# nRF9151 read-only probe (tasks 1.1, 1.2 partial)

Evidence class: **board-read**.

`probe-2026-10-13T235537Z.log` is the output of `tools/nrf9151-probe.sh`.
It was run as `bash /root/nrf9151-probe.sh` over SSH on the second board,
clipped into the keyboard base, while the host held
`flock /tmp/k230-board.lock`. The board ran system `iw5x7hn5…`, whose device
tree already has task 2.1's UART3 and `nrf9151-enable` states.

The script redacts as it writes, so the log carries no area code, cell ID
or operator. It never asks for the IMEI, ICCID, IMSI or number.

## What it shows

- **Enable line low:** `AT` got no answer within 2 s, so the modem is off
  while `nrf9151-enable` (IO2) is low. Before the probe the line was an
  unrequested input.
- **Enable line high:** the firmware prints `Ready` about 1.6 s later and
  `+CEREG: 90` about 0.3 s after that.
- **Radio on by itself:** `AT+CFUN?` reads `1` with no command from us, so
  the firmware switches the radio on by itself after power-on.
- **Firmware:**
  - `AT+CGMR` → `mfw_nrf91x1_2.0.3`;
  - `AT#XSLMVER` → `"2.9.0","2.9.0-cellular-a52f6a06a9e4"`;
  - `AT#XSMVER` → `ERROR`.

  So this unit runs the Serial LTE Modem 2.9.0 application on modem firmware
  2.0.3. The design's 2.0.4 is not what is installed here.
- **No SIM:**
  - `AT%XSIM?` → `%XSIM: 0,9`, SIM not initialised;
  - `AT+CPIN?` → `ERROR`;
  - `+CEREG: 5,90` and `+CEREG: 90`, where 90 means the SIM is unavailable;
  - `AT+COPS?` → `+COPS: 0`;
  - `AT+CESQ` → `99,99,255,255,255,255`, no measurement.

  So no SIM is fitted, or it is not detected.
- **Ending:** the probe ends with `AT+CFUN=4`, flight mode, then the enable
  line low. It does not use `AT+CFUN=0`: on the nRF91 that stores the
  modem's network context to flash, and the probe writes nothing
  non-volatile. After the probe the line is left an output, low.

## Still required for task 1.2

- The operator's notes on which antennas (LTE, GNSS) are fitted.
- Whether a SIM is present, with a camera frame of the antenna connectors if
  visible.