FCC ID: VVXLM074 LM074 Bluetooth 5.0 Dual Mode Module

LM074 SPP with GAP Central Application USER GUIDE All trade names are registered trademarks of respective manufacturers listed. This manual may not be copied in any media or form without the written consent of original maker. All rights reserved. Revision v1.0 v1.1 Date 17/11/2017 25/09/2018 LM074 SPP with GAP Central Application v1.1 Changes Description First revision of this document. Added firmware revision history and LED indication information. Copyright LM Technologies Ltd www.lm-technologies.com Page 2 of 70 LM074 SPP with GAP Central Application v1.1 Contents 1. Introduction ......................................................................................... 7 2. Functionality of SPP with GAP Central application .............................. 7 3. LM074 GAP Central Role ...................................................................... 8 3.1 GAP Central AT commands in brief ...................................................... 9 3.2 Enable GAP Central functionality: ...................................................... 11 3.3 BLE discovery commands: ................................................................ 12 3.4 BLE security commands: ................................................................... 15 3.5 BLE connection commands: .............................................................. 16 3.6 BLE Services/characteristic scan commands: ....................................... 20 3.7 BLE read data from Characteristic: .................................................... 22 3.8 BLE write data on Characteristic: ....................................................... 26 4. LM074 AT commands and Default configuration ............................... 32 4.1 AT commands .................................................................................. 33 4.2 Module Settings commands: .............................................................. 35 4.3 UART Settings commands: ................................................................ 39 Bluetooth Security Settings commands: .............................................. 42 4.4 SPP Related commands: ................................................................... 45 4.5 4.6 Firmware Upgrade commands: .......................................................... 49 LM074 Over The Air Firmware Upgrade Procedure ......................... 50 Pre-requisites for Firmware upgrade: ................................................. 50 Firmware upgrade procedure Flow chart: ........................................... 51 Possible Failure points and corrective actions ...................................... 53 Simple Secure Pairing between LM074 and remote device ............. 61 Pairing of LM074(BT2.1) with BT2.0 devices ....................................... 61 Pairing of LM074 (BT2.1) with BT2.1 devices ...................................... 61 LED Indication ................................................................................. 64 Power on LED sequence ................................................................... 64 7.1 LED0 ............................................................................................... 64 7.2 7.3 LED1 ............................................................................................... 64 7.4 LED2 ............................................................................................... 65 7.5 Pairing State ..................................................................................... 65 Appendix ......................................................................................... 66 8.1 Abbreviations ................................................................................... 66 8.2 BLE Peripheral characteristics ............................................................ 66 8.3 GATT UUID type .............................................................................. 67 5.1 5.2 5.3 6.1 6.2 5. 6. 7. 8. Copyright LM Technologies Ltd www.lm-technologies.com Page 3 of 70 LM074 SPP with GAP Central Application v1.1 8.4 GATT_Status_code ........................................................................... 68 BLE Service UUIDs ........................................................................... 70 8.5 Copyright LM Technologies Ltd www.lm-technologies.com Page 4 of 70 LM074 SPP with GAP Central Application v1.1 Table of Figures Figure 1: Firmware Upgrade Flowchart ............................................................... 52 Figure 2: UART messages when the module is not connected to the peer device ... 55 Figure 3: UART messages when the module opens a partition to write new image . 56 Figure 4: UART messages when the CRC of the received image does not match .... 58 Figure 5: UART messages showing a failure in image verification .......................... 59 Figure 6: UART messages showing successful firmware upgrade .......................... 60 Copyright LM Technologies Ltd www.lm-technologies.com Page 5 of 70 LM074 SPP with GAP Central Application v1.1 Firmware Revision History Version:0107 1. Up to Version_0106, the device will indicate the input pairing request to use and process it as per the Accept or Reject response from the user. 2. In Version_0107, this dependency is removed (like the LM048) and the device will accept all the pairing requests. The device will indicate the success or failure of the pairing procedure. Version:0107 Recreated images for Ver_0107 20Th June 2018 1. The images were recreated, the SPP_ESC_Sequence timeout is 2 seconds. 2. Other features are the same. 3. LM961 tested again with the LM154 test tool, passed the test successfully. 4. Added all production and OTA bin images. Version:0108 29th June 2018 1. Version _0108 released for LM961/LM074 and LM068. 2. Bug fix LM961/LM074/LM068 was not connecting to the WIN-PC after a successful pairing. The RFCOMM-Serial-Over-Bluetooth ports were not being created, and the error device not supporting Serial service was displayed on the PC. This was resolved by adding the default SDP record from CSR-

Example-code. 3. Added production and OTA bin images for all devices. Version:0109 19th Sept 2018 1. Version _0109 released for LM961/LM074 and LM068. 2. LED Blinking was modified to be similar to the LM048 LEDs. Blue LED Blinking if Not connected. Yellow LED as LINK-Data-Transfer LED. 3. Escape sequence detection logic was also modified to be similar to the LM048. 4. Added the feature to upgrade the device name using the last two bytes of the BD-Address. Set as default True. Users can turn it OFF using the AT command AT*UpdateName=ON/OFF. 5. The name of the LM068 adapter is 068SerialADTxx, xx are the last two bytes of BD-address. Copyright LM Technologies Ltd www.lm-technologies.com Page 6 of 70 LM074 SPP with GAP Central Application v1.1 1. Introduction This document describes the functionality of the SPP with GAP Central application. 1. SPP with GAP Central application specific AT commands and information 2. All AT commands and default configurations on device 3. Over the Air Firmware Upgrade procedure 4. Secure simple pairing procedure The LM074 is a dual mode module with the capability for simultaneous connections to Bluetooth (v1.0 v3.0), and Bluetooth low energy devices. LM Technologies supports various firmware applications on the LM074 module enabling users to develop their own applications with AT commands. 2. Functionality of SPP with GAP Central application In the SPP with GAP Central application the LM074 can either be a SPP Master or Slave; or dual mode with one SPP connection at a time. The SPP role supports BOND, ACON, and features similar to those of LM Technologies legacy products such as the LM048, LM072 and LM400, For Bluetooth low energy, it will be in the GAP Central role and can establish connections to up to five low energy peripherals simultaneously. Users can have a maximum of six active connections with this application (five low energy and one SPP). Data can be transferred between devices using AT commands. For the Bluetooth low energy GAP Central role, the user can perform functions normally performed by Android tablets or phones. A user can discover nearby Bluetooth low energy peripherals, and up to ten devices will be reported. They can then connect to any of those devices and read or write data on various services or characteristics with the help of AT commands. The Bluetooth low energy connection also supports whitelisting. If you add the paired devices to the whitelist it will only report advertising packets from the devices added to the whitelist, or only connect to devices on the whitelist. Copyright LM Technologies Ltd www.lm-technologies.com Page 7 of 70 LM074 SPP with GAP Central Application v1.1 3. LM074 GAP Central Role This section describes the AT commands for the GAP Central role to initiate a connection, pair, whitelist, or read/write data to a BLE peripheral device. AT commands for the SPP role and generic device configuration are described in section 4 LM074 AT commands and Default configuration. Every command is terminated with CR-LF. The module will begin parsing the AT command string after receiving the CR-LF sequence. For every AT command issued by a user via UART the module responds with OK/ERR. If the user issues an incorrect AT command string (e.g. instead of "AT*Settings=?"

the user issues "AT*Setting=?"), or issues a correct AT command string but in an invalid state (e.g. the user issues a connection command

"AT*CONN=001122334455" while the SPP-role is Slave), the module will respond with ERR. AT commands are used to enable or disable the GAP Central role of the module. By default, this mode is disabled and the module only initiates the SPP functionality. To enable GAP Central functions, use the AT command AT*ENBGAP=ON. The module will perform a soft reset and initialize itself with both SPP and GAP Central functions initialized. When the module has the GAP Central role disabled, for every AT command of GAP Central functionality or settings, module will respond with ERR. When the module is in the GAP Central role it supports BLE device discovery, connection initiation, and reading/writing data. Users can use different AT commands to read/write data on BLE peripherals or receive updates from BLE peripherals via UART. The SPP with GAP Central application enables the SPP and BLE connections. If the module is in the slave role it is ready to accept an SPP connection at any moment. If the user application only requires GAP Central roles, then set the SPP role as Master and ACON as OFF. This means that module will only connect to a remote SPP device when the connection is initiated by the LM074 module with an AT command. If the user application requires a SPP connection with ACON ON and BLE connections its possible that the LM074 might connect with a remote SPP master device while reading/writing data on the BLE Peripheral, or while performing some other task. This will be indicated to user with IND*:CONNECTED=001122334455. If so the user should use the escape sequence i.e. +++ to come out of SPP-Online-Connected mode and then issue the required AT commands. Copyright LM Technologies Ltd www.lm-technologies.com Page 8 of 70 LM074 SPP with GAP Central Application v1.1 3.1 GAP Central AT commands in brief The table below shows the AT commands for the GAP Central role with examples for reference. AT command string Command type AT*ENBGAP Query and Set Default setting OFF Sr no 1 2 3 4 5 6 7 8 9 10 11 AT*LESEC AT*GETCID AT*LEFIND AT*LECONN AT*LEDROP AT*ENBCCFG AT*BLECONN AT*INDRESP AT*FINDSERV AT*FINDCHA R Query and set Query only Execution only Execution only Execution only Execution only OFF

Query only

Execution only Execution only Execution only

12 AT*CLRWHIT E Execution only Copyright LM Technologies Ltd www.lm-technologies.com AT command format for reference AT*ENBGAP=?

AT*ENBGAP=ON AT*ENBGAP=OFF AT*LESEC=ON

/ AT*LESECOFF

/ATLESEC=?

AT*LEFIND=ON AT*LEFIND=OFF AT*LECONN=001122334 455 AT*LEDROP=001122334 455 AT*ENBCCFG=CID,CHAR

-Handle e.g. At*enbccfg=5,0019 AT*BLECONN=?

AT*INDRESP=CID e.g. At*indresp=5 AT*FINDSERV=CID e.g. At*findserv=5 AT*FINDCHAR=CID,Start

-Handle,End-Handle e.g. At*findchar=5,0001,ffff AT*CLRWHITE\r\n Page 9 of 70 LM074 SPP with GAP Central Application v1.1 Default setting AT command format for reference Sr no AT command string AT*WRWORE SP Command type Execution only 13 14 15 16 17 18 19 AT*RDCHARV AL Execution only AT*WRCHARV AL Execution only AT*LEAUTOS CAN AT*RDMULTC HAR Query and Set Execution only AT*RDLONGC HAR Execution only AT*SIWRWO RESP Execution only

Copyright LM Technologies Ltd www.lm-technologies.com AT*WRWORESP=CID,Ch ar-Handle,no-of-

bytes,actualbytes e.g. at*wrworesp=5,0012,14, 01234567890123456789 AT*RDCHARVAL=CID,ch ar-handle e.g. At*rdcharval=5,0020 AT*WRCHARVAL=CID,ch ar-handle,no-of-

bytes,actualbytes e.g. at*wrcharval=5,0012,14, 01234567890123456789 AT*LEAUTOSCAN=ON AT*LEAUTOSCAN=OFF AT*LEAUTOSCAN=?

AT*RDMULTCHAR=CID,n o-of-read,char-

handle1,char-handle-

2,char-handle3,char-

handle4, char-handle5 e.g. At*rdmultchar=5,05,000 3,0005,0008,0008,000a AT*RDLONGCHAR=CID, Char-Handle e.g. at*rdlongchar=5,0029 AT*SIWRWORESP=CID, Char-Handle,no-of-

bytes,actual-bytes e.g. at*siwrworesp=5,0028,1 4,0123456789012345678 9 Page 10 of 70 LM074 SPP with GAP Central Application v1.1 3.2 Enable GAP Central functionality:

3.2.1 AT*ENBGAP\r\n i. Query and Set command. ii. To query settings use the command AT*ENBGAP=? \r\n iii. Response to the query command will be OK/ERR and report will be REP*:GAP_ENABLE=ON or REP*:GAP_ENABLE=OFF iv. By default, this setting is OFF i.e. the GAP Central role is disabled. The module is only initialized for the SPP functionality. v. To enable the GAP Central role, use the command AT*ENBGAP=ON. vi. The module will respond with OK and display the message Module soft-Reset.. to indicate that the module is performing a soft reset to enable the GAP Central role. vii. After reset, the module shows the power on sequence SPP+GapCentral_Message_Loop viii. If the module currently has ENBGAP set to OFF, and command is issued to turn it OFF, the module shows an ERR response. Similarly, if the current setting is ON and the command is issued to turn it ON, the module will output an ERR response. ix. Response of the AT*SETTINGS=? query command depends on the ENBGAP setting. x. Response of the AT*SETTINGS=? Command displays the settings of LESEC, LE-Auto-Scan only if the ENBGAP is ON. SPP+tral_Message_Loop at*enbgap=?at*enbgap=?

OK REP*:GAP_ENABLE=OFF at*settings=?at*settings=?

OK NAME=LM074_GAP_Central ADDR=0002-5b-00a5a5 FLOW=OFF SPPRole=SLAVE ACON=OFF BOND=0000-00-000000 DPIN=OFF PIN=1234 GAP_ENABLE=OFF VER=074LM_GAPCEN_01.06 REP*:SETTINGS=END at*enbgap=offat*enbgap=off Copyright LM Technologies Ltd www.lm-technologies.com Page 11 of 70 LM074 SPP with GAP Central Application v1.1 ERR at*enbgap=onat*enbgap=on OK Module soft-Reset..SPP+GapCentral_Message_Loop GATT Initialised REP*:LESEC=Success at*settings=?at*settings=?

OK NAME=LM074_GAP_Central ADDR=0002-5b-00a5a5 FLOW=OFF SPPRole=SLAVE ACON=OFF BOND=0000-00-000000 DPIN=OFF PIN=1234 GAP_ENABLE=ON LE_SEC=OFF LE_AUTO_SCAN=ON VER=074LM_GAPCEN_01.06 REP*:SETTINGS=END at*enbgap=?at*enbgap=?

OK REP*:GAP_ENABLE=ON at*enbgap=onat*enbgap=on ERR at*enbgap=offat*enbgap=off OK Module soft-Reset..SPP+GapCentral_Message_Loop 3.3 BLE discovery commands:

3.3.1 AT*LEFIND\r\n i. Execution only command. ii. To begin discovery of nearby BLE peripheral devices, use the command AT*LEFIND=ON\r\n iii. The module responds with OK to this command if it is not already scanning the devices, otherwise it responds as ERR. Copyright LM Technologies Ltd www.lm-technologies.com Page 12 of 70 LM074 SPP with GAP Central Application v1.1 iv. The module reports the name and BT address of the device as soon as it finds the advertisement packet and keeps on updating the report as devices are discovered. v. The module stops the BLE scanning process when it finds 10 BLE devices and displays END of report message. vi. There is no time limit set in the firmware to end the BLE scanning process. If the user wants to terminate the scanning process, they should issue the AT*LEFIND=OFF command. vii. If the module is displaying the scan report and user issues a connection request to any of the devices, then the scan is terminated and connection procedure is started. viii. The module indicates the beginning and end of discovery response as REP*:BLE_SCAN_REP=START and REP*:BLE_SCAN_REP=END respectively. ix. Below is an example report for BLE scanning:

at*lefind=onat*lefind=on OK REP*:BLE_SCAN_REP=START

= 1 :1028-00-5b0002 :0

= 2 :1032-00-5b0002 :0

= 3 :3333-33-333333 :0

= 0: 3333-33-333333, LM Serial Server

= 4 :8863-df-be936c :0 :LML8

= 5 :0000-00-000000 :3

= 6 :1029-00-5b0012 :0 :CSR BP Sensor

= 7 :1030-00-5b0012 :0 :CSR HR Sensor

= 8 :1031-00-5b0012 :0 :CSR HR Sensor at*lefind=offlefind=off at*lefind=offat*lefind=off OK x. If the user terminates the scanning process by issuing the AT*LEFIND=OFF command, the module responds to it with an OK/ERR message but it does not issue an end of report message. xi. When the module finds a BLE advertising report, it does not show the device in the report immediately, it waits for the advertising packet in which BLE-Device-name is included. a. If the module finds address and name same packet, it displays both. waits for name. b. If the module finds address only it shows address and c. When the module finds name of the device for which it has reported address previously, it will show name in report with the serial number as 0 to indicate this is not new device but only name is appended for the device already reported. Copyright LM Technologies Ltd www.lm-technologies.com Page 13 of 70 LM074 SPP with GAP Central Application v1.1 xii. If the LM074 has setting AT*LESEC=OFF, LM074 reports BLE devices even if not present in its Whitelist. If setting is AT*LESEC=ON, LM074 will only report advertising devices which are in its whitelist. xiii. In the discovery report, after the BD-address there is an indication for advertising Indication type ranging from 0 to 5 as mentioned below. a. ble_adv_event_connectable_undirected = 0 =

Connectable Undirected Advert. b. ble_adv_event_connectable_directed = 1 =

Connectable Directed Advert. c. ble_adv_event_discoverable = 2 = Discoverable d. ble_adv_event_non_connectable = 3 = Non-

advert. connectable. e. ble_adv_event_scan_response = 4 = Scan Response. f. ble_adv_event_unknown = 5 = Unknown event type. xiv. The LM074 SPP with GAP central application also supports SPP connection. The module may establish a SPP connection while performing LE discovery. When the module connects with the SPP device, it enters in SPP-Data mode and shows data from the remote device on UART. It treats data sent on local UART as data to be sent to remote device. To access UART for commands and responses, the user needs to use the escape sequence and then continue with other AT commands. xv. Refer to the screenshots below. at*lefind=onat*lefind=on OK REP*:BLE_SCAN_REP=START

= 1 :1032-00-5b0002 :0

= 2 :1028-00-5b0002 :0

= 3 :3333-33-333333 :0

= 0: 3333-33-333333, LM Serial Server

= 4 :8863-df-be936c :0 :LML8 IND*:CONNECTED=0012-6f-0819c2

+++OK

= 7 :2053-ca-20126e :0

= 8 :2053-ca-20126f :0 at*lefind=offat*lefind=off OK xvi. Data during the SPP connection and receive of escape command is lost in this report (data is lost as UART is given to SPP connection). Copyright LM Technologies Ltd www.lm-technologies.com Page 14 of 70 LM074 SPP with GAP Central Application v1.1 3.4 BLE security commands:

3.4.1 AT*LESEC\r\n i. Query and Set command. ii. LESEC stands for Low Energy Security i.e. whether to apply whitelist security or not. iii. Query command to query the setting is AT*LESEC=?\r\n. iv. Query report is REP*:LE_SEC=OFF\r\n or REP*:LE_SEC=ON\r\n. v. When LESEC is ON, the module will scan advertising packets only from whitelist added devices and connect to the devices already added to whitelist (i.e. already BLE paired devices) vi. When LESEC is OFF, the module will scan and connect to any BLE discoverable and connectable device (module will discover and connect any device even if it is not paired with module before) Note: If the LM074 wants to add a new device in its whitelist then while establishing the connection with the device at first time user should use setting AT*LESEC=OFF. This enables the authentication procedure to start to add a new device to the white list. Once the module completes the pairing procedure successfully the BLE device is added to the white list. Then the LM074 can use the setting AT*LESEC=ON for further connections with the same device. 3.4.2 AT*CLRWHITE\r\n i. Execution only command. ii. This command is used to delete all the devices from BLE paired devices list i.e. White list. iii. Command format is AT*CLRWHITE\r\n iv. Module responds OK and deletes all the devices from the whitelist. Copyright LM Technologies Ltd www.lm-technologies.com Page 15 of 70 LM074 SPP with GAP Central Application v1.1 3.5 BLE connection commands:

3.5.1. AT*LEAUTOSCAN\r\n i. Query and set command. ii. Enable or disable the feature to scan the connected BLE peer device automatically for its services. iii. Low energy auto scan query: AT*LEAUTOSCAN=?\r\n. iv. Low energy auto scan query report:

REP*:LE_AUTOSCAN_SERVER=ON (Module default setting as LE-Auto-Scan enabled) v. Low energy auto scan enable command:

REP*:LE_AUTOSCAN_SERVER=ON\r\n. If LE Auto Scan is enabled, after connection module starts scanning Peer device for its services and characteristics automatically. vi. Low energy auto scan disable command:

REP*:LE_AUTOSCAN_SERVER=OFF\r\n. If disabled, module does not scan the Peer device for its services and characteristics automatically. Module will wait for AT*FindServ command from user. 3.5.2 AT*BLECONN\r\n i. Query only command. ii. User can query how many BLE connections module is having and details for those connections. iii. Command format is : AT*BLECONN=?\r\n iv. GAP Central application can have maximum 5 BLE connections simultaneously. v. Example report for this command shall be as shown below at*BLECONN=?at*BLECONN=?

OK REP*:BLE_CONN

= 1 : 3333-33-333333 : 0101

= 2 : 1030-00-5b0012 : 0182

= 3 : 1032-00-5b0002 : 0203

= 4 : Open

= 5 : Open REP*:BLE_CONN END vi. The report above shows that the module is now connected with three devices. The report lists connection ID given by module, remote device BD-Address and Connection-ID i.e. CID given by BLE stack. Copyright LM Technologies Ltd www.lm-technologies.com Page 16 of 70 3.5.3 AT*LECONN\r\n LM074 SPP with GAP Central Application v1.1 vii. Start and end of report is mentioned. viii. E.g. In above report, row = 3 : 1032-00-5b0002 : 0203 mentions module has 3rd connection with 1032-00-5b0002 device and CID given by BLE stack is 0203. ix. CID given in above response is referred while reading/writing data with AT commands, reporting disconnection, notification etc. User should note this carefully. x. Response to this module depends on current state of the module for BLE connections. xi. In a scenario where module has established 3 connections as shown above and if it drops connection 2 then the response to command AT*BLECONN=? Will be at*BLECONN=?at*BLECONN=?

OK REP*:BLE_CONN

= 1 : 3333-33-333333 : 0101

= 2 : Open

= 3 : 1032-00-5b0002 : 0203

= 4 : Open

= 5 : Open REP*:BLE_CONN END i. Execution only command ii. GAP Central application gives more details on connection parameters when connection is successful and error code value if connection fails. iii. User need to mention the BD address of the remote device with which the BLE connection is to be established, e.g. at*leconn=1031-00-5b0012\r\n tries to establish connection with 1031-00-5b0012 device. iv. Response to this command will be ERR if any of the following is true a. string format is incorrect b. BT address is invalid c. 5 BLE connections are already established v. Response to this command will be OK if all the following conditions are true a. Command string format is correct b. BT address is valid c. Module has at least one BLE connection open vi. After displaying OK response, module starts the BLE connection procedure. vii. If the connection is failed the report is given with the error code e. g. REP*:BLE_CONN_FAIL:=1031-00-5b0012,4 err_code:0014\r\n. viii. Refer the Error code list mentioned in the appendix section. Copyright LM Technologies Ltd www.lm-technologies.com Page 17 of 70 LM074 SPP with GAP Central Application v1.1 ix. If the module is successfully connected to a remote device it will show a report with details about the connection. E.g. REP*:BLE_CONNECTED:=1030-00-5b0012-0 : 1 : 0080 : 0017 :

0008\r\n x. Here report includes extra information for the connection details as below. device. a. 1030-00-5b0012 is BD address of the remote BLE device. b. -0 with the address mentions Address type of remote BLE c. TYPED_BDADDR_PUBLIC is noted as 0, TYPED_BDADDR_RANDOM is noted as 1. d. 1 indicates Connection ID given by LM074 module (refer to BLEconn=? report). e. 0080 mentions CID given by BLE stack (hex value 0x0080). f. 0017 is MTU i. e. Maximum Transfer Unit for this BLE connection (hex value 0x0017). g. 0008 is Connection configuration flag (hex value 0x0008) xi. User should take note of MTU mentioned in connection report, while reading and writing data on this device, using one command

(rdcahval/wrworesp etc) up to MTU number of bytes can be sent/received. If user need to read/write more than MTU number of bytes, it needs two commands. at*leconn=1030005b0012at*leconn=1030005b0012 OK REP*:BLE_CONNECTED:=1030-00-5b0012-0 : 1 : 0080 : 0017

: 0008 BLE Auth start OK REP*:SERVICE START: =1030-00-5b0012

= 1 : 1801 : 0001 : 0004

= 2 : 1800 : 0005 : 000b

= 3 : 180d : 000c : 0013

= 4 : 180f : 0014 : 0017 REP*:BLE_PAIR=1030-00-5b0012,Success

= 5 : 00001016d10211e19b2300025b00a5a5 : 0018 : 0021

= 6 : 180a : 0022 : ffff REP*:SERVICE END: =1030-00-5b0012 xii. BLE Pairing:

a. After module is connected with Peer device, If LESEC i.e. LE Security is OFF, module starts BLE Authentication process and Shows message BLE Auth start to indicate start of authentication process. b. If LESEC is ON, module will report or connect to only with previously Paired devices which are present in its whitelist. c. Pairing Success or Failure indication report is given to user as REP*:BLE_PAIR=1030-00-5b0012,Success or REP*:BLE_PAIR=1030-00-5b0012,Fail . Copyright LM Technologies Ltd www.lm-technologies.com Page 18 of 70 LM074 SPP with GAP Central Application v1.1 d. After module completes the pairing procedure successfully, module adds this device to its whitelist. e. Pairing procedure runs at the background and can show the status of pairing at any time. e.g. above report shows the pairing report has displayed while showing Service-scan report. xiii. If LEAutoScan server setting is ON then, module starts scanning services supported on the remote device and displays the report. If LEAutoScan server setting is OFF, module waits for commands from user to scan the services (FINDSERV). 3.5.4 AT*LEDROP\r\n i. Execution only command ii. Command is used to disconnect the BLE connection. Command requires peer devices BT address. iii. BLE connection disconnection command format:

AT*LEDROP=1030005b0012\r\n iv. Response for BLE drop connection will be OK if the module is connected to the BLE device with the same address provided in Drop command. v. Response for BLE drop connection will be ERR if the module is not connected with any BLE device or BD address mentioned in the AT command is not same as the connected BLE device. vi. Module shows a report for the disconnection command e.g. at*ledrop=1030005b0012at*ledrop=1030005b0012 OK REP*:BLE_DIS_CONN:=1030-00-5b0012,2 err_code:0000 vii. Error code 0000 mentions the device has terminated connection gracefully i.e. either device started disconnection procedure. viii. Number 2 near the BD address mentions the BLE Connection ID

(refereed to BLEconn=? response). ix. If disconnection is started by remote device or due to link loss the indication for disconnection is shown as below with the reason code. REP*:BLE_DIS_CONN:= 1030-00-5b0012,2 err_code:0019 x. Refer to the error code in the appendix. Copyright LM Technologies Ltd www.lm-technologies.com Page 19 of 70 LM074 SPP with GAP Central Application v1.1 3.6 BLE Services/characteristic scan commands:

3.6.1 AT*FINDSERV\r\n device. i. Execution only command ii. Command is used to scan services supported on connected BLE iii. User needs to state connection ID for the device whose services are to be scanned. E. g. at*findserv=1 finds services on 1st connected device. iv. Module provides a detailed report for the services supported by v. If the BLE device has any service with 128-bit UUID then it is the remote device. indicated with all bytes. vi. IN below report the row mentions 1 : 1800 : 0001 : 0005 where 1 is serial number, 1800 is 16bit UUID for service, 0001 is start handle of the service and 0005 is end handle of the service. vii. Report is marked for start and end. viii. For e.g refer below report. at*findserv=1at*findserv=1 OK REP*:SERVICE START: =3333-33-333333

= 1 : 1800 : 0001 : 0005

= 2 : 180a : 0006 : 0016

= 3 : 00005500d10211e19b2300025b00a5a5 : 0017 : 001a

= 4 : 180f : 001b : ffff REP*:SERVICE END: =3333-33-333333 3.6.2 AT*FINDCHAR\r\n i. Execution only command ii. Command used to scan characteristics supported by services on the BLE device. iii. User needs to mention connection ID for the device whose services are to be scanned. And start and end handle of the services for which scan is to be performed. iv. User can scan characteristics for only one service or multiple services or for all services in single command. at*findserv=1at*findserv=1 OK REP*:SERVICE START: =3333-33-333333

= 1 : 1800 : 0001 : 0005

= 2 : 180a : 0006 : 0016

= 3 : 00005500d10211e19b2300025b00a5a5 : 0017 : 001a

= 4 : 180f : 001b : ffff REP*:SERVICE END: =3333-33-333333 Copyright LM Technologies Ltd www.lm-technologies.com Page 20 of 70 LM074 SPP with GAP Central Application v1.1 v. Considering the above report for services, below are the possible commands. a. Scan characteristics of single service i.e. 1800 service, handles are 0001 and 0005. Command should be AT*findchar=1,0001,0005 b. Scan characteristics for first two services i.e. 1800 and 180a. User shall issue command as at*findchar=0001,0016. c. Scan characteristics of all services in single command, user shall issue command at*findchar=1,0001,ffff. vi. Report is marked for start and end. vii. The example report below shows a characteristic scan command report. at*findchar=1,0001,001bat*findchar=1,0001,001b OK REP*:CHAR start

=1: 2a00 : 0003 : 02 : 0002 [ Rd ]

=2: 2a01 : 0005 : 02 : 0004 [ Rd ]

=3: 2a25 : 0008 : 02 : 0007 [ Rd ]

=4: 2a24 : 000a : 02 : 0009 [ Rd ]

=5: 2a23 : 000c : 02 : 000b [ Rd ]

=6: 2a27 : 000e : 02 : 000d [ Rd ]

=7: 2a26 : 0010 : 02 : 000f [ Rd ]

=8: 2a28 : 0012 : 02 : 0011 [ Rd ]

=9: 2a29 : 0014 : 02 : 0013 [ Rd ]

=10: 2a50 : 0016 : 02 : 0015 [ Rd ]

=11: 00005501 : 0019 : 14 : 0018 [ Wr_cmd CCFG ]

REP*:CHAR END viii. For report above, the row =1: 2a00 : 0003 : 02 : 0002 [ Rd ]

indicates 1 as serial number, 2a00 as 16 bit characteristic UUID, 0003 is characteristic handle, 02 is properties value and 0002 is declaration value for that characteristic. ix. For details on Characteristic value and Declaration values refer appendix A. x. =11: 00005501 : 0019 : 14 : 0018 [ Wr_cmd CCFG ] row indicates the characteristic has 128 bit UUID, but here only lower 32 bits are displayed. 0019 is characteristic handle. 14 is properties value, this characteristic has two properties as WR-cmd and CCFG. 0018 is declaration value for that characteristic. xi. User needs to use characteristic-Handle to read or write data on that characteristic. Copyright LM Technologies Ltd www.lm-technologies.com Page 21 of 70 LM074 SPP with GAP Central Application v1.1 3.7 BLE read data from Characteristic:

3.7.1 AT*RDCHARVAL\r\n i. Execution only command ii. This command is used to read data from the BLE device for the characteristic which has properties as read Rd i.e. 0x02. iii. The command format is AT*RDCHARVAL=conn-ID, char-Handle. iv. e.g. at*rdcharval=1,0003 command is used to read data from 1st connected device, for characteristic 0003. v. The module shall output an OK response if the CID and the Char-

handle is correct. vi. After the module gives OK response to read command, module shows data received from remote device as a report. vii. E.g. REP*:RDCHARVAL=1:Rcvd_Bytes:0010 LM Serial Server is a report of read data for characteristic 0003. viii. Report shows connection ID as 1, Received bytes as 0x10 i.e. 16 bytes, and the actual bytes are LM Serial Server. ix. If module receives an error response it is reported to user with the x. Users can refer to error codes as mentioned in the appendix xi. Below show some reference reports for read command. error code. section. at*rdcharval=1,000cat*rdcharval=1,000c OK REP*:RDCHARVAL=0001:Err_code:02 at*rdcharval=1,0003at*rdcharval=1,0003 OK REP*:RDCHARVAL=1:Rcvd_Bytes:0010 LM Serial Server at*rdcharval=1,0005at*rdcharval=1,0005 OK REP*:RDCHARVAL=1:Rcvd_Bytes:0002 at*rdcharval=1,000aat*rdcharval=1,000a OK REP*:RDCHARVAL=1:Rcvd_Bytes:0016 CSR-GATT-SERVER-MODEL-

at*rdcharval=1,000cat*rdcharval=1,000c OK REP*:RDCHARVAL=0001:Err_code:02 xii. Above screenshots are taken on Hercules software on Windows PC, it does not show non-printable characters in received Copyright LM Technologies Ltd www.lm-technologies.com Page 22 of 70 LM074 SPP with GAP Central Application v1.1 response. If user analyse the RX line on Oscilloscope or protocol analyser, all bytes can be seen. 3.7.2 AT*RDMULTCHAR\r\n i. Execution only command ii. This command is used to read data from multiple characteristic on single remote device. iii. Read data from BLE device for the characteristic which has properties as Rd i.e. 0x02. iv. Maximum of 5 characteristics data can be read in one single command. v. Command format is AT*RdMultChar=conn-ID, no-of-chars-to-

read, char-Handle1, char-Handle2, char-Handle3, char-Handle4, char-Handle5,. vi. e.g. command to read data from 3 characteristics shall be at*rdmultchar=1,03,0008,000a,0010 command is used to read data from 1st connected device, on characteristic 0003, 0008 and 0010. at*rdcharval=1,0008at*rdcharval=1,0008 OK REP*:RDCHARVAL=1:Rcvd_Bytes:0005 SR_no at*rdcharval=1,000aat*rdcharval=1,000a OK REP*:RDCHARVAL=1:Rcvd_Bytes:0006 mod_no at*rdcharval=1,0010at*rdcharval=1,0010 OK REP*:RDCHARVAL=1:Rcvd_Bytes:0006 FW_Ver at*rdmultchar=1,03,0008,000a,0010at*rdmultchar=1,03,0008

,000a,0010 OK REP*:RDMULTCHAR=1:Success length:0011 SR_nomod_noFW_Ver vii. If the read number of bytes from characteristics exceeds than MTU bytes then lower bytes are lost and only first MTU bytes are reported. This is limitation of BLE stack and not of LM074 application. viii. E.g. refer below response. (last bytes form 0003 characteristic are lost while reading multiple characteristics in one command) at*rdcharval=1,0008at*rdcharval=1,0008 OK Page 23 of 70 Copyright LM Technologies Ltd www.lm-technologies.com LM074 SPP with GAP Central Application v1.1 REP*:RDCHARVAL=1:Rcvd_Bytes:0005 SR_no at*rdcharval=1,000aat*rdcharval=1,000a OK REP*:RDCHARVAL=1:Rcvd_Bytes:0006 mod_no at*rdcharval=1,0010at*rdcharval=1,0010 OK REP*:RDCHARVAL=1:Rcvd_Bytes:0006 FW_Ver at*rdcharval=1,0012at*rdcharval=1,0012 OK REP*:RDCHARVAL=1:Rcvd_Bytes:0007 App_ver at*rdcharval=1,000eat*rdcharval=1,000e OK REP*:RDCHARVAL=1:Rcvd_Bytes:000b CSR101x A05 at*rdmultchar=1,05,0008,000a,0010,0012,000eat*rdmultchar

=1,05,0008,000a,0010,0012,000e OK REP*:RDMULTCHAR=1:Success length:0016 SR_nomod_noFW_VerApp_v ix. Above screen shots are taken on Hercules software on Windows PC, it does not show non printable characters in received response. If user analyse the RX line on Oscilloscope or protocol analyser, all bytes can be seen. 3.7.3 AT*RDLONGCHAR\r\n i. Execution only command ii. When the Characteristic Value is longer than can be sent in a single Read Response message, user can use this command to read that value in one command. iii. Read data from BLE device for the characteristic which has properties as Rd i.e. 0x02. iv. Command format is AT*RdLongChar=conn-ID, char-Handle. v. Commands which support rdcharval can also be read by this command. vi. Response to the command shows bytes received, offset of current data with respect to the whole data, and MoreToCome (MTC) flag if there is next data packet expected on the same characteristic read. vii. Refer following read examples for more detail. Copyright LM Technologies Ltd www.lm-technologies.com Page 24 of 70 LM074 SPP with GAP Central Application v1.1 at*leconn=333333333333at*leconn=333333333333 OK REP*:BLE_CONNECTED:=3333-33-333333-0 : 1 : 0100 : 0017

: 0008 BLE Auth start OK REP*:SERVICE START: =3333-33-333333

= 1 : 1800 : 0001 : 0005

= 2 : 180a : 0006 : 0016

= 3 : 00005500d10211e19b2300025b00a5a5 : 0017 : 001a

= 4 : 180f : 001b : ffff REP*:SERVICE END: =3333-33-333333 at*rdlongchar=1,0008at*rdlongchar=1,0008 OK REP*:RDLONGCHAR=1:0008:Success Rcvd:0005 Offset:0000 MTC:0 SR_no at*rdlongchar=1,000aat*rdlongchar=1,000a OK REP*:RDLONGCHAR=1:000a:Success Rcvd:0024 Offset:0000 MTC:0 abcdEFGHIJklmnopQRSTUvwxyz0123abcdEF at*rdlongchar=1,000cat*rdlongchar=1,000c OK REP*:RDLONGCHAR=1 Err_code:0002 at*rdlongchar=1,0005at*rdlongchar=1,0005 OK REP*:RDLONGCHAR=1:0005:Success Rcvd:0002 Offset:0000 MTC:0 at*rdlongchar=1,0003at*rdlongchar=1,0003 OK REP*:RDLONGCHAR=1:0003:Success Rcvd:0010 Offset:0000 MTC:0 LM Serial Server Copyright LM Technologies Ltd www.lm-technologies.com Page 25 of 70 LM074 SPP with GAP Central Application v1.1 3.8 BLE write data on Characteristic:

3.8.1 AT*ENBCCFG\r\n i. Execution only command. ii. Command used to enable the Client-Configuration-Flag (CCFG) on specific characteristic. iii. When the module scans the characteristics of the device, it shows the CCFG flag if supported by that characteristic. E.g Serial-Over-

Gatt service supports this flag (highlighted yellow in below report). iv. While issuing command, user should mention the device-

connection-ID and characteristic handle. v. E.g The device 1 has CCFG flag characteristic with handle 0019. To enable the CCFG flag use command at*enbccfg=1,0019. vi. Module shall give OK response if the characteristic has CCFG flag otherwise module shall give ERR response if wrong characteristic handle is mentioned. vii. After the module responds with OK, the module receives feedback from the BLE device regarding success or failure, which is reported to the user. viii. The report REP*:WRCHARVAL=1:Success shows enable CCFG operation is performed successfully. at*findchar=1,0001,001bat*findchar=1,0001,001b OK REP*:CHAR start

=1: 2a00 : 0003 : 02 : 0002 [ Rd ]

=2: 2a01 : 0005 : 02 : 0004 [ Rd ]

=3: 2a25 : 0008 : 02 : 0007 [ Rd ]

=4: 2a24 : 000a : 02 : 0009 [ Rd ]

=5: 2a23 : 000c : 02 : 000b [ Rd ]

=6: 2a27 : 000e : 02 : 000d [ Rd ]

=7: 2a26 : 0010 : 02 : 000f [ Rd ]

=8: 2a28 : 0012 : 02 : 0011 [ Rd ]

=9: 2a29 : 0014 : 02 : 0013 [ Rd ]

=10: 2a50 : 0016 : 02 : 0015 [ Rd ]

=11: 00005501 : 0019 : 14 : 0018 [ Wr_cmd CCFG ]

REP*:CHAR END at*enbccfg=1,0019at*enbccfg=1,0019 OK REP*:WRCHARVAL=1:Success Copyright LM Technologies Ltd www.lm-technologies.com Page 26 of 70 LM074 SPP with GAP Central Application v1.1 3.8.2 AT*INDESPr\n i. Execution only command. ii. This command gives feedback to server/peripheral for notification indication from server/peripheral. iii. This command is used to acknowledge the sever that client(BLE-

Central) has received characteristic value Indication, and server(BLE-Peripheral) may send another indication. iv. Command format is at*INDRESP=Conn-ID. v. e.g. AT*INDRESP=1 gives indication response for 1st connected BLE device for receiving notification indication. vi. OK/ERR response is given by LM074 after checking the Connection ID and Connection status. vii. After OK response is given Response is forwarded to remote device by BLE-Stack. viii. No feedback form BLE-Stack is provided to this command. 3.8.3 AT*WRWORESP\r\n i. Execution only command ii. This command is used to send data to BLE device for the characteristic which has properties as Wr_cmd i.e. 0x04. iii. Command format is AT*WRWORESP=conn-ID, char-Handle, length, actual-bytes . iv. e.g. at*wrworesp=1,0019,10,12345abcdef!()12 command is used to send data to 1st connected device, on characteristic 0019. No of bytes to write are 0x10 i.e. 16 and actual bytes are 1,2,3,4,5,a,b,c,d,e,f,!,(,),1,2. v. As shown in the example command number of bytes to transmit is hex value. vi. As shown in the example command, actual data bytes are not separated by a comma. When the value 0x31 is sent i.e. ASCII 1 is sent, the data buffer is copied and sent to remote device transparently. vii. Note : The actual data bytes to be sent shall not have \r\n as the data itself because it is the terminating string for AT command parser. viii. For command AT*WRWORESP=conn-ID, char-Handle, length, actual-bytes module gives OK response if all the following conditions are true:

a. connection ID is correct (if module is connected to 3 devices and CID mentions 4, then it is invalid) b. Characteristic handle has WR_cmd properties c. Value of length field is less than 21 i.e. (0x15). d. Actual data bytes are same as value of length field. Copyright LM Technologies Ltd www.lm-technologies.com Page 27 of 70 LM074 SPP with GAP Central Application v1.1 ix. After the module responds to the command with OK, the module sends the data to the remote BLE device. x. If the remote device receives the data and sends feedback to the LM074, that feedback is displayed on UART. xi. E.g. report shows, REP*:WRWORESP=1:0019:Success which indicates the data has been received by the remote device successfully. 1 is the CID-given by module and 0019 is the characteristic handle. at*wrworesp=1,0019,05,12345at*wrworesp=1,0019,05,12345 OK REP*:WRWORESP=1:0019:Success at*wrworesp=1,0019,10,12345abcdef!()12at*wrworesp=1,001 9,10,12345abcdef!()12 OK REP*:WRWORESP=1:0019:Success 3.8.4 AT*WRCHARVAL\r\n i. Execution only command ii. This command is used to send data to BLE device for the characteristic which has properties as Wr_req i.e. 0x08. iii. Command format is AT*WRCHARVAL=conn-ID, char-Handle, length, actual-bytes. iv. e.g. at*WRCHARVAL=1,0019,10,12345abcdef!()12 command is used to send data to 1st connected device, on characteristic 0019. No of bytes to write are 16 (0x10) and actual bytes are 12345abcdef!()12. v. As shown in the example command, no of bytes to transmit is hex value vi. As shown in the example command, actual data bytes are not separated by comma. When the value 0x31 is sent i.e. ASCII 1 is sent, the data buffer is copied and sent to remote device transparently. vii. Note : The actual data bytes to be sent should not have \r\n as the data itself because it is the terminating string for AT command parser. viii. For command AT*WRWORESP=conn-ID, char-Handle, length, actual-bytes module gives OK response if all the following conditions are true:

a. connection ID is correct (if module is connected to 3 devices and CID mentions 4, then it is invalid) b. Characteristic handle has Wr_req properties c. Value of length field is less than 21 i.e. (0x15). d. Actual data bytes are same as value of length field. ix. After module responds to this command as OK, module sends the data to remote BLE device. Copyright LM Technologies Ltd www.lm-technologies.com Page 28 of 70 LM074 SPP with GAP Central Application v1.1 at*findchar=2,0001,ffffat*findchar=2,0001,ffff OK REP*:CHAR start

=1: 2a05 : 0003 : 20 : 0002

[ Indi ]

=2: 2a00 : 0007 : 0a : 0006

[ Rd Wr_req ]

=3: 2a01 : 0009 : 02 : 0008

[ Rd ]

=4: 2a04 : 000b : 02 : 000a

[ Rd ]

=5: 2a37 : 000e : 10 : 000d

[ CCFG ]

=6: 2a38 : 0011 : 02 : 0010

[ Rd ]

=7: 2a39 : 0013 : 08 : 0012

[ Wr_req ]

=8: 2a19 : 0016 : 12 : 0015

[ Rd CCFG ]

=9: 00001013 : 001a : 0a : 0019

[ Rd Wr_req ]

=10: 00001018 : 001c : 08 : 001b

[ Wr_req ]

REP*:CHAR END at*wrcharval=2,0013,05,12345at*wrcharval=2,0013,05,12345 OK REP*:WRCHARVAL=2:Err_code:fd at*wrcharval=2,0007,05,12345at*wrcharval=2,0007,05,12345 OK REP*:WRCHARVAL=2:Success at*wrcharval=2,0007,05,abCDEat*wrcharval=2,0007,05,abCD E OK REP*:WRCHARVAL=2:Success at*wrcharval=2,001c,05,abCDEat*wrcharval=2,001c,05,abCDE OK REP*:WRCHARVAL=2:Err_code:0d at*wrcharval=2,001a,05,abCDEat*wrcharval=2,001a,05,abCD E OK REP*:WRCHARVAL=2:Err_code:0e at*wrcharval=2,0013,05,abCDEat*wrcharval=2,0013,05,abCD E OK REP*:WRCHARVAL=2:Err_code:fd x. If the remote device receives the data and sends feedback to the LM074, that feedback is displayed on UART. Copyright LM Technologies Ltd www.lm-technologies.com Page 29 of 70 LM074 SPP with GAP Central Application v1.1 xi. Above report shows the WRCharval command is successful only on characteristic 0005 and 0007. xii. If the WrCharVal command fails in execution, then the error code reported by BLE-stack is reported to user in failure report. E.g. Err_code:fd , Err_code:0e, Err_code:0d xiii. Refer Appendix section for more details on error code. 3.8.5 AT*SIWRWORESP\r\n i. Execution only command ii. This command is used to send data to BLE device for the characteristic which has properties as Si_Wrt i.e. 0x40. iii. Command format is AT*WRCHARVAL=conn-ID, char-Handle, length, actual-bytes. iv. e.g. at*WRCHARVAL=1,0019,10,12345abcdef!()12 command is used to send data to 1st connected device, on characteristic 0019. No of bytes to write are 16 (0x10) and actual bytes are 12345abcdef!()12. v. As shown in the example command, no of bytes to transmit is hex value vi. As shown in the example command, actual data bytes are not separated by comma. When the value 0x31 is sent i.e. ASCII 1 is sent, the data buffer is copied and sent to remote device transparently. vii. Note : The actual data bytes to be sent should not have \r\n as the data itself because it is the terminating string for AT command parser. viii. For command AT*WRWORESP=conn-ID, char-Handle, length, actual-bytes module gives OK response if all the following conditions are true:

a. connection ID is correct (if module is connected to 3 devices and CID mentions 4, then it is invalid) b. Characteristic handle has Wr_req properties c. Value of length field is less than 21 i.e. (0x15). d. Actual data bytes are same as value of length field. ix. After module responds to this command as OK, module sends the data to remote BLE device. Copyright LM Technologies Ltd www.lm-technologies.com Page 30 of 70 LM074 SPP with GAP Central Application v1.1 3.8.6 NOTIF_IND notification Indication i. Indication given by module. ii. When the module receives data from the remote BLE device, it notifies the user on UART. iii. E.g. the command below shows some indication reports:

IND*:NOTIF_IND=1:0019 R_bytes:0014 dataFromBLEDev123456 IND*:NOTIF_IND=1:0019 R_bytes:0003 789 IND*:NOTIF_IND=1:0019 R_bytes:0014 abcdefghijklmnopqrst IND*:NOTIF_IND=1:0019 R_bytes:0006 uvwxyz IND*:NOTIF_IND=1:0019 R_bytes:0014 abcdefghijklmnopqrst IND*:NOTIF_IND=1:0019 R_bytes:0006 uvwxyz iv. In report IND*:NOTIF_IND=1:0019 R_bytes:0014 dataFromBLEDev123456 the module shows CID as 1, Characteristic from which data is received is 0x0019, the actual received bytes are 0x0014, and then the actual bytes as dataFromBLEDev123456. v. The module can receive a maximum of 20 bytes i.e. 0x14 bytes in one notification packet. vi. If the remote device sends more than 20 bytes in one packet then the module shows two notification indication messages. E.g. if the remote device sends the string dataFromBLEDev123456789, the module shows dataFromBLEDev123456 first and then 789. Copyright LM Technologies Ltd www.lm-technologies.com Page 31 of 70 LM074 SPP with GAP Central Application v1.1 4. LM074 AT commands and Default configuration This section describes the AT command structure for the LM074 module. Serial terminals (such as Hercules, HyperTerminal, Tera Term or Putty) can be used for serial communication with the LM074. Every command is terminated with CR-LF. The module will begin parsing the AT command strings after receiving CR-LF sequence. AT Commands are case insensitive e.g. At*Resp=On, at*resp=on and AT*RESP=ON are all valid. AT command types:

1. Query only commands - Commands to query Module state, firmware version number etc. 2. Query and Set commands - Commands to query the setting and modify Module setting e.g. discoverability, Role, Baud, etc. 3. Execution only command commands to perform specific action e.g. start discovery for Bluetooth devices, start connection procedure, start upgrade procedure etc. The LM074 outputs messages to the user through the serial port for indications like connection/pairing request, result of connection/pair procedure, result of Bluetooth devices discovery, disconnection indication etc. After the indication message is displayed, the LM074 waits for inputs from the user to execute further action. For example, after incoming pairing indications, enter accept/reject pair response or after indication for PASSKEY_cfm, provide yes/no confirmation for the passkey etc. The module responds to each AT command as OK\r\n or ERR\r\n. After this response the module takes requested action or it will output report to the user on UART. If module does not receive AT as a start of new command, the module may not respond to this command even if it is terminated with

\r\n (e.g. instead of AT*NAME=?, user issues A*name=?). Module will neglect the received string and is ready to receive new AT command and to process it. When the module does not receive any command on UART for more than 30 seconds, the module enters deep sleep mode. The module can come out of this mode on UART activity or BT activity. If the user enters AT commands while the module is in deep sleep, the module may lose the first character of an AT command, e.g. for command AT*NAME=?, module may show the echo as t*name=? or name=? i.e. some garbage character at start. The module will not respond to AT commands such as ERR/OK, but it ignores this data and waits for a new AT command to process. Copyright LM Technologies Ltd www.lm-technologies.com Page 32 of 70 LM074 SPP with GAP Central Application v1.1 AT commands expects the BT address in the string. In this document 0126f357215 is considered a reference BT address, whereas 0012 is nap, 6f is uap and 357215 is lap in the BT address. Users should use the BT address of their devices. 4.1 AT commands The table below shows all the AT commands that are supported on the LM074 module and the default settings wherever applicable. 4.1.1 General settings AT commands:

AT command string AT*ADDR AT*NAME Command type Default setting Query only Query and set

Firmware version dependent e.g. 074LM_SPP_0106 AT*ECHO AT*RESP AT*DCOV AT*PAIR AT*STATE AT*VER AT*RESET AT*SETTINGS Query only Query and set ON Query and set ON Query and set ON Query and set ON

Query only

Query only

Execution only Refer command details 4.1.2 UART settings AT commands:

Sr no 1 2 3 4 5 6 7 8 9 10 Sr no Command type Default setting 19200 (5) AT command string AT*BAUD AT*PAR AT*STOP AT*FLOW AT*CTS AT*RTS AT*DTR AT*DSR AT*MODEM Query and set Query and set No parity (0) Query and set One stop bit (0) Query and set Off

Query only

Set only Set only

Query only

Query and set NONE 1 2 3 4 5 6 7 8 9 Note: CTS, RTS, DTR, DSR, MODEM commands are not applicable for LM074 module. Copyright LM Technologies Ltd www.lm-technologies.com Page 33 of 70 LM074 SPP with GAP Central Application v1.1 4.1.3 Bluetooth security settings commands:

Sr no Command type Default AT setting command string 1234 Query and set AT*PIN Query and set OFF AT*DPIN Query and set OFF AT*MITM Query and set NO_InOut AT*IOTYPE Execution only AT*DEL AT*PASSKEY Execution only AT*PASSCFM Execution only AT*STOPPAIR Execution only AT*PAIRLIST Query only 4.1.4 SPP related AT commands:

1 2 3 4 5 6 7 8 9

Sr no 1 2 3 4 5 6 7 8 AT command string AT*FIND AT*ROLE AT*ACON AT*CONN Escape sequence

AT*AUTO AT*DROP AT*BOND Default setting

Command type Execution only Query and set Dual Query and set OFF Execution only Execution only

Execution only Execution only Query and set Default bond

device address

0000-00-000000 4.1.5 Firmware Upgrade AT commands:

Sr no 1 Command type AT command string AT*UPGRADE Execution only Default setting

Copyright LM Technologies Ltd www.lm-technologies.com Page 34 of 70 LM074 SPP with GAP Central Application v1.1 4.2 Module Settings commands:

4.2.1 AT*ADDR\r\n i. Query only command ii. Address query: AT*ADDR=?\r\n iii. Address query report: REP*:ADDR=00025b00a5a5 4.2.2 AT*NAME\r\n i. Query and set command ii. Name query: AT*NAME=?\r\n iii. Name query report: REP*:NAME=LM074_2_Default iv. Name set command: AT*NAME=testname v. Default name: (Depends on firmware version number) 4.2.3 AT*ECHO\r\n i. Query and set command ii. Echo query: AT*ECHO=?\r\n iii. Echo query report: REP*:ECHO=ON or REP*:ECHO=OFF iv. Echo enable command: AT*echo=on v. Echo disable command: AT*echo=off vi. Default Echo: ON 4.2.4 AT*RESP\r\n i. Query and set command ii. Response query: AT*RESP=?\r\n iii. Response query report: REP*:RESP=ON or REP*:RESP=OFF iv. Response enable command: AT*RESP=on v. Response disable command: AT*RESP=off vi. Default Response: ON vii. When response is ON, the module responds as OK or ERR to every command string before sending report/response of the command. viii. When response is OFF, the module will not provide OK or ERR reply to any AT command. This might not be helpful to users as the user will not get any response if incorrect AT command strings are entered. ix. Below is the sequence of messages when ECHO and RESP are ON. at*echo=?at*echo=?

OK REP*:ECHO=ON at*resp=?at*resp=?

OK Copyright LM Technologies Ltd www.lm-technologies.com Page 35 of 70 LM074 SPP with GAP Central Application v1.1 x. Below is the sequence of messages when ECHO is OFF and RESP REP*:RESP=ON at*name=?at*name=?

OK REP*:NAME=068LM_SPP_0104 is ON. at*echo=offat*echo=off OK at*echo=?OK REP*:ECHO=OFF at*resp=?OK REP*:RESP=ON at*name=?OK REP*:NAME=068LM_SPP_0104 xi. Below is the sequence of messages when ECHO and RESP are both off. The module will show only reports for the query commands. The module will not show any indication messages for connect or disconnect. This is to ensure backwards compatibility with LM048/LM058/LM072 module firmware. at*resp=?REP*:RESP=OFF at*echo=?REP*:ECHO=OFF at*name=?REP*:NAME=068LM_SPP_0104 4.2.5 AT*DCOV\r\n i. Query and set command ii. Discoverable query: AT*DCOV=?\r\n iii. Discoverable query report: REP*:DCOV=ON (Module discoverable for classic role) or REP*:DCOV=OFF (Module non discoverable for classic role) iv. Module make discoverable command: AT*DCOV=ON v. Module make non-discoverable command: AT*DCOV=OFF vi. Default discoverability : ON vii. Enabling discoverability may generate further events of incoming pairing/connection requests. 4.2.6 AT*PAIR\r\n i. Query and set command ii. Pairable query: AT*PAIR=?\r\n iii. Pairable query report: REP*:PAIR=ON (Module is in pairable state and will give indications to host of any incoming pairing requests) iv. Pairable query report: REP*:PAIR=OFF (Module is in non-

pairable state will reject pairing request internally) v. Module make pairable command: AT*PAIR=ON vi. Module make non-pairable command: AT*PAIR=OFF vii. Default Pairable: ON Copyright LM Technologies Ltd www.lm-technologies.com Page 36 of 70 LM074 SPP with GAP Central Application v1.1 viii. Enabling pair-ability may generate further events of incoming pairing/connection requests. ix. Module displays the message IND*:PAIR=00126f357215 to indicate that the device with BT-address 00126f357215 is requesting to pair. x. To accept the pairing request the user should respond as AT*PAIR=00126f357215,accept\r\n. xi. To reject the pairing request user should respond as AT*PAIR=00126f357215,reject\r\n. xii. After pairing procedure is complete, module shows indication message for success or failure of pairing IND*:PAIR=OK,00126f357215 or IND*:PAIR=ERR,00126f357215 . 4.2.7 AT*STATE\r\n i. Query only command ii. Module state query: AT*STATE=?\r\n iii. Module state query report: REP*:STATE-DP=ON,ON (STATE-

DP indicates states as D-discoverable is ON and P-Pairable is ON) iv. Module state query report: REP*:STATE-DP=ON,OFF (STATE-

DP indicates states as D-discoverable is ON and P-Pairable is OFF) 4.2.8 AT*VER\r\n i. Query only command ii. Firmware version query: AT*VER=?\r\n iii. Firmware version query report:

REP*:VER=074LM_GAPCEN_01.06 (current firmware version major number 1, minor number 04) string 074LM_GAPCEN shows it is firmware on LM068 device with SPP profile. 4.2.9 AT*RESET\r\n two Reset levels ii. AT*RESET=1\r\n i. Execution only command, LM951/LM074 supports execution of 1. Module applies soft reset, starts execution as if applied power on-off. 2. Retains all user modified settings 3. Causes disconnection for Bluetooth connections iii. AT*RESET=2\r\n 4. Module applies hard reset 5. Loads default settings for all setting types 6. Causes disconnection for Bluetooth connections 7. Deletes all the paired devices and corresponding data Copyright LM Technologies Ltd www.lm-technologies.com Page 37 of 70 4.2.10 AT*SETTINGS\r\n LM074 SPP with GAP Central Application v1.1 i. Query only command ii. Module settings query: AT*SETTINGS=?\r\n iii. Report for AT*SETTINGS=? command is multiple line, at the end of the report a message REP*:SETTINGS=END is delivered. iv. Module settings query report varies according to DPIN setting. If DPIN is OFF i.e. supporting to BT2.0, Module PIN is displayed. If DPI is ON, i.e. support to BT2.1, then settings for IO-capability, MITM are displayed. AT*Settings report when DPIN is OFF at*settings=?at*settings=?

OK NAME=LM074_SPP+GAPCEN _0106 ADDR=0002-5b-00a5a5 PAIR=ON DCOV=ON BAUD=19200(2) STOP=Stop_One(0) PARITY=None(0) FLOW=OFF SPPRole=SLAVE ACON=OFF BOND=0000-00-000000 DPIN=OFF PIN=1234 GAP_ENABLE=OFF VER=074LM_GAPCEN_01.06 REP*:SETTINGS=END OR at*settings=?at*settings=?

OK NAME=LM074_SPP+GAPCEN _0106 ADDR=0002-5b-00a5a5 PAIR=ON DCOV=ON BAUD=19200(2) STOP=Stop_One(0) PARITY=None(0) FLOW=OFF SPPRole=SLAVE AT*Settings report when DPIN is ON at*settings=?at*settings=?

OK NAME=LM074_SPP+GAPCEN _0106 ADDR=0002-5b-00a5a5 PAIR=ON DCOV=ON BAUD=19200(2) STOP=Stop_One(0) PARITY=None(0) FLOW=OFF SPPRole=SLAVE ACON=OFF BOND=0000-00-000000 DPIN=ON MITM=OFF IOTYPE=NO_InOut GAP_ENABLE=OFF VER=074LM_GAPCEN_01.06 REP*:SETTINGS=END OR at*settings=?at*settings=?

OK NAME=LM074_SPP+GAPCEN _0106 ADDR=0002-5b-00a5a5 PAIR=ON DCOV=ON BAUD=19200(2) STOP=Stop_One(0) PARITY=None(0) Copyright LM Technologies Ltd www.lm-technologies.com Page 38 of 70 LM074 SPP with GAP Central Application v1.1 ACON=OFF BOND=0000-00-000000 DPIN=OFF PIN=1234 GAP_ENABLE=ON LE_SEC=OFF LE_AUTO_SCAN=ON VER=074LM_GAPCEN_01.06 REP*:SETTINGS=END FLOW=OFF SPPRole=SLAVE ACON=OFF BOND=0000-00-000000 DPIN=ON MITM=OFF IOTYPE=NO_InOut GAP_ENABLE=ON LE_SEC=OFF LE_AUTO_SCAN=ON VER=074LM_GAPCEN_01.06 REP*:SETTINGS=END v. Also, Module response depends on ENBGAP settings. Refer section 1.2 Enable GAP Central role for more details. vi. Actual values of PIN, MITM, IOTYPE are displayed as per the current settings of device. vii. Response to the settings command varies as per the device, e.g. for LM068/LM074 modules it includes MODEM command. 4.3 UART Settings commands:

4.3.1 AT*BAUD\r\n i. Query and set command ii. Baud rate query: AT*BAUD=?\r\n iii. Baud rate query report: REP*:BAUD=19200(2). Number in curly brackets shows the serial number as per below table. iv. Baud rate set command: AT*BAUD=3 (Set Module baud rate as v. Module need to not to perform power-on-off after change of baud 38400 bps) rate setting. vi. Refer below table for baud rate settings:

Sr No 1 2 3 4 5 6 7 8 9 Actual baud rate 9600 19200 38400 57600 115200 230400 460800 921600 1382400 LM951 /

LM074 baud rate code 1 2 Default baud rate 3 4 5 6 7 8 9 Report from LM074 REP*:BAUD=9600(1) REP*:BAUD=19200(2) REP*:BAUD=38400(3) REP*:BAUD=57600(4)"

REP*:BAUD=115200(5)"

REP*:BAUD=230400(6)"

REP*:BAUD=460800(7)"

REP*:BAUD=921600(8)"

REP*:BAUD=1382400(9)"

Copyright LM Technologies Ltd www.lm-technologies.com Page 39 of 70 LM074 SPP with GAP Central Application v1.1 4.3.2 AT*PAR\r\n i. Query and set command ii. Parity query command: AT*PAR=?\r\n iii. Parity query report: REP*:PARITY=None(0) (Module uses default parity , parity = none). Number in curly brackets shows the serial number as per below table. iv. Parity set command: AT*PAR=1 (Set Module parity as odd) v. Module need to not to perform power-on-off after change of parity setting. vi. Refer below table for parity settings:

Sr No Actual parity Parity None Parity odd Parity even 1 2 3 4.3.3 AT*STOP\r\n Report from LM074 LM951 /

LM074 parity code 0 default parity REP*:PARITY=None(0) REP*:PARITY=Odd(1) 1 2 REP*:PARITY=Even(2) i. Query and set command ii. Stop bit query command: AT*STOP=?\r\n iii. Stop bit query report: REP*:STOP=Stop_One(0) (module uses default stop bit as = one). Number in curly brackets shows the serial number as per below table. iv. Stop bit set command: AT*STOP=1 (Set module stop bit as two) v. Module need not to perform power-on-off after change of parity setting. vi. Refer below table for stop bit settings:

Sr No Actual Stop bit 1 2 Stop bit One Stop bit two LM951 /

LM074 Stop bit code 0 default stop bit 1 Report from LM074 REP*:STOP=Stop_One(0) REP*:STOP=Stop_Two(1) 4.3.4 AT*FLOW\r\n i. Query and set command ii. Flow control query command: AT*FLOW=?\r\n iii. Flow control query report: REP*:FLOW=OFF (module uses default flow control OFF) Copyright LM Technologies Ltd www.lm-technologies.com Page 40 of 70 LM074 SPP with GAP Central Application v1.1 iv. Flow control set command: AT*FLOW=ON (Set module flow control ON) v. If the user is changing the flow control of device, after accepting command with OK response, module shows report as REP*:FLOW_CHANGE= IN_Progress vi. Module will perform reboot in changed flow control mode vii. If module is in flow control OFF mode and user gives command to make the flow control OFF, then module will respond as OK but shall not perform reboot. Similar applies to flow control OFF setting. 4.3.5 AT*CTS\r\n:

i. Query command ii. CTS query command: AT*CTS=?\r\n iii. CTS query report: module will report the actual status of CTS line e.g. REP*:CTS=OFF or REP*:CTS=OFF. iv. CTS line cannot be set/reset. v. This command is applicable for LM074 module and LM068 adapter. 4.3.6 AT*DSR\r\n:

i. Query command ii. DSR query command: AT*DSR=?\r\n iii. DSR query report: module will report the actual status of DSR line e.g. REP*:DSR=OFF or REP*:DSR=OFF. iv. DSR line cannot be set/reset. v. This command is applicable for LM074 module and LM068 adapter. 4.3.7 AT*RTS\r\n:

i. Set only command ii. RTS line set/reset command: AT*RTS=ON\r\n or AT*RTS=OFF\r\n. iii. RTS line cannot be queried. iv. This command is applicable for LM074 module and LM068 adapter. 4.3.8 AT*DTR\r\n:

i. Set only command ii. DTR line set/reset command: AT*DTR=ON\r\n or AT*DTR=OFF\r\n. iii. DTR line cannot be queried. iv. This command is applicable for LM074 module and LM068 adapter. Copyright LM Technologies Ltd www.lm-technologies.com Page 41 of 70 LM074 SPP with GAP Central Application v1.1 4.3.9 AT*MODEM\r\n:

i. Query and set command ii. MODEM query command: AT*MODEM=?\r\n iii. MODEM query report: REP*:MODEM=NONE (module uses default MODEM settings as none) iv. MODEM set command: AT*MODEM=LOCAL or AT*MODEM=Remote. v. Refer below table for MODEM settings:

Sr No 1 2 Modem setting None Local 3 Remote Comment Default setting LM068/LM074 uses RTS/CTS and DTR/DSR in loopback mode When LM068/LM074 is connected to remote device, LM068/LM074 sends RTS /DTR line status to remote device and receives CTS/DSR line status from remote device vi. Modem settings LOCAL and REMOTE are followed when Flow-

vii. MODEM command is applicable for LM074 module and LM068 4.4 Bluetooth Security Settings commands:

control is off. adapter. 4.4.1 AT*PIN\r\n i. Query and set command ii. PIN query command: AT*PIN=?\r\n iii. PIN query report: REP*:PIN=1234 (module uses default PIN as 1234) iv. PIN set command: AT*PIN=00112233 or AT*PIN=Abcd. v. Maximum PIN length supported is as per BT2.1 standard i.e. 16 bytes. PIN string can be numeric only, alpha only, or alpha numeric. vi. Examples for valid PIN set commands:

AT*PIN=00112233445566778 or AT*PIN=001122aaBBccDDeef 4.4.2 AT*DPIN\r\n i. Query and set command Copyright LM Technologies Ltd www.lm-technologies.com Page 42 of 70 LM074 SPP with GAP Central Application v1.1 ii. Dynamic PIN query command: AT*DPIN=?\r\n iii. Dynamic PIN query report: REP*:DPIN=OFF (module uses default DPIN as off) AT*DPIN=off. iv. Dynamic PIN set enable or disable command: AT*DPIN=ON or v. When module has DPIN setting as OFF, Module uses a fixed PIN provided default as 1234. vi. When module has DPIN setting as ON, module expects the dynamic PIN from customer as per the MITM and IO-Type settings. vii. For further on BT2.1 pairing and MITM, DPIN, PASSKEY messages refer LM951/LM074 Pairing document. 4.4.3 AT*MITM\r\n i. Query and set command ii. (Man IN The Middle) MITM query command: AT*MITM=?\r\n iii. MITM query report: REP*:MITM=OFF (module uses default iv. MITM set enable or disable command: AT*MITM=ON or MITM as off) AT*MITM=off. 4.4.4 AT*IOTYPE\r\n i. Query and set command ii. (Input Output type for Dynamic PIN) IOTYPE query command:

AT*IOTYPE=?\r\n iii. IOTYPE query report: REP*:IOTYPE=NO_InOut (module uses default IOTYPE as no input output) iv. IOTYPE modify command: AT*IOTYPE=KB_ONLY or AT*IOTYPE=kB_OnLy. v. Following IO-types are supported:

IO type LM951/LM074 IOTYPE set command LM951 /

LM074 String for IOTYPE NO_InOut at*iotype=no_inout KB_Only at*iotype=Kb_OnLy No input output Key Board only Display only Disp_Only at*iotype=DISP_only at*iotype=DISP_YN Display and confirmation for Yes / No Disp_YN LM951/LM074 IOTYPE query response REP*:IOTYPE=NO_InOut REP*:IOTYPE=KB_Only REP*:IOTYPE=Disp_Only REP*:IOTYPE=Disp_YN Sr No 1 2 3 4 Copyright LM Technologies Ltd www.lm-technologies.com Page 43 of 70 LM074 SPP with GAP Central Application v1.1 4.4.5 AT*DEL\r\n i. Execution only command. ii. User issues this command to delete the device from its paired list. iii. DEL command: AT*del=00126f357215\r\n iv. OK response will be provided if the string entered has valid BT address. Module deletes the device from its pairing list. v. Err response will be provided if invalid BT address, invalid length of address is provided. vi. If device is deleted form the pairing list, Module will follow pairing procedure before getting connected with the device. 4.4.6 AT*PASSKEY\r\n i. Execution only command. ii. When the module has DPIN=ON, MITM=ON and IOTYPE as Keyboard Only, in pairing procedure module gives indication IND*:PASSK=?. iii. User shall provide the pass key in following format:

AT*PASSKEY=1234\r\n . iv. Any integer within the range uint32 is considered as valid Passkey. 4.4.7 AT*PASSCFM\r\n i. Execution only command. ii. When the module has DPIN=ON, MITM=ON and IOTYPE as DISPLAY confirmation Yes/No, in pairing procedure module gives indication IND*:PASSK=xxxxxx. iii. User shall provide the confirmation for pass key in following format: at*passcfm=00126f357215,Yes\r\n or at*passcfm=00126f357215,no\r\n 4.4.8 AT*STOPPAIR\r\n i. Execution only command. ii. Used to stop the pairing procedure for a device. iii. Once the module starts pairing procedure, the stack completes the procedure within maximum 90 seconds. User can stop the pairing procedure within this time. iv. Issue command to stop the pairing procedure with the BT address of the peer device e.g. AT*stoppair=00126f357215 4.4.9 AT*PAIRLIST\r\n i. Query only command. ii. Pairlist query command: AT*PAIRLIST=?\r\n Copyright LM Technologies Ltd www.lm-technologies.com Page 44 of 70 LM074 SPP with GAP Central Application v1.1 iii. Pairlist report may be multiple line if module is paired with more than one device. Paired devices report is shown in following format REP*:PAIRLIST=00126f357201, REP*:PAIRLIST=00126f357215, REP*:PAIRLIST=END iv. Pairlist report can be multiple line, to indicate end of the report REP*:PAIRLIST=END is displayed at end. 4.5 SPP Related commands:

4.5.1 AT*FIND\r\n i. Execution only command. ii. Used to start the discovery of Bluetooth devices nearby. iii. Start discovery command format is AT*FIND=ON\r\n iv. Stop discovery of Bluetooth devices by command AT*FIND=Off\r\n. v. Module shows discovered devices with their name and addresses. Each device is reported as soon as it is discovered. vi. Report for each device is sent with new line. To indicate the end of the discovery report, REP*:FIND=END message is shown. vii. If module did not get reply to nam query of remote device it will display NULL in name string (e.g. row 3 in below report). viii. Example report for discovery:

at*find=onat*find=on OK REP*:FIND=Start..

= 1 0002-5b-00a5a5 Serial Adapter

= 2 0026-4a-a19172 LML11

= 3 442a-60-da6c58 NULL

= 4 4c49-e3-68b246 Redminote REP*:FIND_END= 4 devices found. 4.5.2 AT*ROLE\r\n i. Query and Set command. ii. Query command = AT*ROLE=?\r\n iii. Report for SPP role query is REP*:SPPRole=SLAVE\r\n . Default role is Slave mode supporting SPP incoming connections. Sr No SPP Role 1 2 Dual role

( SPP Slave and SPP master role ) SPP Slave Only LM951/LM074 Role set command At*role=dual LM951/LM074 Role query response REP*:SPPRole=DUAL At*role=slave REP*:SPPRole=SLAVE Copyright LM Technologies Ltd www.lm-technologies.com Page 45 of 70 LM074 SPP with GAP Central Application v1.1 SPP Master only At*role=master REP*:SPPRole=MASTER 3 iv. When the module is in Dual mode, it can accept incoming SPP connection as well as initiate outgoing SPP connection whereas module cannot accept or initiate new connection when it is already connected to any remote device. E.g. if module has established an outgoing connection, then after terminating the outgoing connection it can accept incoming connection. BOND=Valid-BD-address. (e.g. BOND=0012-6f-

v. In slave-only role 357215) 1. 2. x Module will accept connection request only from bonded device. Connection requests from other devices will be rejected by module. BOND=0000-00-000000. x Module will accept connection request from ay device. vi. In master-only role, Refer ACON and BOND command for more details. vii. In any role (dual, Slave only or Master only role) module can support only one connection at an instance. 4.5.3 AT*ACON\r\n i. Query and set command. ii. This setting is applicable for Master only role. iii. Auto connect query command: AT*ACON=?\r\n iv. Auto connect query report: REP*:ACON=OFF v. Command to set ACON as ON is AT*ACON=ON\r\n vi. When the module is in Master-only role and ACON setting is ON, BOND=Valid-BD-address. (e.g. BOND=0012-6f-

1. 357215) x 2. x If device has valid address for BOND, it keeps issuing connection request to that device till the connection is established. BOND=0000-00-000000. If device has BOND address as Zero, it will start discovery of nearby Bluetooth devices and issues connection request to first found device. vii. When module is in Master-only role and ACON setting is OFF, module will wait for AT command from user to initiate the connection request (module will not accept any incoming connection request). Copyright LM Technologies Ltd www.lm-technologies.com Page 46 of 70 4.5.4 AT*BOND\r\n LM074 SPP with GAP Central Application v1.1 i. Query and set command. ii. Set command: AT*BOND=00126f357215\r\n. Device will establish connection only with remote device having BD address as 00126f357215. iii. Set command: AT*BOND=000000000000\r\n. Device will establish connection with any device. iv. v. This setting is applicable for Master-only, slave-only role. When Bond Address setting holds a valid Bluetooth address then LM068/LM074/LM074 will establish connection only with that device. vi. LM068/LM074/LM074 can be paired with maximum 8 devices and stores the device addresses in its permanent memory (this is called as TDL-Trusted_Devices_List or PDL-Paired_Devices_List) whereas it can be bonded to only one device at a time whose address is mentioned in BOND command setting. vii. Bond device address query command: AT*BOND=?\r\n. viii. Default settings is: REP*:BOND=0000-00-000000. ix. Setting for default bond device address is Zero i.e. device is not bonded to any remote device and can accept or issue connection request to any remote device. x. Command to set ACON as ON is AT*ACON=ON\r\n. xi. When the module is in Master only role and ACON setting is ON, module performs the discovery of nearby devices and tries to connect with the first found device for SPP connection. 4.5.5 AT*CONN\r\n i. Execution only command. ii. Supported in SPP Master-only and Dual mode. iii. If module is MASTER role and ACON setting is ON, the module will always respond to this command as ERR as it only issues a connection request to BOND device, or it performs discovery on its own and attempts to connect to first device found. iv. User can start to initiate outgoing SPP connection. v. Outgoing connection command: AT*conn=00126f357215\r\n vi. OK response will be provided if the string entered has valid BT address, module is not connected to any device. vii. Err response will be provided if invalid BT address, invalid length of address is provided or if the module is already in connected state. viii. After module gives OK response to at+conn command, it starts the connection procedure. Result of connection procedure is indicated as indication message. Copyright LM Technologies Ltd www.lm-technologies.com Page 47 of 70 LM074 SPP with GAP Central Application v1.1 1. IND*:CONN_FAILURE=00126f357215 message is shown to indicate the failure in connection with BD address 0012-

6f-357215. 2. IND*:CONNECTED=00126f357215 message is shown to indicate the SPP connection is successfully established and the devices are in connected state. 3. Once the devices are connected, LM951/LM074 is in SPP-

connected-online-data mode. Every string entered by host on UART is treated as data and is transmitted to connected device. 4. User can come out of this mode by entering the Escape sequence. 4.5.6 Escape sequence +++

i. Execution only command/sequence. ii. Supported only in SPP-connected-online-data mode. iii. User issues this command to enter in SPP-connected-online-

command mode. iv. If the user issues escape sequence in SPP-connected-online-data when LED D10 is Blinking, OK response is given by module and module enters in SPP-connected-online-command mode. v. Once the module enters in SPP-connected-online-command mode, any strings entered on UART are considered as AT commands and are processed by module (still the module is in connected state). vi. In SPP-connected-online-command mode, users can query/update module settings and start the disconnection by issuing at*drop command. 4.5.7 AT*AUTO\r\n i. Execution only command/sequence. ii. Supported only in SPP-connected-online-command mode. iii. User issues this command to enter back in SPP-connected-

online-data mode. iv. After entering in SPP-connected-online-data mode, any data entered on UART is transmitted to the remote device over Bluetooth. 4.5.8 AT*DROP\r\n i. Execution only command. ii. Supported in all SPP roles (dual, master-only or slave-only). iii. User issues this command in SPP-connected-online-command mode to terminate the existing SPP connection (applicable for existing incoming or outgoing SPP connection). Copyright LM Technologies Ltd www.lm-technologies.com Page 48 of 70 LM074 SPP with GAP Central Application v1.1 iv. connection termination command: e.g. AT*DROP=00126f357215\r\n v. OK response will be provided if the string entered has valid BT address and module is connected to the device with entered BT address and module is in online-command mode. vi. Err response will be provided if invalid BT address, invalid length of address is provided, module is not connected to any device. vii. AT*drop command causes the indication message to indicate the devices are successfully disconnected. viii. IND*:DISCONNECTED=00126f357215 indication message is shown to indicate the module is disconnected from the device with BT address 0012-6f-357215. 4.6 Firmware Upgrade commands:

4.6.1 AT*UPGRADE\r\n i. Execution only command. ii. Supported in all SPP roles (dual, master-only or slave-only). iii. The module should not be connected to BLE or any Bluetooth device before starting the procedure. iv. User issues this command in SPP-connected-online-command mode to perform the OTA-firmware-upgrade. v. User shall enter this command with password provided for firmware upgrade. If the password is correct, then module issues OK response and is ready for performing firmware upgrade. Copyright LM Technologies Ltd www.lm-technologies.com Page 49 of 70 LM074 SPP with GAP Central Application v1.1 5. LM074 Over The Air Firmware Upgrade Procedure This section describes the procedure to perform an over the air firmware upgrade for the LM074 module. Users can use serial terminals like Hercules, HyperTerminal, Tera term or Putty etc. for serial communication with LM074 module. In this document, the term new image refers to the firmware image to which the LM074 will be upgraded to. The LM074 receives the new image from a peer device which is connected to itself with Bluetooth. The LM074 can receive new images over SPP profile only. The module does not support other Bluetooth profiles to receive a new image. 5.1 Pre-requisites for Firmware upgrade:

5.1.1 New Firmware image:

i. New Firmware image is provided as xxxxxxx.bin file to user. ii. User shall store this image on PC/Laptop/device used to connect to the LM074 module for OTA upgrade. iii. LM074 module can be upgraded with the image provided by LM Technologies only. 5.1.2 Peer Bluetooth device requirements:

i. Peer Bluetooth device should support sending file over SPP profile

(some mobile applications may not support this). ii. LM technologies has tested LM048/LM058 or LM074 module to send the new image with Hercules utility from windows PC. iii. Peer device should support pairing requirements. iv. LM074 will connect only with Paired device hence receives image only from paired device. 5.1.3 Pairing and Authentication of Peer device:

i. LM074 can pair with remote device with fixed PIN. ii. LM074 can pair with remote device with dynamic PIN and MITM protection enabled. iii. For detailed pairing procedure of LM074 with AT commands, please refer document LM074 module Pairing procedure R1.0.pdf Copyright LM Technologies Ltd www.lm-technologies.com Page 50 of 70 5.1.4 LM074 requirements:

LM074 SPP with GAP Central Application v1.1 i. LM074 can be SPP master (initiate connection with remote device) or SPP Slave (Accept connection request from remote device). 5.2 Firmware upgrade procedure Flow chart:

The flow chart below illustrates the firmware upgrade procedure, highlighting messages when the upgrade operation is successful. The comments show the failure points as FP1 to FP5. The cause of failure points and actions to overcome them are discussed in the subsequent section. Note: During the upgrade procedure, after the module displays the message Ready to receive OTA file, if the user fails to send the image to the LM074 module, the module/user cannot terminate the OTA mode. The user has to provide power-on/off cycle to come out of OTA upgrade mode. Another way to come out of this mode; the remote connected device has to send at-least 200 bytes of data. The module will treat this data as an upgrade image but due to failure it will reboot itself with existing firmware. Copyright LM Technologies Ltd www.lm-technologies.com Page 51 of 70 LM074 SPP with GAP Central Application v1.1 Figure 1: Firmware Upgrade Flowchart Note: The firmware upgrade password is dependent on the current firmware version. Copyright LM Technologies Ltd www.lm-technologies.com Page 52 of 70 LM074 SPP with GAP Central Application v1.1 5.3 Possible Failure points and corrective actions The following section describes the possible failure points while performing an Over the Air firmware upgrade. It also covers possible reasons for errors what a user can do to correct them. 5.3.1 Failure point 1:

i. After entering the escape sequence +++, the module should respond as OK and enter in Online-connected-command-mode. ii. If module does not respond as OK (it will not reply as ERR in this state), module is still in online-connected-data-mode and sends data to remote device. iii. PIO-xx is toggled or LED D10 starts blinking to show the module is ready to accept the escape sequence. iv. User should enter escape sequence immediately after the D10 led starts blinking. v. If module does not reply as OK, user should wait till module is ready to receive next escape sequence. vi. Module is ready to process firmware upgrade even if there are multiple attempts of failure to enter in Online-connected-

command-mode. vii. User cannot process further steps if module does not enter in online-connected-command-mode. Note: If the Current firmware on the LM074 module is a Bridge application or GAP-Central-Only, then after SPP connection the LM074 enters into Command mode. Then there is no need to enter the Escape sequence. The user can directly issue the AT*upgrade command. 5.3.2 Failure point 2:

i. Once the module enters into the Online-connected-command-

mode, the user should provide the firmware upgrade password through AT commands. ii. If the user provides the correct firmware upgrade password, the module responds to the command as OK and displays the message Ready to receive OTA file iii. The module replies as ERR a. If the user enters a wrong password for upgrade command, module responds as ERR. b. Firmware upgrade password is dependent on current firmware version of the module. c. E.g. if the current firmware version on the module is 1.50, the firmware upgrade password will be AT*upgrade=LMUPDATEV150. d. In the AT*upgrade command the string after = is case sensitive and should be entered in all uppercase (for letters). Page 53 of 70 Copyright LM Technologies Ltd www.lm-technologies.com LM074 SPP with GAP Central Application v1.1 e. If the module replies as ERR, the user should try entering the correct password and try to get the message Ready to receive OTA file. f. The module can process successfully even though it already had more than one failure attempt while getting Ready to receive OTA file message. 5.3.3 Failure point 3:

i. Once the module enters in Online-connected-command-mode, the user should provide the firmware upgrade password through AT command. ii. If the user provides the correct firmware upgrade password, the module responds to the command with OK. iii. After displaying the OK response, the module displays the message Ready to receive OTA file if it is in the state to receive the upgrade image. iv. Module replies as State Err a. If the firmware upgrade password is correct but module is not in state to perform the upgrade procedure, the module will respond as State err to the AT*upgrade command. b. The module will display State err message if it is not connected to a remote device or it has lost the current connection. c. If module replies as State err, the user cannot proceed to the firmware upgrade procedure and should check for the BT connection of LM074 with peer device. d. In this case, the user shall start the upgrade procedure from the beginning. e. Refer to the image below:

Copyright LM Technologies Ltd www.lm-technologies.com Page 54 of 70 LM074 SPP with GAP Central Application v1.1 Figure 2: UART messages when the module is not connected to the peer device 5.3.4 Failure point 4:

i. After the module shows the message Ready to receive OTA file, it is ready to receive the upgrade image. ii. After the peer device begins sending the file, the module opens internal memory partition2 or partition3 to write this image iii. The message PTN2/PTN3 indicates that the module is writing the file to partition2/partition3. iv. This message should appear one or two seconds after the peer starts sending the file. v. If the module does not show this message, but the peer device indicates that the file has been sent, an error has occurred. vi. In this case the user should power the module on and off or reset the module with the AT*reset=1 command and try the procedure from start again. vii. Refer to the image below Copyright LM Technologies Ltd www.lm-technologies.com Page 55 of 70 LM074 SPP with GAP Central Application v1.1 Figure 3: UART messages when the module opens a partition to write a new image Copyright LM Technologies Ltd www.lm-technologies.com Page 56 of 70 5.3.5. Failure point 5:

LM074 SPP with GAP Central Application v1.1 i. The message PTN2/PTN3 indicates that the module is writing a file to partition2/partition3, module is receiving the file and writing it to the partition. ii. After the peer device shows that it has successfully sent the file, LM074 will close the partition. iii. After the partition is closed, the message Sign_OK indicates that the module has received Signature. iv. The message Sink_Closed indicates that the module has closed the partition after receiving the random string. v. After the partition is closed and if the upgrade procedure is completed successfully, the module shows the message V_PASS_2 / V_PASS_3. vi. If module shows the failed-CRC message:

a. If CRC of the received image is not matching to the CRC mentioned in the image, the module shows a Failed-CRC message. b. This may be because of disturbances/interferences in wireless transmission. If so the user should repeat the procedure from beginning. c. The module restarts itself with a warm reset and starts executing the existing image. d. Refer to the image below:

Copyright LM Technologies Ltd www.lm-technologies.com Page 57 of 70 LM074 SPP with GAP Central Application v1.1 Figure 4: UART messages when the CRC of the received image does not match vii. If the module shows failed-Sign message:

a. If module shows the failed-Sign message, it indicates that the signature of module firmware is different than the signature of the new image. b. This indicates that the firmware upgrade procedure has been followed correctly but there is error in new image provided for the firmware upgrade. c. If the image is not suitable for performing a firmware upgrade the user should contact LM technologies. d. The module restarts itself with a warm reset and starts executing the existing image. e. Refer to the image below:

Copyright LM Technologies Ltd www.lm-technologies.com Page 58 of 70 LM074 SPP with GAP Central Application v1.1 Figure 5: UART messages showing a failure in image verification 5.3.5 Successful firmware Upgrade:

i. The image below depicts the messages shown by the module during a successful firmware upgrade procedure ii. After showing message V_Pass_2 or V_Pass_3, the module performs warm reset and starts executing the new image. iii. In the image below, the message Entering Message Loop indicates that the device has performed warm reboot. The message GATT Initialised indicates that the new image has GATT is enabled for BLE connectivity. Copyright LM Technologies Ltd www.lm-technologies.com Page 59 of 70 LM074 SPP with GAP Central Application v1.1 Figure 6: UART messages showing successful firmware upgrade Copyright LM Technologies Ltd www.lm-technologies.com Page 60 of 70 LM074 SPP with GAP Central Application v1.1 6. Simple Secure Pairing between LM074 and remote device This section describes the indication messages given by the LM074 module during the pairing procedure. It also covers the AT commands that a user will need to provide as per the settings of DPIN, MITM and IOTYPE.``

The LM074 uses BT2.1 security supporting the dynamic PIN, but is also compatible with BT2.0 devices which shares fixed PIN during the pairing procedure. 6.1 Pairing of LM074(BT2.1) with BT2.0 devices Here the BT2.0 device is treated as LM Technologies LM048 device, with firmware version 6.57. When the LM074 has DPIN as DPIN=OFF, it is compatible with BT2.0 devices. When DPIN=OFF, the module does not care about MITM, IOTYPE settings. When DPIN is OFF, module uses PIN during the pairing procedure with remote devices. Default PIN is 1234, users can change this to numeric only, Alpha only or alphanumeric. As per Bluetooth standards, maximum of 16 characters are allowed in PIN setting. 6.1.1 If LM074 has setting DPIN=OFF i. When the pairing procedure is started on the LM074, it will show the indication message with the BD-Address of remote device e.g IND*:PAIR=00126f357215. ii. The user shall provide accept/reject response to this indication as AT*PAIR=00126f357215,accept or AT*PAIR=00126f357215,reject. iii. LM074 uses its fixed PIN. iv. If the fixed PIN of LM074 is same as the other device pairing is successful. v. After completing the pairing procedure, the LM074 indicates the status of pairing to user e.g. IND*:PAIR=OK,00126f357215 or IND*:PAIR=FAIL,00126f357215 . vi. If the fixed PIN of LM074 is not same as other device pairing fails. 6.2 Pairing of LM074 (BT2.1) with BT2.1 devices Here the BT2.0 device is treated as LM Technologies LM048 device with firmware version 6.19. The passkey used during the pairing procedure is dependent on the IO-type setting on the LM074. Copyright LM Technologies Ltd www.lm-technologies.com Page 61 of 70 LM074 SPP with GAP Central Application v1.1 If IO-type is keyboard only, the LM074 will expect the passkey from the user and use it internally for the pairing procedure. When the IO-type is display only, the LM074 will display the passkey and the user should use the same passkey on the remote device to complete the pairing procedure. When IO-type is Display with yes/no confirmation, the LM074 displays passkey and expects confirmation from the user whether the passkey for remote device is the same. When the IO-type is NO-INOUT i.e. no input no output then it depends on the peer device whether the pairing will be successful or not. If the IO-

type is No-input-no-output, MITM should be off otherwise the LM074 will never be able to pair with a remote device. If the LM074 and remote device has IO-type as No-input-no-output and MITM as off then devices may pair successfully by just works pairing type. 6.2.1 LM074 has settings DPIN=on, MITM=on, IO-

type=Keyboard-only i. After the LM074 indicates Pairing as IND*:PAIR,00126f357215 and the user accepts the Pairing request with AT*PAIR=00126f357215, accept, the LM074 starts the pairing procedure. ii. IO-type as Keyboard only indicates that user can provide Passkey for pairing using AT commands. iii. The bluetooth stack will use this passkey for completing the pairing procedure with the remote device. iv. During the pairing procedure, the LM074 displays the message IND*:PASSK=?. This indicates that the LM074 requires a Passkey from the user. v. The user should respond to this with at*passkey=1234. i.e. the passkey for the remote device is 1234. It can be any integer in range of 32bit value. vi. After completing the pairing procedure, the LM074 indicates the status of pairing to the user e.g. IND*:PAIR=OK,00126f357215 or IND*:PAIR=FAIL,00126f357215 . 6.2.2 LM074 has settings DPIN=on, MITM=on, IO-

type=display only i. After the LM074 shows indication of Pairing IND*:PAIR,00126f357215 and user accepts the Pairing request Copyright LM Technologies Ltd www.lm-technologies.com Page 62 of 70 LM074 SPP with GAP Central Application v1.1 with AT*PAIR=00126f357215, accept, LM074 starts pairing procedure. ii. When the LM074 starts the pairing procedure with a remote device and has IO-capability as Display only, LM074 shows the Passkey for remote device as message IND*:PASSKEY=311303 here number 311303 is for reference only and should vary for every device. iii. IO-type as Display only indicates that the Passkey generated by the Bluetooth stack for pairing is only displayed by the LM074. iv. The user should ensure that the other device uses the passkey provided by the LM074 module in above indication. v. If the remote device uses the passkey displayed by the LM074 then the pairing procedure should be completed successfully. vi. After the pairing procedure is completed, the LM074 indicates this as IND*:PAIR=OK,00126f357215 . 00126f357215 is the reference BD address and LM074 will show the remote devices BD-Address. 6.2.3 LM074 has settings DPIN=on, MITM=on, IO-

type=Display Y/N i. After the LM074 indicates Pairing as IND*:PAIR,00126f357215 and the user accepts the pairing request with AT*PAIR=00126f357215, accept, the LM074 starts the pairing procedure. ii. When the LM074 starts the Pairing procedure with the remote device and has IO-capability as Display_YN i.e. Display passkey and Confirmation is required as Yes or No, LM074 shows the Passkey for remote device and expects the confirmation from user as yes or No. iii. The passkey is displayed by the LM074 module as IND*:PASSKEY=756830. iv. User shall provide confirmation with the AT command as at*passcfm=00126f357215,Yes or at*passcfm=00126f357215,No. v. The remote device should be set as IO-type as display-only or display-YN otherwise pairing will not be possible. 6.2.4 LM074 has settings DPIN=on, MITM=on, IO-type=no-

Input-no-output i. Pairing with the remote device may or may not be successful and depends on MITM and IO-type settings of remote device. ii. If the remote device also has the same settings, then pairing may be successful otherwise the pairing might fail. Copyright LM Technologies Ltd www.lm-technologies.com Page 63 of 70 6.2.5 LM074 has settings DPIN=on, MITM=off, IO-type=no-

LM074 SPP with GAP Central Application v1.1 Input-no-output i. Pairing with the remote device might be successful if the remote device also has DPIN=on, MITM=off and IO-type as no one. ii. If the remote device has MITM=on or IO type other than no input no output, the LM074 cannot pair with that device. 7. LED Indication 7.1 Power on LED sequence 1. All LEDs blink fast during power on for 3 seconds. User can notice all LEDs blinking approximately 6 to 7 times. 2. The module shows power on LED sequence after AT*Reset=1 and AT*Reset=2 commands. 7.2 LED0 1. LED0 (RED LED on LM068) is constantly ON to indicate that the module/adapter is powered and active for AT commands, Bluetooth discovery, audio functionality. 2. If LED0 is not ON, module/adapter may not be powered correctly or not initialised. 3. The state of LED0 is irrespective of Bluetooth connection or pairing state. 7.3 LED1 1. LED1 (Yellow LED on adapter) indicates the data transfer in the SPP 2. When the module/adapter is not connected to the remote SPP device, connected state. LED1 should be OFF. 3. When the module/adapter connects to a remote SPP device, LED1 is ON for the duration of the module/adapter receiving data or sending data to the remote device. 4. LED1 should be off when there is no active data transfer on the Bluetooth connection. Copyright LM Technologies Ltd www.lm-technologies.com Page 64 of 70 LM074 SPP with GAP Central Application v1.1 7.4 LED2 SPP Connected state:

1. LED2 (Blue LED) shall be constantly ON when the module/adapter is connected to the remote device over a SPP connection. 2. LED2 will be constantly ON when it is connected to a remote device while its role is slave or master. 3. Slave-mode:

1. When the module/adapter is in slave mode, LED2 will keep blinking fast until the module/adapter enters into Connected state or Pairing mode. Master-mode:

1. When the module/adapter is not connected to a remote device and is in master mode, LED2 will blink slowly until the module/adapter enters into Pairing state or Connected state. 7.5 Pairing State 1. When the module/adapter is in pairing mode, LED-1 and LED2 will keep blinking fast until pairing is completed. Copyright LM Technologies Ltd www.lm-technologies.com Page 65 of 70 LM074 SPP with GAP Central Application v1.1 8. Appendix 8.1 Abbreviations SSP BT BLE BD-Address BT2.0 BT2.1 MITM IOTYPE DPIN PIN Simple Secure Pairing Bluetooth Bluetooth low energy Bluetooth address of device Bluetooth 2.0 stack Bluetooth 2.1 stack Man In The Middle protection Input Output Type (IO capability of device) Dynamic PIN Personal Identification Number 8.2 BLE Peripheral characteristics Characteristic Bit field for broadcast characteristic 0x01 Indication on LM074 Bd read 0x02

"Rd "

write_cmd 0x04 Description Broadcasts of the Characteristic Value User cannot read or write on this characteristic Reads of the Characteristic Value. User can read this characteristic with RDCHARVAL command

"Wr_cmd " Writes of the Characteristic Value without response. User can write on this characteristic with AT*WRWORESP command Copyright LM Technologies Ltd www.lm-technologies.com Page 66 of 70 LM074 SPP with GAP Central Application v1.1 write 0x08

"Wr_req "

notify 0x10

"CCFG "

indicate 0x20

"Indi "

write_sig 0x40

"Wr_signed

Writes of the Characteristic Value with response. User can write on this characteristic with AT*WRCHARVAL command Client configuration flag for notification enable If user enables this flag, remote device shows notification Indications of a Characteristic Value with acknowledgement. LM074 will show indication message if receives data form this characteristic Signed writes to the Characteristic Value using Signed Write Command. User can write on this characteristic with AT*SIWRWORESP command 8.3 GATT UUID type 1. All UUID values are in Hex. 2. 16-bit Attribute UUID is represented as 1801 3. 32-bit UUID is represented as 32005b32 4. All UUIDs are Big Endian, i.e. for example 128-bit UUID 00112233-

4455-6677-8899-aabbccddeeff Copyright LM Technologies Ltd www.lm-technologies.com Page 67 of 70 LM074 SPP with GAP Central Application v1.1 5. uuid[0] = 0x00112233, uuid[1] = 0x44556677, uuid[2] =

0x8899aabb, and uuid[3] = 0xccddeeff. 6. If the service-UUID is 128-bit, it is completely mentioned in the report of FindServ e.g. 00005500-d102-11e1-9b23-00025b00a5a5 7. If the characteristic has 128-bit UUID then only first 32 bits are shown 8. 00005501 is shown whereas the actual 128-bit UUID is 00005501-

D10211E1-9B230002-5B00a5a5 here the remaining bits are same as that of the 128-bit Service UUID shown above. e.g. 8.4 GATT_Status_code The BLE stack outputs an error if the required operation fails. The table below lists the possible error codes with a description. Sr No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Error code Error description gatt_status_success 0x0 0x1 gatt_status_invalid_handle gatt_status_read_not_permitted 0x2 0x3 gatt_status_write_not_permitted gatt_status_invalid_pdu 0x4 gatt_status_insufficient_authentication 0x5 gatt_status_request_not_supported 0x6 gatt_status_invalid_offset 0x7 0x8 gatt_status_insufficient_authorization gatt_status_prepare_queue_full 0x9 0xa gatt_status_attr_not_found gatt_status_not_long 0xb gatt_status_insufficient_encr_key_size 0xc gatt_status_invalid_length 0xd gatt_status_unlikely_error 0xe gatt_status_insufficient_encryption 0xf gatt_status_unsupported_group_type 0x10 gatt_status_insufficient_resources 0x11 0x12 gatt_status_application_error gatt_status_initialising 0x13 Copyright LM Technologies Ltd www.lm-technologies.com Page 68 of 70 LM074 SPP with GAP Central Application v1.1 Sr No 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 Error code Error description gatt_status_failure 0x14 0x15 gatt_status_att_reg_failure gatt_status_att_db_failure 0x16 gatt_status_max_connections 0x17 gatt_status_abnornal_disconnection 0x18 gatt_status_link_loss 0x19 gatt_status_mtu_already_exchanged 0x1a gatt_status_value_mismatch 0x1b gatt_status_rej_psm 0x1c 0x1d gatt_status_rej_security gatt_status_key_missing 0x1e 0x1f gatt_status_connection_timeout gatt_status_retrying 0x20 gatt_status_peer_aborted 0x21 gatt_status_device_not_found 0x73 gatt_status_sign_failed 0x74 0x75 gatt_status_busy gatt_status_timeout 0x76 gatt_status_invalid_mtu 0x77 gatt_status_invalid_uuid 0x78 gatt_status_success_more 0x79 gatt_status_success_sent 0x7a gatt_status_invalid_cid 0x7b 0x7c gatt_status_invalid_db gatt_status_db_full 0x7d gatt_status_invalid_phandle 0x7e 0x7f gatt_status_invalid_permissions Copyright LM Technologies Ltd www.lm-technologies.com Page 69 of 70 LM074 SPP with GAP Central Application v1.1 8.5 BLE Service UUIDs BLE Service UUIDs for reference only. 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Sr No Service 1 2 3 4 5 6 7 8 Generic Access Alert Notification Service Automation IO Battery Service Blood Pressure Body Composition Bond Management Service Continuous Glucose Monitoring Current Time Service Cycling Power Cycling Speed and Cadence Device Information Environmental Sensing Fitness Machine Generic Attribute Glucose Health Thermometer Heart Rate HTTP Proxy Human Interface Device Immediate Alert Indoor Positioning Internet Protocol Support Service Link Loss Location and Navigation Mesh Provisioning Service Mesh Proxy Service Next DST Change Service Object Transfer Service Phone Alert Status Service Pulse Oximeter Service Reference Time Update Service Running Speed and Cadence Scan Parameters Transport Discovery Tx Power User Data Weight Scale Copyright LM Technologies Ltd www.lm-technologies.com 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 UUID 0x1800 0x1811 0x1815 0x180F 0x1810 0x181B 0x181E 0x181F 0x1805 0x1818 0x1816 0x180A 0x181A 0x1826 0x1801 0x1808 0x1809 0x180D 0x1823 0x1812 0x1802 0x1821 0x1820 0x1803 0x1819 0x1827 0x1828 0x1807 0x1825 0x180E 0x1822 0x1806 0x1814 0x1813 0x1824 0x1804 0x181C 0x181D Page 70 of 70 2.2 List of applicable FCC rules FCC Part 15.247 2.3 Specific operational use conditions This product is a Dual-modular transmitter policy independent of any host. Not applicable. 2.4 Limited module procedures This product is a S Dual-modular transmitter. It is not a limited module. Not applicable. 2.5 Trace antenna designs This product has an Integral antenna. Not applicable. 2.6 RF exposure considerations This equipment complies with the FCC RF radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with a minimum distance of 20cm between the radiator and any part of your body. 2.7 Antennas This product has an Integral antenna. Not applicable. 2.8 Label and compliance information Remind end customers to add "Contain FCC ID: VVXLM074"

2.9 Information on test modes and additional testing requirements Contact LM Technologies Ltd. will provide stand-alone modular transmitter test mode. Additional testing and certification may be necessary when multiple modules are used in a host. 2.10 Additional testing, Part 15 Subpart B disclaimer To ensure compliance with all non-transmitter functions the host manufacturer is responsible for ensuring compliance with the module(s) installed and fully operational. For example, if a host was previously authorized as an unintentional radiator under the Suppliers Declaration of Conformity procedure without a transmitter certified module and a module is added, the host manufacturer is responsible for ensuring that the after the module is installed and operational the host continues to be compliant with the Part 15B unintentional radiator requirements. Since this may depend on the details of how the module is integrated with the host, LM Technologies Ltd. shall provide guidance to the host manufacturer for compliance with the Part 15B requirements. FCC Warning This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:

(1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. NOTE 1: Any changes or modifications to this unit not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. FCC Radiation Exposure Statement:

This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment. End users must follow the specific operating instructions for satisfying RF exposure compliance. This module certified that complies with RF exposure requirement under mobile or fixed condition, this module is to be installed only in mobile or fixed applications. A mobile device is defined as a transmitting device designed to be used in other than fixed locations and to generally be used in such a way that a separation distance of at least 20 centimeters is normally maintained between the transmitter's radiating structure(s) and the body of the user or nearby persons. Transmitting devices designed to be used by consumers or workers that can be easily re-located, such as wireless devices associated with a personal computer, are considered to be mobile devices if they meet the 20 centimeter separation requirement. A fixed device is defined as a device is physically secured at one location and is not able to be easily moved to another location. Note 2: Any modifications made to the module will void the Grant of Certification, this module is limited to OEM installation only and must not be sold to end-users, end-user has no manual instructions to remove or install the device, only software or operating procedure shall be placed in the end-user operating manual of final products. Note 3: Additional testing and certification may be necessary when multiple modules are used. Note 4: The module may be operated only with the antenna with which it is authorized. Any antenna that is of the same type and of equal or less directional gain as an antenna that is authorized with the intentional radiator may be marketed with, and used with, that intentional radiator. Note 5: To ensure compliance with all non-transmitter functions the host manufacturer is responsible for ensuring compliance with the module(s) installed and fully operational. For example, if a host was previously authorized as an unintentional radiator under the Suppliers Declaration of Conformity procedure without a transmitter certified module and a module is added, the host manufacturer is responsible for ensuring that the after the module is installed and operational the host continues to be compliant with the Part 15B unintentional radiator requirements. Since this may depend on the details of how the module is integrated with the host, LM Technologies Ltd. shall provide guidance to the host manufacturer for compliance with the Part 15B requirements. Note 6: FCC ID label on the final system must be labeled with Contains FCC ID: VVXLM074 or Contains transmitter module FCC ID: VVXLM074. Note 7: For all products market in US, OEM has to limit the operation channels in CH1 to CH11 for 2.4G band by supplied firmware programming tool. OEM shall not supply any tool or info to the end-user regarding to Regulatory Domain change. IC WARNING This device contains licence-exempt transmitter(s) that comply with Innovation, Science and Economic Development Canadas licence-exempt RSS(s). Operation is subject to the following two conditions:

(1) This device may not cause interference.

(2) This device must accept any interference, including interference that may cause undesired operation of the device. Lmetteur/rcepteur exempt de licence contenu dans le prsent appareil est conforme aux CNR dInnovation, Sciences et Dveloppement conomique Canada applicables aux appareils radio exempts de licence. Lexploitation est autorise aux deux conditions suivantes:

1. Lappareil ne doit pas produire de brouillage;

2. Lappareil doit accepter tout brouillage radiolectrique subi, mme si le brouillage est susceptible den compromettre le fonctionnement. This radio transmitter [enter the devices ISED certification number] has been approved by Innovation, Science and Economic Development Canada to operate with the antenna types listed below, with the maximum permissible gain indicated. Antenna types not included in this list that have a gain greater than the maximum gain indicated for any type listed are strictly prohibited for use with this device. No. External uniqueness Antenna 1 1 Internal uniqueness Antenna Antenna Type Gain 2dBi 2dBi Impedance 50ohm 50ohm IC Radiation Exposure Statement:

This device and its antenna(s) must not be co-located with any other transmitters except in accordance with IC multi-transmitter product procedures. Referring to the multi-transmitter policy, multiple-transmitter(s) and module(s) can be operated simultaneously without reassessment permissive change. Cet appareil et son antenne (s) ne doit pas tre co-localiss ou fonctionnement en association avec une autre antenne ou transmetteur. This equipment complies with IC RSS-102 radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with minimum distance 20cm between the radiator & your body. Cet quipement est conforme aux limites d'exposition aux rayonnements IC tablies pour un environnement non contrl. Cet quipement doit tre install et utilis avec un minimum de 20cm de distance entre la source de rayonnement et votre corps. This module is limited to OEM installation only and must not be sold to end-users, end-user has no manual instructions to remove or install the device, only software or operating procedure shall be placed in the end-user operating manual of final products. Additional testing and certification may be necessary when multiple modules are used. Any changes or modifications not expressly approved by the manufacturer could void the user's authority to operate this equipment. The final end product must be labeled in a visible area with the following " Contains IC:

10531A-LM074 ".

Model: L LM074-0190 T 1 - PRO ODUCT L LABELIN NG FCC ID La abel Forma at FCC ID: V VVXLM07 74 EXHIBI Proposed Specification silk-screened Proposed ns: Text is b d onto the EU black in colo UT or shall be r and justifie e affixed at a ed. Labels ar conspicuous re printed in location on t indelible ink the EUT. k on perman nent adhesivee Label Loca ation on EU UT FCC ID Label Lo cation FCC C Part 15.247 Report No.: S SWTX19X10 0071446W-1/2 2

TECHNOLOGIES Declaration concerning Antenna Specification It is hereby declared that the product Model No.: LM074-0190, LM074-0191, LM074-0192 FCC ID: VVXLM074 fulfills the requirement in FCC test relating to the antenna type. The device specified above confirms to the FCC recommendations for Integral antenna type(s) described below:

Model No. of antenna: (N/A) Type of antenna: Integral Gain of the antenna: 2.0 dBi Frequency range: 2402MHz-2480MHz The mounting of the antenna is fixed to the radio module and no other antenna should be used. Company name: LM Technologies Ltd. Address: Unit19, Spectrum House, 32-34, Gordon House Road, London ZIP / Postal code: NVV5 1LP Country: United Kingdom Place: United Kingdom Date: December 19, 2019 Signature:

LM Technologies Ltd, Unit 19 Spectrum House, 32-34 Gordon House Rd, Gospel Oak, London, NW5 1LP, United Kingdom Company Reg 05303785

TECHNOLOGIES.

(FCC ID: VVXLMO74) Date: 2020-01-02 Gentlemen:

Regarding to the FCC 15.212, LM Technologies Ltd. would like to request modular approval for the submission FCC ID: VVXLM074. LM Technologies Ltd. confirms that the product complies with numbered requirements identified below:

1. The modular transmitter must have its own RF Shielding This EUT has its own shielding, please refers to external photos of the report. The modular transmitter must have buffered modulation/data inputs The EUT has buffered data inputs; it is integrated in chip CSRB5348A11-IBVE-R. 2. The modular transmitter must have its own power supply regulation The EUT interface provides 5VDC, and has its own VCO inside. 3. The modular transmitter must comply with the antenna and transmission system requirements of Sections 15.203, 15.204(b).and 15.204(c) The EUT meets the antenna requirements. It has an Integral antenna. Refer to the photo of antennas are shown in the internal photos. 4. The modular transmitter must be tested in a stand-alone configuration. The EUT is tested in an access point configuration via DC power. 5. The modular transmitter must be labeled with its own FCC ID number. The EUT has its own FCC ID and the label is visible. 6. The modular transmitter must comply with any specific rule or operating requirements applicable to the transmitter and the manufacture must provide adequate instructions along with module to explain any such requirement. The EUT comply with all applicable FCC Rules. Warning detail refer to the user manual. 7. The modular transmitter must comply with any applicable RF exposure requirements. The EUT comply with all applicable RF exposure requirements. See this RF exposure report. Sincerely, LM Technologies Ltd. Michael Sims/Managing Director LM Technologies Ltd, Unit 19 Spectrum House, 32-34 Gordon House Rd, Gospel Oak, London, NW5 1LP, United Kingdom Company Reg 05303785