Manual Test Mode for Analog Cellular Telephones Part 1, Page Two

by Damien Thorn

Need program codes for a phone not listed here? Try this great resource: http://www.google.com to search the USENET. Select "Groups" from their home page. Enter your make or model and its number into their search engine; you might find what you are looking for.

. . . setups ran on a Commodore-64 personal computer.

Manufacturers gradually moved away from the AMPS bus standard. As technology advanced, phones were re-engineered to use a serial data interface or some proprietary hybrid to control the transceiver. This eliminated an assortment of control cir-cuitry and a number of the wires that previously interconnected the control head and transceiver, thus bringing down the manufacturing cost.

Since the trusty AMPS test rig was now useless for in-shop diagnostics, most manufacturers included a manual test mode in their operating software. Although some adapter or external piece of hardware may still have been required to access the test mode, the diagnostic commands could be punched in right from the keypad.

Even today many of the debug mode commands adhere to some form of the old AMPS two-digit test codes, although there is considerable variation between which code does what from manufacturer to manufacturer. Based on this fact, one could probably ferret out the other test functions for the phones listed in this article simply by using the Motorola command set as an archetype.

OPEN SESAME

The keystroke sequences used to access the diagnostics are often referred to as "codes" or "passwords." Because these same terms are used to describe the unique words or digits that protect computer accounts, alarm systems and things of that nature, it is important to clarify the role of these keystroke sequences.

The series of digits that causes a cellular phone to execute a test routine is not a trade secret, "code" or "password" in the confidential sense. Such sequences are provided by the manufacturer to allow servicing, and are the same from one phone to the next on any given model.

Never intended to be a big secret, the sequences were designed to prevent the end user from accidentally entering the diagnostic mode. Most people would be quite disturbed to suddenly hear another cellular call blaring from the handset after a clumsy dialing attempt, and then see arcane messages flashing across the LCD display. It's not difficult to imagine the chaos that would be caused by someone driving around town with their phone in test mode with the carrier on, oblivious to the fact that the accidental transmission was causing calls to be dropped by the cellular system left and right.

As we dive in to cellular test modes, be aware that the list of phones provided here is not all-inclusive. It is not necessarily accurate either, as the data has been compiled from a number of sources and was impossible to personally test and verify on each model.

PART 1: ACCESSING DIAGNOSTIC MODES

GENERAL ELECTRIC

The G.E. CF-1000, CF-2000, CF-2500, CF-3000, CF-3500 and CF-4500 require a small jumper in the transceiver to access the diagnostic capabilities. With the cover removed and the audio board exposed, a small hole will be noted allowing access to the logic board underneath. The two pins visible through this hole must be jumpered (shorted) to activate the test functions.

SEND, 8, 3 - Load synthesizer command

SEND, 8, 6 - Unmute the received audio

SEND, 8, 5 - Mute the received audio [default condition]

The test mode on the G.E. Mini and Mini II models does not require that the phone be opened to activate the diagnostics. Use the following sequence on the Mini: Power up the phone and hold down the CL (clear) key. While holding CL, enter 1, 4, 1,4 ,2, 1, 3 within 8-10 seconds of powering up the phone. Release the CL key and the in use indicator will be illuminated.

The procedure is the same for the Mini II transceiver, except the END key is depressed while entering the digits instead of the CL key. The commands on both phones are:

x, x, x, END add synthesizer to channel xxx

x, x, x, x, END - Load synthesizer to channel xxxx [Mini II]

0, 3, SEND - Unmute the received audio

0, 4, SEND Mute the received audio

NEC models M-3700, M-4500, M-4600, M-4700 can be placed in test mode by constructing a small adapter from a set of male and female DB-15 connectors to place between the cable and the connector on the transceiver. The pins of the DB-15 connectors should be wired straight through (pin #1 to pin #1 etc.) except that pins #2 and #11 should be shorted (jumpered) to each other in addition to being wired through. This activates the test line present at the jack.

Power up the phone and enter RCL, # - the display should say "test mode." Key in 0, 1 and the message should be replaced by blocks on the display. Note that entering test mode will reset the phone's autonomous (cumulative) call timer.

RCL, #, 0, 9, x, x, x - Load synthesizer to channel xxx

RCL, #, 1, 2 - Unmute the received audio

RCL, #, 1, 1 - Mute the received audio

RCL, #, 0, 2 - Exit test mode

The NEC P-9000 and P-9100 series portable phones use a method similar to Motorola access test mode: an extra battery terminal normally engaged only . . .

[Back one page] [Next page --->]