Dear polite fellow forum inhabitants,
excuse my noob question. I work as a support techie / FAE in a company selling various industrial PC’s, Ethernet and fieldbus communication gadgets. I have fond memories of dial-up modems and episodic experience with WWAN modems over the last two decades. So much for my background.
The problem at hand is: I have a tablet PC with an M.2 WWAN modem. The original was a Sierra EM7455, which I considered replacing with a Quectel EM05 - except that the EM7455 is deep inside. And, I have a SIM card, supplied by the customer, who’s running a fleet of vehicles with on-board computers containing WWAN modems - obviously, my customer is not willing to switch his GSM operator just to get that pesky tablet to work. The “culprit operator” here is O2 CZ. Czech Republic is an EU member country - the trio of operators here are the ex-incumbent O2 (no longer owned by O2 international), T-Mobile and Vodafone. We have various RAN’s in bands 1/3/7/8/20/28. Curiously to me, as I have started debugging this particular case yesterday, I’ve noticed that apparently, no 3G networks are in sight anymore (WCDMA, UTRAN, whatever). All the transponders I can see are either 2G=GERAN or 4G=LTE=E-UTRA (I don’t have a 5G=NR modem in my claws yet). So much for the environment.
Now for the problem description: with either of those two modems (Sierra/Quectel), the O2 SIM at hand fails to achieve network registration. The SIM is present, AT+CPIN? says READY, but AT+CREG says either “searching for network” or “registration denied”.
ati3
Manufacturer: Sierra Wireless, Incorporated
Model: EM7455
Revision: SWI9X30C_02.33.03.00 r8209 CARMD-EV-FRMWR2 2019/08/28 20:59:30
MEID: 35982032939552
IMEI: 359820329395527
IMEI SV: 20
FSN: LF140650430310
+GCAP: +CGSM
OK
at+cpin?
+CPIN: READY
OK
at+creg?
+CREG: 0,3
OK
AT+COPS?
+COPS: 0
OK
AT!GSTATUS?
!GSTATUS:
Current Time: 1173 Temperature: 31
Reset Counter: 1 Mode: ONLINE
System mode: LTE PS state: Not attached
LTE band: B20 LTE bw: 10 MHz
LTE Rx chan: 6300 LTE Tx chan: 4294967295
LTE CA state: NOT ASSIGNED
EMM state: Deregistered Attach Needed
RRC state: RRC Idle
IMS reg state: No Srv
PCC RxM RSSI: -69 RSRP (dBm): -94
PCC RxD RSSI: -72 RSRP (dBm): -96
Tx Power: -- TAC: 05E7 (1511)
RSRQ (dB): -6.8 Cell ID: 06440700 (105121536)
SINR (dB): 7.8
OK
AT!PCINFO?
State: Online
LPM voters - Temp:0, Volt:0, User:0, W_DISABLE:0, IMSWITCH:0, BIOS:0, LWM2M:0, OMADM:0, FOTA:0
LPM persistence - None
OK
C:\Users\User>netsh mbn sh int
There is 1 interface on the system:
Name : Cellular
Description : Sierra Wireless EM7455 Qualcommr SnapdragonT X7 LTE-A
GUID : {2AC33EB3-3DBD-45F6-A12E-A172CB760499}
Physical Address : 80:99:97:5e:40:5a
State : Not connected
Device type : This is a remote device
Cellular class : GSM
Device Id : 359820329395527
Manufacturer : Sierra Wireless, Incorporated
Model : Sierra Wireless EM7455 Qualcomm
Firmware Version : SWI9X30C_02.33.03.00
Provider Name : O2-CZ
Roaming : Not roaming
Signal : 0%
RSSI / RSCP : 0 (-113 dBm)
C:\Users\User>netsh mbn sh read int=*
Ready information for interface Cellular:
-------------------------------------
State : Ready to power up and register
Emergency mode : Off
Subscriber Id : 230021200115552
SIM ICC Id : 8942020322801035550
Number of telephone numbers : 0
C:\Users\User>netsh mbn sh rad int=*
Radio state information for interface Cellular:
-------------------------------------
Hardware radio state : On
Software radio state : On
C:\Users\User>netsh mbn sh cap int=*
Device capability information for interface Cellular:
-------------------------------------------------------
Device type : This is a remote device
Cellular class : GSM
Voice class : No voice
Sim class : SIM is removable
Data class : UMTS, HSDPA, HSUPA, LTE
GSM band class : Unknown
SMS capability : PDU receive, PDU send
Control capability : Manual network selection is allowed
USSD support available
Device Id : 359820329395527
Manufacturer : Sierra Wireless, Incorporated
Model : Sierra Wireless EM7455 Qualcomm
Firmware Information : SWI9X30C_02.33.03.00
Maximum activation contexts : 8
C:\Users\User>netsh mbn sh vis int=*
Scanning for available networks. Device can take few minutes to complete this operation
Visible providers list for interface Cellular:
-----------------------------------------------
Provider # 1
Name : O2 - CZ
Id : 23002
state : Home, Preferred, Visible, Registered
data class : UMTS, HSDPA, HSUPA, LTE
cellular class : GSM
rssi : 99
error rate : 99
Provider # 2
Name : T-Mobile CZ
Id : 23001
state : Forbidden, Visible
data class : UMTS, HSDPA, HSUPA, LTE
cellular class : GSM
rssi : 99
error rate : 99
Provider # 3
Name : Vodafone CZ
Id : 23003
state : Forbidden, Visible
data class : UMTS, HSDPA, HSUPA, LTE
cellular class : GSM
rssi : 99
error rate : 99
# yet, the Windows MBN GUI systray applet reports "Cellular: no service".
# And:
at+creg?
+CREG: 0,2
OK
And, for comparison, here is a listing from the Quectel, providing a slightly different angle:
ati3
Quectel
EM05
Revision: EM05EFAR06A04M4G
OK
AT+CPIN?
+CPIN: READY
OK
at+creg?
+CREG: 0,2
OK
AT+QNWINFO
+QNWINFO: "FDD LTE","23002","LTE BAND 20",6300
OK
AT+QENG="servingcell"
+QENG: "servingcell","SEARCH"
OK
AT+QENG="neighbourcell"
+QENG: "neighbourcell intra","LTE",6300,235,-13,-83,-52,-20,41,255,20,8,62
+QENG: "neighbourcell intra","LTE",6300,432,-20,-92,-60,-20,31,255,20,8,62
+QENG: "neighbourcell inter","LTE",9260,335,-12,-80,-58,-20,39,0,20,255
+QENG: "neighbourcell inter","LTE",100,-,-,-,-,-,-,0,20,6
AT+QENG="servingcell"
+QENG: "servingcell","LIMSRV","LTE","FDD",230,02,64407B4,335,9260,28,3,3,5E7,-96,-10,-68,10,27
OK
AT+QENG="neighbourcell"
+QENG: "neighbourcell intra","LTE",6300,235,-16,-99,-65,-20,24,255,20,8,62
+QENG: "neighbourcell intra","LTE",6300,432,-15,-98,-72,-20,26,255,20,8,62
+QENG: "neighbourcell inter","LTE",100,-,-,-,-,-,-,0,20,6
+QENG: "neighbourcell inter","LTE",1379,-,-,-,-,-,-,0,20,5
at+qcops=7,1
+QCOPS: "4G","","56047","LTE BAND 3",1379,5e7,3A,-84,-115,-10
+QCOPS: "4G","","56047","LTE BAND 20",6300,5e7,1B0,-68,-100,-15
+QCOPS: "4G","","56047","LTE BAND 28",9260,5e7,14F,-63,-96,-16
+QCOPS: "4G","","56031","LTE BAND 1",473,3866,FC,-75,-102,-8
+QCOPS: "4G","","56031","LTE BAND 3",1579,3866,B4,-75,-111,-15
+QCOPS: "4G","","56031","LTE BAND 20",6200,3866,AE,-71,-99,-11
+QCOPS: "4G","","56063","LTE BAND 1",300,8dcc,CC,-75,-109,-14
+QCOPS: "4G","","56063","LTE BAND 3",1849,8dcc,2C,-69,-107,-18
+QCOPS: "4G","","56063","LTE BAND 20",6400,8dcc,84,-70,-100,-13
If I try a T-Mobile SIM, I do get registered to an LTE RAN, I can launch a PDP context etc. (Windows just get a breath of LTE connectivity, the bar-graph is all green, operator name gets displayed in the “cellular systray applet” and an IP address gets assigned etc.) Not with the O2 SIM.
The two modems that I’ve mentioned so far, have at least one aspect in common: they lack support for 2G GERAN. They support 3G and 4G only. Does that ring a bell maybe? Could it be that the O2 network requires a registration to a 2G transponder first, and only then allows the MT to switch to 4G ? Is this a feature of the network, or is this somehow encoded in the SIM and a local decision of the MT (modem) based on SIM contents?
I’ve also tried with two other modems:
- an old Sierra MC8092 is 2G/3G. Registers happily to 2G GERAN and runs that way. Does not report any 3G carriers in sight.
at+csq
+csq: 31,99
OK
AT+CPIN?
+CPIN: READY
OK
AT+CREG?
+CREG: 0,1
OK
AT+COPS?
+COPS: 0,0,"O2-CZ",0
OK
AT!GSTATUS?
!GSTATUS:
Current Time: 173 Temperature: 21
Bootup Time: 0 Mode: ONLINE
System mode: GSM PS state: Attached
GSM band: GSM900
GSM channel: 122
GMM (PS) state:REGISTERED NORMAL SERVICE
MM (CS) state: IDLE NORMAL SERVICE
Serving Cell: 519 (GSM 1800 )
RX level (dBm):-47.8750 LAC: 05E7 (1511)
GPRS State: GPRS STANDBY Cell ID: 00009C9D (40093)
- the low-cost EC200T from Quectel. Capable of 2G/3G/4G, just lacking a WWAN driver in Windows. But the USB Serial interfaces do work, the modem reports 2G and 4G towers in sight and I can see that it quickly locks onto a 4G cell… well at least it says “CREG: 0,1” - in Windows I have no further clues.
ati
Quectel
EC200T
Revision: EC200TEUHAR05A01M16
OK
at+cpin?
+CPIN: READY
OK
at+creg?
+CREG: 0,1
OK
at+cgreg?
+CGREG: 0,1
OK
at+QCFG="band"
+QCFG: "band",0x93,0x1a0080800c5
OK
at+qnwinfo
+QNWINFO: "FDD LTE","23002","LTE BAND 3",1379
OK
at+qcfg="nwscanseq"
+QCFG: "nwscanseq",0
OK
AT+QENTAT+QENG="neighbourcell"
+CME ERROR: 50
AT+QENG="neighbourcell"
+QENG: "neighbourcell inter","LTE",44192,65535,-140,-20,-,-,0,2,2,7
+QENG: "neighbourcell inter","LTE",44892,65535,-140,-20,-,-,0,2,2,7
+QENG: "neighbourcell inter","LTE",45490,65535,-140,-20,-,-,0,2,2,7
+QENG: "neighbourcell inter","LTE",100,65535,-140,-20,-,-,0,4,20,6
+QENG: "neighbourcell inter","LTE",2850,65535,-140,-20,-,-,0,4,20,6
+QENG: "neighbourcell inter","LTE",1404,65535,-140,-20,-,-,0,4,20,5
+QENG: "neighbourcell inter","LTE",6300,65535,-140,-20,-,-,0,4,20,4
+QENG: "neighbourcell inter","LTE",9260,65535,-140,-20,-,-,0,4,20,4
+QENG: "neighbourcell inter","LTE",100,7,-121,-14,-,-,2,4,20,6
+QENG: "neighbourcell inter","LTE",6300,235,-92,-15,-,-,27,4,20,4
+QENG: "neighbourcell inter","LTE",9260,335,-81,-14,-,-,38,4,20,4
+QENG: "neighbourcell","GSM",68,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",519,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",122,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",115,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",111,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",101,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",93,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",89,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",87,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",86,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",83,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",75,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",69,0,0,0,0,0,255,0,0
+QENG: "neighbourcell","GSM",111,1,20,4,255,0,14,-63,687
+QENG: "neighbourcell","GSM",69,1,20,4,255,0,11,-72,531
+QENG: "neighbourcell","GSM",519,1,20,4,255,0,14,-74,507
OK
AT+QENG="servingcell"
+QENG: "servingcell","NOCONN","LTE","FDD",230,02,644075A,58,1379,3,5,5,5E7,-93,-12,-78,11,30
What an amazing sensitivity, BTW. The longest list of towers that I’ve seen so far, here in my lab.
I’m still waiting for an EC25-E to arrive in a day or two (2G/3G/4G), which should allow me to probe the bands and carriers and practical Windows behavior a little further.
Ho hum.
As for the EM7455 - is there some way for me to debug the mystery further?
Increase verbosity, add some progress messages related to network registration (CREG), make the modem comment on SIM contents? I’ve also noticed the AT+CRSM command - would this possibly be any use to identify any “service configuration features” relevant to the observed misbehavior?
Actually the very first thing I tried was an upgrade to firmware 02.38.00.00_00_GENERIC_002.082_000 which did not solve the problem. So I retreated back to 02.33.03.00_00_GENERIC_002.072_001 which we consider previously tested and proven…
Any ideas are welcome.
You’re as swift as usual.