Get Signal info from different Operators

IoT Modules LTE Standard Module
1

Hi,

I’m trying to gather signal level information for different mobile network operators in my area using a Quectel EC200 module without a SIM card.

Here’s the approach I’m currently using:

  1. I run AT+COPS=? to retrieve the list of available operators.
  2. I iterate through the list and attempt to manually register to each operator using:
    AT+COPS=1,2,"xxxxx" (where “xxxxx” is the MCC/MNC of the operator).
  3. After each attempt, I run:
    AT+QENG="servingcell"
    and
    AT+QENG="neighbourcell"
    to get information about the serving and neighboring cells.

However, the issue is that I consistently get the same serving cell information (same MCC and MNC), regardless of which operator I try to register with. I was expecting the serving cell to match the MCC/MNC of the operator specified in the AT+COPS command.

Do you have any suggestions on how I can retrieve signal strength or cell info for multiple operators without a SIM card? Or is there a limitation in the module or command set that prevents this?

Thanks in advance!

2

I’ve continued working on this issue and conducted a test. I inserted a SIM card from Movistar. When I select the Movistar operator using AT+COPS, everything works perfectly. However, when I select other operators, the results are inconsistent. Sometimes it works as expected and I get the serving cells from the selected operator, but other times I still receive the serving cell from Movistar.

Is there a way I can force the serving cell somehow? Maybe through the SDK?

3

Hi Chano,

The inconsistent behavior you are experiencing is due to the fundamental difference between camping on a cell and registering with a network.

Here is why your current approach is failing and how you can achieve your goal.

  1. Why AT+COPS is Inconsistent
    The command AT+COPS=1,2,“xxxxx” is a request for manual network registration.

  • Authentication Requirement: Registration requires a successful authentication handshake between the (U)SIM and the network. Because you have a Movistar SIM, the module can only successfully register with Movistar.

  • Fallback to Limited Service: When you attempt to register with a different operator (one your SIM cannot authenticate with), the registration fails. The module then enters “Limited Service” mode (“LIMSRV”).

  • Strongest Cell Selection: In LIMSRV mode, the module ignores your manual selection and automatically camps on the strongest available cell that allows emergency calls.

  • This is why the serving cell often reverts to Movistar; if that tower has the strongest signal, the module will stay there regardless of your AT+COPS command.

  1. If your goal is to force the module to listen to a specific operator’s tower to measure its signal without registering, you should use Factory Test Mode (FTM.
    This mode allows you to bypass the protocol stack’s registration logic and control the radio hardware directly.

You may follow the steps below to use FTM

  1. Enter FTM

Execute AT+QRFTESTMODE=1.

  1. Force Reception on a Specific Frequency: Use the AT command below to tune the radio to a specific band and channel (EARFCN for LTE or ARFCN for GSM).

AT+QRXFTM

image
image661×664 49.6 KB

  1. Measure Signal Strength: The command will return <RX_RSSI_PRI>, which is the actual signal strength (in dBm) received at that specific frequency.
    This method forces the module to act as a receiver for that specific tower, effectively making it the “serving” source for your measurements.

Thank you and have a great day!

4

Hi AmarRaaj thx for your answer.

I’ve been trying your approach but I can Enter QRTESTMODE but QRXFTM always gave me “ERROR”

This is what I’m doing
[00:47:03] [LTE] Sending command: AT
[00:47:04] [LTE] Respuesta recibida: OK
[00:47:04] [LTE] Respuesta del comando AT: ret=2, num=1
[00:47:04] [LTE] Sending command: ATE0
[00:47:04] [LTE] Respuesta recibida: OK
[00:47:04] [LTE] Sending command: AT+GMI
[00:47:04] [LTE] Respuesta recibida: Quectel
[00:47:04] [LTE] Respuesta recibida: OK
[00:47:05] [LTE] Sending command: AT+GMM
[00:47:05] [LTE] Respuesta recibida: EG25
[00:47:05] [LTE] Respuesta recibida: OK
[00:47:05] [LTE] Sending command: AT+GMR
[00:47:05] [LTE] Respuesta recibida: EG25GGCR07A02M1G
[00:47:06] [LTE] Respuesta recibida: OK
[00:47:06] [LTE] Sending command: AT+CIMI
[00:47:06] [LTE] Respuesta recibida: 204047600634713
[00:47:06] [LTE] Respuesta recibida: OK
[00:47:06] [LTE] Sending command: AT+CGSN
[00:47:06] [LTE] Respuesta recibida: 864677068276948
[00:47:07] [LTE] Respuesta recibida: OK
[00:47:07] [LTE] Sending command: AT+CFUN=1
[00:47:07] [LTE] Respuesta recibida: OK
[00:47:07] [LTE] Sending command: AT+COPS=?
[00:47:43] [LTE] Respuesta recibida: +COPS: (1,“Orange SP”,“ESPRT”,“21403”,7),(1,“Movistar”,“Movistar”,“21407”,2),(1,“Orange SP”,“ESPRT”,“21403”,2),(1,“Orange SP”,“ESPRT”,“21403”,0),(2,“vodafone ES”,“vodafone ES”,“21401”,7),(1,“vodafone ES”,“voda ES”,“21401”,0),(1,“Movistar”,“Movistar”,“21407”,0),(1,“vodafone ES”,“voda ES”,“21401”,2),(0-4),(0-2)
[00:47:43] [LTE] Respuesta recibida: OK
[00:47:43] [LTE] Sending command: AT+COPS=1,2,“21407”
[00:47:47] [LTE] Respuesta recibida: OK
[00:47:49] [LTE] Sending command: AT+QENG=“servingcell”
[00:47:49] [LTE] Respuesta recibida: +QENG: “servingcell”,“NOCONN”,“WCDMA”,214,07,B30,C9C4F2B,3034,484,4,-87,-5,-,-,-,-,-
[00:47:49] [LTE] Respuesta recibida: OK
[00:47:49] [LTE] EARFCN extraído: 3034
[00:47:49] [LTE] Sending command: AT+COPS=0
[00:47:50] [LTE] Respuesta recibida: OK
[00:47:50] [LTE] Entrando en modo Factory Test Mode (FTM) para operadora 21407…
[00:47:50] [LTE] Sending command: AT+QRFTESTMODE=1
[00:47:51] [LTE] Respuesta recibida: OK
[00:47:52] [LTE] Midiendo señal con FTM (EG25): Banda 7, EARFCN 3034
[00:47:52] [LTE] Sending command: AT+QRXFTM=7,3034
[00:47:52] [LTE] Respuesta recibida: ERROR
[00:47:53] [LTE] Midiendo señal con FTM (EG25): Banda 3, EARFCN 1300
[00:47:53] [LTE] Sending command: AT+QRXFTM=3,1300
[00:47:53] [LTE] Respuesta recibida: ERROR
[00:47:53] [LTE] Midiendo señal con FTM (EG25): Banda 7, EARFCN 2850
[00:47:53] [LTE] Sending command: AT+QRXFTM=7,2850
[00:47:53] [LTE] Respuesta recibida: ERROR
[00:47:54] [LTE] Midiendo señal con FTM (EG25): Banda 20, EARFCN 6300
[00:47:54] [LTE] Sending command: AT+QRXFTM=20,6300
[00:47:54] [LTE] Respuesta recibida: ERROR
[00:47:54] [LTE] Saliendo del modo Factory Test Mode…

Thx for your Help