Using SIM7020E to Connect to 1NCE NB-IoT Network

The SIM7020E board

So after checking out Sigfox and while still waiting for LoRaWAN parts, I got this nice 3.3V and 5V-capable SIM7020E board which is supposedly made by Electrodragon.

Here are links related to the board, some of which do not offer much information, but which I have added for completeness:

Simcom -- Manufacturer of the main chip, but not necessarily the board. In their documentation area you can download Hardware Design and latest AT Command Guide etc. after registration (free).

Simcom (other website) -- Manufacturer (see above). Some additional/different documentation here. You have to register a second time, apparently.

Amazon (Spanish reseller for Electrodragon, quick delivery through Amazon)

CNX-Software Blog post (no hands on details)

Electrodragon Wiki (real command responses with China network, using firmware B03 at the time)

The board supports the European NB-IoT LTE bands e.g. band 8 used by Deutsche Telekom.

Other (i.e. different PCB and components) boards with SIM7020E (the SIM7020C is for China) can be found on Aliexpress. Let me know if you have any of them working in Germany!

So far, I am talking to the board via Serial Passthrough of a nice 3.3v Seeedstudio Aduino. But the plan is to send measurement and other data from a Calliope Mini or Micro:Bit to "the Internet" via this board.

This SIM7020E board has a Micro USB interface. It registers as MTK (MediaTek Inc.) USB Debug und Modem Ports on a Windows system (given the right MTK USB drivers). The MTK chipset is not supported by macOS out of the box (let me know if you have seen macOS drivers).
Only one of the ports seems to be useful and it provides debugging data i.e. you can see power button press events.

Words of caution

• Always observe voltage requirements and limits of the things you wire together. The board in the picture above has different pins for 3.3v and 5v, but other boards may only accept 3.3v or 5v. Be sure to check what the USB/Serial or microcontroller you use requires.
• Power requirements are less problematic in so far that if you provide too little, the board will just shut down without warning (see below).

The NB-IoT provider/operator

As NB-IoT providers/operators in Germany I looked into the offers from Vodafone, Telefonica and Deutsche Telekom. It looks like only Telefonica and the Telekom subsidiary 1NCE allow or online ordering of NB-IoT SIM cards.

If you know how to order a NB-IoT SIM from Vodafone without going through a call center or fax machine, please let me know, I'd like to compare coverage for my use cases.

SIM ordering and delivery from 1NCE was effortless and quick.

1NCE FAQ (answered my question on the band to use).

If you know of other providers that have NB-IoT SIM cards and NB-IoT roaming agreements in Germany, please let me know!

Observations so far

• The LED is the "Net+ LED" aka Network LED. I have found the following behavior specification:
  64ms on, 800ms off - Network scanning, not registered
  64ms on, 3000ms off - Registered network (PS service)
  64ms on, 300ms off - Data communication
  OFF - Power off or in PSM mode
  The fast blinking "Data communication" can be triggered by creating a socket e.g. AT+CSOC=1,1,1 even without the device being attached to a network, so it is not a real indicator of data transfer over the network.
• The software revision can be queried with AT+GMR and I get 1752B05SIM7020E.
  As stated below, I have received a firmware update to B07, which is the most current as of December 12.
• Use AT+CMEE=2 to set/enable more verbose error messages.
• the board may need more power than your microcontroller can provide. The hardware design PDF from Simcom mentions 500mA, but I am unsure about the peak power consumption. So it is recommended to hook up a 3.7v LiPo directly. Make sure you ground the LiPo with your microcontroller, otherwise AT commands via two-wire serial may be garbled. Battery level of the attached LiPo can be queried with AT+CBC. I get a result of +CBC: 0,4122 for a charged 3.7v LiPo.
  A different board I have (from AND Global, see below) requires 3.3V (i.e. will not directly accept a LiPo) and will shut down from lack of power while trying to register with network when only provided with ca. 200mA, so peak consumption seems to me more than that.
  If the board shuts down on you "for no reason", it is probably lack of power.
• Deutsche Telekom uses band 8 for NB-IoT. As far as I can tell, Vodafone as well. So use an antenna that works well in the 900MHz range. The AT Command Guide states that AT+CBAND takes integers, but for me, AT+CBAND=8 results in +CME ERROR: invalid input value. But AT+CBAND="8" will return OK.
  This behavior has changed with firmware B07, AT+CBAND=8 now works.
• When the SIM card is inserted, you should be able to query its IMSI with AT+CIMI to verify that the SIM7020E can "see" the SIM. The 1NCE SIM cards start with 90140 not with 26201 and will "roam" with the Telekom network. It will also roam with Vodafone and others, but not for NB-IoT (at the time of writing according to their FAQ). AT+GSN is used to query the IMEI of the SIM7020E, you may want to compare to what you see in the NB-IoT provider backend if you have multiple SIM.
• The APN for 1NCE is set with AT+CGDCONT=1,"IP","iot.1nce.net". There is also the related command AT+CSGACT=1,1,"iot.1nce.net" which may or may not be required additionally.
• AT+CREG=2 will request unsolicited status updates of the registration status. This means, the SIM7020E will output +CREG: <number> messages whenever something changes. You will want to enable this for troubleshooting (but probably disable for production). At the moment, I see the SIM7020E switching between 0 (got nothing, doing nothing) and 2 (got nothing, but searching), but I should get 5 (Registered, roaming).
• AT+COPS=? is supposed to return a list of network providers. It always takes a while to execute, so be patient. For me, I often get nothing at all.
  Example results:
  +COPS: (1,"26201","26201","26201",9),,(0-4),(0-2) means the Deutsche Telekom network (26201) is available for registration (1 at the beginning)
  +COPS: (1,"26202","26202","26202",9),,(0-4),(0-2) means the same for Vodafone
  +COPS: (3,"26201","26201","26201",9),,(0-4),(0-2) means the Deutsche Telekom network can be seen, but is denied for registration (i.e. your SIM may not roam there)
• AT+CSQ is supposed to return the signal quality. For me, the results do not seem to follow the documentation. I mostly get +CSQ: 0,0 while at the same time the 1NCE backend shows the SIM Session Status as Attached with Network GPRS.
  I have also seen +CSQ: 4,0 and +CSQ: 12,0 and +CSQ: 17,0 but I have never seen 0,99 or 99,99 as is often documented as meaning no signal.
• AT+CENG? is supposed to return information about the reachable network cells. After start, the SIM7020E will return +CME ERROR: In cell search state
  I have also seen the following, but at the moment I usually get +CME ERROR: No Service state for reasons unknown.
  +CENG: 6290,3,26,"0050FF65",-96,-6,-90,9,20,"A757",0,
+CENG: 3740,0,486,"019C3109",-134,-22,-112,-9,8,"D70A",2,230
+CENG: 6290,3,237,"0060D566",-85,-6,-78,8,20,"A777",0,(these cells are in the north of Hamburg, if you can tell me more about their positions or other, please let me know)
  With firmware B07 I have also seen the error message +CME ERROR: ERRC is deactivated, but I do not know if this is an issue or just FYI.
• The 1NCE portal/backend will show the SIM card as Session Status ATTACHED on Network GPRS and it will show location updates like this:
  New location received from SGSN for IMSI='90140nnn', now attached to SGSN='49151.VSNHAN22.epc.mnc001.mcc262.3gppnetwork.org', IP='0.0.0.0'. or
  New location received from SGSN for IMSI='90140nnn', now attached to SGSN='49151.VSNLPZ22.epc.mnc001.mcc262.3gppnetwork.org', IP='0.0.0.0'
  However, it will not show the IMEI.
  Testing with a normal smartphone (you have to enter the APN manually and enable roaming!) showed different location updates (due to not using the NB-IOT backend) with a proper IP. The IMEI used will be shown.
• Sending SMS should be possible as the SIM7020E supports sending SMS in PDU mode.
  A PDU encoder/decoder can be found here: http://rednaxela.net/pdu.php
  You can look up the SMSC with AT&V command.
  After entering the AT+CMGS=nn command, you will get a > prompt, enter the Hex String and then ctrl-z to send.
• At first I suspected that I have very bad coverage or no NB-IoT coverage. However a test near the city center has not given better/different results. 1NCE has stated that I should have sufficient coverage at my location, but there is the possibility they mean 2G and not NB-IOT.
• I have opened a support call with 1NCE to see if they can find any issues on their end. So far they have been very helpful, but were not able to identify any issue on their side.
• Testing a Vodafone SIM does not seem to be an option as they do not seem to have a process of just selling one NB-IOT SIM (yet). If you have a contact at Vodafone Germany that knows how to sell one NB-IOT SIM, let me know.
• I have tried three different antennae and have ensured proper input power (also see above what happens if you don't).
• I have addressed my questions on the documentation to Simcom and received a firmware update to B07 which I will now attempt to install on this board.
• Firmware updates need to be done via UART2 of the SIM7020, which unfortunately is not led out on this board, so that it is required to solder wires to Pin 22 and 23.
  Asking UART2 for AT&V will give the same answer as UART1.
  The hardware design states "When using UART2 for downloading software, the band rate is 921600bps, please pay attention to the device’s speed support.", so you must use a USB/Serial/TTL interface that is fast enough. I recommend that you use a FTDI based USB/Serial to avoid bizarre compatibility issues.
• An other quite small (but not as small) breakout board for SIM7020E is manufactured by AND Global and sold via AliExpress. It ships with firmware B07 as of December 2018. The good thing about it is that it has UART2 led out for easier access, the drawback is that it requires 3.3v and so you can not hook it up to a LiPo directly. It may require more power (mA) than your microcontroller board can provide and you'll need to find a solution for that.

Let me know any tips or helpful remarks in the comments, thanks!