EM9291 Not Connecting to Private 5G Network

IoT Modules MC/EM Series
1

We are attempting to attach a UE to a private 5G deployment and the UE uses the EM9291 modem. Output from qmicli suggests the SIM is ‘illegal’, but this SIM has been used to successfully connect other UEs to the same network.

voxl2:/$ qmicli -d /dev/cdc-wdm0 --uim-get-card-status 
[/dev/cdc-wdm0] Successfully got card status
Provisioning applications:
	Primary GW:   slot '1', application '1'
	Primary 1X:   session doesn't exist
	Secondary GW: session doesn't exist
	Secondary 1X: session doesn't exist
Slot [1]:
	Card state: 'present'
	UPIN state: 'not-initialized'
		UPIN retries: '0'
		UPUK retries: '0'
	Application [1]:
		Application type:  'usim (2)'
		Application state: 'illegal'
		Application ID:
			A0:00:00:00:87:10:02:FF:FF:FF:FF:89:07:09:00:00
		Personalization state: 'ready'
		UPIN replaces PIN1: 'no'
		PIN1 state: 'disabled'
			PIN1 retries: '3'
			PUK1 retries: '10'
		PIN2 state: 'enabled-not-verified'
			PIN2 retries: '3'
			PUK2 retries: '10'
	Application [2]:
		Application type:  'isim (5)'
		Application state: 'detected'
		Application ID:
			A0:00:00:00:87:10:04:FF:FF:FF:FF:89:07:09:00:00
		Personalization state: 'unknown'
		UPIN replaces PIN1: 'no'
		PIN1 state: 'disabled'
			PIN1 retries: '3'
			PUK1 retries: '10'
		PIN2 state: 'not-initialized'
			PIN2 retries: '0'
			PUK2 retries: '0'
Slot [2]:
	Card state: 'absent'
	UPIN state: 'not-initialized'
		UPIN retries: '0'
		UPUK retries: '0'

Based on the output of AT commands it seems like the network is visible to the modem:

voxl2:/$ busybox microcom /dev/ttyUSB0
at!entercnd="A710"
OK
ati3
Manufacturer: Sierra Wireless, Incorporated
Model: EM9291
Revision: SWIX65C_03.04.10.01 00b8ca jenkins 2025/06/18 05:56:16
IMEI: 358186652129789
IMEI SV: 11
FSN: 833415552901B1
+GCAP: +CGSM


OK
at!impref?
!IMPREF: 
 preferred fw version:    03.04.10.01
 preferred carrier name:  GENERIC
 preferred config name:   GENERIC_040.025_001
 preferred subpri index:  000
 current fw version:      03.04.10.01
 current carrier name:    GENERIC
 current config name:     GENERIC_040.025_001
 current subpri index:    000

OK
at!selrat?
!SELRAT: 00, Automatic


OK
at!band?
Index, Name
0C, NR5G ALL,
0 - GW:    0000000000000000
1 - LTE:   0000000000000000 0000000000000000
3 - NRNSA: 000081A03B0A38D7 0000000000007C62
4 - NRSA:  000081A03B0A38D7 0000000000007C62

OK
at!sdpref?
RATs : WCDMA,LTE,NR5G
GWC  : B1,B2,B4,B5,B6,B8,B19
LTE  : B1,B2,B3,B4,B5,B7,B8,B12,B13,B14,B17,B18,B19,B20,B25,B26,B28,B29,B30,B32,B34,B38,B39,B40,B41,B42,B43,B46,B48,B66,B71
TDS  : 
NRSA : n1,n2,n3,n5,n7,n8,n12,n13,n14,n18,n20,n25,n26,n28,n29,n30,n38,n40,n41,n48,n66,n70,n71,n75,n76,n77,n78,n79
NRNSA: n1,n2,n3,n5,n7,n8,n12,n13,n14,n18,n20,n25,n26,n28,n29,n30,n38,n40,n41,n48,n66,n70,n71,n75,n76,n77,n78,n79

OK
at!gstatus?
!GSTATUS: 
Current Time:  8240		Temperature: 35

Reset Counter: 1		Mode:        ONLINE         
System mode:   NR5G       	PS state:    Not attached 
MM5G state:    Deregistered     Limited Service
RRC state:     RRC Idle        
IMS reg state: NOT REGISTERED  	IMS mode:    Normal       
IMS Srv State: UNKNOWN SMS,UNKNOWN VoIP

NR5G TAC:        000001        		NR5G Cell ID:    D15 (3349)
NR5G band:       n78       		NR5G Carrier ID: 0
NR5G dl bw:      100 MHz   		NR5G ul bw:      100 MHz   
NR5G Tx Power:   ---        		NR5G Tx chan:    0
NR5G Rx chan:    624924
NR5G dl MIMO:    4         		NR5G ul MIMO:    1
NR5G(sub6) Rx0 RSSI (dBm):   -51.3	NR5G(sub6) Rx1 RSSI (dBm):   -52.8
NR5G(sub6) Rx2 RSSI (dBm):   ---  	NR5G(sub6) Rx3 RSSI (dBm):   ---	

NR5G RSRP (dBm): -79			NR5G RSRQ (dB):  -11
NR5G SINR (dB):  23.5


OK
at!lteinfo?
!LTEINFO: Not Available


OK
at!nrinfo?
!NRINFO: 
Connectivity Mode: SA

NR5G Cell ID:    D15 (3349)
NR5G band:       n78       		NR5G Carrier ID: 0
NR5G dl bw:      100 MHz   		NR5G ul bw:      100 MHz   
NR5G Tx Power:   ---        		NR5G Tx chan:    0
NR5G Rx chan:    624924
NR5G dl MIMO:    4         		NR5G ul MIMO:    1
NR5G(sub6) Rx0 RSSI (dBm):   -51.3	NR5G(sub6) Rx1 RSSI (dBm):   -52.8
NR5G(sub6) Rx2 RSSI (dBm):   ---  	NR5G(sub6) Rx3 RSSI (dBm):   ---	

NR5G RSRP (dBm): -79			NR5G RSRQ (dB):  -11
NR5G SINR (dB):  23.5


OK
AT+CGDCONT?
+CGDCONT: 1,"IPV4V6","internet","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0
+CGDCONT: 2,"IPV4V6","ims","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0

OK
2

Probably you need to capture network log and send to distributor for further analysis

3

Maybe I can help. Here is what I see - in the AT!GSTATUS? response, the status or state is Limited Service mode. Something went wrong with the module/SIM handshaking with the network. Network does not like something about that communications and tells the device, you have limited service. So need more information, over the air messages between the device and network. Yes, sometimes this happens.

4

I have been in contact with the network distributor and they believe this is an issue on the modem side. We have seen no packets come in from the modem on the network side and have confirmed the network is visible to the modem. We have tried multiple SIMs that have all been used to successfully attach other UEs to the network. The lack of a visible registration attempt on the network side suggests the modem is rejecting the network at some point. Do you have any suggestions to further troubleshoot this issue?

5

We had an issue like this. What we did is - the distributor provided a logging tool. I do not recall the name but I can check with a coworker, he will know. The logging tool will capture the over the air messages and tell the story you need. suggestion - request that logging tool.

6

I found it. The logging tool is part of the MBPL package. The logging tool is called dm-logger, this is the linux based version. Can you download the MBPL package? it is @ the source support page for the module.

7

MBPL tools package. This one - MBPL_Tools_R48_ENG5.bin.tar

9

Probably you need to capture modem log and send to the EM9291 distributor to understand the root cause

10

Maybe I can help you again. I remembered how we tested and logged - we used the default log mask and put the module into airplane mode On first then started logging then airplane mode off - this sequence allows the log to contain the initial messages to the network. The distributor support person should know this though.