Table of Contents:

• 1. The use of this guideline
• 2. Attach Network
  • 2.1 General Configure to attach network
  • 2.2 Speed Up Network Attach time
• 3. Configure to connect to different servers
  • 3.1 General UDP Connection
    • 3.1.1 Simulate UDP Connection by PC tool
    • 3.1.2 Configure NB-IoT Sensor
      • 3.1.2.1 AT Commands
      • 3.1.2.2 Uplink Example
  • 3.2 General MQTT Connection
  • 3.3 ThingSpeak (via MQTT)
    • 3.3.1 Get MQTT Credentials
    • 3.3.2 Simulate with MQTT.fx
      • 3.3.2.1 Establish MQTT Connection
      • 3.3.2.2 Publish Data to ThingSpeak Channel
    • 3.3.3 Configure NB-IoT Sensor for connection
      • 3.3.3.1 AT Commands:
      • 3.3.3.2 Uplink Examples
      • 3.3.3.3 Map fields to sensor value
  • 3.4 Datacake
    • 3.4.1 For device Already has template
      • 3.4.1.1 Create Device
    • 3.4.2 For Device already registered in DataCake before shipped
      • 3.4.2.1 Scan QR Code to get the device info
      • 3.4.2.2 Claim Device to User Account
    • 3.4.3 Manual Add Decoder in DataCake ( don't use the template in DataCake)
    • 3.4.4 For device have not configured to connect to DataCake
  • 3.5 Node-Red (via MQTT)
    • 3.5.1 Configure Node-Red
    • 3.5.2 Simulate Connection
    • 3.5.3 Configure NB-IoT Sensors
  • 3.6 ThingsBoard.Cloud (via MQTT)
    • 3.6.1 Configure ThingsBoard
      • 3.6.1.1 Create Device
      • 3.6.1.2 Create Uplink & Downlink Converter
      • 3.6.1.3 MQTT Integration Setup
    • 3.6.2 Simulate with MQTT.fx
    • 3.6.3 Configure NB-IoT Sensor
  • 3.7 ThingsBoard.Cloud (via COAP)
    • 3.7.1 Configure ThingsBoard
      • 3.7.1.1 Create Uplink & Downlink Converter
      • 3.7.1.2 COAP Integration Setup
      • 3.7.1.3 Add COAP Integration
      • General Configure to Connect to IoT server for -NB & -NS NB-IoT models
    • 3.7.2 Node Configuration(Example: Connecting to the Thingsboard platform)
      • 3.7.2.1 Instruction Description
  • 3.8 Tago.io (via MQTT)
    • 3.8.1 Create device & Get Credentials
    • 3.8.2 Simulate with MQTT.fx
    • 3.8.3 tago data
  • 3.9 TCP Connection
  • 3.10 AWS Connection
• 4. MQTT/UDP/TCP downlink
  • 4.1 MQTT (via MQTT.fx)
• 5. FAQ
  • 5.1 What is the usage of Multi Sampling and One Uplink?
  • 5.2 Why the uplink JSON format is not standard?
• 6. Trouble Shooting:
  • 6.1 Checklist for debuging Network Connection issue. Signal Strenght:99 issue.
  • 6.2 Issue: "NBIOT did not respond"
  • 6.3 Issue: "Failed to readI MSI number"
  • 6.4 Why sometime the AT Command is slow in reponse?
  • 6.5 What is the Downlink Command by the NB device?
    • UDP:
    • MQTT:
  • 6.6 How to obtain device logs?
  • 6.7 How to find the AT Command Password if lost?
    • Why can't the password access AT command after upgrade(-NB)?
    • Version Confirmation
    • UART connection and firmware update methods
    • query the password via STM32CubeProgrammer
    • Special case

1. The use of this guideline

This configure instruction is for Dragino NB-IoT models with -NB or -NS suffix, for example DDS75-NB. These models use the same NB-IoT Module BC660K-GL and has the same software structure. The have the same configure instruction to different IoT servers. Use can follow the instruction here to see how to configure to connect to those servers.

2. Attach Network

2.1 General Configure to attach network

To attache NB-IoT sensors to NB-IoT Network, You need to:

1. Get a NB-IoT SIM card from Service Provider. (Not the same as the SIM card we use in mobile phone)
2. Power Off End Node ( See below for the power off/on position)
3. Insert the SIM card to Sensor. ( See below for direction)
4. Power On End Node
5. Configure APN in the sensor (AT+APN=<APN>), example AT+APN=iot.1nce.net

After doing above, the NB-IoT Sensors should be able to attach to NB-IoT network .

The -NB and -NS models support LTE Cat NB2, with below frequency band: multiple frequency bands of B1/B2/B3/B4/B5/B8/B12/B13/B14/B17/B18/B19/B20/B25/B28/B66/B70/B85 . Make sure you use a the NB-IoT SIM card.

2.2 Speed Up Network Attach time

BC660K-GL supports multi bands B1/B2/B3/B4/B5/B8/B12/B13/B14/B17/B18/B19/B20/B25/B28/B66/B70/B85.  It will search one by one and try to attach, this will take a lot of time and even cause attach fail and show Signal Strenght:99. User can lock the band to specify band for its operator to make this faster. 

AT+QBAND?        // Check what is the current used frequency band
AT+QBAND=1,4     // Set to use 1 frequency band. Band4
Europe General AT+QBAND=2,8,20  // Set to use 2 frequency bands. Band 8 and Band 20
Global General : AT+QBAND=10,8,20,28,2,4,12,13,66,85,5

Verizon       AT+QBAND=1,13
AT&T           AT+QBAND=3,12,4,2
Telstra        AT+QBAND=1,28
Softband     AT+QBAND=2,3,8

After connection is successful, user can use AT+QENG=0  to check which band is actually in used.

By default, device will search network for 5 minutes. User can set the time to 10 minutes by AT+CSQTIME=10 so it can search longer.

See bands used for different provider: NB-IoT Deployment , Bands, Operator list

3. Configure to connect to different servers

3.1 General UDP Connection

The NB-IoT Sensor can send packet to server use UDP protocol. 

3.1.1 Simulate UDP Connection by PC tool

We can use PC tool to simulate UDP connection to make sure server works ok. 

3.1.2 Configure NB-IoT Sensor

3.1.2.1 AT Commands

AT Commands:

• AT+PRO=2,0         //  Set to use UDP protocol to uplink ,Payload Type select Hex payload

• AT+SERVADDR=120.24.4.116,5601      //  Set UDP server address and port

3.1.2.2 Uplink Example

3.2 General MQTT Connection

The NB-IoT Sensor can send packet to server use MQTT protocol. 

Below are the commands.

AT Commands:

• AT+PRO=3,0      //  Set to use MQTT protocol to uplink, Payload Type select Hex payload.

• AT+SERVADDR=120.24.4.116,1883        //  Set MQTT server address and port

• AT+CLIENT=CLIENT                                 //  Set up the CLIENT of MQTT

• AT+UNAME=UNAME                              //  Set the username of MQTT

• AT+PWD=PWD                                        //  Set the password of MQTT

• AT+PUBTOPIC=NSE01_PUB                    //  Set the sending topic of MQTT

• AT+SUBTOPIC=NSE01_SUB                    //  Set the subscription topic of MQTT

Notice: MQTT protocol has a much higher power consumption compare with UDP/CoAP protocol. Please check the power analyze document and adjust the uplink  period to a suitable interval.

3.3 ThingSpeak (via MQTT)

3.3.1 Get MQTT Credentials

ThingSpeak connection uses MQTT Connection. So we need to get MQTT Credentials first. You need to point MQTT Devices to ThingSpeak Channel as well. 

3.3.2 Simulate with MQTT.fx

3.3.2.1 Establish MQTT Connection

After we got MQTT Credentials, we can first simulate with PC tool MQTT.fx tool to see if the Credentials and settings are fine. 

• Broker Address: mqtt3.thingspeak.com

• Broker Port: 1883

• Client ID: <Your ThingSpeak MQTT ClientID>

• User Name: <Your ThingSpeak MQTT User Name>

• Password: <Your ThingSpeak MQTT Password>

3.3.2.2 Publish Data to ThingSpeak Channel

In MQTT.fx, we can publish below info:

• Topic: channels/YOUR_CHANNEL_ID/publish

• Payload: field1=63&field2=67&status=MQTTPUBLISH 

Where 63 and 67 are the value to be published to field1 & field2. 

Result: 

3.3.3 Configure NB-IoT Sensor for connection

3.3.3.1 AT Commands:

In the NB-IoT, we can run below commands so to publish the channels like MQTT.fx

• AT+PRO=3,1     // Set to use ThingSpeak Server and Related Payload

• AT+CLIENT=<Your ThingSpeak MQTT ClientID>

• AT+UNAME=<Your ThingSpeak MQTT User Name>

• AT+PWD=<Your ThingSpeak MQTT Password>

• AT+PUBTOPIC=<YOUR_CHANNEL_ID>

• AT+SUBTOPIC=<YOUR_CHANNEL_ID>

3.3.3.2 Uplink Examples

For SE01-NB

For DDS20-NB

For DDS45-NB

For DDS75-NB

For NMDS120-NB

For SPH01-NB

For NLM01-NB

For NMDS200-NB

For CPN01-NB

For DS03A-NB

For SN50V3-NB

3.3.3.3 Map fields to sensor value

When NB-IoT sensor upload to ThingSpeak. The payload already specify which fileds related to which sensor value. Use need to create fileds in Channels Settings. with name so to see the value correctly. 

Below is the NB-IoT Product Table show the mapping. 

3.4 Datacake

Dragino NB-IoT sensors has its template in Datacake Platform. There are two version for NB Sensor,

As example for S31B-NB. there are two versions: S31B-NB-1D and S31B-NB-GE.

• S31B-NB-1D: This version have pre-configure DataCake connection. User just need to Power on this device, it will auto connect send data to DataCake Server.

• S31B-NB-GE: This verson doesn't have pre-configure Datacake connection. User need to enter the AT Commands to connect to Datacake. See below for instruction. 

3.4.1 For device Already has template

3.4.1.1 Create Device

Add Device in DataCake.

Choose the correct model from template.

Fill Device ID. The device ID needs to be filled in with IMEI, and a prefix of 'f' needs to be added.

3.4.2 For Device already registered in DataCake before shipped

3.4.2.1 Scan QR Code to get the device info

Users can use their phones or computers to scan QR codes to obtain device data information.

3.4.2.2 Claim Device to User Account

By Default, the device is registered in Dragino's DataCake Account. User can Claim it to his account.

3.4.3 Manual Add Decoder in DataCake ( don't use the template in DataCake)

Step1: Add a device

Step2: Choose your device type,please select dragino NB-IOT device

Step3: Choose to create a new device

Step4: Fill in the device ID of your NB device

Step5: Please select your device plan according to your needs and complete the creation of the device

Step6: Please add the decoder at the payload decoder of the device configuration.

Decoder location: dragino-end-node-decoder/Datacake-Dragino_NB at main · dragino/dragino-end-node-decoder (github.com)

Due to version update, please use the following decoder for the new version firmware:
dragino-end-node-decoder/Datacake-Dragino_NB_New_Version at main · dragino/dragino-end-node-decoder (github.com)

Step7: Add the output of the decoder as a field

Step8: Customize the dashboard and use fields as parameters of the dashboard

3.4.4 For device have not configured to connect to DataCake

Use AT command for connecting to DataCake

AT+PRO=2,0

AT+SERVADDR=67.207.76.90,4445

3.5 Node-Red (via MQTT)

3.5.1 Configure Node-Red

Take S31-NB UDP protocol as an example.

Dragino provides input flow examples for the sensors.

User can download the required JSON file through Dragino Node-RED input flow template.

Download sample JSON file link: https://www.dropbox.com/sh/mduw85jcuwsua22/AAAvwPhg9z6dLjJhmZjqBf_ma?dl=0

We can directly import the template.

The templates for S31-NB and NB95S31B are the same.

Please select the NB95S31B template.

Successfully imported template.

Users can set UDP port.

3.5.2 Simulate Connection

We have completed the configuration of UDP. We can try sending packets to node red.

3.5.3 Configure NB-IoT Sensors

• AT+PRO=3,0 or 3,5     // hex format or json format
• AT+SUBTOPIC=<device name>or User Defined 
• AT+PUBTOPIC=<device name>or User Defined
• AT+CLIENT=<device name> or User Defined
• AT+UNAME=<device name> or User Defined
• AT+PWD=“Your device token”

3.6 ThingsBoard.Cloud (via MQTT)

3.6.1 Configure ThingsBoard

3.6.1.1 Create Device

Create a New Device in ThingsBoard. Record Device Name which is used for MQTT connection.

3.6.1.2 Create Uplink & Downlink Converter

Uplink Converter

The purpose of the decoder function is to parse the incoming data and metadata to a format that ThingsBoard can consume. deviceName and deviceType are required, while attributes and telemetry are optional. Attributes and telemetry are flat key-value objects. Nested objects are not supported.

To create an uplink converter go to the Integrations center -> Data converters page and click “plus” button. Name it “MQTT Uplink Converter” and select type "Uplink". Use debug mode for now.

Downlink Converter

The Downlink converter transforming outgoing RPC message and then the Integration sends it to external MQTT broke

Note: Our device payload is already human readable data. Therefore, users do not need to write decoders. Simply create by default.

3.6.1.3 MQTT Integration Setup

Go to the Integrations center -> Integrations page and click “plus” icon to add a new integration. Name it “MQTT Integration”, select type MQTT;

• The next steps is to add the recently created uplink and downlink converters;

Add a topic filter:

Consistent with the theme of the node setting.

You can also select an MQTT QoS level. We use MQTT QoS level 0 (At most once) by default;

3.6.2 Simulate with MQTT.fx

3.6.3 Configure NB-IoT Sensor

AT Commands

• AT+PRO=3,3    // Use MQTT to connect to ThingsBoard. Payload Type set to 3.

• AT+SUBTOPIC=<device name> 

• AT+PUBTOPIC=<device name>

• AT+CLIENT=<device name> or User Defined

• AT+UNAME=<device name> or User Defined

• AT+PWD=<device name> or User Defined

Test Uplink by click the button for 1 second

3.7 ThingsBoard.Cloud (via COAP)

3.7.1 Configure ThingsBoard

3.7.1.1 Create Uplink & Downlink Converter

Uplink Converter

The purpose of the decoder function is to parse the incoming data and metadata to a format that ThingsBoard can consume. deviceName and deviceType are required, while attributes and telemetry are optional. Attributes and telemetry are flat key-value objects. Nested objects are not supported.

To create an uplink converter go to the Integrations center -> Data converters page and click “plus” button. Name it “COAP Uplink Converter” and select type "Uplink". Use debug mode for now.

Downlink Converter

The Downlink converter transforming outgoing RPC message and then the Integration sends it to external COAP broker.

3.7.1.2 COAP Integration Setup

Go to the Integrations center -> Integrations page and click “plus” icon to add a new integration. Name it “CoAP Integration”, select type COAP    ;

The next steps is to add the recently created uplink converters;

3.7.1.3 Add COAP Integration

3.7.2 Node Configuration(Example: Connecting to the Thingsboard platform)

3.7.2.1 Instruction Description

• AT+PRO=1,0(HEX format uplink)  &AT+PRO=1,5(JSON format uplink)
• AT+SERVADDR=COAP Server Address,5683

Example: AT+SERVADDR=int.thingsboard.cloud,5683(The address is automatically generated when the COAP integration is created)

Note:The port for the COAP protocol has been fixed to 5683

• AT+URL1=11,character length,"Needs to be consistent with the CoAP endpoint URL in the platform"

If the module used is BC660K, only one URL directive needs to be configured,

e.g. 

• AT+URL1=11,38, "i/faaaa241f-af4a-b780-4468-c671bb574858"

If you are using a BG95-M2 module, you need to configure TWO URL commands,

e.g.

• AT+URL1=11, "i"
• AT+URL2=11,"faaaa241f-af4a-b780-4468-c671bb574858"

3.8 Tago.io (via MQTT)

3.8.1 Create device & Get Credentials

We use MQTT Connection to send data to Tago.io. We need to Create Device and Get MQTT Credentials first. 

Go to the Device section and create a device. Then, go to the section tokens and copy your device-token.

The device needs to enable the TLS mode and set the AT+TLSMOD=1,0 command.

On the Connection Profile window, set the following information:

• Profile Name: “Any name”

• Broker Address: mqtt.tago.io

• Broker Port: 8883

• Client ID: “Any value”

On the section User credentials, set the following information:

• User Name: “Any value”       // Tago validates your user by the token only

• Password: “Your device token”

• PUBTOPIC: “Any value”

• SUBTOPIC: “Any value”

AT command:

• AT+PRO=3,0 or 3,5     // hex format or json format

• AT+SUBTOPIC=<device name>or User Defined 

• AT+PUBTOPIC=<device name>or User Defined

• AT+CLIENT=<device name> or User Defined

• AT+UNAME=<device name> or User Defined

• AT+PWD=“Your device token”

3.8.2 Simulate with MQTT.fx

Users can run the AT+PRO=3,5 command, and the payload will be converted to JSON format.

3.8.3 tago data

3.9 TCP Connection

AT command:

• AT+PRO=4,0     // Set to use TCP protocol to uplink(HEX format)

• AT+PRO=4,1     // Set to use TCP protocol to uplink(JSON format)

• AT+SERVADDR=120.24.4.116,5600    // to set TCP server address and port

Sensor Console Output when Uplink:

See result in TCP Server:

3.10 AWS Connection

Users can refer to Dragino NB device connection to AWS platform instructions

4. MQTT/UDP/TCP downlink

4.1 MQTT (via MQTT.fx)

Configure MQTT connections properly and send downlink commands to configure nodes through the Publish function of MQTT.fx.

1. Configure node MQTT connection (via MQTT.fx):

AT command:

• AT+PRO=3,0 or 3,5   // hex format or json format

• AT+SUBTOPIC=User Defined 

• AT+PUBTOPIC=User Defined

• AT+UNAME=<device name> or User Defined

• AT+PWD=<device name> or User Defined

• AT+SERVADDR=8.217.91.207,1883    // to set MQTT server address and port

Note: To uplink and downlink via MQTT.fx, we need set the publish topic and subscribe topic different, for example: AT+SUBTOPIC=SE01_SUB & AT+PUBTOPIC=SE01_PUB.

2. When the node uplink packets, we can observe the data in MQTT.fx.

3. The downlink command can be successfully sent only when the downlink port is open.

    The downlink port is opened for about 3 seconds after uplink packets are sent.

    Therefore, when we see the node uplink packets in the Subscribe window, we need to immediately switch to the publish window to publish the hex format command.

Note: Users can edit the hex command in advance. When the node uplink, directly click the publish button several times to increase the success rate of command configuration.

5. FAQ

5.1 What is the usage of Multi Sampling and One Uplink?

The NB series has the feature for Multi Sampling and one uplink. See one of them

http://wiki.dragino.com/xwiki/bin/view/Main/User%20Manual%20for%20LoRaWAN%20End%20Nodes/SN50v3-NB_BN-IoT_Sensor_Node_User_Manual/#H2.5Multi-SamplingsandOneuplink

User can use this feature for below purpose:

1. Reduce power consumption. The NB-IoT transmit power is much more higher than the sensor sampling power. To save battery life, we can sampling often and send in one uplink.
2. Give more sampling data points.
3. Increase reliable in transmission. For example. If user set
   • AT+TR=1800        // The unit is seconds, and the default is to record data once every 1800 seconds (30 minutes, the minimum can be set to 180 seconds)
   • AT+NOUD=24    //  The device uploads 24 sets of recorded data by default. Up to 32 sets of record data can be uploaded.
   • AT+TDC=7200  // Uplink every 2 hours.
   • this will mean each uplink will actually include the 6 uplink data (24 set data which cover 12 hours). So if device doesn't lost 6 continue data. There will not data lost.

5.2 Why the uplink JSON format is not standard?

The json format in uplink packet is not standard Json format. Below is the example. This is to make the payload as short as possible, due to NB-IoT transmit limition, a standard Json is not able to include 32 sets of sensors data with timestamp.

The firmware version released after 2024, Mar will use change back to use Json format. Detail please check changelog.

6. Trouble Shooting:

6.1 Checklist for debuging Network Connection issue. Signal Strenght:99 issue.

There are many different providers provide NB-IoT service in the world. They might use different band, different APN & different operator configuration. Which makes connection to NB-IoT network is complicate.

If end device successfully attached NB-IoT Network, User can normally see the signal strengh as below (between 0~31)

If fail to attach network, it will shows signal 99. as below:

When see this issue, below are the checklist:

• Does your SIM card support NB-IoT network? If SIM card doesn't not specify support NB-IoT clearly, normally it doesn't support. You need to confirm with your operator.
• Do you configure the correct APN? Check here for APN settings.
• Do you lock the frequency band? This is the most case we see. Explain and Instruction.
• Check if the device is attached to Carrier network but reject. (need to check with operator).
• Check if the antenna is connected firmly.

If you have check all above and still fail. please send console log files (as many as possible) to support@dragino.com so we can check.

6.2 Issue: "NBIOT did not respond"

This issue might due to initiate issue for NB-IoT module. In this case, please try:

1) Open Enclosure

2) Power off device by pull out the power on Jumper

3) Power on device by connect back the power jumper.

4) push reset button.

6.3 Issue: "Failed to readI MSI number"

Make sure that the SIM card is insert in correct direction and device is power off/on during insert. Here is reference link: Insert SIM Card.

6.4 Why sometime the AT Command is slow in reponse?

When the MCU is communicating with the NB-IoT module, the MCU response of AT Command will become slower, it might takes several seconds to response.

6.5 What is the Downlink Command by the NB device?

UDP:

Its downlink command is the same as the AT command, but brackets are required.
Example:

{AT+TDC=300}

MQTT:

Json：

The Json format in MQTT mode needs to be configured with all commands.
If you have configurations that need to be changed, please change them in the template below.
Template:

{
"AT+SERVADDR":"119.91.62.30,1882",
"AT+CLIENT":"JwcXKjQBNhQ2JykDDAA5Ahs",
"AT+UNAME":"usenamedragino",
"AT+PWD":"passworddragino",
"AT+PUBTOPIC":"123",
"AT+SUBTOPIC":"321",
"AT+TDC":"7200",
"AT+INTMOD":"0",
"AT+APN":"NULL",
"AT+5VT":"0",
"AT+PRO":"3,5",
"AT+TR":"900",
"AT+NOUD":"0",
"AT+CSQTIME":"5",
"AT+DNSTIMER":"0",
"AT+TLSMOD":"0,0",
"AT+MQOS":"0",
"AT+TEMPALARM1":"0",
"AT+TEMPALARM2":"10",
"AT+TEMPALARM3":"0"
}

Hex：

MQTT's hex format. Since many commands need to support strings, only a few commands are supported.

The supported commands are consistent with LoRaWAN's hex commands.
Please refer to the following link to obtain the hex format:

http://wiki.dragino.com/xwiki/bin/view/Main/End%20Device%20AT%20Commands%20and%20Downlink%20Command/

6.6 How to obtain device logs?

• AT Command: AT +GETLOG

This command can be used to query upstream logs of data packets.

6.7 How to find the AT Command Password if lost?

Why can't the password access AT command after upgrade(-NB)?

Because the new version of -NB firmware has updated the factory reset function, users can choose to restore all parameters to factory Settings, or keep the password to restore the rest of the parameters to factory Settings.

This update changes the password address of the firmware, so the password will be invalid after the customer upgrades from the old version of firmware (without FDR1 function) to the new version of firmware (with FDR1 function).

Two different restore factory Settings configurations.

AT command:

• AT+FDR       // Reset Parameters to Factory Default.
• AT+FDR1     // Reset parameters to factory default values except for passwords.(new)

Version Confirmation

We are now dividing the old firmware(without FDR1 function) with the new firmware(with FDR1 function) by whether it contains FDR1 functionality. Please refer to the table:

UART connection and firmware update methods

Users can query passwords only using the UART interface via the STM32CubeProgrammer.

See UART Connection.

update firmware through UART TTL interface : Instruction.

query the password via STM32CubeProgrammer

Users can use the password address to query the password through STM32CubeProgrammer.

• The password address for old firmware(without FDR1 function) : 0x08019000
• The password address for new firmware(with FDR1 function) : 0x08025D00

Notice: The password can only be queried after the firmware is run once.

Procedure for querying the password(old firmware):

• After the firmware upgrade is complete, switch back to the FLASH and reset the node to run the firmware once.
• Then place the switch at the ISP and connect to the STM32CubeProgrammer (same as when burning the firmware).
• Click "Device memory", enter 0x08019000 in "Address", and click "Read"
• Find the 0x08019000 address field and then read the current password as shown in the screenshot below.

Procedure for querying the password(new firmware):

Refer to the old and new firmware division above, and run the firmware first after updating the firmware.

• After the firmware upgrade is complete, switch back to the FLASH and reset the node to run the new firmware once.
• Then place the switch at the ISP and connect to the STM32CubeProgrammer (same as when burning the firmware).
• Click "Device memory", enter 0x08025D00 in "Address", and click "Read"
• Find the 0x08025D00 address field and then read the current password as shown in the screenshot below.

Special case

If the user has never changed the password manually, the user cannot find the valid password through the above two password addresses. In this case, the valid password is still the original password on the node box label (AT+PIN).

Invalid query screenshot example: