R305 AT Command Manual - wless.ru

TelegesisTG-ETRXn-R305-AT-CommandsETRX2 and ETRX3 series AT-Command Dictionary 3.05ETRX2 and ETRX3 Series ZigBee® ModulesAT-Command DictionaryAT-Command DictionaryCurrent Firmware R305©2011 Telegesis (UK) Ltd AT Command Manual October 2011 (Rev 3.05)

R305 AT CommandsTable of Contents1 INTRODUCTION ................................................................................................................. 31.1 Document Overview ......................................................................................................... 31.2 Network topology ............................................................................................................. 41.3 A Note on ZigBee ® Compliance ....................................................................................... 41.4 Important notes ................................................................................................................ 41.4.1 Hardware compatibility ..................................................................................................... 41.4.2 Unexpected start-up in bootloader mode .......................................................................... 41.4.3 Compatibility with other devices ....................................................................................... 51.4.4 Persistence of network parameters .................................................................................. 52 AT STYLE COMMAND CONVENTIONS ............................................................................ 52.1 Parameters ...................................................................................................................... 62.2 Prompt Overview.............................................................................................................. 72.3 Device Overview .............................................................................................................. 92.3.1 ZigBee types .................................................................................................................... 92.3.2 Non-ZigBee types ............................................................................................................ 92.4 AT Command Overview ................................................................................................. 102.5 Module Control & Configuration Commands .................................................................. 122.6 Network Control & Configuration Commands ................................................................. 182.7 Messaging...................................................................................................................... 333 LIST OF ERROR CODES ................................................................................................. 464 S-REGISTERS .................................................................................................................. 484.1 Recovery of the Factory Default Settings ....................................................................... 504.2 S-Registers for Network Setup ....................................................................................... 514.3 S-Registers for Module Setup ........................................................................................ 564.4 I/O related S-Registers ................................................................................................... 624.5 S-Registers Defining the Functionality of the Module ..................................................... 724.6 Advanced Settings ......................................................................................................... 865 BUILD IN FUNCTIONALITY ............................................................................................. 946 ETRX2 POWER CONSUMPTION ..................................................................................... 967 ETRX357 POWER CONSUMPTION (PROVISIONAL DATA) .......................................... 978 NOTES ON ENERGY LEVELS AND LQI ......................................................................... 988.1 Interpreting LQI .............................................................................................................. 988.2 Interpreting RSSI Energy Levels .................................................................................... 999 UPGRADING FROM R2XX TO R305 ON THE ETRX2 SERIES ..................................... 10010 TRADEMARKS ............................................................................................................... 10111 DISCLAIMER .................................................................................................................. 10112 CONTACT INFORMATION ............................................................................................. 10113 REFERENCES ................................................................................................................ 10114 APPENDIX A. FORMING A SECURE NETWORK ........................................................ 102©2011 Telegesis (UK) Ltd - 2 - AT Command Manual (Rev 3.05)

R305 AT Commands1 IntroductionThis document describes the AT-Command interface firmware of the ETRX2 and ETRX3 seriesZigBee PRO wireless meshing modules. It applies to the R305 firmware, which can be loaded onto all products of the ETRX2 and ETRX3 module series, for example:-ETRX2, ETRX2-PA, ETRX2HR, ETRX2HR-PA-ETRX2USB- ETRX2CF- ETRX2EAP and ETRX2RTR- ETRX351, ETRX357, ETRX351-LR, ETRX357-LR, ETRX351-LRS, ETRX357-LRS- ETRX351HR, ETRX357HR, ETRX351HR-LR, ETRX357HR-LR, ETRX351HR-LRS,ETRX357HR-LRSThe Telegesis ZigBee modules have been designed to be built into any device and provide a lowcost, low power ZigBee solution based on the industry leading EmberZNet ZigBee stack.Integration into a wide range of applications is made easy using a simple AT-style softwareinterface and advanced hardware design.No RF experience or expertise is required to add this powerful wireless networking capability toyour products. Telegesis ZigBee Modules fast integration opportunities and the shortest possibletime to market for your product.Important noteUsing the AT-Command interface described in this document can shorten the time to marketsignificantly, however customers using the range of Telegesis modules also have the option ofusing Ember‟s EZSP interface firmware or of developing custom firmware using the EmberDevelopment tools.1.1 Document OverviewThis document is meant as an AT-Command and S-Register reference for R3xx revisions of thefirmware based on EmberZNet3.x and EmberZNet4.x. In order to learn how your products canbenefit from wireless mesh networking please also refer to the following documents:ETRX2/3 Product ManualsR3xx Firmware User GuideMigration guide for existing R2xx firmware customersETRX2/3 Development Kit User GuidesApplication notes from www.telegesis.comThe ETRX2/3 Product Manuals concentrate on the hardware specification of the modules. TheDevelopment Kit Product Manuals contain all of the information required to set up yourdevelopment kit and run firmware upgrades where necessary.©2011 Telegesis (UK) Ltd - 3 - AT Command Manual (Rev 3.05)

R305 AT Commands1.2 Network topologyA network consists of a ZigBee Coordinator (ZC) which started the network, ZigBee Routers (ZR)and ZigBee End Devices (ZED). There do not have to be any routers (other than the coordinator,which functions as a router) or end devices in any given network. Each router can support up to16 end devices (32 on the ETRX3 series) in any combination of non-sleepy, sleepy and mobileEnd Devices. The network is always formed as a mesh according to the ZigBee PRO featureset ofthe ZigBee standard; the tree structure is not available.By default the module joins a PAN as a router, but modifying register S0A allows you to define it asan end device. The coordinator is simply the device that first establishes the PAN, and it shouldnot be allowed to leave the PAN as it is not possible for a node that is already joined to the PAN totake over the role of a coordinator or Trust Centre.1.3 A Note on ZigBee ® ComplianceThe Telegesis R300 firmware has been tested and certified for MSP (manufacturer specific profile)compliance by a test house appointed by the ZigBee Alliance.This certification includes tests guaranteeing that:- Modules running the Telegesis AT-Command set will not interfere with existing ZigBeeNetworks in a malicious way- Modules running the Telegesis AT-Command set can join a 3rd party ZigBee PRO networkand use its routing capabilities- Modules running the Telegesis AT-Command set can allow 3rd party nodes to join into anetwork consisting of Telegesis nodes and use its routing capabilitiesIn addition to implementing a manufacturer specific application profile the AT-Command set allowsfor transparency allowing communication with 3 rd party nodes running any public applicationprofile. In addition to this a transparent endpoint has been added allowing a host processor toimplement any public application profile in fully transparent mode.If you want to use the term ZigBee or the ZigBee Logo in your product documentation the currentregulations state that you have to(i) Be at least an adopting member of the ZigBee Alliance in the year you release your product(ii) Implement a public application profileIf you intend to get your product certified feel free to contact Telegesis for additional information.Also if you intend to build a product compliant to a public application profile (e.g. HomeAutomation, Smart Energy) feel free to contact us to discuss your options.1.4 Important notes1.4.1 Hardware compatibilityR305 firmware will now run on the STRX2 series of modules.R2xx firmware will not run on the ETRX3 series of modules.1.4.2 Unexpected start-up in bootloader modeThe bootloader on the ETRX2 can be triggered using the command AT+BLOAD as described inSection 2, but it can also be triggered in hardware. If the A/D2 pin is pulled low during the boot-upof the module, the module will also enter the bootloader, so exercise caution when doing hardware©2011 Telegesis (UK) Ltd - 4 - AT Command Manual (Rev 3.05)

R305 AT Commandsdesign and ensure that this pin is not grounded during start-up and reset. If unused the pad canbe left floating and a pull-up is not required.In analogy to this pulling down PA5 during a reset will cause an ETRX3 series module to enter thebootloader.1.4.3 Compatibility with other devicesMost features of the R3xx Telegesis AT-Command line Interpreter are part of a ManufacturerSpecific Profile using the ZigBee PRO feature set of ZigBee 2007. Interoperability with otherdevices that use the ZigBee PRO featureset is limited to a number of transparent commands.R3xx is not compatible with earlier versions of ZigBee which are not implementing the ZigBee PROfeatureset, including Telegesis R2xx firmware. Also, it is not compatible with the ZigBee SmartEnergy profile as it lacks the required security key.1.4.4 Persistence of network parametersOnce a device has joined a network as a coordinator, router or end device, it will retain its networkparameters if it is powered off and on again. It will still be a member of its original PAN, assumingthat PAN still exists, though an end device may need to find a new parent and it may have missedan update of the network key. Certain S-registers will have been reset to default values, though,which may change an end device‟s power mode for example.2 AT Style Command ConventionsTo simplify the communication with the modules, an AT-style command set, similar to the industrystandard Hayes modem control language, is used.Each command must be preceded by the "AT" or "at" prefix. To terminate a command enter. Any data not following this pattern is either not accepted by the module or will cause anerror message in response. Every command must be terminated with a , they cannot beconcatenated.Commands are followed by an optional response that includes and/or a prompt where the prompt could also be an errormessage.Example:ATS00?FFFFOKIt is recommended to wait for an “OK” or “ERROR:XX” prompt before issuing the next command.Any data which is prompted to the user is delivered in the format .Unless disabled in S0E or S0F prompts may appear whenever the corresponding event occurs.Example:A prompt intersecting a command being entered will not affect the command itself.©2011 Telegesis (UK) Ltd - 5 - AT Command Manual (Rev 3.05)

R305 AT CommandsThroughout this document, only the responses and prompts are presented, are omittedintentionally. Sequences of AT commands in a single line are not supported.The ETRX2 and ETRX357 feature a 128-byte FIFO to buffer incoming characters from the hostprocessor, which is sufficient to hold even the longest possible command. The ETRX357 featuresa 256 byte FIFO buffer for incoming radio messages, which allows rapid reception of multiplemessages without loss of characters. To prevent a buffer overflow XON/XOFF handshaking isused. Optional hardware handshaking can be enabled as described in the register description ofS12 in section 4.Read CommandATXXX?Write CommandATXXX=Execute CommandATXXXCommands ending with a „?‟ return the currently set value of theparameter or parametersThis command sets user-definable parameters as indicated bythe „=‟ sign.This command executes routines of the module and returnsparametersTable 1: Types of AT commandsWhen bit 7 of S12 is set each individual reply or prompt is additionally started with the STX andended with the ETX character to aid the interpretation of the incoming strings on a host processor.2.1 ParametersEach parameter must be entered in the correct format for any of the AT commands to executecorrectly. Optional parameters are marked with square brackets […].XX8-bit hexadecimal number. Valid characters are 0-9, a-f and A-FXXXX16-bit hexadecimal number. Valid characters are 0-9, a-f and A-Fn Number from 0-9sSignb Bit (0 or 1)ccharacter16-bit hexadecimal PAN ID (0000 to FFFF)64-bit hexadecimal extended PAN ID decimal channel (802.15.4 channel 11-26)8 character password64-bit IEEE 802.15.4 address in hexadecimal32-bit hexadecimal number representing the reading of S1ACustom DataA list of 16 bit cluster identifiers in hexadecimal representation The Firmware Revision NumberTable 2: Different formats of parameters©2011 Telegesis (UK) Ltd - 6 - AT Command Manual (Rev 3.05)

R305 AT Commands2.2 Prompt OverviewThe following prompts can show up during the operation of the ETRXn modules. Most of theprompts can be disabled using register S0E and S0F.Prompt OverviewOKOK terminatorERROR:XXError number XX occurredACK:XXAcknowledgement for message XX was receivedNACK:XXAcknowledgement for message no XX was notreceivedSR:XX,,,…Route Record Message receivedBCAST:[,]XX=A Broadcast with XX characters has beenreceivedMCAST:[,]XX=A Multicast with XX characters has been receivedUCAST:[,]XX=A Unicast with XX characters has been receivedSDATA:[,],,,, A data message has been received at the sink.,ADC data is A/D1 & A/D2 or ADC0 & ADC1FN0130:[],,,,,[],[],[],[]A data message has been received at the sink.The number of ADC data fields depends on howmany ADCs are activated at the senderCOO:,A coordinator announcing itselfFFD:,A router announcing itselfSED:,A sleepy end device announcing itselfMED:,A mobile sleepy end device announcing itselfZED:,An end device announcing itselfNEWNODE: ,,Shown on Coordinator: New node has joined thePANLeftPANLocal Node has left the PANLostPANEnd Device has lost contact with ParentJPAN:,,Local Node has joined PAN with given parametersSINK:,Selected new SinkADSK:,Received Sink AdvertisementSREAD:,,, Reply to a remote S Register Read operation[=]SWRITE:,, Reply to a remote S Register Write operation©2011 Telegesis (UK) Ltd - 7 - AT Command Manual (Rev 3.05)

R305 AT CommandsPrompt OverviewDataMODE:,Datamode has been opened remotelyDataMODE:,, Response to an attempt to open data modeOPENData mode is openCLOSEDData mode is closedTRACK:,,,,,,,Tracking message: EUIs of receiver and sender,RSSI, input data, Vcc & S46 counter of senderTRACK2:,,,,Tracking message: EUIs of receiver and sender,RSSI, I/O data, and S46 counter of senderPWRCHANGE:XXXXLocal node has changed Power Mode to XXXXAddrResp:[,,] Response to an address request (also triggeredwhen finding source routes)RX:,,,An incoming message not addressed to the AT,, command endpoint. EUI64 is only shown if,:included in network frame headerNM:ES REPORT WARNINGMore than 16 energy scan reports have beenrecently received by the network managerindicating high packet lossENTERING BLOADPassthrough bootloading has been initiated fromanother nodeTable 3: Prompt Overview©2011 Telegesis (UK) Ltd - 8 - AT Command Manual (Rev 3.05)

R305 AT Commands2.3 Device Overview2.3.1 ZigBee typesTable 4 gives an overview of the ZigBee device types mentioned in this document.Device TypesZigBee Naming ConventionCOO Coordinator ZigBee Coordinator (ZC)FFD Router ZigBee Router (ZR)ZEDEnd Device (non sleepy)SEDSleepy End DeviceZigBee End Device (ZED)MEDMobile Sleepy end DeviceTable 4: Device OverviewThe terms Full Function device (FFD) and Reduced Function Device (RFD) are obsolete, but theabbreviations are retained in the R302X firmware to avoid problems with users‟ legacy applicationsoftware.Each ETRX2 coordinator or router can support up to 16 End Devices, in any combination of SleepyEnd Devices and Mobile End Devices, and an ETRX357 can support 32.Only end devices should be put into a low-power state because routers and the coordinator mustalways be powered up to maintain the network connectivity. ZigBee End Devices do not poll fordata, instead their incoming messages are relayed immediately by their parent without beingbuffered. This means that ZEDs must not be put into a sleep mode.2.3.2 Non-ZigBee typesSink. The sink is a Telegesis feature. When a node is defined as a sink by setting S10 bit 4, itcan broadcast its address to the rest of the network. Other nodes can then send messages to thesink node using AT+SCAST or various built-in functions. This simplifies the application softwaresince it is not necessary to know the EUI64 of the sink in advance. Devices discover the sinkwhen (1) they receive a regular advertisement broadcast from the sink (2) they are commanded tosend a message without knowing the sink address and bit 8 of S10 is set (the first sink-castmessage is therefore lost (3) the AT+SSINK command is used. To reduce traffic to end devicesthey do not receive the advertisement broadcasts, but will be informed of the sink address whenthey join the PAN. Otherwise, you should set bit 8 of S10 on end devices.©2011 Telegesis (UK) Ltd - 9 - AT Command Manual (Rev 3.05)

R305 AT Commands2.4 AT Command OverviewThe following table gives a quick reference of all commands available.Command OverviewModule control and configurationATIDisplay Product Identification InformationATZSoftware ResetAT&FRestore Factory DefaultsAT+BLOADEnter The Bootloader MenuAT+CLONEClone Local Node To Remote Node (ETRX2 Series Only)AT+PASSTHROUGH Pass new Firmware Image To Remote Node (ETRX3 Series Only)AT+RECOVER Recover From A Failed Clone AttemptATSS-Register AccessATREMSRemote S-Register AccessATSALLRemote S-Register AccessAT+TOKDUMP Display All S-RegistersNetwork control and configurationAT+ESCANScan The Energy Of All ChannelsAT+PANSCAN Scan For Active PansAT+ENEstablish Personal Area NetworkAT+JNJoin NetworkAT+JPANJoin Specific PanAT+SJNSilent JoinAT+DASSLDisassociate Local Device From PanAT+DASSR Disassociate Remote Node From PAN (ZDO)AT+NDisplay Network InformationAT+NTABLE Display Neighbour Table (ZDO)AT+RTABLE Display Routing Table (ZDO)AT+IDREQ Request Node’s NodeID (ZDO)AT+EUIREQ Request Node’s EUI (ZDO)AT+NODEDESC Request Node’s Descriptor (ZDO)AT+POWERDESC Request Node’s Power Descriptor (ZDO)AT+ACTEPDESC Request Node’s Active Endpoint List (ZDO)AT+SIMPLEDESC Request Endpoint’s Simple Descriptor (ZDO)AT+MATCHREQ Find Nodes which Match a Specific Descriptor (ZDO)AT+ANNCE Announce Local Device in the Network (ZDO)AT+SRSet Source Route To Remote DeviceAT+FNDSRFind The Source Route To A Remote DeviceAT+POLLPoll For Data From ParentAT+REJOIN Rejoin The NetworkAT+SNScan NetworkAT+KEYUPD Update the Network Key (ZDO)AT+BECOMETC Make Local Device the Trust CentreAT+BECOMENM Make the local device Network ManagerAT+CCHANGE Change the network’s channel©2011 Telegesis (UK) Ltd - 10 - AT Command Manual (Rev 3.05)

R305 AT CommandsCommand Overview (continued)MessagingAT+ATABLE Display Address TableAT+ASETSet Address Table EntryAT+MTABLE Display Multicast TableAT+MSETSet Multicast Table EntryAT+BCASTTransmit A BroadcastAT+BCASTB Transmit A Broadcast Of Binary DataAT+UCASTTransmit A UnicastAT+UCASTB Transmit A Unicast Of Binary DataAT+SCASTTransmit Data To The SinkAT+SCASTB Transmit Binary Data To The SinkAT+SSINKSearch For A SinkAT+MCASTTransmit A MulticastAT+MCASTB Transmit A Multicast Of Binary DataAT+DMODE Enter Data Mode (Serial Link Mode)+++ Leave Data ModeAT+IDENTPlay A Tune On Remote DevboardAT+RDATAB Send Binary Raw DataTable 5: Command Overview©2011 Telegesis (UK) Ltd - 11 - AT Command Manual (Rev 3.05)

R305 AT Commands2.5 Module Control & Configuration CommandsI – Display Product Identification InformationExecute CommandATIResponseTelegesis ROKNoteOn modules manufactured before summer2007 an invalid is displayed.This does not affect the functionality of themodule.Where is the order code of thedevice, is the firmwarerevision and is the Device‟s IEEE802.15.4 identifierSW release R300 ●Z – Software ResetExecute CommandATZResponseModule Performs a software resetAll non-volatile S Registers keep the user definedvalues, if the module was part of a PAN it willremain part of it.SW release R300 ●&F – Restore Factory DefaultsExecute CommandAT&FResponseModule Performs a factory resetAll non-volatile S Registers are updated with theirfactory defaults and the node leaves the network itis currently joined to.SW release R300 ●+BLOAD – Enter The Bootloader MenuExecute CommandAT+BLOADResponseThe device leaves the AT command line andenters the bootloader menu for downloading newfirmware.A description of the bootloading process can befound in the Development Kit Product Manual.Please note that the bootloader will run at abaudrate of 115k2, no parity, 8 data bits regardlessof the current serial port settings.SW release R300 ●©2011 Telegesis (UK) Ltd - 12 - AT Command Manual (Rev 3.05)

R305 AT Commands+CLONE – Clone Local Node To Remote Node (ETRX2 Series only)Execute CommandResponseAT+CLONE:, Cloning…Use on:Source: FFD, COODestination: All device typesNotesThe default password for R3xx nodes is“password”.A description of the cloning process can befound in the Development Kit ProductManual.Remote ResponseENTERING BLOADorERRORWhere represents the error codeexplained in section 3.This command clones the firmware of the localnode to a remote node within the same PAN,whose address is given by . represents the remote node‟s8-character password. After completion a softreset is caused on the remote end.SW release R304 ●+PASSTHROUGH – Pass new Firmware Image To Remote Node (ETRX3 Series Only)Execute CommandResponseAT+PASSTHROUGH:,PASSTHROUGH BLOAD...Use on:Source: FFD, COODestination: FFD, COONotesThe default password for R3xx nodes is“password”.A description of the passthrough process canbe found in the Development Kit ProductManual; it is the same procedure as cloning.The ETRX357(HR)-LRS module cannot bereliably upgraded by the passthough processPlease start .ebl upload image...Remote ResponseENTERING BLOADorERRORWhere represents the error codeexplained in section 3. represents the remote node‟s8-character password. After completion a softreset is caused on the remote end.SW release R304 ●©2011 Telegesis (UK) Ltd - 13 - AT Command Manual (Rev 3.05)

R305 AT Commands+RECOVER – Recover From A Failed Clone or Passthrough AttemptExecute CommandResponseAT+RECOVERRecovering…Use on:Source: FFD, COODestination: All device typesorNoteUse this command in cases where thecloning (ETRX2 Series) or PassthroughBootloading (ETRX3 Series) operation wasinterrupted and the target device thereforeremains in the bootloader. In case the targetdevice has been reset channel 13 must beused for recovering.For more information on over-the-airfirmware upgrading please refer to theDevelopment Kit Manual.ERRORWhere represents the error codeexplained in section 3.Enters clone (ETRX2 Series) or Passthrough(ETRX2 Series) mode to a remote node which isalready in the bootloader.SW release R300 ●©2011 Telegesis (UK) Ltd - 14 - AT Command Manual (Rev 3.05)

R305 AT CommandsS – S-Register AccessRead CommandATSXX[x[x]]?ExamplesATS00?ATS0AE?ATS1812?XX is the S-Register which is to be read.As an option for all 16 bit registers it is alsopossible to address an individual bit only byspecifying the bit number [x]. For all 32 bitregisters it is possible to address anindividual bit by specifying the bit number inhexadecimal [xx]Write CommandATSXX[x[x]]=[,]ResponseOKor ERROR:The module displays the contents of S-register xxor an error message, where represents the error code explained in section 3.All 16- and 32-bit registers can also be accessedbit by bit. In order to do this [x[x]] may specify thebit which is to be read. The result when reading asingle bit will always be 0 or 1.ResponseOK or ERROR:ExamplesATS00=3FFCATS0AE=1:passwordNotesSome S-Registers require a password forwrite access. See S-Register description fordetails. The default password for R3xx is“password”.Some S-Registers are read-only and willreturn an error if you are trying to write tothem.When writing an individual bit by specifying[x[x]], can only be either 0 or 1.The data is written to S-register number XX and ifapplicable stored in non-volatile memory. The dataformat for each individual S Register is given in theS-Register description. represents the error code explained insection 3.For all 16- and 32-bit registers individual bits canalso be set or cleared by specifying the bit usinghexadecimal [x[x]] and setting it to either 0 or 1.SW release R300 ●©2011 Telegesis (UK) Ltd - 15 - AT Command Manual (Rev 3.05)

R305 AT CommandsREMS – Remote S-Register AccessRead CommandATREMS:,XX[X[x]]?ExamplesATREMS:000D6F00000AAC93,00?ATREMS:000D6F00000AAC93,0AE?ATREMS:000D6F00000AAC93,1812?Where can be the remote node‟sEUI64, NodeID or address table index andXX is the S-Register which is to be read. Asan option for all 16 bit registers it is alsopossible to address an individual bit only byspecifying the bit number [X]. For all 32 bitregisters it is possible to address anindividual bit by specifying the bit number inhexadecimal [xx]The result when reading a single bit willalways be 0 or 1.Write CommandATREMS:,XX[x[x]]=[,]ResponseSEQ:XXOKor ERROR:The module asks for the contents of the remote S-register using a unicast. The sequence number ofthe unicast is displayed (an ACK or NACK promptwill follow). represents the error codeexplained in section 3.PromptSREAD:,,,[=]Where NodeID is the remote NodeID, EUI64 is theremote EUI64, Register is the S-Register whichwas read and is indicating thesuccess (00) or failure of the read operation. Thecontents of the remote S-Register are following incase of a successful read only.ResponseSEQ:XXOKExamplesATREMS:000D6F0000012345,00=3FFCATREMS:000D6F0000012345,0AE=1:passwordWhere can be the remote node‟sEUI64, NodeID or address table index andXX is the S-Register which is to be written.As an option for all 16- and 32-bit registers itis also possible to address an individual bitonly by specifying the bit number [x[x]].or ERROR:The data is written to the remote S-register numberXX and if applicable stored in non-volatile memory.The data format for each individual S Register isgiven in the S-Register description.The sequence number of the unicast is displayed(an ACK or NACK prompt will follow). represents the error code explained in section 3.PromptSWRITE:,,NotesSome S-Registers require a password forwrite access. See S-Register description fordetails. The default password for R3xx is“password”.Some S-Registers are read-only and willreturn an error if you are trying to write tothem.When writing an individual bit by specifying[x[x]], can only be either 0 or 1.Where is the remote NodeID, is the remote EUI64. Only in case the errorcode is00 the write operation has been completedsuccessfully.SW release R302 ●©2011 Telegesis (UK) Ltd - 16 - AT Command Manual (Rev 3.05)

R305 AT CommandsSALL – Remote S-Register AccessWrite CommandATSALL:,XX[x[x]]=[,]ExamplesATSALL:FFFF,00=3FFCATSALL:FFFC,0AE=1:passwordWhere group IDs are remote node‟smulticast IDs orFFFF - Broadcast to all devicesFFFD - Broadcast to all non-sleepy devicesFFFC – Broadcast to all RoutersResponseOK or ERROR:The data is written to the remote S-register numberXX on all nodes addressed by the multicast groupID. The data format for each individual S Registeris given in the S-Register description. represents the error code explained insection 3.For all 16- and 32-bit registers individual bits canalso be set or cleared by specifying the bit usinghexadecimal [x[x]] and setting it to either 0 or 1.NotesSome S-Registers require a password forwrite access. See S-Register description fordetails. The default password for R3xx is“password”.Some S-Registers are read-only and cannotbe written to.SW release R300 ●+TOKDUMP – Display All S-RegistersExecute CommandAT+TOKDUMPNotesOnly used on the local node. You cannotdisplay all the registers of a remote device.ResponseOKThe module displays the contents of all local S-Registers. The data format for each individual SRegister is given in the S-Register description insection 4.SW release R300 ●©2011 Telegesis (UK) Ltd - 17 - AT Command Manual (Rev 3.05)

R305 AT Commands2.6 Network Control & Configuration Commands+ESCAN – Scan The Energy Of All ChannelsExecute CommandAT+ESCANUse on:All nodesNotesScanning all channels can take up to 16seconds.The results are the background radio powerin each channel, not the RSSI of incomingZigBee packetsResponse+ESCAN:11:XX12:XX…26:XXOKor ERROR: represents the error code explained insection 3. XX represents the average energy onthe respective channel (see description in Section8). Channels masked out in S00 are not scanned.SW release R300 ●+PANSCAN – Scan For Active PANsExecute CommandAT+PANSCANUse on:All nodesResponse+PANSCAN:,,,XX,bOKor ERROR: represents the error code explained insection 3. The node gives a list of all PANs found. represents the channel, the PANID, the extended PAN ID, XX the ZigBeestack profile (00 = Custom, 01 = ZigBee, 02 =ZigBee PRO) and b indicates whether the networkNoteis allowing additional nodes to join (1 = joiningScanning for active PANs can take up to 4permitted). The node does not join any of theseconds.PANs found.SW release R300 ●©2011 Telegesis (UK) Ltd - 18 - AT Command Manual (Rev 3.05)

R305 AT Commands+EN – Establish Personal Area NetworkExecute CommandAT+ENResponseJPAN:,,OKor ERROR:Use on:All nodes which are not part of a PAN represents the error code explained insection 3.NoteWhen issuing this command the local devicebecomes a Coordinator (and Trust Centre).Establishing a PAN can take up to 16seconds.This command can only be executed if thelocal node is not part of a PAN already.The local node becomes a coordinator andperforms an energy scan on all channels selectedin S00. It then starts a PAN with a random unusedPAN ID and extended PAN ID on the quietestchannel. If a PAN ID and/or extended PAN ID isspecified in S02 or S03 the provided IDs are usedinstead of random ones, given the selected IDs arenot already in use by other networks within rangeSW release R300 ●+JN – Join NetworkExecute CommandAT+JNUse on:All nodes which are not part of a PANNoteJoining a PAN can take up to 4 seconds,depending on the number of channels whichneed scanning.This command can only be executed if thelocal node is not part of a PAN already.Remote ActionOn the Trust Centre / CoordinatorResponseJPAN:,,OKor ERROR: represents the error code explained insection 3.The local node scans all channels selected inregister S00 for the existence of a PAN. Whenfinding any PAN which allows joining it willautomatically join in via the remote node with thehighest RSSI.In case registers S02 and S03 differ from thedefault value of all zeros the node will only join aPAN with the specified Pan ID and/or extendedPAN ID.PromptNEWNODE:,,SW release R300 ●©2011 Telegesis (UK) Ltd - 19 - AT Command Manual (Rev 3.05)

R305 AT Commands+JPAN – Join Specific PANExecute CommandAT+JPAN:,ExamplesAT+JPAN:20,1234AT+JPAN:24,0793E14FFB220A38ResponseJPAN:,,OKor ERROR:Use onAll nodes which are not part of a PANNotesThis command can only be executed if thelocal node is not part of a PAN already.The JPAN command ignores the channelmask in register S00 and the PID and EPIDsettings in S02 and S03. represents the error code explained insection 3.The local node joins a particular PAN on with the specified or via the remote node with the highest RSSI.Remote ActionOn the Trust Centre / CoordinatorPromptNEWNODE:,,SW release R300 ●+SJN – Silent JoinExecute CommandAT+SJN:,,,“Silent” joining is joining via thecommissioning method. All data required toenter the network is provided to the node, sothat no joining procedure itself is required.The node will appear in the target networkwithout any joining procedure given thesupplied data is correct. is a decimal numberOther parameters are hexadecimalUse onAll joining DevicesExampleAT+SJN:11,000D6F00000AAAD0,AFFE,00ResponseJPAN:,,OKor ERROR:> represents the error code explained insection 3.The local node will become part of the network withthe channel specified in , the trust centreEUI64 specified in , the NodeID of thenetwork manager specified in , the 8bit network update ID specified in , the network key provided in S08, the trustcentre link key provided in S09, the PAN IDprovided in S02 and the extended PAN ID providedin S03. It is assumed that the key-sequencenumberof the network key is 0 when issuing thiscommand.SW release R305 ●©2011 Telegesis (UK) Ltd - 20 - AT Command Manual (Rev 3.05)

R305 AT Commands+DASSL – Disassociate Local Device From PANExecute CommandAT+DASSLResponseOK or ERRORUse onAll DevicesNoteUse with care on a Coordinator. It will not beable to rejoin the PANPromptLeftPAN represents the error code explained insection 3.Instruct local device to leave the PAN.SW release R300 ●+DASSR – Disassociate Remote Node from PANExecute CommandAT+DASSR:Where can be a node‟s EUI64,NodeID or address table indexResponseSEQ:XXOKor ERROR:(ZDO)Use onAll DevicesNoteUse with care when targeting a Coordinator.It will not be able to rejoin the PAN represents the error code explained insection 3.Instruct device to leave the PAN.Remote ActionPromptNode leaves PANLeftPANSW release R300 ●+N – Display Network InformationRead CommandAT+N?Use onAll DevicesResponse+N=,,,,or +N=NoPANfollowed byOK represents the node‟s functionality in thePAN (FFD,COO,ZED,SED,MED), the node‟soutput power in dBm, the IEEE 802.15.4 radiochannel (11-26), the node‟s PAN ID and the node‟s extended PAN ID.SW release R302 ●©2011 Telegesis (UK) Ltd - 21 - AT Command Manual (Rev 3.05)

R305 AT Commands+NTABLE – Display Neighbour TableRead CommandAT+NTABLE:XX,Where XX is the start index of theremote LQI table and can bethe remote node‟s EUI64, NodeID oraddress table entry.Note: Also the local node can be thetarget of this command (e.g. useaddress table entry FF as the address)Use onFFD, COO as the target deviceResponseSEQ:XXOK or ERROR(ZDO)This command requests the target node to respond bylisting its neighbour table starting from the requestedindex. Can be used to find the identity of all ZigBeedevices in the network including non-Telegesis devices.Prompt (example)NTable:,Length:03No.| Type | EUI | ID | LQI00.| FFD | 000D6F000015896B | BC04 | FF01.| FFD | 000D6F00000B3E77 | 739D | FF02.| FFD | 000D6F00000AAD11 | 75E3 | FFIn this example the neighbour table of the remote nodewith the short ID shown in contains threeentries (hexadecimal), which are displayed. In case thetable contains more than three entries it may be requiredto repeat this command and increase the index countuntil the full table is derived.In case of an error an errorcode other than 00 will bedisplayed and the prompt will end after the errorcode.SW release R302 ●©2011 Telegesis (UK) Ltd - 22 - AT Command Manual (Rev 3.05)

R305 AT Commands+RTABLE – Display Routing TableRead CommandAT+RTABLE:XX,Where XX is the start index of theremote Routing table and can be the remote node‟s EUI64,NodeID or address table entry.ResponseSEQ:XXOK or ERROR(ZDO)This command requests the target node to respond bylisting its routing table starting from the requested index.Note: Also the local node can be thetarget of this command (e.g. useaddress table entry FF as the address)Use onFFD, COO as the target devicePrompt (example)RTable:,Length:40No.| Dest | Next | Status00.| 1234 | ABCD | 0001.| 4321 | 739D | 0002.| 0000 | 0000 | 03In this example the routing table of the remote node withthe short ID shown in contains 64 entries(hexadecimal 0x40), of which the first three aredisplayed. When the table contains more than thedisplayed entries it may be required to repeat thiscommand and increase the index count until the fulltable is derived.The status shown is as described in table 2.128 of theZigBee Specification.In case of an error an errorcode other than 00 will bedisplayed and the prompt will end after the errorcode.SW release R303 ●©2011 Telegesis (UK) Ltd - 23 - AT Command Manual (Rev 3.05)

R305 AT Commands+IDREQ – Request Node’s NodeIDExecute CommandAT+IDREQ:[,XX]ResponseOK(ZDO)Where can be a node‟s EUI64, oraddress table entry and XX is an optionalindex number. In case an index number isprovided, an extended response is requestedasking the remote device to list its associateddevices (ie children).Sends a broadcast to obtain the specifiedDevice‟s NodeID and optionally alsoelements of its associated devices list.or ERROR: represents the error code explained insection 3.PromptAddrResp:[,,][nn. ]In case of an error an errorcode other than 00 willbe displayed and the prompt will end after theUse onAll Deviceserrorcode. is the Remote node‟s EUI64 and is its NodeID. In case an extendedNoteresponse has been requested the requestedProviding FF as an address table entry NodeIDs from the associated devices list are listedaddresses the local nodeas well.SW release R302 ●+EUIREQ – Request Node’s EUI64Execute CommandAT+EUIREQ:< Address>,[,XX]Where is the EUI64, NodeID oraddress table entry of the node which is tobe interrogated about the node with theNodeID specified in . XX is anoptional index number. In case an indexnumber is provided, an extended response isrequested asking the remote device to list itsassociated devices (ie children).Sends a unicast to obtain the specifieddevice‟s EUI64 and optionally also elementsof its associated devices list (extendedresponse).Use onAll DevicesResponseSEQ:XXOKor ERROR:(ZDO) represents the error code explained insection 3.PromptAddrResp:[,,][dd. ]In case of an error an errorcode other than 00 willbe displayed and the prompt will end after theerrorcode. is the Remote node‟s EUI64 and is its NodeID. In case an extendedresponse has been requested the requestedNodeIDs from the associated devices list are listed.As with all unicasts after successful transmissionNotethe sequence number of the unicast is stated usingProviding FF as an address table entry the “SEQ:XX” prompt. When acknowledged (oraddresses the local nodenot) the accompanying “ACK:XX” (or “NACK:XX”)prompt is displayed.SW release R302 ●©2011 Telegesis (UK) Ltd - 24 - AT Command Manual (Rev 3.05)

R305 AT Commands+NODEDESC – Request Node’s DescriptorExecute CommandAT+NODEDESC:,Where is the EUI64, NodeID orAddress table entry of the node which is tobe interrogated about the node with theNodeID specified in .Sends a unicast to obtain the specifieddevice‟s node descriptor.Use onAll DevicesNoteProviding FF as an address table entryaddresses the local nodeResponseSEQ:XXOKor ERROR:(ZDO) represents the error code explained insection 3.Prompt (example)NodeDesc:,Type:FFDComplexDesc:NoUserDesc:NoAPSFlags:00FreqBand:40MacCap:8EManufCode:1010MaxBufSize:52MaxInSize:0080SrvMask:0000MaxOutSize:0080DescCap:00In case of an error an errorcode other than 00 willbe displayed and the prompt will end after theerrorcode. is the Remote node‟s NodeID. Inaddition the node descriptor is displayed. Theindividual fields of the Node Descriptor aredescribed in section 2.3.2.3 of the ZigBeespecification.As with all unicasts after successful transmissionthe sequence number of the unicast is stated usingthe “SEQ:XX” prompt. When acknowledged (ornot) the accompanying “ACK:XX” (or “NACK:XX”)prompt is displayed.SW release R302 ●©2011 Telegesis (UK) Ltd - 25 - AT Command Manual (Rev 3.05)

R305 AT Commands+POWERDESC – Request Node’s Power DescriptorExecute CommandAT+POWERDESC:,Where is the EUI64, NodeID orAddress table entry of the node which is tobe interrogated about the node with theNodeID specified in .Sends a unicast to obtain the specifieddevice‟s power descriptor.ResponseSEQ:XXOKor ERROR:(ZDO) represents the error code explained insection 3.PromptPowerDesc:,[,]In case of an error an errorcode other than 00 willbe displayed and the prompt will end after theerrorcode is the Remote node‟s NodeID. Inaddition the power descriptor is displayed as a 16bit hexadecimal number as described in section2.3.2.4. of the ZigBee specification.As with all unicasts after successful transmissionUse onAll Devicesthe sequence number of the unicast is stated usingthe “SEQ:XX” prompt. When acknowledged (ornot) the accompanying “ACK:XX” (or “NACK:XX”)prompt is displayed.SW release R302 ●+ACTEPDESC – Request Node’s Active Endpoint ListExecute CommandAT+ACTEPDESC:,Where is the EUI64, NodeID orAddress table entry of the node which is tobe interrogated about the node with theNodeID specified in .Sends a unicast to obtain the specifieddevice‟s active endpoint list.ResponseSEQ:XXOKor ERROR:(ZDO) represents the error code explained insection 3.PromptActEpDesc:,[,XX,…]In case of an error an errorcode other than 00 willbe displayed and the prompt will end after theerrorcode is the Remote node‟s NodeID. Inaddition all active endpoints are listed as 8-bithexadecimal numbers separated by commas.As with all unicasts after successful transmissionUse onAll Devicesthe sequence number of the unicast is stated usingthe “SEQ:XX” prompt. When acknowledged (ornot) the accompanying “ACK:XX” (or “NACK:XX”)prompt is displayed.SW release R302 ●©2011 Telegesis (UK) Ltd - 26 - AT Command Manual (Rev 3.05)

R305 AT Commands+SIMPLEDESC – Request Endpoint’s Simple DescriptorExecute CommandResponseAT+SIMPLEDESC:,, SEQ:XXOK(ZDO)Where is the EUI64, NodeID orAddress table entry of the node which is to beinterrogated about the node with the NodeIDspecified in and XX is the numberof the endpoint, which simple descriptor is tobe read.Sends a unicast to obtain the specifieddevice‟s active endpoint list.or ERROR: represents the error code explained insection 3.PromptSimpleDesc:,EP:XXProfileID:XXXXDeviceID:XXXXvXXInCluster:OutCluster:In case of an error an errorcode other than 00 willbe displayed and the prompt will end after theerrorcode is the Remote node‟s NodeID. Inaddition all active endpoints are listed as 8 bithexadecimal numbers separated by commas.As with all unicasts after successful transmissionthe sequence number of the unicast is stated usingUse onthe “SEQ:XX” prompt. When acknowledged (orAll Devicesnot) the accompanying “ACK:XX” (or “NACK:XX”)prompt is displayed.SW release R302 ●©2011 Telegesis (UK) Ltd - 27 - AT Command Manual (Rev 3.05)

R305 AT Commands+MATCHREQ – Find Nodes which Match a Specific DescriptorExecute CommandResponseAT+MATCHREQ: ,SEQ:XX [,], OK [,OutClusterList]Where Required profile ID of thedevice being searched for followed by aspecification of required input and outputclusters.If a remote node has a matching ProfileIDand matches at least one of the specifiedclusters it will respond to this broadcastlisting the matching endpoint(s). and must be 2 hexadecimal digitsExampleat+matchreq:C091,01,0002,02,0004,000Bor ERROR:(ZDO) represents the error code explained insection 3.PromptMatchDesc:,,XX,…In case of an error an errorcode other than 00 willbe displayed and the prompt will end after theerrorcode.Where is the Remote node‟s NodeID.In addition all endpoints of this node matching thesearch criterion are listed as 8 bit hexadecimalnumbers separated by commas.Use onAll DevicesSW release R302 ●+ANNCE – Announce Local Device In The NetworkExecute CommandAT+ANNCEResponseOK or ERROR(ZDO)Send a ZigBee device announce Broadcastannouncing the local node on the network. represents the error code explained insection 3.Use onAll DevicesRemote ActionPromptFFD:, [,syy,zz]MED:, [,syy,zz]SED:, [,syy,zz]ZED:, [,syy,zz]The prompt above will be displayed on all nodeswhich can hear the announcement. In case bit Cof register S10 is set the RSSI level (syy dBm) andLQI (zz in hexadecimal) of the last hop aredisplayed. For a description of the LQI readingplease see section 7. is the identifier and theNodeID of the sending deviceSW release R302 ●©2011 Telegesis (UK) Ltd - 28 - AT Command Manual (Rev 3.05)

R305 AT Commands+SR – Set Source Route to Remote DeviceExecute CommandAT+SR:,,…Set the source route of a message sent to aremote device, starting with the NodeID ofthe remote device followed by all NodeIDs onthe route from the remote node to the localnodeUse onAll DevicesNote: Setting up invalid routes may lead tolisted devices becoming unavailable. Toconfirm a route use AT+FNDSR.ResponseOKorERROR represents the error code explained insection 3.Stores route information for up to 30 hops whichwill be used when sending any message to aremote node, which is part of the listed devices.SW release R300 ●+FNDSR – Find the Source Route to a remote deviceExecute CommandResponseAT+FNDSR:OKWhere can be the remote node‟sEUI64 or address table indexorERRORTries to find source route information to thespecified device by sending a ZDO requestto the remote device and thus triggering areply.Use onSink, COOPromptSR:XX,,,…Where XX represents the number of hops to theremote node, EUI64 its EUI64 number followed bya list of NodeIDs starting with the remote nodelisting all nodes along the path to the local node represents the error code explained insection 3.SW release R302 ●©2011 Telegesis (UK) Ltd - 29 - AT Command Manual (Rev 3.05)

R305 AT Commands+POLL – Poll The Parent DeviceExecute CommandAT+POLLPoll the parent device for new data.Note: Action 0010/8010 is recommended forperiodic polling using the built-in timers.Use onSED, MEDResponseOKorERROR represents the error code explained insection 3.SW release R300 ●+REJOIN – Rejoin the networkExecute CommandAT+REJOIN:bIf b is set to 0 join without the known networkkey (unencrypted) and if b is set to 1 joinencrypted.Use onSED,MEDNotesPolling a parent on an end device that haslost its parent will automatically callAT+REJOIN:1. Furthermore functionality0012 and 0013 make use of this command.ResponseOKorERRORIf the contact with the network has been lostbecause an end device has lost its parent, thenetwork has changed channel, or updated itsencryption key the command AT+REJOIN can beused to rejoin the network. represents the error code explained insection 3.SW release R300 ●©2011 Telegesis (UK) Ltd - 30 - AT Command Manual (Rev 3.05)

R305 AT Commands+SN – Scan NetworkExecute CommandAT+SN[:nn]ResponseOK or ERRORAll Telegesis devices which are up to nnhops away are listed. If nn = 01 only directneighbours will reply and nn = 00 will searchthe entire network.PromptsFFD:, [,syy,zz]MED:, [,syy,zz]SED:, [,syy,zz]ZED:, [,syy,zz]Use onCOO, SINKParametersnn ranging from 00 to 30Notes- In case no parameter is specified fornn, 30 is used by default.- If used on nodes other than the COOand a sink the command may beunreliable represents the error code explained insection 3. In case bit C of register S10 is set theRSSI level (syy in dBm) and LQI (zz inhexadecimal) of the last hop are displayed. For adescription of the LQI reading please seesection 7. Source route messages may also bedisplayed.SW release R302 ●+KEYUPD – Update the Network KeyExecute CommandAT+KEYUPDResponseOKUpdates the Network Key with a new random orkey.ERRORUse onTrust Centre represents the error code explained inNotesection 3.Can only be used on the Trust CentreSW release R302 ●©2011 Telegesis (UK) Ltd - 31 - AT Command Manual (Rev 3.05)

R305 AT Commands+BECOMETC – Make Local Device the Trust CentreExecute CommandAT+BECOMETCLocal Device takes over the Trust Centre.Can only be used if no other device in thenetwork is Trust Centre (i.e. the network hasbeen started in distributed Trust Centremode)Use onRouter that established the PAN indistributed TC ModeResponseOKorERROR represents the error code explained insection 3.NoteCan only be used if Network has beenstarted as non-TC network (bit 9 of S0A set).SW release R302 ●+BECOMENM – Make the local device Network ManagerExecute CommandAT+BECOMENMLocal Device takes over role of NetworkManager. By default the COO is the NetworkManager, but any other router in the networkcan take over this responsibility. TheNetwork Manager can change the radiochannel and the PAN ID.Use onRouterResponseOKorERROR represents the error code explained insection 3.SW release R304 ●©2011 Telegesis (UK) Ltd - 32 - AT Command Manual (Rev 3.05)

R305 AT Commands+CCHANGE – Change the network’s channelExecute CommandAT+CCHANGE[:XX]Ask all nodes in the network to change theirchannel. If no channel is specified a randomchannel out of the channels masked in S00is picked which wasn‟t previously blacklistedbecause of excessive packet loss (NM:ESREPORT WARNING prompt)ResponseOKorERROR represents the error code explained insection 3.Use onNetwork ManagerParametersOptional XX ranging from 0B to 1ANoteThe New channel needs to be masked in inS00 for all nodes on the network. Ideally S00should be identical for all nodes on anetwork.SW release R304 ●2.7 Messaging+ATABLE – Display Address TableRead CommandAT+ATABLEUse onAll DevicesNotesEntry 05 contains the address of the node‟ssink. The user can overwrite it to manuallyselect a different sink.The address table is volatile and its contentsare lost if the device is powered down.ResponseNo. | Active | ID | EUI00 | N | 0000 |000D6F0000012345(…)OKThe Address Table contains nodes which can beaddressed by referring to the correspondingaddress table entry. The “Active” column showsnodes to which a message is currently in flight.SW release R300 ●©2011 Telegesis (UK) Ltd - 33 - AT Command Manual (Rev 3.05)

R305 AT Commands+ASET – Set Address Table EntryRead CommandAT+ASET:XX,,Where XX is the entry number of the addresstable entry which is to be written. If theNodeID is unknown, the NodeID must besubstituted with “FFFF”.Use onResponseOKor ERROR: represents the error code explained insection 3.All DevicesSW release R300 ●+MTABLE – Display Multicast TableRead CommandAT+MTABLEUse onAll DevicesNote: For Multicasts to be displayed usingthe MCAST prompt, endpoint 01 must beselected as the target endpoint.ResponseNo. | ID | EP00 | 1234 | 0101 | 0000 | 0002 | 0000 | 0003 | 0000 | 0004 | 0000 | 00OKThe multicast table contains all multicast IDs whichThe multicast table is cleared by a reset will be received by the local node.SW release R300 ●+MSET – Set Multicast Table EntryRead CommandAT+MSET:XX,,Where XX is the index number of themulticast-table entry which is to be written.For the AT-Command interface operation theendpoint should always be set to 01.Use onResponseOKor ERROR: represents the error code explained insection 3.All DevicesSW release R300 ●©2011 Telegesis (UK) Ltd - 34 - AT Command Manual (Rev 3.05)

R305 AT Commands+BCAST – Transmit A BroadcastExecute CommandAT+BCAST:nn,ExampleAT+BCAST:00,Hello worldUse on:All devicesResponseOK or ERRORWhere represents the error codeexplained in section 3.Parametersnn ranging from 00 to 30Note: Use broadcasts sparingly! The ZigBeespecification only allows any node to repeator originate up to 8 broadcasts in every 8second interval. Broadcasts use a lot ofbandwidth.A maximum of 82 bytes are sent (with attachedEUI only 74 bytes). The response OK showssuccessful transmission. Successful transmissiondoes not guarantee successful reception. To makesure data has been received by a specific nodeuse a unicast message. Only neighbours whichare up to nn hops away will receive the broadcast.If nn = 01 only direct neighbours will receive thebroadcast and if n = 00 the entire network will(max. 30 hops).Remote actionPromptBCAST:[,]=Every node in the PAN which has received thebroadcast message will prompt the abovemessage where is the address of thesender, is the length of the payload and is the data which was attached to thebroadcast. The EUI64 is only displayed if it is partof the network header (set bit 0 of S10 to disableattaching the EUI64 to outgoing messages).SW release R300 ●©2011 Telegesis (UK) Ltd - 35 - AT Command Manual (Rev 3.05)

R305 AT Commands+BCASTB – Transmit A Broadcast Of Binary DataExecute CommandAT+BCASTB:XX,nnWhere nn is the number of hops themessage will travel and XX is the number (inhexadecimal) of data bytes to be sent.Use onAll DevicesNoteThis command is particularly useful if thedata may contain and characters.Response> OKor ERROR:After the „>‟ prompt a number of XX characters areexpected to be entered. representsthe error code explained in section 3.(In case bit 9 of S10 is set a timeout error isgenerated if no character is received for 1 second.)ParametersXX ranging from 00 to 52 (hexadecimal)nn ranging from 00 to 30 (decimal)A maximum of 82 bytes are sent (with attachedEUI only 74 bytes). The response OK showssuccessful transmission. Successful transmissiondoes not guarantee successful reception. To makesure data has been received by a specific nodeuse a unicast message. Only neighbours whichare up to nn hops away will receive the broadcast.If nn=01 only direct neighbours will receive thebroadcast and if n = 00 the entire network will (max30 hops).Remote actionPromptBCAST:,=Every node in the PAN which has received thebroadcast message will prompt the abovemessage where is the address of thesender and is the length of the messagein hexadecimal. The EUI64 is only displayed if it ispart of the network header (set bit 0 of S10 todisable attaching the EUI64 to outgoingmessages).SW release R300 ●©2011 Telegesis (UK) Ltd - 36 - AT Command Manual (Rev 3.05)

R305 AT Commands+UCAST – Transmit A UnicastExecute CommandAT+UCAST:=ExampleAT+UCAST:000D6F0000012345=HelloWhere can be the remote node‟sEUI64, NodeID or address table indexUse onAll DevicesResponseSEQ:XXOKorERROR:Where represents the error codeexplained in section 4.PromptACK:XXNotesUnicasts can be addressed either byreferencing the recipient‟s EUI64, NodeID oran entry in the address table.The maximum payload is 82 bytes. It isreduced by 8 bytes when appending the EUIto the network header (default) and also it isreduced by 2 bytes per hop in case a sourceroute is known. The latter event can neitherbe suppressed nor foreseen.Up to 10 unicasts may be in flight at one timeor NACK:XXUp to 82 bytes are sent to the node up to 30 hopsaway. On successful transmission the user isgiven the transmission‟s sequence numberfollowed by “OK”. The user is then prompted“ACK” on receipt of an acknowledgement or“NACK” in case the message was notacknowledged. A NACK does not guarantee thatthe message has not reached its destination.Remote actionPromptUCAST:[,]=Where is the address of the sender and is the length of the message inhexadecimal. The EUI64 is only displayed if it ispart of the network header (set bit 0 of S10 todisable attaching the EUI64 to outgoingmessages).SW release R300 ●©2011 Telegesis (UK) Ltd - 37 - AT Command Manual (Rev 3.05)

R305 AT Commands+UCASTB – Transmit A Unicast Of Binary DataExecute CommandAT+UCASTB:XX,Where can be the remote node‟sEUI64, NodeID or address table index andXX is the number (in hexadecimal) of databytes to be sent.Use onAll DevicesNotesThis command is particularly useful if thedata may contain and characters.The ACK and/or NACK prompt can bedisabled in S0EUnicasts can be addressed either byreferencing the recipient‟s EUI64, NodeID oran entry in the address table.The maximum payload is 82 bytes. It isreduced by 8 bytes when appending the EUIto the network header (default) and also it isreduced by 2 bytes per hop in case a sourceroute is known. The latter event can neitherbe suppressed nor foreseen.Up to 10 unicasts may be in flight at one timeRemote actionResponse> SEQ:XXOKor ERROR:PromptACK:XXor NACK:XXParametersXX ranging from 00 to 52 (hex)After the „>‟ prompt a number of XX characters areexpected to be entered. Up to 82 bytes are sent tothe node with address .In case bit 9 of S10 is set a timeout error isgenerated if no character is received for 1 second.On successful transmission the user is given atransmission number followed by “OK”. After thatthe user is prompted “ACK” on receipt of anacknowledgement or “NACK” in case the messagewas not acknowledged. A NACK does notguarantee that the message has not reached itsdestination.PromptUCAST:[,]=Where is the address of the sender and is the length of the message inhexadecimal. The EUI64 is only displayed if it ispart of the network header (set bit 0 of S10 todisable attaching the EUI64 to outgoingmessages).SW release R300 ●©2011 Telegesis (UK) Ltd - 38 - AT Command Manual (Rev 3.05)

R305 AT Commands+SCAST – Transmit Data To The SinkExecute CommandAT+SCAST:ExampleAT+SCAST:Hello worldUse onAll DevicesResponseSEQ:XXOKor ERRORWhere represents the error codeexplained in section 3.Notes- When bit 8 of S10 is set, if a sinkcannot be reached for threeconsecutive transmissions the sink isassumed unavailable and a new oneis sought- The ACK and/or NACK prompt canbe disabled in S0E- When attaching the node‟s EUI64 tothe network frame the maximumpayload reduces to 74 bytes- The maximum payload is 82 bytes. Itis reduced by 8 bytes whenappending the EUI to the networkheader (default) and also it is reducedby 2 bytes per hop in case a sourceroute is known. The latter event canneither be suppressed nor foreseen.PromptACK:XXor NACK:XXParametersUp to 82 bytes are sent to the node‟s sink. Onsuccessful transmission the user is given thesequence number followed by “OK”. After that theuser is prompted “ACK” on receipt of anacknowledgement or “NACK” in case the messagewas not acknowledged. A NACK does notguarantee that the message has not reached itsdestination.Remote actionPromptUCAST:[,]=Where is the address of the sender and is the length of the message inhexadecimal. The EUI64 is only displayed if it ispart of the network header (set bit 0 of S10 todisable attaching the EUI64 to outgoingmessages).SW release R300 ●©2011 Telegesis (UK) Ltd - 39 - AT Command Manual (Rev 3.05)

R305 AT Commands+SCASTB – Transmit Binary Data To A SinkExecute CommandAT+SCASTB:XXWhere XX is the number (in hexadecimal) ofdata bytes to be sent.Use onAll DevicesNotes- When bit 8 of S10 is set, if a sinkcannot be reached for threeconsecutive transmissions the sink isassumed unavailable and a new oneis sought.- The ACK and/or NACK prompt canbe disabled in S0E- When attaching the node‟s EUI64 tothe network frame the maximumpayload reduces to 74 bytes- The maximum payload is 82 bytes. Itis reduced by 8 bytes whenappending the EUI to the networkheader (default) and also it is reducedby 2 bytes per hop in case a sourceroute is known. The latter event canneither be suppressed nor foreseen.Response> SEQ:XXOKor ERRORParametersXX ranging from 00 to 52 (hex)After the „>‟ prompt a number of XX characters areexpected to be entered. A maximum of 82 bytesare sent to the network‟s sink.(In case bit 9 of S10 is set a timeout error isgenerated if no character is received for 1 second.)On successful transmission the user is given atransmission number followed by “OK”. After thatthe user is prompted “ACK” on receipt of anacknowledgement or “NACK” in case the messagewas not acknowledged. A NACK does notguarantee that the message has not reached itsdestination.Remote actionPromptUCAST:[,]XX=Where is the address of the sender and is the length of the message inhexadecimal. The EUI64 is only displayed if it ispart of the network header (set bit 0 of S10 todisable attaching the EUI64 to outgoingmessages).SW release R300 ●©2011 Telegesis (UK) Ltd - 40 - AT Command Manual (Rev 3.05)

R305 AT Commands+SSINK – Search For A SinkRead CommandAT+SSINKResponseOK or ERRORSearch for a sink on the network by sendinga broadcast causing all sinks to reply.By default, if a sink is already known and nobetter sink is found, no prompt will bedisplayed.A sink which is already known can be foundat index 05 of the address table.Use onPromptSINK:, orADSK:, represents the error code explained insection 3.All DevicesSW release R300 ●+MCAST – Transmit A MulticastExecute CommandAT+MCAST:nn,,ResponseOK or ERRORUse on:All devicesNotes- When attaching the node‟s EUI64 tothe network frame the maximumpayload reduces to 74 bytes- Entries in the multicast table must beset to endpoint 01 to trigger thedesired prompt- Use multicasts sparingly! They are aform of broadcast so any node mayonly repeat or originate up to 8multicasts in every 8 second interval.Where represents the error codeexplained in section 3.Parametersnn ranging from 00 to 30Up to 82 bytes are sent to the multicast group. The response OK shows successfultransmission. Successful transmission does notguarantee successful reception. To make suredata has been received by a specific node use aunicast message. Only neighbours which are up tonn hops away will receive the broadcast. If nn = 01only direct neighbours will receive the broadcastand if nn = 00 the entire network will (max. 30hops).Remote actionPromptMCAST:[,]=Where is the address of the sender and is the length of the message inhexadecimal. The EUI64 is only displayed if it ispart of the network header (set bit 0 of S10 todisable attaching the EUI64 to outgoingmessages).SW release R300 ●©2011 Telegesis (UK) Ltd - 41 - AT Command Manual (Rev 3.05)

R305 AT Commands+MCASTB – Transmit A Multicast Of Binary DataExecute CommandAT+MCASTB:XX,nn,Where XX is the number (in hexadecimal) ofdata bytes to be sent and nn is the number ofhops the message will travel.Use onAll DevicesNotesWhen attaching the node‟s EUI64 to thenetwork frame the maximum payloadreduces to 74 bytesThis command is particularly useful if thedata may contain and characters.Use multicasts sparingly! They are a form ofbroadcast so any node may only repeat ororiginate up to 8 multicasts in every 8 secondinterval.Remote actionResponse> OKor ERRORAfter the „>‟ prompt a number of XX characters areexpected to be entered. representsthe error code explained in section 3.In case bit 9 of S10 is set a timeout error isgenerated if no character is received for 1 second.ParametersXX ranging from 00 to 52 (hex)nn ranging from 00 to 30Up to 82 bytes are sent to devices up to nn hopsaway. The response OK shows successfultransmission. Successful transmission does notguarantee successful reception. To make suredata has been received by a specific node use aunicast message. Only neighbours which are up tonn hops away will receive the broadcast. If nn=01only direct neighbours will receive the broadcastand if n = 00 the entire network will.PromptMCAST:[,]=Where is the address of the sender and is the length of the message inhexadecimal. The EUI64 is only displayed if it ispart of the network header (set bit 0 of S10 todisable attaching the EUI64 to outgoingmessages).SW release R300 ●©2011 Telegesis (UK) Ltd - 42 - AT Command Manual (Rev 3.05)

R305 AT Commands+DMODE – Enter Data Mode (Serial Link Mode)Execute CommandAT+DMODE:Where can be the remote node‟sEUI64, NodeID or address table indexUse onAll DevicesNoteOpening a serial link to end devices willresult in a limited data rate which depends onthe polling interval of the child.In Data mode all prompts are disabledResponseSEQ:XXOKorERRORPromptACK:XXor NACK:XX represents the error code explained insection 3 and XX is the sequence number of theunicast.Remote PromptDataMODE:,OPENPromptDataMODE:,,[OPEN]Where is the NodeID of theremote node and is its EUI64.Where is the NodeID of the remotenode and is its EUI64. Only if theerrorcode equals 0 the data mode will open.SW release R302 ●+++ – Leave Data ModeExecute Command+++ResponseCLOSEDTo Leave data mode +++ must be entered ata minimum of 500ms after the last characterwhich is to be transmitted to the remotenode. In case the data payload contains +++it can be transmitted safely as long as it ismade sure no more than 250ms passbetween sending +++ and the previouscharacter.Use onAll DevicesSW release R302 ●©2011 Telegesis (UK) Ltd - 43 - AT Command Manual (Rev 3.05)

R305 AT Commands+IDENT – Play A Tune On Remote DevboardExecute CommandAT+IDENT:Where can be the remote node‟sEUI64, NodeID or address table indexResponseSEQ:XXOKorERRORUse onAll DevicesPromptACK:XXor NACK:XX represents the error code explained insection 3.Plays a tune on a remote devboard if the Beeper isconnected. Useful to identify remote nodes. Seedevkit manual for details about connecting abuzzer to the ETRXn.SW release R300 ●©2011 Telegesis (UK) Ltd - 44 - AT Command Manual (Rev 3.05)

R305 AT Commands+RDATAB – Send Binary Raw DataExecute CommandAT+RDATAB:XXUse onAll DevicesNotesCan be useful to quickly exchange bulk datawith neighbouring node. The applicationneeds to handle addressing, error checking,retries and acknowledgements.Response> OKor ERROR:ParametersXX ranging from 00 to 67 (hex)AT+RDATAB generates broadcasts so anynode may only originate up to 8 broadcastsin every 8 second interval. Broadcasts use alot of bandwidth.End Devices do not receive raw data.Raw data will only travel one hop.Use with great care. Raw data messagesare not ZigBee-compliant and may even leakinto other PANs.After the „>‟ prompt a number of XX characters areexpected to be entered. Up to 103 bytes of datacan be send to all nodes within reach (directneighbours)The data is neither encrypted nor error checked.No retries are made and no acknowledgement isreceived. represents the error code explained insection 3.Remote actionPromptRAW:snn,where snn is the RSSI, orin case bit 9 of S0E is set. Displaying the data canalso be disabled by setting bit D of S0E.SW release R300 ●©2011 Telegesis (UK) Ltd - 45 - AT Command Manual (Rev 3.05)

R305 AT Commands3 List of Error codes00 Everything OK - Success01 Couldn’t poll Parent because of Timeout02 Unknown command04 Invalid S-Register05 Invalid parameter06 Recipient could not be reached07 Message was not acknowledged08 No sink known09 Address Table entry is in use and cannot be modified0A Message could not be sent0B Local node is not sink0C Too many characters0E Background Scan in Progress (Please wait and try again)0F Fatal error initialising the network10 Error bootloading12 Fatal error initialising the stack18 Node has run out of Buffers19 Trying to write read-only register1A Data Mode Refused by Remote Node1B Connection Lost in Data Mode1C Remote node is already in Data Mode20 Invalid password25 Cannot form network27 No network found28 Operation cannot be completed if node is part of a PAN2C Error leaving the PAN2D Error scanning for PANs33 No response from the remote bootloader34 Target did not respond during cloning35 Timeout occurred during xCASTB39 MAC Transmit Queue is Full70 Invalid Operation72 More than 10 unicast messages were in flight at the same time74 Message too long80 ZDP Invalid Request Type81 ZDP Device not Found82 ZDP Invalid Endpoint83 ZDP Not Active84 ZDP Not Supported85 ZDP Timeout86 ZDP No Match87 ZDP Table Full88 ZDP No Entry89 ZDP No Descriptor©2011 Telegesis (UK) Ltd - 46 - AT Command Manual (Rev 3.05)

R305 AT Commands91 Operation only possible if connected to a PAN93 Node is not part of a Network94 Cannot join network96 Mobile End Device Move to new Parent Failed98 Cannot join ZigBee 2006 Network as RouterA1 More than 8 broadcasts were sent within 8 secondsAB Trying to join, but no beacons could be heardAC Network key was sent in the clear when trying to join securedAD Did not receive Network KeyAE No Link Key receivedAF Preconfigured Key RequiredC5 NWK Already PresentC7 NWK Table FullC8 NWK Unknown Device©2011 Telegesis (UK) Ltd - 47 - AT Command Manual (Rev 3.05)

R305 AT Commands4 S-RegistersMost S-Registers of the ETRX2 and ETRX357 can be read and written locally as well as remotely.The S-Registers are summarised in the table below.S-Register Overview Local R/W Remote R/WS00 Channel Mask ( / ) ( / )S01 Transmit Power Level ( / ) ( / )S02 Preferred PAN ID ( / ) ( / )S03 Preferred Extended PAN ID ( / ) ( / )S04 Local EUI ( /-) ( /-)S05 Local NodeID ( /-) ( /-)S06 Parent‟s EUI ( /-) ( /-)S07 Parent‟s NodeID ( /-) ( /-)S08 Network Key 1 (-/ ) (-/ )S09 Link Key 1 (-/ ) (-/ )S0A Main Function 1 ( / ) ( / )S0B User Readable Name 1 ( / ) ( / )S0C Password 1 ( / ) ( / )S0D Device Information ( /-) ( /-)S0E Prompt Enable 1 ( / ) ( / )S0F Prompt Enable 2 ( / ) ( / )S10 Extended Function ( / ) ( / )S11 Device Specific ( / ) ( / )S12 UART Setup ( / ) ( / )S13 Pull-up enable ( / ) ( / )S14 Pull-down enable ( / ) ( / )S15 I/O Configuration ( / ) ( / )S16 Data Direction of I/O Port (volatile) ( / ) ( / )S17 Initial Value of S16 ( / ) ( / )S18 Output Buffer of I/O Port (volatile) ( / ) ( / )S19 Initial Value of S18 ( / ) ( / )S1A Input Buffer of I/O Port (volatile) ( /-) ( /-)S1B Special Function pin 1 (volatile) ( / ) ( / )S1C Initial Value of S1B ( / ) ( / )S1D Special Function Pin 2 (volatile) ( / ) ( / )S1E Initial Value of S1D ( / ) ( / )S1F A/D1 (ETRX3: ADC0) ( /-) ( /-)S20 A/D2 (ETRX3: ADC1) ( /-) ( /-)S21 A/D3 (ETRX3: ADC2) ( /-) ( /-)S22 A/D4 (ETRX3: ADC3) ( /-) ( /-)S23 Immediate functionality at IRQ0 ( / ) ( / )S24 Immediate functionality at IRQ1 ( / ) ( / )S25 Immediate functionality at IRQ2 ( / ) ( / )S26 Immediate functionality at IRQ3 ( / ) ( / )1 Password Protected Registers©2011 Telegesis (UK) Ltd - 48 - AT Command Manual (Rev 3.05)

R305 AT CommandsS-Register Overview (continued) Local R/W Remote R/WS27 Functionality 1 at Boot-up ( / ) ( / )S28 Functionality at Network Join ( / ) ( / )S29 Timer/Counter 0 ( / ) ( / )S2A Functionality for Timer/Counter 0 ( / ) ( / )S2B Timer/Counter 1 ( / ) ( / )S2C Functionality for Timer/Counter 1 ( / ) ( / )S2D Timer/Counter 2 ( / ) ( / )S2E Functionality for Timer/Counter 2 ( / ) ( / )S2F Timer/Counter 3 ( / ) ( / )S30 Functionality for Timer/Counter 3 ( / ) ( / )S31 Timer/Counter 4 ( / ) ( / )S32 Functionality for Timer/Counter 4 ( / ) ( / )S33 Timer/Counter 5 ( / ) ( / )S34 Functionality for Timer/Counter 5 ( / ) ( / )S35 Timer/Counter 6 ( / ) ( / )S36 Functionality for Timer/Counter 6 ( / ) ( / )S37 Timer/Counter 7 ( / ) ( / )S38 Functionality for Timer/Counter 7 ( / ) ( / )S39 Power mode (volatile) ( / ) ( / )S3A Initial Power Mode ( / ) ( / )S3B Start-up Functionality Plaintext A ( / ) ( / )S3C Start-up Functionality Plaintext B ( / ) ( / )S3D Supply Voltage ( /-) ( /-)S3E Multicast Table Entry 00 ( / ) ( / )S3F Multicast Table Entry 01 ( / ) ( / )S40 Source and Destination Endpoints for xCASTs (volatile) ( / ) ( / )S41 Initial Value of S40 ( / ) ( / )S42 Cluster ID for xCASTs (volatile) ( / ) ( / )S43 Initial Value of S42 ( / ) ( / )S44 Profile ID for xCASTs (volatile) ( / ) ( / )S45 Initial Value of S44 ( / ) ( / )S46 Start-up Functionality 32 bit number (volatile) ( / ) ( / )S47 Power Descriptor ( / ) ( / )S48 Endpoint 2 Profile ID ( / ) ( / )S49 Endpoint 2 Device ID ( / ) ( / )S4A Endpoint 2 Device Version ( / ) ( / )S4B Endpoint 2 Input Cluster List ( / ) ( / )S4C Endpoint 2 Output Cluster List ( / ) ( / )S4D Mobile End Device Poll Timeout ( / ) ( / )S4E End Device Poll Timeout ( / ) ( / )S4F MAC Timeout ( / ) ( / )Table 6: S-Register Overview©2011 Telegesis (UK) Ltd - 49 - AT Command Manual (Rev 3.05)

R305 AT CommandsWith a few exceptions the S-registers are stored in non-volatile memory and will keep their userdefined settings unless reset to the factory defaults using the “AT&F” command. S16, S18, S1A,S1B, S1D, S39, S40 and S42 are directly accessing volatile I/O registers to prevent memorycorruption due to constant I/O access. Registers S17, S19, S1C, S1E, S3A, S41 and S43represent the non-volatile registers which define the contents of S16, S18, S1B, S1D, S39, S40and S42 respectively after booting up or reset.4.1 Recovery of the Factory Default SettingsIf the unit seems to be unresponsive to commands on the serial port this is most often due to theunit having been set into a power-down mode or the set-up for the serial connection having beenaltered. To overcome this a feature has been added which performs a factory reset on any modulewhich seems unresponsive. To factory reset a module, connect it to the PC‟s serial port andexecute the Factory Reset Tool (downloadable from www.telegesis.com). When pressing theReset button on the Reset Tool you are prompted to cause a hardware reset to the module bypulling the module‟s reset line low for more than 100ms (done by pressing the reset button on theDevelopment Board). Once completed, the factory default settings of the ETRXn module arerestored.©2011 Telegesis (UK) Ltd - 50 - AT Command Manual (Rev 3.05)

R305 AT Commands4.2 S-Registers for Network SetupS00 – Channel MaskDescriptionThe 802.15.4 channel mask.ParametersXXXXOperationsR/W LOCALR/W REMOTEBecomes effectiveWhen Joining, Scanning or establishing aPANNoteThe channel mask does not affect theAT+JPAN commandWhere XXXX represents a 16-bit decimal numberenabling IEEE 802.15.4 channel numbers 11 to 26.Writing a bit to 1 enables a channel andsubsequently writing a bit to 0 disables a channelfor scanning, joining and establishing networks.e.g. when setting S00 to 0001, only channel 11 willbe used for all following operations.Range0001 - FFFFStorageNon-VolatileFactory DefaultETRX3 LRS-Variants: 7FFFOthers: FFFFSW release R302 ●S01 – Transmit Power LevelDescriptionThe device‟s transmit power level in dBm.ParameterssnnOperationsR/W LOCALR/W REMOTENotesThe output power of the ”-PA” and “-LR”variants is higher than the value in S01.Please refer to the respective hardwaremanuals.The ETRX357-LRS power is reduced for ECregulatory compliance. See the hardwaremanual.Becomes effectiveWhen Joining or establishing a PANStorageNon-VolatileWhere snn represents a signed 8-bit decimalnumber.RangeETRX2: 4 to -43ETRX3: 8 to -43ETRX3 LRS Variants: -7 to -43Actual values are {8, 7, 6, 5, 4, 3, 2, 1, -1, -2, -3, -4,-5, -6, -7, -8, -9, -11, -12, -14, -17, -20, -26, -43}Entering a value not on this list (such as –19) willresult in the next lowest output power.Entering a value higher than 3 will automaticallyenable boost mode regardless of the setting of bitE of S11.Factory DefaultETRX3 LRS-Variants: -11Others: 3SW release R305 ●©2011 Telegesis (UK) Ltd - 51 - AT Command Manual (Rev 3.05)

R305 AT CommandsS02 – Preferred PAN IDDescriptionThe 802.15.4 PAN ID.OperationsR/W LOCALR/W REMOTEBecomes effectiveWhen Joining or establishing a PANParametersWhere represents a 16-bit hexadecimalnumberRange0000 – FFFFNotesTwo networks operating on the samechannel with the same PAN ID, but adifferent EPID are detected to be in conflictwith each other. PAN ID conflicts aredetected by the stack and resolved by one ofthe networks dynamically changing its PANID.The preferred PID does not affect theAT+JPAN commandWhen establishing a PAN the coordinator will picka random PAN ID if S02 is set to 0000. If set toany value between 0001 and FFFF this number willbe used as PAN ID instead, unless trying to use aPAN ID which already exists on the same channel.In this case a random PAN ID will be used instead.When joining only a PAN with the ID stored in S02will be joined unless S02 is set to 0000. In thiscase the next best PAN which allows joining isjoined.StorageNon-VolatileFactory Default0000SW release R300 ●S03 – Preferred Extended PAN IDDescriptionThe extended PAN ID.OperationsR/W LOCALR/W REMOTEBecomes effectiveWhen Joining or establishing a PANParametersWhere represents a 64-bit hexadecimalnumberRange0000000000000000 – FFFFFFFFFFFFFFFFNoteThe EPID is used for PAN ID conflictdetection. It is therefore recommended touse a random EPID at all times.The preferred EPID does not affect theAT+JPAN commandWhen establishing a PAN the coordinator will picka random EPID if S03 is set to all 0‟s. If set to anyother value this number will be used as EPIDinstead.When joining only a PAN with the EPID stored inS03 will be joined unless S03 is set to all 0‟s. Inthis case the next best PAN which allows joining isjoined.StorageFactory DefaultNon-Volatile0000000000000000SW release R300 ●©2011 Telegesis (UK) Ltd - 52 - AT Command Manual (Rev 3.05)

R305 AT CommandsS04 – Local EUI64DescriptionThe local node‟s unique EUI64 identifier.OperationsR LOCALR REMOTEParametersRange0000000000000000 – FFFFFFFFFFFFFFFFStorageFactory DefaultNon-VolatileSW release R300 ●S05 – Local 16-Bit NodeIDDescriptionThe local node‟s 16-bit NodeID.ParametersNoteReading this register while not associatedwith a network will result in an undefinedreturn value.OperationsR LOCALR REMOTEStorageNon-VolatileRange0000-FFFFFactory Defaultn/aSW release R300 ●S06 – Parent’s EUI64DescriptionThe parent node‟s unique EUI64 identifier.ParametersNoteThe return value is undefined for nodeswithout parents (coordinators and nodes thatare not joined to a network). For an FFD,S06 is the ID of the node via which the localnode joined the PANOperationsR LOCALR REMOTEStorageRange0000000000000000 – FFFFFFFFFFFFFFFFFactory Defaultn/aNon-VolatileSW release R300 ●©2011 Telegesis (UK) Ltd - 53 - AT Command Manual (Rev 3.05)

R305 AT CommandsS07 – Parent’s 16-Bit NodeIDDescriptionThe parent node‟s 16-bit NodeID.OperationsR LOCALR REMOTEParametersRange0000-FFFFNoteThe return value is undefined for nodeswithout parents (coordinators and nodes thatare not joined to a network). For an FFD,S07 is the ID of the node via which the localnode joined the PANStorageFactory Defaultn/aNon-VolatileSW release R300 ●S08 – Network KeyDescriptionThe network key which can be written usingthe password. The default password for R3xxis “password”.OperationsW LOCALW REMOTEWrite operationATS08=:ATREMS:,08=:Becomes effectiveOnly when establishing a PANRangeFrom 0 to 2 128 -1The 128-bit AES network key in hexadecimalrepresentation (32 characters).When set to all 0‟s (default) a random network keyis generated when establishing a PAN.This key is transmitted to all joining nodes and canbe encrypted using the link key.Factory DefaultStorage00000000000000000000000000000000Non VolatileSW release R300 ●©2011 Telegesis (UK) Ltd - 54 - AT Command Manual (Rev 3.05)

R305 AT CommandsS09 – Trust Centre Link KeyDescriptionThe link key which can be written using thepassword. The default password for R3xx is“password”.OperationsW LOCALW REMOTEWrite operationATS09=:ATREMS:,09=:Becomes effectiveWhen Joining or establishing a PANRangeFrom 0 to 2 128 -1The 128-bit trust centre link key in hexadecimalrepresentation (32 characters).When set to all 0s (default) a random trust centrelink key is generated when establishing a PAN.StorageFactory DefaultNon Volatile00000000000000000000000000000000SW release R300 ●©2011 Telegesis (UK) Ltd - 55 - AT Command Manual (Rev 3.05)

R305 AT Commands4.3 S-Registers for Module SetupS0A – Main FunctionDescriptionDefines the behaviour of the Device.ParametersXXXXOperationsR/W LOCALR/W REMOTEBecomes effectiveWhen joining or establishing a PAN (bitsF-E)Instantly (bits B-0)Write operationATS0A=XXXX:ATREMS:,0A=XXXX:NotesFor security reasons this register is passwordprotected. The default password for R3xx is“password”.See section 14 regarding secure networksTo block joining, set either bit 5 on the trustcentre or bit 0 on every node. Built-in function0017 only overrides bit 0An End Device (not Sleepy or Mobile) isprimarily to let a ZigBee PRO device join aZigBee 2006 PAN. An SED or MED is themore usual choiceStorageNon-VolatileWhere XXXX represents a 16-bit hexadecimalnumber.Range0000 to FFFFBit E-F: Device SelectionBit F Bit E Device Type0 0 Router (FFD)1 0 End Device0 1 Sleepy End Device1 1 Mobile End DeviceBit D: ReservedBit C: ReservedBit B: Set: Enable custom endpoint 2Bit A: Set: When joining don‟t ask for TrustCentre link keyBit 9: Set: Don‟t use central Trust Centre(distributed TC Mode)Bit 8: Set: Use Pre-Configured Trust CentreLink Key when joiningBit 7: Set: Trust centre uses hashed link keyBit 6: ReservedBit 5: Set: Don‟t allow nodes to join (TC setting)Bit 4: Set: Send Network key encrypted with thelink key to nodes joiningBit 3: Set: Don‟t allow nodes to re-joinunsecuredBit 2: Set: Send Network key encrypted with thelink key to nodes re-joining unsecuredBit 1: ReservedBit 0: Set: Don‟t allow other nodes to join thenetwork via this nodeFactory Default0000SW release R301 ●©2011 Telegesis (UK) Ltd - 56 - AT Command Manual (Rev 3.05)

R305 AT CommandsS0B – User Readable NameDescriptionPassword protected user defined name whichcan be used to identify the nodeOperationsR/W LOCALR/W REMOTEParametersccccccccccccccccName with up to 16 characters.Write operationATS0B=:ATREMS:,0B=:Becomes effectiveInstantlyStorageFactory DefaultTelegesisNon-VolatileSW release R302 ●S0C – PasswordDescriptionThe local node‟s password.OperationsW LOCALW REMOTEParameterscccccccc8 case sensitive characters (8 bytes).Note that the password must have exactly 8characters.Write operationATS0C=:ATREMS:,0C=:Becomes effectiveInstantlyStorageFactory DefaultpasswordNon-VolatileSW release R300 ●©2011 Telegesis (UK) Ltd - 57 - AT Command Manual (Rev 3.05)

R305 AT CommandsS0D – Device InformationDescriptionString containing the module‟s order codeand firmware revision.OperationsR LOCALR REMOTEParametersccc…cccText stringExamplesETRX2 R305XETRX357 R305CStorageNon-VolatileFactory DefaultN/ASW release R300 ●S0E – Prompt Enable 1DescriptionDefines the behaviour of the Device.OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyStorageNon-VolatileParametersXXXXWhere XXXX represents a 16-bit hexadecimalnumber.Range0000 to FFFFBit F: Set: Disable „>‟ prompt when enteringbinary dataBit E: Set: Disable UCAST, MCAST, BCAST dataBit D: Set: Disable RAW dataBit C: Set: Disable SEQ promptBit B: Set: Disable SINK promptBit A: Set: Disable SR: promptBit 9: Set: Disable RAW wrapperBit 8: Set: Disable NEWNODE promptBit 7: Set: Disable NACK:XX promptBit 6: Set: Disable ACK:XXBit 5: Set: Disable UCAST, MCAST, BCASTwrapperBit 4: Set: Disable LeftPAN promptBit 3: Set: Disable JPAN promptBit 2: Set: Disable PWRCHANGE:nn promptBit 1: Set: Disable OK promptBit 0: Set: Disable ERROR:XX promptFactory Default0000SW release R300 ●©2011 Telegesis (UK) Ltd - 58 - AT Command Manual (Rev 3.05)

R305 AT CommandsS0F – Prompt Enable 2DescriptionDefines the behaviour of the Device.ParametersXXXXOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyNotesUse of bit 8 requires bit 1 to be unsetUse of Endpoint 2 requires bit B of S0A to besetWhere XXXX represents a 16-bit hexadecimalnumber.Range0000 to 01FFBit 9 – Bit F: ReservedBit 8: Set: Show unhandled messages receivedby Endpoints 3 and aboveBit 7: Set: Hide “AddrResp” promptBit 6: Set: Hide Network Manager WarningBit 5: Set: Hide “DataMODE” promptBit 4: Set: Hide “CLOSED” promptStorageNon-VolatileBit 3: Set: Hide “OPEN” promptBit 2: Set: Hide all Sink AdvertisementsUnset: Show all Sink Advertisements,except advertisements by the current sinkBit 1: Set: Disable showing unhandled messagesreceived by Endpoints 0, 2, 3 etcBit 0: Set: Disable COO, FFD, SED and MEDpromptsFactory Default0006SW release R301 ●©2011 Telegesis (UK) Ltd - 59 - AT Command Manual (Rev 3.05)

R305 AT CommandsS10 – Extended FunctionDescriptionDefines the behaviour of the Device.OperationsR/W LOCALR/W REMOTEParametersXXXXWhere XXXX represents a 16-bit hexadecimalnumber.Range0000 to FFFFBecomes effectiveInstantlyNotesBit C: the ETRX357-LRS and ETRX357HR-LRS have an RF preamplifier, so thereported RSSI is 12dB higher than the powerat the antennaOnly set bit 8 if transmissions to the sink areinfrequent!StorageNon-VolatileBit F: Set: Don‟t exit data mode in case of datalossBit E: Set: Don‟t accept Data ModeBit D: Set: High RAM concentrator instead of LowRAM concentratorBit C: Set: Display RSSI and LQI of the last hopwhen devices report to AT+SN orAT+ANNCEBit B: Set: UCASTs and SCASTs wait for ACKBit A: Set: Disable playing Tune when receivingAT+IDENTBit 9: Set: Enable one second character timeoutwhen entering data for xCASTB.Bit 8: Set: Actively search for a sink if none isknownBit 7: Set: Node doesn‟t replace existing sink withbetter one (lower cost)Bit 6: Set: Node doesn‟t lose sink if it couldn‟t bereached for three timesBit 5: Set: Sink won‟t reply to nodes searching fora sinkBit 4: Set: Node is SinkBit 3: Set: Changes to S01 take effect instantlyBit 2: Set: Send BCAST[B] messages to routersonlyBit 1: Set: Send unicast messagesunacknowledgedBit 0: Set: Don‟t attach EUI64 to NWK frame whensending a message.Factory Default0000SW release R302 ●©2011 Telegesis (UK) Ltd - 60 - AT Command Manual (Rev 3.05)

R305 AT CommandsS11 – Device SpecificDescriptionDefines the behaviour of the Device.ParametersXXXXOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyNoteOn the ETRX2 series IRQ0,1,2,3 aregenerated by logic transitions on inputsI/O0,1,10,11 respectively, on the ETRX3series they are generated by logic leveltransitions on PA0, PA1, PB0 and PB6respectivelyStorageNon-VolatileWhere XXXX represents a 16-bit hexadecimalnumber.Bit F (MSB): Set: I/O3 (ETRX2) or PB7 (ETRX3) isPWM as defined by S1B/S1D.Unset: Standard I/O pin.Bit E: Set: Enable Boost ModeBit D: Set: Present 1.2V A/D-Reference at I/O0during measurement (ETRX2 only)Bit C: Set: I/O8 turns into A/D3, which can be readfrom S21 (ETRX2 only)Bit B: Set: Pad 38 turns into A/D4, which can beread from S22 (ETRX2 only)Bit A: ReservedBit 9: Set: Enable wakeup on UART activity (1stinput character is discarded)Bit 8: Set: Enable 100ms debouncing for all IRQsBit 7: Set: IRQ3 on rising edgeBit 6: Set: IRQ3 on falling edgeBit 5: Set: IRQ2 on rising edgeBit 4: Set: IRQ2 on falling edgeBit 3: Set: IRQ1 on rising edgeBit 2: Set: IRQ1 on falling edgeBit 1: Set: IRQ0 on rising edgeBit 0: Set: IRQ0 on falling edgeFactory Default0005SW release R301 ●©2011 Telegesis (UK) Ltd - 61 - AT Command Manual (Rev 3.05)

R305 AT Commands4.4 I/O related S-RegistersS12 – UART SetupDescriptionThe device‟s RS232 Baudrate and mode.The default setting of 0500 results in:19200bps, no parity, 1 stop bit, 8 data bits.OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyNoteIf bit 5 is set, bi-directional Hardware FlowControl is used instead of XON/XOFF flowcontrol. If using Hardware flow control I/O4or PB4 becomes the RTS output and theCTS input is assigned to I/O2 or PB3.Access to these I/Os via S16, S18 is blockedwhilst Hardware Flow control is active. Notethat in case the 128-byte output buffer of theETRX2 is full data will be dropped.The parity settings do not affect the bytestransmitted over the air.StorageNon-VolatileParametersXXXXWhere XXXX represents a 16-bit hexadecimalnumber.Range of the most significant byte00 to 0C00: 1200 baud01: 2400 baud02: 4800 baud03: 9600 baud04: 14400 baud05: 19200 baud06: 28800 baud07: 38400 baud08: 50000 baud09: 57600 baud0A: 76800 baud0B: 100000 baud0C: 115200 baudRange of the least significant byte00 to FFbit 7 set: Enable STX ETX wrapperbit 6 Reservedbit 5 set: H/W flow control enablebit 4 set: no command echobit 3 set: 7 data bits instead of 8bit 2 set: 2 stop bits instead of onebit 1 set: odd parity enabledbit 0 set: even parity enabledFactory Default0500SW release R300 ●©2011 Telegesis (UK) Ltd - 62 - AT Command Manual (Rev 3.05)

R305 AT CommandsS13 – ETRX2: Pull-up enable ETRX3: I/O ConfigurationDescriptionParametersConfigures the I/O pins.XXXX (ETRX2) or XXXXXXXX (ETRX3)Setting a bit on the ETRX2 enables the builtinpull-up on the corresponding pin.Setting a bit on the ETRX3 will have thefollowing effect:Where XXXX represents a 16-bit hexadecimalnumber and XXXXXXXX represents a 32-bithexadecimal number.S13 S16 S180 0 0 Floating Input0 0 1 floating input0 1 0 Output driving 00 1 1 Output driving 11 0 0 Input with pull-down1 0 1 Input with pull-up1 1 0 Open Drain Output (0)1 1 1 Open Drain Output(open)OperationsR/W LOCALR/W REMOTEBecomes effectiveAfter ResetETRX2: representing I/O pinsxx BA98 7654 3210e.g. setting bit 7 to 1 will enable the pull-up for I/Opin 7ETRX3: representing the I/O pinsxxxxxxxx e.g. setting bit 7 to 1 will configure PA7 to either bean input with pull-up or pull-down, or an open-drainoutput.Factory DefaultETRX2: 0000ETRX3: 00000000NoteTo achieve ultra low current consumption onthe ETRX2 it is recommended not to use thebuilt-in pull-ups and leave this register in itsdefault state.The ETRX357‟s current consumption maybenefit from the use of pull-ups or pull-downswhere inputs are otherwise unconnected.StorageNon-VolatileSW release R300 ●©2011 Telegesis (UK) Ltd - 63 - AT Command Manual (Rev 3.05)

R305 AT CommandsS14 – ETRX2: Pull-down enable ETRX3: ReservedDescriptionEnables the built-in pull-downs for eachindividual I/O pin of the ETRX2.OperationsR/W LOCALR/W REMOTEBecomes effectiveAfter ResetNoteTo achieve ultra low current consumption it isrecommended not to use the built-in pulldownsand leave this register in its defaultstate.ParametersXXXXWhere XXXX represents a 16-bit hexadecimalnumber.Range0000 to FFFFrepresenting I/O pinsxx BA98 7654 3210e.g. setting bit 7 to 1 will enable the pull-down forI/O pin 7On the ETRX3 series this register isReserved and currently not in useFactory Default0000StorageNon-VolatileSW release R300 ●©2011 Telegesis (UK) Ltd - 64 - AT Command Manual (Rev 3.05)

R305 AT CommandsS15 – ETRX3: I/O Configuration ETRX2: ReservedDescriptionThis Register is not used on the ETRX2. Onthe ETRX3 it is used to enable alternatefunctionalities for each I/O pin. When set tozero the corresponding I/O pin is a standardI/O pin, when set to 1 any other setting forthis I/O are overwritten by the peripheralfunctionality.representing the I/O pinsxxxxxxxxOperationsR/W LOCALR/W REMOTEBecomes effectiveAfter ResetNotePB0 is used internally on the ETRX357-LRSand ETRX357HR-LRS and is not available tothe user.StorageNon-VolatileParametersXXXXXXXXWhere XXXXXXXX represents a 32-bithexadecimal number.bit 31 reservedbit 30 reservedbit 29 reservedbit 28 reservedbit 27 reservedbit 26 reservedbit 25 reservedbit 24 reservedbit 23 reserved (PC7)bit 22 reserved (PC6)bit 21 Set: Enable TX_Active (reserved on –LR)bit 20 reserved (PC4)bit 19 reserved (PC3)bit 18 reserved (PC2)bit 17 Set: Enable ADC3 (PC1)bit 16 reserved (PC0)bit 15 Set: Enable ADC2 (PB7)bit 14 Set: Enable ADC1 (PB6)bit 13 Set: Enable ADC0 (PB5)bit 12 Set: reservedbit 11 Set: reservedbit 10 Set: Enable RXD input (PB2)bit 9 Set: Enable TXD output (PB1)bit 8 Set: Enable Vref Output (PB0) during ADCconversionsbit 7 reserved (PA7)bit 6 reserved (PA6)bit 5 reserved (PA5)bit 4 reserved (PA4)bit 3 reserved (PA3)bit 2 reserved (PA2)bit 1 reserved (PA1)bit 0 reserved (PA0)Factory Default00000600SW release R300 ●©2011 Telegesis (UK) Ltd - 65 - AT Command Manual (Rev 3.05)

R305 AT CommandsS16 – Data Direction of I/O PortDescriptionThe data direction of the module‟s I/O portOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXX (ETRX2) or XXXXXXXX (ETRX3)Where XXXX represents a 16-bit hexadecimalnumber and XXXXXXXX represents a 32-bithexadecimal number.ETRX2: representing I/O pinsxxxx BA98 7654 3210Note: On the “-LR” variants of the ETRX3PC5 is reserved and cannot be controlledusing this register.e.g. setting bit 7 to 1 will configure I/O7 to be anoutput.StorageVolatileETRX3: representing the I/O pinsxxxxxxxx e.g. setting bit 7 to 1 will configure PA7 to be anoutputFactory DefaultDefined in S17SW release R300 ●S17 – Initial Setting of S16DescriptionThe initial setting of S16 stored in nonvolatile memoryParametersXXXX (ETRX2) or XXXXXXXX (ETRX3)OperationsR/W LOCALR/W REMOTEWhere XXXX or XXXXXXXX represent the initialvalue of S16 which is loaded after boot-up, soft orhard reset.Becomes effectiveAfter Soft or Hard ResetStorageNon-VolatileFactory DefaultETRX2: 00F8ETRX3: 000142CCSW release R300 ●©2011 Telegesis (UK) Ltd - 66 - AT Command Manual (Rev 3.05)

R305 AT CommandsS18 – Output Buffer Of I/O PortDescriptionThe output buffer of the module‟s I/O portOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXX (ETRX2) or XXXXXXXX (ETRX3)Where XXXX represents a 16-bit hexadecimalnumber and XXXXXXXX represents a 32-bithexadecimal number.ETRX2: representing I/O pinsxxxx BA98 7654 3210Note: On the “-LR” variants of the ETRX3PC5 is reserved and cannot be controlledusing this register.e.g. setting bit 7 to 1 will cause I/O7 to drive high (ifdefined as an output in S16)ETRX3: representing the I/O pinsxxxxxxxx StorageVolatilee.g. setting bit 7 to 1 will cause PA7 to drive high(depending on settings in S16 and S15)Factory DefaultDefined in S19SW release R300 ●S19 – Initial Setting of S18DescriptionThe initial setting of S18 stored in nonvolatile memoryParametersXXXX (ETRX2) or XXXXXXXX (ETRX3)OperationsR/W LOCALR/W REMOTEWhere XXXX or XXXXXXXX represent the initialvalue of S18 which is loaded after boot-up, soft orhard reset.Becomes effectiveAfter Soft or Hard ResetStorageNon-VolatileFactory DefaultETRX2: 00F0ETRX3: 00000000SW release R300 ●©2011 Telegesis (UK) Ltd - 67 - AT Command Manual (Rev 3.05)

R305 AT CommandsS1A – Input Buffer of I/O PortDescriptionThe Logical Levels at the I/O PinsOperationsR LOCALR REMOTEBecomes effectiveInstantlyStorageInstant Reading of Port StatusRange0000 to FFFF (ETRX2)00000000 to FFFFFFFF (ETRX3)ETRX2: representing I/O pinsxxxx BA98 7654 3210ETRX3: representing the I/O pinsxxxxxxxx S1A represents the logic level at each pin of theI/O port.Factory Defaultn/aSW release R300 ●S1B – PWM Pin Top ValueDescriptionThe mode of operation for the specialfunction pinOperationsR/W LOCALR/W REMOTEOperationsInstantlyParametersXXXXRange0000 to FFFFThis register represents the top value of the 16-bitcounter counting from 0 to top repeatedlyincrementing at 12MHz. When reaching top I/O3 isset, given that the PWM is enabled in S11.StorageVolatileExamplesFactory DefaultDefined in S1CSW release R300 ●©2011 Telegesis (UK) Ltd - 68 - AT Command Manual (Rev 3.05)

R305 AT CommandsS1C – Initial value of S1BDescriptionThe initial setting of S1B stored in nonvolatile memoryParametersXXXXOperationsR/W LOCALR/W REMOTEWhere XXXX represents the initial value of S1Bwhich is loaded after boot-up, soft or hard reset.Becomes effectiveAfter Soft or Hard ResetStorageFactory DefaultNon-Volatile3A98 (800Hz 50% m/s ratio)SW release R300 ●S1D – PWM Pin Compare ValueDescriptionThe mode of operation for the specialfunction pinOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXRange0000 to FFFFIf the special function pin is enabled by setting bit Fof S11, this register represents the compare valueof the 16-bit counter counting from 0 to toprepeatedly incrementing at 12MHz. Whenreaching compare I/O3 is cleared.StorageFactory DefaultVolatileDefined in S1ESW release R300 ●S1E – Initial Value S1DDescriptionThe initial setting of S1D stored in nonvolatile memoryParametersXXXXOperationsR/W LOCALR/W REMOTEWhere XXXX represents the initial value of S1Dwhich is loaded after boot-up, soft or hard reset.Becomes effectiveAfter Soft or Hard ResetStorageFactory DefaultNon-Volatile1D4C (800Hz 50% m/s ratio)SW release R300 ●©2011 Telegesis (UK) Ltd - 69 - AT Command Manual (Rev 3.05)

R305 AT CommandsS1F – A/D1 Reading (ETRX3 series ADC0)DescriptionThe analogue reading of A/D1 (ETRX3series ADC0)ETRX3: Only when bit 13 (0x0D) of S15 isset, invalid otherwiseOperationsR LOCALR REMOTEBecomes effectiveInstantlyParametersXXXXRepresentationThe hexadecimal reading of the analogue input inmV (mV * 10 on the ETRX3) with respect toground. The return value will be undefined in casethe corresponding A/D converter has not beenenabled.RangeETRX2: 0000 – 04B0 (0 – 1200)ETRX3: 0000 – 2EE0 (0 – 12000)StorageInstant Reading of analogue inputSW release R300 ●S20 – A/D2 Reading (ETRX3 series ADC1)DescriptionThe analogue reading of A/D2 (ETRX3series ADC1)ETRX3: Only when bit 14 (0x0E) of S15 isset, invalid otherwiseOperationsR LOCALR REMOTEBecomes effectiveInstantlyParametersXXXXRepresentationThe hexadecimal reading of the analogue input inmV (mV * 10 on the ETRX3) with respect toground. The return value will be undefined in casethe corresponding A/D converter has not beenenabled.RangeETRX2: 0000 – 04B0 (0 – 1200)ETRX3: 0000 – 2EE0 (0 – 12000)StorageInstant Reading of analogue inputSW release R300 ●©2011 Telegesis (UK) Ltd - 70 - AT Command Manual (Rev 3.05)

R305 AT CommandsS21 – A/D3 Reading (ETRX3 series ADC2)DescriptionThe analogue reading of A/D3 (ETRX3series ADC2)ETRX2: Only when bit C of S11 is set, invalidotherwiseETRX3: Only when bit 15 (0x0F) of S15 isset, invalid otherwiseOperationsR LOCALR REMOTEBecomes effectiveInstantlyStorageParametersXXXXRepresentationThe hexadecimal reading of the analogue input inmV (mV * 10 on the ETRX3) with respect toground. The return value will be undefined in casethe corresponding A/D converter has not beenenabled.RangeETRX2: 0000 – 04B0 (0 – 1200)ETRX3: 0000 – 2EE0 (0 – 12000)Instant Reading of analogue inputSW release R300 ●S22 – A/D4 Reading (ETRX3 series ADC3)DescriptionThe analogue reading of A/D4 (ETRX3series ADC3)ETRX2: Only when bit B of S11 is set, invalidotherwiseETRX3: Only when bit 17 (0x11) of S15 isset, invalid otherwiseOperationsR LOCALR REMOTEBecomes effectiveInstantlyStorageParametersXXXXRepresentationThe hexadecimal reading of the analogue input inmV (mV * 10 on the ETRX3) with respect toground. The return value will be undefined in casethe corresponding A/D converter has not beenenabled.RangeETRX2: 0000 – 04B0 (0 – 1200)ETRX3: 0000 – 2EE0 (0 – 12000)Instant Reading of analogue inputSW release R300 ●©2011 Telegesis (UK) Ltd - 71 - AT Command Manual (Rev 3.05)

R305 AT Commands4.5 S-Registers Defining the Functionality of the ModuleThere are 14 events which can trigger a user-selectable action to prevent the need for a hostmicrocontroller for simple applications. Four out of those 14 events are the external interruptswhich can be enabled in register S11. The actions to be performed on those four interrupt eventsare defined in S23 to S26. The user can pick any of the actions from the list in section 5 of thisdocument and assign them to any event.Another event is triggering when the unit is reset or power cycled and also joining a networktriggers an event.The remaining 8 events are timed events. Registers S29 to S38 control those 8 timers and theircorresponding events. Please note that the first 4 timers are used by default for networkmanagement tasks, which can be modified by the user when changing the correspondingregisters. A timer will increment every 250ms (4 times a second) and when the timer reaches thevalue stored in the timer/counter register the corresponding action will be executed.S23 – Immediate Functionality At IRQ0 (ETRX2: I/O0 ETRX3:PA0)DescriptionParametersDescribes the immediate action taken onXXXXIRQ0.OperationsR/W LOCALR/W REMOTEIf set to 0 the functionality is disabled. Please seesection 5 for a list of available functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default0001 (Wakeup to power mode 0)SW release R300 ●©2011 Telegesis (UK) Ltd - 72 - AT Command Manual (Rev 3.05)

R305 AT CommandsS24 – Immediate Functionality At IRQ1 (ETRX2: I/O1 ETRX3:PA1)DescriptionParametersDescribes the immediate action taken onXXXXIRQ1.OperationsR/W LOCALR/W REMOTEIf set to 0 the functionality is disabled. Please seesection 5 for a list of available functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default0000 (none)SW release R300 ●S25 – Immediate Functionality At IRQ2 ( (ETRX2: I/O10 ETRX3:PB0)DescriptionParametersDescribes the immediate action taken onXXXXIRQ2.OperationsR/W LOCALR/W REMOTEIf set to 0 the functionality is disabled. Please seesection 5 for a list of available functionalities.Becomes effectiveInstantlyNotePB0 is used internally on theETRX357(HR)-LRS and is not available tothe userFactory Default0000 (none)StorageNon-VolatileSW release R300 ●©2011 Telegesis (UK) Ltd - 73 - AT Command Manual (Rev 3.05)

R305 AT CommandsS26 – Immediate Functionality At IRQ3 (ETRX2: I/O11 ETRX3:PB6)DescriptionParametersDescribes the immediate action taken onXXXXIRQ3.OperationsR/W LOCALR/W REMOTEIf set to 0 the functionality is disabled. Please seesection 5 for a list of available functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default0000 (none)SW release R300 ●©2011 Telegesis (UK) Ltd - 74 - AT Command Manual (Rev 3.05)

R305 AT CommandsS27 – Functionality at BootupDescriptionDescribes the immediate action taken afterboot-up (and stack initialization).OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of available functionalities.Becomes effectiveInstantlyNoteOn versions before R305 this was executedbefore the protocol stack was running so itcould not be used for network or messagefunctionsStorageNon-VolatileFactory Default0000 (none)SW release R305 ●S28 – Functionality at Network JoinDescriptionDescribes the immediate action taken afterjoining a network.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of available functionalities.Becomes effectiveInstantlyStorageFactory DefaultNon-Volatile0000 (none)SW release R302 ●©2011 Telegesis (UK) Ltd - 75 - AT Command Manual (Rev 3.05)

R305 AT CommandsS29 –Timer/Counter 0DescriptionA multipurpose Timer/Counter whosefunctionality is defined by S2AOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXA 16-bit hexadecimal number representing athreshold for either a timer or counter event to betriggered. When reading this register the thresholdrather than the actual timer/counter value isdisplayed.If set to 0 the corresponding functionality isdisabled.StorageNon-VolatileFactory Default0004 (1s interval)SW release R300 ●S2A – Functionality For Timer/Counter 0DescriptionDefines the functionality for Timer/Counter 0events.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of the functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default8010 (end devices poll parent)SW release R300 ●©2011 Telegesis (UK) Ltd - 76 - AT Command Manual (Rev 3.05)

R305 AT CommandsS2B –Timer/Counter 1DescriptionA multipurpose Timer/Counter whosefunctionality is defined by S2COperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXA 16-bit hexadecimal number representing athreshold for either a timer or counter event to betriggered. When reading this register the thresholdrather than the actual timer/counter value isdisplayed.If set to 0 the corresponding functionality isdisabled.StorageNon-VolatileFactory Default00F0 (1 min interval)SW release R300 ●S2C – Functionality For Timer/Counter 1DescriptionDefines the functionality for Timer/Counter 1events.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of the functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default821E (advertise sink for 30 hops and createaggregation routes to COO and sinks)SW release R300 ●©2011 Telegesis (UK) Ltd - 77 - AT Command Manual (Rev 3.05)

R305 AT CommandsS2D –Timer/Counter 2DescriptionA multipurpose Timer/Counter whosefunctionality is defined by S2EOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXA 16-bit hexadecimal number representing athreshold for either a timer or counter event to betriggered. When reading this register the thresholdrather than the actual timer/counter value isdisplayed.If set to 0 the corresponding functionality isdisabled.StorageNon-VolatileFactory Default00F4 (1 min 1s interval)SW release R300 ●S2E – Functionality For Timer/Counter 2DescriptionDefines the functionality for Timer/Counter 2events.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of the functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default8014 (leave network if I am alone)SW release R300 ●©2011 Telegesis (UK) Ltd - 78 - AT Command Manual (Rev 3.05)

R305 AT CommandsS2F –Timer/Counter 3DescriptionA multipurpose Timer/Counter whosefunctionality is defined by S30OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXA 16-bit hexadecimal number representing athreshold for either a timer or counter event to betriggered. When reading this register the thresholdrather than the actual timer/counter value isdisplayed.If set to 0 the corresponding functionality isdisabled.StorageNon-VolatileFactory Default00F2 (1min interval)SW release R300 ●S30 – Functionality For Timer/Counter 3DescriptionDefines the functionality for Timer/Counter 3events.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of the functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default8015 (if not part of a network do AT+JN)SW release R300 ●©2011 Telegesis (UK) Ltd - 79 - AT Command Manual (Rev 3.05)

R305 AT CommandsS31 –Timer/Counter 4DescriptionA multipurpose Timer/Counter whosefunctionality is defined by S32OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXA 16-bit hexadecimal number representing athreshold for either a timer or counter event to betriggered. When reading this register the thresholdrather than the actual timer/counter value isdisplayed.If set to 0 the corresponding functionality isdisabled.StorageNon-VolatileFactory Default0000SW release R302 ●S32 – Functionality For Timer/Counter 4DescriptionDefines the functionality for Timer/Counter 4events.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of the functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default0000SW release R302 ●©2011 Telegesis (UK) Ltd - 80 - AT Command Manual (Rev 3.05)

R305 AT CommandsS33 –Timer/Counter 5DescriptionA multipurpose Timer/Counter whosefunctionality is defined by S34OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXA 16-bit hexadecimal number representing athreshold for either a timer or counter event to betriggered. When reading this register the thresholdrather than the actual timer/counter value isdisplayed.If set to 0 the corresponding functionality isdisabled.StorageFactory DefaultNon-Volatile0000SW release R300 ●S34 – Functionality For Timer/Counter 5DescriptionDefines the functionality for Timer/Counter 5events.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of the functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default0000SW release R300 ●©2011 Telegesis (UK) Ltd - 81 - AT Command Manual (Rev 3.05)

R305 AT CommandsS35 –Timer/Counter 6DescriptionA multipurpose Timer/Counter whosefunctionality is defined by S36OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXA 16-bit hexadecimal number representing athreshold for either a timer or counter event to betriggered. When reading this register the thresholdrather than the actual timer/counter value isdisplayed. If set to 0 the correspondingfunctionality is disabled.StorageNon-VolatileFactory Default0000SW release R300 ●S36 – Functionality For Timer/Counter 6DescriptionDefines the functionality for Timer/Counter 6events.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of the functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default0000SW release R300 ●©2011 Telegesis (UK) Ltd - 82 - AT Command Manual (Rev 3.05)

R305 AT CommandsS37 –Timer/Counter 7DescriptionA multipurpose Timer/Counter whosefunctionality is defined by S38OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXA 16-bit hexadecimal number representing athreshold for either a timer or counter event to betriggered. When reading this register the thresholdrather than the actual timer/counter value isdisplayed. If set to 0 the correspondingfunctionality is disabled.StorageNon-VolatileFactory Default0000SW release R300 ●S38 – Functionality For Timer/Counter 7DescriptionDefines the functionality for Timer/Counter 6events.OperationsR/W LOCALR/W REMOTEParametersXXXXIf set to 0 the functionality is disabled. Please seesection 5 for a list of the functionalities.Becomes effectiveInstantlyStorageNon-VolatileFactory Default0000SW release R300 ●©2011 Telegesis (UK) Ltd - 83 - AT Command Manual (Rev 3.05)

R305 AT CommandsS39 – Power ModeDescriptionThe current power mode of the moduleOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXRange0000 – 0003The module‟s power mode as described insection 6.StorageVolatileFactory DefaultDefined in S3ASW release R300 ●S3A – Initial Power ModeDescriptionThe module‟s power mode after start-up andreset.OperationsR/W LOCALR/W REMOTEBecomes effectiveAfter hard or soft resetParametersXXXXRange0000 – 0003The module‟s power mode as described insection 6.StorageNon-VolatileFactory Default0000SW release R300 ●S3B – Start-up Functionality Plaintext ADescriptionContains Text which is used by some of theactions described in section 5.ParametersUp to 50 charactersOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyStorageNon-VolatileFactory DefaultBUTTON3SW release R300 ●©2011 Telegesis (UK) Ltd - 84 - AT Command Manual (Rev 3.05)

R305 AT CommandsS3C – Start-up Functionality Plaintext BDescriptionContains Text which is used by some of theactions described in section 5.ParametersUp to 50 charactersOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyStorageNon-VolatileFactory DefaultBUTTON4SW release R300 ●S3D – Supply VoltageDescriptionThe Supply voltage of the device in mV.OperationsR LOCALR REMOTEParametersnnnnWhere nnnn represents the supply voltage in mV.Becomes effectiveN/AStorageFactory DefaultN/AVolatileSW release R300 ●©2011 Telegesis (UK) Ltd - 85 - AT Command Manual (Rev 3.05)

R305 AT Commands4.6 Advanced SettingsS3E – Multicast Table Entry 00DescriptionThe ID portion of Multicast Table Entry 00OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXIf S3E is not set to all 0‟s multicast table entry 1 toendpoint 1 (the AT command layer‟s endpoint) isset with the setting of this register is createdinstantly and after a reset.NoteSame effect as AT+MSET, but can be set atboot-up by built-in functionalityStorageNon-VolatileFactory Default0000SW release R300 ●S3F – Multicast Table Entry 01DescriptionThe ID portion of Multicast Table Entry 01OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParametersXXXXIf S3F is not set to all 0‟s multicast table entry 2 toendpoint 1 (the AT command layer‟s endpoint) isset with the setting of this register is createdinstantly and after a reset.NoteAs for S3EStorageNon-VolatileFactory Default0000SW release R300 ●©2011 Telegesis (UK) Ltd - 86 - AT Command Manual (Rev 3.05)

R305 AT CommandsS40 – Source and Destination Endpoints for xCASTs (volatile)DescriptionParametersThe source and destination endpoints for allssddmessages.OperationsR/W LOCALR/W REMOTEWhere ss is the hexadecimal source endpoint anddd is the hexadecimal destination endpoint.Becomes effectiveInstantlyStorageFactory DefaultVolatileDefined in S41SW release R300 ●S41 – Initial Setting of S40DescriptionThe initial setting of S40 stored in nonvolatile memoryOperationsR/W LOCALR/W REMOTEParametersssddWhere ss is the hexadecimal source endpoint anddd is the hexadecimal destination endpoint.Becomes effectiveAfter Soft or Hard ResetStorageFactory DefaultNon-Volatile0101SW release R300 ●©2011 Telegesis (UK) Ltd - 87 - AT Command Manual (Rev 3.05)

R305 AT CommandsS42 – Cluster ID for xCASTs (volatile)DescriptionThe Cluster ID any xCAST message is sentto.OperationsR/W LOCALR/W REMOTEParametersXXXXThe cluster ID of any xCAST messageBecomes effectiveInstantlyStorageFactory DefaultDefined in S43VolatileSW release R300 ●S43 – Initial Setting of S42DescriptionThe initial setting of S42 stored in nonvolatile memoryOperationsR/W LOCALR/W REMOTEBecomes effectiveAfter Soft or Hard ResetParametersXXXXThe cluster ID of any xCAST messageFactory Default0002StorageNon-VolatileSW release R300 ●©2011 Telegesis (UK) Ltd - 88 - AT Command Manual (Rev 3.05)

R305 AT CommandsS44 – Profile ID for xCASTs (volatile)DescriptionThe profile ID for all messages.OperationsR/W LOCALR/W REMOTEParametersXXXXThe profile ID of any xCAST messageBecomes effectiveInstantlyStorageFactory DefaultDefined in S45VolatileSW release R300 ●S45 – Initial Setting of S44DescriptionThe initial setting of S44 stored in nonvolatile memoryOperationsR/W LOCALR/W REMOTEParametersXXXXThe profile ID of any xCAST messageBecomes effectiveAfter Soft or Hard ResetStorageFactory DefaultC091Non-VolatileSW release R300 ●S46 – Start-up Functionality 32-bit numberDescriptionVolatile 32-bit register which can be used bysome of the build in functionalityParametersXXXXXXXXOperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyStorageVolatileFactory Default00000000SW release R303 – upgraded to 32-bit ●©2011 Telegesis (UK) Ltd - 89 - AT Command Manual (Rev 3.05)

R305 AT CommandsS47 – Power DescriptorDescriptionRegister defining the Node‟s powerdescriptor, which can be read by remotenodes using ZigBee compliant ZDOmessaging.ParametersXXXXThe Power Descriptor as described in section2.3.2.4 of the ZigBee specification.OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyStorageNon-VolatileFactory DefaultC110SW release R302 ●S48 – Endpoint 2 Profile IDDescriptionRegister defining the Profile ID of the Node‟sendpoint 2.OperationsR/W LOCALR/W REMOTEParametersXXXXThe 16 bit Profile ID.Becomes effectiveInstantlyStorageNon-VolatileFactory DefaultC091SW release R302 ●S49 – Endpoint 2 Device IDDescriptionRegister defining the Device ID of the Node‟sendpoint 2OperationsR/W LOCALR/W REMOTEParametersXXXXThe 16 bit device ID.Becomes effectiveInstantlyStorageNon-VolatileFactory Default0000SW release R302 ●©2011 Telegesis (UK) Ltd - 90 - AT Command Manual (Rev 3.05)

R305 AT CommandsS4A – Endpoint 2 Device VersionDescriptionRegister defining the version of the deviceattached to the Node‟s endpoint 2OperationsR/W LOCALR/W REMOTEParameters00XXThe 8 bit version trailed by two leading 0‟s..Becomes effectiveInstantlyStorageNon-VolatileFactory Default0000SW release R302 ●S4B – Endpoint 2 Input Cluster ListDescriptionRegister defining the input cluster list of thedevice attached to the Node‟s endpoint 2OperationsR/W LOCALR/W REMOTEBecomes effectiveInstantlyParameters[XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX]A list of a maximum of 12 x 16 bit cluster IDsseparated by commas. The list may have anylength from 0 to 12 clustersExampleATS4B=1101,000DStorageFactory DefaultNon-Volatile0000SW release R302 ●©2011 Telegesis (UK) Ltd - 91 - AT Command Manual (Rev 3.05)

R305 AT CommandsS4C – Endpoint 2 Output Cluster ListDescriptionRegister defining the output cluster list of thedevice attached to the Node‟s endpoint 2OperationsR/W LOCALR/W REMOTEParameters[XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX,XXXX]A list of a maximum of 12 x 16 bit cluster IDsseparated by commas. The list may have anylength from 0 to 12 clustersBecomes effectiveInstantlyStorageFactory DefaultNon-Volatile0000SW release R302 ●S4D – Mobile End Device Poll TimeoutDescriptionIn an FFD,the register defining the amount oftime after which a mobile end device timesout of its parent‟s child table if it has notpolled.In an MED, defines the delay between anMED losing contact with its parent andreporting “LostPAN”.OperationsR/W LOCALR/W REMOTEBecomes effectiveAfter Soft or Hard ResetParameters00XX8-bit number led by “00”, which represents thetimeout in quarter seconds. The default of 0x0014results in a timeout of 5s.Factory Default0014StorageNon-VolatileSW release R302 ●©2011 Telegesis (UK) Ltd - 92 - AT Command Manual (Rev 3.05)

R305 AT CommandsS4E – End Device Poll TimeoutDescriptionRegister defining the amount of time afterwhich a Sleepy End Device times out of itsparent‟s child table if it hasn‟t polledOperationsR/W LOCALR/W REMOTEBecomes effectiveAfter Soft or Hard ResetParametersXXYYWhere YY is the timeout in seconds left shifted byXX (YY * 2^XX). The default number results in atimeout of 5 Minutes, whereas the maximumnumber results in a timeout of approximately 48days.Maximum0EFFStorageNon-VolatileFactory Default0605SW release R303 ●S4F – MAC TimeoutDescriptionRegister defining the MAC timeoutParametersXXXXOperationsR/W LOCALR/W REMOTEBecomes effectiveAfter Soft or Hard ResetStorageNon-VolatileThe Ember_Indirect_Transmission_Timeout is theamount of time in milliseconds that the MAC willhold a message for indirect transmission to a child.In addition to this is also basis for the timeout afterwhich an acknowledged unicast is nacked in caseno ack is received.Factory Default0BB8SW release R302 ●©2011 Telegesis (UK) Ltd - 93 - AT Command Manual (Rev 3.05)

R305 AT Commands5 Build in FunctionalityThe following table gives an overview of the built-in functionality which can be triggered either bythe four external interrupts, boot-up, joining a network, or by 8 individually programmabletimers/counters. If the node is in a low power mode and the action requires the node to wake up,the node will do so and go back to its original power mode after completion of the action. Whentriggered by a timer the timer will restart only in case the most significant bit of the action is set to 1(e.g. instead of 0001 set 8001).Overview of Actions0000 No operation of the corresponding interrupt/timer/counter0001 Change to power mode 0.0002 Change to power mode 1.0003 Change to power mode 2.0004 Change to power mode 3.… Reserved0010 If I am an end device Poll Parent for data.0011 Update the Network key with new random key.0012 Check for other devices on the network. If no other devices could be found for threeconsecutive tries, attempt a rejoin using the current network key each time this functionalityis triggered. Note: No functionality on COOs.0013 Check for other devices on the network. If no other devices could be found for threeconsecutive tries, attempt a rejoin using the known network key. If this is unsuccessful tryan unsecured rejoin each time this functionality is triggered from there on. Note: Nofunctionality on COOs.0014 Check for other devices on the network. If no other devices could be found for threeconsecutive tries, attempt a rejoin using the known network key. If this is unsuccessful try arejoin using the current link key the next time this functionality is triggered. If this isunsuccessful leave the current network the next time this action is triggered. Note: Nofunctionality on COOs.0015 In case I am not joined to a network scan for and join the next best0016 Reserved0017 Allow joining via the local node for 60 Seconds (when it is disabled using bit 0 of S0A)0018 Copy local Inputs to Remote outputs: Read Local S1A and if changed since the previoustime, write the reading into the remote S18 whose address is given in S3B.001D End Data Mode (if active)003x Toggle I/Ox004x Flash I/Ox (pull low) for 250ms005x Set I/Ox to 0006x Set I/Ox to 10108 The unit sends the contents of S3B to the networks sink.0109 The unit sends the contents of S3C to the networks sink.0110 Sends the reading of the I/O, A/D1 & A/D2 or ADC0 & ADC1 and V cc as well as an 8-bittransmission counter which increments with every transmission to the network‟s sink, and ifno sink is known the unit will search for a sink immediately when bit 8 of S10 is set.0111 Same as 0110, but to charge an external RC timer ETRX2:I/O7 or ETRX3:PA3 is pulledhigh whilst sending the data and left high impedance the rest of the time.0112 Send a Tracking Message to all nearby routers which will forward this message and theRSSI reading to their nearest sink.©2011 Telegesis (UK) Ltd - 94 - AT Command Manual (Rev 3.05)

R305 AT CommandsOverview of Actions0113 Same as 0112, but to charge an external RC timer ETRX2:I/O7 or ETRX3:PA3 is pulledhigh whilst sending the data and left high impedance the rest of the time.0114 Same as 0112, but tracking message doesn‟t contain ADC readings to save power ontracked device (TRACK2 Prompt)0115 Same as 0114, but to charge an external RC timer ETRX2:I/O7 or ETRX3:PA3 is pulledhigh whilst sending the data and left high impedance the rest of the time.0120 Sends the contents of S3B as a RAW transmission.0121 Sends the contents of S3C as a RAW transmission.0130 Sends to the network‟s sink the reading of the I/O, an 8-bit transmission counter whichincrements with every transmission, the contents of S46 and the reading of any A/D [1..4]enabled in S15 (ETRX3) or S11 (ETRX2). If no sink is known the unit will search for a sinkimmediately when bit 8 of S10 is set0131 Same as 0130, but to charge an external RC timer ETRX2:I/O7 or ETRX3:PA3 is pulledhigh whilst sending the data and left high impedance the rest of the time.02XX If I am a Sink advertise me for x hops (max. no. of hops: 30). If I am a COO createaggregation routes needed for Trust Centre. NB message does not reach end deviceswhen parent already knows a sink address0300 Increment S460301 Decrement S460302 Clear S460400 Show status on ETRX2:I/O3, ETRX3:PA7. LED on (pin driven low) = no connection.Blinking fast = Auto-searching for PAN. Blinking slow = connected to PAN. Theaccompanying counter register defines the update interval. Note: I/O3/PA7 must be definedto be an output.0401 Show status on ETRX2:I/O10, ETRX3:PB7. LED on (pin driven low) = no connection.Blinking fast = Auto-searching for PAN. Blinking slow = connected to PAN. Theaccompanying counter register defines the update interval. Note: I/O10/PB7 must bedefined to be an output.2000 When triggered the number of times listed in the accompanying counter a message is sentto the sink containing a transmission counter and the reading of the analogue and digitalinputs. Note: Can only be triggered by setting S23, S24, S25 or S26 to 24XX .2001 When enabling this action the command line is disabled and as soon as a number of bytesin excess of the number N specified in the accompanying timer/counter register is receivedon the serial port, a SCAST containing these characters is sent to the network‟s sink.Notes: This event is triggered by receiving a character on the serial port. N ≤ 64.2100 The contents of S3B is sent to the local command line followed by carriage return. Note:No AT-Prefix required!2101 The contents of S3C is sent to the local command line followed by carriage return. Note:No AT-Prefix required!24XX Start timers masked in XX.25XX Toggle timers masked in XX.26XX Stop timers masked in XX.3XXX Change I/O port to the LSBs.4XXX Change data direction of the I/O port to the LSBs.Table 7. Built-in functions©2011 Telegesis (UK) Ltd - 95 - AT Command Manual (Rev 3.05)

R305 AT Commands6 ETRX2 Power ConsumptionAs the module‟s power consumption is firmware dependent, the values in the following tablessupersede any of the numbers given in previous revisions of the AT command dictionary. Table 8gives the hardware dependent theoretical figures for the ETRX2 as stated in the current hardwaremanual, whereas Table 9 shows the firmware dependent average power consumption of anETRX2 measured with light to medium network traffic. For more details please refer to theseparate application note regarding power consumption, which can be found onwww.telegesis.com.Typical values at 3.3V 25°C.Parameter Min. Typ. Max. Units ConditionSupply Current 36 mA TX 4dBm32 mA TX –1dBm29 mA TX –10dBm28 mA TX –20dBm37 mA RX1.5 µA Asleep, Timers on0.7 µA Asleep, Timers offTable 8: Power ConsumptionMode Router, COOMED, SEDMCU Radio Timers I MCU Radio Timers I0 Awake Awake User defined 36mA Awake Asleep User defined 9mA1 Idle Awake User defined 32mA Idle Asleep User defined 4.5mA2 Asleep Asleep User defined 0.7mA 1 Asleep Asleep User defined 0.7mA 13 Asleep Asleep Off 0.7µA Asleep Asleep Off 0.7µANotes:Table 9: Averaged power consumption during operation- Sleep modes 1-3 should not be used on a router or coordinator, however it was found that mode 1may work on a router with light to medium network traffic. Successful operation of a router in mode1 cannot be guaranteed and needs to be evaluated carefully for each target application in case theadditional energy saving is vital.- Wakeup from mode 3 is only possible by external interrupt or reset. Make sure never to set theinitial power mode (S3A) to mode 03 unless you want the device to always wake up into this mode.- Modules in power mode 2 and 3 will not respond to commands at the serial port, so always makesure you have defined means to wake it up from these modes.- If no means of waking up from any of the power down modes has been defined and the moduleappears unresponsive the Telegesis factory default resetter can be used to reset the modulesfactory defaults via the serial port.- In order to achieve ultra low power consumption of sub 1µA it is required to either define all I/Os tobe outputs, or to pull all inputs to a defined level as floating input pins will increase the currentconsumption. Furthermore as described in the hardware manual a pull-down of 10kΩ must beattached to the SIF_MOSI pin for lowest possible power consumption.1 Assuming the unit polls every second. If no polling and other timed actions are performed the powerconsumption can be as little as 1.5µA in this mode.©2011 Telegesis (UK) Ltd - 96 - AT Command Manual (Rev 3.05)

R305 AT Commands7 ETRX357 Power Consumption (Provisional data)Typical values at 3.3V 25°C.Parameter Min. Typ. Max. Units ConditionSupply Current 30 mA TX 8dBm28 mA TX 3dBm28 mA TX –1dBm28 mA TX –43dBmTable 10: Power ConsumptionMode Router, COOMED, SEDMCU Radio Timers I MCU Radio Timers I0 Awake Awake User defined 28mA Awake Asleep User defined 9.5mA1 Idle Awake User defined 22mA Idle Asleep User defined 3.5mA2 Asleep Asleep User defined Asleep Asleep User defined3 Asleep Asleep Off Asleep Asleep OffTable 11: Averaged power consumption during operationNotes:- Sleep modes 1-3 should not be used on a router or coordinator, however it was found that mode 1may work on a router with light to medium network traffic. Successful operation of a router in mode1 cannot be guaranteed and needs to be evaluated carefully for each target application in case theadditional energy saving is vital.- Wakeup from mode 3 is only possible by external interrupt or reset. Make sure never to set theinitial power mode (S3A) to mode 03 unless you want the device to always wake up into this mode.- Modules in power mode 2 and 3 will not respond to commands at the serial port, so always makesure you have defined means to wake it up from these modes.- If no means of waking up from any of the power down modes has been defined and the moduleappears unresponsive the Telegesis factory default resetter can be used to reset the modulesfactory defaults via the serial port.- In order to achieve ultra low power consumption of sub 1µA it is required to either define all I/Os tobe outputs, or to pull all inputs to a defined level as floating input pins will increase the currentconsumption.©2011 Telegesis (UK) Ltd - 97 - AT Command Manual (Rev 3.05)

R305 AT Commands8 Notes on Energy Levels and LQI8.1 Interpreting LQIOn the EM250 as well as the EM35x, the LQI is closely related to the SNR (signal noise ratio).The graph below shows the relation between the SNR and the LQI reading on the EM250, which isthe basis of the ETRX2 series of modules.EM250 SNR vs LQIFigure 1: LQI vs. SNR (source: Ember)From the LQI the stack calculates the cost for a particular link based on the following table:Cost LQI1 254 - 2553 247 - 2535 200 - 2467 0 - 199Table 12: LQI/Cost relationship©2011 Telegesis (UK) Ltd - 98 - AT Command Manual (Rev 3.05)

R305 AT Commands8.2 Interpreting RSSI Energy LevelsOn the ETRX2 and ETRX3 series modules the readings from AT+ESCAN represent thehexadecimal readings from the RSSI register of the EM250 or EM35x, offset by +127 to make it apositive number. AT+ESCAN returns the background radio power so that the quietest channel canbe selected for a new network; if you want to measure the RSSI of incoming messages you mustset bit C of register S10 (see page 60).The EM250 and EM35x SoCs calculate the RSSI over an 8-symbol period as well as at the end ofa received packet. They utilize the RX gain settings and the output level of the ADC within itsalgorithm. The linear range of RSSI is specified to be 40dB over all temperatures. At roomtemperature, the linear range is approximately 60dB (-90 dBm to -30dBm).©2011 Telegesis (UK) Ltd - 99 - AT Command Manual (Rev 3.05)

R305 AT Commands9 Upgrading from R2xx to R305 on the ETRX2 SeriesR305 firmware can be loaded on to an ETRX2 by bootloading through the serial port or by reflashingwith an Ember Insight Adaptor. Cloning over the air is tricky because the new R305 nodeand the old R2xx node will not join the same PAN. It is possible to clone by using an extra R2xxdevice, as shown in the step-by-step guide below.R305S00=0004R2xx R2xx Start with 3 modules.Set the channelmask on the R305sourceAT+ENR2xxR2xxEstablish a PAN onany channelZCZRAT+CLONER2xxR2xxStart to clone from adummy deviceR2xxUnplug the targetbefore the cloning iscompleteAT+ENR305S00=0004R???Bootload R305 on tothe source device, orreplace it with theR305 device.Establish a PAN.Plug in the targetdeviceAT+RECOVERR305S00=0004channel 13R???Start the recoveryprocessR305S00=0004channel 13R305Figure 2. Cloning from an R305 device©2011 Telegesis (UK) Ltd - 100 - AT Command Manual (Rev 3.05)

R305 AT Commands10 TrademarksAll trademarks, registered trademarks and products names are the sole property of their respectiveowners.11 DisclaimerProduct and Company names and logos referenced may either be trademarks or registeredtrademarks of their respective companies. We reserve the right to make modifications and/orimprovements without prior notification. All information is correct at time of issue. Telegesis (UK)Ltd. does not convey any license under its patent rights or assume any responsibility for the use ofthe described product.12 Contact InformationWebsite:E-mailwww.telegesis.comsales@telegesis.comTelegesis (UK) LimitedAbbey Barn Business CentreAbbey Barn LaneHigh WycombeBucksHP10 9QQUKTel: +44 (0)1494 510199Fax: +44 (0)5603 43699913 ReferencesTelegesis – www.telegesis.comEmber – www.ember.com©2011 Telegesis (UK) Ltd - 101 - AT Command Manual (Rev 3.05)

R305 AT Commands14 Appendix A. Forming a secure networkThe default S-register settings lead to a network that is easy to set up and to which extra devicescan easily be added, but it is not very secure. Not only can malicious devices intrude themselves,but there is also no safeguard against your devices joining a nearby network established byanother user with similar Telegesis devices and register settings, and vice-versa. The use of apre-defined Trust Centre Link Key can avoid all these problems. ZigBee PRO normally uses aNetwork Key common to all devices for general network traffic, and a Trust Centre Link Keycommon to all devices for key distribution. More specific applications such as Smart Energysystems can use a higher level of security such as a different link key for each point-to-point link.The default register settings produce the following behaviour when a device establishes a PANand another node joins:1. ZC selects a random Link Key and Network Key2. ZC sends Network Key to new node, unencrypted3. ZC sends Link Key to new node, encrypted with Network KeyTo create a secure network, use the following settings:Write your own Link Key into S09 on every device. If you do this off-line it can never behackedSet bit 8 of register S0A on all devices that will join the PAN (Use Pre-Configured TrustCentre Link Key when joining)Set bits 4 and 2 of register S0A on the coordinator (Send Network key encrypted with thelink key to nodes joining; Send Network key encrypted with the link key to nodes re-joiningunsecured)(For simplicity, you can set bits 8, 4 and 2 of S0A on every device)The joining procedure now becomes:1. ZC selects a random Network Key2. ZC sends the Network Key to new node, encrypted with Link KeyA sniffer can now no longer read the Network Key and use it to decrypt your messages, becausethe Link Key is never sent over the air.You can choose a Network Key and write it into S08 in the coordinator, but there is not much pointin doing this. The other devices ignore S08 as they receive the key from the coordinator, and if thekey is ever updated over the air S08 no longer contains the current value. A pre-defined NetworkKey will be needed, however, if your device has to join a secure ZigBee 2006 network.Bit A of S0A (When joining don‟t ask for Trust Centre link key) is intended for use when yourZigBee PRO device needs to join a ZigBee 2006 network, since ZigBee 2006 does not use LinkKeys. In normal use bit A is not set.©2011 Telegesis (UK) Ltd - 102 - AT Command Manual (Rev 3.05)