This project will describe a method to add a cellular modem into the NetBurner as a TCP/IP interface component. The NetBurner communications setup discussed in this paper consists of three major components.
- The DIGI XBEE3 Cellular Smart Modem LTE-CAT 1 AT&T development kit (XBIB-U-DEV development board, XBee smart modem with Telit cellular module, and two cellular antennas. For the complete development kit user guide, go here.)
- The Netburner SB72EX (however this is just one of many NetBurner devices with this capability
- The level shifter board that you will build using the MAX3232 3.3V level shifter (find a breakout board version from SparkFun here)
The project uses two wall wart transformers, one for the cellular modem board and one for the SB72EX. The Netburner communicates with the cellular modem board using RS-232 at 57600 baud, with no parity, 8 data bits, and 1 stop bit.
The XBEE kit comes with at least 90 days free connectivity with AT&T through the cellular interface and antennas. If you are close enough to a cell tower it is not necessary to use the secondary antenna of the two. See the XBEE user’s manual for more information.
In this example we are using the DIGI XBEE3 kit along with a Netburner SB72EX serial communications device, although any Netburner board / module will work providing that a second UART port is available with full handshaking connections along with the Debug serial port. The DIGI kit provides a Telit LE866 Series cellular module, 2 antennae and some handy applications that can be used to configure and update the device.
The XBEE cellular modem has at least two major modes of operation: "Transparent" mode and "Bypass" mode. There are others, like "Micro Python" mode, that are not covered in this paper and are not necessary to us here. Bypass mode is discussed in this article at various points, and its purpose is to allow us to talk directly to the cellular network chip. The Telit cellular module chip supports two interfaces: AT commands and PPP communications. See the manuals listed at the bottom of this document for more information on the Telit chip.
The cellular modem can provide the TCP/IP connection to your NetBurner platform by adding some hardware to the development board, placing the modem into bypass mode, and connecting to the cellular modem using PPP (point-to-point protocol). On the next page a drawing of the system shows the location of the level shifter board on the DIGI development board. Before you develop or install the level shifter, you should follow the instructions that come with the DIGI modem development kit. Install the XCTU application and connect to the DIGI modem module through USB as the manufacturer has specified with this kit. Talk with “ELIZA the cyber-psychologist”, send a text message to your phone, and perform any of the other documented experiments in the DIGI user’s manual.
It is valuable to work with the cellular modem board using the Digi application XCTU running on Windows initially in order to get used to working with the modem at the high level before adding the level shifter board and using bypass mode to connect with PPP.
When you are ready to attach to NetBurner, review section 2 of this article below, change the parameters, and then move to section 3 of the article to build the level shifter.
2. Setting up the cellular modem board for RS-232 operation
Use the XBEE default USB cabling and follow the instructions in the XBEE user’s manual to bring up the list of modem parameters on XCTU.
It is valuable to remember the following:
The Association Indicator tells you a lot about what the modem is doing and what state it is in. If the value is 2A then the modem is in airplane mode, if the value is 2F it is in bypass mode and the micro-python and command API firmware features are not alive in the modem. When you are in the XCTU application you want Airplane Mode to be (0), and the Association Indicator to be something other than 2F, in other words, not in bypass mode.
Connect the XCTU application to the XBEE modem/dev board.
Before you connect the XBEE modem board/dev board/level shifter board to your Netburner, you will want to change the following parameters in the XBEE modem using XCTU application:
- Change IP protocol to TCP and press WRITE icon
- Set DL Destination Address to 18.104.22.168 and write
- Set Destination port to 2328 and write
- Set BD baud rate to 57600 and write
- Ensure parity is No Parity
- Ensure Stop Bits is One Stop Bit
- Ensure text delimiter is ‘D’
- Ensure API Enable is Transparent Mode 
- Ensure Sleep mode is Normal 
- Ensure CC is still 2B, CT is 64, GT is 3E8 still
- Python should be Disabled 
Now the modem is setup and ready to operate with the NetBurner library and the sample application. Go to the next section and build up the serial port level shifter hardware.
3. Level Shifter Hardware
The Netburner communicates with the cellular modem through its serial port. The XBEE module supports 3.3 volts on DIN and DOUT lines, so we use a MAX3232 3.3V level shifter chip for use with RS-232 signals on one side and 3.3V signals on the XBEE side. The XBEE board uses USB to communicate with your computer when you get the kit initially, but to move forward and use the cellular modem for the Netburner TCP/IP interface, you need to use the RS-232 interface.
The XBEE board numbers the 0.1 x 0.1 inch 20 pin dual row connector in the same manner as the modem module- which is not compatible with the usual numbering scheme of these dual row connectors. On the schematic above I have both numbering schemes shown together, with the numbers on the outside edge representing the modem module’s number scheme. The modem uses handshaking signals as shown on this schematic.
I have specified a DB9-S DCE connector that is ready to plug into any DTE 9-pin connector, such as the SB72EX or a PC serial connector.
I decided to hand-wire my level shifter board and a dual row 20 pin female connector on the bottom of the board using a part such as the Mouser M20-7831046 (note that despite the reference image, it is a 2 row, 20 pin connector).
There are several ways to accomplish this, however. If needed, you can find a MAX3232 level shifter breakout board from SparkFun here. You would then connect the wires from the DB9-S DCE connector to the corresponding signals on pins 1-4 of the breakout board. Similarly, pins 5-10 on the breakout board would then be connected to the corresponding signals on the XBIB-U-DEV development board.
***Important Note: Four resistors are removed from the DIGI development board to take the USB UART out of the circuit. They are R32, 33, 41, 45.
Once the resistors are removed and the level shifter is installed, it is still easy to communicate with the cell modem using the XCTU app by specifying that it uses the COM port address of your laptop or PC instead of the USB port you were using initially. You can use XCTU to test your level shifter board.
4. Working with the supplied Netburner firmware
The Netburner application is controlled through the Debug COM port. This is the menu as supplied to the debug port at 115200 baud, with no parity, 8 data bits, and 1 stop bit..
0: Sends <1 second>+++<1 second> to modem to place it in command mode
1: Asks the modem to report the list shown on the following page
2: Returns the modem into data mode from command mode
3: Enter a phone number for SMS
4: Specify SMS protocol mode
5: Open a terminal (cancel with cntl-c) to talk to the modem
6: Specify the IP address that you wish to connect to
7: Specify the port that you wish to connect to
8: Put modem into TCP/IP mode
9: Send “accept changes” to modem
A: Send “write to NV memory”
B: Enter Bypass mode
C: Cancel Bypass Mode
D: Set airplane mode
E: Set airplane mode off
F: Get associated status value
J: Send Telit chip “echo off” (I do this in the terminal key 5)
K: Have Telit chip list visible operators. (I do this in the terminal key 5)
L: Enable IP Context
M: Disable IP Context
N: Show IP address of context
O: Connect PPP (Telit chip command)
P: Enter PPP direct mode (Netburner command)
Q: Close PPP session (abort PPP)
S: Say something to ELIZA server on the internet
V: Shut down remote handler
X: Not used
In this screen the modem is reporting some interesting data:
BD is 6 (baud rate of 57600), MN (operator) is AT&T, AM (airplane mode) is OFF, IP (protocol) is 2 or SMS text message, MY reports my IP address - we can see that we are connected to the internet, P# (destination phone number) is set to some fake phone number - you would set it to your cell phone number, DL (destination IP address) is set to the ELIZA/ECHO server at 22.214.171.124, DE (destination port) is set to ELIZA server port 2328, TD (text delimiter) is set to D (0x0d), AI (assoc. indicator) is set to 0- so we are not in either bypass or airplane mode (0x2f, 0x2A)
From this menu system we can talk to the cellular modem at a high level (through the modem’s internal microprocessor that is between you and the Telit cellular chip
High-Level Operations: (Modem is not in bypass mode to use these)
- To send an SMS message:
- Hit key 3 enter a cell phone number then ENTER
- Hit key 4 to set SMS protocol mode
- Hit key 9 to accept the changes
- Hit 5 to enter the terminal mode
- Write something and press ENTER
- Your cell phone will show the characters you typed in a text message
- Press cntl-C to exit the terminal
- To talk with ELIZA
- Hit key 6 and enter 126.96.36.199 press ENTER
- Hit key 7 and enter “0x2328” then press ENTER
- Hit key 8 to enter TCP/IP protocol mode
- Hit Key 9 to accept the changes
- Hit key 5 to enter terminal mode
- Type in something and hit ENTER
- After a bit, ELIZA will say something counselor-like to you
- Press cntl-C to exit the terminal
***Note: Bypass Mode with the XBEE cellular modem:
When you place the modem into the Bypass Mode, you are removing the on-modem microprocessor from translating between you and the actual cellular processing chip, the Telit LE866 chip. The process of place the modem into bypass mode is straightforward, but you must check that the modem has made the transition to bypass mode by querying the AI (key F on the menu) until the result is 2F. Once you are in bypass mode the modem will stay there, even through power cycles.
Now the next step will be to bypass the modem’s microprocessor and talk directly with the Telit cellular chip on the XBEE device. This chip can perform certain tasks for you like reporting all of the operators it finds in the RF stream, and connecting via PPP to the Netburner library.
To enter bypass mode, press menu item ‘B’ and give the modem 4 or 5 minutes to reboot and the cellular signal to re-acquire. The RED LED which was blinking in non-bypass mode stays on solid in bypass mode. Query the associative status value by hitting key ‘F’ until you get the 2F response, as mentioned previously.
Now that you have an AI of 2F and the modem is in bypass mode, hit key 5 to enter the terminal. Now enter:
This command turns off the echo- you should see:
Now press cntl-C to exit the terminal
Press ‘M’ to disable the IP context. You should see:
Press ‘L’ to enable the IP context, you should see:
#SGACT: nnn.nnn.nnn.nnn (a valid IP address)
Press ‘O’ to tell Telit chip to connect via PPP
When you see the word:
Press the ‘P’ key to connect PPP. You should see:
You are now providing the Netburner TCP/IP stack with an internet connection through the cellular network. Go ahead and unplug the Ethernet cable from your Netburner while you are testing to prove your connectivity is through the cellular modem.
Below is a screenshot of the procedure to connect with PPP, invoke ELIZA on the internet, and shut down the remote handler with key ‘V’ and scuttle the PPP session with key ‘Q’.
5. Building a solid cellular modem-based application:
To use a cellular modem in a stand-alone Netburner application you would need to:
- Generate the custom hardware that accepts the XBEE modem and provides the level shifter hardware.
- Setup XBEE modem using XCTU application to all of the above specified settings PLUS placing the modem in Bypass mode. Save all to non-volatile memory in the modem so it reverts to this each time after power cycle.
- Build a state machine that will walk the modem and the PPP library through the connection states after power-up. The code would need to check the Assoc. status, place the Telit chip in non-echo mode.
- Get a Telit IP context in place with the AT command AT#SGACT=1,1, send a CONNECT command to Telit with the AT command ATD*99***1#
- Invoke PPP and check for a successful connection to be established.
- Build your Ethernet-based code with web pages, sockets, UDP handling, etc.