Subscribe to our Developer Newsletter