Siemens TC35i AT+CNMI Mode 2 SMS Configuration: Firmware Fix

Overview: TC35i Cellular Engine and SMS Indication

The Siemens TC35i is a GSM 900/1800 MHz cellular engine designed for embedded M2M deployments. SMS handling on the TC35i is driven by AT commands per 3GPP TS 27.005 (Use of Data Terminal Equipment – Data Circuit terminating Equipment (DTE–DCE) interface for Short Message Service (SMS) and Cell Broadcast Service (CBS)) and 3GPP TS 27.007 (AT command set for User Equipment (UE)). Two settings dominate receive-side behavior: AT+CMGF selects the message format (PDU or Text), and AT+CNMI controls how the terminal routes incoming SMS-DELIVER, Cell Broadcast, and SMS-STATUS-REPORT indications to the host application.

On TC35i firmware Rev 4 (the version shipped in many legacy M2M units), the AT+CNMI command is restricted to (0-3),(0,1),(0,2,3),(0,2),(1) for the parameters <mode>,<mt>,<bm>,<ds>,<bfr>. This means <mt>=2 — direct forwarding of the message to the TE without intermediate storage — is not selectable on this firmware branch. The behavior is documented as a firmware limitation rather than a hardware constraint, and later Cinterion/Thales TC35i firmware builds handle the AT+CNMI parameter set differently. Engineers integrating SMS receive into PLCs, RTUs, or SCADA front-ends must work within the supported parameter envelope or upgrade the firmware. The practical symptoms reported in the field are twofold: AT+CNMI=2,2,0,0,1 returns ERROR, and AT+CMGL=REC UNREAD also returns ERROR when AT+CMGF has not been committed to text mode.

This reference details the parameter matrix, the exact behavior of AT+CMGL when format and stat are misaligned, the firmware update path, and a working AT+CNMI configuration that survives on Rev 4.

SMS Format Selection: AT+CMGF

The first decision on the SMS path is the message format. The TC35i supports two formats selected by AT+CMGF (3GPP TS 27.005 §3.2.1):

The format also changes the syntax of the AT+CMGL stat parameter. The mismatch between PDU-mode numeric stat and Text-mode string stat is the most common source of the "OK instead of message list" symptom reported in the field.

AT+CNMI Parameter Matrix

Per 3GPP TS 27.005 §3.4.1, the AT+CNMI command syntax is:

AT+CNMI=<mode>,<mt>,<bm>,<ds>,<bfr>

The crucial line is <mt>: TC35i Rev 4 only allows 0 or 1. A command like AT+CNMI=2,2,0,0,1 is rejected because the second token 2 is outside the firmware-allowed set. The terminal responds with +CME ERROR: 3 (Operation not allowed) on some firmware versions, or simply echoes ERROR without a numeric code on others.

Working AT+CNMI Configurations for TC35i Rev 4

For the typical SCADA polling pattern, AT+CNMI=0,1,0,0,1 is the safe default. The application receives a small unsolicited response code +CMTI: "SM",5 whenever a new message lands in slot 5 of the SIM, then issues AT+CMGR=5 to fetch the body.

Firmware Update Path for <mt>=2 Support

The TC35i firmware is field-upgradeable over its serial interface using a Siemens/Cinterion flash loader. The standard upgrade procedure is:

1. Confirm the exact module variant — TC35i, TC35i Terminal, or the related TC35/TC37/TC63. The flash image and loader versions are not interchangeable, and the band stack (GSM 900/1800 vs. 850/1900) is part of the image.
2. Request the current firmware from a Siemens/Cinterion distribution partner, or from MC Technologies (the long-standing TC35i specialist for European M2M customers).
3. Put the module in download mode: hold the IGT (ignition) line low while applying Vcc, or issue the proprietary AT^SUDL sequence on units that support it.
4. Transfer the image with the Siemens flash tool (typically T35DL for the bare engine or SxT for the Terminal variant) at 115200 bps. The handshake is AT\r followed by the loader's SYNC sequence.
5. Cycle power and verify with AT+CGMR that the new revision is reported. Also re-read AT+CNMI=? to confirm the new parameter range.

Newer firmware revisions on the TC35i Terminal platform extend AT+CNMI to include <mt>=2, but the exact build that opens the parameter up depends on the modem's IMEI range and the cellular band stack. Always check the Cinterion/Thales documentation portal for the specific release notes applicable to your hardware. The Siemens TC35i command reference published with the IGSS SCADA driver lists the supported AT+CNMI tuples by firmware branch.

AT+CMGL: Why "OK" Is Returned Instead of a Message List

The AT+CMGL=<stat> command per 3GPP TS 27.005 §3.3.1 lists messages from the currently selected storage matching the requested status. The crucial detail is that the syntax of <stat> is format-dependent:

When the host sends AT+CMGL=ALL while the modem is in PDU mode (CMGF=0), the token ALL is interpreted as stat=0 after the 3GPP numeric mapping rule. Many TC35i firmware builds silently coerce non-numeric tokens in PDU mode to stat=0 (REC UNREAD). If there are no REC UNREAD messages — for example, because all incoming SMS were already promoted to REC READ by a prior AT+CMGR — the response is the empty list:

OK

The terminal does not return +CMGL: ... headers because there is nothing to report. This is correct 3GPP behavior, not a fault.

When the host sends AT+CMGL=REC UNREAD while in Text mode, the result depends on the firmware's string handling. Rev 4 in Text mode accepts the string as a status filter, but the SCADA application in the original case had not yet executed AT+CMGF=1, leaving the modem in the factory default PDU mode. The string "REC UNREAD" then fails to parse as a number, and the terminal returns ERROR.

Diagnosing an Empty AT+CMGL Response

Follow this 60-second bench procedure with a known-good SIM and a network connection:

1. Send AT and confirm OK — proves UART, baud, and DTR/RTS framing.
2. Send AT+CMGF=1 and wait for OK.
3. Send AT+CPMS? to query the current storage preference. Expected: +CPMS: "SM",10,20,"SM",10,20,"SM",10,20 when SIM storage is selected.
4. Send AT+CMGL="ALL" in Text mode (or AT+CMGL=4 in PDU mode). One of:
   • +CMGL: 1,"REC READ","+49xxxxxxxxx",,"24/05/12,10:33:14+08" … OK — normal.
   • Just OK — empty filter; messages exist in another status bucket.
   • ERROR — format mismatch or unsupported token. Re-check CMGF and retry.
5. If OK is returned, send AT+CMGL="REC READ" / AT+CMGL=1 in the matching format. This isolates the failure to a stat filter, not a missing message.

Recommended SMS Receive Sequence for Rev 4

Use this verified sequence at the top of every SMS-receive application on TC35i Rev 4:

AT+CMGF=1
OK
AT+CPMS="SM","SM","SM"
+CPMS: 20,20,20,20,20,20
OK
AT+CNMI=0,1,0,0,1
OK
AT+CSCA="+491710760000"
OK

Then on each unsolicited +CMTI: "SM",<index>:

AT+CMGR=<index>
+CMGR: "REC UNREAD","+49xxxxxxxxx",,"24/05/12,10:33:14+08"
<body>
OK
AT+CMGD=<index>,0
OK

The AT+CMGD delete after read keeps the SIM inbox from filling. With a 20-message SIM capacity and 2-byte UDH overhead, a typical 160-character GSM 7-bit message uses one slot.

SMS Receive State Machine

Memory and Storage Management on the TC35i

The TC35i supports three storage areas selectable with AT+CPMS (3GPP TS 27.005 §3.2.2):

For SCADA and alarm dispatch, prefer "SM" for receive and "ME" for outbound drafts. The asymmetry gives you a permanent record of inbound alarms even if the application crashes between receipt and deletion, while keeping application-level templates resident in flash for faster re-issue after a power loss.

Troubleshooting Matrix

Field-Proven Edge Cases

1. Power-on reordering. On some TC35i Terminals, the unsolicited +CMTI lines are emitted before the application has a chance to issue AT+CMGF=1 after a power cycle. The proper fix is to buffer the first second of unsolicited output, then re-parse once the format is locked.

2. Long SMS (concatenated). A GSM 7-bit message above 160 characters is delivered as multiple SMS-SUBMIT segments with a User Data Header (UDH) carrying the concatenation reference. TC35i Rev 4 stores each segment as a separate +CMTI indication. The host must stitch them via the UDH's 8-bit reference and 8-bit part-number. Newer firmware revs can be set to AT+CNMI=2,2,0,0,1 so the modem does the stitching, but only when <mt>=2 is supported.

3. Class 0 flash SMS. TC35i treats class 0 messages as not stored regardless of AT+CNMI setting. They are delivered as +CMT only — which on Rev 4 means the application must accept the unsolicited line in real time. If your PLC's serial poll cycle is too slow, you lose the class 0 message. This is the strongest argument in favor of upgrading to a firmware that supports <mt>=2.

4. Multi-line +CMTI at boot. When the SIM was filled while the modem was powered off, the network re-delivers the backlog on the next attach. The TC35i can emit 10–20 +CMTI lines in a few hundred milliseconds. The host's UART ring buffer must be sized accordingly (≥ 4 KB recommended).

5. SMSC address. The Service Center Address stored on the SIM is the destination of every AT+CMGS. If the SIM is freshly provisioned or has been moved between devices, the AT+CSCA value may be missing or stale. The first AT+CMGS after a SIM swap should be preceded by an explicit AT+CSCA="+491710760000" (or your operator's number) to avoid +CMS ERROR: 500.

6. Auto-bauding trap. The TC35i's first AT after power-up negotiates the UART baud by measuring the character timing. If your application sends AT too early — before the modem's RDY unsolicited response — the modem locks to a wrong baud and every subsequent command returns ERROR. Always wait for RDY or the +CFUN: 1 callback before the first command.

Verification Procedure After Reconfiguration

1. Send a test SMS from a handset to the SIM's MSISDN.
2. Within 5–10 s, observe +CMTI: "SM",<idx> on the serial line.
3. Issue AT+CMGR=<idx>. Confirm the body matches the test text byte-for-byte.
4. Issue AT+CMGD=<idx>,0 to clear the slot.
5. Send an SMS from the modem with AT+CMGS="+49xxxxxxxxx"<CR>test<Ctrl-Z>. Confirm the handset receives it.
6. Send a concatenated (long) SMS from a handset. Verify all segments are received and the host can reassemble by UDH reference.
7. Force a power cycle, then repeat steps 1–5 to confirm non-volatile behavior.
8. Query AT+CPMS? and confirm used < total in all three memory areas.
9. Query AT+CNMI? and confirm the value committed to NVRAM matches the boot value you expect.

If any step fails, return to the AT+CMGF and AT+CNMI defaults in the recommended sequence and re-run the diagnostic.

TC35i Variant Comparison

Hardware Interface Notes

The TC35i presents a 3.3 V CMOS UART. Common host-side mistakes on the wiring side mimic AT command issues:

• Logic level: The serial pins are 3.3 V CMOS, not 5 V tolerant. Connecting directly to an RS-232 transceiver's TTL side is correct, but a 5 V MCU's UART will exceed Vih on the TC35i's RX line and cause intermittent framing errors that look like ERROR on every other command.
• Baud: The factory default is 9600 8N1 with autobaud. After the first AT, the modem latches to that rate. To change, issue AT+IPR=115200 and save with AT&W. Power-cycle to confirm the new rate stuck.
• IGT line: Ignition (pin 1) must be pulsed low for at least 100 ms to start the module. Holding it low continuously will not start the module; the pulse triggers an internal latch.
• EMERG_RST: A 10 s low pulse on the EMERG_RST pin forces a hard reset. Use only as a last resort, because it can corrupt the internal flash if held mid-write.
• Power supply: The TC35i draws up to 2.0 A in brief bursts during the GSM transmit slots. A supply that averages 1.5 A but cannot sustain 2.0 A for 577 µs will cause voltage drops that the modem interprets as power-loss, and the unit will spontaneously reboot. Use a low-ESR bulk capacitor (≥ 470 µF) close to the module's VBAT pins.

Downstream Integration: PLC and SCADA Notes

The TC35i is most often coupled to a Siemens S7-200/300, an Allen-Bradley MicroLogix/CompactLogix, or a Schneider M340 PLC over a free-port or Modbus RTU link. Some practical integration points:

• On S7-200 with the Siemens TC35i Terminal variant, configure the freeport on the same baud (default 9600) and use an RCV message to capture +CMTI lines. The S7-200 has no native regex, so the application FB parses the line by fixed-offset string search for the comma and the trailing CR/LF.
• On CompactLogix with a Prosoft or Proface gateway, the gateway can run the AT command stack and present SMS as Modbus registers (e.g. 400001 = latest +CMTI index, 400100–400139 = ASCII body, 400200 = body length).
• On M340, the BMX NOM module's SMS library wraps the AT commands, so the PLC programmer never sees AT+CNMI directly — but the underlying modem still enforces the firmware limits described above. The library defaults to AT+CNMI=0,1,0,0,1 and a polling scan on AT+CMGL="ALL" in text mode.

The Schneider Electric IGSS SCADA driver for the TC35i (referenced in the IGSS TC35i command guide) implements the recommended sequence above as the driver default and surfaces the new-message event as an IGSS message class.

Standards and Reference Documents

• 3GPP TS 27.005 — SMS AT command reference; defines CMGF, CMGL, CMGR, CMGS, CNMI, CPMS.
• 3GPP TS 27.007 — General AT command set; defines CSCS, CREG, CPIN.
• 3GPP TS 24.011 — SMS on the air interface; defines the SMSC address and the TON/NPI encoding used by AT+CSCA.
• ITU-T V.250 — DTE-DCE serial AT command syntax baseline.
• Cinterion/Thales documentation portal — TC35i firmware release notes and band-stack release index.
• Schneider Electric IGSS — Siemens TC35i command guide — practical AT+CNMI tuples and SCADA integration notes.

Frequently Asked Questions