FCC ID: 2AX2URL9424 Module

WARNING:pdfminer.pdfpage:The PDF <_io.BufferedReader name='/Volumes/Scratch/Incoming/eg-scratch/6014311.pdf'> contains a metadata field indicating that it should not allow text extraction. Ignoring this field and proceeding. Use the check_extractable if you want to raise an error in this case RL9xxx Certification Testing Support Guide FH0003253 - Rev1.0 April 27, 2022 RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Contents 3 7.1 7.2 Contents _________________________________________________________________ 2 Legal Notice ______________________________________________________________ 4 1 Purpose ______________________________________________________________ 6 2 Quick guide for HW setup ________________________________________________ 6 CCB Setup (for the testing without audio) ________________________________ 6 2.1 CCB with antenna installed ____________________________________________ 7 2.2 CCB with development kit (for voice and VOLTE relevant testing) ______________ 8 2.3 CCB with ELNA for AGPS testing (ELNA is used to improve the GPS performance) 11 2.4 TTY test set up ____________________________________________________ 11 2.5 2.6 Others: Power supply with power cable _________________________________ 12 Install Device Drivers __________________________________________________13 Install the USB Device Drivers ________________________________________ 13 3.1 3.2 How to check the driver version _______________________________________ 15 4 Installing the SIM _____________________________________________________16 5 Accessing the modem AT Port ____________________________________________17 Firmware Upgrade Instructions ___________________________________________19 6 7 QXDM Diagnostic Monitor ______________________________________________20 DM Logging_______________________________________________________ 20 NVs modification ___________________________________________________ 23 8 Reading the FSN and IMEI _______________________________________________25 9 Changing Radio Mode Preference _________________________________________25 10 Making a Data Connection over windows 10 with cellular function _______________26 Establish a connection to the DUT and PC _______________________________ 26 Connect the data call over PC ________________________________________ 26 To enable UE register to the network, you could use below two AT command to trigger a new search of network: ______________________________________ 26 To check if DUT registration status, you could issue at!gstatus? to query. _____ 26 For data connection, you may issue below AT command to trigger data connection between DUT and PC (windows10). ____________________________________ 27 To make sure if the data call setup correctly between DUT and PC, issue ipconfig on cmd terminal(windows10). ________________________________________ 27 Disconnect the data call over PC ______________________________________ 28 11 Ping between Simulation Network and UE __________________________________29 Ping destination IP address -S Source IP address _________________________ 29 Disable the other networks___________________________________________ 30 Turn off Windows Defender Firewall ____________________________________ 30 12 Setting for VOLTE testing ________________________________________________32 13 Setting for Audio related test ____________________________________________34 14 Setting for GPS and AGPS testing: _________________________________________35 For UP test cases: _________________________________________________ 35 UE parameter setting: ______________________________________________ 35 Cert file setting ____________________________________________________ 35 CP test case setting ________________________________________________ 36 UE parameter setting: ______________________________________________ 36 SBAS AT Command _______________________________________________ 36 15 Basic AT commands used for testing _______________________________________38 Set Voice Auto Answer Mode _________________________________________ 38 14.1 14.1.1 14.1.2 14.2 14.2.1 14.2.2 10.1 10.2 10.2.1 11.1 11.2 11.3 10.2.2 10.2.3 10.2.5 10.2.4 15.1 Page 2 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 15.2 15.3 15.4 15.5 15.6 15.7 15.8 15.9 15.10 15.11 15.12 15.13 15.14 Programming Emergency Call Test Number ______________________________ 38 Resetting the Device during Scripted Testing _____________________________ 38 Diversity Receiver Testing (for W and L) ________________________________ 39 Data Service ______________________________________________________ 39 Voice Call Service __________________________________________________ 39 SMS Service ______________________________________________________ 41 DTMF Service _____________________________________________________ 42 Supplementary Services _____________________________________________ 42 Diag Commands ___________________________________________________ 43 Enable/Disable IMS ________________________________________________ 43 Change IMS APN name per test purpose ________________________________ 44 TTY command _____________________________________________________ 44 Caller ID display AT command ________________________________________ 45 16 Others ______________________________________________________________46 Get TTY state over QXDM ____________________________________________ 46 16.1 QMI Test Guide for UT interface Cases __________________________________ 46 16.2 AT Test Guide for eCall Cases(only for europe) ___________________________ 51 16.3 AT Test Guide for Factory reset Cases (only for Verizon) ____________________ 54 16.4 AT Command for MSB & MSA _________________________________________ 54 16.5 16.5.1 GPS constant location _______________________________________________ 54 AGPS MSB: at!gpstrack=2,255,1000,1000,1 ________________________________________ 54 AGPS MSA: at!gpstrack=3,255,1000,1000,1 ________________________________________ 54 GPS stop location __________________________________________________ 54 16.5.2 17 Rolling Wireless Lab Support Contacts _____________________________________55 18 OEM/Integrators Installation Manual ______________________________________________55 19 Routing Constraints and Recommendations _________________________________57 RF Routing Recommendations ________________________________________ 57 USB Routing Recommendations _______________________________________ 59 Power and Ground Recommendations __________________________________ 60 Antenna Recommendations __________________________________________ 60 19.1 19.2 19.3 19.4 VERSION DATE AUTHOR UPDATES 1.0 2022.04.27 Wilson Lin Initial version, based on AR759x Certification Testing Support Guide V1.0 Page 3 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Legal Notice Important Notice Due to the nature of wireless communications, transmission and reception of data can never be guaranteed. Data may be delayed, corrupted (i.e., have errors) or be totally lost. Although significant delays or losses of data are rare when wireless devices such as the Rolling Wireless modem are used in a normal manner with a well-constructed network, the Rolling Wireless modem should not be used in situations where failure to transmit or receive data could result in damage of any kind to the user or any other party, including but not limited to personal injury, death, or loss of property. Rolling Wireless accepts no responsibility for damages of any kind resulting from delays or errors in data transmitted or received using the Rolling Wireless modem, or for failure of the Rolling Wireless modem to transmit or receive such data. Safety and Hazards Do not operate the Rolling Wireless modem in areas where cellular modems are not advised without proper device certifications. These areas include environments where cellular radio can interfere such as explosive atmospheres, medical equipment, or any other equipment which may be susceptible to any form of radio interference. The Rolling Wireless modem can transmit signals that could interfere with this equipment. Do not operate the Rolling Wireless modem in any aircraft, whether the aircraft is on the ground or in flight. In aircraft, the Rolling Wireless modem MUST BE POWERED OFF. When operating, the Rolling Wireless modem can transmit signals that could interfere with various onboard systems. NOTE: Some airlines may permit the use of cellular phones while the aircraft is on the ground and the door is open. Rolling Wireless modems may be used at this time. The driver or operator of any vehicle should not operate the Rolling Wireless modem while in control of a vehicle. Doing so will detract from the driver or operators control and operation of that vehicle. In some states and provinces, operating such communications devices while in control of a vehicle is an offence. Limitations of Liability This manual is provided as is. Rolling Wireless makes no warranties of any kind, either expressed or implied, including any implied warranties of merchantability, fitness for a particular purpose, or noninfringement. The recipient of the manual shall endorse all risks arising from its use. The information in this manual is subject to change without notice and does not represent a commitment on the part of Rolling Wireless. ROLLING WIRELESS AND ITS AFFILIATES SPECIFICALLY DISCLAIM LIABILITY FOR ANY AND ALL DIRECT, INDIRECT, SPECIAL, GENERAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES INCLUDING, BUT NOT LIMITED TO, LOSS OF PROFITS OR REVENUE OR ANTICIPATED PROFITS OR REVENUE ARISING OUT OF THE USE OR INABILITY TO USE ANY ROLLING WIRELESS PRODUCT, EVEN IF ROLLING WIRELESS AND/OR ITS Page 4 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 AFFILIATES HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR THEY ARE FORESEEABLE OR FOR CLAIMS BY ANY THIRD PARTY. Notwithstanding the foregoing, in no event shall Rolling Wireless and/or its affiliates aggregate liability arising under or in connection with the Rolling Wireless product, regardless of the number of events, occurrences, or claims giving rise to liability, be in excess of the price paid by the purchaser for the Rolling Wireless product. Patents This product may contain technology developed by or for Rolling Wireless S. r.l. and its affiliates. This product includes technology licensed from QUALCOMM. Copyright 2022 Rolling Wireless. All rights reserved. Trademarks Sierra Wireless, AirPrime, AirVantage, and the Legato and Open AT logos are registered trademarks of Sierra Wireless Inc. or one of its subsidiaries, used under license. Watcher is a registered trademark of NETGEAR Inc., used under license. Windows and Windows Vista are registered trademarks of Microsoft Corporation. Macintosh and Mac OS X are registered trademarks of Apple Inc., registered in the U.S. and other countries. QUALCOMM is a registered trademark of QUALCOMM Incorporated. Used under license. Other trademarks are the property of their respective owners. Contact Information Sales information and technical support, including warranty and returns Web: https://www.rollingwireless.com/en/support Corporate and product information Web: https://www.rollingwireless.com/

Page 5 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 1 Purpose This document was specifically written to support the RL9xxx product for certification testing. 2 Quick guide for HW setup 2.1 CCB Setup (for the testing without audio) WWAN/GNSS connectors:

Main: Primary Tx/PRx path for 2G/3G/4G DIV: Diversity Rx for 2G/3G/4G USB cable (Micro-USB) Page 6 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. 2.2 CCB with antenna installed RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Page 7 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 2.3 CCB with development kit (for voice and VOLTE relevant testing) RJ11 AUDIO JACK PORT, FOR NORMAL AUDIO CALL DEVELOPMENT KIT POWER PORT

(REAR SIDE OF DEV KIT, 4V INPUT) Left->Right: GNSS

/DIV/PRM Antenna USB Cable SIM Insert

(The Back) NOTE: For Testing, we suggest you use the ports listed below:

1 CCB POWER PORT (if use dev kit for audio test and VOLTE and field test, use DEVELOPMENT KIT POWER PORT instead) 2 USB PORT 3. CCB SIM SLOT 4. Main Antenna Port 5. DIV Antenna Port 6. GPS Antenna Port Page 8 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. 1) CCB with development kit and antenna installed (For Field testing):

RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 NOTE: The antenna must be oriented at 90 degrees, to get the optimal performance. Page 9 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. 2) Connect the handset into RJ11 port as below. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 3) 4V Power Adaptor Here is a photo of the 4V power adapter supplied with the Development Kit and CCB. 4) USB cable (Micro-USB) Use default Micro-USB as the USB cable, as below. Page 10 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 2.4 CCB with ELNA for AGPS testing (ELNA is used to improve the GPS performance) 1) Please connect the below ELNA out port to the CCB GPS antenna port. 2.5 TTY test set up

(Please use the green dev kit and CCB which has a 2.5mm audio jack) Please connect the below TTY adapter to the 2.5mm audio jack on the development kit. Page 11 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 2.6 Others: Power supply with power cable The power cable can be used to connect DC power support to the development kit. Page 12 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 3 Install Device Drivers 3.1 Install the USB Device Drivers

(Windows 10 1903 build and later) In general, Rolling Wireless will provide the recommended device driver for you to install. You will find it easy to follow the instructions (UI) to install the drivers before connecting the Rolling Wireless device. It will be recognized automatically as below. Step 1: Download the driver RWS provided, such as Build21423_Manufacturing. Please ensure the DUT is connected to the PC USB port. (Suggest using USB3.0 port or higher) To install drivers for RL9xxx, run the ManufacturingDrivers.exe. Step 2: You will see the following progress bar. Page 13 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Step 3: Click Finish to complete the installation. Page 14 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 3.2 How to check the driver version After the driver installation is complete, verify if the driver is operational by plugging the RL9xxx into your PC USB port. If you launch the device manager, you should see several USB ports (DM, NMEA) in the PC device manager network adapter. Right-click on the Rolling Wireless WWAN Modem port, select Properties, and then select the Driver Tab. The driver version will be shown as below. Rolling Wireless WWAN Modem (for AT commands transmission) Rolling Wireless DM Port (For WWAN QXDM/EFS Explorer tools using) Rolling Wireless NMEA Port (For GNSS) Rolling ADB Device (For software upgrades) Page 15 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 4 Installing the SIM Break the SIM out of the SIM Carrier. Install the SIM as the picture below. NOTE: The above picture is the SIM slot on CCB. If tested with dev. kit, the SIM slot on the dev. kit can also be used. Page 16 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 5 Accessing the modem AT Port Find the modem AT port by checking the properties of the Rolling Wireless WWAN Modem in the Device Manager. The properties show the WWAN Device is on COM4 (The modem enumeration port on your PC will vary). Launch your favourite terminal emulator program, select the correct port, and open the serial p ort. Page 17 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Type ATI at the command prompt, to get the basic module information. Page 18 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 6 Firmware Upgrade Instructions 1) Check the firmware version prior to the upgrade using the AT command ATI. 2) Close any applications connected to the DM COM port prior to upgrading firmware such as QPST/QXDM. 3) Run one-click upgrade by double-clicking executable. 4) Wait while the firmware downloads and the module resets. 5) Verify the firmware version after the upgrade using the AT command ATI. Page 19 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 7 QXDM Diagnostic Monitor 7.1 DM Logging Step 1: Launch QXDM. Step 2: Select Options -> Communications, select Target DM Port, and click Connect. Page 20 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Step 3: Load the Default Configuration for capturing the DM log. Page 21 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Step 4: When you complete the log capturing, you can Disconnect the DM port and then save the log into a local directory. Page 22 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 7.2 NVs modification You also can modify the NVs in NV Browser by clicking the when you have connected the DM port. Search for the NV value you want to update, and click READ. Page 23 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. In the corresponding NAME line, enter the new NV value, and click WRITE to finish. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Page 24 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 8 Reading the FSN and IMEI AT command: ATI is for reading the FSN and IMEI ATI Manufacturer: Rolling Wireless Model: RL9424 Revision: AFPQ9X40A_01.04.03.00 e72d5b jenkins 2022/04/06 04:17:59 IMEI: 001027009999999 IMEI SV: 1 FSN: 491484003408AD

+GCAP: +CGSM,+DS,+ES OK 9 Changing Radio Mode Preference AT!SELRAT is used to set/query mode preferences:

at!selrat=?

!SELRAT: Index, Name 00, Automatic 01, UMTS 3G Only 06, LTE Only 11, UMTS and LTE Only OK Page 25 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 10 Making a Data Connection over windows 10 with cellular function 10.1 Establish a connection to the DUT and PC Insert the SIM card and connect the power supply and USB port. 10.2 Connect the data call over PC 10.2.1 To enable UE register to the network, you could use below two AT command to trigger a new search of network:

AT+CFUN=0 (when the script prompts you to switch off the device/radio.) AT+CFUN=1 (when the script prompts you to switch on the device/radio.) 10.2.2 To check if DUT registration status, you could issue at!gstatus? to query. AT!GSTATUS?

ModemProc Mitigate Level: 0 Temperature: 28

!GSTATUS:

Current Time: 39 Modem Mitigate Level: 0 Reset Counter: 2 System mode: LTE IMS reg state: REGISTERED IMS Srv State: FULL SMS,FULL VoIP LTE band: B1 LTE Rx chan: 300 LTE CA state: INACTIVE EMM state: Registered Normal Service LTE bw: 20 MHz LTE Tx chan: 18300 Mode: ONLINE PS state: Attached IMS mode: Normal Page 26 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 RRC state: RRC Connected PCC RxM RSSI: -87 PCC RxD RSSI: -90 Tx Power: 18 RSRQ (dB): -5 SINR (dB): 12.2 OK RSRP (dBm): -112 RSRP (dBm): -116 TAC: 2540 (9536) Cell ID: 06F0C702 (116442882) 10.2.3 For data connection, you may issue below AT command to trigger data connection between DUT and PC (windows10). AT!SCACT =<action>,<profile_id>

NOTE: action can be 0 or 1, 0 means disconnected and 1 means connected. Example: for normal testing, such as PTCRB/GCF/most of the carriers, profile id is 1:

AT!SCACT=1,1 (setup with profiles 1) AT!SCACT=0,1 (disconnect profiles 1) The profile id of the carriers below is special:

For Verizon testing:

AT!SCACT=1,3 (setup with profiles 3) AT!SCACT=0,3 (disconnect profiles 3) For KT testing:

AT!SCACT=1,2 (setup with profiles 2) AT!SCACT=0,2 (disconnect profiles 2) For DCM(NTT) testing:

AT!SCACT=1,2 (setup with profiles 2) AT!SCACT=0,2 (disconnect profiles 2) NOTE: To configure the APN on UE side, AT+CGDCONT (see the TS27.007 for the usage) 10.2.4 To make sure if the data call setup correctly between DUT and PC, issue ipconfig on cmd terminal(windows10). Type ipconfig, then click Enter. Page 27 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 10.2.5 Disconnect the data call over PC AT!SCACT =<0>,<profile_id>

Page 28 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 11 Ping between Simulation Network and UE 11.1 Ping destination IP address -S Source IP address For example:

a) Disable the other connection on UE PC, such as WIFI/Ethernet (refer session 14.2, dont use airplane mode) b) Disable all the firewall both on UE PC and Server PC (refer session 14.3) c) Power on UE and have UE register to network d) Make the Cellular connection and get connected e) Figure out the UE IP address on UE PC by Ipconfig commend, such as 192.168.157.11 f) Figure out the server PC IP address by Ipconfig commend, such as 192.168.157.18 g) If require the ping from UE PC to Server PC, then Type: Ping 192.168.157.18 -S 192.168.157.11 NOTE: All the Firewall need to be turn off on the destination side, and suggest disabling other network adapter before the testing, such as LAN & WIFI. Page 29 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 11.2 Disable the other networks Control Panel\Network and Internet\Network and Sharing Center->click Change adapter settings, Disable the other connection on UE PC, such as WIFI/Ethernet (dont use airplane mode) 11.3 Turn off Windows Defender Firewall All the Firewall need to be turn off on the destination side. Page 30 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Page 31 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 12 Setting for VOLTE testing To check APN setting:

AT+ CGDCONT?

+CGDCONT: 1,"IPV4V6","nxtgenphone","0.0.0.0",0,0

+CGDCONT: 2,"IPV4V6","ims","0.0.0.0",0,0

+CGDCONT: 3,"IPV4V6","sos","0.0.0.0",0,0 OK To check P-CSCF Flag setting:

AT$QCPDPIMSCFGE?

AT$QCPDPIMSCFGE?

$QCPDPIMSCFGE: 1 , 0 , 0 , 0

$QCPDPIMSCFGE: 2 , 1 , 0 , 0

$QCPDPIMSCFGE: 3 , 1 , 0 , 0 To disable IMS AT!UNLOCK=A710 AT!IMSTESTMODE=1 AT!RESET To Enable IMS AT!UNLOCK=A710 AT!IMSTESTMODE=0 AT!RESET To Setup Normal or E911 Call:

ATDXXXXXXXXXX; or ATD911; /* XXXXXXXXXX is normal call number*/

To check if IMS VOLTE service is available:

AT!GSTATUS?

!GSTATUS:

Current Time: 401893 Bootup Time: 0 System mode: LTE Temperature: 26 Mode: ONLINE PS state: Attached Page 32 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 LTE band: B7 LTE Rx chan: 3280 EMM state: Reregistered Attached EMM connection:RRC Idle LTE bw: 15 MHz LTE Tx chan: 65535 RSSI (dBm): -70 RSRP (dBm): -70 RSRQ (dB): 0 SINR (dB): -20.0 Tx Power: 0 TAC: 0002 (0) Cell ID: 00000001 (0) IMS Reg State: REGISTERED IMS Mode: Normal IMS Srv State: FULL SMS, FULL VoIP OK Page 33 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 13 Setting for Audio related test Device supports analog voice calls with the Dev-kit. Please follow below 3 steps:

1) Configure the jumpers correctly on Dev-kit.(The jumpers should be well configurated by default) 2) Connect the handset into RJ11 port as below. (Refer to 2.3 CCB with development Kit ) 3) Type the AT command as below. I. II. III. AT!AVSETPROFILE=5,0,0,0,6,0 AT!AVMFTCODECMODE=5 Note: Please set above two AT command again Once UE reset. (if audio needed) AT commands for audio call:

###To enquiry the current audio configuration:

AT!AVCFG?

!AVCFG: 0,0,1

!AVCFG: 1,0,1

!AVCFG: 2,0,1

!AVCFG: 3,0,1

!AVCFG: 4,0,1

!AVCFG: 5,0,1

!AVCFG: 6,0,1

!AVCFG: 7,0,1

!AVCFG: 8,0,1

!AVCFG: 9,0,1 OK

### To set the Audio profile to 5 AT!AVSETPROFILE=5,0,0,0,6,0 OK

###To set the Audio codec mode to 5

****Must run after each reset or power cycle or there will be no sound****

AT!AVMFTCODECMODE=5 OK Page 34 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 14 Setting for GPS and AGPS testing:

14.1 For UP test cases:

14.1.1 UE parameter setting:

(1). at!unlock="A710"

(2). At!gpssuplurl=www.spirent-lcs.com:7275 -- replace the server URL if necessary.

(3). At!gpsmomethod = 1

(4). At!gpsmtlrsettings = 0

(5). at!gpsposmode=ff7f

(6). at!gpstranssec=1

(7). at!gpssuplver=2

(8). At!reset If the test case has an NI message, the NI message will display in the AT port. If the test case requires a manual response to the NI message, you can use At!gpssendniresp = 0

(accept) 1 (deny) to respond, if not, wait 25 seconds, and our device will auto-reply. The auto-reply timer setting by At!gpssuplnitimeout = 15(waiting time). 14.1.2 Cert file setting The cert file in the server and UE should correspond.

(1). Update UE cert file:

1. Delete all the files in /SUPL and /CERT folder. 2. Copy the SuplRootCert to those two folders. 3. Use At!reset to reset the device

(2). Update the Server cert file if necessary:

1. TLS Server Certificate(*.cer) use *.cer 2. TLS privateKey(*.pen, *.pvk) use *.pem 3. TLS root Certificat(*cer) use *.cer Page 35 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 14.2 CP test case setting 14.2.1 UE parameter setting:

(1). at!unlock="A710"

(2). At!gpssuplurl=www.spirent-lcs.com:7275 -- replace the server URL if necessary.

(3). At!gpsmomethod = 0

(4). At!gpsmtlrsettings = 0

(5). at!gpsposmode=ff7f

(6). at!gpstranssec=1

(7). At!reset If the test case has an NI message, the NI message will display in the AT port. If the test case requires a manual response to the NI message, you can use At!gpssendniresp = 0

(accept) 1 (deny) to respond, if not, wait 25 seconds, and our device will auto-reply. The auto-reply timer setting by At!gpssuplnitimeout = 15(waiting time). 14.2.2 SBAS AT Command 1. Unlock module AT!UNLOCK="A710"

2. Enable GPS AT!CUSTOM="GPSENABLE", 1 3. Reset the module for configuation activation AT!RESET 4. Delete GPS Assistance Date AT!GPSCOLDSTART 5. Enable all GNSS satellite capabilities AT!GNSSCONFIG=1,1,1,1,1 6. Start GNSS fix Page 36 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 AT!GPSTRACK=1,255,255,1000,1 7. Check whether SBAS satellite found with AT!GPSSATINFO?

SV ID 33-54 belongs to SBAS systems. eg: SV:41 is SBAS satellite. AT!GPSSATINFO?

Satellites in view: 4 (1980 01 06 6 00:09:08)

* SV: 5 ELEV: 49 AZI: 270 CN0: 36

* SV: 19 ELEV: 35 AZI: 136 CN0: 27

* SV: 20 ELEV: 60 AZI: 329 CN0: 34

* SV: 41 ELEV: 0 AZI: 0 CN0: 35 OK Page 37 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 15 Basic AT commands used for testing 15.1 Set Voice Auto Answer Mode ITEMS OPERATIONS COMMENTS AT commands AT! NV=74, 1 ATS0=<value> /* Answers after the specified number of rings.*/

Note: You have to reset the device to make it work. 15.2 Programming Emergency Call Test Number ITEMS OPERATIONS COMMENTS AT commands AT! NVENUM=1,XXXXX /* XXXXX means Emergency Number */

Note: You have to reset the device to make the Emergency number work. 15.3 Resetting the Device during Scripted Testing ITEMS OPERATIONS COMMENTS Use AT+CFUN=0 when the script prompts you to switch off the device/radio. AT commands Use AT+CFUN=1 when the script prompts you to switch on the device/radio. AT!RESET is used for resetting the device. It will take longer to find service and initiate attach procedure. Note: Close all Qualcomm tools

(QXDM etc.) before performing AT!RESET. Keeping these tools running will sometime cause USB enumeration issues after AT!RESET is performed. If encounters a USB enumeration issue, rebooting OS will be required. All test cases that involve a refresh of the UICC or authentication information will need a full power-off reset. This is done by removing power from the Dev-Kit and waiting for 1 minute for the device to fully power off before applying power again. Page 38 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 15.4 Diversity Receiver Testing (for W and L) ITEMS OPERATIONS COMMENTS AT commands AT commands AT commands AT!ENTERCND="A710"

AT!RXDEN=0 AT!RESET AT!ENTERCND="A710"

AT!RXDEN=1 AT!RESET AT!ENTERCND="A710"

AT!RXDEN=2 AT!RESET 15.5 Data Service Enable Primary Receiver Only Enable Both Receivers Enable Secondary Receiver Only ITEMS OPERATIONS COMMENTS AT!SCACT =<action>,<profile_id>

AT!SCACT?

AT!SCACT =?

AT commands Example:

AT!SCACT=1,3 15.6 Voice Call Service For SCACT Currently, this command supports both UMTS and CDMA profile id. For detail please check AT!SCACT=?

Please check the response of AT!CGDCONT? for profile contents info. Note: AT! SCACT=1 is preferable. ITEMS OPERATIONS COMMENTS ATD12345678;

AT commands ATA ATH Init MO voice call Answer MT voice call Hung up MT voice call Page 39 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 ITEMS OPERATIONS COMMENTS

<profile>: 0-5, 6 audio profiles in total By default, profile 0 is for TTY purpose AT!ENTERCND=A710 AT!AVTTY = <profile>, <mode>

<mode>: 0-2 0: Full mode 1: Voice Carry Over (VCO) mode 2: Hearing Cary Over (HCO) mode Page 40 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 15.7 SMS Service ITEMS OPERATIONS COMMENTS 3GPP Mode SMS Command:

1. Send SMS Text SMS:

AT+CMGF=1 OK AT+CMGS="+31628870634"

> This is the text message.<Ctrl>+<Z>

+CMGS: 45 OK PDU SMS:

AT+CMGF=0 OK AT commands AT+CMGS=42

07915892000000F001000B915892214365F70000 21493A283D0795C3F33C88FE06CDCB6E32885EC 6D341EDF27C1E3E97E72E

<Ctrl>+<Z>

+CMGS: 12 For detailed usage of these AT commands please use =? to check. Note:

For IMS SMS, the device should register to IMS first, if the module is set to send 3GPP format SMS, AT+CMGS should be used, otherwise AT$QCMGS should be used. 2. Read SMS AT+CMGR=<index>

3. List SMS AT+CMGL=<stat>

4. Delete SMS AT+CMGD=<index>

Page 41 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 ITEMS OPERATIONS COMMENTS AT commands at^hsmsss=1,0,1,0 QMI Interface Skylight:

Menu SMS Express

/* First 1 indicates status:

0:FALSE, 1:TRUE */

/* Second 1 in red color indicates encoding type: 0:GSM 7 bit, 1: ASCII 7-bit */

Skylight will need to be used if need to send concatenated SMS. 15.8 DTMF Service ITEMS OPERATIONS COMMENTS AT commands AT+VTS=<0~9,*,#>

Example:

##### Test in GSM/WCDMA mode

AT+VTD?

+VTD: 20 OK AT+VTD=3000 OK ATD10086;

OK AT+VTS=1 OK ATH OK

+VTS to issue continuous DTMF

+VTD to configure continuous DTMF duration under GW mode.

//current duration under GW mode

//change the duration to 3000 milliseconds under GW mode if you want

//input one digital continuous DTMF 15.9 Supplementary Services The commands below are standard 3GPP AT commands. You can refer to TS 27.007 for detailed usage. ITEMS OPERATIONS COMMENTS AT commands AT+CHLD = <n>

Control call hold functions AT commands AT+CCFC = <reason>, <mode>

Control call forwarding functions. Page 42 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 ITEMS OPERATIONS COMMENTS AT commands AT+CCWA = <n>

Check current module voltage. AT commands AT+CLIP = <n>

AT+COLP = <n>

15.10 Diag Commands Control calling line identity (CLI) of the calling party when receiving a mobile terminated call Control a calling subscriber to get the connected line identity (COL) of the called party after setting up a mobile originated call ITEMS OPERATIONS COMMENTS AT commands AT!GSTATUS?

AT commands AT commands AT!ENTERCND="A710"

AT!PCTEMP?

AT!ENTERCND="A710"

AT!PCVOLT?

Shows a snapshot of what rat/band/channel the device is on. Check current module temperature. Check current module voltage. AT commands AT+CGDCONT?

Check the profile contents. 15.11 Enable/Disable IMS ITEMS OPERATIONS COMMENTS AT commands AT commands AT!UNLOCK=A710 AT!IMSTESTMODE=1 AT!RESET AT!UNLOCK=A710 AT!IMSTESTMODE=0 AT!RESET Disable IMS. Enable IMS. Page 43 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 15.12 Change IMS APN name per test purpose To change the name of IMS APN, below AT command & NV change are required:

at!unlock="A710"

at+cgdcont?

(figure out the current IMS APN profile in used) at+cgdcont=2,"IPV4V6","ims"

(Take profile 2 as example and change IMS name as "ims") Configure NV71527 -> (0).cAPNNAME with value ims as below screenshot.

(How to configure NV? Please refer to chapter 7.2) Reset device. 15.13 TTY command ITEMS OPERATIONS COMMENTS AT commands AT!AVCFG=5,2,1 (TTY device) AT!AVSETPROFILE=5 AT!AVMFTCODECMODE=5 Enable TTY, and deregister IMS. Page 44 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 ITEMS OPERATIONS COMMENTS AT commands AT! AVCFG?

AT!AVSETPORFILE=1 (chose a none TTY device profile index, prefer to set it back to 1 as it is the default audio setting) AT commands AT! AVSETPROFILE? (query the current audio profile index) AT! AVCFG? (Query the audio profile configure if the second parameter of the current profile is 2, that means it is a TTY profile) Disable TTY, and register IMS. Query the TTY state

#### Reference ###

AT!AVSETPROFILE?

!AVSETPROFILE: 5,0,0,0,3,0 OK

## 5 as current profile in use;

AT!AVCFG?

!AVCFG: 0,0,2

!AVCFG: 1,0,2

!AVCFG: 2,0,0,1,0,0,0,4

!AVCFG: 3,0,1

!AVCFG: 4,0,3

!AVCFG: 5,2,2 OK

## 2 mean current profile enable TTY;

NOTE: Do not forget to disable TTY after TTY testing is completed. Or else the module will fail to do IMS registration. 15.14 Caller ID display AT command ITEMS OPERATIONS COMMENTS AT commands AT!IPCALLNAME?

To display caller ID per AT&T requirement. Page 45 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 16 Others 16.1 Get TTY state over QXDM TTY state could be checked in the OTA message as below if the CTM in the CM setup message is set to 1, which means the TTY is enabled. 16.2 QMI Test Guide for UT interface Cases For all Ut Interface Test Plan, keep NV70239 to 2 and use the QMI command voice_set_sups_service_req_msg with QMI test pro, but the QMI setting is different for all cases. 1. LTE-BTR-5-4200(TC5.1):

Set voice_service to VOICE_SERVICE_ACTIVATE (for *43#) or VOICE_SERVICE_DEACTIVATE(for

#43#) Set reason to VOICE_REASON_CALLWAITING Page 46 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 2. LTE-BTR-5-4212(TC5.2):

Dial *21*<MSISDN># from UE where <MSISDN> is in +11d format:

Set voice_service to VOICE_SERVICE_ACTIVATE Set reason to VOICE_REASON_FWD_UNCONDITIONAL Set number to <MSISDN> in test case. Dial #21# from UE and allow transactions to complete:

Page 47 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Set voice_service to VOICE_SERVICE_DEACTIVATE Set reason to VOICE_REASON_FWD_UNCONDITIONAL Do not set number Dial ##21# from UE and allow transactions to complete:

Set voice_service to VOICE_SERVICE_ERASE Set reason to VOICE_REASON_FWD_UNCONDITIONAL Do not set number Page 48 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 3. LTE-BTR-5-4210(TC5.3):

Dial *67*<MSISDN># from UE where <MSISDN> is in 10d format Set voice_service to VOICE_SERVICE_ACTIVATE Set reason to VOICE_REASON_FWD_MOBILEBUSY Set number to <MSISDN> in test case. Dial #67# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_DEACTIVATE Set reason to VOICE_REASON_FWD_MOBILEBUSY Do not set number Dial ##67# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_ERASE Set reason to VOICE_REASON_FWD_MOBILEBUSY Do not set number 4. LTE-BTR-5-4202(TC5.4) Dial *61*<MSISDN># from UE where <MSISDN> is in +11d format Set voice_service to VOICE_SERVICE_ACTIVATE Set reason to VOICE_REASON_FWD_NOREPLY Set number to <MSISDN> in test case. Dial #61# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_DEACTIVATE Set reason to VOICE_REASON_FWD_NOREPLY Do not set number Page 49 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Dial ##61# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_ERASE Set reason to VOICE_REASON_FWD_NOREPLY Do not set number 5. LTE-BTR-5-4208(TC5.5) Dial *61*<MSISDN>**25# from UE where <MSISDN> is in 10d format Set voice_service to VOICE_SERVICE_ACTIVATE Set reason to VOICE_REASON_FWD_NOREPLY Set number to <MSISDN> in test case. Set time_value to 25 Dial #61# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_DEACTIVATE Set reason to VOICE_REASON_FWD_NOREPLY Do not set number and time_value Dial ##61# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_ERASE Set reason to VOICE_REASON_FWD_NOREPLY Do not set number and time_value 6. LTE-BTR-5-4204(TC5.6) Dial *62*<MSISDN># from UE where <MSISDN> is in +11d format Set voice_service to VOICE_SERVICE_ACTIVATE Set reason to VOICE_REASON_FWD_UNREACHABLE Set number to <MSISDN> in test case. Dial #62# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_DEACTIVATE Set reason to VOICE_REASON_FWD_UNREACHABLE Do not set number Dial ##62# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_ERASE Set reason to VOICE_REASON_FWD_UNREACHABLE Do not set number 7. LTE-BTR-5-4214(TC5.7) Dial *004*<MSISDN># from UE where <MSISDN> is in 10d format Set voice_service to VOICE_SERVICE_ACTIVATE Set reason to VOICE_REASON_FWD_ALLCONDITIONAL Set number to <MSISDN> in test case. Dial #004# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_DEACTIVATE Set reason to VOICE_REASON_FWD_ALLCONDITIONAL Do not set number Dial ##004# from UE and allow transactions to complete Page 50 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Set voice_service to VOICE_SERVICE_ERASE Set reason to VOICE_REASON_FWD_ALLCONDITIONAL Do not set number 8. LTE-BTR-5-4206(TC5.8) Dial *004*<MSISDN>**25# from UE where <MSISDN> is in +11d format Set voice_service to VOICE_SERVICE_ACTIVATE Set reason to VOICE_REASON_FWD_ALLCONDITIONAL Set number to <MSISDN> in test case. Set time_value to 25 Dial #004# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_DEACTIVATE Set reason to VOICE_REASON_FWD_ALLCONDITIONAL Do not set number and time_value Dial ##004# from UE and allow transactions to complete Set voice_service to VOICE_SERVICE_ERASE Set reason to VOICE_REASON_FWD_ALLCONDITIONAL Do not set number and time_value 16.3 AT Test Guide for eCall Cases(only for europe) 1. How to check eCall enable/disable AT!UNLOCK=A710 AT!NV?ECALL_ENABLED Return 00//disable 01//enable 2. How to start/stop eCall AT! MECALL=<ecall_session>[,<type_of_ecall>]

< ecall_session >

<type_of_call>

0-1 0-3 0: stop eCall session 1: start eCall session 0: test call 1: reconfiguration call eCall 2: manually initiated eCall 3: automatically initiated eCall 3. How to config eCall AT!MECALLCFG=<voc_mode>,<host_build_msd>,<dial_type>,[<num>],<modem_msd_ty pe>[,<max_redial_attempt>[,<gnss_update_time>[,<nad_deregistration_time>[,<ecall_usi m_slot_id>]]]]

<voc_mode>

<host_build_msd>

0-1 0-1 0: Deregister the (speaker) Rx input of the vocoder 1: Do not deregister Rx input of the vocoder 0: This instructs the modem to build the MSD blob without involving the Host. Page 51 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022.

<dial_type>

0-1

<num>

string RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 1: The Host is entirely responsible to provide the MSD blob. 0: NORMAL, i.e., Read the number to dial from the FDN/SDN, depending upon the eCall operating mode 1: OVERRIDE, i.e., Override the operating mode; the eCall modem dials the number specified in the <num> field Indicates the number to dial; specified only when

<dial_type> is set to OVERRIDE; this number must be the number of the PSAP

<modem_msd_type>

0-1 0: Send real MSD; look for the GPS fix

<max_redial_attempt>

0-10

<gnss_update_time>

1-255

<nad_deregistration_time> 1-12 ecall_usim_slot_id 1-2 1: Send canned MSD The number of attempts for IVS to redial the call if the initial eCall attempt fails to connect, or the call is dropped for any reason other than by the PSAP operator clearing the call down or T2 (IVS Call Clear-

down Fallback Timer) ends. Default value: 0 The number of seconds to allow to capture satellite information, also it is the timer to start GPS location fix. Default value: 5 The number of hours that the IVS NAD shall remain registered on the serving network and available to receive calls from the PSAP and rescue workers after the call clear-down by the PSAP. Default values: 8 Indicates on which SIM slot the ECALL is triggered. 1: Directs the request to the USIM inserted in Slot 1. 2: Directs the request to the USIM inserted in Slot 2 Default value: 1 4. How to set PULL/PUSH tx mode AT!MECALLTXMODE=<tx_mode>

<tx_mode>

0-1 0: PULL mode 1: PUSH mode 5. How to send MSD when host_build_msd is 1 AT!MECALLMSD=<msd_data>

Page 52 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0

<msd_data>

string Data as defined in the format as suggested in EN 15722. Must be enclosed in . 6. How to update MSD block AT!MECALLMSDBLK=<blockNumber>,<data>

<blockNumber>

<data>

1-12 string valid block number values are 1-12 Data as defined in the format as suggested in EN 15722. Must be enclosed in . 7. How to enable eCall/disable uslmsk and check eCall event

//enable eCall uslmsk AT+WUSLMSK=FFFFFFFF,0 AT+WUSLMSK=FFFFFFFF,1 AT!MECALLUSLMSK=FFFFFFFFF

//disable eCall uslmsk AT!MECALLUSLMSK=0

//check eCall event

!MECALL:<ind>[,<timer_id>]

<ind>

0-28 0: eCall session started 1: Get GPS Fix 2: GPS Fix Received 3: GPS Fix Timeout 4: MO call connected 5: MO call Disconnected 6: MT call connected 7: MT call Disconnected 8: Waiting for PSAP START indication 9: PSAP START received but no MSD available 10: PSAP START received and MSD available 11: PSAP START received and MSD sent 12: LL ack received 13: 2LL acks received 14: LL nack received 15: HL ack received 16: IVS Transmission completed 17: 2AL acks received 18: eCall session completed 19: eCall clear-down received 20: eCall session reset 21: eCall session failure 22: MSD update request available 23: eCall session stop 24: eCall operating mode is eCall and normal call mode 25: eCall operating mode is eCall only mode Page 53 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022.

<timer_id>

RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 26: eCall transmission mode is PUSH mode 27: call transmission mode is PULL mode 28: eCall timer timeout reached 2: T2 timer 5: T5 timer 6: T6 timer 7: T7 timer 9: T9 timer 10: T10 timer 16.4 AT Test Guide for Factory reset Cases (only for Verizon) For some Verizon Motive test cases, need to execute Factory reset. How to execute Factory reset, 1. at!unlock="A710"

2. at!mcfgselmode=0 //set it by manually mode 3. at!mcfgsel=0 //deactivate the Current MBN 4. at!mcfgsel=0 //deactivate the Current MBN 16.5 AT Command for MSB & MSA 16.5.1 GPS constant location AGPS MSB: at!gpstrack=2,255,1000,1000,1 AGPS MSA: at!gpstrack=3,255,1000,1000,1 NOTE: As long as the power stays on, you only need to give a command once. 16.5.2 GPS stop location AT!GPSEND=0 NOTE: If the power is not powered off, you need to send the GPS stop command before sending the GPS location command for the second time. Page 54 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 s 17 Rolling Wireless Lab Support Contacts NAME TITLE PHONE NUMBER Eva Zheng <eva.zheng@rollingwireless.com> Certification Engineer

+86 755 8611 9884 Wilson Lin <Wilson.Lin@rollingwireless.com> Certification Manager

+86 755 8611 9834 18 OEM/Integrators Installation Manual Important Notice to OEM integrators 1. This module is limited to OEM installation ONLY. 2. This module is limited to installation in mobile or fixed applications, according to Part 2.1091(b). 3. The separate approval is required for all other operating configurations, including portable configurations with respect to Part 2.1093 and different antenna configurations 4. For FCC Part 15.31 (h) and (k): The host manufacturer is responsible for additional testing to verify compliance as a composite system. When testing the host device for compliance with Part 15 Subpart B, the host manufacturer is required to show compliance with Part 15 Subpart B while the transmitter module(s) are installed and operating. The modules should be transmitting and the evaluation should confirm that the module's intentional emissions are compliant (i.e. fundamental and out of band emissions). The host manufacturer must verify that there are no additional unintentional emissions other than what is permitted in Part 15 Subpart B or emissions are complaint with the transmitter(s) rule(s). The Grantee will provide guidance to the host manufacturer for Part 15 B requirements if needed. Important Note notice that any deviation(s) from the defined parameters of the antenna trace, as described by the instructions, require that the host product manufacturer must notify to XXXX that they wish to change the antenna trace design. In this case, a Class II permissive change application is required to be filed by the USI, or the host manufacturer can take responsibility through the change in FCC ID (new application) procedure followed by a Class II permissive change application. End Product Labeling When the module is installed in the host device, the FCC label must be visible through a window on the final device or it must be visible when an access panel, door or cover is easily re-moved. If not, a second label must be placed on the outside of the final device that contains the following text:

Contains FCC ID: 2AX2URL9424 The FCC ID can be used only when all FCC compliance requirements are met. Antenna Installation Page 55 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0

(1) The antenna must be installed such that 20 cm is maintained between the antenna and users,

(2) The transmitter module may not be co-located with any other transmitter or antenna.

(3) Only antennas of the same type and with equal or less gains as shown below may be used with this module. Other types of antennas and/or higher gain antennas may require additional authorization for operation. Antenna type Dipole Antenna LTE Band7 Peak Gain (dBi) 2dbi In the event that these conditions cannot be met (for example certain laptop configurations or co-

location with another transmitter), then the FCC authorization is no longer considered valid and the FCC ID cannot be used on the final product. In these circumstances, the OEM integrator will be responsible for re-evaluating the end product (including the transmitter) and obtaining a separate FCC authorization. Manual Information to the End User The OEM integrator has to be aware not to provide information to the end user regarding how to install or remove this RF module in the users manual of the end product which integrates this module. The end user manual shall include all required regulatory information/warning as show in this manual. Federal Communication Commission Interference Statement This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures:

- Reorient or relocate the receiving antenna.

- Increase the separation between the equipment and receiver.

- Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.

- Consult the dealer or an experienced radio/TV technician for help. Any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate this equipment. This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter. List of applicable FCC rules This module has been tested and found to comply with part 27 requirements for Modular Approval. Page 56 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 The modular transmitter is only FCC authorized for the specific rule parts (i.e., FCC transmitter rules) listed on the grant, and that the host product manufacturer is responsible for compliance to any other FCC rules that apply to the host not covered by the modular transmitter grant of certification. If the grantee markets their product as being Part 15 Subpart B compliant (when it also contains unintentional-radiator digital circuity), then the grantee shall provide a notice stating that the final host product still requires Part 15 Subpart B compliance testing with the modular transmitter installed. This device is intended only for OEM integrators under the following conditions: (For module device use) 1) The antenna must be installed such that 20 cm is maintained between the antenna and users, and 2) The transmitter module may not be co-located with any other transmitter or antenna. As long as 2 conditions above are met, further transmitter test will not be required. However, the OEM integrator is still responsible for testing their end-product for any additional compliance requirements required with this module installed. Radiation Exposure Statement This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with minimum distance 20 cm between the radiator

& your body. 19 Routing Constraints and Recommendations Layout and routing of the AirPrime RL942x Series in the application is critical to maintaining the performance of the radio. The following sections provide guidance to the developer when designing their application to include an AirPrime RL942x Series and achieve optimal system performance. 19.1 RF Routing Recommendations To route the RF antenna signals, the following recommendations must be observed for PCB layout:

The RF signals must be routed using traces with a 50 characteristic impedance. Basically, the characteristic impedance depends on the dielectric constant (r) of the material used, trace width (W), trace thickness (T), and height (H) between the trace and the reference ground plane. In order to respect this constraint, Sierra Wireless recommends that a MicroStrip structure be used and trace width be computed with a simulation tool (such as AppCAD, shown in the figure below and available free of charge at http://www.avagotech.com). Page 57 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 Figure 1. AppCAD Screenshot for Microstrip Design Power Mode Diagram The trace width should be wide enough to maintain reasonable insertion loss and manufacturing reliability. Cutting out inner layers of ground under the trace will increase the effective substrate height; therefore, increasing the width of the RF trace. Caution:

It is critical that no other signals (digital, analog, or supply) cross under the RF path. The figure below shows a generic example of good and poor routing techniques. Figure 2. RF Routing Examples Fill the area around the RF traces with ground and ground vias to connect inner ground layers for isolation. Cut out ground fill under RF signal pads to reduce stray capacitance losses. Avoid routing RF traces with sharp corners. A smooth radius is recommended. E.g. Use of 45 angles instead of 90. The ground reference plane should be a solid continuous plane under the trace. Page 58 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 The coplanar clearance (G, below) from the trace to the ground should be at least the trace width

(W) and at least twice the height (H). This reduces the parasitic capacitance, which potentially alters the trace impedance and increases the losses. E.g. If W = 100 microns then G = 200 microns in an ideal setup. G = 150 microns would also be acceptable is space is limited. Figure 3. Coplanar Clearance Example NOTE:

The figure above shows several internal ground layers cut out, which may not be necessary for every application. Figure 4. Antenna Microstrip Routing Example 19.2 USB Routing Recommendations HighSpeed USB signals (USB_D_P / USB_D_M) are a differential pair and must be routed with the following considerations/constraints:

90 Ohm differential +/- 10% trace impedance, Differential trace length pair matching < 2mm (15 ps), Solid reference planes, And 2x the trace width separation to all adjacent signals. Trace lengths < 120 mm, SuperSpeed USB adds two differential pairs (SSRX+ / SSRX- and SSTX+ / SSTX-). These pairs should be routed with the following considerations/constraints:

Page 59 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022. RL9xxx-Certification Testing Support Guide FH0003253 - Rev1.0 90 Ohm differential +/- 15% trace impedance, Differential trace length pair matching < 0.7mm (5 ps), And GND isolation from other adjacent traces with minimum of 2x the SSRX/SSTX trace wdith. Trace lengths < 112 mm, 19.3 Power and Ground Recommendations Power and ground routing is critical to achieving optimal performance of the AirPrime RL942x Series when integrated into an application. Recommendations:

Do not use a separate GND for the Antennas. Connections to GND from the AirPrime RL942x Series should be flooded plane using thermal reliefs to ensure reliable solder joints. VBATT is recommended to be routed as a wide trace(s) directly from the power supply to the LGA pad. 19.4 Antenna Recommendations Connecting the antenna ground reference to the vehicle chassis is not recommended since that has been known to cause noise from the engine to couple into the audio of the device. It is ultimately up to the integrator to evaluate this performance. Page 60 of 60 Rolling Wireless confidential. Only soft copies are controlled. Printed copies of this document are for information purposes only and are uncontrolled. Printed copies are REFERENCE DOCUMENTS after the date of printing. This document was printed on July 22, 2022.

ROLLING WIRELESS RL9424 FOC 1D:2AX2URL9424 AUTEN AML TTT IMEI:35065251001 1469 INU INO 00 Made in China

Rolling Wireless S.a r.l. Date: July 19, 2022 Federal Communications Commission Office of Engineering and Technology Laboratory Division 7435 Oakland Mills Rd Columbia MD 21046-1609 Subject: Request for Confidentiality FCC ID:2AX2URL9424 To Whom It May Concern, Pursuant to the provisions of Sections 0.457 and 0.459 of Commissions rules (47CFR0.457, 0.459), we are requesting the Commission to withhold the following attachment(s) as confidential document from public disclosure indefinitely. Operational Description Tune-up Procedure Schematic Diagram Block Diagram Part List Above mentioned document contains detailed system and equipment description are considered as proprietary information in operation of the equipment. The public disclosure of above documents might be harmful to our company and would give competitor an unfair advantage in the market. In additional to above mentioned documents, pursuant to Public Notice DA 04-1705 of the Commission s policy, in order to comply with the marketing regulations in 47 CFT 2.803 and the importation rules in 47 CFR 2.1204, while ensuring that business sensitive information remains confidential until the actual marketing of newly authorized devices. We are requesting the commission to grant short-term confidentiality request on the following attachment(s) for 180 days after the grant as outlined in Public Notice DA 04-1705. External Photos Internal Photos Test Setup Photos User Manual It is our understanding that all measurement test reports, FCC ID label format and correspondent during certification review process cannot be granted as confidential documents and those information will be available for public review once the grant of equipment authorization is issued. Best Regards, ______________________ Contact Person: Wilson Lin E-mail: Wilson.lin@rollingwireless.com

Rolling Wireless S.a r.l. Power of Attorney Date: July 19, 2022 To whom it may concern, Please be notified that I, Wilson Lin, have designated Jim Tsai in Sporton International Inc. as the person being responsible for this project and to sign the form 731 and other documentation. Any and all acts carried out by Jim Tsai in Sporton International Inc., on the matters of relating to all processes required in the FCC approval and any communication needed with the national authority, shall have the same legal authority as acts on our own behalf. We further certifies that neither the applicant nor any party to this application, as defined in 47 CFR Ch. 1.2002 (b), is subject to a denial to Federal benefits, that include FCC benefits, pursuant to section 5301 of the Anti-Drug Abuse Act of 1998, 21 U.S.C. 835(a). This authorization is limited to the product of as following:

FCC ID:2AX2URL9424 If you have any acknowledgement and response, please send it to Sporton International Inc. Should you have any questions or comments regarding this matter, please have my best attention. directly. Sincerely yours, Contact Person: Wilson Lin E-mail: wilson.lin@rollingwireless.com

Applicant/Grantee Rolling Wireless S.a r.l./2AX2U FCC ID:

2AX2URL9424 Request for Modular Approval Request for Limited Modular Approval Requirements EUT Conditions Comply (Y/N) Single Modular Approval Requirements Section 15.212 Modular Transmitters The radio portion of this module is shielded, please see exhibition external photos. Y The module has buffer modulation/data inputs. Y The module has its own power supply regulation. Please see the schem.pdf The requirements of antenna connector and spurious emission have been fulfilled. Please refer to the Test Report exhibition. Y Y Please refer to the Setup Photo exhibition for the stand-alone test configuration. Y 1 2 3 4 5 The radio elements of the modular transmitter must have their own shielding. The physical crystal and tuning capacitors may be located external to the shielded radio elements. The modular transmitter must have buffered modulation/data inputs (if such inputs are provided) to ensure that the module will comply with Part 15 requirements under conditions of excessive data rates or over-modulation. The modular transmitter must have its own power supply regulation. The modular transmitter must comply with the antenna and transmission system requirements of Sections 15.203, 15.204(b) and 15.204(c). The antenna must either be permanently attached or employ a unique antenna coupler (at all connections between the module and the antenna, including the cable). The professional installation provision of Section 15.203 is not applicable to modules but can apply to limited modular approvals under paragraph (b) of this section. The modular transmitter must be tested in a stand-alone configuration, i.e., the module must not be inside another device during testing for compliance with Part 15 requirements. Unless the transmitter module will be battery powered, it must comply with the AC line conducted requirements found in Section 15.207. AC or DC power lines and data input/output lines connected to the module must not contain ferrites, unless they will be marketed with the module (see Section 15.27(a)). The length of these lines shall be the length typical of actual use or, if that length is unknown, at least 10 centimeters to insure that there is no coupling between the case of the module and supporting 6 7 equipment. Any accessories, peripherals, or support equipment connected to the module during testing shall be unmodified and commercially available

(see Section 15.31(i)). The modular transmitter must be equipped with either a permanently affixed label or must be capable of electronically displaying its FCC identification number.

(A) If using a permanently affixed label, the modular transmitter must be labeled with its own FCC identification number, and, if the FCC identification number is not visible when the module is installed inside another device, then the outside of the device into which the module is installed must also display a label referring to the enclosed module. This exterior label can use wording such as the following: Contains Transmitter Module FCC ID: XYZMODEL1 or Contains FCC ID:

XYZMODEL1. Any similar wording that expresses the same meaning may be used. The Grantee may either provide such a label, an example of which must be included in the application for equipment authorization, or, must provide adequate instructions along with the module which explain this requirement. In the latter case, a copy of these instructions must be included in the application for equipment authorization.

(B) If the modular transmitter uses an electronic display of the FCC identification number, the information must be readily accessible and visible on the modular transmitter or on the device in which it is installed. If the module is installed inside another device, then the outside of the device into which the module is installed must display a label referring to the enclosed module. This exterior label can use wording such as the following:

Contains FCC certified transmitter module(s). Any similar wording that expresses the same meaning may be used. The user manual must include instructions on how to access the electronic display. A copy of these instructions must be included in the application for equipment authorization. The modular transmitter must comply with any specific rules or operating requirements that ordinarily apply to a complete transmitter and the manufacturer must provide adequate instructions along with the module to explain any such requirements. A copy of these instructions must be included in the application for equipment authorization. The Module will be labeled with its own FCC ID, and the instruction on the labeling rule of the end product has been stated in the User Manual of this module. Please refer to the Label and User Manual exhibition. Y The required FCC rule has been fulfilled and all the instructions for maintaining compliance have been clearly stated in the User Manual. Y 8 The modular transmitter must comply with any applicable RF exposure requirements in its final configuration. Please refer exhibition RF Exposure for the compliance of MPE RF exposure rule. Y _________________________________ Contact Person: Wilson Lin E-mail: Wilson.lin@rollingwireless.com