Most of the AT commands are defined in 3GPP TS 27.007, but more and more UE makers are adding their own AT commands as well. In this page, I will keep adding the commonly used AT commands defined in 3GPP spec.

Followings are the topics :

• Where AT commands are actually defined
• The four forms of an extended command
• Result codes, and why you may only ever see ERROR
• Commands worth knowing first
• USIM Read/Write
• Reference :

Where AT commands are actually defined

Three documents stand behind almost every command on this page, and they do different jobs. Knowing which one owns what saves a lot of searching, because a command you cannot find in 27.007 is usually not a 3GPP command at all.

27.007 clause 4.1 draws the first line of that table sharply. Standardized basic commands are found only in V.250, and the commands in 27.007 use the syntax rules of extended commands. That is why every 3GPP command starts with a plus sign and the V.250 ones do not.

The last row is the one that costs time. A vendor command looks exactly like a 3GPP one, plus sign included, and no specification will tell you what it does. The vendor's own AT manual is the only source, and two chipsets rarely agree.

The example further down this page needs two of these documents at once. 27.007 says that +CRSM exists and that 176 means READ BINARY. 51.011 says that the file is 6F7B and what its bytes mean. Neither document answers the question on its own.

• V.250 owns the command line : echo, verbose format and the basic commands with no plus sign.
• 27.007 owns the extended commands : everything with a plus sign that 3GPP standardised.
• 51.011 owns the card, not the commands : it is the map of what +CRSM reaches.
• A vendor command has no specification : only the vendor's manual, and it will differ by chipset.

The four forms of an extended command

Every extended command can appear in more than one form, and the punctuation at the end is what chooses between them. A command may come back with ERROR when the spelling looked right. Very often the form is wrong rather than the command.

The read form is the one that is missing more often than people expect. 27.007 clause 4.1 says that action type commands do not store the values of their parameters, and a command that stores nothing has nothing to read back. So AT+CRSM=? is answered and AT+CRSM? is not, and that is the specification behaving correctly rather than the modem refusing.

Start with the test form when a command is new to you. It answers two questions in one line: whether this modem implements the command at all, and what the parameters may be set to. A modem that does not implement a command answers its test form with ERROR, which is a much faster check than reading a vendor manual.

The V.250 commands work differently and do not follow any of this. ATE0 and ATV1 carry no plus sign, take their parameter as a trailing digit, and have no test form. Several can also be written on one line, which is why ATE0V1 is legal.

• Four forms, chosen by punctuation : =? tests, ? reads, = sets, and a bare command executes.
• Action commands have no read form : they store nothing, so there is nothing to read.
• The test form is the fastest capability check : ERROR from AT+CMD=? means the command is not implemented.
• V.250 commands are not built this way : no plus sign, no test form, and several fit on one line.

Result codes, and why you may only ever see ERROR

Some modems answer every failed command with a bare ERROR. That answer tells you nothing about what went wrong. That is the default behaviour, not a fault, and one command changes it. This is the single most useful thing to know before starting a terminal session.

27.007 clause 4.1 sets out the plain case. When the command is not accepted, or cannot be performed for some reason, the TA sends ERROR and stops: no later command on the same command line is processed. The clause then adds the exception that matters. ERROR may be replaced by +CME ERROR: <err> when the failure was to do with MT operation.

The +CMEE command decides whether that replacement happens, and 27.007 clause 9.1 defines it.

27.007 makes values 0 and 1 mandatory and leaves 2 optional, so a modem may refuse AT+CMEE=2 and accept AT+CMEE=1. Try the verbose form first and fall back to the numeric one. Either is better than what you started with.

Note what +CMEE does not cover. 27.007 says ERROR is returned normally when the error is about syntax, invalid parameters, or TA functionality. So a bare ERROR that survives AT+CMEE=2 is telling you something after all: the problem is in what you typed rather than in what the modem tried to do.

Two other kinds of response appear without being asked for. Intermediate result codes report progress, such as CONNECT during call establishment. Unsolicited result codes report an event that no command triggered, such as RING. Neither is a reply to the line you just sent, A script may read one line and assume it is the answer, and eventually it will read one of these instead.

• Bare ERROR is the default : and it carries no diagnosis.
• AT+CMEE=2 first, every session : numeric with =1 if the modem refuses verbose.
• ERROR after +CMEE is still information : it points at syntax or parameters rather than at the MT.
• Not every line is an answer : CONNECT and RING arrive on their own schedule.

Commands worth knowing first

The commands below are the ones a test session reaches for before anything else. Each row names the clause in 27.007 that defines it, so the full parameter list and the exact response format are one lookup away rather than a guess.

Three of those rows answer different halves of the same question when a data connection fails. +CEREG says whether the UE is registered at all. +CGDCONT says which APN the context was defined with, which the APN page covers at length. +CGPADDR says whether an address ever arrived. Checking them in that order separates a radio problem from a subscription problem without any tracing.

• Identity first : +CGMI, +CGMM and +CGSN confirm which device is on the port.
• +CEREG is the LTE registration check : +CREG and +CGREG answer for the older domains.
• The APN lives in +CGDCONT : and the address it produced lives in +CGPADDR.
• Every row has a clause number : so the response format is never a guess.

USIM Read/Write

The SIM keeps its data in files, and +CRSM is how a terminal reads and writes them. It is a thin wrapper rather than a translator. The modem selects the file for you, and everything else on the line is passed to the card untouched.

Based on 27.007 8.18 Restricted SIM access +CRSM,

AT+CRSM=<command>[,<fileid>[,<P1>,<P2>,<P3>[,<data>[,<pathid>]]]]

<command> (command passed on by the MT to the SIM);

176        READ BINARY

178        READ RECORD

192        GET RESPONSE

214        UPDATE BINARY

220        UPDATE RECORD

242        STATUS

203        RETRIEVE DATA

219        SET DATA

For the Details refer to 27.007 and 51.011

The list above says what goes in. 27.007 also fixes what comes back, and the response has three parts rather than one.

That last sentence is a free success check. If you ran a read and data came back at all, the read worked, and you never have to decode the status words to find that out.

The two ways a +CRSM line can fail are reported in two different places, and the split between them is easy to miss. 27.007 says +CME ERROR may be returned when the command cannot be passed to the SIM, while a failure in the execution of the command inside the SIM is reported in <sw1> and <sw2>. So a line that comes back with status words has already reached the card. Only an +CME ERROR means it never got there.

The table of what each status word means lives in 51.011 rather than in 27.007. This page does not reproduce it: the only published version of 51.011 is v5.0.0, and it is an old binary document that could not be read while this section was written.

Ex) Resetting FPLMN List, according to 51.011 10.3.16 EF_FPLMN (Forbidden PLMNs), file ID is 6F7B

One detail in that example is the usual first mistake. 51.011 writes the file identifier as 6F7B, and +CRSM takes it as a decimal integer, so it goes on the line as 28539. The two are the same number written in different bases.

Reading EF_FPLMN with +CRSM. Field values are from a live terminal session, not from the specification.

# read FPLMN
Command : AT+CRSM=176,28539
Output  : +CRSM: 144,0,"130014130062030294030205030223FFFFFF"

51.011 10.3.16 EFFPLMN (Forbidden PLMNs) describes FPLMN Field format as below.

Figure 1. 51.011 clause 10.3.16, EF_FPLMN. Twelve bytes, divided into four slots of three.

• Identifier 6F7B, structure transparent, mandatory : transparent means one flat run of bytes rather than numbered records, which is why the read uses READ BINARY and not READ RECORD.
• Four slots, three bytes each : bytes 1 to 3 hold PLMN 1 and bytes 10 to 12 hold PLMN 4. Every slot is marked M for mandatory.
• Reading and updating both need CHV1 : that is the PIN. INVALIDATE and REHABILITATE are ADM, so they are out of reach from a terminal.
• Each slot is an MCC followed by an MNC : coded as in 24.008, and the digits are not in the order you would write them.
• The picture supplies its own worked example : MCC 246 with MNC 81 is stored as the bytes 42, F6 and 18, which is the key to reading the output above.
• An unused slot is filled with FF : the note at the foot says so, and that is what an empty entry looks like in a read.

Now the output of the read can be taken apart. Each slot is three bytes, and within them the digits are swapped in pairs. Byte 1 carries MCC digit 2 over MCC digit 1, byte 2 carries MNC digit 3 over MCC digit 3, and byte 3 carries MNC digit 2 over MNC digit 1. Checking that against the picture's own example is the quickest way to trust it: 42, F6, 18 gives MCC 246 and MNC 81.

A value of F in the MNC digit 3 position means the MNC has two digits rather than three. Applied to 130014130062030294030205030223FFFFFF, the eighteen bytes come apart like this.

One thing there does not match the picture. The table in 51.011 gives the file a size of twelve bytes and four slots, and this card returned eighteen bytes and six. The file is larger on this SIM than the minimum the table shows, which is allowed and is worth expecting. Count the bytes that come back rather than assuming four entries.

The write line works the same way in reverse. 214 is UPDATE BINARY. The two zeros are P1 and P2, which give the offset into the file, so this writes at the very start. The 3 is P3, the length, which is one slot. Decoding 00F130 by the same rules gives MCC 001, an MNC digit 3 of F for a two digit MNC, and MNC 03.

So that line puts one entry into the first slot rather than emptying the list. The picture's own note says an unused slot is filled with FF, so a line that cleared the first slot would carry FFFFFF as its data instead.

• The digits are swapped in pairs : and the picture's 42 F6 18 example is there to check any decode against.
• F in the MNC digit 3 position means a two digit MNC : which is how 00F130 reads as 001-03.
• This card held six slots, not four : the 51.011 table is a minimum, so count what comes back.
• P1 and P2 are the offset, P3 is the length : which is what makes UPDATE BINARY a partial write.
• Writing FFFFFF is what clears a slot : writing a PLMN adds one.

Writing one PLMN slot of EF_FPLMN with +CRSM. Field values are from a live terminal session, not from the specification.

# write FPLMN
AT+CRSM=214,28539,0,0,3,"00F130"

Reference :

The clause numbers quoted on this page are from 27.007 v19.6.0 (Release 19). 51.011 was frozen at v5.0.0 and has not moved since.

[1] 3GPP 27.007 - AT Command set for User Equipment

[2] 3GPP 51.011 - Mobile Equipment (SIM-ME) interface

[3] 3GPP 27.005 - Use of Data Terminal Equipment - Data Circuit terminating Equipment (DTE-DCE) interface for Short Message Service (SMS) and Cell Broadcast Service (CBS). The SMS commands, which 27.007 does not carry.

[4] ITU-T V.250 - Serial asynchronous automatic dialling and control. The basic command set and the command line format that every extended command sits inside.

[5] AT Command from PowerShell - driving these commands from a script on Windows rather than from a terminal by hand.