BC35-G&BC28

AT Commands Manual

NB-IoT Module Series

Rev. BC35-G&BC28_AT_Commands_Manual_V1.0

Date: 2017-12-28

Status: Released

www.quectel.com
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Our aim is to provide customers with timely and comprehensive service. For any
assistance, please contact our company headquarters:

Quectel Wireless Solutions Co., Ltd.

7th Floor, Hongye Building, No.1801 Hongmei Road, Xuhui District, Shanghai 200233, China
Tel: +86 21 5108 6236
Email: [email protected]

Or our local office. For more information, please visit:

http://quectel.com/support/sales.htm

For technical support, or to report documentation errors, please visit:

http://quectel.com/support/technical.htm
Or email to: [email protected]

GENERAL NOTES
QUECTEL OFFERS THE INFORMATION AS A SERVICE TO ITS CUSTOMERS. THE INFORMATION
PROVIDED IS BASED UPON CUSTOMERS’ REQUIREMENTS. QUECTEL MAKES EVERY EFFORT
TO ENSURE THE QUALITY OF THE INFORMATION IT MAKES AVAILABLE. QUECTEL DOES NOT
MAKE ANY WARRANTY AS TO THE INFORMATION CONTAINED HEREIN, AND DOES NOT ACCEPT
ANY LIABILITY FOR ANY INJURY, LOSS OR DAMAGE OF ANY KIND INCURRED BY USE OF OR
RELIANCE UPON THE INFORMATION. ALL INFORMATION SUPPLIED HEREIN IS SUBJECT TO
CHANGE WITHOUT PRIOR NOTICE.

COPYRIGHT
THE INFORMATION CONTAINED HERE IS PROPRIETARY TECHNICAL INFORMATION OF
QUECTEL WIRELESS SOLUTIONS CO., LTD. TRANSMITTING, REPRODUCTION, DISSEMINATION
AND EDITING OF THIS DOCUMENT AS WELL AS UTILIZATION OF THE CONTENT ARE
FORBIDDEN WITHOUT PERMISSION. OFFENDERS WILL BE HELD LIABLE FOR PAYMENT OF
DAMAGES. ALL RIGHTS ARE RESERVED IN THE EVENT OF A PATENT GRANT OR
REGISTRATION OF A UTILITY MODEL OR DESIGN.

Copyright © Quectel Wireless Solutions Co., Ltd. 2017. All rights reserved.

BC35-G&BC28_AT_Commands_Manual 1 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

About the Document

History
Revision Date Author Description
Hayden WANG/
1.0 2017-12-28 Gary TANG/ Initial
Arnold ZHAO

BC35-G&BC28_AT_Commands_Manual 2 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Contents

About the Document ................................................................................................................................... 2

Contents ....................................................................................................................................................... 3
Table Index ................................................................................................................................................... 6

1 Introduction .......................................................................................................................................... 7
1.1. Definitions .................................................................................................................................. 8
1.2. AT Command Syntax ................................................................................................................. 8
1.3. AT Command Responses .......................................................................................................... 9
1.4. 3GPP Compliance ..................................................................................................................... 9

2 Implementation Status ...................................................................................................................... 10

3 3GPP Commands (27.007) ................................................................................................................ 13

3.1. ATI Display Product Identification Information ...................................................................... 13
3.2. ATE Set Command Echo Mode ............................................................................................ 14
3.3. AT+CGMI Request Manufacturer Identification .................................................................... 15
3.4. AT+CGMM Request Manufacturer Model ............................................................................ 15
3.5. AT+CGMR Request Manufacturer Revision ......................................................................... 16
3.6. AT+CGSN Request Product Serial Number ......................................................................... 17
3.7. AT+CEREG EPS Network Registration Status ..................................................................... 18
3.8. AT+CSCON Signalling Connection Status ........................................................................... 21
3.9. AT+CLAC List Available Commands .................................................................................... 23
3.10. AT+CSQ Get Signal Strength Indicator ................................................................................ 24
3.11. AT+CGPADDR Show PDP Addresses ................................................................................. 25
3.12. AT+COPS PLMN Selection .................................................................................................. 27
3.13. AT+CGATT PS Attach or Detach .......................................................................................... 29
3.14. AT+CGACT Activate or Deactivate PDP Context ................................................................. 30
3.15. AT+CIMI Request International Mobile Subscriber Identity.................................................. 32
3.16. AT+CGDCONT Define a PDP Context ................................................................................. 33
3.17. AT+CFUN Set UE Functionality ............................................................................................ 35
3.18. AT+CMEE Report UE Error .................................................................................................. 36
3.19. AT+CCLK Return Current Date and Time ............................................................................ 37
3.20. AT+CPSMS Power Saving Mode Setting ............................................................................. 38
3.21. AT+CEDRXS eDRX Setting .................................................................................................. 40
3.22. AT+CEER Extended Error Report ........................................................................................ 43
3.23. AT+CEDRXRDP eDRX Read Dynamic Parameters ............................................................ 44
3.24. AT+CTZR Time Zone Reporting ........................................................................................... 46
3.25. AT+CIPCA Initial PDP Context Activation ............................................................................. 48
3.26. AT+CGAPNRC APN Rate Control ........................................................................................ 49
3.27. AT+CSODCP* Sending Originating Data via the Control Plane .......................................... 51
3.28. AT+CRTDCP* Reporting Terminating Data via the Control Plane ....................................... 52

4 3GPP Commands (27.005) ................................................................................................................ 55

BC35-G&BC28_AT_Commands_Manual 3 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

4.1. AT+CSMS Select Message Service ..................................................................................... 55

4.2. AT+CNMA New Message Acknowledgement to UE............................................................. 57
4.3. AT+CSCA Service Centre Address ....................................................................................... 58
4.4. AT+CMGS Send SMS Message ........................................................................................... 59
4.5. AT+CMGC Send SMS Command......................................................................................... 61

5 General Commands ........................................................................................................................... 62

5.1. AT+NRB Reboot the UE ....................................................................................................... 62
5.2. AT+NUESTATS Query UE Statistics..................................................................................... 62
5.3. AT+NEARFCN Specify Search Frequencies ........................................................................ 67
5.4. AT+NSOCR Create a Socket................................................................................................ 67
5.5. AT+NSOST SendTo Command (UDP Only) ......................................................................... 69
5.6. AT+NSOSTF SendTo Command with Flags (UDP Only) ..................................................... 69
5.7. AT+NSORF Receive Command (UDP Only)........................................................................ 71
5.8. AT+NSOCL Close a Socket .................................................................................................. 72
5.9. +NSONMI Indicator of Arrived Socket Message (Response Only) ...................................... 72
5.10. AT+NPING Test IP Network Connectivity to a Remote Host ................................................ 73
5.11. AT+NBAND Set Supported Bands........................................................................................ 74
5.12. AT+NLOGLEVEL Set Debug Logging Level ........................................................................ 75
5.13. AT+NCONFIG Configure UE Behaviour ............................................................................... 76
5.14. AT+NATSPEED Configure UART Port Baud Rate ............................................................... 78
5.15. AT+NCCID USIM Card Identification .................................................................................... 79
5.16. AT+NFWUPD Firmware Update via UART .......................................................................... 80
5.17. AT+NPOWERCLASS Set the Mapping for Band and Power Class ..................................... 81
5.18. AT+NPSMR Power Saving Mode Status Report .................................................................. 82
5.19. AT+NPTWEDRXS Paging Time Window Value and eDRX Setting ..................................... 83
5.20. AT+NPIN* PIN Operator ....................................................................................................... 86
5.21. AT+QLEDMODE Set NETLIGHT LED Function Mode ........................................................ 87

6 Huawei’s IoT Platform Commands................................................................................................... 89

6.1. AT+NCDP Configure and Query CDP Server Settings ........................................................ 89
6.2. AT+QSECSWT* Set Data Encryption Mode......................................................................... 90
6.3. AT+QSETPSK* Set PSK ID and PSK .................................................................................. 91
6.4. AT+QLWSREGIND Register Control .................................................................................... 92
6.5. AT+QLWULDATA Send Data ................................................................................................ 93
6.6. AT+QLWULDATAEX Send CON/NON Message .................................................................. 94
6.7. AT+QLWULDATASTATUS Query CON Messages Sent Status ........................................... 94
6.8. AT+QLWFOTAIND Set DFOTA Update Mode ...................................................................... 95
6.9. AT+QREGSWT Set Registration Mode ................................................................................ 96
6.10. +QLWULDATAEXIND Message Sent Status Report (Response Only)................................ 97
6.11. +QLWEVTIND LWM2M Event Report (Response Only) ...................................................... 98

7 Error Values ........................................................................................................................................ 99

8 Reset Reasons ................................................................................................................................. 102

9 Examples .......................................................................................................................................... 103

BC35-G&BC28_AT_Commands_Manual 4 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

9.1. Send/Receive/Read a UDP Message ................................................................................... 103

9.2. Examples Relating to Huawei’s IoT Platform ........................................................................ 103
9.2.1. Register to Huawei’s IoT Platform ............................................................................... 103
9.2.2. Send/Receive Data with Huawei’s IoT Platform .......................................................... 104
9.2.3. Upgrade Firmware on Huawei’s IoT Platform ............................................................. 105
9.2.4. Register to Huawei’s IoT Platform with DTLS ............................................................. 106

10 Appendix A Reference..................................................................................................................... 107

BC35-G&BC28_AT_Commands_Manual 5 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Table Index

TABLE 1: UNSOLICITED INFORMATION FOR UE UPDATE STATE INDICATION .......................................... 7

TABLE 2: AT COMMAND SYNTAX ..................................................................................................................... 8
TABLE 3: TYPES OF AT COMMANDS AND IMPLEMENTATION STATUS ..................................................... 10
TABLE 4: GENERAL ERRORS (27.007)........................................................................................................... 99
TABLE 5: GENERAL ERRORS (27.005)........................................................................................................... 99
TABLE 6: SPECIFIC ERROR CODES ............................................................................................................ 101
TABLE 7: REBOOT MESSAGES DISPLAYED ............................................................................................... 102
TABLE 8: TERMS AND ABBREVIATIONS ...................................................................................................... 107

BC35-G&BC28_AT_Commands_Manual 6 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

1 Introduction
This document gives details of the AT Command Set supported by Quectel NB-IoT BC35-G and BC28
modules.

The following string will be output after booting the module:

<CR><LF>Neul<CR><LF>OK<CR><LF>

After this string has been received, the AT command processor is ready to accept AT commands.

If BC35-G/BC28 module is rebooted or restarted for any reason that is not a normal power-on sequence,
a message that indicates the reason for the reboot would be output before the
<CR><LF>Neul<CR><LF>OK<CR><LF> string. Please refer to Chapter 8 for more details.

In case that an external MCU intervenes in the process of firmware update via DFOTA, unsolicited
information will be output to inform the external MCU the current update state.

Table 1: Unsolicited Information for UE Update State Indication

Unsolicited Information Description

Indicates that UE is downloading update
<CR><LF>FIRMWARE DOWNLOADING<CR><LF>
package.
<CR><LF>FIRMWARE DOWNLOAD FAILED<CR><LF> Indicates that the download failed.

<CR><LF>FIRMWARE DOWNLOADED<CR><LF> Indicates that the download finished.

<CR><LF>FIRMWARE UPDATING<CR><LF> Indicates that the UE is updating.

Indicates that the update is successful, but
<CR><LF>FIRMWARE UPDATE SUCCESS<CR><LF> update state has not been reported to
firmware package server yet.
<CR><LF>FIRMWARE UPDATE FAILED<CR><LF> Indicates that the update failed.
Indicates that the update is successful, and
update state has been reported to firmware
<CR><LF>FIRMWARE UPDATE OVER<CR><LF>
package server.
Update is done after this information.

BC35-G&BC28_AT_Commands_Manual 7 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

NOTE

During updating procedure, the module should not be operated until "FIRMWARE UPDATE OVER" is
reported. For instance, executing AT+NRB to power off the module is not permitted, otherwise an error
will occur.

1.1. Definitions

 <CR>: Carriage return character;

 <LF>: Line feed character;
 <..>: Parameter name. Angle brackets do not appear on command line;
 [..]: Optional parameter. Square brackets do not appear on the command line.

1.2. AT Command Syntax

Table 2: AT Command Syntax

Test Command AT+<cmd>=? Check possible sub-parameter values

Read Command AT+<cmd>? Check current sub-parameter values

AT+<cmd>=p1[,p2[,p3[.....
Write Command Write command
]]]
Execution
AT+<cmd> Execution command
Command

Multiple commands can be placed on a single line using a semi-colon (“;”) between commands. Only the
first command should have AT prefix. Commands can be in upper or lower case.

When entering AT commands spaces are ignored except in the following cases:

 Within quoted strings, where they are preserved;

 Within an unquoted string or numeric parameter;
 Within an IP address;
 Within the AT command name up to and including a ‘=’, ‘?’ or ‘=?’.

They can be used to make the input more human-readable. On input, at least a carriage return is required.
A newline character is ignored so it is permissible to use carriage return/line feed pairs on the input.

If no command is entered after the AT token, "OK" will be returned. If an invalid command is entered,

BC35-G&BC28_AT_Commands_Manual 8 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

“ERROR” will be returned.

Optional parameters, unless explicitly stated, need to be provided up to the last parameter being entered.

1.3. AT Command Responses

When the AT Command processor has finished processing a line, it will output either "OK" or "ERROR"
indicating that it is ready to accept a new command. Solicited informational responses are sent before the
final "OK" or "ERROR". Unsolicited information responses will never occur between a solicited
informational response and the final “OK” or “ERROR”.

Responses will be of the format:

<CR><LF>+CMD1:<parameters><CR><LF>
<CR><LF>OK<CR><LF>

Or

<CR><LF><parameters><CR><LF>
<CR><LF>OK<CR><LF>

1.4. 3GPP Compliance

3GPP commands are complied with the 3GPP TS 27.007 v14.3.0 (2017-03).

BC35-G&BC28_AT_Commands_Manual 9 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

2 Implementation Status

Table 3: Types of AT Commands and Implementation Status

Implementation
AT Command Description
Status

3GPP Commands (27.007)

ATI Display Product Identification Information R01A01

ATE Set Command Echo Mode R01A01

AT+CGMI Request Manufacturer Identification B150SP1

AT+CGMM Request Manufacturer Model B150SP1

AT +CGMR Request Manufacturer Revision B150SP1

AT+CGSN Request Product Serial Number B150SP1

AT+CEREG EPS Network Registration Status B150SP1

AT+CSCON Signalling Connection Status B150SP1

AT+CLAC List Available Commands B150SP1

AT+CSQ Get Signal Strength Indicator B150SP1

AT+CGPADDR Show PDP Addresses B150SP1

AT+COPS PLMN Selection B150SP1

AT+CGATT PS Attach or Detach B150SP1

AT+CGACT Activate or Deactivate PDP Context B150SP1

AT+CIMI Request International Mobile Subscriber Identity B150SP1

AT+CGDCONT Define a PDP Context B150SP1

AT+CFUN Set UE Functionality B150SP1

AT+CMEE Report UE Error B150SP1

BC35-G&BC28_AT_Commands_Manual 10 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

AT+CCLK Return Current Date and Time B150SP1

AT+CPSMS Power Saving Mode Setting B150SP1

AT+CEDRXS eDRX Setting B150SP1

AT+CEER Extended Error Report B150SP1

AT+CEDRXRDP eDRX Read Dynamic Parameters B150SP1

AT+CTZR Time Zone Reporting B150SP1

AT+CIPCA Initial PDP Context Activation B150SP1

AT+CGAPNRC APN Rate Control B150SP1

AT+CSODCP* Sending Originating Data via the Control Plane B150SP1

AT+CRTDCP* Reporting Terminating Data via the Control Plane B150SP1

3GPP Commands (27.005)

AT+CSMS Select Message Service B150SP1

AT+CNMA New Message Acknowledgement to UE B150SP1

AT+CSCA Service Centre Address B150SP1

AT+CMGS Send SMS Message B150SP1

AT+CMGC Send SMS Command B150SP1

General Commands

AT+NRB Reboot the UE B150SP1

AT+NUESTATS Query UE Statistics B150SP1

AT+NEARFCN Specify Search Frequencies B150SP1

AT+NSOCR Create a Socket B150SP1

AT+NSOST SendTo Command (UDP Only) B150SP1

AT+NSOSTF SendTo Command with Flags (UDP Only) B150SP1

AT+NSORF Receive Command (UDP only) B150SP1

AT+NSOCL Close a Socket B150SP1

Indicator of Arrived Socket Message (Response

+NSONMI B150SP1
Only)

BC35-G&BC28_AT_Commands_Manual 11 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

AT+NPING Test IP Network Connectivity to a Remote Host B150SP1

AT+NBAND Set Supported Bands B150SP1

AT+NLOGLEVEL Set Debug Logging Level B150SP1

AT+NCONFIG Configure UE Behaviour B150SP1

AT+NATSPEED Configure UART Port Baud Rate B150SP1

AT+NCCID USIM Card Identification B150SP1

AT+NFWUPD Firmware Update via UART B150SP1

AT+NPOWERCLASS Set the Mapping for Band and Power Class B150SP1

AT+NPSMR Power Saving Mode Status Report B150SP1

AT+NPTWEDRXS Paging Time Window Value and eDRX Setting B150SP1

AT+NPIN* PIN Operator B150SP1

AT+QLEDMODE Set NETLIGHT LED Function Mode B150SP1

Huawei’s IoT Platform Commands

AT+NCDP Configure and Query CDP Server Settings R01A01

AT+QSECSWT* Set Data Encryption Mode R01A01

AT+QSETPSK* Set PSK ID and PSK R01A01

AT+QLWSREGIND Register Control R01A01

AT+QLWULDATA Send Data R01A01

AT+QLWULDATAEX Send CON/NON Message R01A01

AT+QLWULDATASTATUS Query CON Messages Sent Status R01A01

AT+QLWFOTAIND Set DFOTA Update Mode R01A01

AT+QREGSWT Set Registration Mode R01A01

+QLWULDATAEXIND Message Sent Status Report (Response Only) R01A01

+QLWEVTIND LWM2M Event Report (Response Only) R01A01

NOTE

"*" means under development.

BC35-G&BC28_AT_Commands_Manual 12 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

3 3GPP Commands (27.007)

3.1. ATI Display Product Identification Information

The execution command returns product identification information. Please refer to Chapter 7 for possible
<err> values.

ATI Display Product Identification Information

Execution Command Response
ATI Quectel
<Object Id>
Revision:<revision>

OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<Object Id> Identifier of device type

<revision> Revision of software release

Example
ATI
Quectel
BC35-G
Revision:BC35GJAR01A01

OK

BC35-G&BC28_AT_Commands_Manual 13 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

3.2. ATE Set Command Echo Mode

The execution command determines whether or not the UE echoes characters received from external
MCU during command state. Please refer to Chapter 7 for possible <err> values.

ATE Set Command Echo Mode

Execution Command Response
ATE[<value>] OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<value> 0 Echo mode OFF

1 Echo mode ON

Example
ATE0
OK
ATI
Quectel
BC35-G
Revision:BC35GJAR01A01

OK
ATE1
OK
ATI
ATI
Quectel
BC35-G
Revision:BC35GJAR01A01

OK

BC35-G&BC28_AT_Commands_Manual 14 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

3.3. AT+CGMI Request Manufacturer Identification

The execution command returns manufacturer information. By default it will return “Quectel” on the
standard platform. Please refer to Chapter 7 for possible <err> values.

AT+CGMI Request Manufacturer Identification

Execution Command Response
AT+CGMI <manufacturer>

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CGMI=? OK

Parameter

<manufacturer> Manufacturer information. The total number of characters, including line

terminators, in the information text shall not exceed 2048 characters, and shall not
contain the sequence 0<CR> or OK<CR>.

Example
AT+CGMI
Quectel

OK

3.4. AT+CGMM Request Manufacturer Model

The execution command returns manufacturer model information. Please refer to Chapter 7 for possible
<err> values.

AT+CGMM Request Manufacturer Model

Execution Command Response
AT+CGMM <model>

OK

BC35-G&BC28_AT_Commands_Manual 15 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CGMM=? OK

Parameter

<model> Manufacturer model information. The total number of characters, including line
terminators, in the information text shall not exceed 2048 characters, and shall
not contain the sequence 0<CR> or OK<CR>.

Example
AT+CGMM
BC35GJA-02-STD

OK

3.5. AT+CGMR Request Manufacturer Revision

The execution command returns the manufacturer revision. The text is human-readable and is not
intended for microcontroller parsing. By default it will return the firmware revision - release and build.

The execution command returns one or more lines of information text <revision>. Please refer to Chapter
7 for possible <err> values.

AT+CGMR Request Manufacturer Revision

Execution Command Response
AT+CGMR <Revision>

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CGMR=? OK

Parameter

<revision> Manufacturer revision. The total number of characters, including line terminators, in

BC35-G&BC28_AT_Commands_Manual 16 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

the information text shall not exceed 2048 characters, and shall not contain the
sequence 0<CR> or OK<CR>.The <revision> may change format over time. It should
be treated as an opaque identifier.

Example
AT+CGMR
SECURITY_A,V150R100C10B180

PROTOCOL_A,V150R100C10B180

APPLICATION_A,V150R100C10B180

SECURITY_B,V150R100C10B180

OK
AT+CGMR=?
OK

3.6. AT+CGSN Request Product Serial Number

The execution command returns the IMEI (International Mobile station Equipment Identity) number and
related information. For UE which does not support <snt>, only "OK" is returned. Please refer to Chapter
7 for possible <err> values.

AT+CGSN Request Product Serial Number

Execution Command Response
AT+CGSN[=<snt>] When <snt>=0 (or omitted) and the command is executed
successfully:
<sn>

When <snt>=1 and the command is executed successfully:

+CGSN:<imei>

When <snt>=2 and the command is executed successfully:

+CGSN:<imeisv>

When <snt>=3 and the command is executed successfully:

+CGSN:<svn>

OK

BC35-G&BC28_AT_Commands_Manual 17 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CGSN=? When UE supports <snt> and the command is executed
successfully:
+CGSN:(list of supported <snt>s)

OK

Parameter

<snt> Integer type. The serial number type that has been requested.
0 Returns <sn>
1 Returns the IMEI number
2 Returns the IMEISV (International Mobile station Equipment Identity and Software
Version) number
3 Returns the SVN (Software Version Number)
<sn> The 128-bit UUID of the UE. The total number of characters, including line terminators, in
the information text shall not exceed 2048 characters, and shall not contain the sequence 0
<CR> or OK<CR>.
<imei> String type indecimal format indicating the IMEI number
<imeisv> String type indecimal format indicating the IMEISV number
<svn> String type indecimal format indicating the current SVN which is a part of IMEISV

Example
AT+CGSN=1 //Request the IMEI number
+CGSN:490154203237511

OK

3.7. AT+CEREG EPS Network Registration Status

The write command controls the presentation of an unsolicited result code (URC) “+CEREG:<stat>” when
<n>=1 and there is a change in the UE's EPS network registration status in E-UTRAN, or unsolicited
result code “+CEREG:<stat>[,[<tac>],[<ci>],[<AcT>]]” when <n>=2 and there is a change of the network
cell in E-UTRAN. The parameters <AcT>, <tac> and <ci> are provided only if available. The value <n>=3
further extends the unsolicited result code with [,<cause_type>,<reject_cause>], when available, when
the value of <stat> changes. Please refer to Chapter 7 for possible <err> values.

If the UE requests PSM for reducing its power consumption, the write command controls the presentation

BC35-G&BC28_AT_Commands_Manual 18 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

of an unsolicited result code: “+CEREG:<stat>[,[<tac>],[<ci>],[<AcT>][,[<cause_type>],[<reject_cause>][,

[<Active-Time>],[<Periodic-TAU>]]]]”.

When <n>=4, the unsolicited result code will provide the UE with additional information for the active time
value and the extended periodic TAU value if there is a change of the network cell in E-UTRAN. The value
<n>=5 further enhances the unsolicited result code with <cause_type> and <reject_cause> when the
value of <stat> changes. The parameters <AcT>, <tac>, <ci>, <cause_type>, <reject_cause>,
<Active-Time> and <Periodic-TAU> are provided only if available.

The read command returns the status of result code presentation and an integer <stat> which shows
whether the network has currently indicated the registration of the UE. Location information elements
<tac>, <ci> and <AcT>, if available, are returned only when <n>=2 and UE is registered on the network.
The parameters [,<cause_type>,<reject_cause>], if available, are returned when <n>=3.

The test command returns supported parameter values.

AT+CEREG EPS Network Registration Status

Write Command Response
AT+CEREG=<n> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CEREG? When <n>=0, 1, 2 or 3 and the command is executed
successfully:
+CEREG:<n>,<stat>[,[<tac>],[<ci>],[<AcT>[,<cause_type>
,<reject_ cause>]]]

When <n>=4 or 5 and the command is executed successfully:

+CEREG:<n>,<stat>[,[<tac>],[<ci>],[<AcT>],[<rac>][,[<cau
se_type>],[<reject_cause>][,[<Active-Time>],[<Periodic-T
AU>]]]]

OK
Test Command Response
AT+CEREG=? +CEREG:(list of supported <n>s)

OK

Parameter

<n> Integer type

0 Disable network registration unsolicited result code

BC35-G&BC28_AT_Commands_Manual 19 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

1 Enable network registration unsolicited result code: “+CEREG:<stat>”

2 Enable network registration and location information unsolicited result code:
“+CEREG:<stat>[,[<tac>],[<ci>],[<AcT>]]”
3 Enable network registration, location information and EMM cause value information
unsolicited result code:
“+CEREG:<stat>[,[<tac>],[<ci>],[<AcT>][,<cause_type>,<reject_cause>]]”
4 For a UE that requests PSM, enable network registration and location information
unsolicited result code:
“+CEREG:<stat>[,[<tac>],[<ci>],[<AcT>][,,[,[<Active-Time>],[<Periodic-TAU>]]]]”
5 For a UE that requests PSM, enable network registration, location information and
EMM cause value information unsolicited result code:
“+CEREG:<stat>[,[<tac>],[<ci>],[<AcT>][,[<cause_type>],[<reject_cause>][,[<Active-
Time>],[<Periodic-TAU>]]]]”
<stat> Integer type. The EPS registration status.
0 Not registered, UE is not currently searching an operator to register to
1 Registered, home network
2 Not registered, but UE is currently trying to attach or searching an operator to register
to
3 Registration denied
4 Unknown (e.g. out of E-UTRAN coverage)
5 Registered, roaming
<tac> String type. Two bytes tracking area code in hexadecimal format (e.g. “00C3” equals 195 in
decimal).
<ci> String type. Four bytes E-UTRAN cell ID in hexadecimal format.
<AcT> Integer type. The access technology of the serving cell.
7 E-UTRAN
9 E-UTRAN (NB-S1 mode)
<cause_type> Integer type. The type of <reject_cause>.
0 Indicates that <reject_cause> contains an EMM cause value
1 Indicates that <reject_cause> contains a manufacturer-specific cause value
<reject_cause> Integer type. Contains the cause of the failed registration. The value is of type as
defined by <cause_type>.
<Active-Time> String type. One byte in an 8-bit format. Indicates the active time value (T3324)
allocated to the UE in E-UTRAN. The active time value is coded as one byte (octet 3)
of the GPRS Timer 2 information element coded as bit format (e.g. “00100100” equals
4 minutes).
Bits 5 to 1 represent the binary coded timer value.
Bits 6 to 8 defines the timer value unit for the GPRS timer as follows:
Bits
876
0 0 0 value is incremented in multiples of 2 seconds
0 0 1 value is incremented in multiples of 1 minute
0 1 0 value is incremented in multiples of decihours
1 1 1 value indicates that the timer is deactivated.

BC35-G&BC28_AT_Commands_Manual 20 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Other values shall be interpreted as multiples of 1 minute in this version of the

protocol.
<Periodic-TAU> String type. One byte in an 8-bit format. Indicates the extended periodic TAU value
(T3412) allocated to the UE in E-UTRAN. The extended periodic TAU value is coded
as one byte (octet 3) of the GPRS Timer 3 information element coded as bit format
(e.g. “01000111” equals 70 hours).
Bits 5 to 1 represent the binary coded timer value.
Bits 6 to 8 defines the timer value unit for the GPRS timer as follows:
Bits
876
0 0 0 value is incremented in multiples of 10 minutes
0 0 1 value is incremented in multiples of 1 hour
0 1 0 value is incremented in multiples of 10 hours
0 1 1 value is incremented in multiples of 2 seconds
1 0 0 value is incremented in multiples of 30 seconds
1 0 1 value is incremented in multiples of 1 minute
1 1 0 value is incremented in multiples of 320 hours
1 1 1 value indicates that the timer is deactivated

Example
AT+CEREG=1 //Enable network registration URC.
OK
AT+CEREG?
+CEREG:1,1

OK
AT+CEREG=?
+CEREG:(0,1,2,3,4,5)

OK

3.8. AT+CSCON Signalling Connection Status

The command gives details of the UE’s perceived radio connection status (i.e. to the base station). It
returns an indication of the current state. Please note that this state is only updated when radio events,
such as sending and receiving, take place. This means that the current state may be out of date. The
terminal may think it is "Connected" yet cannot currently use a base station due to a change in the link
quality.

The write command controls the presentation of an unsolicited result code. If setting fails, an UE error,
“+CME ERROR:<err>” is returned. Please refer to Chapter 7 for possible <err> values.

BC35-G&BC28_AT_Commands_Manual 21 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

When the UE is in E-UTRAN, the mode of the UE refers to idle when no PS signalling connection and to
connected mode when a PS signalling connection between UE and network is set up.

The <state> value indicates the state of the UE when the UE is in E-UTRAN.

The read command returns the status of result code presentation and an integer <mode> which shows
whether the UE is currently in idle mode or connected mode.

The test command returns supported values as a compound value.

AT+CSCON Signalling Connection Status

Write Command Response
AT+CSCON=<n> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CSCON? +CSCON:<n>,<mode>

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CSCON=? +CSCON:(list of supported <n>s)

OK

Parameter

<n> Integer type. Enable/disable unsolicited result code.

0 Disable unsolicited result code
1 Enable unsolicited result code: “+CSCON:<mode>”
<mode> Integer type. The signalling connection status.
0 Idle
1 Connected
2-255 <reserved for future use>

Example
AT+CSCON=0
OK
AT+CSCON?

BC35-G&BC28_AT_Commands_Manual 22 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

+CSCON:0,1

OK
AT+CSCON=?
+CSCON:(0,1)

OK
AT+CSCON=1
OK
AT+CSCON?
+CSCON:1,1

OK

3.9. AT+CLAC List Available Commands

The command lists the available AT commands. The execution command causes the UE to return one or
more lines of AT commands. Please refer to Chapter 7 for possible <err> values. Please note that this
command only returns the AT commands that are available for the user.

AT+CLAC List Available Commands

Execution Command Response
AT+CLAC <AT Command>
[<CR><LF><AT Command>[...]]

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CLAC=? OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<AT Command> Defines the AT command including the prefix AT. Text shall not contain the
sequence 0<CR> or OK<CR>.

BC35-G&BC28_AT_Commands_Manual 23 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Example
AT+CLAC
AT+COPS

AT+CGATT

...

AT+NSOCR

AT+NSOST

OK

3.10. AT+CSQ Get Signal Strength Indicator

The execution command returns received signal strength indication <rssi> and channel bit error rate
<ber> from the UE. Please refer to Chapter 7 for possible <err> values.

The test command returns values supported as compound values.

AT+CSQ Get Signal Strength Indicator

Execution Command Response
AT+CSQ +CSQ:<rssi>,<ber>

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CSQ=? +CSQ:(list of supported <rssi>s),(list of supported <ber>s)

OK

Parameter

<rssi> Integer type. Received signal strength. Unit: dBm.

0 -113dBm or less

BC35-G&BC28_AT_Commands_Manual 24 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

1 -111dBm
2...30 -109dBm... -53dBm
31 -51dBm or greater
99 Not known or not detectable
<ber>* Integer type. Channel bit error rate (in percent).
0...7 As RXQUAL values (please refer to 3GPP specifications)
99 Not known or not detectable

NOTE

<ber> is currently not supported, and will always be 99.

Example
AT+CSQ
+CSQ:31,99

OK

3.11. AT+CGPADDR Show PDP Addresses

The command returns the IP address of the device.

The execution command returns a list of PDP addresses for the specified context identifiers. If no <cid> is
specified, the addresses for all defined contexts are returned. Please refer to Chapter 7 for possible <err>
values.

The test command returns a list of defined <cid>s. These are <cid>s that have been activated and may or
may not have an IP address associated with them.

AT+CGPADDR Show PDP Addresses

Execution/Write Command Response
AT+CGPADDR[=<cid>[,<cid>[,...]]] [+CGPADDR:<cid>[,<PDP_addr_1>[,<PDP_addr_2>]]]
[<CR><LF>+CGPADDR:<cid>,[<PDP_addr_1>[,<PDP_add
r_2>]]
[...]]

OK
Test Command Response
AT+CGPADDR=? +CGPADDR:(list of defined <cid>s)

BC35-G&BC28_AT_Commands_Manual 25 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

OK

Parameter

<cid> Integer type. Specifies a particular PDP context definition (see the AT+CGDCONT command).
<cid> values between 0 and 10 are supported.
<PDP_addr_1> and <PDP_addr_2> String type. Identify the UE in the address space applicable to
the PDP. The address may be static or dynamic. For a static
address, it will be the one set by the AT+CGDCONT command
when the context was defined. For a dynamic address it will be
the one assigned during the last PDP context activation that
used the context definition referred to by <cid>. Both
<PDP_addr_1> and <PDP_addr_2> are omitted if none is
available. <PDP_addr_1> and <PDP_addr_2> are included
when both IPv4 and IPv6 addresses are assigned, with
<PDP_addr_1> containing the IPv4 address and
<PDP_addr_2> containing the IPv6 address.
When AT+CGPIAF is supported, its settings can influence the
format of the IPv6 address in parameter <PDP_addr_1> or
<PDP_addr_2> returned with the execute form of
AT+CGPADDR.

NOTES

1. In dual-stack terminals (<PDP_type>=IPv4v6), the IPv6 address will be provided in <PDP_addr_2>.

For terminals with a single IPv6 stack (<PDP_type>=IPv6) or due to backwards compatibility, the
IPv6 address can be provided in parameter <PDP_addr_1>.
2. With AUTOCONNECT enabled, <cid>=0 will not be listed until an IP address is acquired.

Example
AT+CGPADDR=0
+CGPADDR:0,101.43.5.1

OK
AT+CGPADDR=?
+CGPADDR:(0)

OK

BC35-G&BC28_AT_Commands_Manual 26 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

3.12. AT+COPS PLMN Selection

The write command forces an attempt to select and register the EPS network operator using the USIM
card installed in the currently selected card slot. <mode> is used to select whether the selection is done
automatically by the UE or is forced by this command to operator <oper> (it shall be given in format
<format>) to a certain access technology, indicated in <AcT>. If the selected operator is not available, no
other operator shall be selected. If the selected access technology is not available, then the same
operator shall be selected in other access technology. The selected operator name format shall also apply
to the read command (AT+COPS?). <mode>=2 forces an attempt to deregister from the network. The
selected mode affects all further network registration (e.g. after <mode>=2, UE shall be unregistered until
<mode>=0 or 1 is selected). This command should be abortable when registration/deregistration attempt
is made. Please refer to Chapter 7 for possible <err> values.

The read command returns the current mode, the currently selected operator and the current access
technology. If no operator is selected, <format>, <oper> and <AcT> are omitted.

The test command returns a set of five parameters, each representing an operator present in the network.
A set consists of an integer indicating the availability of the operator <stat>, long and short alphanumeric
format of the operator’s name, numeric format representation of the operator and access technology. Any
of the formats may be unavailable and should then be an empty field. The list of operators shall be in the
order of: home network, networks referenced in USIM or active application in the UICC (USIM) in the
following order: HPLMN selector, user controlled PLMN selector, operator controlled PLMN selector and
PLMN selector (in the USIM), and other networks.

The <AcT> access technology selected parameters should only be used in terminals capable to register
to more than one access technology. Selection of <AcT> does not limit the capability to cell reselections,
even though an attempt is made to select an access technology, the UE may still re-select a cell in
another access technology.

AT+COPS PLMN Selection

Write Command Response
AT+COPS=<mode>[,<format>[,<oper OK
>[,<AcT>]]]
If there is any error, response:
+CME ERROR:<err>
Read Command Response
AT+COPS? +COPS:<mode>[,<format>,<oper>]

OK

If there is any error, response:

+CME ERROR:<err>

BC35-G&BC28_AT_Commands_Manual 27 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Test Command Response

AT+COPS=? +COPS:[list of supported (<stat>, numeric <oper>[,<Ac
T>])s][,,(list of supported <mode>s),(list of supported <for
mat>s)]

OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<mode> Integer type

0 Automatic (<oper> field is ignored)
1 Manual (<oper> field shall be present, and <AcT> is optional)
2 Deregister from network.
When <mode>=1, the PLMN setting will not be retained after the UE is rebooted.
<mode>=1 is only for development use and <mode>=0 should be used in production when
AUTOCONNECT is enabled.
<format> Integer type
2 Numeric <oper>
<oper> String type. <format> indicates if the format is numeric; numeric format is the NB-IoT
network location area identification number which consists of a three BCD digit ITU-T
country code coded, plus a two or three BCD digit network code, which is administration
specific. <oper> field could not be present when <mode>=0.
<stat> Integer type
0 Unknown
1 Available
2 Current
3 Forbidden
<AcT> Integer type. Access technology selected. No <Act> returned for AT+COPS?.
7 E-UTRAN
9 E-UTRAN (NB-S1 mode)

Example
AT+COPS=0
OK
AT+COPS?
+COPS:0,2,"46000"

OK
AT+COPS=?
+COPS:(2,,,"46000"),,(0-2),(2)

BC35-G&BC28_AT_Commands_Manual 28 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

OK

NOTES

1. When <mode>=1 is used, the PLMN setting will not persist after the UE is rebooted.
2. The test command currently returns the configured values rather than performing a PLMN search.

3.13. AT+CGATT PS Attach or Detach

The execution command is used to attach the UE to, or detach the UE from, the packet domain service.
After the command has completed, the UE remains in V.250 command state. If the UE is already in the
requested state, the command is ignored and the “OK” response is returned. If AT+CGATT is in progress,
further execution of this command before the finishing of attach or detach procedure will return an error. If
the requested state cannot be achieved, an “ERROR” or “+CME ERROR” response is returned. Please
refer to Chapter 7 for possible <err> values.

Any active PDP contexts will be automatically deactivated when the attachment state changes to
detached.

The read command returns the current packet domain service state.

The test command is used for requesting information on the supported packet domain service states.

AT+CGATT PS Attach or Detach

Write Command Response
AT+CGATT=<state> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CGATT? +CGATT:<state>

OK
Test Command Response
AT+CGATT=? +CGATT:(list of supported <state>s)

OK

BC35-G&BC28_AT_Commands_Manual 29 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Parameter

<state> Integer type. Indicates the state of PDP context activation.

0 Detached
1 Attached
When <state>=1, AT+COPS=0 is automatically selected.

Example
AT+CGATT?
+CGATT:0

OK
AT+CGATT=1
OK
AT+CGATT=?
+CGATT:(0,1)

OK

NOTE

If the initial PDP context is supported, the context with <cid>=0 is automatically defined at startup.

3.14. AT+CGACT Activate or Deactivate PDP Context

The execution command is used to activate or deactivate the specified PDP context(s). After the
command has completed, the UE remains in V.250 command state. If any PDP context is already in the
requested state, the state for that context remains unchanged. If the requested state for any specified
context cannot be achieved, an “ERROR” or “+CME ERROR” response is returned. Extended error
responses are enabled by the AT+CMEE command. If the UE is not PS attached when the activation form
of the command is executed, the UE first performs a PS attach and then attempts to activate the specified
contexts. If the attach fails then the UE responds with error or, if extended error responses are enabled,
with the appropriate failure-to-attach error message. Please refer to Chapter 7 for possible <err> values.

For EPS, if an attempt is made to disconnect the last PDN connection, then the UE responds with
“ERROR” or, if extended error responses are enabled, a “+CME ERROR”.

For EPS, the activation request for an EPS bearer resource will be answered by the network by either an
EPS dedicated bearer activation or EPS bearer modification request. The request must be accepted by
the UE before the PDP context can be set into established state.

BC35-G&BC28_AT_Commands_Manual 30 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

If no <cid>s are specified, the activation form of the command activates all defined non-emergency
contexts, and the deactivation form of the command deactivates all active contexts.

The read command returns the current activation states for all the defined PDP contexts.

The test command is used for requesting information on the supported PDP context activation states.

AT+CGACT Activate or Deactivate PDP Context

Write Command Response
AT+CGACT=<state>,<cid>[,<cid>[,...]] OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CGACT? +CGACT:<cid>,<state>[...]

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CGACT=? +CGACT:(list of supported <state>s)

OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<state> Integer type. Indicates the activation state of PDP context.

0 Deactivated
1 Activated
<cid> Integer type. Specifies a particular PDP context definition (see the AT+CGDCONT). Only
one <cid> can be activated or deactivated at a time.

Example
AT+CGACT=0,1
OK
AT+CGACT?
+CGACT:1,0

BC35-G&BC28_AT_Commands_Manual 31 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

OK
AT+CGACT=?
+CGACT:(0,1)

OK

NOTE

If the initial PDP context is supported, the context with <cid>=0 is automatically defined at startup.

3.15. AT+CIMI Request International Mobile Subscriber Identity

The command returns International Mobile Subscriber Identity (string without double quotes).

The execution command causes the UE to return <IMSI>, which is intended to permit the TE to identify
the individual USIM card or active application in the UICC (USIM) which is attached to UE.

Please refer to Chapter 7 for possible <err> values.

AT+CIMI Request International Mobile Subscriber Identity

Execution Command Response
AT+CIMI <IMSI>

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CIMI=? OK

Parameter

<IMSI> International Mobile Subscriber Identity (string without double quotes).

NOTE

IMSI may not be displayed for a few seconds after power-on.

BC35-G&BC28_AT_Commands_Manual 32 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Example
AT+CIMI
460001357924680

OK

3.16. AT+CGDCONT Define a PDP Context

The write command specifies PDP context parameter values for a PDP context identified by <cid>, and
the (local) context identification parameter. It also allows the TE to specify whether security protected
transmission of ESM information is requested, because the PCO can include information that requires
ciphering. There can be other reasons for the UE to use security protected transmission of ESM
information, e.g. if the UE needs to transfer an APN. The number of PDP contexts that may be in a
defined state at the same time is given by the range returned by the test command. Please refer to
Chapter 7 for possible <err> values.

For EPS, the PDN connection and its associated EPS default bearer is identified herewith.

A special form of the write command, AT+CGDCONT=<cid> causes the values for context number <cid>
to become undefined.

If the initial PDP context is supported, the context with <cid>=0 is automatically defined at startup, the
parameters for <cid>=0 can be modified with AT+CGDCONT. If the initial PDP context is supported,
AT+CGDCONT=0 resets context number 0 to its particular default settings.

The read command returns the current settings for each defined context.

The test command returns values supported as compound values. If the UE supports several PDP types,
the parameter value ranges for each <PDP_type> are returned on a separate line.

AT+CGDCONT Define a PDP Context

Write Command Response
AT+CGDCONT=<cid>[,<PDP_type>[,< OK
APN>[,,,,,,,,<NSLPI>]]]
Read Command Response
AT+CGDCONT? +CGDCONT:<cid>,<PDP_type>,<APN>[,,,,,,,,<NSLPI>]

OK
Test Command Response
AT+CGDCONT=? +CGDCONT:(range of supported <cid>s),<PDP_typ
e>,,,,,,,,,(list of supported <NSLPI>s)

BC35-G&BC28_AT_Commands_Manual 33 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

[...]

OK

Parameter

<cid> Integer type. Specifies a particular PDP context definition. The parameter is local to
the TE-UE interface and is used in other PDP context-related commands. The range
of permitted values (minimum value=1 or if the initial PDP context is supported,
minimum value=0) is returned by the test form of the command.
The <cid>s for network-initiated PDP contexts will have values outside the ranges
indicated for the <cid> in the test form of the AT+CGDCONT and AT+CGDSCONT
commands.
<cid> values of 0-10 are supported.
<cid>=0 is read only and is only defined when AUTOCONNECT is enabled.
<cid> value of 7 cannot be set when BIP is enabled.
<PDP_type> String type. Specifies the type of packet data protocol.
IP Internet Protocol (IETF STD 5 [103])
IPv6* Internet Protocol, version 6
IPv4v6* Virtual <PDP_type> introduced to handle dual IP stack UE capability
NONIP None IP
<APN> String type. A logical name that is used to select the GGSN or the external packet data
network. If the value is null or omitted, then the subscription value will be requested.
Maximum number of <APN> string is 63 characters.
<NSLPI> Integer type. Indicates the NAS signalling priority requested for this PDP context.
0 Indicates that this PDP context is to be activated with the value for the
low priority indicator configured in the UE.
1 Indicates that this PDP context is to be activated with the value for the
low priority indicator set to "MS is not configured for NAS signalling low
priority".
The UE utilizes the provided NSLPI information as specified in 3GPP TS
24.301 [83] and 3GPP TS 24.008.

Example
AT+CGDCONT=?
+CGDCONT:(0-10),("IP","NONIP"),,,,,,,,,(0,1)

OK
AT+CGDCONT=1,"IP","HUAWEI.COM"
OK
AT+CGDCONT?
+CGDCONT:1,"IP","HUAWEI.COM" ,,,,,,,,0

BC35-G&BC28_AT_Commands_Manual 34 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

OK

3.17. AT+CFUN Set UE Functionality

The write command selects the level of functionality in the UE. Level "full functionality" is where the
highest level of power is drawn. "Minimum functionality" is where minimum power is drawn.

The read command returns the current setting of <fun>.

The test command returns values supported by the UE as compound values.

Please refer to Chapter 7 for possible <err> values.

AT+CFUN Set UE Functionality

Write Command Response
AT+CFUN=<fun>[,<rst>] OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CFUN? +CFUN:<fun>

OK
Test Command Response
AT+CFUN=? +CFUN:(list of supported <fun>s), (list of supported <rst>s)

OK

Parameter

<fun> Integer type. UE functionality level

0 Minimum functionality
1 Full functionality. Enable UE to transmit and receive RF circuits for all
supported radio access technologies. For UE supporting AT+CSRA, this
equals the RATs indicated by the response of AT+CSRA=?. Currently
AT+CSRA setting is ignored. It is not required that the transmitting and
receiving RF circuits are in a disabled state when this setting takes effect.
After this action and AT+CFUN has returned “OK”, the UE can be shut down
with <fun>=0, or by other means.
<rst> Integer type. UE resetting
0 Do not reset the UE before setting it to <fun> power level. This shall always

BC35-G&BC28_AT_Commands_Manual 35 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

be defaulted when <rst> is not given.

1 Reset the UE before setting it to <fun> power level (not supported and will be
ignored)

NOTE

Deep sleep mode will be entered when the system is quiescent, but only if it has been enabled by the
network.

Example
AT+CFUN=?
+CFUN:(0,1),(0,1)

OK
AT+CFUN=1
OK
AT+CFUN?
+CFUN:1

OK

3.18. AT+CMEE Report UE Error

The write command disables or enables the use of final result code “+CME ERROR:<err>” as an
indication of an error relating to the functionality of the UE. When enabled, UE related errors cause
“+CME ERROR:<err>” final result code instead of the regular “ERROR” final result code. “ERROR” is
returned normally when error is related to syntax, invalid parameters or UE functionality.

The read command returns the current setting of <n>.

The test command returns values supported as a compound value.

Please refer to Chapter 7 for possible <err> values.

AT+CMEE Report UE Error

Write Command Response
AT+CMEE=<n> OK
Read Command Response
AT+CMEE? +CMEE:<n>

BC35-G&BC28_AT_Commands_Manual 36 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

OK

Test Command Response

AT+CMEE=? +CMEE:(list of supported <n>s)

OK

Parameter

<n> Integer type. Error mode.

0 Disable “+CMEE ERROR:<err>” result code and use “ERROR” instead
1 Enable “+CMEE ERROR:<err>” result code and use numeric <err> values
(Please refer to Chapter 7 for possible <err> values)

3.19. AT+CCLK Return Current Date and Time

The clock will be set automatically once the UE has connected to the network.

The read command returns the current setting of the clock.

Please refer to Chapter 7 for possible <err> values.

AT+CCLK Return Current Date and Time

Read Command Response
AT+CCLK? +CCLK:<time>

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CCLK=? OK

Parameter

<time> String type. The format is "yy/MM/dd,hh:mm:ss±zz", where characters indicate

year (two last digits), month, day, hour, minute, second and time zone (indicates
the difference, expressed in quarters of an hour, between the local time and GMT;
and range is -96 ~ +96). For instance, 6th of May 1994, 22:10:00 GMT+2 hours
equals "94/05/06,22:10:00+08"

BC35-G&BC28_AT_Commands_Manual 37 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

NOTES

1. If UE does not support time zone information then the three last characters of <time> are not returned
by AT+CCLK? command.
2. If the RTC has not been set by the network, no value is returned.

Example
AT+CCLK?
OK
AT+CCLK=?

OK

3.20. AT+CPSMS Power Saving Mode Setting

The write command controls the setting of the UE’s power saving mode (PSM) parameters. It can be used
to control whether the UE wants to apply PSM or not. Please refer to the unsolicited result codes provided
by AT+CGREG for the active time value, and the extended periodic TAU value that are allocated to the
UE by the network in E-UTRAN.

A special form of the command can be given as AT+CPSMS=2. In this form, the use of PSM will be
disabled and data for all parameters in AT+CPSMS command will be removed or, if available, set to the
default values.

The read command returns the current parameter values.

The test command returns the supported <mode>s and the value ranges for the requested extended
periodic TAU value in E-UTRAN and the requested active time value as compound values.

Please refer to Chapter 7 for possible <err> values.

AT+CPSMS Power Saving Mode Setting

Write Command Response
AT+CPSMS=<mode>[,,,<Requested_ OK
Periodic-TAU>[,<Requested_Active-T
ime>]] If there is any error, response:
+CME ERROR:<err>
Read Command Response
AT+CPSMS? +CPSMS:<mode>[,,,<Requested_Periodic-TAU>],[<Reque
sted_Active-Time>]

BC35-G&BC28_AT_Commands_Manual 38 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

OK
Test Command Response
AT+CPSMS=? +CPSMS:(list of supported <mode>s),,,(list of supported
<Requested_Periodic-TAU>s),(list of supported
<Requested_Active-Time>s)

OK

Parameter

<mode> Integer type. Disable or enable the use of PSM in the UE

0 Disable the use of PSM
1 Enable the use of PSM
2 Disable the use of PSM and discard all parameters for PSM or, if available, reset to the
default values.
<Requested_Periodic-TAU> String type. One byte in an 8 bit format. Requested extended
periodic TAU value (T3412) to be allocated to the UE in
E-UTRAN. The requested extended periodic TAU value is
coded as one byte (octet 3) of the GPRS Timer 3 information
element coded as bit format (e.g. "01000111" equals 70 hours).
Bits 5 to 1 represent the binary coded timer value
Bits 6 to 8 define the timer value unit as follows:
Bits
876
0 0 0 value is incremented in multiples of 10 minutes
0 0 1 value is incremented in multiples of 1 hour
0 1 0 value is incremented in multiples of 10 hours
0 1 1 value is incremented in multiples of 2 seconds
1 0 0 value is incremented in multiples of 30 seconds
1 0 1 value is incremented in multiples of 1 minute
1 1 0 value is incremented in multiples of 320 hours(note)
1 1 1 value indicates that the timer is deactivated.
The default value is 10 hours.
<Requested_Active-Time> String type. One byte in an 8 bit format. Requested Active Time
value (T3324) to be allocated to the UE. The requested Active
Time value is coded as one byte (octet 3) of the GPRS Timer 2
information element coded as bit format (e.g. "00100100"
equals 4 minutes).
Bits 5 to 1 represent the binary coded timer value.
Bits 6 to 8 defines the timer value unit for the GPRS timer as
follows:
Bits

BC35-G&BC28_AT_Commands_Manual 39 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

876
0 0 0 value is incremented in multiples of 2 seconds
0 0 1 value is incremented in multiples of 1 minute
0 1 0 value is incremented in multiples of decihours
1 1 1 value indicates that the timer is deactivated.
The default value is 10 seconds.

NOTES

1. This timer value unit is only applicable to the T3412 extended value IE. If it is received in an integrity
protected message, value shall be interpreted as multiples of 320 hours. Otherwise value shall be
interpreted as multiples of 1 hour.
2. AT+CPSMS? read command could only get mode value 0 and 1.

Example
AT+CPSMS=1,,,01000011,01000011
OK
AT+CPSMS?
+CPSMS:1,,,01000011,01000011

OK
AT+CPSMS=?
+CPSMS:(0,1,2),,,( 00000000-11111111), (00000000-11111111)

OK

3.21. AT+CEDRXS eDRX Setting

The write command controls the setting of the UE’s eDRX parameters. It can be used to control whether
the UE wants to apply eDRX or not, as well as the requested eDRX value for each specified type of
access technology.

The write command also controls the presentation of an unsolicited result code
+CEDRXP:<AcT-type>[,<Requested_eDRX_value>[,<NW-provided_eDRX_value>[,<Paging_time_wind
ow>]]] when <n>=2 and there is a change in the eDRX parameters provided by the network.

A special form of the command can be given as AT+CEDRXS=3. In this form, eDRX will be disabled and
data for all parameters in AT+CEDRXS command will be removed.

The read command returns the current settings for each defined value of <AcT-type>.

BC35-G&BC28_AT_Commands_Manual 40 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

The test command returns the supported <mode>s and the value ranges for the access technology and
the requested eDRX value as compound values.

Please refer to Chapter 7 for possible <err> values.

AT+CEDRXS eDRX Setting

Write Command Response
AT+CEDRXS=<mode>,<AcT-type>[,< OK
Requested_eDRX_value>]
If there is any error, response:
+CME ERROR:<err>
Read Command Response
AT+CEDRXS? +CEDRXS:<AcT-type>,<Requested_eDRX_value>

OK
Test Command Response
AT+CEDRXS=? +CEDRXS:(list of supported <mode>s),(list of supported
<AcT-type>s),(list of supported
<Requested_eDRX_value>s)

OK

Parameter

<mode> Integer type. Disable or enable the use of eDRX in the UE. This parameter is
applicable to all specified types of access technology, i.e. the most recent setting of
<mode> will take effect for all specified values of <AcT-type>.
0 Disable the use of eDRX
1 Enable the use of eDRX
2 Enable the use of eDRX and enable the unsolicited result code
+CEDRXP:<AcT-type>[,<Requested_eDRX_value>[,<NW-provided_eDRX_
value>[,<Paging_time_window>]]]
3 Disable the use of eDRX and discard all parameters for eDRX.
<AcT-type> Integer type. Indicates the type of access technology. AT+CEDRXS? is used to specify
the relationship between the type of access technology and the requested eDRX
value.
0 Access technology is not using eDRX. This parameter value is only used in
the unsolicited result code.
5 E-UTRAN (NB-S1 mode)
<Requested_eDRX_value> String type. Half a byte in a 4 bit format. NB-S1 mode.
bit
4 3 2 1 E-UTRAN eDRX cycle length duration
0 0 1 0 20.48 seconds

BC35-G&BC28_AT_Commands_Manual 41 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

0 0 1 1 40.96 seconds
0 1 0 1 81.92 seconds
1 0 0 1 163.84 seconds
1 0 1 0 327.68 seconds
1 0 1 1 655.36 seconds
1 1 0 0 1310.72 seconds
1 1 0 1 2621.44 seconds
1 1 1 0 5242.88 seconds
1 1 1 1 10485.76 seconds
<NW-provided_eDRX_value> String type. Half a byte in a 4 bit format. NB-S1 mode.
bit
4 3 2 1 E-UTRAN eDRX cycle length duration
0 0 1 0 20.48 seconds
0 0 1 1 40.96 seconds
0 1 0 1 81.92 seconds
1 0 0 1 163.84 seconds
1 0 1 0 327.68 seconds
1 0 1 1 655.36 seconds
1 1 0 0 1310.72 seconds
1 1 0 1 2621.44 seconds
1 1 1 0 5242.88 seconds
1 1 1 1 10485.76 seconds
<Paging_time_window> String type. Half a byte in a 4 bit format. NB-S1 mode.
bit
4 3 2 1 Paging Time Window length
0 0 0 0 2.56 seconds
0 0 0 1 5.12 seconds
0 0 1 0 7.68 seconds
0 0 1 1 10.24 seconds
0 1 0 0 12.8 seconds
0 1 0 1 15.36 seconds
0 1 1 0 17.92 seconds
0 1 1 1 20.48 seconds
1 0 0 0 23.04 seconds
1 0 0 1 25.6 seconds
1 0 1 0 28.16 seconds
1 0 1 1 30.72 seconds
1 1 0 0 33.28 seconds
1 1 0 1 35.84 seconds
1 1 1 0 38.4 seconds
1 1 1 1 40.96 seconds
1 1 1 1 40.96 seconds

BC35-G&BC28_AT_Commands_Manual 42 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Example
AT+CEDRXS=1,5,"0101"
OK
AT+CEDRXS?
+CEDRXS:5,"0101"

OK
AT+CEDRXS=?
+CEDRXS:(0,1,2,3),(5),("0000"-"1111")

OK

AT+CEDRXS=0,5

OK

3.22. AT+CEER Extended Error Report

The execution command causes the UE to return one or more lines of information text <report>,
determined by the UE manufacturer, which should offer the user of the UE an extended report of the
reason for the following errors:

 The failure in the last call release;

 The failure in the last unsuccessful PDP context activation;
 The failure in the PDP context deactivation.

Typically, the text will consist of a single line containing the cause information given by network in textual
format.

AT+CEER Extended Error Report

Execution Command Response
AT+CEER +CEER <report>

OK
Test Command Response
AT+CEER=? OK

Parameter

<report> Extended error report. The total number of characters, including line terminators, in the

BC35-G&BC28_AT_Commands_Manual 43 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

information text shall not exceed 2041 characters. The text shall not contain the sequence
0<CR> or OK<CR>.

Example
AT+CEER
+CEER:EMM_CAUSE_EPS_AND_NON_EPS_SERVICES_NOT_ALLOWED

OK
AT+CEER=?

OK

3.23. AT+CEDRXRDP eDRX Read Dynamic Parameters

The execution command returns <AcT-type>, <Requested_eDRX_value>, <NW-provided_eDRX_value>

and <Paging_time_window> if eDRX is used for the cell that the UE is currently registered to.

If the cell that the UE is currently registered to is not using eDRX, <AcT-type>=0 is returned.

Please refer to Chapter 7 for possible <err> values.

AT+CEDRXRDP eDRX Read Dynamic Parameters

Execution Command Response
AT+CEDRXRDP +CEDRXRDP:<AcT-type>[,<Requested_eDRX_value>[,<N
W-provided_eDRX_value>[,<Paging_time_window>]]]

OK
Test Command Response
AT+CEDRXRDP=? OK

Parameter

<AcT-type> Integer type. The type of access technology. AT+CEDRXS? is used to specify the
relationship between the type of access technology and the requested eDRX value.
0 Access technology is not using eDRX. This parameter value is only used in
the unsolicited result code
5 E-UTRAN (NB-S1 mode)
<Requested_eDRX_value> String type. Half a byte in a 4-bit format. NB-S1 mode.
bit
4 3 2 1 E-UTRAN eDRX cycle length duration

BC35-G&BC28_AT_Commands_Manual 44 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

0 0 1 0 20.48 seconds
0 0 1 1 40.96 seconds
0 1 0 1 81.92 seconds
1 0 0 1 163.84 seconds
1 0 1 0 327.68 seconds
1 0 1 1 655.36 seconds
1 1 0 0 1310.72 seconds
1 1 0 1 2621.44 seconds
1 1 1 0 5242.88 seconds
1 1 1 1 10485.76 seconds
<NW-provided_eDRX_value> String type. Half a byte in a 4-bit format. NB-S1 mode.
bit
4 3 2 1 E-UTRAN eDRX cycle length duration
0 0 1 0 20.48 seconds
0 0 1 1 40.96 seconds
0 1 0 1 81.92 seconds
1 0 0 1 163.84 seconds
1 0 1 0 327.68 seconds
1 0 1 1 655.36 seconds
1 1 0 0 1310.72 seconds
1 1 0 1 2621.44 seconds
1 1 1 0 5242.88 seconds
1 1 1 1 10485.76 seconds
<Paging_time_window> String type. Half a byte in a 4 bit format. NB-S1 mode.
bit
4 3 2 1 Paging Time Window length
0 0 0 0 2.56 seconds
0 0 0 1 5.12 seconds
0 0 1 0 7.68 seconds
0 0 1 1 10.24 seconds
0 1 0 0 12.8 seconds
0 1 0 1 15.36 seconds
0 1 1 0 17.92 seconds
0 1 1 1 20.48 seconds
1 0 0 0 23.04 seconds
1 0 0 1 25.6 seconds
1 0 1 0 28.16 seconds
1 0 1 1 30.72 seconds
1 1 0 0 33.28 seconds
1 1 0 1 35.84 seconds
1 1 1 0 38.4 seconds
1 1 1 1 40.96 seconds

BC35-G&BC28_AT_Commands_Manual 45 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Example
AT+CEDRXRDP
+CEDRXRDP:5,"0010","1110","0101"

OK
AT+CEDRXRDP=?

OK

3.24. AT+CTZR Time Zone Reporting

The write command controls the time zone change event reporting. If reporting is enabled the UE returns
the unsolicited result code +CTZV:<tz>, +CTZE:<tz>,<dst>,[<time>], or +CTZEU:<tz>,<dst>,[<utime>]
whenever the time zone is changed. The UE also provides the time zone upon network registration if
provided by the network. If setting fails in an UE error, +CME ERROR:<err> is returned.

The read command returns the current reporting settings in the UE.

The test command returns supported <reporting> values as a compound value.

Please refer to Chapter 7 for possible <err> values.

AT+CTZR Time Zone Reporting

Execution/Write Command Response
AT+CTZR[=<reporting>] +CTZR <reporting>

OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CTZR? +CTZR:<reporting>

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CTZR=? +CZTR:(list of supported <reporting>s)

OK

BC35-G&BC28_AT_Commands_Manual 46 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

If there is any error, response:

+CME ERROR:<err>

Parameter

<reporting> Integer type. Reporting status

0 Disable time zone change event reporting
1 Enable time zone change event reporting by unsolicited result code +CTZV:<tz>
2 Enable extended time zone and local time reporting by unsolicited result code
+CTZE:<tz>,<dst>,[<time>]
3 Enable extended time zone and universal time reporting by unsolicited result
code +CTZEU:<tz>,<dst>,[<utime>]
<tz> String type. Represents the sum of the local time zone (difference between the local
time and GMT expressed in quarters of an hour) plus daylight saving time. The format
is "±zz", expressed as a fixed width, two digit integer with the range -48 ~ +56. To
maintain a fixed width, numbers in the range -9 ~ +9 are expressed with a leading
zero, e.g. "-09", "+00" and "+09".
<dst> Integer type. Indicates whether <tz> includes daylight savings adjustment
0 <tz> includes no adjustment for daylight saving time
1 <tz> includes +1 hour (equals 4 quarters in <tz>) adjustment for daylight saving
time
2 <tz> includes +2 hours (equals 8 quarters in <tz>) adjustment for daylight saving
time
<time> String type. Represents the local time. The format is "YYYY/MM/DD,hh:mm:ss",
expressed as integers representing year (YYYY), month (MM), date (DD), hour (hh),
minute (mm) and second (ss). The local time can be derived by the UE from
information provided by the network at the time of delivering time zone information and
will be present in the unsolicited result code for extended time zone and local time
reporting if the universal time is provided by the network.
<utime> String type. Represents the universal time. The format is "YYYY/MM/DD,hh:mm:ss",
expressed as integers representing year (YYYY), month (MM), date (DD), hour (hh),
minute (mm) and second (ss). The universal time can be provided by the network at
the time of delivering time zone information and will be present in the unsolicited result
code for extended time zone and universal time reporting if provided by the network.

Example
AT+CTZR=0
OK
AT+CTZR?
+CTZR:0

OK

BC35-G&BC28_AT_Commands_Manual 47 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

AT+CTZR=?
+CTZR:(0,1,2,3)

OK

3.25. AT+CIPCA Initial PDP Context Activation

The write command controls whether the UE is attached to E-UTRAN with or without a PDN connection.

The value of <n>=3 applies to E-UTRAN RATs. Changing <n> will never cause a PDP context
deactivation.

For <AttachWithoutPDN>=1, the EPS attach is performed without a PDN connection.

The read command returns the current setting of the command.

The test command returns values supported as a compound value.

Please refer to Chapter 7 for possible <err> values.

AT+CIPCA Initial PDP Context Activation

Write Command Response
AT+CIPCA=<n>[,<AttachWithoutPDN OK
>]
If there is any error, response:
+CME ERROR:<err>
Read Command Response
AT+CIPCA? +CIPCA:<n>[,<AttachWithoutPDN>]

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CIPCA=? +CIPCA:(list of supported <n>s),(list of supported
<AttachWithoutPDN>s)

OK

If there is any error, response:

+CME ERROR:<err>

BC35-G&BC28_AT_Commands_Manual 48 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Parameter

<n> Integer type. Activation of PDP context upon attachment.

3 No change in current setting
<AttachWithoutPDN> Integer type. EPS attach with or without PDN connection. If
<AttachWithoutPDN> is omitted, will use the default value 0.
0 EPS attach with PDN connection
1 EPS attach without PDN connection

NOTE

For this command, the term roaming corresponds to being registered to a VPLMN which is not equivalent
to HPLMN or EHPLMN.

Example
AT+CIPCA=3
OK

AT+CIPCA=?
+CIPCA:(3),(0,1)

OK

3.26. AT+CGAPNRC APN Rate Control

This execution command returns the APN rate control parameters (see 3GPP TS 24.008 [8]) associated
to the provided context identifier <cid>. If the parameter <cid> is omitted, the APN rate control parameters
for all active PDP contexts are returned.

The test command returns a list of <cid>s associated with secondary and non-secondary active PDP
contexts.

Please refer to Chapter 7 for possible <err> values.

AT+CGAPNRC APN Rate Control

Execution/Write Command Response
AT+CGAPNRC[=<cid>] [+CGAPNRC:
<cid>[,<Additional_exception_reports>[,<Uplink_time_un
it>[,<Maximum_uplink_rate>]]]
[<CR><LF>+CGAPNRC:

BC35-G&BC28_AT_Commands_Manual 49 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

<cid>[,<Additional_exception_reports>[,<Uplink_time_un
it>[,<Maximum_uplink_rate>]]]
[...]]]
OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CIPCA=? +CGAPNRC: (list of <cid>s associated with active contexts)

OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<cid> Integer type. Specifies a particular PDP context definition (see

the AT+CGDCONT command).
<Additional_exception_reports> Integer type. Indicates whether or not additional exception
reports are allowed to be sent when the maximum uplink rate is
reached.
0 <Additional_exception_reports> at maximum rate reached
are not allowed to be sent.
1 <Additional_exception_reports> at maximum rate reached
are allowed to be sent.
<Uplink_time_unit> Integer type. Specifies the time unit to be used for the
maximum uplink rate.
0 Unrestricted
1 Minute
2 Hour
3 Day
4 Week
<Maximum_uplink_rate> Integer type. Specifies the maximum number of messages the
UE is restricted to send per uplink time unit. The time unit is
indicated in the uplink time unit. If the uplink time unit is set to
"unrestricted", the maximum uplink data volume the UE can
send is not restricted.

Example
AT+CGAPNRC=2,1,2,3
OK

BC35-G&BC28_AT_Commands_Manual 50 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

AT+CGAPNRC=?
+CGAPNRC:1,2

OK

3.27. AT+CSODCP* Sending Originating Data via the Control Plane

Send a non-IP message.

The write command is used by the TE to transmit data over control plane to network via UE. Context
identifier <cid> is used to link the data to a particular context.

This command optionally indicates that the application on the UE expects that the exchange of data will
be completed with this uplink data transfer; or will be completed with the next received downlink data.

This command also optionally indicates whether or not the data to be transmitted is an exception data. It
causes transmission of an “ESM DATA TRANSPORT” message, as defined in 3GPP TS 24.301 [83].

The test command returns the maximum number of bytes of the user data container supported by the UE,
supported <RAI>s and supported <type_of_user_data>s as a compound value.

Please refer to Chapter 7 for possible <err> values.

AT+CSODCP* Sending Originating Data via the Control Plane

Write Command Response
AT+CSODCP=<cid>,<cpdata_length>, OK
<cpdata>[,<RAI>[,<type_of_user_da
ta>]] If there is any error, response:
+CME ERROR:<err>
Test Command Response
AT+CSODCP=? +CSODCP:(range of supported <cid>s),(maximum number
of bytes of the <cpdata_length>),(list of supported
<RAI>s),(list of supported <type_of_user_data>s)

OK

Parameter

<cid> Integer type. A numeric parameter which specifies a particular PDP context or EPS
bearer context definition. The <cid> parameter is local to the TE-UE interface and
identifies the PDP or EPS bearer contexts which have been setup via AT

BC35-G&BC28_AT_Commands_Manual 51 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

commands (see the AT+CGDCONT command).

<cpdata_length> Integer type. Indicates the number of bytes of the <cpdata> information element.
When there is no data to transmit, the value shall be set to zero.
<cpdata> String of octets. Contains the user data container contents. When there is no data
to transmit, the <cpdata> shall be an empty string (""). This parameter shall not be
subject to conventional character conversion as per AT+CSCS (refer to 3GPP TS
27.007 [9]). The coding format of the user data container and the maximum length
of <cpdata> are implementation specific. Maximum data length will be 1358 bytes
when non-IP is used, otherwise will be 0.
<RAI> Integer type. Indicates the value of the release assistance indication.
0 No information available
1 The UE expects that exchange of data will be completed with the
transmission of the “ESM DATA TRANSPORT” message.
2 The UE expects that exchange of data will be completed with the receipt
of an “ESM DATA TRANSPORT” message.
<type_of_user_data> Integer type. Indicates whether the user data that is transmitted is regular
or exceptional.
0 Regular data
1 Exception data

NOTES

1. "*" means under development.

2. Only one message will be buffered at any one time.

Example
AT+CSODCP=?
+CSODCP:(0-10),(512),(0,1,2),(0,1)

OK

3.28. AT+CRTDCP* Reporting Terminating Data via the Control Plane

Receive a message from the CDP server.

The write command is used to enable and disable reporting of data from the network to the UE that is
transmitted via the control plane in downlink direction. If reporting is enabled, the UE returns the
unsolicited result code +CRTDCP:<cid>,<cpdata_length>,<cpdata> when data is received from the
network.

BC35-G&BC28_AT_Commands_Manual 52 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

The read command returns the current settings.

The test command returns supported values as compound values

Please refer to Chapter 7 for possible <err> values

AT+CRTDCP* Reporting Terminating Data via the Control Plane

Write Command Response
AT+CRTDCP=<reporting> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CRTDCP? +CRTDCP:<reporting>

OK
Test Command Response
AT+CRTDCP=? +CRTDCP:(list of supported <reporting>s),(range of
supported <cid>s),(maximum number of octets of user data
indicated by <cpdata_length>)

OK

Parameter

<reporting> Integer type. Controls reporting of mobile terminated control plane data events
0 Disable reporting of UE control plane data
1 Enable reporting of UE control plane data by the unsolicited result code
“+CRTDCP:<cid>,<cpdata_length>,<cpdata>”
<cid> Integer type. A numeric parameter which specifies a particular PDP context or
EPS bearer context definition. The <cid> parameter is local to the TE-UE
interface and identifies the PDP or EPS bearer contexts which have been setup
via AT command (see AT+CGDCONT command).
<cpdata_length> Integer type. Indicates the number of bytes of the <cpdata> information element.
When there is no data to transmit, the value shall be set to zero.
<cpdata> String of octets. Contains the user data container contents. When there is no data
to transmit, the <cpdata> shall be an empty string (""). This parameter shall not be
subject to conventional character conversion as per AT+CSCS (refer to 3GPP TS
27.007 [9]). The coding format of the user data container and the maximum
length of <cpdata> are implementation specific. Maximum received data length
will be 1358 bytes when non-IP is set by AT+CGDCONT, otherwise will be 0.

BC35-G&BC28_AT_Commands_Manual 53 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

NOTE

"*" means under development.

Example
AT+CRTDCP=1
OK
AT+CRTDCP?
+CRTDCP:1

OK
AT+CRTDCP=?
+CRTDCP:(0-1),(0-10),(0)

OK

+CRTDCP:0,2,"ab" //URC

BC35-G&BC28_AT_Commands_Manual 54 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

4 3GPP Commands (27.005)

4.1. AT+CSMS Select Message Service

The write command selects messaging service. It returns the types of messages supported by the UE:
<mt> for mobile terminated messages, <mo> for mobile originated messages and <bm> for broadcast
type messages. If chosen service is not supported by the ME, final result code +CME ERROR:<err> will
be returned.

The read command returns supported message types along the current service setting.

The test command returns a list of all services supported by the UE.

Please refer to Chapter 7 for possible <err> values.

AT+CSMS Select Message Service

Write Command Response
AT+CSMS=<service> +CSMS:<mt>,<mo>,<bm>

OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CSMS? +CSMS:<service>,<mt>,<mo>,<bm>

OK
Test Command Response
AT+CSMS=? +CSMS:(list of supported <service>s)

OK

Parameter

<service> Integer type. Messaging service

0 3GPP TS 23.040 [3] and 3GPP TS 23.041 [4] (the syntax of SMS AT

BC35-G&BC28_AT_Commands_Manual 55 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

commands is compatible with 3GPP TS 27.005 Phase 2 version 4.7.0; Phase

2+ features which do not require new command syntax may be supported,
e.g. correct routing of messages with new Phase 2+ data coding schemes).
1 3GPP TS 23.040 [3] and 3GPP TS 23.041 [4] (the syntax of SMS AT
commands is compatible with 3GPP TS 27.005 Phase 2+ version; the
requirement of <service> setting 1 is mentioned under corresponding
command descriptions)
2...128 Reserved
<mt> Mobile terminated messages
0 Type not supported
1 Type supported
<mo> Mobile originated messages
0 Type not supported
1 Type supported
<bm> Broadcast type messages
0 Type not supported
1 Type supported

NOTE

UE will report to user if received SMS messages:

+CMT: [<alpha>],<length><CR><LF><pdu> (PDU mode enabled)

Example
AT+CSMS=1
+CSMS:2,3,4

OK
AT+CSMS?
+CSMS:1,2,3,4

OK
AT+CSMS=?
+CSMS:(0,1)

OK

BC35-G&BC28_AT_Commands_Manual 56 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

4.2. AT+CNMA New Message Acknowledgement to UE

The execution command confirms reception of a new message (SMS-DELIVER or

SMS-STATUS-REPORT) which is routed directly to the UE. This acknowledgement command shall be
used when AT+CSMS parameter <service> equals 1. In PDU mode, it is possible to send either positive
(RPACK) or negative (RP-ERROR) acknowledgement to the network. Parameter <n> defines which one
will be sent. Optionally (when <length> is greater than zero) an acknowledgement TPDU
(SMS-DELIVER-REPORT for RPACK or RP-ERROR) may be sent to the network. The entering of PDU is
done similarly as specified in command AT+CMGS, except that the format of <ackpdu> is used instead of
<pdu> (i.e. SMSC address field is not present). PDU shall not be bounded by double quotes. UE shall not
send another +CMT or +CDS result code to TE before previous one is acknowledged.

If UE does not get acknowledgement within required time (network timeout), UE should respond as
specified in 3GPP TS 24.011 [6] to the network.

If the command is executed, but no acknowledgement is expected, or some other UE related error occurs,
final result code +CME ERROR:<err> is returned. In case that a directly routed message must be
buffered in UE or AT interpreter remains too long in a state where result codes cannot be sent to TE (e.g.
user is entering a message using AT+CMGS), acknowledgement (RP-ACK) must be sent to the network
without waiting AT+CNMA command from TE. Later, when buffered result codes are flushed to TE, TE
must send +CNMA[=0] acknowledgement for each result code. In this way, UE can determine if message
should be placed in non-volatile memory and routing to TE disabled (+CNMA[=0] not received).

The test command returns a list of supported <n> values. If the only value supported is 0, the device does
not support sending of TPDU.

Please refer to Chapter 7 for possible <err> values.

AT+CNMA New Message Acknowledgement to UE

Execution/Write Command Response
AT+CNMA=[<n>[,<length>[<CR>PDU OK
is given<ctrl-Z/ESC>]]]
If there is any error, response:
+CME ERROR:<err>
Test Command Response
AT+CNMA=? +CNMA:(list of supported<n>s)

OK

Parameter

<n> Integer type

BC35-G&BC28_AT_Commands_Manual 57 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

0 Command operates similarly as defined for the text mode (UE does not support
text mode for SMS currently)
1 Send RP-ACK (or buffered result code received correctly)
<length> Integer type. Indicates in the text mode (AT+CMGF=1) the length of the message body
<data> > (or <cdata>) in characters; or in PDU mode (AT+CMGF=0), the length of the
actual TP data unit in octets (i.e. the RP layer SMSC address octets are not counted in the
length). <length> range is 0-232.

NOTE

UE will report to user if received SMS messages:

+CMT: [<alpha>],<length><CR><LF><pdu> (PDU mode enabled)

Example
AT+CNMA=1
OK
AT+CNMA=?
+CNMA:(0-2)

OK

4.3. AT+CSCA Service Centre Address

The write command updates the SMSC address, through which mobile originated SMS are transmitted. In
text mode, setting is used by send and write commands. In PDU mode, setting is used by the same
commands, but only when the length of the SMSC address coded into <pdu> parameter equals zero.

Please refer to Chapter 7 for possible <err> values.

AT+CSCA Service Centre Address

Write Command Response
AT+CSCA=<sca>[,<tosca>] OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+CSCA? +CSCA:<sca>[,<tosca>]

OK

BC35-G&BC28_AT_Commands_Manual 58 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Test Command Response

AT+CSCA=?
OK

Parameter

<sca> 3GPP TS 24.011 [6] RP SC address Address-Value field in string format. BCD numbers (or
GSM 7 bit default alphabet characters) are converted to characters of the currently selected
TE character set (refer to AT+CSCS command in 3GPP TS 27.007 [9]); type of address
given by <tosca>.
<tosca> 3GPP TS 24.011 [6] RP SC address Type-of-Address octet in integer format (when first
character of <da> is + (IRA 43) default is 145, otherwise default is 129).

Example
AT+CSCA=358501234567,145

OK
AT+CSCA?
+CSCA:"358501234567",145

OK
AT+CSCA=?
OK

4.4. AT+CMGS Send SMS Message

The execution command sends message from a TE to the network (SMS-SUBMIT). Message reference
value <mr> is returned to the TE on successful message delivery. Optionally (when AT+CSMS <service>
value is 1 and network supports) <ackpdu> is returned. Values can be used to identify message upon
unsolicited delivery status report result code. If sending fails in a network or an UE error, final result code
+CME ERROR:<err> is returned. This command should be abortable.

 <length> must indicate the number of octets coded in the TP layer data unit to be given (i.e. SMSC
address octets are excluded).
 The UE shall send a four character sequence <CR><LF><greater_than><space> (IRA 13, 10, 62, 32)
after command line is terminated with <CR>; after that PDU can be given from TE to UE.
 The DCD signal shall be in ON state while PDU is given.
 The echoing of given characters back from the UE is controlled by V.25ter echo command E.
 The PDU shall be hexadecimal format (similarly as specified for <pdu>) and given in one line; UE
converts this coding into the actual octets of PDU.

BC35-G&BC28_AT_Commands_Manual 59 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

 When the length octet of the SMSC address (given in the PDU) equals zero, the SMSC address set
with AT+CSCA command is used; in this case the SMSC Type-of-Address octet shall not be present
in the PDU, i.e. TPDU starts right after SMSC length octet.
 Sending can be cancelled by giving <ESC> character (IRA 27).
 <ctrl-Z> (IRA 26) must be used to indicate the ending of PDU

Please refer to Chapter 7 for possible <err> values.

AT+CMGS Send SMS Message

Write Command Response
AT+CMGS=<length><CR>PDU is +CMGS:<mr>[,<ackpdu>]]
given<ctrl-Z/ESC>
OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CMGS=?
OK

Parameter

<mr> 3GPP TS 23.040 [3] TP-Message-Reference in integer format

<length> Integer type. Indicates in the text mode (AT+CMGF=1) the length of the message body
<data> > (or <cdata>) in characters; or in PDU mode (AT+CMGF=0), the length of the
actual TP data unit in octets (i.e. the RP layer SMSC address octets are not counted in the
length). The range is 7-220.
<ackpdu> 3GPP TS 23.040 [3] RP-User-Data element of RP-ACK PDU. The format is same as for
<pdu> in case of SMS, but without 3GPP TS 24.011 [6] SC address field and parameter
shall be bounded by double quote characters like a normal string type parameter.

NOTES

1. <ackpdu> is not returned currently.

2. For address field in PDU (3GPP TS 24.011), the country code should be added at the beginning of it,
i.e., 86 for China.

BC35-G&BC28_AT_Commands_Manual 60 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

4.5. AT+CMGC Send SMS Command

The execution command sends a command message from TE to the network (SMS-COMMAND). The
entering of text (3GPP TS 23.040 [3] TP-Command-Data) is done similarly as specified in AT+CMGS
command, but the format is fixed to be a sequence of two IRA character long hexadecimal numbers which
UE converts into 8-bit octets (refer to AT+CMGS). Message reference value <mr> is returned to the TE on
successful message delivery. Optionally (when AT+CSMS <service> value is 1 and network supports)
<scts> is returned. Values can be used to identify message upon unsolicited delivery status report result
code. If sending fails in a network or an UE error, final result code +CME ERROR:<err> is returned. This
command should be abortable.

Please refer to Chapter 7 for possible <err> values.

AT+CMGS Send SMS Message

Write Command Response
AT+CMGC=<length><CR>PDU is +CMGC:<mr>[,<ackpdu>]
given<ctrl-Z/ESC>
OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+CMGC=?
OK

Parameter

<mr> 3GPP TS 23.040 [3] TP-Message-Reference in integer format

<length> Integer type. Indicates in the text mode (AT+CMGF=1) the length of the message body
<data> > (or <cdata>) in characters; or in PDU mode (AT+CMGF=0), the length of the
actual TP data unit in octets (i.e. the RP layer SMSC address octets are not counted in the
length). The range is 8-220.
<ackpdu> 3GPP TS 23.040 [3] RP-User-Data element of RP-ACK PDU. The format is same as for
<pdu> in case of SMS, but without 3GPP TS 24.011 [6] SC address field and parameter
shall be bounded by double quote characters like a normal string type parameter.

NOTES

1. <ackpdu> is not returned currently.

2. For address field in PDU (3GPP TS 24.011), the country code should be added at the beginning of it,
i.e., 86 for China.

BC35-G&BC28_AT_Commands_Manual 61 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

5 General Commands

5.1. AT+NRB Reboot the UE

The command reboots the UE. There is a short delay after issuing this command before the UE reboots.
No further AT commands will be processed. Please refer to Chapter 7 for possible <err> values.

Please note that there is no final “OK” to signal that the command line has finished processing as AT
command processing terminates with this command. No confirmation messages are expected until the
reboot.

AT+NRB Reboot the UE

Execution Command Response
AT+NRB REBOOTING

Example
AT+NRB
REBOOTING

5.2. AT+NUESTATS Query UE Statistics

The command fetches the most recent operational statistics. Please refer to Chapter 7 for possible <err>
values. It can take an optional parameter that allows different sets of statistics to be displayed. The
<type>=RADIO provides the default set of values, and <type>=ALL will print all data.

AT+NUESTATS Query UE Statistics

Execution Command Response
AT+NUESTATS Signal power:<signal power in centibels>
Total power:<total power in centibels>
TX power:<current Tx power level in centibels>
TX time:<total Tx time since last reboot in millisecond>
RX time:<total Rx time since last reboot in millisecond>
Cell ID:<last cell ID>

BC35-G&BC28_AT_Commands_Manual 62 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

ECL:<last ECL value>

SNR:<last snr value>
EARFCN:<last earfcn value>
PCI:<last pci value>
RSRQ:<rsrq in centibels>
OPERATOR MODE:<operator mode>

OK

If there is any error, response:

+CME ERROR:<err>
Write Command Response
AT+NUESTATS=CELL NUESTATS:CELL,<earfcn>,<physical cell
id>,<primarycell>,<rsrp>,<rsrq>,<rssi>,<snr>

[...NUESTATS:CELL,<earfcn>,<physical cell
id>,<primarycell>,<rsrp>,<rsrq>,<rssi>,<snr>]

OK

If there is any error, response:

+CME ERROR:<err>
Write Command Response
AT+NUESTATS=THP NUESTATS:THP,<throughput_type>,<throughput>

[...NUESTATS:THP,<throughput_type>,<throughput>]

OK

If there is any error, response:

+CME ERROR:<err>
Write Command Response
AT+NUESTATS=APPSMEM NUESTATS:APPSMEM,Current Allocated:<allocated>

NUESTATS:APPSMEM,Total Free:<free>

NUESTATS:APPSMEM,Max Free:<max free>

NUESTATS:APPSMEM,Num Allocs:<num allocs>

NUESTATS:APPSMEM,Num Frees:<num frees>

OK

BC35-G&BC28_AT_Commands_Manual 63 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Write Command Response

AT+NUESTATS=<type> NUESTATS:<type>,<name/value>,<value>[,<value[,<valu
e>[...]]]

[...NUESTATS:<type>,<name/value>,<value>[,<value[,<va
lue>[...]]]]
OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+NUESTATS=? NUESTATS:[<type>,…]

OK

Parameter

<type> Type of data to be displayed as an unquoted string. Supported values of <type> are:
RADIO Radio specific information
CELL Per-cell information for the top 8 cells
BLER Block error rate information
THP Throughput
APPSMEM Dynamic memory usage
ALL All information. The value of <type> output is the correct one for each
data type.
If <type>=RADIO, return the default set of values:
<signal power in centibels> Signal power in centibels
<total power in centibels> Total power in centibels
<current TX power level in centibels> Current Tx power level in centibels
<total TX time since last reboot in millisecond> Total Tx time since last reboot in millisecond
<total RX time since last reboot in millisecond> Total Rx time since last reboot in millisecond
<last SIB1 cell ID> Last SIB1 cell ID
<last ECL value> Last ECL value
<last snr value> Last SNR value
<last earfcn value> Last EARFCN value
<last pci value> Last PCI value
<rsrq in centibels> Reference signal received quality in centibels
<operator mode> Operator mode for SIB1:
0 Unknown mode
1 Inband different PCI mode
2 Inband same PCI mode
3 Guardband mode
4 Standalone mode

BC35-G&BC28_AT_Commands_Manual 64 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

If <type>=CELL, per-cell information for the top 5 cells. Returned entries are of the form:
<earfcn>,<physical cell id>,<primary cell>,<rsrp>,<rsrq>,<rssi>
<earfcn> Absolute radio-frequency channel number
<physical cell id> Physical ID of the cell
<primary cell> 1 indicates the current serving cell
<rsrp> Reference signal received power
<rsrq> Reference signal received quality
<rssi> Received signal strength indicator
<snr> Signal to noise ratio
If <type>=BLER, returned entries are:
<rlc_ul_bler> RLC layer block error rate (uplink). Integer %
<rlc_dl_bler> RLC layer block error rate (downlink). Integer %
<mac_ul_bler> Physical layer block error rate (uplink). Integer %
<mac_dl_bler> Physical layer block error rate (downlink).
Integer %
<total bytes transmitted> Total bytes transmitted
<total bytes received> Total bytes received
<transport blocks sent> Transport blocks sent
<transport blocks received> Transport blocks received
<transport blocks retransmitted> Transport blocks retransmitted
<total ack/nack messages received> Total ACK/NACK messages received
If <type>=THP, returned entries are:
<rlc_ul> RLC layer throughput (uplink). Integer bps
<rlc_dl> RLC layer throughput (downlink). Integer bps
<mac_ul> Physical layer throughput (uplink). Integer bps
<mac_dl> Physical layer throughput (downlink). Integer bps
If <type>=APPSMEM, dynamic memory usage, returned entries are:
<allocated> Current allocated size
<free> Total free size
<max free> Max free size
<num allocs> Number of times to allocate memory
<num frees> Number of times to free memory

NOTE

The variant of NUESTATS without an argument prints out the RADIO arguments without the command
and variant prefixes. This will be removed in a future release.

Example
AT+NUESTATS
Signal power:-663
Total power:-632
TX power:-35

BC35-G&BC28_AT_Commands_Manual 65 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

TX time:1572
RX time:17847
Cell ID:27447553
ECL:0
SNR:290
EARFCN:3701
PCI:37
RSRQ:-108
OPERATOR MODE:4

OK
AT+NUESTATS=CELL
NUESTATS:CELL,3569,69,1,23,-1073,-1145,286

OK
AT+NUESTATS=THP
NUESTATS:THP,RLC UL,100

NUESTATS:THP,RLC DL,98

NUESTATS:THP,MAC UL,103

NUESTATS:THP,MAC DL,100

OK
AT+NUESTATS=BLER
NUESTATS:BLER,RLC UL BLER,10

NUESTATS:BLER,RLC DL BLER,5

NUESTATS:BLER,MAC UL BLER,8

NUESTATS:BLER,MAC DL BLER,3

NUESTATS:BLER,Total TX bytes,1080

NUESTATS:BLER,Total RX bytes,900

NUESTATS:BLER,Total TX blocks,80

NUESTATS:BLER,Total RX blocks,80

NUESTATS:BLER,Total RTX blocks,100

BC35-G&BC28_AT_Commands_Manual 66 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

NUESTATS:BLER,Total ACK/NACK RX,100

OK

5.3. AT+NEARFCN Specify Search Frequencies

The write command provides a mechanism to lock to a specific E-UTRAN Absolute Radio Frequency
Channel Number (EARFCN) and, if desired, Physical Cell ID. All actions will be locked to this carrier until
either the lock is removed or the UE is rebooted. It is not persistent over reboots. If the specified EARFCN
is not present, the UE will enter out of service mode. If the specified PCI is not present, the UE will enter
out of service mode. Please refer to Chapter 7 for possible <err> values.

AT+NEARFCN Specify Search Frequencies

Write Command Response
AT+NEARFCN=<search_mode>,<earf OK
cn>[,<pci>]
+CME ERROR:<err>
Test Command Response
AT+NEARFCN=? OK

Parameter

<search_mode> Integer type. Specifies the type of search and defines the supplied parameters
0 Lock to a specific EARFCN
<earfcn> Integer type. A number in the range of 1-65535 representing the EARFCN to
search.
<pci> Integer type. E-UTRAN physical cell ID in hexadecimal format.
Valid range 0 -1F7.

Example
AT+NEARFCN=0,2506,AB
OK

5.4. AT+NSOCR Create a Socket

The command creates a socket on the UE and associates with specified protocol. If the port is set,
receiving is enabled and “+NSONMI” unsolicited messages will appear for any message that is received
on that port. Please refer to Chapter 7 for possible <err> values.

BC35-G&BC28_AT_Commands_Manual 67 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

If a socket has already been created for a protocol or port combination, then AT+NSOCR will fail if
requested a second time.

AT+NSOCR Create a Socket

Write Command Response
AT+NSOCR=<type>,<protocol>,<liste <socket>
n port>[,<receive control>]
OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<type> Socket type.

DGRAM UDP
RAW TCP*
<protocol> Integer type. Standard internet protocol definition. For example, UDP is 17, and
TCP* is 6.
<listen port> Integer type. A number in the range of 1-65535 except 5683. This is the local port
that will be included in sent messages and on which messages will be received.
<socket> This is a reference to the created socket. It is an integer greater than or equal to 0.
A maximum of 7 sockets are supported, but other services may reduce this
number.
<receive control> Set to 1 if incoming messages should be received, 0 if incoming messages should
be ignored. Default is 1 (messages will be received).

NOTE

“*” means under development.

Example
AT+NSOCR=DGRAM,17,4587,1
0

OK
AT+NSOCR=DGRAM,17,1234,0
1

OK

BC35-G&BC28_AT_Commands_Manual 68 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

5.5. AT+NSOST SendTo Command (UDP Only)

Send a UDP datagram containing length bytes of data to <remote_port> on <remote_addr>.

The command sends a UDP datagram containing length bytes of data to the specified host:port. It will
return with the socket that it was sent on, and the number of bytes of data sent. If the amount of data is
larger than the largest datagram that can be sent, return value of AT+NSOST will indicate how much of
the data was successfully sent. Please refer to Chapter 7 for possible <err> values.

AT+NSOST SendTo Command (UDP Only)

Write Command Response
AT+NSOST=<socket>,<remote_addr> <socket>,<length>
,<remote_port>, <length>,<data>
OK
If there is any error, response:
+CME ERROR:<err>

Parameter

<socket> Integer type. Socket number returned by AT+NSOCR.

<remote_addr> A dot notation IPv4 address. IP addresses can be specified in decimal, octal or
hexadecimal notation. Only IPv4 is supported.
<remote_port> Integer type. A number in the range of 0-65535. This is the remote port on which
messages will be received
<length> Integer type. Decimal length of data to be sent.
<data> Data received in hex string format. Maximum length of received data is 1358
bytes.

Example
AT+NSOST=0,192.158.5.1,1024,2,AB30
0,2

OK

5.6. AT+NSOSTF SendTo Command with Flags (UDP Only)

Send a UDP datagram containing length bytes of data to <remote_port> on <remote_addr> and allows
meta-data flags to be set.

BC35-G&BC28_AT_Commands_Manual 69 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

The command sends a UDP datagram to the specified host:port. It will return with the socket that it was
sent on, and the number of bytes of data sent. If the amount of data is larger than the largest datagram
that can be sent, the AT+NSOSTF return value will indicate how much of the data was successfully sent.
Please refer to Chapter 7 for possible <err> values.

AT+NSOSTF SendTo Command with Flags (UDP Only)

Write Command Response
AT+NSOSTF=<socket>,<remote_addr <socket>,<length>
>,<remote_port>,[<flag>],<length>,<d
ata> OK
If there is any error, response:
+CME ERROR:<err>

Parameter

<socket> Integer type. Socket number returned by AT+NSOCR.

<remote_addr> A dot notation IPv4 address. IP addresses can be specified in decimal, octal or
hexadecimal notation. Only IPv4 is supported.
<remote_port> Integer type. A number in the range of 0-65535. This is the remote port on which
messages will be received.
<flag> Integer type. Specifies the type of message transmission. Values of this argument
are in hex format and are formed by logically OR'ing zero or more of the following
flags:
0x100 Exception Message: Send message with high priority
0x200 Release Indicator: indicate release after next message
0x400 Release Indicator: indicate release after next message has been replied
to
If no flags are set, a value of 0 should be provided.
<length> Integer type. Decimal length of data to be sent. Maximum data size is 1358 bytes.
<data> Data to be transmitted in hex string format.

Example
AT+NSOSTF=1,192.158.5.1,1024,0x100,2,AB30
1,2

OK

BC35-G&BC28_AT_Commands_Manual 70 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

5.7. AT+NSORF Receive Command (UDP Only)

The command can read up to <req_length> characters of data from <socket>, and returned length is the
actual number of characters returned.

The command is use to receive data on a socket. When data arrives, a “+NSONMI” response will be
generated to indicate the socket the message was received on and also the amount of data. The
AT+NSORF command takes a length, which is the maximum amount of data that will be returned.

If the requested length is larger than the actual size of the returned data, only the length of returned data
is provided, and the remaining length is returned as 0. If the requested length is less than the amount of
data returned, only the requested amount of data will be returned, plus an indication of the number of
bytes remaining. Once a message has been fully read, a new “+NSONMI” notification will be sent if there
is another message to process. Please refer to Chapter 7 for possible <err> values.

If messages arrive faster than they are read, and the internal message buffer is full, the most recent
message will be discarded.

AT+NSORF Receive Command (UDP Only)

Write Command Response
AT+NSORF=<socket>,<req_length> <socket>,<ip_addr>,<port>,<length>,<data>,<remaining_
length>

OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<socket> Integer type. Socket number returned by AT+NSOCR.

<req_length> Maximum amount of data to be returned as a decimal byte length. Maximum
request data length is 1358 bytes.
<ip_addr> Address of system sending the message
A dot notation IPv4 address. IP addresses can be specified in decimal, octal or
hexadecimal notation. Only IPv4 is supported.
<port> A number in the range of 0-65535. This is the remote port that messages was sent
from.
<length> Amount of data returned as a decimal byte length.
<remaining_length> Amount of data left to read for this message as a decimal byte length. Remaining
length is always 0. The remaining data is readable.
<data> Data received in hex string format. Maximum length of received data is 1024

BC35-G&BC28_AT_Commands_Manual 71 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

bytes.

Example
AT+NSORF=0,10
0,192.168.5.1,1024,2,ABAB,0

OK

5.8. AT+NSOCL Close a Socket

The command is used to close the specified socket. If there are pending messages to be read, they will
be dropped. No further unsolicited “+NSONMI” notifications will be generated. If the socket has already
been closed, or was never created, an error will be returned.

AT+NSOCL Close a Socket

Write Command Response
AT+NSOCL=<socket> OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<socket> Integer type. Socket number returned by AT+NSOCR

Example
AT+NSOCL=0
OK

5.9. +NSONMI Indicator of Arrived Socket Message (Response Only)

This is an unsolicited message to notify that data has been received on a socket and is ready to be read.
It returns socket number and number of bytes of data available to read for the first message that is
queued. If another message is received on the same socket, it will only be notified when the preceding
message has been completely read. Please refer to Chapter 7 for possible <err> values.

BC35-G&BC28_AT_Commands_Manual 72 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

+NSONMI Indicator or Arrived Socket Message (Response Only)

URC Format:
+NSONMI: <socket>,<length>

Parameter

<socket> Integer type. Socket on which data is received. Decimal number returned by
AT+NSOCR.
<length> Integer type. Number of bytes of data in the first message.

NOTE

This message can occur at any point if it is indicating a new message with no messages buffered. If there
are buffered messages, it will occur in the AT+NSORF command before the data is returned.

5.10. AT+NPING Test IP Network Connectivity to a Remote Host

The command sends an ICMP packet to the specified host address. Please refer to Chapter 7 for
possible <err> values.

AT+NPING initiates the sending of a PING packet to the specified address. This will either cause a packet
to be returned if the remote system is connected and responding to PING packets or no response will be
received. A maximum of 1 ping attempts will be tried. If none of the packets receive a response within the
timeout period, an error will be raised.

If a response is received, the unsolicited “+NPING” message will be returned. If no response is received
the “+NPINGERR” unsolicited response will be returned with an error value.

AT+NPING Test IP Network Connectivity to a Remote Host

Write Command Response
AT+NPING=<remote_address>[,<p_si OK
ze>[,<timeout>]]
+NPING:<remote_address>,<ttl>,<rtt>

If there is any error, response:

+NPINGERR:<err>

BC35-G&BC28_AT_Commands_Manual 73 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Parameter

<remote_address> Address of system sending the message

A dot notation IPv4 address. IP addresses can be specified in decimal, octal
or hexadecimal notation. Only IPv4 is supported.
<p_size> Integer type. Size in bytes of echo packet payload. The range is 8-1460, and
the default value is 8.
<timeout> Integer type. Maximum time in ms to wait for an echo reply response. The
range is 10-60000, and the default value is 10000.
<ttl> Integer type. TTL received in the response packet.
<rtt> Integer type. Elapsed time in msec from packet sent to response received.
<err> Integer type. An integer value to provide some information on why the ping
request failed.
1 No response from remote host within timeout period
2 Failed to send ping request

5.11. AT+NBAND Set Supported Bands

The command sets the bands to be used. Please refer to Chapter 7 for possible <err> values.

AT+NBAND Set Supported Bands

Write Command Response
AT+NBAND=n[,n[,n[…]]] OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+NBAND? +NBAND:n[,n[,n[…]]]

OK
Test Command Response
AT+NBAND=? Returns the list of bands supported by the hardware.
+NBAND:(n[,n[,n[…]]])

OK

Parameter

<n> Integer type. Band in a decimal number.

BC35-G&BC28_AT_Commands_Manual 74 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Example
AT+NBAND=?
+NBAND:(1,2,3,5,8,12,13,14,17,18,19,20,25,26,28,66)

OK

5.12. AT+NLOGLEVEL Set Debug Logging Level

The command sets the logging level. Logging level is not persistent. It can take one of the following
values. Please refer to Chapter 7 for possible <err> values.

AT+NLOGLEVEL Set Debug Logging Level

Write Command Response
AT+NLOGLEVEL=<core>,<level> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+NLOGLEVEL? +NLOGLEVEL:<core>,<level>

OK
Test Command Response
AT+NLOGLEVEL=? +NLOGLEVEL:(<core>, …),(<level>,<level>, …)

OK

Parameter

<core> String type. Core required.

PROTOCOL
APPLICATION
SECURITY
<level> String type. Logging level required
VERBOSE
NORMAL
WARNING
ERROR
NONE

BC35-G&BC28_AT_Commands_Manual 75 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Example
AT+NLOGLEVEL?
+NLOGLEVEL:SECURITY,NORMAL

+NLOGLEVEL:PROTOCOL,NORMAL

+NLOGLEVEL:APPLICATION, NORMAL

OK

5.13. AT+NCONFIG Configure UE Behaviour

The command allows configuring certain aspects of UE behavior. It takes a function and a value that
controls operation of that function.

AT+NCONFIG Configure UE Behaviour

Write Command Response
AT+NCONFIG=<function>,<value> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+NCONFIG? +NCONFIG:<function>,<value>
[+NCONFIG:<function>,<value>
[…]]

OK
Test Command Response
AT+NCONFIG=? +NCONFIG:(<function>,(<value1>,<value2>[,<value3>[,…
]]))
[+NCONFIG:(<function>,(<value1>,<value2>[,<value3>[,
…]]))
[,…]]

OK

Parameter

<function> UE function to configure

AUTOCONNECT Control whether the platform will automatically attempt to

BC35-G&BC28_AT_Commands_Manual 76 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

connect to the network after power-on or reboot. When

enabled, it will set AT+CFUN=1 and read the PLMN from the
USIM. And it will use the APN provided by the network.
COMBINE_ATTACH Enable/disable combine attach
CELL_RESELECTION Enable support for RRC cell reselection
ENABLE_BIP Enable/disable BIP
MULTITONE Enable/disable multitone
<value> Bool type
TRUE
FALSE

Example
AT+NCONFIG?
+NCONFIG:AUTOCONNECT,TRUE
+NCONFIG:CR_0354_0338_SCRAMBLING, TRUE
+NCONFIG:CR_0859_SI_AVOID,TRUE
+NCONFIG:COMBINE_ATTACH,FALSE
+NCONFIG:CELL_RESELECTION,FALSE
+NCONFIG:ENABLE_BIP,FALSE
+NCONFIG:MULTITONE,TRUE

OK
AT+NCONFIG=?
+NCONFIG:(AUTOCONNECT,(FALSE,TRUE))
+NCONFIG:(CR_0354_0338_SCRAMBLING,(FALSE,TRUE))
+NCONFIG:(CR_0859_SI_AVOID,(FALSE,TRUE))
+NCONFIG:(COMBINE_ATTACH,(FALSE,TRUE))
+NCONFIG:(CELL_RESELECTION,(FALSE,TRUE))
+NCONFIG:(ENABLE_BIP,(FALSE,TRUE))
+NCONFIG:(MULTITONE,(FALSE,TRUE)

OK

NOTES
1. CR_ function is temporary and will be retired when no longer required.
2. AT+NCONFIG=MULTITONE,<value> will take effect when rebooted. The real value could be got
when power on.

BC35-G&BC28_AT_Commands_Manual 77 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

5.14. AT+NATSPEED Configure UART Port Baud Rate

The command is used to configure UART port baud rate. Please refer to Chapter 7 for possible <err>
values.

AT+NATSPEED Configure UART Port Baud Rate

Write Command Response
AT+NATSPEED=<baud_rate>,<timeo OK
ut>,<store>,<sync_mode>[,<stopbits
>[,<parity>]] If there is any error, response:
+CME ERROR:<err>
Read Command Response
AT+NATSPEED? +NATSPEED:<baud_rate>,<sync_mode>,<stopbits>

OK
Test Command Response
AT+NATSPEED=? +NATSPEED:(list of supported <baud rate>s),(list of
supported <timeout>s),(list of supported <store>s),(list of
supported <sync_mode>s),(list of supported <stopbits>s),

OK

Parameter

<baud_rate> Integer type indicating the baud rate of UART port that has been requested.
<baud_rate> value higher than the fastest speed supported by the low power
UART will disable deep sleep low power operation.
<timeout> Integer type indicating the time to wait for communication before switching back to
the original speed. Unit: second. Default value: 3. Maximum value: 30. 0 means
using default value.
<store> Integer type indicating whether to store <baud_rate> and <sync_mode> to NV or
not.
0 Do not store to NV, need to configure again after reboot
1 Store to NV, while there is interaction before timeout
<sync_mode> Integer type. The LP UART synchronizes to each start bit that it detects and uses
this to configure its optimum sampling point for each subsequent bit in a data
word. The Sync Mode field allows this sampling point to be modified if required.
<sync mode> don’t support 3 when <baud rate> is 4800bps and 57600bps. This
parameter may be removed in a future release.
0 Sample normally
1 Sample later
2 Sample earlier

BC35-G&BC28_AT_Commands_Manual 78 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

3 Sample even earlier

<stopbits> Integer type. The LP UART stop bits.
1 1 stop bit
2 2 stop bits
<parity> Integer type .The AT UART parity.
0 No parity enabled( default value)
1 Odd parity
2 Even parity

Example
AT+NATSPEED=9600,3,1,2,1
OK
AT+NATSPEED?
+NATSPEED:9600,2,1,0

OK
AT+NATSPEED=?
+NATSPEED:(4800,9600,57600,115200),(0-30),(0,1),(0-3),(1,2),(0-2)

OK

5.15. AT+NCCID USIM Card Identification

Both the execution and read commands read the ICCID off the USIM card. If no USIM card is present, or
the USIM card is unreadable, no data is returned. Please refer to Chapter 7 for possible <err> values.

AT+NCCID USIM Card Identification

Execution Command Response
AT+NCCID +NCCID:<ICCID>

OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+NCCID? +NCCID:<ICCID>

OK

If there is any error, response:

BC35-G&BC28_AT_Commands_Manual 79 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

+CME ERROR:<err>

Test Command Response

AT+NCCID=? OK

Parameter

<ICCID> USIM Card Identification Number

Example
AT+NCCID
+NCCID:44123456789012345678

OK
AT+NCCID?
+NCCID:44123456789012345678

OK

5.16. AT+NFWUPD Firmware Update via UART

This command enables firmware updating. It allows package download, package validation and firmware
upgrading. Package needs to be downloaded first before upgrading the firmware. After downloading is
finished, it sends package validity command. If package is legal, “OK” will be returned, otherwise return
error and print reason. When validation is ongoing, it refuses to execute other commands with error return.
After validation is finished, it sends firmware upgrade command. It refuses to execute firmware upgrade
command without package validity.

Please refer to Chapter 7 for possible <err> values.

AT+NFWUPD Firmware Update via UART

Write Command Response
AT+NFWUPD=<cmd>[,<sn>,<len>,<d OK
ata>,<crc>]
If there is any error, response:
+CME ERROR:<err>
Test Command Response
AT+NFWUPD=? +NFWUPD:(list of supported <cmd>s)

OK

BC35-G&BC28_AT_Commands_Manual 80 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Parameter

<cmd> Integer type. Package process command

1 <sn>,<len>,<data>,<crc>. Download a package segment. Download a FOTA
package. Package segments are continuous segments of the FOTA package.
Segments can be of any length, but must be provided in order.
2 Validate package
5 Upgrade firmware
<sn> Integer type. Sequence number. It starts with 0, and increments by one for each package
segment.
<len> Integer type. Data length in bytes of data.
<data> Data to be transmitted in hex string format.
<CRC> Integer type. CRC of the package segment binary data. CRC is sent as a hex string, and it
is an XOR8 of each byte in the package segment.

5.17. AT+NPOWERCLASS Set the Mapping for Band and Power Class

This command sets the mapping for band and power class. The read command lists all mapping of bands
and power classes.

Please refer to Chapter 7 for possible <err> values.

AT+NPOWERCLASS Set the Mapping for Band and Power Class

Write Command Response
AT+NPOWERCLASS=<band>,<power OK
class>
If there is any error, response:
+CME ERROR:<err>
Read Command Response
AT+NPOWERCLASS? +NPOWERCLASS:<band>,<power class>

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+NPOWERCLASS=? +NPOWERCLASS:(list of supported <band>s),(list of
supported <power class>s)

OK

BC35-G&BC28_AT_Commands_Manual 81 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Parameter

<band> Integer type. Band as key to map

<power class> Integer type. Power class value for band, only supports 3 and 5 currently.

5.18. AT+NPSMR Power Saving Mode Status Report

The write command controls the presentation of an unsolicited result code “+NPSMR”. If <n>=1,
+NPSMR:<mode> is sent from the UE when the power mode of the UE is changed.

The read command returns the status of result code presentation and an integer <mode> which shows
whether the UE is currently in power saving mode or normal mode.

The test command returns supported values as a compound value.

Please refer to Chapter 7 for possible <err> values.

AT+NPSMR Power Saving Mode Status Report

Write Command Response
AT+NPSMR=<n> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+NPSMR? +NPSMR:<n>[,<mode>]

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+NPSMR=? +NPSMR:(list of supported <n>s)

OK

Parameter

<n> Integer type. Enable/disable unsolicited result code.

0 Disable unsolicited result code
1 Enable unsolicited result code “+NPSMR:<mode>”
<mode > Integer type. Indicates the power mode of UE.
0 Normal mode
1 Power saving mode

BC35-G&BC28_AT_Commands_Manual 82 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

5.19. AT+NPTWEDRXS Paging Time Window Value and eDRX Setting

The write command controls the setting of the UE paging time window value and eDRX parameters. The
command controls whether the UE wants to apply paging time window and eDRX or not, as well as the
requested paging time window and eDRX value for each specified type of access technology.

The write command also controls the presentation of an unsolicited result code
“+NPTWEDRXP:<AcT-type>[,<Requested_Paging_time_window>[,<Requested_eDRX_value>[,<NW_pr
ovided_eDRX_value>[,<Paging_time_window>]]]]” when <n>=2 and there is a change in the paging time
window and eDRX parameters provided by the network.

A special form of the command can be given as AT+NPTWEDRXS=3. In this form, paging time window
and eDRX will be disabled and data for all parameters in the command will be removed.

The read command returns the current settings for each defined value of <AcT-type>. The test command
returns the supported <mode>s and the value ranges for the access technology and the requested paging
time window and requested eDRX value as compound values.

Please refer to Chapter 7 for possible <err> values.

AT+NPTWEDRXS Paging Time Window Value and EDRX Setting

Write Command Response
AT+NPTWEDRXS=<mode>,<Act-type OK
>[,<Requested_Paging_time_window
>[,<Requested_eDRX_value>]] If there is any error, response:
+CME ERROR:<err>
Read Command Response
AT+NPTWEDRXS? +NPTWEDRXS:<Act-type>,<Requested_Paging_time_wi
ndow>,<Requested_eDRX_value>[,<NW_provided_eDRX
_value>[,<Paging_time_window>]]

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+NPTWEDRXS=? +NPTWEDRXS:(list of supported <mode>s),(list of
supported <Act-type>s),(list of supported
<Requested_Paging_time_window>s),(list of supported
<Requested_eDRX_value>s)

OK

BC35-G&BC28_AT_Commands_Manual 83 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Parameter

<mode> Integer type. Indicates to disable or enable the use of requested paging time window
and eDRX in the UE. This parameter is applicable to all specified types of access
technology, i.e. the most recent setting of <mode> will take effect for all specified
values of <AcT>. When set <mode> to 0 and do not have parameter
<Requested_Paging_time_window> or <Requested_eDRX_value>, it will set omit
value to invalid value like 0x00.
0 Disable the use of requested paging time window and eDRX
1 Enable the use of requested paging time window and eDRX
2 Enable the use of requested paging time window and eDRX, and enable the
unsolicited result code:
“+NPTWEDRXP:<AcT-type>[,<Requested_Paging_time_window>[,<Requested
_eDRX_value>[,<NW_provided_eDRX_value>[,<Paging_time_window>]]]]”
3 Disable the use of eDRX and discard all parameters for eDRX.
<Act-type> Integer type. Indicates the type of access technology. This parameter is used to
specify the relationship between the type of access technology and the requested
eDRX value.
0 Access technology is not using eDRX. This parameter value is only used in the
unsolicited result code.
5 E-UTRAN (NB-S1 mode)
<Requested_Paging_time_window> String type. Half a byte in a 4 bit format. NB-S1 mode.
bit
4 3 2 1 Paging Time Window length
0 0 0 0 2.56 seconds
0 0 0 1 5.12 seconds
0 0 1 0 7.68 seconds
0 0 1 1 10.24 seconds
0 1 0 0 12.8 seconds
0 1 0 1 15.36 seconds
0 1 1 0 17.92 seconds
0 1 1 1 20.48 seconds
1 0 0 0 23.04 seconds
1 0 0 1 25.6 seconds
1 0 1 0 28.16 seconds
1 0 1 1 30.72 seconds
1 1 0 0 33.28 seconds
1 1 0 1 35.84 seconds
1 1 1 0 38.4 seconds
1 1 1 1 40.96 seconds
<Requested_eDRX_value> String type. Half a byte in a 4 bit format. NB-S1 mode.
bit
4 3 2 1 E-UTRAN eDRX cycle length duration
0 0 1 0 20.48 seconds

BC35-G&BC28_AT_Commands_Manual 84 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

0 0 1 1 40.96 seconds
0 1 0 1 81.92 seconds
1 0 0 1 163.84 seconds
1 0 1 0 327.68 seconds
1 0 1 1 655.36 seconds
1 1 0 0 1310.72 seconds
1 1 0 1 2621.44 seconds
1 1 1 0 5242.88 seconds
1 1 1 1 10485.76 seconds
<NW_Provided_eDRX_value> String type; half a byte in a 4 bit format. NB-S1 mode.
bit
4 3 2 1 E-UTRAN eDRX cycle length duration
0 0 1 0 20.48 seconds
0 0 1 1 40.96 seconds
0 1 0 1 81.92 seconds
1 0 0 1 163.84 seconds
1 0 1 0 327.68 seconds
1 0 1 1 655.36 seconds
1 1 0 0 1310.72 seconds
1 1 0 1 2621.44 seconds
1 1 1 0 5242.88 seconds
1 1 1 1 10485.76 seconds
<Paging_time_window> String type; half a byte in a 4 bit format. NB-S1 mode.
bit
4 3 2 1 Paging Time Window length
0 0 0 0 2.56 seconds
0 0 0 1 5.12 seconds
0 0 1 0 7.68 seconds
0 0 1 1 10.24 seconds
0 1 0 0 12.8 seconds
0 1 0 1 15.36 seconds
0 1 1 0 17.92 seconds
0 1 1 1 20.48 seconds
1 0 0 0 23.04 seconds
1 0 0 1 25.6 seconds
1 0 1 0 28.16 seconds
1 0 1 1 30.72 seconds
1 1 0 0 33.28 seconds
1 1 0 1 35.84 seconds
1 1 1 0 38.4 seconds
1 1 1 1 40.96 seconds

BC35-G&BC28_AT_Commands_Manual 85 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

5.20. AT+NPIN* PIN Operator

The write command is used to verify, change, enable, disable, or unblock PIN. An unsolicited result will be
received when execute pin command is completed.

USIM PIN, USIM PUK refer to the PIN of the selected application on the UICC. For example, in an
E-UTRAN context, the selected application on the currently selected UICC should be a USIM and the
USIM PIN then represents the PIN of the selected USIM. See 3GPP TS 31.101 [65] for further details on
application selection on the UICC.

Please refer to Chapter 7 for possible <err> values.

AT+NPIN* PIN Operator

Write Command Response
AT+NPIN=<command>,<parameter1>[ +NPIN:<npin result>
,<parameter2>]
If there is any error, response:
+CME ERROR:<err>

Parameter

<command> Integer type. PIN operation mode.

<command> <parameter1> <parameter2> PIN Operation Mode
0 <pin> Verify PIN
1 <old pin> <new pin> Change PIN
2 <pin> Enable PIN
3 <pin> Disable PIN
4 <puk> <pin> Unblock PIN
<parameter1> A parameter varies with the setting of <command>.
When <command>=0, 2, and 3, it is <pin>.
When <command>=1, it is <old pin>.
When <command>=4, it is <puk>.
<parameter2> A parameter varies with the setting of <command>.
When <command>=0, 2, and 3, it is omitted.
When <command>=1, it is <new pin>.
When <command>=4, it is <pin>.
<pin>,<old pin>,<new pin> Decimal string format. <old pin> shall be the same as password
specified for the facility from the MT user interface or with command
AT+NPIN=1,<old pin>,<new pin>. <new pin> is the new password. The
minimum length is 4, and the maximum length is 8. Unit: byte.
<puk> Decimal string format. The string size is 8.
<npin result> String type. Result.

BC35-G&BC28_AT_Commands_Manual 86 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

“OK”
“ERROR PIN disabled”
“ERROR PIN blocked”
“ERROR wrong PIN <pin retries remaining>”
“ERROR wrong format”
“ERROR”
<pin retries remaining> Decimal type. Remained PIN retries. If no retries left then PIN is
blocked. AT+NPIN=4,<puk>,<pin> needs to be entered before the PIN
can be used again.

NOTE

"*" means under development.

Example
AT+NPIN=0,29102394
OK

5.21. AT+QLEDMODE Set NETLIGHT LED Function Mode

The write command is used to set the function mode of NETLIGHT LED.

Please refer to Chapter 7 for possible <err> values.

AT+QLEDMODE Set NETLIGHT LED Function Mode

Write Command Response
AT+QLEDMODE=<ledmode> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+QLEDMODE? +QLEDMODE:<ledmode>

OK

If there is any error, response:

+CME ERROR:<err>
Test Command Response
AT+QLEDMODE=? + QLEDMODE :(list of supported <ledmode>s)

BC35-G&BC28_AT_Commands_Manual 87 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

OK

Parameter

<ledmode> Integer type. Function mode of NETLIGHT LED.

0 Disable NETLIGHT LED function, and the NETLIGHT pin outputs a low level.
1 Enable NETLIGHT LED function, and the NETLIGHT pin outputs PWM
signal, different high duration and low duration of which indicate different
network status.
High duration Low duration Network Status
64ms 800ms Searching
64ms 2000ms Connect status
400ms 4000ms IDLE status
400ms 8000ms PSM status

Example
AT+QLEDMODE=1
OK

BC35-G&BC28_AT_Commands_Manual 88 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

6 Huawei’s IoT Platform Commands

This chapter describes the AT command related to the Huawei’s IoT platform.

6.1. AT+NCDP Configure and Query CDP Server Settings

The command is used to set and query the server IP address and port for the CDP server. It is used when
there is a HiSilicon CDP or Huawei’s IoT platform acting as gateway to network server applications. The
values assigned are persistent across reboots.

This command is available after the IMEI number has been set. It must be executed when the radio is
inactive (AT+CFUN=0 will force the module to enter into this state).

Please refer to Chapter 7 for possible <err> values.

AT+NCDP Configure and Query CDP Server Settings

Write Command Response
AT+NCDP=<ip_addr>[,<port>] Update the CDP server configuration from the supplied
parameters.
OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+NCDP? Return the current CDP server IP address and port.
+NCDP:<ip_addr>,<port>

OK

If CDP server is not set, response:

+CME ERROR:<err>

Parameter

<ip_addr> A dot notation IPv4 address. IP addresses can be specified in decimal, octal or
hexadecimal notation. Only IPv4 is supported.

BC35-G&BC28_AT_Commands_Manual 89 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

<port> Integer type. Unsigned integer. The range is 0-65535. If port 0 is provided, the default
port (5683) will be used. If no port is specified the previously set port will be used. If no
port is specified, and no port was previously set, the default port will be used.

Example
AT+NCDP=192.168.5.1
OK
AT+NCDP?
+NCDP:192.168.5.1,5683

OK

6.2. AT+QSECSWT* Set Data Encryption Mode

This command is used to set the encryption mode of the data and standard DTLS session timeout
renegotiation interval.

Please refer to Chapter 7 for possible <err> values.

AT+QSECSWT Set Data Encryption Mode

Write Command Response
AT+QSECSWT=<type>[,<renegotiatio OK
n time>]
If there is any error, response:
+CME ERROR:<err>
Read Command Response
AT+QSECSWT? +QSECSWT:<type>[,<renegotiation time>]

OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<type> Integer type. Indicates the encryption mode.

0 No encryption
1 Encryption using standard DTLS
2 Encryption using DTLS+
<renegotiation time> Integer type. Standard DTLS session timeout renegotiation interval. Unit:

BC35-G&BC28_AT_Commands_Manual 90 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

minute. The value range is 1-525600. Valid only for the standard DTLS. The
parameter can be configured only when <type> is set to 1. It must be set to
a value less than the network's NAT change time. When <type> is set to 2,
the fixed renegotiation time is 1 month.

NOTE

"*" means under development.

Example
AT+QSECSWT=0
OK
AT+QSECSWT=1,100

OK
AT+QSECSWT=2

OK
AT+QSECSWT?
+NSECSWT:0

OK

6.3. AT+QSETPSK* Set PSK ID and PSK

This command is used to configure PSK ID and PSK. This command must be executed when the radio is
inactive (AT+CFUN=0 will force this state).

Please refer to Chapter 7 for possible <err> values.

AT+QSETPSK Set PSK ID and PSK

Write Command Response
AT+QSETPSK=<pskid>,<psk> OK

If there is any error, response:

+CME ERROR:<err>
Read Command Response
AT+QSETPSK? +QSETPSK: <pskid>,<psk>

BC35-G&BC28_AT_Commands_Manual 91 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<pskid> Indicates the PSK index. The fixed length is 15 decimal digits, The value
must be the same as the device IMEI. In addition, this parameter must also
be set to the same value on the IoT platform. When <pskid> is set to 0, the
IMEI is used as the PSKID.
<psk> Indicates the PSK. This parameter must be set to a 16-digit hexadecimal
number. In addition, it must also be set to the same value on Huawei’s IoT
platform.

NOTE

"*" means under development.

Example
AT+QSETPSK= 867724030000225,E8E19CC16CE1F388E8E19CC16CE1F388
OK

AT+QSETPSK?
+QSETPSK: 867724030000225,***

OK

6.4. AT+QLWSREGIND Register Control

The command is used to control module to launch register, deregister or update to the IoT platform. It will
give an <err> code and description as an intermediate message if the message cannot be sent. Please
refer to Chapter 7 for possible <err> values.

AT+QLWSREGIND Register Control

Write Command Response
AT+QLWSREGIND=<type> OK

If there is any error, response:

BC35-G&BC28_AT_Commands_Manual 92 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

+CME ERROR:<err>

Parameter

<type> Integer type. Action type.

0 Trigger register operation
1 Trigger deregister operation
2 Trigger update operation

Example
AT+QLWSREGIND=0
OK

6.5. AT+QLWULDATA Send Data

The command is used to send data to Huawei’s IoT platform with LWM2M protocol. It will give an <err>
code and description as an intermediate message if the message cannot be sent. Before the module
registered to the IoT platform, executing the command will trigger register operation and discard the data.
Please refer to Chapter 7 for possible <err> values.

AT+QLWULDATA Send Data

Write Command Response
AT+QLWULDATA=<length>,<data> OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<length> Integer type. Length of data sent.

<data> Hexadecimal format string. Maximum length of data to be sent is 512 bytes.

Example
AT+QLWULDATA=3,AA34BB
OK

BC35-G&BC28_AT_Commands_Manual 93 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

6.6. AT+QLWULDATAEX Send CON/NON Message

This command is used to send confirmable (CON) or non-confirmable (NON) message to Huawei’s IoT
platform. After sending CON data, the sending result will be automatically notified to the TE. TE can also
use the command AT+QLWULDATASTATUS? to query the status of the CON data that has been sent. If
sending CON data, it must acquire the state (fail/timeout/success/got reset message) of sending CON
data before sending the next CON or NON data.

Please refer to Chapter 7 for possible <err> values.

AT+QLWULDATAEX Send CON/NON Message

Write Command Response
AT+QLWULDATAEX=<length>,<data> OK
,<mode>
If there is any error, response:
+CME ERROR:<err>

Parameter

<length> Integer type. Length of data sent.

<data> Hexadecimal format string. Maximum length of data to be sent is 512 bytes.
<mode> 0x0000 Send NON message
0x0001 Send NON message and carry out the RELEASE auxiliary instructions
0x0100 Send CON message
0x0101 Send CON message and carry out the RELEASE_AFTER_REPLY
auxiliary instructions

Example
AT+QLWULDATAEX=3,AA34BB,0x0001
OK

6.7. AT+QLWULDATASTATUS Query CON Messages Sent Status

This command queries the status of the sending CON data to NB-IoT platform. This command only
queries the status of the CON data that has been sent.

Please refer to Chapter 7 for possible <err> values.

BC35-G&BC28_AT_Commands_Manual 94 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

AT+QLWULDATASTATUS Query CON Messages Sent Status

Read Command Response
AT+QLWULDATASTATUS? +QLWULDATASTATUS:<status>

OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<status> Integer type. Status of CON data sending.

0 Have not sent
1 Sent, waiting response of IoT platform
2 Sent failed
3 Timeout
4 Success
5 Got reset message

Example
AT+QLWULDATASTATUS?
+QLWULDATASTATUS:4

OK

6.8. AT+QLWFOTAIND Set DFOTA Update Mode

The command is used to set DFOTA update mode: automatic mode or manual mode. Under automatic
mode, the firmware download and update are completed automatically. Under manual mode, the firmware
download and update are controlled by device. Under manual mode, after received 5/0/1 update package
URL and 5/0/2 request update messages, the module will notify the device by AT+QLWEVTIND=<type>
command, and the device will decide whether or not to download and update firmware according to actual
conditions.

The function of manual mode requires the cooperation of Huawei’s IoT platform. It will give an <err> code
and description as an intermediate message if the message cannot be sent. Please refer to Chapter 7 for
possible <err> values.

BC35-G&BC28_AT_Commands_Manual 95 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

AT+QLWFOTAIND Set DFOTA Update Mode

Write Command Response
AT+QLWFOTAIND=<type> OK

If there is any error, response:

+CME ERROR:<err>

Parameter

<type> Integer type. DFOTA update mode

0 Set automatic mode
1 Set manual mode
2 Notify module to start downloading
3 Notify module to cancel downloading
4 Notify module to start updating
5 Notify module to cancel updating

Example
AT+QLWFOTAIND=1
OK

6.9. AT+QREGSWT Set Registration Mode

The command is used to set registration mode after the module reboot.

 If set <type> to 1, after reboot and attached to network, the module will trigger automatic registration.
 If set <type> to 0, after reboot and attached to network, the module will send REGISTERNOTIFY
message to the device, then the device triggers registration by command AT+QLWSREGIND.

It will give an <err> code and description as an intermediate message if the message cannot be sent.
Please refer to Chapter 7 for possible <err> values.

AT+QREGSWT Set Registration Mode

Write Command Response
AT+QREGSWT=<type> OK

If there is any error, response:

+CME ERROR:<err>

BC35-G&BC28_AT_Commands_Manual 96 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

Read Command Response

AT+QREGSWT? +QREGSWT:<type>

OK

Parameter

<type> Integer type. Registration mode.

0 Manual mode.
1 Automatic registration mode

Example
AT+QREGSWT=1
OK

AT+QREGSWT?
+QREGSWT:1

OK

6.10. +QLWULDATAEXIND Message Sent Status Report (Response

Only)

The module reports the message sent status to the device after the device sent CON message to the
module. Please refer to Chapter 7 for possible <err> values.

+QLWULDATAEXIND Message Sent Status Report (Response Only)

URC Format
+QLWULDATAEXIND: <indications>

Parameter

<indications> 0 Message has not been sent

1 Wait for response
2 Message sent failed
3 Message sent timeout
4 Message sent success
5 Received RST response

BC35-G&BC28_AT_Commands_Manual 97 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

6.11. +QLWEVTIND LWM2M Event Report (Response Only)

The module reports the LWM2M event to the device. Please refer to Chapter 7 for possible <err> values.

+QLWEVTIND LWM2M Event Report (Response Only)

URC Format Response
+QLWEVTIND: <type>

Parameter

<type> 0 Register complete

1 Deregister complete
2 Update register complete
3 Object observe complete
4 Bootstrap complete
5 5/0/3 resource observe complete
6 Notify the device to receive update package URL
7 Notify the device to receive update message
9 Cancel object 19/0/0 observe

BC35-G&BC28_AT_Commands_Manual 98 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

7 Error Values
This chapter introduces the error values related to BC35-G and BC28 modules.

The error codes listed in the following two tables are compliant with the 3GPP specifications. Customers
can refer to 3GPP TS 27.007 V13.5.0, sub-clause 9.2 for all possible <err> values.

Table 4: General Errors (27.007)

Code of <err> Description

3 Operation not allowed

4 Operation not supported

5 Need to enter PIN

23 Memory failure

30 No network service

50 Incorrect parameters

51 Command implemented but currently disabled

52 Command aborted by user

159 Uplink busy/flow control

Table 5: General Errors (27.005)

Code of <err> Description

300 ME failure

301 SMS service of ME reserved

302 Operation not allowed

BC35-G&BC28_AT_Commands_Manual 99 / 108
 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

303 Operation not supported

304 Invalid PDU mode parameter

305 Invalid text mode parameter

310 USIM not inserted

311 USIM PIN required

312 PH-USIM PIN required

313 USIM failure

314 USIM busy

315 USIM wrong

316 USIM PUK required

317 USIM PIN2 required

318 USIM PUK2 required

320 Memory failure

321 Invalid memory index

322 Memory full

330 SMSC address unknown

331 No network service

332 Network timeout

340 No +CNMA acknowledgement expected

500 Unknown error

BC35-G&BC28_AT_Commands_Manual 100 / 108

 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

The following error codes are specific ones for BC35-G and BC28 modules. Error code 512 was
previously error code 256. Error code 513 was previously error code 257.

Table 6: Specific Error Codes

Code of <err> Description

512 Required parameter not configured

513 TUP not registered

514 AT internal error

515 CID is active

516 Incorrect state for command

517 CID is invalid

518 CID is not active

520 Deactive the last active CID

521 CID is not defined

522 UART parity error

NOTE

AT+CMEE=<n> command disables (<n>=0) or enables (<n>=1) the use of final result code “+CME
ERROR:<err>”. When <n>=1, a limited set of error codes will be returned.

BC35-G&BC28_AT_Commands_Manual 101 / 108

 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

8 Reset Reasons
If the module is rebooted for any reason apart from either being power cycled or being externally reset, it
will return a message before the <CR><LF>Neul<CR><LF>OK<CR><LF> message that indicates the
reason for the reboot.

Table 7: Reboot Messages Displayed

No. Reboot Message Displayed

1 REBOOT_CAUSE_SECURITY_RESET_UNKNOWN

2 REBOOT_CAUSE_SECURITY_SYSRESETREQ

3 REBOOT_CAUSE_SECURITY_WATCHDOG

4 REBOOT_CAUSE_SECURITY_SELF

5 REBOOT_CAUSE_SECURITY_ALTBOOT

6 REBOOT_CAUSE_SECURITY_REGIONS_UPDATED

7 REBOOT_CAUSE_PROTOCOL_UNKNOWN

8 REBOOT_CAUSE_PROTOCOL_SYSRESETREQ

9 REBOOT_CAUSE_PROTOCOL_WATCHDOG

10 REBOOT_CAUSE_PROTOCOL_MONITOR_REBOOT_REQ

11 REBOOT_CAUSE_APPLICATION_UNKNOWN

12 REBOOT_CAUSE_APPLICATION_SYSRESETREQ

13 REBOOT_CAUSE_APPLICATION_WATCHDOG

14 REBOOT_CAUSE_APPLICATION_AT

15 REBOOT_CAUSE_UNKNOWN

BC35-G&BC28_AT_Commands_Manual 102 / 108

 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

9 Examples

9.1. Send/Receive/Read a UDP Message

The following shows a simple example of sending, receiving and reading a UDP message. Once the
socket is closed, no replies will be received.

AT+NSOCR=DGRAM,17,4587,1 //Create a socket

0

OK
AT+NSOST=0,192.53.100.53,5683,25,400241C7B17401724D0265703D323031363038323331363438
//Send a message
0,25

OK

+NSONMI:0,4 //Receive the message

AT+NSORF=0,4 //Read the messages

0,192.53.100.53,5683,4,60A041C7,0

OK
AT+NSOCL=0 //Close the socket

OK

9.2. Examples Relating to Huawei’s IoT Platform

9.2.1. Register to Huawei’s IoT Platform

AT+CGATT? //Query the PS service attach status.

+CGATT:1 //Attached to the PS service.
OK

BC35-G&BC28_AT_Commands_Manual 103 / 108

 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

AT+NCDP=127.0.0.1,5683 //Set IoT platform IP address and port.

OK

AT+QREGSWT? //Query the registration mode.

+QREGSWT:0 //Manual registration mode.
OK

AT+QLWSREGIND=0 //Start to register to the IoT platform.

OK

+QLWEVTIND:0 //Successful registration indication.

AT+QLWSREGIND=2 //Update to the IoT platform.

OK

+QLWEVTIND:2 //Successful update indication.

AT+QLWSREGIND=1 //Deregister from the IoT platform.

OK

+QLWEVTIND:1 //Successful deregistration indication.

9.2.2. Send/Receive Data with Huawei’s IoT Platform

AT+QLWSREGIND=0 //Start to register to the IoT platform.

OK

+QLWEVTIND:0 //Successful registration indication.

+QLWEVTIND:3 //IoT platform has observed the data object 19. When
the module reports this message, the customer can
send data to the IoT platform.
AT+QLWULDATA=3,313233 //Send data with NON mode. It does not need the IoT
platform to ACK this data message.
OK

AT+QLWULDATAEX=3,313233,0X0100 //Send CON message. It needs the IoT platform to

ACK this data message.
OK

+QLWULDATAEXIND:4 //Successful message sending.

AT+QLWULDATASTATUS? //Query the data sending status.

BC35-G&BC28_AT_Commands_Manual 104 / 108

 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

+QLWULDATASTATUS:4 //Successful message sending.

OK

+QLWDDLDATA:10,0102030405060708090A //The module has received data from the IoT platform.

9.2.3. Upgrade Firmware on Huawei’s IoT Platform

//Create a firmware upgrade task on the IoT platform.

AT+QLWFOTAIND? //Query the firmware upgrade mode.

+QLWFOTAIND:1 //Manual mode.

OK

AT+QLWSREGIND=0 //Start to register to the IoT platform.

OK

+QLWEVTIND:0 //Successful registration indication.

+QLWEVTIND:3 //IoT platform has observed the data object 19.

+QLWEVTIND:5 //IoT platform has observed the firmware object 5.

+QLWEVTIND:6 //Notify the device to receive update package URL.

AT+QLWFOTAIND=2 //Device notifies the module to start downloading.

OK

FIRMWARE DOWNLOADING

FIRMWARE DOWNLOADED

+QLWEVTIND:7 //Notify the device to receive update message.

AT+QLWFOTAIND=4 //Device notifies the module to start updating.

OK

FIRMWARE UPDATING

REBOOT_CAUSE_SECURITY_RESET_UNKNOWN //The module reboots.

Neul
OK

BC35-G&BC28_AT_Commands_Manual 105 / 108

 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

FIRMWARE UPDATE SUCCESS

+QLWEVTIND:0 //Successful registration indication.

+QLWEVTIND:3 //IoT platform has observed the data object 19.

FIRMWARE UPDATE OVER

9.2.4. Register to Huawei’s IoT Platform with DTLS

AT+CGATT? //Query the PS service attach status.

+CGATT:1 //Attached to the PS service.
OK

AT+NCDP=127.0.0.1,5684 //Set IoT platform IP address and port. The port is 5684.
OK

AT+QSECSWT=1 //Encryption using standard DTLS.

OK

AT+QSETPSK=201703230000024,0123456789ABCDEF0123456789ABCDEF
OK //Set PSK ID and PSK

AT+QREGSWT? //Query the registration mode

+QREGSWT:0 //Manual registration mode.
OK

AT+QLWSREGIND=0 //Start to register to the IoT platform.

OK

+QLWEVTIND:0 //Successful registration indication.

BC35-G&BC28_AT_Commands_Manual 106 / 108

 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

10 Appendix A Reference
Table 8: Terms and Abbreviations

Abbreviation Description

APN Access Point Name

CDP Connected Device Platform

CS Circuit Switched

DCE Data Communication Equipment

EARFCN E-UTRA Absolute Radio Frequency Channel Number

eDRX Extended Discontinuous Reception

EGPRS Enhanced General Packet Radio Service

GERAN GSM/EDGE Radio Access Network

GMT Greenwich Mean Time

GPRS General Packet Radio Service

HPLMN Home Public Land Mobile Network

HSDPA High Speed Downlink Packet Access

HSUPA High-Speed Uplink Packet Access

ICMP Internet Control Messages Protocol

IMEI International Mobile Equipment Identity

IMEISV International Mobile Equipment Identity and Software Version

MS Mobile Station

NB-IoT Narrow Band Internet of Thing

BC35-G&BC28_AT_Commands_Manual 107 / 108

 NB-IoT Module Series
BC35-G&BC28 AT Commands Manual

PDP Packet Data Protocol

RRC Radio Resource Control

RTC Real Time Clock

SVN Software Version Number

TA Terminal Adapter

TCP Transmission Control Protocol

TE Terminal Equipment

TTL Time To Live

UDP User Datagram Protocol

UE User Equipment

UICC Universal Integrated Circuit Card

URC Unsolicited Result Code

UUID Universally Unique Identifier

BC35-G&BC28_AT_Commands_Manual 108 / 108