AT COMMAND SET FOR MODEL 9601-DG TECHNICAL NOTE

Similar documents
AT COMMAND SET FOR MODEL 9601-D TECHNICAL NOTE

AT COMMANDS FOR MODELS 9602-I/9602-N

9602N Developers Guide-Revision by Beam

AT COMMANDS FOR MODEL 9602-LP

EXTENDED AT COMMAND GUIDE

CMM 900-3W USER GUIDE

RTU-COM PSTN AT. User Guide

Manual Reference. Modem Commands. S35i, C35i, M35i

Cellular modem and Transceiver

ISU AT Command Reference

HOW TO USE MODEL A3LA-IGS TECHNICAL NOTE. December 6, 2004 PRELIMINARY. Copyright by NAL Research Corporation

HOW TO USE MODEL A3LA-D TECHNICAL NOTE

Telenetics dial modems are based upon Rockwell chipsets. These chipsets contain Rockwell's "AT" command set.

ZM56 High-Speed Industrial Modem. Command Summary. 1 ZM56 High-Speed Industrial Modem

Frontline Test System

USING SatTerm SOFTWARE WITH SMS APPLICATION NOTE

NL6000 Wireless Modem NL6000 User Manual Rev 1.1

GETTING STARTED WITH MODEL A3LA-X

9602 SBD Voyager Satellite Transeiver Controller. 9602VG-D15 Manual Hardware Version 1.4

SatTerm SOFTWARE MANUAL TECHNICAL NOTE

ETC II Modbus Communications Protocol Reference Guide

GETTING STARTED WITH MODEL A3LA-XM

ZM24x Quick-Connect Industrial Modem. User s Manual

Low Speed Modems for Dial and Leased Circuits 2400E (Standalone) 2400R (Rackmount)

HOW TO USE MODEL A3LA-I TECHNICAL NOTE

WiMOD LR Base Host Controller Interface

Wireless Modem Exchange (WMX) Protocol Description

User Guide Laird Configuration and Test Utility Software. Version 1.0

RM024 DVK USER GUIDE VERSION 1.2

DAQ Electronics, Inc 262B Old New Brunswick Road, Piscataway, NJ

DatraxRF Spread Spectrum Wireless Modem

Chapter 11: Input/Output Organisation. Lesson 05: Asynchronous RS232C Serial Port data transfer

Ultrabeam RCU-06 USB port description

Unified CCX Outbound Dialer Configuration

ARC Modem Low Power Modem LP9624

kcserial User Guide version 2006.FEB.20

APPLICATION NOTE. N2 Dial Application. Using N2 Dial...3. Introduction...3. Key Concepts...4

Nabto Serial Link Protocol

MRD-310 MRD G Cellular Modem / Router Web configuration reference guide. Web configuration reference guide

IML 560 USER GUIDE. Low Power 56Kbps Industrial modem. Version 1.2. December 6, AYANTRA Inc.

TRAINING GUIDE LEVEL 3 MODBUS WRITE IMPORT COMMAND

User Manual V1.1 Date: WiFi RS-232 Adapter. Red LED: IP Address Blue LED: TX/RX 5V Out (Pin 9)

COMTool User Guide Version /02/2013

INTELLIS. Modbus Direct Network Monitor

User Module. AT Modem Emulator APPLICATION NOTE

DNP3 Master Serial Driver PTC Inc. All Rights Reserved.

Dual Serial Shield User Manual

Sender Receiver Sender

WiMOD LoRaWAN EndNode Modem HCI Specification

Frontline Test System

1. Implemented CM11 protocol

Stevens SatComm. Product GUI Quick Start Guide

AT Commands - Trust 56K PCI Modem - Executing commands

NetComm NTC-6000 Series Cellular Router. AT (V.250) Command Manual

Low-Power-Radio Transceiver IC

SERVER FOR SATELLITE TRACKERS TECHNICAL NOTE

Specification. Current Consumption Range 8m * Rotational Angle +/- 50 degrees * Shear Angle +/- 40 degrees *

Unified CCX Outbound Dialer Configuration

Communicator ISDN 128 External

WiMOD LR Base Plus Host Controller Interface

4.3 Ingenico Telium OS modem specific commands

Network Working Group Request for Comments: 2866 Category: Informational June 2000 Obsoletes: 2139

MODBUS Protocol for MiCOM P30 Series

AB300-Series Automated Filter Wheels

Network Working Group Request for Comments: 2059 Category: Informational January 1997

Single Antenna Multi Channel Modem

GENERAL DESCRIPTION OF MODEL HRC-24-8X

Chaper 1: E10+ PLCs Host-Link Command Format

FeliCa Card User's Manual Excerpted Edition

ISU AT Command Reference NEXT ASSY USED ON REV DESCRIPTION DATE APPROVED IRIDIUM HANDSET. XA Engineering control release of ver /25/01 T.

ViewPoint for GMPT-401 Personal Tracker

WIRELESS RECEIVER WRM-TS. Rev. 1.0c

OMNI 56K PCI Plus Rev.2. Commands Reference Manual

Modem AT Command Set

FM300 Network Server

Configuring System Message Logging

WIR-1386 / WIR-1186M Long Range 865MHz 867MHz RF Wireless Module with WIR-METERING Mesh Stack

GDI Communications, LLC. Graphical User Interface. User Manual. Version 1.0.1

AMCP/5-WP/72 APPENDIX D (ENGLISH ONLY)

Flytec Bluetooth Option

Configuring Cisco Integrated Data Service Unit/Channel Service Unit (DSU/CSU) Modules and WAN Interface Cards

DNP3 Device Profile. Device Profile Template. Data Dictionary. Release 2.0. January 30, 2001

Developer s Guide. PC54O1 Serial Interface Module Version 1.0

PRELIMINARY embit s.r.l.

SDI-12 A Serial-Digital Interface Standard for Microprocessor-Based Sensors. Version 1.3. April 7, Prepared By

RST200. Configuration & Beam Management System Manual

XStream AT Commands. Advanced Manual v South 520 West, Suite 180 Lindon, UT Phone: (801) Fax: (801)

Modbus Unsolicited Serial Driver PTC Inc. All Rights Reserved.

User s Manual CDMA Cellular Model CDM819s Serial Modem CDMA Cellular Model CDM819u USB Modem

Instructions. Modbus RTU Card (WSIQ-COM-MB)

CLVM Driver CLV Command Language Module. Table of Contents

ECAN-240. (Modbus TCP to 2-port CAN Bus Gateway User manual) ECAN-240 Modbus TCP to 2-port CAN Bus Gateway User Manual, Version 1.0.

DNP3 Communication User's manual

8051SERIAL PORT PROGRAMMING

WiMOD LR Base Host Controller Interface

GIoT AT Command for LoRa Module

Mettler Toledo Driver PTC Inc. All Rights Reserved.

User Guide. Date Apr BlueEva+C11/G2. Stollmann. E + V GmbH. User Guide

AsReader Desktop Demo Reference Guide v1.2

Hints and tips when using RC1xx0 RF Modules

Transcription:

TN2007-626-V2.0.0 AT COMMAND SET FOR MODEL 9601-DG TECHNICAL NOTE February 19, 2007 Copyright 2007 by NAL Research Corporation The specifications in this document are subject to change at NAL Research s discretion. NAL Research assumes no responsibility for any claims or damages arising out of the use of this document or from the use of the 9601-DG based on this document, including but not limited to claims or damages based on infringement of patents, copyrights or other intellectual property rights. NAL Research makes no warranties, either expressed or implied with respect to the information and specifications contained in this document. Performance characteristics listed in this document are estimates only and do not constitute a warranty or guarantee of product performance.

TABLE OF CONTENTS TABLE OF CONTENTS... 2 GLOSSARY... 4 1.0 INTRODUCTION... 5 2.0 AT COMMANDS... 5 2.1 AT Attention Code... 5 2.2 A/ Repeat Last Command... 5 2.3 En Echo... 5 2.4 In Identification... 5 2.5 Qn Quiet Mode... 6 2.6 Vn Verbose Mode... 6 2.7 Zn Soft Reset... 6 2.8 &Dn DTR Option (modified)... 6 2.9 &Fn Restore Factory Settings... 6 2.10 &Kn Flow Control (modified)... 6 2.11 &V View Active and Store Configuration... 6 2.12 &Wn Store Active Configuration... 6 2.13 &Yn Designate Default Reset Profile... 7 2.14 %R Display Registers... 7 2.15 *F Flush to EEPROM (new)... 7 2.16 *Rn Radio Activity (new)... 7 2.17 +CGMI Manufacturer Identification... 7 2.18 +CGMM Model Identification... 7 2.19 +CGMR Revision... 7 2.20 +CGSN Serial Number... 8 2.21 +CIER Indicator Event Reporting (new)... 8 2.22 +CSQ Signal Quality... 9 2.23 +CSQ[F] Signal Quality (revised)... 10 2.24 +CULK Unlock (new)... 10 2.25 +GMI Manufacturer Identification... 11 2.26 +GMM Model Identification... 11 2.27 +GMR Revision... 11 2.28 +GSN Serial Number... 11 2.29 +IPR Fixed DTE Rate (DO NOT USE)... 11 2.30 +SBDWB Short Burst Data: Write Binary Data to the Module... 12 2.31 +SBDRB Short Burst Data: Read Binary Data from the Module... 13 2.32 +SBDWT Short Burst Data: Write a Text Message to the Module... 13 2.33 +SBDRT Short Burst Data: Read a Text Message from the Module... 14 2.34 +SBDI Short Burst Data: Initiate an SBD Session... 14 2.35 +SBDDET Short Burst Data: Detach (new)... 16 2.36 +SBDDSC Short Burst Data: Delivery Short Code... 17 2.37 +SBDIX Short Burst Data: Initiate an SBD Session Extended (new)... 17 2.38 +SBDMTA Short Burst Data: Mobile-Terminated Alert (new)... 19 NAL Research Corporation (TN2007-626-V2.0.0) 2

2.39 +SBDREG Short Burst Data: Network Registration (new)... 19 2.40 +SBDAREG Short Burst Data: Automatic Registration (new)... 21 2.41 +SBDD Short Burst Data: Clear SBD Message Buffer(s)... 22 2.42 +SBDC Short Burst Data: Clear SBD MOMSN... 23 2.43 +SBDS Short Burst Data: Status... 23 2.44 +SBDSX Short Burst Data: Status Extended... 24 2.45 +SBDTC Short Burst Data: Transfer MO Buffer to MT Buffer... 25 2.46 +MSSTM Request System Time... 25 3.0 S-REGISTER DEFINITIONS... 26 3.1 S-Register Commands... 26 3.1.1 Sr Direct S-Register Reference... 26 3.1.2 Sr? Direct S-Register Read... 26 3.1.3 Sr=n Direct S-Register Write... 26 3.1.4? Referenced S-Register Read... 26 3.1.5 =n Referenced S-Register Write... 26 3.2 S-Registers... 27 4.0 SUMMARY OF RESULT CODES... 31 5.0 INFORMATION EXAMPLES... 32 5.1 Setting the Default Configuration... 32 5.2 Power-on to Sending a Message... 32 5.3 Automatic Notification Registration... 33 5.4 Automatic Notification Message Reception... 33 5.5 Automatic Notification Automatic Registration... 34 5.6 Sending a Message with Minimal Radio Activity... 34 5.7 Power Down... 34 5.8 Sending an SBD Message to the 9601-DG... 35 5.9 Field Elements of an SBD Message (Commercial Gateway Only)... 36 5.10 Calculate Checksum for SBDWB... 37 6.0 TABLE OF AT COMMAND CHANGES... 38 7.0 AT GPS COMMANDS... 42 7.1 +PA... 42 7.2 +PM... 43 7.3 +PT... 43 7.4 +PD... 44 7.5 +PL... 44 7.6 +PLOC... 44 7.7 +PV... 45 7.8 +PVEL... 45 7.9 +PNAV... 46 7.10 +PNAV?... 46 7.10 +PP... 46 APPENDIX A: NMEA MESSAGE FORMAT... 50 NAL Research Corporation (TN2007-626-V2.0.0) 3

GLOSSARY CTS (V.24 signal) DCD (V.24 signal) DCE DSR (V.24 signal) DTE DTR (V.24 signal) ESS ETC FA GSS IMEI MO MOMSN MT MTMSN RI (V.24 signal) RTS (V.24 signal) SBD UART Clear To Send. This signal is used to control the flow of data to the 9601-DG Data Carrier Detect Data Communications Equipment. In this product, DCE refers to the 9601-DG Data Set Ready. This signal, from the 9601-DG, indicates readiness to accept communication over the data port Data Terminal Equipment. In this product, DTE refers to the FA Data Terminal Ready. This signal, from the FA, requests the 9601-DG to accept communication over the data port ETC SBD Subsystem (synonymous with GSS) Earth Terminal Controller, part of the Iridium Gateway Field Application, the host of the 9601-DG Gateway SBD Subsystem (synonymous with ESS) International Mobile Equipment Identity Mobile Originated Mobile Originated Message Sequence Number Mobile Terminated Mobile Terminated Message Sequence Number Ring Indicate. This signal, from the 9601-DG, indicates that an MT message is present at the ESS Request To Send. This signal is used to control the flow of data from the 9601-DG Short Burst Data Universal Asynchronous Receiver Transmitter NAL Research Corporation (TN2007-626-V2.0.0) 4

1.0 INTRODUCTION This document is intended as a reference guide to the usage of AT command set for the Iridium 9601- DG modem. There are two parts to this document. The first part includes AT commands for the Iridium 9601 RF board and the second part (Section 7.0) has AT GPS commands. Note that AT commands may be modified, removed or added and users should always check for the latest revision by logging on NAL Research s anonymous ftp site (under RESOURCE CENTER of website www.nalresearch.com). In order for the GPS features on the 9601-DG modem to work properly, please do not change the following modem default values: 1. Serial port setting at 19.2 kbits/sec (can be re-configured by NAL Research for other baud rates). Do not use the +IPR command to change the baud rate. If the +IPR as been used then follow the instructions listed under +IPR Fixed DTE rate (Section 2.2.8) to return the 9601-DG to standard opration. 2. When the Iridium 9601 RF board is turned OFF by an AT command, communications with the 9601- DG must be done with no flow control 2.0 AT COMMANDS The following AT command can be used to put the Iridium RF board into an ON or an OFF state. A different AT command can be used to toggle the GPS receiver and active antenna ON and OFF as well (see Section 7.0). AT*S=n Change the state of the Iridium transceiver board to OFF (n=0) or to ON (n=1) A carriage return or <Enter> key is needed after this command. Once the Iridium RF board is OFF, the 9601-DG can only communicate with a data terminal equipment (DTE) with flow control OFF. When the Iridium RF board is OFF, only AT*S=n command and AT GPS commands work on the 9601-DG. 2.1 AT ATtention Code This is the prefix for all commands except A/. When entered by itself, the 9601-DG will respond with OK. 2.2 A/ Repeat Last Command Repeat the last command issued to the 9601-DG unless power was interrupted or the 9601-DG is reset. A/ is not followed by <CR>. 2.3 En Echo Echo command characters. 0 Characters are not echoed to the DTE. 1 Characters are echoed to the DTE (default). 2.4 In Identification Requests the 9601-DG to display information about itself. 0 2400 (for compatibility only) 1 0000 (for compatibility only) 2 OK (for compatibility only) 3 XXXXXXXX (software revision level) NAL Research Corporation (TN2007-626-V2.0.0) 5

4 IRIDIUM 9601 (product description) 5 8816 (for compatibility only) 6 XXX (factory identity) 7 XXXXXXXX (hardware specification) 2.5 Qn Quiet Mode Control 9601-DG responses. 0 9601-DG responses are sent to the DTE (default). 1 9601-DG responses are NOT sent to the DTE. 2.6 Vn Verbose Mode Set the response format of the 9601-DG, which may be either numeric or textual. 0 Numeric responses. 1 Textual responses (default). 2.7 Zn Soft Reset Reset 9601-DG s data port to a user-stored configuration that has been previously stored using &Wn. 0 Restores user configuration 0. 1 Restores user configuration 1. 2.8 &Dn DTR Option (modified) Set the 9601-DG reaction to the DTR signal. 0 DTR is ignored. A DTR signal input is not needed when set to &D0. 1-3 DTR must be ON. If DTR transitions from ON to OFF, the data port will be locked after approximately 10 seconds to enter the UART test mode. The data port will resume when DTR is restored to ON. There is no distinction between settings 1-3 (the default is 2). 2.9 &Fn Restore Factory Settings Recall factory default configuration without resetting the data port. 0 Recall factory default 0. 2.10 &Kn Flow Control (modified) Select the flow control method between the 9601-DG and DTE. Flow control is only applied to the transfer of SBD message data; it does not apply to AT commands and their responses. 0 Disables flow control. 3 Enables RTS/CTS flow control (default). 2.11 &V View Active and Stored Configuration View the current active configuration and stored profiles. 2.12 &Wn Store Active Configuration Store the active profile in non-volatile memory. This is used to store user configurations for later use. 0 Store current (active) configuration as profile 0. 1 Store current (active) configuration as profile 1. NAL Research Corporation (TN2007-626-V2.0.0) 6

2.13 &Yn Designate Default Reset Profile Select profile for use after power-up. 0 Select profile 0 (default). 1 Select profile 1. 2.14 %R Display Registers Display all the S-registers in the system. 2.15 *F Flush to EEPROM (new) Flush all pending writes to EEPROM, shut down the radio, and prepare the 9601-DG to be powered down. The command returns OK upon completion, at which point it is safe to remove the power without losing non-volatile data. NOTE: This command stops the 9601-DG from responding to any more commands, but does not actually power it down. The only way to power down the 9601-DG is for the DC power to be removed or to de-assert the ON/OFF control line. NOTE: After an SBD session, the new SBD MOMSN is always flushed to EEPROM before the +SBDI result is issued. 2.16 *Rn Radio Activity (new) Control radio activity. 0 Disable radio activity. 1 Enable radio activity (default). While the radio is disabled: SBD sessions can not be initiated; they will fail immediately. No SBD Automatic Notifications will be issued for automatic-mt messages. No registration, i.e. location updates will be performed. The baseband circuitry is still active and the 9601-DG still accepts AT commands. This command allows the FA (field application, the host of the 9601-DG) to reduce detectable emissions from the RF circuitry during the idle periods between SBD sessions, and also provides a degree of power saving in cases where it may be inconvenient for the FA to power down the 9601-DG. 2.17 +CGMI Manufacturer Identification Exec Command: +CGMI Query the 9601-DG manufacturer. 2.18 +CGMM Model Identification Exec Command: +CGMM Query the 9601-DG model. 2.19 +CGMR Revision Exec Command: +CGMR Query the 9601-DG revision. NAL Research Corporation (TN2007-626-V2.0.0) 7

2.20 +CGSN Serial Number Exec Command: +CGSN Query the 9601-DG IMEI. 2.21 +CIER Indicator Event Reporting (new) Set Command: +CIER=[<mode>[,<sigind>[,<svcind>[,<antind>]]]] The set command enables or disables sending of the +CIEV unsolicited result code from the 9601-DG to the DTE in case of indicator state changes. <mode> controls the processing of the +CIEV unsolicited result codes. <mode>: 0 Disable indicator event reporting; do not send +CIEV unsolicited result codes to the DTE; buffer the most recent indicator event for each indicator in the 9601-DG (default). 1 Enable indicator event reporting; buffer the most recent +CIEV unsolicited result code for each indicator when the data port is reserved (e.g. in SBD data mode) and flush them to the DTE after reservation; otherwise forward them directly to the DTE. <sigind>: Control reporting of "signal quality" indicator changes: 0 No "signal quality" indicator reporting. 1 Enable "signal quality" indicator reporting using result code +CIEV:0,<rssi> where <rssi> is: 0 Equivalent to 0 bar on the signal strength indicator 1 Equivalent to 1 bar on the signal strength indicator 2 Equivalent to 2 bars on the signal strength indicator 3 Equivalent to 3 bars on the signal strength indicator 4 Equivalent to 4 bars on the signal strength indicator 5 Equivalent to 5 bars on the signal strength indicator The reported signal strength is the same value that would be returned by the +CSQ command. When enabled, the signal quality indicator is reported only when the signal strength changes. <svcind>: Control reporting of "service availability" indicator changes: 0 No "service availability" indicator reporting. 1 Enable "service availability" indicator reporting using result code +CIEV:1,<value> where <value> is: 0 Network service is currently unavailable. 1 Network service is available. Network service availability is equivalent to a signal strength greater than 0. The service availability indicator provides a way for the FA to wait until the 9601-DG can start an SBD session without receiving NAL Research Corporation (TN2007-626-V2.0.0) 8

continual notifications of changes in signal strength. <antind>: Control reporting of "antenna fault" indicator changes: 0 No "antenna fault" indicator reporting. 1 Enable "antenna fault" indicator reporting using result code +CIEV:2,<value> where <value> is: 0 No antenna fault detected, or antenna fault cleared. 1 Antenna fault detected, further transmission impossible. An antenna fault indicates that the antenna is not correctly attached, and in order to protect the transmitter no more transmissions are permitted. On seeing an antenna fault, the user should check the antenna connection; the fault will be automatically cleared once the 9601-DG detects network service availability again. Read Command: +CIER? Query the current indicator event reporting settings. The response is of the form: +CIER:<mode>,<sigind>,<svcind>,<antind> Test Command: +CIER=? List the supported settings. The response is in the form: +CIER:(supported <mode>s),(supported <sigind>s),(supported <svcind>s),(supported <antind>s) NOTE: In <mode> 1, the DTE may miss some indicator state changes if they occur while the data port is reserved. However, the buffering mechanism ensures that the most recent change for each indicator during reservation will be flushed to the DTE after reservation; thus the DTE is always made aware of the latest state of each indicator. NOTE: The DTE may initiate an SBD session even if service is unavailable; in this case, the 9601-DG makes an immediate search for the network and, if successful, starts the SBD session, otherwise the SBD session fails. 2.22 +CSQ Signal Quality Exec Command: +CSQ Execution command returns the received signal strength indication <rssi> from the 9601-DG. Response is in the form: +CSQ:<rssi> where <rssi> indicates: 0 Equivalent to 0 bar displayed on the signal strength indicator. 1 Equivalent to 1 bar displayed on the signal strength indicator. 2 Equivalent to 2 bars displayed on the signal strength indicator. 3 Equivalent to 3 bars displayed on the signal strength indicator. 4 Equivalent to 4 bars displayed on the signal strength indicator. NAL Research Corporation (TN2007-626-V2.0.0) 9

5 Equivalent to 5 bars displayed on the signal strength indicator. Test Command: +CSQ=? List the supported signal strength indications. The response is in the form: +CSQ:(supported <rssi>s) NOTE: A signal strength response may not be immediately available, but will usually be received within two seconds of issuing the command. If the 9601-DG is in the process of acquiring the system, a delay in response of up to 10 seconds may be experienced. 2.23 +CSQ[F] Signal Quality (Revised) Exec Command: +CSQ[F] Execution command returns the received signal strength indication <rssi> from the 9601-D. Response is in the form: +CSQ:<rssi> where <rssi> indicates: 0 Equivalent to 0 bar displayed on the signal strength indicator 1 Equivalent to 1 bar displayed on the signal strength indicator 2 Equivalent to 2 bars displayed on the signal strength indicator 3 Equivalent to 3 bars displayed on the signal strength indicator 4 Equivalent to 4 bars displayed on the signal strength indicator 5 Equivalent to 5 bars displayed on the signal strength indicator NOTE: The +CSQ form of the command waits for an updated signal strength reading to become available. This will usually be within two seconds of issuing the command. If the 9601-DG is in the process of acquiring the system, or in a satellite handoff, a delay in response of up to 10 seconds may be experienced. If the 9601-DG has not proceeded to successful registration, the delay in response may exceed the 50 second timeout limit. Under such condition, an ERROR response will be received. To avoid a delayed response due to registration problems, issue the +CREG command to verify registration prior to entering the +CSQ command to obtain signal strength. NOTE: The +CSQF form of the command returns immediately, reporting the last known signal strength. Test Command: +CSQ=? List the supported signal strength indications. The response is in the form: +CSQ:(supported <rssi>s) 2.24 +CULK Unlock (new) Exec Command: +CULK=<unlock key> Unlock the 9601-DG after it has been locked by the Gateway. The unlock key must be obtained by contacting Iridium s customer support. <unlock key>: 0000000000000000.. FFFFFFFFFFFFFFFF A string of 16 hexadecimal digits. NAL Research Corporation (TN2007-626-V2.0.0) 10

While the 9601-DG is locked, it is unable to perform any SBD sessions. Any attempts to start a session will return an error code indicating that the 9601-DG is locked. Command Response: +CULK:<status> where <status> indicates the lock status of the 9601-DG following the unlock attempt: 0 Unlocked 9601-DG is not locked and is permitted to perform SBD sessions. 1 Locked 9601-DG is locked and unable to perform SBD sessions. It must be unlocked by supplying the correct unlock key to the +CULK command. 2 Permanently locked 9601-DG is locked and unable to perform SBD sessions. It cannot be unlocked and must be returned to the supplier. Read Command: +CULK? Query the current lock status of the 9601-DG. The response is of the form: +CULK:<status> where <status> indicates: 0 Unlocked 1 Locked 2 Permanently locked 2.25 +GMI Manufacturer Identification Exec Command: +CGMI Query the 9601-DG manufacturer. 2.26 +GMM Model Identification Exec Command: +CGMM Query the 9601-DG model. 2.27 +GMR Revision Exec Command: +CGMR Query the 9601-DG revision. 2.28 +GSN Serial Number Exec Command: +CGSN Query the 9601-DG IMEI. 2.29 +IPR Fixed DTE Rate (DO NOT USE) Set Command: +IPR=<rate> This command should not be used because of how the 9601-DG processes GPS data and the Iridium RF board responses. This sets the data rate at which the 9601-DG will accept commands, but using this command will causes data coming back from the 9601-DG to be corrupted. The change in data rate takes into effect after the result code (e.g., OK) is received by the DTE. where <rate> indicates: NAL Research Corporation (TN2007-626-V2.0.0) 11

1 600 bps 2 1200 bps 3 2400 bps 4 4800 bps 5 9600 bps 6 19200 bps (default) 7 38400 bps 8 57600 bps 9 115200 bps Read Command: +IPR? Query the current data rate. The response is in the form: +IPR:<rate> Test Command: +IPR=? List the supported data rates. The response is in the form: +IPR:(supported <rate> settings) If this command was used and the configuration was not saved then the original configuration can be restored by power cycling the modem. If this command has been saved to memory then do the following: 1. Change the settings on the serial communications program to use the baud rate it has been set to. 2. Issue the Command, AT+IPR=6 3. Change the settings on the serial communications program to use 19200 bps as the baud rate. 4. Issue the Command AT+GSN. If the IMEI number of the unit is not returned then repeat step 1 at a different baud rate. Otherwise continue to the next step. 5. Issue the Command AT&Wn&Yn where n is the profile you are currently using. For example AT&W0&Y0. NAL Research can set other permanent baud rates upon request 2.30 +SBDWB Short Burst Data: Write Binary Data to the Module Exec Command: +SBDWB=<SBD message length> This command is used to transfer a binary SBD message from the DTE to the single mobile originated buffer in the 9601-DG. The mobile originated buffer can contain only one message at any one time. Once the command is entered, and the message length is acceptable, the 9601-DG will indicate to the DTE that it is prepared to receive the message by sending the ASCII encoded string READY<CR><LF> (hex 52 45 41 44 59 0D 0A) to the DTE. The <SBD message length> parameter represents the length, in bytes, of the SBD message not including the mandatory two-byte checksum. The maximum mobile originated SBD message length is specified at 205 bytes (and may be increased in the future). The minimum mobile originated SBD message length is 1 byte. If the <SBD message length> parameter is out of range, the 9601-DG issues response 3 (see below). NAL Research Corporation (TN2007-626-V2.0.0) 12

Once the DTE receives the READY indication from the 9601-DG, the SBD message must be sent from the DTE formatted as follows: {binary SBD message} + {2-byte checksum} The checksum is the least significant 2-bytes of the summation of the entire SBD message. The high order byte must be sent first. For example if the DTE were to send the word hello encoded in ASCII to the 9601-DG the binary stream would be hex 68 65 6c 6c 6f 02 14. The mobile originated buffer will be empty upon power-up. If any data is currently in the mobile originated buffer, it will be overwritten. Command Response: 0 SBD message successfully written to the 9601-DG. 1 SBD message write timeout. An insufficient number of bytes were transferred to 9601-DG during the transfer period of 60 seconds. 2 SBD message checksum sent from DTE does not match the checksum calculated at 9601-DG. 3 SBD message size is not correct. The maximum mobile originated SBD message length is 205 bytes. The minimum mobile originated SBD message length is 1 byte. 2.31 +SBDRB Short Burst Data: Read Binary Data from the Module Exec Command: +SBDRB This command is used to transfer a binary SBD message from the single mobile terminated buffer in the 9601-DG to the DTE. The mobile terminated buffer can contain only one message at any one time. The SBD message is transferred formatted as follows: {2-byte message length} + {binary SBD message} + {2-byte checksum} 1. The {2-byte message length} field represents the length, in bytes, of the SBD message not including the length field or the mandatory two-byte checksum. The high order byte will be sent first. 2. The maximum mobile terminated SBD message length is length is specified at 135 bytes (and may be increased following actual performance testing). 3. The checksum is the least significant 2-bytes of the summation of the entire SBD message. The high order byte will be sent first. For example if the 9601-DG were to send the word hello encoded in ASCII to the DTE the binary stream would be hex 00 05 68 65 6c 6c 6f 02 14. 4. If there is no mobile terminated SBD message waiting to be retrieved from the 9601- DG, the message length and checksum fields will be zero. The mobile terminated message buffer will be empty upon power-up. Command Response: There are no response codes generated by the 9601-DG for this command. 2.32 +SBDWT Short Burst Data: Write a Text Message to the Module Exec Command: +SBDWT[=<text message>] This command is used to transfer a text SBD message from the DTE to the single mobile originated buffer in the 9601-DG. The text message may be entered on the command line: For example, AT+SBDWT=hello. NAL Research Corporation (TN2007-626-V2.0.0) 13

The length of <text message> is limited to 120 characters. This is due to the length limit on the AT command line interface. The message is terminated when a carriage return is entered. Alternatively, the text message may be entered separately: Upon entering the command AT+SBDWT, the 9601-DG will indicate to the DTE that it is prepared to receive the message by sending the string READY<CR><LF> (hex 52 45 41 44 59 0D 0A) to the DTE. Once the DTE receives the READY indication, the text message must be sent, terminated by a carriage return. The length of the text message entered in this way is limited only by maximum mobileoriginated SBD message length of 205 bytes. The mobile originated buffer will be empty upon power-up. If any data is currently in the mobile originated buffer, it will be overwritten. Command Response: For the AT+SBDWT form: 0 SBD message successfully written to the 9601-DG. 1 SBD message write timeout. An insufficient number of bytes were transferred to 9601-DG during the transfer period of 60 seconds. For the AT+SBDWT=<text message> form: OK SBD message successfully stored in mobile originated buffer. ERROR An error occurred storing SBD message in mobile originated buffer. 2.33 +SBDRT Short Burst Data: Read a Text Message from the Module Exec Command: +SBDRT This command is used to transfer a text SBD message from the single mobile terminated buffer in the 9601-DG to the DTE. This command is similar to +SBDRB but does not provide a length indicator or checksum. The intent of this command is to provide a human friendly interface to SBD for demonstrations and application development. It is expected that most usage of SBD will be with binary messages. Once the command is entered, the SBD message in the mobile terminated buffer is sent out of the port. This command is similar to +SBDRB except no length or checksum will be provided. The maximum mobile terminated SBD message length is 135 bytes. The mobile terminated message buffer will be empty upon power-up. Command Response: +SBDRT:<CR> {mobile terminated buffer} 2.34 +SBDI Short Burst Data: Initiate an SBD Session NOTE: The +SBDI command is provided for backwards compatibility with existing FAs which do not use SBD Automatic Notification functionality. For SBD calls invoked with this command: NAL Research Corporation (TN2007-626-V2.0.0) 14

The SBD Session Type is fixed at type 0 MO call. The SBD Delivery Short Code will be the value specified by the +SBDDSC command. The Detach/Attach flag is fixed at the Detach setting. The Location Update flag is fixed at the No Update setting. FAs requiring SBD Automatic Notification functionality should use the extended +SBDIX command. Exec Command: +SBDI This command initiates an SBD session between the 9601-DG and the GSS (Gateway SBD Subsystem). If there is a message in the mobile originated buffer it will be transferred to the GSS. Similarly if there is one or more messages queued at the GSS the oldest will be transferred to the 9601-DG and placed into the mobile terminated buffer. The message, if any, in the mobile originated buffer will be sent from the 9601-DG to the GSS. If there is a message queued at the GSS it will be transferred to the 9601-DG and placed into the mobile terminated buffer. Command Response: +SBDI:<MO status>,<momsn>,<mt status>,<mtmsn>,<mt length>,<mt queued> where: <MO status>: MO session status provides an indication of the disposition of the mobile originated transaction. The field can take on the following values: 0 No SBD message to send from the 9601-DG. 1 SBD message successfully sent from the 9601-DG to the GSS. 2 An error occurred while attempting to send SBD message from 9601-DG to GSS. <MOMSN>: The Mobile Originated Message Sequence Number (MOMSN) is a value assigned by the 9601-DG when sending a mobile-originated message to the GSS. This value is incremented each time an SBD session is successfully completed between the 9601-DG to the GSS. This wrap around counter can range from 0 to 65535. <MT status>: The MT status provides an indication of the disposition of the mobile terminated transaction. The field can take on the following values: 0 No SBD message to receive from the GSS. 1 SBD message successfully received from the GSS. 2 An error occurred while attempting to perform a mailbox check or receive a message from the GSS. <MTMSN>: The Mobile Terminated Message Sequence Number (MTMSN) is assigned by the GSS when forwarding a message to the 9601-DG. This value is indeterminate if the field <MT status> is zero. This wrap around counter can range from 0 to 65535. NAL Research Corporation (TN2007-626-V2.0.0) 15

<MT length>: The MT length is the length in bytes of the mobile terminated SBD message received from the GSS. If no message was received, this field will be zero. <MT queued>: MT queued is a count of mobile terminated SBD messages waiting at the GSS to be transferred to the 9601-DG. 2.35 +SBDDET Short Burst Data: Detach (new) Exec Command: +SBDDET Initiates an SBD session to detach the 9601-DG from the Gateway. Command Response: +SBDDET:<status>,<error> where <status>: 0 Detach successfully performed 1 An error occurred while attempting the detach <error>: Gateway-reported values 0 No error. 1..4 Reserved, but indicate success if used. 5..14 Reserved, but indicate failure if used. 15 Access is denied. 9610-D-reported values 16 9601-DG has been locked and may not make SBD calls (see +CULK command). 17 Gateway not responding (local session timeout). 18 Connection lost (RF drop). 19..31 Reserved, but indicate failure if used. 32 No network service, unable to initiate call. 33 Antenna fault, unable to initiate call. 34 Radio is disabled, unable to initiate call (see *Rn command). 35 9601-DG is busy, unable to initiate call (typically performing auto-registration). 36 Reserved, but indicate failure if used. This instructs the Gateway to disable (detach) SBD Automatic Notifications for the calling 9601-DG. Successful completion of the detach command implies that the Gateway has performed the requested detach action and the 9601-DG is no longer registered. This session does not transfer any MO or MT messages. NOTE: A user can send an MO-SBD message and request a detach at the same time by using the +SBDI command. The +SBDI command always requests a detach. NAL Research Corporation (TN2007-626-V2.0.0) 16

2.36 +SBDDSC Short Burst Data: Delivery Short Code Set Command: +SBDDSC=<dsc> Set the Delivery Short Code (DSC), which provides dynamic routing information for uploaded messages. This is an 8-bit value providing the ability to set individual fields. Value 0x80 (hexadecimal) sets the most significant bit. Value 0x01 sets the least significant bit. Flag values can be added together to achieve a combination of settings. Some fields may be locked when the 9601-DG is in a special mode (e.g. Auto-registration locks the flag values 0x80 and 0x40). <dsc>: 0..255 DSC to be used for subsequent uploaded messages (0 default) 0x80 Hold MT message delivery 0x40 Leave MT message in queue after delivery 0x20 Destination in MO payload Read Command: +SBDDSC? Query the current Delivery Short Code. The response is of the form: +SBDDSC:<dsc> 2.37 +SBDIX Short Burst Data: Initiate an SBD Session Extended (new) NOTE: The +SBDIX command must be used in place of the +SBDI command for FAs wishing to make use of SBD Automatic Notification functionality. Exec Command: +SBDIX[A][=<location>] This command initiates an SBD session between the 9601-DG and the GSS, setting the SBD Session Type according to the type of command +SBDIX or +SBDIXA, Delivery Short Code according to the value specified by the +SBDDSC command, and the type of location according to whether the optional location value is provided. If there is a message in the mobile originated buffer it will be transferred to the GSS. Similarly if there is one or more messages queued at the GSS the oldest will be transferred to the 9601-DG and placed into the mobile terminated buffer. The message, if any, in the mobile originated buffer will be sent from the 9601-DG to the GSS. If there is a message queued at the GSS it will be transferred to the 9601-DG and placed into the mobile terminated buffer. This command will always attempt an SBD registration, consisting of attach and location update, during the SBD session in order to support SBD Automatic Notification. If this is not desired, the +SBDI command should be used. The FA should append an A to the command, i.e. +SBDIXA, when the SBD session is in response to an Automatic Notification. <location> has format: [+ -]DDMM.MMM,[+ -]dddmm.mmm where: DD Degrees latitude (00-89) MM Minutes latitude (00-59) MMM Thousandths of minutes latitude (000-999) ddd Degrees longitude (000-179) NAL Research Corporation (TN2007-626-V2.0.0) 17

mm Minutes longitude (00-59) mmm Thousandths of minutes longitude (000-999) The optional sign indicators specify latitude North (+) or South (-), and longitude East (+) or West (-). If omitted, the default is +. For example, AT+SBDIX=5212.483,-00007.350 corresponds to 52 degrees 12.483 minutes North, 0 degrees 7.35 minutes West. Command Response: +SBDIX:<MO status>,<momsn>,<mt status>,<mtmsn>,<mt length>,<mt queued> where: <MO status>: MO session status provides an indication of the disposition of the mobile originated transaction. The field can take on the following values: Gateway-reported values 0 MO message, if any, transferred successfully. 1 MO message, if any, transferred successfully, but the MT message in the queue was too big to be transferred. 2 MO message, if any, transferred successfully, but the requested Location Update was not accepted. 3..4 Reserved, but indicate MO session success if used. 5..8 Reserved, but indicate MO session failure if used. 10 Gateway reported that the call did not complete in the allowed time. 11 MO message queue at the Gateway is full. 12 MO message has too many segments. 13 Gateway reported that the session did not complete. 14 Invalid segment size. 15 Access is denied. 9601-DG-reported values 16 9601-DG has been locked and may not make SBD calls (see +CULK command). 17 Gateway not responding (local session timeout). 18 Connection lost (RF drop). 19..31 Reserved, but indicate MO session failure if used. 32 No network service, unable to initiate call. 33 Antenna fault, unable to initiate call. 34 Radio is disabled, unable to initiate call (see *Rn command). 35 9601-DG is busy, unable to initiate call (typically performing auto-registration). 36.. Reserved, but indicate failure if used. <MOMSN>: The Mobile Originated Message Sequence Number (MOMSN) is a value assigned by the 9601-DG when sending a mobile-originated message to the GSS. This value is incremented each time an SBD session is successfully completed between the 9601-DG to the GSS. This wrap around counter can range from 0 to 65535. NAL Research Corporation (TN2007-626-V2.0.0) 18

<MT status>: The MT status provides an indication of the disposition of the mobile terminated transaction. The field can take on the following values: 0 No MT SBD message to receive from the Gateway. 1 MT SBD message successfully received from the Gateway. 2 An error occurred while attempting to perform a mailbox check or receive a message from the Gateway. <MTMSN>: The Mobile Terminated Message Sequence Number (MTMSN) is assigned by the GSS when forwarding a message to the 9601-DG. This value is indeterminate if the field <MT status> is zero. This wrap around counter can range from 0 to 65535. <MT length>: The MT length is the length in bytes of the mobile terminated SBD message received from the GSS. If no message was received, this field will be zero. <MT queued>: MT queued is a count of mobile terminated SBD messages waiting at the GSS to be transferred to the 9601-DG. 2.38 +SBDMTA Short Burst Data: Mobile-Terminated Alert (new) Set Command: +SBDMTA=<mode> Enable or disable ring indications for SBD Automatic Notifications. <mode>: 0 Disable ring indication 1 Enable ring indication (default) When ring indication is enabled, the 9601-DG asserts the RI line and issues the unsolicited result code SBDRING when an SBD automatic notification is received. Read Command: +SBDMTA? Query the current ring indication mode. The response is of the form: +SBDMTA:<mode> Test Command: +SBDMTA=? List the supported mode settings. The response is of the form: +SBDMTA:(supported <mode> settings) 2.39 +SBDREG Short Burst Data: Network Registration (new) Exec Command: +SBDREG[=<location>] Triggers an SBD session to perform a manual SBD registration. This command initiates an SBD session to perform a manual SBD registration, consisting of an attach and location update. The session type will be set to 2 registration. This session does not transfer any MO or MT messages. NAL Research Corporation (TN2007-626-V2.0.0) 19

NOTE: The 9601-DG restricts the number of manual and automatic registrations to once every 3 minutes. Successive attempts within 3 minutes will return an error code indicating that the FA should try later (see error 36 below). NOTE: A user can send an MO SBD message and register at the same time by using the +SBDIX command. The +SBDIX command always performs a registration attempt and should be used for an application requiring SBD Automatic Notification. The +SBDI command never includes an SBD registration and should be used for an application that does not require SBD Automatic Notification. <location> has format: [+ -]DDMM.MMM,[+ -]dddmm.mmm where: DD Degrees latitude (00-89) MM Minutes latitude (00-59) MMM Thousandths of minutes latitude (000-999) ddd Degrees longitude (000-179) mm Minutes longitude (00-59) mmm Thousandths of minutes longitude (000-999) The optional sign indicators specify latitude North (+) or South (-), and longitude East (+) or West (-). If omitted, the default is +. For example, AT+SBDIX=5212.483,-00007.350 corresponds to 52 degrees 12.483 minutes North, 0 degrees 7.35 minutes West. Command Response: +SBDREG:<status>,<reg err> where: <status> indicates the resulting registration status of the 9601-DG: 0 Detached 9601-DG is detached as a result of a successful +SBDDET or +SBDI command. 1 Not registered 9601-DG is attached but has not provided a good location since it was last detached. 2 Registered 9601-DG is attached with a good location. Note that this may be the case even when the most recent attempt did not provide a good location. 3 Registration denied The gateway is denying service to the 9601-DG. <reg err>: Gateway-reported values 0 No error. 2 Session completed but the requested Location Update was not accepted. 3..14 Reserved, but indicate Location Update failure if used. 15 Access is denied. 9601-DG-reported values 16 9601-DG has been locked and may not make SBD calls (see +CULK command). 17 Gateway not responding (local session timeout). 18 Connection lost (RF drop). 19..31 Reserved, but indicate failure if used. 32 No network service, unable to initiate call. NAL Research Corporation (TN2007-626-V2.0.0) 20

33 Antenna fault, unable to initiate call. 34 Radio is disabled, unable to initiate call (see *Rn command). 35 9601-DG is busy, unable to initiate call (typically performing auto-registration). 36 Try later, must wait 3 minutes since last registration. 37.. Reserved, but indicate failure if used. Read Command: +SBDREG? Query the current SBD registration status of the 9601-DG. The response is of the form: +SBDREG:<status> <status>: 0 Detached 1 Not registered 2 Registered 3 Registration denied 4 Unknown The registration status is stored in 9601-DG non-volatile memory, and can therefore be queried by the FA after powering up. 2.40 +SBDAREG Short Burst Data: Automatic Registration (new) Set Command: +SBDAREG=<mode> Set the 9601-DG s Auto-registration mode. <mode>: 0 Disable automatic registration (default) 1 Set the Auto-registration mode to Automatic 2 Set the Auto-registration mode to Ask When auto-registration is enabled, mode 1 or 2, the 9601-DG monitors its current location and triggers an auto-registration when it determines that the 9601-DG has moved sufficiently far away from its last registered location. Note that auto-registration runs only while the 9601-DG is attached to the gateway, i.e. the registration status is Not registered or Registered. Auto-registration may only be used with system-provided location. If the FA is providing its own location (e.g. GPS), the FA should use the manual registration command, +SBDREG. Upon triggering in mode 1, Automatic, the 9601-DG autonomously initiates an SBD session in order to perform a registration with the updated location of the 9601-DG, with the session type set to 3 autoregistration. This session does not transfer any MO or MT messages. Upon triggering in mode 2, Ask, the 9601-DG reports to the FA that it should register with the system because the 9601-DG location has changed (see <event> below); it is then the responsibility of the FA to register via +SBDREG or +SBDIX. +SBDIX allows the FA to register while including an MO message and/or retrieving an MT message that is pending at the Gateway. When auto-registration is enabled, mode 1 or 2, the 9601-DG reports relevant events to the FA by issuing an unsolicited result code +AREG:<event>,<reg error>. NAL Research Corporation (TN2007-626-V2.0.0) 21

<event>: 0 Suggest FA makes a registration attempt (mode 2 only) 1 Auto-registration has been performed successfully (mode 1 only) 2 Auto-registration has failed and will be retried after a delay (mode 1 only) <reg error>: Gateway-reported values 0 No error. 2 Session completed but the requested Location Update was not accepted. 3..14 Reserved, but indicate Location Update failure if used. 15 Access is denied. 9601-DG-reported values 16 9601-DG has been locked and may not make SBD calls (see +CULK command). 17 Gateway not responding (local session timeout). 18 Connection lost (RF drop). 19..31 Reserved, but indicate failure if used. 32 No network service, unable to initiate call. 33 Antenna fault, unable to initiate call. 34 Radio is disabled, unable to initiate call (see *Rn command). 35 9601-DG is busy, unable to initiate call (typically performing auto-registration). 36 Try later, must wait 3 minutes since last registration. 37.. Reserved, but indicate failure if used. Read Command: +SBDAREG? Query the current automatic MT registration mode. The response is of the form: +SBDAREG:<mode> Test Command: +SBDAREG=? List the supported mode settings. The response is of the form: +SBDAREG:(supported <mode> settings) 2.41 +SBDD Short Burst Data: Clear SBD Message Buffer(s) Exec Command: +SBDD<Delete type> This command is used to clear the mobile originated buffer, mobile terminated buffer or both. The <Delete type> parameter identifies which buffers are cleared. 0 Clear the mobile originated buffer. 1 Clear the mobile terminated buffer. 2 Clear both the mobile originated and mobile terminated buffers. Using this command or power cycling the 9601-DG are the only means by which both buffers are cleared. The mobile terminated buffer will be cleared when an SBD session is initiated. Sending a message from the 9601-DG to the ESS does not clear the mobile originated buffer. Reading a message from the 9601-DG does not clear the mobile terminated buffer. Command Response: NAL Research Corporation (TN2007-626-V2.0.0) 22

0 Buffer(s) cleared successfully. 1 An error occurred while clearing the buffer(s). 2.42 +SBDC Short Burst Data: Clear SBD MOMSN Exec Command: +SBDC This command will clear (set to 0) the mobile originated message sequence number (MOMSN) stored in the 9601-DG. The MOMSN is maintained even after power cycle. Command Response: 0 The MOMSN was cleared successfully. 1 An error occurred while clearing the MOMSN. 2.43 +SBDS Short Burst Data: Status Exec Command: +SBDS This command returns current state of the mobile originated and mobile terminated buffers. Command Response: +SBDS:<MO flag>,<momsn>,<mt flag>,<mtmsn> where: <MO flag>: The MO flag indicates the existence of a message in the mobile originated buffer. The response from the 9601-DG is one of the following numeric codes: 0 No message in mobile originated buffer 1 Message in mobile originated buffer <MOMSN>: The MOMSN identifies the sequence number that will be used during the next mobile originated SBD session. <MT Flag>: The MT flag indicates the existence of a message in the mobile terminated buffer. The response from the 9601-DG is one of the following numeric codes: 0 No message in mobile terminated buffer 1 Message in mobile terminated buffer <MTMSN>: The MTMSN identifies the sequence number that was used in the most recent mobile terminated SBD session. This value will be 1 if there is nothing in the mobile terminated buffer. NOTE: The +SBDS command has been extended to +SBDSX to display a non-volatile SBD ring alert flag indicating the presence of an unanswered SBD ring alert. Also a new extension was added to the +SBDSX extended status command <msg waiting> to identify the number or count of messages waiting to be downloaded. NAL Research Corporation (TN2007-626-V2.0.0) 23

2.44 +SBDSX Short Burst Data: Status Extended Exec Command: +SBDSX This command returns current state of the mobile originated and mobile terminated buffers and the SBD ring alert status. Command Response: +SBDS: <MO flag>, <MOMSN>, <MT flag>, <MTMSN>, <RA Flag>, <msg waiting> where: <MO flag>: The MO flag indicates the existence of a message in the mobile originated buffer. The response from the 9601-DG is one of the following numeric codes: 0 No message in mobile originated buffer 1 Message in mobile originated buffer <MOMSN>: The MOMSN identifies the sequence number that will be used during the next mobile originated SBD session. <MT Flag>: The MT flag indicates the existence of a message in the mobile terminated buffer. The response from the 9601-DG is one of the following numeric codes: 0 No message in mobile terminated buffer 1 Message in mobile terminated buffer <MTMSN>: The MTMSN identifies the sequence number that was used in the most recent mobile terminated SBD session. This value will be -1 if there is nothing in the mobile terminated buffer. <RA Flag>: The RA flag indicates whether an SBD ring alert has been received and still needs to be answered. 0 No SBD ring alert 1 SBD ring alert has been received and needs to be answered NOTE: The RA flag is set whenever the 9601-DG receives an SBD ring alert; this happens even if the +SBDMTA setting specifies that SBD ring indications are disabled. The RA flag is cleared only on successful completion of an SBD mailbox check, i.e. an SBD session invoked with +SBDI[X[A]] in which the returned MT status indicates that no error occurred. The value of the RA flag is stored in non-volatile memory so it is preserved across power cycling of the 9601-DG. <msg waiting>: The message waiting flag indicates how many SBD mobile terminated messages are currently queued at the gateway awaiting collection by the 9601-D. This flag is updated after every SBD session, including +SBDI, +SBDIX, +SBDIXA, +SBDREG and +SBDDET. NAL Research Corporation (TN2007-626-V2.0.0) 24

2.45 +SBDTC Short Burst Data: Transfer MO Buffer to MT Buffer Exec Command: +SBDTC This command will transfer the contents of the mobile originated buffer to the mobile terminated buffer. Developers of DTE can use this command to test reading and writing to the 9601-DG without actually initiating SBD sessions with the ESS. Command Response: The command produces a response of the form SBDTC: Outbound SBD copied to Inbound SBD: size = <size> followed by OK, where <size> is the length of the message in bytes. 2.46 -MSSTM Request System Time Exec Command: -MSSTM Query the latest system time received from the network. The response is the form: -MSSTM:<system_time> <system_time> can take one of the following forms: no network service The 9601-DG has not yet received system time from the network. XXXXXXX Where XXXXXXXX is the current Iridium system time available from the network. The system time as received through the Iridium Air Interface, is a 32 bit integer count of the number of 90 millisecond intervals that have elapsed since the epoch. The return value is formatted as an ASCII hexadecimal number. The counter will rollover approximately every 12 years. Iridium system time epoch: June 1, 1996, 00:00:13 (GMT): Iridium system time source: The system time is available and valid only after the 9601-DG has registered with the network and has received the Iridium system time from the network. Once the time is received, the 9601-DG uses its internal clock to increment the counter. In addition, at least every 8 hours, or on location update or other event that requires re-registration, the 9601-DG will obtain a new system time from the network. Time localization: None. The system time value is always expressed in GMT time. Resolution and accuracy: The resolution of the system time is one Iridium frame tick, or 90 ms. Accuracy as measured by the difference between the time reported and the actual time it is sent out the 9601-DG serial port should not exceed 4 frame ticks (.36 seconds) and in most cases will be one frame tick (.09 seconds) or less. NAL Research Corporation (TN2007-626-V2.0.0) 25

3.0 S-REGISTER DEFINITIONS S-registers allow control over specific 9601-DG operations. Some S-registers contain a single numeric value, other S-registers are bit-mapped where individual bits, or set of bits, control specific functions. Table 1 defines the S-registers used for 9601-DG. Many of the A3LA series S-registers are obsolete for 9601-DG, and 9601-DG requires some new S-registers. To prevent reallocation of obsolete S-registers, they are reserved and shaded out in the table, and the new S-registers are registers that are unused in A3LA series and are marked as new for 9601-DG. All S-registers, from S0 to S127, are readable. All write permissions remain unchanged from A3LA series, even where a writable register is not used in 9601-DG. Writable registers are highlighted in the Sr=n writable? column. An FA could use the unused writable S-registers to store application-specific data. The final column in the table indicates which S-registers are stored in non-volatile memory as part of a user profile; the 9601-DG can be reset to a stored profile using the Zn command. 3.1 S-Register Commands Commands allow S-registers to be read, written, or simply referenced (i.e. set a pointer to designate the current, referenced S-register). S-register commands are described in the following subsections. 3.1.1 Sr Direct S-Register Reference Set a pointer to reference S-register r. 3.1.2 Sr? Direct S-Register Read Read the value of S-register r. 3.1.3 Sr=n Direct S-Register Write Set the value of S-register r to n, where n is a decimal value in the range 0 to 255. 3.1.4? Referenced S-Register Read Read the value of the current referenced S-register. The current referenced S-register is that which was last acted upon by a direct reference (ATSr), read (ATSr?), or write (ATSr=n) command. 3.1.5 =n Referenced S-Register Write Set the value of the current referenced S-register to n. The current referenced S-register is that which was last acted upon by a direct reference (ATSr), read (ATSr?), or write (ATSr=n) command. NAL Research Corporation (TN2007-626-V2.0.0) 26

3.2 S-Registers Table 1: 9601-DG Transceiver S-Registers REGISTER RANGE DEFAULT DESCRIPTION Sr=n writable? Profile Setting? SO 0 255 0 Auto-answer. Assigning a value from 1 to 255 in register S0 tells the ISU to automatically answer incoming calls. The factory setting of 0 turns off the automatic answer feature. S1 0 255 0 Ring count S2 0 255 43 Escape code character S3 0 127 13 Carriage return character S4 0 127 10 Line feed character S5 0 32 8 Backspace character S6 0 255 4 Wait for dail-tone S7 0 255 50 Communication standard used by ISU S8 0 255 4 Pause time for comma S9 0 255 6 Carrier detect response time S10 0 255 14 Carrier loss time S11 0 255 0 DTMF tone duration S12 0 255 50 Escape guard time. Time, in 50 ths of a second, until OK displayed after entering command mode by escape sequence S13 0 255 49 Bitmap register: Bits 0 1: DCE data bits Bits 2 3: DCE stop bits Bits 4 6: DCE parity setting S14 0 255 170 Bit register: Bit 1: En setting (echo) Bit 2: Qn setting (quiet) Bit 3: Vn setting (verbose) Bit 5: pulse/tone dial mode S21 0 255 48 Bitmap register: Bit 0: telephone jack control Bit 2: RTS/CTS on/off Bits 3 4: &Dn setting (DTR operation) Bit 5: &Cn setting Bit 6: disconnecting long space S22 0 255 246 Bitmap register Bits 0 1: speaker volume setting Bits 2 3: speaker on/off setting Bits 4 6: Xn setting NAL Research Corporation (TN2007-626-V2.0.0) 27

REGISTER RANGE DEFAULT DESCRIPTION Sr=n writable? Profile Setting? S23 0 255 61 Bitmap register: Bits 1 4: +IPR setting (DTE baud rate) Bits 6 7: guard tone S25 0 255 5 Sets length of time in hundredths of a second that a change in the DTR status has to persist for before it is recognized S27 0 255 9 Bitmap register: Bits 0 2: &Qn setting Bit 3: leased line operation setting Bits 4 5: synchronous clock setting S28 0 255 0 Bitmap register: Bits 3 4: &Pn setting (pulse dial make/break ratio) S30 0 255 0 Disconnect activity timer. Timer used to determined how long the call connection been inactive, in increments of 1/10000ms. A value of 0 disables this function S31 0 255 0 Bitmap register: Bit 1: line modulation method setting Bits 2 3: Wn setting S34 0 255 0 Bitmap register: Bits 0 1: data compression type (PT) Bit 6: +DS compression negotiation setting Bit 7: +DR setting S35 0 255 7 Bearer service capabilities S36 0 255 0 Bitmap register: Bits 0 2: link type setting S37 0 255 0 Bitmap register: Bits 0 4: Fn setting (line modulation standard) S39 0 255 3 Bitmap register: Bits 0 2: &Kn setting (flow control) S40 0 255 104 Bitmap register: Bits 2 4: \K setting Bits 3 5: \Kn setting Bits 6 7: \An setting S41 0 255 0 Bitmap registers: Bits 2, 6: enable retrain on bad signal quality setting Bit 4: xon/xoff usage setting Bit 5: DTE auto rate adjustment setting S42 0 255 16 GSM Call clearing code as returned by the network. Refer to GSM 04.08 Table 10.86 Cause Information Element Values NAL Research Corporation (TN2007-626-V2.0.0) 28

REGISTER RANGE DEFAULT DESCRIPTION Sr=n writable? Profile Setting? S43 0 255 32 Bitmap register: Bit 0: +CMGF setting Bit 1: +CBST parameter <name> setting Bit 2: +CMEE setting Bit 3: +CMEE setting Bit 5: +CBST parameter <ce> setting Bit 6: +CRC setting Bit 7: +CR setting S44 0 255 4 Bitmap register: Bits 0 2: +CPBS setting Bits 5 6: +CREG setting Bit 7: reserved S45 0 255 0 Bitmap register: Bits 0 1: +CNMI parameter <mode> setting Bits 2 3: +CNMI parameter <mt> setting Bits 4 5: +CNMI parameter <bm> setting Bits 6 7: +CNMI parameter <ds> setting S47 0 255 0 Bitmap register: Bits 4 6: TON settings for dial string S49 0 255 1 Bitmap register: Bits 0 3: NPI settings for dial string S51 0 255 2 V.42bis maximum codewords (P1), high byte S52 0 255 0 V.42bis maximum codewords (P1), low byte S54 0 255 6 V.42bis maximum string size (P2) S58 0 255 3 V.42bis compression direction (P0) S95 0 255 0 Bitmap register for extended result codes (overrides Wn setting): Bit 0: CONNECT shows DCE speed Bit 2: Enable CARRIER XXXX Bit 3: Enable PROTOCOL XXXX Bit 5: Enable COMPRESSION XXXX S96 0 255 0 IRLP version number (N0) parameter S98 1 105 10 5 S99 1 105 10 5 IRLP k iwf ISU parameter IRLP k ISU iwf parameter S100 1 15 15 IRLP N2 parameter S102 26 255 30 IRLP T1 parameter S103 10 255 10 IRLP T2 parameter S104 4 255 25 IRLP T4 parameter NAL Research Corporation (TN2007-626-V2.0.0) 29

REGISTER RANGE DEFAULT DESCRIPTION Sr=n writable? Profile Setting? S106 1 10 10 IRLP riwf ISU parameter S107 1 10 10 IRLP risu iwf parameter S110 0 1 0 SBM max segment size (40 310) (high byte) S111 0 255 135 SBM max segment size (40 310) (low byte) S112 0 255 0 SBD upload message sequence number (high byte) S113 0 255 0 SBD upload message sequence number (low byte) S121 0 15 1 New for 9601-DG S122 0 31 1 New for 9601-DG S123 0 255 8 Bitmap register: Bit 1: +WTM Bit 2: +WDLDM<dldm> Bit 3: +WIRLP<mode> Bits 4 5: +WFRNG Bitmap register: Bit 0: +SBDMTA setting (ring indication) Bits 1 2: +SBDAREG setting (automatic registration) Bitmap register: Bit 0: *R setting (radio activity) Bits 1 4: +CIER setting (indicator event reporting) S124 0 255 15 Dynamic link measurement interval (+WDLM <mi> setting). Value in 1000ms unit S125 1 100 10 Dynamic link delay measurement delay tolerance (+WDLM<dtl> setting). Value in % unit S126 0 255 2 Bitmap register: Bit 0: ignore &Dn command specified reaction to DTR ON to OFF transitions. Disconnect as reaction to Hn command. OK response given Bit 1: ignore &Dn command specified reaction to DTR ON to OFF transitions. Ignore Hn command. OK response given Bit 2: comply with &Dn command specified reaction to DTR ON to OFF transitions. Disconnect as reaction to Hn command. S127 0 255 0 Bitmap register containing copies of MSVTR/MSVLS parameters: Bit 0: -MSVTR: 0=Disabled (default) 1=Enabled Bit 1: -MSVLS: 0=No Mute (default) 1=Mute Enabled NAL Research Corporation (TN2007-626-V2.0.0) 30

4.0 SUMMARY OF RESULT CODES NUMERIC (V0) VERBOSE (V1) DESCRIPTION 0 OK Acknowledges execution of command 2 SBDRING MT messages present at gateway (unsolicited if enabled). See section 2.34 4 ERROR Command not accepted 127 HARDWARE FAILURE: <subsys>,<error> Issued at initialization in case of a hardware failure as verbose READY Ready to receive binary message data from DTE as verbose as verbose +AREG:<event>,<reg error> +CIEV:<sig>,<value > Auto-registration event report. See section 2.39 Indicator event report (unsolicited if enabled). See section 2.21 NAL Research Corporation (TN2007-626-V2.0.0) 31

5.0 INFORMATIVE EXAMPLES 5.1 Setting the Default Configuration The FA sets the 9601-DG s default configuration to no handshaking, no flow control, radio enabled, SBD Automatic Notifications enabled. TO 9601-DG (FROM FA) AT&K0 AT*R1 AT+SBDMTA=1 AT&W0 AT&Y0 TO FA (FROM 9601-DG) OK OK OK OK OK DESCRIPTION Disable RTS/CTS flow control Enable the radio Enable SBD ring indications Store the configuration as profile 0 Store profile 0 as the power-up default 5.2 Power-on to Sending a Message The FA will power the 9601-DG, wait for the 9601-DG to acquire the network, and send a 70-byte message. TO 9601-DG (FROM FA) AT+CIER=1,0,1,0 AT+SBDWB=70 <binary transfer> AT+SBDIX AT+SBDD0 TO FA (FROM 9601-DG) OK +CIEV:1,1 READY 0 +SBDIX:0,23,0,-1,0,0 OK DESCRIPTION Apply power to the 9601-DG Wait for DSR to become asserted Enable service indication reporting (note that this can be stored in the default configuration) Wait for the 9601-DG to acquire the network Transfer message to 9601 Perform SBD session Clear the MO message buffer NAL Research Corporation (TN2007-626-V2.0.0) 32

5.3 Automatic Notification Registration The FA verifies its registration state, performs a registration in order to be able to receive Automatic Notifications, and enables Automatic Notification indications. TO 9601-DG (FROM FA) TO FA (FROM 9601-DG) DESCRIPTION AT+SBDREG? +SBDREG:0 Query the 9601-DG registration status 9601-DG is detached, i.e. un-registered AT+SBDREG Tell the 9601-DG to register for Automatic Notifications +SBDREG:2,0 9601-DG is now registered AT+SBDREG? Query the 9601-DG registration status AT+SBDMTA=1 +SBDREG:2 OK 9601-DG is registered Enable SBD ring indications from 9601-DG to FA 5.4 Automatic Notification Message Reception The FA verifies its registration state. Upon receiving an Automatic Notification the FA initiates an SBD session to receive an MT message. TO 9601-DG (FROM FA) AT+SBDREG? AT+SBDIXA AT+SBDRB TO FA (FROM 9601-DG) +SBDREG:2. +SBDRING +SBDIXA:0,23,1,237,90,2 <binary transfer> DESCRIPTION Query the 9601-DG registration status 9601-DG is registered User sending a MT message to the GSS 9601-DG indicates an incoming message. The RI line also toggles FA initiates an SBD session in answer to the Automatic Notification 9601-DG informs FA that a 90-byte message was successfully received with MTMSN 237 and that two further MT messages are queued at the GSS FA retrieves the received message from the 9601- DG NAL Research Corporation (TN2007-626-V2.0.0) 33

5.5 Automatic Notification Automatic Registration The FA verifies its registration state and enables automatic registration using the Ask mode. TO 9601-DG (FROM FA) AT+SBDREG? AT+SBDAREG=2 AT+SBDREG TO FA (FROM 9601-DG) +SBDREG:2 OK +AREG:0,0 +SBDREG:2,0 DESCRIPTION Query the 9601-DG registration status 9601-DG is registered FA sets the automatic registration to Ask mode 9601-DG is moved 9601-DG notifies FA that it needs to register FA instructs the 9601-DG to register Registration successful 5.6 Sending a Message with Minimal Radio Activity Assuming that service indication events have been turned on with AT+CIER=1,0,1 and the radio has been disabled with AT*R0. TO 9601-DG (FROM FA) AT+SBDWB=70 <binary transfer> AT*R1 AT+SBDI AT*R0 AT+SBDD0 TO FA (FROM 9601-DG) READY 0 OK +CIEV:1,1 +SBDI:0,23,0,-1,0,0 OK OK DESCRIPTION Transfer message to 9601-DG Activate the radio and wait for the 9601-DG to acquire the network 9601-DG has acquired the network Perform SBD session Deactivate the radio Clear the MO message buffer 5.7 Powering Down The FA flushes any pending EEPROM writes before powering down the 9601-DG. NAL Research Corporation (TN2007-626-V2.0.0) 34

TO 9601-DG (FROM FA) AT*F <binary transfer> TO FA (FROM 9601-DG) OK DESCRIPTION FA tells the 9601-DG to flush pending writes to EEPROM and waits for completion FA may now safely disconnect the 9601-DG power supply 5.8 Sending an SBD Message to the 9601-DG Messages can be sent to the 9601-DG via SBD from almost any e-mail program (Outlook, Outlook Express, etc.). 1. In order to send e-mail messages to a 9601-DG, the e-mail program must use the standard Multipurpose Internet Mail Extensions (MIME) Base64 encoding as defined in RFC 2045. The following instructions describe how to set this up for Microsoft Outlook Express: a. Select Tools/Options b. Click the Send Tab c. Under Mail Sending Format, click HTML Settings d. Click MIME e. Select Base 64 for Encode text using f. Click OK g. Under Mail Sending Format, click Plain Text Settings h. Repeat steps d f 2. Send all e-mail messages to Data@SBD.Iridium.com 3. Place the IMEI number of the modem in the subject line 4. The message should be carried in an attachment, which must have a.sbd extension NOTE: Comparable information related to the DoD gateway is provided upon request. NAL Research Corporation (TN2007-626-V2.0.0) 35