AT Command Set for a GSM/Cellular Modem (Hayes + 3GPP TS 27.007 subset) V.250 / TS 27.007

The base 'is anybody there' command every AT command set supports.

ATE0 -- stop the modem echoing back everything it receives. Most scripted/automated use wants this; interactive terminal use usually wants echo on (ATE1) so what you type is visible.

ATE1 -- the modem's power-on default on most hardware.

ATZ -- reset to the profile stored in non-volatile memory (not necessarily factory defaults -- see FactoryDefaults for that).

AT&F -- restore factory default configuration.

ATI -- a free-form multi-line identification string, format entirely vendor-specific.

AT+CGMI.

AT+CGMM.

AT+CGSN -- returns the modem's IMEI.

AT+CPIN? -- whether the SIM needs a PIN/PUK entered before it can be used.

AT+CREG? -- whether, and how, the modem is registered on the network.

AT+CSQ

AT+CESQ -- supersedes CSQ with metrics meaningful for UMTS/LTE (RSCP, EcNo, RSRQ, RSRP), not just GSM RSSI/BER.

AT+COPS? -- the currently selected network operator and how it was selected.

AT+COPS=0 -- automatic network/operator selection. Each COPS mode is its own command here, the same way SetEchoOff/SetEchoOn are separate rather than one parameterized command: the trailing parameters COPS actually accepts genuinely differ by mode (0 and 2 take none at all; 1 and 4 require an operator; 3 takes only a format), and this schema has no way to make a message's own required fields conditional on another field's value within the same message.

AT+COPS=1,, -- manually select a specific operator. The real command also accepts an optional trailing (radio access technology); left out of this modeled version for simplicity rather than made a genuinely optional positional field, which this delimiter-based field model handles awkwardly.

AT+COPS=2 -- deregister from the network and remain deregistered until told otherwise.

AT+COPS=3, -- sets how OperatorResult's oper field will be formatted on future queries, without changing registration at all.

AT+COPS=4,, -- try the given operator manually; fall back to automatic selection if that specific one can't be reached. Same AcT simplification as SetOperatorManual.

AT+CPIN= -- from the Quectel BC660K-GL manual (AT+CPIN, section 8.6): entering a plain SIM PIN. See EnterPukWithNewPin for the other shape this same command takes.

AT+CPIN=, -- when the SIM demands PUK (not plain PIN), a second argument -- the new PIN to set -- is required. Genuinely COPS-like: same command name, argument COUNT (not a leading mode digit this time) selects which shape applies, and this schema has no way to make newpin conditionally required on pin actually being a PUK rather than a PIN -- an engine, or a human, has to know which case applies from GetPinStatus's own +CPIN: SIM PUK result first.

AT+CLCK=,0[,] -- from the manual's AT+CLCK (section 8.5). fac is quoted, e.g. "SC" for the SIM facility.

AT+CLCK=,1[,].

AT+CLCK=,2 -- the third CLCK shape: mode=2 needs no password, and gets a genuinely different response format (FacilityLockResult lines, not a bare OK) from mode=0/1 -- but that's not actually ambiguous for this schema's dispatch algorithm, since FacilityLockResult has its own +CLCK: prefix distinguishing it from Ok. Worth including precisely because it's a case where a mode-dependent response DOESN'T need special handling, unlike G460's write-variant ambiguity.

AT+CPSMS=2 -- from the manual's AT+CPSMS (section 9.4): mode=2 is a 'special form' that takes no further parameters at all and resets everything to defaults, unlike mode=0/1 below.

AT+CPSMS=,,,, -- mode 0 (disable) or 1 (enable) plus the requested timer values. Two literal empty positions (the manual's own ',,,' -- unused parameters this module doesn't support) sit between mode and TAU; modeled as a literal separator field rather than tidied away, since that's genuinely how the command is written on the wire. mode is restricted to {0,1} via a named enum type specifically so this can't overlap with SetPsmDisabled's mode=2 -- with a plain unrestricted uint here, an engine could wrongly treat 'AT+CPSMS=2' as this command's prefix plus mode=2 rather than SetPsmDisabled's own single constValue, a genuine ambiguity risk this fixes rather than leaves.

AT+QCFG="DataInactTimer" -- Quectel's AT+QCFG (section 11.1) is itself a text-based sub-command dispatcher: its first argument, a quoted function name, selects an entirely different parameter set for everything after it -- the same COPS-like pattern, but keyed on a string rather than a mode digit. Modeled as separate commands per function, the same way COPS's modes are. Omitting the value here means query.

AT+QCFG="DataInactTimer", -- supplying the value switches this from a query to a set.

AT+QCFG="GPIO",1,,

AT+QCFG="GPIO"[,2[,]] -- mode=2 (the default if omitted entirely) with pin optional: omit it for every GPIO's status, or give one for just that pin. Modeled here as the explicit mode=2,pin form; the bare AT+QCFG="GPIO" (mode and pin both omitted) is QcfgGetDataInactTimer's sibling case and isn't separately modeled to keep this set from growing unboundedly -- the pattern is established by the two variants that are here.

AT+QCFG="GPIO",3,, -- mode=3: set one GPIO's output level. Per the manual, 'only and must set value of a specified GPIO' -- pin and level only, no dir/pullsel, a third distinct trailing shape for the same function name.

AT+QCCID -- correction: an earlier version of this file modeled a generic, vendor-unspecified 'AT+CCID' for this. The Quectel BC660K-GL manual's actual command (section 8.11) is AT+QCCID, an execution command with no arguments at all; response is +QCCID:, not +CCID:. Kept alongside the generic GetIccid/IccidResult below rather than replacing them, since other vendors do genuinely use the generic form -- but where you have the real target module's manual, as here, prefer the sourced command over the generic guess.

AT+CGMR -- from the BC660K-GL manual (section 2.4). Worth flagging: its response line is literally 'Revision: ', not a '+CGMR: prefix the way almost every other query response here works -- a genuine, sourced exception to the pattern, not a modeling choice.

AT+IPR? (section 3.2).

AT+IPR= -- one of the module's own real supported rates (2400-460800). Wired up to this whole interface's own baudRateNegotiation (see the top-level property): the module acks at the OLD rate, then the host must reconfigure its own UART to match.

AT+CMEE=2 (section 10.2) -- without this, most of the CmeError responses modeled throughout this whole file wouldn't actually be returned at all; the module would send plain ERROR instead. Worth sending early in any real integration's init sequence, right after SetEchoOff.

AT+CGACT=, (section 5.1) -- brings the data connection actually up (or down). DefinePdpContext only defines the context's parameters; nothing flows until this activates it.

AT+CGPADDR (section 4.4, bare execution form) -- the IP address actually assigned to the device once its PDP context is active.

AT+CSODCP=,, (section 7.4) -- the actual point of this NB-IoT module for many real products: small non-IP data sent via the control plane (NIDD), avoiding the overhead of a full IP stack. This, not a PPP-style data-mode switch, is the primary data path this specific hardware is built for. Simplified from the manual's full AT+CSODCP=,,[,[,]] by omitting the two trailing optional parameters, the same simplification already used for SetOperatorManual.

AT+CRTDCP= (section 7.3) -- enables the +CRTDCP: URC (ControlPlaneDataReceived) for downlink data arriving the same way SendControlPlaneData sends it uplink.

AT+CBC (section 10.1) -- for a battery-powered deployment, worth polling before/after any high-current radio activity.

AT+QRST=1 (section 10.4) -- immediate reset, without a clean network detach first.

AT+CCLK? (section 12.1).

AT+CCLK=, format "YY/MM/DD,hh:mm:ss+zz" (quarter-hours from GMT, not whole hours -- +08 means +2 hours, per the manual's own worked example).

AT+CEDRXS=3 (section 9.1) -- the exact same COPS/CPSMS-like pattern again: a bare mode value that takes no further parameters and resets everything, distinct from mode 0/1/2 below which all need AcT_type and a requested value.

AT+CEDRXS=,, -- mode restricted to {0,1,2} via a named enum type for the same reason SetPsmParameters restricts its own mode: so this can't overlap with SetEdrxDisabled's mode=3.

AT+COPN -- dumps the modem's whole built-in numeric-to-alphanumeric operator name table. The device sends one OperatorNameResult line per known operator, then OK -- a burst of many same-shaped response frames, not one. No special modeling needed for that: each line dispatches independently like any other response, there just happen to be a lot of them in a row.

AT+CPLS? -- which preferred-PLMN list is currently active: 0=SIM/USIM (user-controlled), 1=operator-controlled, 2=HPLMN selector.

AT+CPOL? -- entries stored in the list GetPreferredListSelection points at. Like GetOperatorNames, typically returns several PreferredOperatorResult lines, one per stored entry, before OK.

AT+CIMI -- the SIM's IMSI. Response is the raw digit string with no +CIMI: prefix at all, unlike most other query responses here -- see ImsiResult.

Reads the SIM's ICCID. Genuinely non-standardized across vendors (AT+CCID, AT+ICCID, AT+QCCID and others all exist) -- AT+CCID modeled here as one common form, not a universal one.

AT+GSN -- the older Hayes-style serial number query. Response is the raw IMEI digit string with no prefix, unlike GetSerialNumber's AT+CGSN which modern modules also usually support; both often return the same value.

AT+CGREG? -- packet-switched (GPRS/UMTS) registration status, analogous to GetNetworkRegistration's AT+CREG? for circuit-switched.

AT+CEREG? -- LTE/EPS registration status, the AT+CREG?/AT+CGREG? equivalent for 4G.

AT+CGATT=1 -- attach to the GPRS/packet-data service, a precondition for DefinePdpContext.

AT+CGDCONT=,, -- the first genuinely parameterized command here, showing delimiter-separated arguments rather than a single constValue line.

ATD -- for a circuit-switched or legacy dial-up data call.

ATH.

AT+CGDATA="PPP",1 -- switches this same link from AT command mode into raw PPP. See relatedInterfaces.

AT+CMGF=1 -- text mode rather than PDU mode, a precondition for SendSmsHeader as modeled here.

AT+CMGS="" -- the modem replies with a bare '> ' prompt (not modeled as its own response here -- it's a 2-character prompt, not a CRLF-terminated line, and this schema's message model assumes the latter), then waits for SendSmsBody.

The actual message text, sent only after SendSmsHeader's '> ' prompt. Terminated by Ctrl-Z (0x1A), NOT this interface's usual CRLF -- endDelimiterOverride exists specifically for this case. (Esc instead of Ctrl-Z cancels the send instead; not separately modeled here.)

The generic success response to almost any command.

Generic failure with no further detail -- contrast CmeError, which at least gives a code.

+CME ERROR: -- an extended error report, typically only enabled after AT+CMEE=1 (not separately modeled here).

+CPIN: READY (no PIN needed) or +CPIN: SIM PIN (one is required), among other states.

+CREG: , -- n is the reporting mode previously set; stat is the registration state (1=registered home, 5=registered roaming, etc.).

+CSQ: 15,99 followed by OK, each its own CRLF-terminated line.

+CESQ: ,,,,, -- 6 comma-separated values, most using 99/255-style sentinels for 'not known/not detectable on fields that don't apply to the current radio access technology.

+COPS: [,,][,] -- per the manual (section 7.2): format/oper/AcT are genuinely OPTIONAL, omitted together when no operator is selected -- modeled below as always-present for simplicity, a real gap against the manual's own read-command response shape, not fixed here. AcT on THIS module is 9 (E-UTRAN NB-S1 mode) -- an earlier version of this file used 7 (generic LTE from the wider 3GPP TS 27.007 AcT table), which is wrong for this specific module; corrected.

AT+COPS=? -- the test command form, genuinely distinct from GetOperator (AT+COPS?): scans and lists every operator the module currently sees, not just the selected one. Response (OperatorScanResult) is a compound per-operator list, not the simple mode/format/oper/AcT shape.

+COPS: (,,,,),(...),...,,(list of supported s),(list of supported s) -- TestOperators's response, and genuinely too structurally complex for this schema to decompose field-by-field: an arbitrary-count LIST of parenthesized 5-tuples (one per operator the module currently sees), followed by two more parenthesized compound lists for supported modes/formats. Nothing in this schema models 'a variable number of grouped, parenthesized sub-fields' -- there's no equivalent to variableLength for a repeating STRUCTURED group, only for a single flat run of bytes/text. Modeled as one opaque remainder string rather than force a wrong decomposition; a real implementation needs its own parser for this one response, not this schema's ordinary field model. stat: 0=unknown, 1=available, 2=currently selected, 3=forbidden.

+COPN: , -- one line per operator in the modem's built-in table; GetOperatorNames's own description covers the multi-line pattern this and PreferredOperatorResult both share.

+CPLS:

+CPOL: ,, -- one line per stored preferred-operator entry.

Raw IMSI digit string, no +CIMI: prefix -- unlike almost every other query response here, so nothing to use as role=discriminator. Worth flagging: IMSI and IMEI (SerialNumberLegacyResult) are both commonly 15 prefix-less digits, so if their lengths coincide, this schema's dispatch algorithm genuinely cannot tell them apart by content alone -- real disambiguation relies entirely on which request (GetImsi vs GetSerialNumberLegacy) is outstanding, the same correlation problem noted for G460's AckResponse.

+CCID: as modeled here (vendor-specific -- see GetIccid).

+QCCID: -- the Quectel BC660K-GL manual's actual response to AT+QCCID (GetIccidQuectel), with its own distinct prefix from the generic IccidResult above.

+CLCK: [,] -- QueryFacilityLock's response. class is optional and omitted here for simplicity; a real implementation may see it, or several repeated lines for different classes.

+QCFG: "DataInactTimer", -- QcfgGetDataInactTimer's response.

+QCFG: "GPIO",[,,,] -- QcfgGpioQuery's response: one level if a specific pin was queried, four (comma-joined) if all were. Modeled as a single variable-length string covering however many comma-separated levels are actually present, rather than as separate optional fields -- this schema has no clean way to say 'either 1 or 4 of this field, never 2 or 3.'

Revision: -- see GetFirmwareRevision for why this doesn't follow the usual '+CGMR:' shape.

+IPR: -- GetBaudRate's response.

+CGPADDR: ,

+CRTDCP: ,, -- an unsolicited result code (URC), not a reply to any specific command: arrives whenever the network sends downlink data via the control plane, once SetControlPlaneDataReporting has enabled it.

+RECVNONIP: ,, -- a second, distinct URC for incoming non-IP data, via the user plane rather than SendControlPlaneData/ControlPlaneDataReceived's control-plane path.

+CBC: in mV -- GetBatteryVoltage's response.

+CCLK: -- GetClock's response.

Raw IMEI digit string, no prefix -- same shape as ImsiResult; see its description for the resulting dispatch ambiguity when lengths coincide.

+CGREG: , -- same stat encoding as NetworkRegistrationResult, for packet-switched registration.

+CEREG: , -- same shape again, for LTE/EPS registration.

+CMGS: -- confirms SendSmsBody's message was actually sent, with a reference number for delivery-status tracking.

Sent instead of OK for EnterDataMode: confirms the switch, after which every byte on the wire is PPP, not AT text, until the link drops back to command mode.