EM9291 SMS Sending Failure (+CMS ERROR: 500) on Portuguese MVNO SIMs (WOO/UTmobile & DIGI PT)

IoT Modules MC/EM Series
1

I’m experiencing unreliable SMS sending on an EM9291 module integrated with a Techship MC201 adapter. The module registers successfully on LTE, detects SIMs, and shows good signal, but SMS fails consistently on WOO SIM and on DIGI SIM with +CMS ERROR: 500

The same SIMs send/receive SMS flawlessly in Android phones, ruling out SIM/network provisioning issues.

Carrier/Location: Portugal (PT); SIMs from WOO/UTmobile (MCC/MNC: 20406) and DIGI PT (MCC/MNC: 20416)
Hardware: Techship MC201 M.2 to USB-C Adapter (Jumpers J6/J22 shorted for USB mode; external 5V/2A power; 4x antennas connected)

Relevant logs:

AT+CIMI
268020000409812

OK
ATI
Manufacturer: Sierra Wireless, Incorporated
Model: EM9291
Revision: SWIX65C_03.04.10.01 00b8ca jenkins 2025/06/18 05:56:16
IMEI: 358186652726758
IMEI SV: 11
FSN: FX5402784702B1
+GCAP: +CGSM

OK
AT+CPAS
+CPAS: 4

OK
AT+CGDCONT?
+CGDCONT: 1,"IPV4V6","","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0
+CGDCONT: 2,"IPV4V6","ims","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0
+CGDCONT: 3,"IPV4V6","umts","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0

OK
AT+CGACT?
+CGACT: 1,1
+CGACT: 2,1
+CGACT: 3,0

OK

AT+CREG?
+CREG: 0,1
OK

AT+COPS?
+COPS: 0,0,“DIGI PT”,7
OK

AT!GSTATUS?
!GSTATUS: 
Current Time:  1306		Temperature: 23

Reset Counter: 1		Mode:        ONLINE         
System mode:   LTE        	PS state:    Attached     
LTE band:      B8     		LTE bw:      3 MHz   
LTE Rx chan:   3485		LTE Tx chan: 21485
EMM state:     Registered     	Normal Service 
RRC state:     RRC Idle        
IMS reg state: REGISTERED      	IMS mode:    Normal       
IMS Srv State: FULL SMS,NO VoIP        

PCC Rx0 RSSI:  -75.9		PCC Rx0 RSRP:  -106.0
PCC Rx1 RSSI:  -76.4		PCC Rx1 RSRP:  -105.5
PCC Tx Power:  ---		TAC:         2cee (11502)
RSRQ (dB):     -17.3		Cell ID:     01909333 (26252083)
SINR (dB):     -3.4

NR5G band:       ---		NR5G bw:         ---		
NR5G Tx Power:   ---		NR5G Tx chan:    ---		
NR5G Rx chan:    ---		NR5G RSRP (dBm): ---		
NR5G RSRQ (dB):  ---		NR5G SINR (dB):  ---		


OK


AT+CMGF=1
OK
AT+CMGS="+351936386037"
> hi

+CMS ERROR: 500
AT+CSMS?
+CSMS: 0,1,1,1

OK
AT+CGSMS?
+CGSMS: 0

OK
AT+CGSMS=3
OK
AT+CMGS="+351936386037"
> hi

+CMS ERROR: 500
AT!GSTATUS?
!GSTATUS: 
Current Time:  1395		Temperature: 23

Reset Counter: 1		Mode:        ONLINE         
System mode:   LTE        	PS state:    Attached     
LTE band:      B8     		LTE bw:      3 MHz   
LTE Rx chan:   3485		LTE Tx chan: 21485
EMM state:     Registered     	Normal Service 
RRC state:     RRC Connected   
IMS reg state: REGISTERED      	IMS mode:    Normal       
IMS Srv State: FULL SMS,NO VoIP        

PCC Rx0 RSSI:  -75.3		PCC Rx0 RSRP:  -106.4
PCC Rx1 RSSI:  -75.6		PCC Rx1 RSRP:  -105.2
PCC Tx Power:  ---		TAC:         2cee (11502)
RSRQ (dB):     -18.0		Cell ID:     01909333 (26252083)
SINR (dB):     -3.8

NR5G band:       ---		NR5G bw:         ---		
NR5G Tx Power:   ---		NR5G Tx chan:    ---		
NR5G Rx chan:    ---		NR5G RSRP (dBm): ---		
NR5G RSRQ (dB):  ---		NR5G SINR (dB):  ---		
OK

I was experiencing this issue firstly with firmware SWIX65C_02.17.08.00. I’ve updated the firmware to SWIX65C_03.04.10.01 but the problem persists.
I’m able to receive SMS and connect to the internet using mbimcli.
I’ve tried to use the EM9291 modem from both linux and windows hosts to send the relevant AT commands, but the SMS transmission issue persists.

2

Can it receive sms?
I saw that you did not set APN in +cgdcont.

Btw, does it work in 3G mode?

Lastly, are you using the generic pri?

Also what is the value of at!imstestmode?

3

Hi @jyijyi !
Yes, the module can receive sms.
3G mode doesn’t work since 3G has been discontinued in Portugal.
I’m using the Generic PRI and IMSTESTMODE is disabled as is visible in the log below.

AT+CNMI?
+CNMI: 2,1,0,0,0

OK

+CMTI: “ME”,1
AT+CMGF=1
OK
AT+CMGL=“ALL”
+CMGL: 0,“REC READ”,“+351936386037”,“26/01/07,13:48:39+00”
Hello
+CMGL: 1,“REC UNREAD”,“+351936386037”,“26/01/07,14:00:02+00”
Hi 2

OK
AT+CGDCONT?
+CGDCONT: 1,“IP”,“umts”,“0.0.0.0”,0,0,0,0,“”,0
+CGDCONT: 2,“IPV4V6”,“ims”,“0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0”,0,0,0,0,“”,0
+CGDCONT: 3,“IPV4V6”,“umts”,“0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0”,0,0,0,0,“”,0

OK
AT+CGACT?
+CGACT: 1,1
+CGACT: 2,1
+CGACT: 3,0

OK
AT+CMGS=“+351936386037”

hi

+CMS ERROR: 500
AT!PRIID?
PRI Part Number: 9912117
Revision: 001.000
Customer: Generic

Carrier PRI: 9999999_9911053_SWIX65C_03.04.10.01_00_GENERIC_040.025_001

OK
AT!IMSTESTMODE?
IMS Test Mode Disabled

AT!GSTATUS?
!GSTATUS: 
Current Time:  450		Temperature: 24

Reset Counter: 2		Mode:        ONLINE         
System mode:   LTE        	PS state:    Attached     
LTE band:      B20    		LTE bw:      10 MHz  
LTE Rx chan:   6400		LTE Tx chan: 24400
EMM state:     Registered     	Normal Service 
RRC state:     RRC Idle        
IMS reg state: REGISTERED      	IMS mode:    Normal       
IMS Srv State: FULL SMS,NO VoIP        

PCC Rx0 RSSI:  -69.8		PCC Rx0 RSRP:  -98.2
PCC Rx1 RSSI:  -66.8		PCC Rx1 RSRP:  -98.9
PCC Tx Power:  ---		TAC:         00d7 (215)
RSRQ (dB):     -11.0		Cell ID:     0082C48E (8569998)
SINR (dB):      3.4

NR5G band:       ---		NR5G bw:         ---		
NR5G Tx Power:   ---		NR5G Tx chan:    ---		
NR5G Rx chan:    ---		NR5G RSRP (dBm): ---		
NR5G RSRQ (dB):  ---		NR5G SINR (dB):  ---		


OK
4

Hi @jyijyi ,

Meanwhile I’ve also tested with a Vodafone SIM card, but the issue persists.

5

For the successful case with android, what is the APN used in android system?

If you send sms without +351, is it ok?

6

The APN on android, with WOO, is “umts”.

Meanwhile I’ve tested the lite-qmi-sms sample app, and I’m able to send SMS with it …

sudo ./lite-qmi-smshostx86_64

lite-qmi-sms v1.0.2503.0

Open transport “/dev/cdc-wdm0” on USB device in MBIM mode
Please select one of the following options or press ‘q’ to exit:
1.	Register for SMS Notification
2.	Query SMS Service Center
3.	Set SMS Service Center
4.	Query SMS List
5.	Query SMS Item
6.	Delete SMS
7.	Send SMS
8.	Send SMS CDMA
9.	Get SMS Routes
10.	Set SMS Routes
11.	Get SMS Protocol
12.	Modify message tag
13.	Get Sms Parameters
14.	Set Sms Parameters

(q)uit to exit: 

7

Please enter the parameter(s) for Send SMS:-P  --phone_number  (Mandatory)Phone Number string-M  --message  (Mandatory)Message string-Y  --asynchronous  (Mandatory)asynchronous send 0|1-I  --ims  (Optional)Send SMS on IMS 0|1

Or press  to cancel.-P 936386037 -M “hello” -Y 0 -I 0

Executing command 7 (custom): SendSms -P 936386037 -M hello -Y 0 -I 0

Phone Number: 936386037Message: helloSendSmsPdu ret: 0 Mask: 0x0006SMS successfully sent.

However, my application requires that we are able to send and receive SMS via AT commands.

7

If you send sms without +351, is it ok?

8

No, the +351 makes no difference.

9

When executing lite-qmi-sms, if IMS is enabled, sending of the message fails:

Executing command 7 (custom): SendSms -P 936386037 -M ‘hello 4’ -Y 0 -I 1

Phone Number: 936386037
Message: hello 4
SendSmsPdu errorCode: 1056 - The message could not be delivered
Message ID: 212
Message delivery failure type: 1
IMS reject cause Information: 501
Barring timer value in ms: 0
10

I am wondering if service centre number needs to be set in +csca

11

Is there any improvement if disable ims by +imstestmode?

I.e. enable ims test mode in +imstestmode

12

No, the modem / SIM recognizes the service center number automatically.
With the WOO SIM card (without manually setting the service center number):
AT+CSCA?
+CSCA: “+35193121314”,145

13

What if you enable ims test mode in +imstestmode?

14

If I enable IMSTESTMODE with AT+IMSTESTMODE=1, then I’m able to send SMS using AT+CMGS.

15

Could you explain why we need to enable IMSTESTMODE?

AT!IMSTESTMODE=1
OK
AT+COPS?
+COPS: 0,0,“WOO”,13

OK

AT!GSTATUS?
!GSTATUS:
Current Time:  1114		Temperature: 25

Reset Counter: 1		Mode:        ONLINE
System mode:   ENDC        	PS state:    Attached
LTE band:      B3     		LTE bw:      20 MHz
LTE Rx chan:   1500		LTE Tx chan: 19500
EMM state:     Registered     	Normal Service
RRC state:     RRC Connected
IMS reg state: NOT REGISTERED  	IMS mode:    Test
IMS Srv State: NO SMS,NO VoIP

PCC Rx0 RSSI:  -78.1		PCC Rx0 RSRP:  -111.7
PCC Rx1 RSSI:  -73.0		PCC Rx1 RSRP:  -113.6
PCC Rx2 RSSI:  -78.0		PCC Rx2 RSRP:  -114.9
PCC Rx3 RSSI:  -75.0		PCC Rx3 RSRP:  -119.9
PCC Tx Power:  22.0		TAC:         00d7 (215)
RSRQ (dB):     -14.1		Cell ID:     0082C4AC (8570028)
SINR (dB):      0.8
SCC1 NR5G band:       n78    	SCC1 NR5G bw:         100 MHz
SCC1 NR5G Tx Power:   23.0	SCC1 NR5G Tx chan:    644000
SCC1 NR5G Rx chan:    644000
SCC2 NR5G band:       n28    	SCC2 NR5G bw:         10 MHz
SCC2 NR5G Tx Power:   —	SCC2 NR5G Tx chan:    0
SCC2 NR5G Rx chan:    156600
NR5G RSRP (dBm): -109		NR5G RSRQ (dB):  -14
NR5G SINR (dB):   1.0

OK
AT+CMGF=1
OK
AT+CMGS=“+351936386037”

hi

+CMGS: 213
AT+CMGS=“936386037”

hi 3

+CMGS: 215
16

Maybe your network does not support sms over ims

17

My network supports sending SMS via RCS (which uses IMS). Also, I’ve tried 3 different mobile operators, so there must be some other root cause. Can we somehow add logging to debug why SMS over IMS is failing?

18

Then you need to contact distributor for network log analysis

19

I saw that in your +cgdcont, ims is set in 2nd profile, is it set by you?

20

Hi @jyijyi , no, that was set automatically.
I’ve contacted the mobile operator support and they are currently in the process of scaling the request to their system engineers to obtain delailed logs of the network core.
Their first line support told me that this symptom likely means that the modem is failing to negotiate the SIP Message protocol. They also told me that since this a consumer SIM card, the VoLTE/VoSMS profiles are optimized for Android/IOS.