Sony Ericsson CM52 User manual

Confidential
USERS MANUAL 1(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
Prepared by Date
SEM/BMDSB DAVID DUGUID 2006-03-24
Contents responsible if other than preparer Remarks
Approved by
SEM/BMDG (JEREMY ROTH)
This document is managed in metaDoc.
Note: Any hard copy of this document is for reference only. Due to template and application dependencies the header and footer may fail to display correct data. It is
the responsibility of the user to ensure that they have a correct and valid version. Any outdated hard copy is invalid and must be removed from possible use.
CM52
Software User’s Guide and AT Command
Manual
The AT Command Manual is a reference of all the AT Commands that are supported
by SEMC in the CM52 module.

Confidential
USERS MANUAL 2(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
Table of Contents
1Introduction to the User’s Guide Command Manual ________________________________________ 14
1.1 Overview _______________________________________________________________________________ 14
1.2 How to read the manual __________________________________________________________________ 14
1.3 Service and Support______________________________________________________________________ 14
1.3.1 Technical Assistance ____________________________________________________________________________ 15
1.3.2 Change Requests _______________________________________________________________________________ 15
1.4 Abbreviations ___________________________________________________________________________ 15
2Overview of the CM52 Module__________________________________________________________ 17
3Functional Description________________________________________________________________ 17
3.1 Voice Calls______________________________________________________________________________ 17
3.2 Subscriber Call features __________________________________________________________________ 17
3.3 Over The Air Service Provisioning (OTA) ___________________________________________________ 18
3.4 Service _________________________________________________________________________________ 19
3.4.1 NAM ________________________________________________________________________________________ 19
3.4.2 Scanning______________________________________________________________________________________ 19
3.4.3 Roaming______________________________________________________________________________________ 20
3.4.4 Registration ___________________________________________________________________________________ 20
3.5 E911 or Emergency Calls _________________________________________________________________ 20
3.5.1 Phase I _______________________________________________________________________________________ 20
3.5.1.1 E911 Scanning ____________________________________________________________________________ 20
3.5.2 Phase 2 or Location Determination _________________________________________________________________ 21
3.6 Short Message Service ____________________________________________________________________ 21
3.7 Data Functionality _______________________________________________________________________ 22
3.7.1 Async data ____________________________________________________________________________________ 22
3.7.2 Quick Net Connect (QNC)________________________________________________________________________ 22
3.7.3 1xRTT _______________________________________________________________________________________ 23
3.7.3.1 Verizon’s Retry Logic During Service Option 33 Access Attempts____________________________________ 23
3.7.4 Data Rates ____________________________________________________________________________________ 23
3.8 Application Wake-up_____________________________________________________________________ 24
3.8.1 Details _______________________________________________________________________________________ 24
3.8.2 Behavior______________________________________________________________________________________ 24
3.8.3 Ring Indicator Notes ____________________________________________________________________________ 25
3.9 Real Time Clock (RTC)___________________________________________________________________ 25
3.10 Serial Port Multiplexer ___________________________________________________________________ 25
3.10.1 Module Device Driver (MDD) __________________________________________________________________ 25
3.11 Aeris MicroBurst ________________________________________________________________________ 26
3.12 Power Down ____________________________________________________________________________ 26
3.12.1 Power Down Registration ______________________________________________________________________ 26
3.12.2 Wait for Notification __________________________________________________________________________ 26
4AT Commands_______________________________________________________________________ 27
4.1 General description of AT commands _______________________________________________________ 27
4.1.1 Overview _____________________________________________________________________________________ 27
4.1.2 Command types ________________________________________________________________________________ 27
4.1.3 Command Format and Syntax _____________________________________________________________________ 28
4.1.3.1 Alphabet _________________________________________________________________________________ 28

Confidential
USERS MANUAL 3(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
4.1.3.2 Command-line editing_______________________________________________________________________ 28
4.1.3.3 Input Command Syntax______________________________________________________________________ 28
4.1.3.4 Output Response Syntax _____________________________________________________________________ 29
4.1.3.5 Unsolicited Message Syntax __________________________________________________________________ 30
4.1.3.6 Parameter Defaults _________________________________________________________________________ 30
4.2 Information and Identification Commands __________________________________________________ 31
4.2.1 AT (Attention Command) ________________________________________________________________________ 31
4.2.2 AT+GMI (Request Manufacturer Identification)_______________________________________________________ 31
4.2.3 AT+GMM (Request Model Identification) ___________________________________________________________ 31
4.2.4 AT+GMR (Revision Identification)_________________________________________________________________ 32
4.2.5 AT+GSN (Request Product Serial Number Identification) _______________________________________________ 32
4.2.6 AT+CPAS (Phone Activity State) __________________________________________________________________ 33
4.2.7 AT+CSQ (Signal Quality) ________________________________________________________________________ 33
4.2.8 AT+GCAP (Capabilities)_________________________________________________________________________ 34
4.2.9 AT*EIDSUM (Fixed-Format Module Identification Summary) ___________________________________________ 35
4.2.10 AT*EUNSOLM (Numeric or Verbose Unsolicited Messages)__________________________________________ 35
4.2.11 AT*EUNSOL (Control Unsolicited Messages)______________________________________________________ 36
4.2.11.1 Message Waiting Unsolicited Response_______________________________________________________ 37
4.2.11.2 Call Waiting Unsolicited Response __________________________________________________________ 37
4.2.11.3 Service Indicator Unsolicited Response _______________________________________________________ 37
4.2.11.4 RSSI change unsolicited response ___________________________________________________________ 38
4.2.11.5 Caller ID unsolicited response ______________________________________________________________ 38
4.2.11.6 Internal Call State unsolicited response _______________________________________________________ 39
4.2.11.7 Indication of Service State unsolicited response_________________________________________________ 39
4.2.11.8 Call end status unsolicited response __________________________________________________________ 39
4.2.11.9 Mode unsolicited response _________________________________________________________________ 40
4.2.11.10 SMS submit status unsolicited response_______________________________________________________ 41
4.2.11.11 Display unsolicited response________________________________________________________________ 42
4.2.11.12 User Zone unsolicited response _____________________________________________________________ 42
4.2.11.13 OTA programming status unsolicited response _________________________________________________ 43
4.2.11.14 Notification of forwarded incoming calls ______________________________________________________ 43
4.2.11.15 Privacy Mode unsolicited response___________________________________________________________ 43
4.2.11.16 Internal Registration unsolicited response _____________________________________________________ 43
4.2.11.17 Notification of no space to save SMS messages_________________________________________________ 44
4.2.11.18 Timestamp message ______________________________________________________________________ 44
4.2.11.19 DTMF message__________________________________________________________________________ 44
4.2.11.20 FLASH message _________________________________________________________________________ 45
4.2.12 Forced Unsolicited Messages ___________________________________________________________________ 45
4.2.12.1 Startup Unsolicited Message________________________________________________________________ 45
4.2.12.2 Shutdown Unsolicited Message _____________________________________________________________ 46
4.2.12.3 Shutdown Unsolicited Message (RTC Mode) __________________________________________________ 46
4.2.12.4 RING Unsolicited Message ________________________________________________________________ 46
4.2.12.5 Offline Unsolicited Message________________________________________________________________ 46
4.2.12.6 Async Data Communication Established Unsolicited Message _____________________________________ 46
4.2.12.7 NV Restored Unsolicited Message ___________________________________________________________ 47
4.2.13 AT$QCPREV (Display Current CDMA Protocol Revision)____________________________________________ 47
4.2.14 AT*ENETTIME (CDMA Network Time) _________________________________________________________ 47
4.2.15 AT*ECALLERID (Query Caller ID) _____________________________________________________________ 49
4.2.16 AT*ECSTAT (Query Call Status)________________________________________________________________ 49
4.3 NAM Programming______________________________________________________________________ 50
4.3.1 AT*ESCAN (Stop/Start Scanning) _________________________________________________________________ 50
4.3.2 AT*ERNAM (NAM Programming) ________________________________________________________________ 51
4.3.3 AT*ERPRL (Preferred Roaming List)_______________________________________________________________ 55
4.3.4 AT*ESSE (Select NAM1 or NAM2)________________________________________________________________ 57
4.3.5 AT*EOTAPAS (Prevent/Allow an OTAPA Session) ___________________________________________________ 57
4.4 Call Control ____________________________________________________________________________ 58
4.4.1 ATA (Answer) _________________________________________________________________________________ 58
4.4.2 ATH (Hook Control) ____________________________________________________________________________ 58
4.4.3 ATD – Dial command ___________________________________________________________________________ 58

Confidential
USERS MANUAL 4(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
4.4.4 ATD – Overdial (DTMF Tones) ___________________________________________________________________ 59
4.4.5 ATD! – Hook Flash _____________________________________________________________________________ 59
4.4.6 AT+COS (Operating Service) _____________________________________________________________________ 60
4.4.7 AT+CSS (Read Serving System)___________________________________________________________________ 62
4.5 Registration_____________________________________________________________________________ 62
4.5.1 AT*EREGC (Registration Control)_________________________________________________________________ 62
4.5.2 AT*EREGF (Forced Registration)__________________________________________________________________ 63
4.5.3 AT*EREGT (Retain Registration Time) _____________________________________________________________ 63
4.6 Audio Control___________________________________________________________________________ 64
4.6.1 AT*EAMS (Audio Mode Selection) ________________________________________________________________ 64
4.6.2 AT*EPCMR (PCM audio Routing) ________________________________________________________________ 65
4.6.3 AT*ENESC (Network Echo Suppression)____________________________________________________________ 65
4.7 Mode Management_______________________________________________________________________ 66
4.7.1 AT+CAD (Query Analog or Digital Service) _________________________________________________________ 66
4.7.2 AT*EPMOD (Preferred Mode) ___________________________________________________________________ 66
4.8 Interface Commands _____________________________________________________________________ 67
4.8.1 ATS0 (Automatic Answer Control)_________________________________________________________________ 67
4.8.2 ATS2 (Escape Sequence Character) ________________________________________________________________ 68
4.8.3 ATS3 (Command Line Termination Character) _______________________________________________________ 68
4.8.4 ATS4 (Response Formatting Character) _____________________________________________________________ 68
4.8.5 ATS5 (Command Line Editing Character) ___________________________________________________________ 69
4.8.6 ATS6 (Pause before Blind Dialing)_________________________________________________________________ 69
4.8.7 ATS7 (Connection Completion Timeout) ____________________________________________________________ 69
4.8.8 ATS8 (Comma Time) ___________________________________________________________________________ 70
4.8.9 ATS9 (Carrier Detect Threshold)___________________________________________________________________ 70
4.8.10 ATS10 (Automatic Disconnect Delay) ____________________________________________________________ 70
4.8.11 ATS11 (DTMF Duration and Spacing Setting)______________________________________________________ 71
4.8.12 AT&C (DCD Control)_________________________________________________________________________ 72
4.8.13 AT&D (DTR Response) _______________________________________________________________________ 72
4.8.14 ATE (Command Echo) ________________________________________________________________________ 72
4.8.15 AT+IFC (DTE-DCE Local Flow Control) _________________________________________________________ 73
4.8.16 AT+IPR (DTE Rate) __________________________________________________________________________ 73
4.8.17 AT*EMUX (Setup Multiplexer) ***Future Implementation*** ________________________________________ 74
4.8.17.1 Multiplexer Packet Format _________________________________________________________________ 74
4.9 Module Status and Controls _______________________________________________________________ 76
4.9.1 AT+CFUN (Set Functionality Level) _______________________________________________________________ 76
4.9.1.1 Real Time Clock (RTC) Unsolicited Response; in RTC wake mode ___________________________________ 79
4.9.1.2 Real Time Clock (RTC) Unsolicited Response; RTC holding host_en_pwr_b ___________________________ 80
4.9.2 AT*ERTCT (Set RTC Time)______________________________________________________________________ 80
4.9.2.1 Real Time Clock (RTC) Unsolicited Response, Date not set _________________________________________ 81
4.9.2.2 Real Time Clock (RTC) Unsolicited Response, RTC Power On ______________________________________ 81
4.9.3 AT*EWAKESET (Set Wakeup Notifications) ________________________________________________________ 81
4.9.4 AT*EWAKE (Query Wakeup Event) _______________________________________________________________ 82
4.10 Error Control ___________________________________________________________________________ 83
4.10.1 AT+CMEE (Report Mobile Equipment Error) ______________________________________________________ 83
4.11 Data Capability__________________________________________________________________________ 84
4.11.1 AT+CMUX (Select Multiplex Option) ____________________________________________________________ 85
4.11.2 AT$QCMIP (Mobile IP Capability) ______________________________________________________________ 85
4.11.3 AT$QCMDR (Set Medium Data Rate) ____________________________________________________________ 86
4.12 SMS Handling___________________________________________________________________________ 86
4.12.1 AT+CSSM (Send Short Message)________________________________________________________________ 86
4.12.1.1 *ESMSACK (Alert on Delivery) ____________________________________________________________ 89
4.12.2 AT*ESMSFULL (SMS Storage Space Full)________________________________________________________ 89
4.12.3 AT+CSLM (List Messages)_____________________________________________________________________ 90
4.12.3.1 Unsolicited Message +CSLM_______________________________________________________________ 90

Confidential
USERS MANUAL 5(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
4.12.4 AT+CSDM (Delete Message) __________________________________________________________________ 90
4.12.5 AT+CSRI (Receive Message Indications)__________________________________________________________ 90
4.12.5.1 Unsolicited Message +CSTD (Message Notification With Data) ___________________________________ 91
4.12.5.2 Unsolicited Message +CSTI (Message Notification)_____________________________________________ 93
4.12.6 AT+CSRM (Read Message) ____________________________________________________________________ 93
4.12.7 AT*ESMSFLTR (SMS Filter)___________________________________________________________________ 93
4.13 Location Determination___________________________________________________________________ 94
4.13.1 AT*EPDMOD (Position Determination Mode) _____________________________________________________ 94
4.13.2 AT*EPDCF (Location Determination Call Flow)____________________________________________________ 94
4.13.3 AT*EPDRL (Request Location) _________________________________________________________________ 95
4.13.3.1 *EPDLR (Location Response) ______________________________________________________________ 95
4.13.3.2 *EPDTR (Time Response) _________________________________________________________________ 97
4.13.4 AT*EPDPR (Provide Pseudorange Measurement) ___________________________________________________ 98
4.13.4.1 *EPDPR (Request Pseudorange Measurement) _________________________________________________ 99
4.13.5 AT*EPDREJ (Reject A Request) _______________________________________________________________ 100
4.14 Antenna Capabilities ____________________________________________________________________ 100
4.14.1 AT*EASW (Antenna Switch) __________________________________________________________________ 100
4.14.2 AT*EAFF (Antenna Fail Flag) _________________________________________________________________ 101
4.14.2.1 Antenna failure unsolicited response ________________________________________________________ 102
4.14.3 AT*EANTDIAG (Antenna Diagnostic command) __________________________________________________ 102
4.14.4 AT*EANTLIM (Antenna Limits command)_______________________________________________________ 102
4.14.4.1 Unsolicited Message Antenna Diagnostic Status Change_________________________________________ 103
4.15 Protocol Testing ________________________________________________________________________ 104
4.15.1 AT*EPREV (Protocol Version) ________________________________________________________________ 104
4.15.2 AT*EMRUCLR (Clear the current NAM MRU) __________________________________________________ 104
4.15.3 AT*ESNAP (Display Channel Parameter Snapshot) ________________________________________________ 105
4.16 Data Testing ___________________________________________________________________________ 106
4.16.1 AT+CRM (RM Interface Protocol) ______________________________________________________________ 106
4.16.2 AT$QCMIPP (Select Mobile IP Profile)__________________________________________________________ 107
4.16.3 AT$QCMIPEP (State of Current Mobile IP Profile)_________________________________________________ 107
4.16.4 AT$QCMIPGETP (Mobile IP Profile Content) ____________________________________________________ 108
4.16.5 AT$QCMIPNAI (NAI) _______________________________________________________________________ 108
4.16.6 AT$QCMIPMASS (AAA Shared Secret) _________________________________________________________ 109
4.16.7 AT$QCMIPMHSS (HA Shared Secret) __________________________________________________________ 109
4.16.8 AT$QCMIPRT (Reverse Tunneling) ____________________________________________________________ 110
4.16.9 AT$QCMIPMASPI (AAA SPI) ________________________________________________________________ 110
4.16.10 AT$QCMIPMHSPI (HA SPI)__________________________________________________________________ 111
4.16.11 AT$QCMIPPHA (Primary HA IP) ______________________________________________________________ 111
4.16.12 AT$QCMIPSHA (Secondary HA IP) ____________________________________________________________ 112
4.16.13 AT$QCMIPHA (Home IP) ____________________________________________________________________ 112
4.16.14 AT$QCQNC (Enables/Disables Quick Net Connect)________________________________________________ 112
4.16.15 AT+CTA (Packet Data Inactivity Timer) _________________________________________________________ 113
4.16.16 AT$QCSCRM (Supplementary Channel Supported) ________________________________________________ 113
4.16.17 AT$QCTRTL (Slow down data at high CPU utilization) _____________________________________________ 114
4.16.18 AT$QCPKND (Scan serial link for PPP packets) ___________________________________________________ 114
4.16.19 AT$QCSO (Data Service Option Selection) _______________________________________________________ 114
4.17 Depreciated Commands _________________________________________________________________ 115
4.17.1 AT*ENSERV (Display Current Service State) _____________________________________________________ 115
4.17.2 AT*ECAM (Call Monitoring)__________________________________________________________________ 115
4.17.2.1 *ECAV (Call Monitoring Event) ___________________________________________________________ 116
4.17.3 AT+CIMI (Read Cellular International Mobile Identity Number) ______________________________________ 116
4.17.4 AT+CLVL (Loudspeaker Volume Level) ________________________________________________________ 117
4.17.5 AT+CMUT (Mute Control) ___________________________________________________________________ 117
4.17.6 AT*EAGVS (AGC/AVC Select) _______________________________________________________________ 118
4.17.7 AT+CUDAH (Default User Destination Address Info)_______________________________________________ 118
4.17.8 AT+CSDCN (Default Call-back Number) ________________________________________________________ 118
4.17.9 AT+CSDSH (Default SMS Header) _____________________________________________________________ 119

Confidential
USERS MANUAL 6(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
4.17.10 AT+CSDUH (Default User Data Header)_________________________________________________________ 119
4.17.11 AT+CRC (Cellular Result Codes)_______________________________________________________________ 120
4.17.12 AT+WS46 (Sets the Cellular Protocol Mode)______________________________________________________ 120
4.17.13 AT*ECPREV (Display Current CDMA Protocol Revision)___________________________________________ 121
5Aeris MicroBurst Feature_____________________________________________________________ 121
5.1 General Information ____________________________________________________________________ 121
5.1.1 Factory Configuration __________________________________________________________________________ 121
5.1.2 System Selection ______________________________________________________________________________ 121
5.1.3 Supported MicroBurst Paging Methods_____________________________________________________________ 121
5.1.4 I/O Pins _____________________________________________________________________________________ 121
5.1.5 Support for Multiple MINs ______________________________________________________________________ 122
5.2 MicroBurst Commands__________________________________________________________________ 122
5.2.1 AT*EDCLR Set MicroBurst Default Values________________________________________________________ 122
5.2.2 AT*EDCTR Thirty-Two Bit Internal Counter/Register ________________________________________________ 123
5.2.3 AT*EDMFE MicroBurst Function Enable __________________________________________________________ 123
5.2.4 AT*EDFMTP Set Page Match Parameters__________________________________________________________ 125
5.2.5 AT*EDMIN Enter and Display MicroBurst MINs____________________________________________________ 125
5.2.6 AT*EDWDG Write Dial Digit Buffer _____________________________________________________________ 126
5.2.7 AT*EDMBIO Monitor Binary Input Enable/Disable__________________________________________________ 127
5.2.8 AT*EDSDG Send Current Dial Digit Buffer Contents ________________________________________________ 127
5.2.9 AT*EDRDG Read Current Dial Digit Buffer State ___________________________________________________ 128
5.2.10 AT*EDFREG Force Registration______________________________________________________________ 129
5.2.11 AT*EDRLP Read Last MicroBurst/Configuration Page _____________________________________________ 129
5.2.12 AT*EDTXS Read Transmit Buffer Status ________________________________________________________ 130
5.2.13 AT*EDSERV MicroBurst Service Search ________________________________________________________ 130
5.2.14 AT*EDSCTR Send Thirty-two Bit Counter Register ________________________________________________ 131
5.3 MicroBurst Unsolicited Messages _________________________________________________________ 131
5.3.1 MICRO,1 – Unsolicited MIN Page Response ________________________________________________________ 131
5.3.2 MICRO,2 – Unsolicited Configuration Packet Page Response ___________________________________________ 131
5.3.3 MICRO,3 – Unsolicited MicroBurst Service Detection_________________________________________________ 131
5.3.4 MICRO,4 – Unsolicited MicroBurst TX Done _______________________________________________________ 132
5.3.5 MICRO,5 – Unsolicited MicroBurst TX Failure ______________________________________________________ 132
5.3.6 MICRO,6 – Unsolicited MicroBurst Service SID Change ______________________________________________ 132
5.3.7 MICRO,7 – Unsolicited MicroBurst I/O Pin A Change ________________________________________________ 132
5.3.8 MICRO,8 – Unsolicited MicroBurst I/O Pin B Change_________________________________________________ 132
5.3.9 MICRO,9 – Unsolicited No MicroBurst Service Detected ______________________________________________ 132
5.3.10 MICRO,11 – Unsolicited Forward Data Packet Application Data ______________________________________ 133
5.3.11 MICRO,12 – Unsolicited Forward Data Packet SDRR Data___________________________________________ 133
5.3.12 MICRO,13 – Unsolicited SMS Application Data ___________________________________________________ 133
5.3.13 MICRO,14 – Unsolicited SMS SDRR Data _______________________________________________________ 133
5.3.14 MICRO,95 – Origination Disallowed ____________________________________________________________ 133
5.3.15 MICRO,96 – Unsolicited Forward Data Packet Page Response, Error Detected ___________________________ 133
5.3.16 MICRO,97 – Unsolicited SMS Page Response, Error Detected ________________________________________ 133
5.3.17 MICRO,98 – Unsolicited MIN Page Response, Error Detected ________________________________________ 134
5.3.18 MICRO,99 – Unsolicited Configuration Page Response, Error Detected_________________________________ 134
6User scenarios ______________________________________________________________________ 134
6.1 Configuring HyperTerminal______________________________________________________________ 134
6.2 Setup CM52 for serial communication _____________________________________________________ 135
6.3 Proper Shutdown procedure______________________________________________________________ 135
6.4 Acquiring Cellular Service _______________________________________________________________ 136
6.4.1 Over the Air Programming (OTA)_________________________________________________________________ 136
6.4.2 Manual Activation _____________________________________________________________________________ 136
6.5 NAM Programming_____________________________________________________________________ 137
6.5.1 Enter NAM programming mode __________________________________________________________________ 137

Confidential
USERS MANUAL 7(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
6.5.2 Read NAM___________________________________________________________________________________ 138
6.5.3 Write NAM __________________________________________________________________________________ 138
6.5.4 Writing a PRL ________________________________________________________________________________ 139
6.5.5 Reading a PRL________________________________________________________________________________ 139
6.5.6 Exit NAM programming mode ___________________________________________________________________ 139
6.6 Unsolicited Messages ____________________________________________________________________ 140
6.7 Call Processing _________________________________________________________________________ 140
6.7.1 Call origination _______________________________________________________________________________ 140
6.7.2 Answer Incoming Call __________________________________________________________________________ 140
6.7.3 Hang Up Call _________________________________________________________________________________ 140
6.7.4 DTMF tones while on a call______________________________________________________________________ 140
6.8 Subscriber Calling Features ______________________________________________________________ 140
6.8.1 Caller ID_____________________________________________________________________________________ 141
6.8.2 Call Forward _________________________________________________________________________________ 141
6.8.3 Call Waiting__________________________________________________________________________________ 141
6.8.4 Three-way calling _____________________________________________________________________________ 142
6.9 SMS __________________________________________________________________________________ 142
6.9.1 Mobile Originated (MO) Messages ________________________________________________________________ 142
6.9.1.1 Sending Text Data to MIN __________________________________________________________________ 142
6.9.1.2 Sending binary data________________________________________________________________________ 142
6.9.1.3 Sending Text to Email Address_______________________________________________________________ 142
6.9.2 Mobile Terminated (MT) Messages________________________________________________________________ 143
6.9.2.1 Temporarily store SMS Messages_____________________________________________________________ 143
6.10 Data Communication____________________________________________________________________ 143
6.10.1 Prepare CM52 for Data services ________________________________________________________________ 143
6.10.2 CM52 – Windows NT PC Installation Procedure ___________________________________________________ 143
6.10.3 To Make an Asynchronous Data Call (CSD)_______________________________________________________ 144
6.10.4 To Make a QNC Data Call (Packet over Circuit Switched) ___________________________________________ 144
6.10.5 To Make a 1x HSPD Call, Simple IP only on Verizon _______________________________________________ 144
6.10.6 To Make a 1x HSPD Call, Mobile IP Preferred on Verizon ___________________________________________ 145
6.11 Location Determination Call Flows ________________________________________________________ 145
6.11.1 External GPS _______________________________________________________________________________ 145
6.11.2 Internal GPS _______________________________________________________________________________ 146
6.12 Application Wake-up Examples___________________________________________________________ 146
6.12.1 Single Event Case ___________________________________________________________________________ 146
6.12.2 Multiple Event Case _________________________________________________________________________ 147
6.12.3 RTC Event Case ____________________________________________________________________________ 147
6.13 RTC Examples _________________________________________________________________________ 148
6.13.1 Ring Indicator Example_______________________________________________________________________ 148
6.13.2 Application Wakeup RTC Example _____________________________________________________________ 149
6.13.2.1 Module not powered on __________________________________________________________________ 150
6.13.2.2 Module powered on _____________________________________________________________________ 150
6.13.2.3 Module powered on and currently powering down______________________________________________ 150
7Test Scenarios ______________________________________________________________________ 151
7.1 Running CAIT/QXDM with the CM52 _____________________________________________________ 151
7.2 Programming the correct PRL using External Tools _________________________________________ 151
7.3 MOB_P_REV __________________________________________________________________________ 151
7.4 Modifying the Service ___________________________________________________________________ 151
7.5 Set Voice Privacy _______________________________________________________________________ 151
8CM-42 Software Compatibility_________________________________________________________ 151

Confidential
USERS MANUAL 8(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
8.1 Features_______________________________________________________________________________ 152
8.2 AT Command Differences________________________________________________________________ 152
8.3 Unsolicited Message Differences___________________________________________________________ 157

Confidential
USERS MANUAL 9(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
Revision History
RELEASE DATE SUMMARY OF CHANGES
PA1 6/22/04 •Initial Release of AT command manual.
PA2 7/6/04 •Editorial Changes
PA3 7/7/04 •Editorial changes made by Dave Hoover
PA4 – PA5 8/13/04 •Document review changes made
PA6 9/1/04 •Style and format changes
•NAM tag 50 parameters modified to complement AT*EPMOD.
•Updates to unsolicited messages to more closely resemble the CM-42
when applicable.
•Clarification of AT*ENSERV results
•AT*ESNAP added back into document under protocol commands.
PA7 9/9/04 •Additional documentation to the SMS handling section.
•Additional documentation to the SERVICE STATE unsolicited message
•Added a new Service header to detail general service, scanning, roaming,
etc in one centralized location.
•Cleared up +CMEE implementation
•Removed Result Code tables from the AT commands since every AT
command has a result code of either OK or ERROR, it was completely
redundant information that is now explained in the AT command syntax
section.
PA8 9/10/04 •Removing 14 data commands; commands are not used by our customers.
The commands are advanced functionality not needed by most
applications.
•Fixed data user scenarios, changed to few SEMC AT commands to
Qualcomm equivalent.
PA9 9/22/04 •Corrected the format of the validity period in AT+CSSM
•Replaced the parameter descriptions for +CSTD with a reference to
AT+CSSM
•Spelling correction in AT*EOTAPAS
•Added additional information to the call back number parameter in
AT+CSSM
•Changed any occurrence of AT*ECMUX to AT*EMUX.
•Clarification of a-key contents
•Added AT+CSLM, AT+CSRM, AT+CSRI, AT+CSDM, & +CSTI.
•Added BUFFERFULL unsolicited message for SMS
•Removed AT$SPNAI since it is a Sprint only function.
•Added AT$QCMDR back into document.
•Removed AT+CXT & AT+CFG
PA10 10/7/04 •Removed AT*EGODIAG; refer to PRI for setting
•Removed AT*EAPCS; Power class controlled by 3watt hardware feature.
•Removed AT*ECARRIER & AT$PZID; currently only supporting Verizon.
•Added service options 32, 54, & 55 to AT+COS command.
PA11 10/15/04 •Updates to AT+COS
•Reflecting the fact that ATS0 is now persistent
•Removed E911 read option in AT*EPMOD
•Reflected the fact that nid is returned with SERVICE unsolicited message
PA12 10/21/04 •Removed COS=8 from AT+COS command (table explains how to set up
packet data call
•Clarifications made to the user scenarios
PA13 10/27/04 •Parameters associated with AT+IFC are NOT persistent
•AT*EOTAPAS is issued against the current NAM and not both NAMs
•Changed the default setting of AT+CTA from 20 to 30 seconds to match
Verizon specification.

Confidential
USERS MANUAL 10(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
RELEASE DATE SUMMARY OF CHANGES
PA14 11/09/04 •Changed the default email addressing for SMS to MAIL
•AT+CSLM will free up the AT port for command processing before all
messages are reported (+CSLM: EOL signifies the end of the list).
•Clarification that AT*EPMOD will return ERROR if the module is on a call.
•Fixed AT*ESNAP to reflect the correct service options (refer to AT+COS).
•Clarifications to *EUNSOL: RSSI and AT+CSQ
•Added descriptions for RING, Restart, CONNECT, and OFFLINE
unsolicited messages.
•Clarification of asynchronous data calls
•Added error message text to AT+CMEE
PA15 11/10/04 •Clarification about the A and T being required for command echoing
purposes (added a small comment about responses from module if a
command character is lost).
•Clarification on size limits for SMS messages
PA16 11/24/04 •Corrected defaults for AMPS Home SID and system preference.
•Adding a section that describes the compatibility with the CM-42.
•Adding a few requested CM-42 backward compatibility AT commands (it is
encouraged these commands not be used but will be fully supported)
PA17 12/12/04 •Enhancing the User Scenarios, adding more detail.
•Added a Test Scenarios section to assistance common external tests.
•Updated the support section.
PA18 12/15/04 •Clarification on AT+COS
•Clarification on AT+CSSM
•Removed “Calling” option from AT*ECAM (*ECAV)
•Changed document name to S/W User’s Guide and AT Command Manual
•Added an explanation of the NV Restore feature
•Added an explanation of the Multiplexer feature
•Added unsolicited messages to the CM-42 compatibility section
PA19 12/15/04 •Added more unsolicited message to the CM-42 compatibility section
•Changed the default display option for AT+CSRI
PA20 12/16/04 •Updated AT*ESCAN description to indicate that the NO SERVICE
message is displayed only when the module has service at the time the
command is issued.
PA21 12/17/04 •Reformatted Table of Contents
PA22 12/20/04 •AT+CSLM parameter no longer optional to CM-42 compatibility
•Changed AT&D default from 0 to 2
•Changed AT&C default from 1 to 2
PB1 1/13/05 •Corrected grammatical errors
•Updated the Data User scenarios
•Clarifications in +CSTD & AT+CSSM
•Added Ring Indicator handling
•Added RTC handling
•Added Shutdown Complete unsolicited messages
•Added the TIMESTAMP unsolicited message
PB2 1/25/05 •Clarification to SYS_PREF NAM entry
•Modified 3-way calling user scenario (Verizon changed how it is done)
•Several changes to the RTC usage and AT+CFUN=10
•Added CRC into the manual
•Modified the behavior of AT*EPMOD if parameters are not specified.

Confidential
USERS MANUAL 11(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
RELEASE DATE SUMMARY OF CHANGES
PB3 2/1/05 •Adds Aeris Microburst descriptions, commands, and error codes
•Adds of comment on AT*EREGC disabling by MicroBurst enable.
•Adds bit 0x80 to AT*EREGC for Parameter Based Registration
•Adds command difference entries for AT*OACQPRL, AT*OACQTYPE,
AT*EDMBIO, AT*EDSCTR, AT*EDMFE
•Adds Unsolicited message differences for “MICRO,7”, “MICRO,8”,
“MICRO,10”, “MICRO,96”, “MICRO,97” messages
PB4 2/1/05 •Corrected a few section headers (incorrect font)
•Consistent usage of hex-coded and TBCD phrases
•Added a Julian Date/Time option to AT*ENETTIME
•Added location determination unsolicited message *EPDTR
•Verizon clarification to AT$QCMIPNAI
•Comment to MIP user scenario regarding the MDN
•Changed units of measure for <timezone> in AT*ENETTIME
•Added FLASH & DTMF unsolicited messages to AT*EUNSOL
•Added AT+WS46 for CM-42 backward compatibility
•Changed defaults for AT+CSRI to match the code
•Note in AT command compatibility section suggesting the parameters
associated with AT commands be reviewed in addition to the AT command.
•Clarification to service indicators in AT*EWAKESET
PB5 2/15/05 •Removed unnecessary, and confusing, parameters from unsolicited
message *EPDPR
•Clarification to AT*EUNSOL regarding the use of the <control> parameter.
PB6 3/1/05 •AT Command difference table sorted alphabetically by command and
updated to include information about parameter differences
•Added conversion example for AT+GSN command
PB7 3/2/05 •SMS submit unsolicited message had incorrect message number for “DTC
has been disconnected by the module”; it was 32778 but should be 32779.
•Set RTC wakeup to minute granularity
PB8 3/11/05 •Binary SMS MO example had one to many commas
•Port mapping and DMU data now saved in backup/restore feature
•Adding AT*ESMSFLTR for application control over SMS message types
received.
•Noting the Ring Indicator pin assert time is configurable in the PRI.
•Adding Antenna failures and antenna diagnostics to the Ring Indicator
settings.
•Added clarification of a race condition where an application was notified of
an incoming call by the Ring Indicator, but the call was dropped before the
application queried the module for the wakeup reason.
•Added AT*ECALLERID to poll for the caller ID
•Modification to AT*EANTDIAG to query both Antennas if hardware
supports a two antenna configuration.
•Clarification that the RTC should be defined as UTC time.
•Clarification to AT*EWAKE regarding issuing AT*EWAKE just before
application powers down to clear the wake reason settings.
•Added Application wake-up functional description section
•Added Application wake-up examples to the user scenarios
•Added more details regarding the RTC (functional description)
•Fixed the RTC unsolicited message format
•Clarification regarding a scan to Digital only when sending SMS messages
PB9 4/11/05 •Escape sequence clarified
•RTC time/date updates clarified
•Added some details regarding registration to the functionality section
•Added details regarding Verizon “throttling” of 1x data retry attempts
•Moved OTA description from User Scenarios to Functional Description

Confidential
USERS MANUAL 12(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
RELEASE DATE SUMMARY OF CHANGES
PB10 4/15/05 •Syntax correction to manual to reflect software (antenna unsolicited
messages)
•A few clarifications to OTASP (providing all OTA status & dropping the call
aborting the OTA process).
•Updated documentation to reflect the SMS timestamp parameter
•Added some details to the TIMESTAMP unsolicited message
•Explanation of ATH to terminate an incoming call without first answering it
•Adding a comment about AT+CFUN=99
•CALL END terse mode values changed to match module
•Details regarding the CM52 timing out of a wait for answer state
PB11 4/29/05 •Minor grammatical corrections throughout document
PB12 5/12/05 •Added AT*ECSTAT command
•Added information regarding an extended error code when using
AT*ECALLERID
•Added AT*EREGT
•Removing REGISTRATION TIMER (ON | OFF) unsolicited messages
•Note regarding the negative SID/NID requiring the module to be restarted
•Minor grammatical corrections throughout the document
•Documented module behavior for an OTA SPC failure
•Documented the “keep awake” option, AT+CFUN=20
•Change to reflect the modules capability to determine when the RTC was
powering the module down and the host application is power the module
up.
PB13 5/20/05 •Changed the message time for RTC,WAKETIME from 3 to 5.12 seconds to
match the sleep cycle…keeps power consumption low
•Note regarding RI and unsolicited message correlations
•Changed the name of the RTC keep awake unsolicited message to
RTC,AWAKE
•Replacing AT*ECPREV? with AT$QCPREV.
•Moving some data commands out of the general AT commands as they
apply more to system/network testing and debugging and should not be
designed into an external application.
•Added a small description that the module supports two NAMs
•Changed “No requirement” to “Not Supported” in the CM-42 compatibility
table
•Grammar change in AT*ECSTAT
•DTMF unsolicited message clarification
•SERVICE unsolicited message clarification
PC1 8/10/05 •Updated the module behavior for an OTA SPC failure with references to
the expected unsolicited message
•Updated the AT+CSRI command description to indicate that message
buffer space is required to receive messages
•Updated AT*EREGC command regarding ordered registrations.
•Updated data testing commands to include additional commands as
required by Verizon. Also updated the data testing command section with
information regarding defaults versus carrier (Verizon) defaults.
PC2 8/17/05 •Updated all fields, TOC
PC3 9/14/05 •Grammatical Updates
PC4 9/15/05 •Added informational chapter regarding proper shutdown
•Added informational chapter regarding the validity of RI pin at power-up.
PC5 9/16/2005
•Updated sections describing AT$QCMIPMASS and AT$QCMIPMHSS with
information regarding default settings.

Confidential
USERS MANUAL 13(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
RELEASE DATE SUMMARY OF CHANGES
PC6 9/19/2005
•Reviewed document for consistency
•Updated grammatical errors.
•Updated formatting inconsistencies
•Added tables for parameter information that was in paragraph form
•Recast command descriptions to be in the active present tense
PC7 10/05/2005
•Replaced all instances of CM-52 with CM52, per SEMC marketing material.
•Updated table formatting for readability & consistency.
•Added indication that AT*EMUX command is NOT currently supported.
•Added information regarding the function of AT*EPMOD when a digital-only
or AMPS-only PRL is loaded.
•Added information about the possible differences between CM42 and
CM52 audio settings.
•Added information regarding AT*ESCAN command and E911call
interaction.
PC8 10/25/2005
•Added note regarding guard times to ATS2 command description
•Added information regarding ERROR to be returned when AT commands
are issued that attempt to use features that are not supported via hardware
or software feature flags, including these commands:
oAT*EAFF
oAT+CFUN=10
oAT+CFUN=20
oAT*ERTC
oAT*EASW
oAll Microburst commands
•Added information regarding the impact of OFFLINE mode on the
AT*EPMOD command
C Released as formal release C. No changes
PD1 12/29/2005
•Updated AT+CSQ? command with clarifications on when the command is
valid
•Updated AT*EPMOD command with information regarding its ability to
cope with multiple issuance of the command (M2M00123896).
•Updated AT+CFUN=0 command with information regarding Fatal Errors
(M2M00124208) and information regarding all CFUN shutdowns being
“proper” shutdowns (M2M00124264).
•Updated AT+CSRM & *EUNSOL: SMS_SUBMIT commands to use
message reference instead of index based on VZW feedback
(M2M00124290).
PD2 2/15/2006
•Updated the Power down chapter to include information regarding the
power down registration timeout and information regarding waiting for the
shutdown complete message.
PD3 3/23/2006
•Removed an invalid reference to the DTR pin

Confidential
USERS MANUAL 14(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
1 Introduction to the User’s Guide Command Manual
1.1 Overview
AT commands are used for communication between the CM52 module and an application. All the AT
commands that are supported by CM52 are described in this AT command manual.
The CM52 Integrator’s manual, which is provided with the CM52 module, contains information on the CM52
hardware, mechanics, Developer’s Kit and how to get started in general.
This manual assumes that the CM52 module is connected properly as defined in the Integrator’s manual and
is ready to start AT command communication.
1.2 How to read the manual
This manual is divided into five chapters.
Chapter 1 provides a general overview of the AT command manual. This chapter contains abbreviations used
throughout the AT command manual and also contains information concerning Service and Support.
Chapter 2 is a brief overview of the CM52 module. Detailed information about CM52 and the Developer’s kit
can be found in the CM52 Integrator’s Manual.
Chapter 3 describes the main functions and capabilities of the CM52 module.
Chapter 4 contains all of the AT commands that are supported by the CM52 module. Each AT command has
a description of its function and of its parameters. Examples are provided for some of the commands. In
addition to the descriptions of each AT command, the chapter begins with a description on how to use AT
commands in general.
Chapter 5 provides additional information about how to use the AT commands. This chapter contains user
scenarios for a variety of features.
Chapter 6 provides descriptions and examples on how to use many of the features that are supported by the
CM52.
Examples are provided throughout this manual to clarify the text descriptions. All AT command examples are
written in Courier font. To differentiate AT commands from the host controller and responses from the CM52
module, the responses are written in gray color.
1.3 Service and Support
Please visit the Sony Ericsson M2M web pages for more information about where you can purchase Sony
Ericsson modules or for recommendations regarding accessories and components.
The web address is: http://www.sonyericsson.com/m2m
To register for product news and announcements or for product questions, contact the Sony Ericsson modules
Technical Support group:
Phone Number: [phone] (staffed Monday-Friday 9:00 AM – 5:00 PM EST)
E-mail: mailto:[email protected]

Confidential
USERS MANUAL 15(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
1.3.1 Technical Assistance
When you request technical assistance from SEMC, there are several pieces of information that will help to
resolve your issue.
If the issue is a software issue, please provide the following information (all statements may not apply):
•Whether the testing was done on a live network and/or Communication Analyzer. If the testing was
done on a live network, provide all relevant information about the account (carrier, features, etc).
Additionally, please provide the SID and channel that the module is camped on and indicate whether
the SID is associated with the Carrier the account is with.
•What level of hardware and software is being used? This information can be retrieved from the module
by issuing the following command:
AT*EIDSUM?
•Provide an AT command log of the issue that is actually occurring. SEMC prefers all unsolicited
messages to be enabled, and AT commands and responses should be time stamped if possible.
•It can be helpful to both SEMC and its customers if the issue can be recreated on the SEMC
development board. Doing so removes any involvement with the customer application.
•Have any configuration changes been done to the module since it was received? For example, has the
PRL been updated? If the module has been configured, provide the new settings.
•Please provide the CDMA protocol revision. This information can be retrieved by issuing the following
command:
AT*ECPREV?
•A QXDM/CAIT log is always helpful in resolving issues. If providing such a log please capture at least
one minute of log data both before and after the issue. Also, please note the approximate time in the
log where the issue occurred.
1.3.2 Change Requests
It is recommended that any request for a change be made to the sales or project department within SEMC.
The request for a change must be documented. SEMC recommends that the customer complete the Change
Request form supplied by SEMC.
1.4 Abbreviations
AAA Authentication, Authorization, and Accounting
AEC Acoustic Echo canceller
AKEY Authentication key
AFLT Advanced Forward Link Trilateration
AFMS Audio From Mobile Station (refers to audio pins on the system connector)
ATMS Audio To Mobile Station (refers to audio pins on the system connector)
AT Attention command
CDMA Code Division Multiple Access
CFU Call Forward Unconditional
CFNA Call Forward on No Answer
CFB Call Forward on Busy
CSD Circuit Switched Data
CTS Clear To Send
DCD Data Carrier Detect
DTR Data Terminal Ready
ESEC Ear Seal Echo Canceller
EFR Enhanced Full Rate (speech coding)
ERI Enhanced Roaming Indicator
ESN Electronic Serial Number

Confidential
USERS MANUAL 16(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
FCC Federal Communications Commission
GPS Global Positioning System
GSM Global System for Mobile Communications
HA Home Agent
HSPD High Speed Packet Data
IA5 T.50 International Alphabet 5
IP Internet Protocol
IRA International Reference Alphabet
ISDN Integrated Services Digital Network
ISO International Standards Organization
LD Location Determination
ME Mobile Equipment
MIP Mobile IP
MO Mobile Originated
MRU Most Recently Used
MS Mobile Station
MSB Most Significant Bit
MT Mobile Terminated
NAM Number Assignment Module
NAI Network Access Identifier
NID Network Identifier
NV Non-Volatile memory
OEM Original Equipment Manufacturer
OTA Over the Air Programming
OTASP Over the Air Service Provisioning
OTAPA Over the Air Parameter Administration
PCM Pulse Code Modulation
PDE Position Determination Equipment
PIN Personal Identification Number
PPP Point to Point Protocol
PR PseudoRange
PRI Product Revision Information
PRL Preferred Roaming List
QNC Quick Net Connect
Rate Set 1 (9600, 4800, 2400, 1200), over the air link rate is up to 9600 bps
Rate Set 2 (14400, 7200, 3600, 1800), over the air link rate is up to 14400 bps
RF Radio Frequency
RI Ring Indicator
RLP Radio Link Protocol
RTC Real Time Clock
RM Relay Module
RS Rate Set
RTS Request To Send
S3 Termination Character
S5 Editing Character

Confidential
USERS MANUAL 17(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
SEMC Sony Ericsson Mobile Communications
SID System Identifier
SLC Subsidy Lock Code
SMS Short Message Service
SO Service Option
SPC Service Programming Code
SPI Security Parameter Index
TCP Transmission Control Protocol
QNC Quick Network Connection
2 Overview of the CM52 Module
The CM52 is a dual band CDMA/AMPS 800 MHz and CDMA 1900 MHz transceiver module. It is designed for
consumer and OEM industrial voice and data applications. At this time, the SEMC customer base requires
data only applications; therefore voice capabilities have not been addressed.
The CM52 module is intended for mounting into an application developer’s chassis to provide wireless
communication capability for the product. The target chassis may take a wide variety of forms, such as a
residential electric meter, a point of sale terminal, an alarm panel, or an automobile console. All initial
configuration, mode control, and operational commands are issued to the CM52 module over an RS-232 serial
port using a flexible AT command format.
This manual provides a description of the software features available and all of the AT commands that are
supported in the CM52 and how to use them. For more information about the CM52 module refer to the
Integrator’s Manual.
3 Functional Description
This chapter describes the functional capability of the CM52 module. The module performs a set of telecom
services according to TIA/EIA/IS-2000. AT commands are used for communication with CM52.
3.1 Voice Calls
Basic voice calls are supported over CDMA and AMPS according to the following specifications:
Telephony according to TIA/EIA/IS-2000.
Emergency according to TIA/EIA/IS-2000.
An incoming call is indicated by an unsolicited response code (RING indicator). The module must be
registered with the network before the network will send an incoming call to the module. Due to power saving
algorithms, the CM52 will time out of the wait-for-answer state after approximately 22 RING attempts. After
the timeout occurs, the module will tear down the call. In addition, the carrier implementation usually limits the
time duration for ringing. Thus the actual number of RING indications could be limited by the network. When
this limit is reached, the network will initiate tearing down the call.
An outgoing call can be made before the module has registered with the network. An outgoing call is
considered an implicit registration: the network has been made aware of the module through the call request.
The audio input and output signals in the interface (AFMS and ATMS) will carry analog speech in full duplex
(transmitting and receiving simultaneously).
3.2 Subscriber Call features
The CM52 module supports the following Subscriber Call features:
Caller ID. Enables/disables the caller’s ID from being sent to the called party.

Confidential
USERS MANUAL 18(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
Call Forwarding. Permits the called module to have the network send incoming calls to a desired phone
number.
Call Waiting. Permits the module to be notified of an incoming call during an active call. For example, if
the module is engaged in an active call, the module can accept, reject or ignore the incoming call.
3-Party Conference Calls. Permits the module to maintain simultaneous communication with more than
one party.
Voice Mail. Permits the module to activate/deactivate voice mail. In addition, the module can retrieve
voice mail held for the user.
Note: Some subscriber call features, such as Call Forwarding and Call Waiting, may vary depending on your
service provider’s network. Subscriber call features are activated and deactivated via the ATD command
using specific codes. These codes might vary depending on the service provider. Consult your service
provider for additional information.
3.3 Over The Air Service Provisioning (OTA)
The CM52 supports TIA/EIA/IS-683-A: Over-the-Air Service Provisioning of Mobile Stations in Spread
Spectrum Systems.
Over the air programming is a mechanism that enables service providers to program mobile equipment (ME)
to match their network requirements. For the CM52, OTA is typically used to update NAM values, download a
PRL, update the A-key, etc.
OTA will not write the updates until all desired data has been downloaded into the module. This prevents
incomplete or inconsistent data from being written when the connection is prematurely terminated and OTA did
not complete all the programming.
OTA has two variants: OTA Service Provisioning (OTASP) and OTA Parameter Administration (OTAPA).
OTASP is used to initially program the ME. OTASP is initiated from the ME. OTAPA is used to apply updates
to an ME that is already provisioned. OTAPA is initiated from the service provider. OTAPA is transparent to the
user/application of the ME. If an OTAPA session is in progress and an outgoing call is placed, OTAPA will
continue to program the phone in the background.
The progress of the OTA programming is reported by using the *EUNSOL unsolicited responses. See the
AT*EUNSOL command for more information.
Note: the CM52 provides more status information than some Carriers feel should be provided to
handset users. It is left to the host application to determine what status data to provide to the user,
keeping the Carrier’s requirements in mind.
Initiating OTASP is done via a call to *228xx; where xx indicates the frequency range:
xx Frequency
00 800 MHz, A-Band
01 800 MHz, B-Band
02 1.8 GHz, A Block
03 1.8 GHz, B Block
04 1.8 GHz, C Block
05 1.8 GHz, D Block
06 1.8 GHz, E Block
07 1.8 GHz, F Block

Confidential
USERS MANUAL 19(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
Therefore, ATD*22800 will initiate an OTASP call to the 800 MHz A-band.
If the module is locked onto the correct frequency as it relates to the service provider, the frequency does not
need to be specified in the dial command. Therefore, ATD*228 will connect to the service provider as defined
by the current PRL for the module. It may not necessarily be the current serving system.
Depending on the service provider, there could be additional frequency numbers. Refer to your service
provider for more information. Some of the frequency numbers act on the data found in the PRL, or more
accurately the scan list. Keep in mind the command AT*EPMOD affects the behavior of the PRL/scan list, and
depending on its setting, may affect the outcome of the OTASP session.
The network can initiate an OTAPA session. Currently, you cannot trigger the network to perform an OTAPA
session. As a result, OTAPA cannot be tested on a live network (SEMC uses RACAL test boxes to test
OTAPA functionality).
Several notes of interest:
•Not all carriers support OTA. Contact your service provider to determine if OTA is supported.
•Each Carrier handles how OTA is done. For example, Verizon uses an automated system; therefore
the user must listen to the menu and follow the instructions. To simulate key presses, use the ATD
command to over dial DTMF tones.
•OTA is performed with a digital signal. If the module is set to Analog mode, the module will switch to a
digital signal for OTA then return back to an Analog signal. If, however, a digital signal is not available
when OTA is initiated, the call to the network will be completed, but OTA cannot be performed.
•If the OTA call is disconnected before the data is committed to NV or the NAM, the programming
session is aborted. Once the data has started to be written to the NAM or permanent storage, the data
will be committed even if the call is terminated.
•If the OTA programming should fail the SPC verification 15 consecutive times, the module will provide
an unsolicited message indicating excessive SPC verification failures (see section 4.2.11.13) and then
shutdown. This is in accordance to Verizon’s OTA specification. The host application must prevent the
module from restarting for 1 minute when this condition occurs.
3.4 Service
The module will attempt to camp on the most preferred service available, where most preferred service is
defined by the PRL. AT*EPMOD and the NAM can potentially alter what service the CM52 will camp on
despite the PRL.
3.4.1 NAM
The CM52 supports two fully capable and independent NAMs with associated PRLs. The module provides
external application access to the NAM parameters with the exception of being able to read the A-key. As
reference above, OTA programming can populate the current NAM.
The primary purpose for using two NAMs is so the module can have two independent cellular accounts.
Because the NAMs are independent, authentication and other account specific data is stored independently of
the other NAM. Therefore, the two NAMs should not be used interchangeably with a single cellular account
3.4.2 Scanning
If the CM52 is not on the most preferred service in the PRL, the CM52 will periodically rescan looking for better
service.
Note: the SID/NID list in the latest Qualcomm code no longer designates the most preferred service. A
rescan for the most preferred service also will occur any time a traffic channel has been released if the
last used SID was not the most preferred.
The CM52 supports a ten entry deep Most Recently Used channel table (MRU) that assists with the scanning.

Confidential
USERS MANUAL 20(158)
Document number Revision
1/198 17-4/FCP 101 3045 Uen D
3.4.3 Roaming
The CM52 will report whether the unit is home or roaming. The roaming indicator is read from the PRL. The
AMPS Home SID and CDMA SID/NID list entries are considered home and take precedence over the PRL
value.
Carriers may alter what the roam indicator in the PRL is defined to be: home or roam. The CM52, however, will
always report the roaming indicator as follows:
0 – Indicates the module is home
1 – Indicates the module is roaming
2 – Indicates the module is flashing
x – For ERI purposes, this value is retrieved directly from the PRL
3.4.4 Registration
When the module has found service, it will register in accordance to the registration information sent from the
network, such as how often to register or whether a power down registration should occur. The CM52
provides several AT commands to customize the registration.
Note: the resulting behavior needs to be approved by the host carrier.
If a rescan results in the same service on which the module was previously camped, then it will not re-register.
This is true even when forcing the module to different modes. For example, if the module is set to Digital
preferred mode, is currently camped on AMPS service (because no digital signal could be found), an
application forces the module to AMPS only mode and the previous AMPS service is found, the module will
NOT re-register.
When the module acquires service for the first time after a power cycle, the module will wait for 20 seconds
before registering according to the IS-2000 standard. During the time duration between acquiring service and
registering, outgoing calls can be made. However, because the module has not informed the network of its
“presence”, it will not be paged for incoming calls. After the module registers, incoming pages will be sent by
the network.
3.5 E911 or Emergency Calls
The CM52 has three hard coded E911 values; 911, *911, and #911. In addition, the CM52 has three
programmable emergency numbers. Programmable numbers could be E911 equivalents in other countries, or
could be a vendor’s “private” E911 numbers. The CM52 handles all E911 numbers in the same manner.
The three programmable emergency numbers are stored in NAM; therefore NAM programming is necessary to
set and read the values. Refer to the AT*ERNAM command for more details. NAM 1 and NAM 2 use the
same set of emergency numbers.
3.5.1 Phase I
After the completion of an emergency call the module will not rescan. Should the call center need to call the
CM52 back, the module will still have service on what could be a channel that is not normally allowed. A
rescan will occur after one of the following occurs:
•Five minutes has expired since the last emergency call was placed.
•The user makes a non-emergency call. The CM52 will rescan before attempting to establish the
outgoing call.
3.5.1.1 E911 Scanning
If the CM52 does not have service and an emergency call is placed, the module will perform an exhaustive
scan looking for any CDMA or AMPS service. This scan is completely independent of the PRL. The rescan
looks for service on every channel. The algorithm is defined by Qualcomm and scans more frequently on
commonly used channels.