The information on this page
covers secrets and field test functions on both Nokia
6185 and 6188 models plus the Nokia 5185/85i.
Secrets
Change the provider's name to your own welcome message on
startup:
Menu-1-3
Change the provider's name on the screen:
Enter *3001#12345#, then select NAM1, ALPHA TAG, and enter in
your own text string. Power off to get out of this menu
Quickly switch profiles:
Hit POWER button briefly to select
Keyguard:
Hold down END key for 2 seconds OR Menu + '*' OR Menu + '9'
Phone lock to prevent unauthorized use:
Menu-4-3-2-1, ON, Power off to engage
Setting Speed Dial:
NAMES Softkey, 1-TOUCH DIALING, Pick name out of phone book
Software version:
*#837# or *#VER# or *#9999#
Serial / ESN:
*#92772689# or *#WARRANTY#
Phone reset?
*#SLOT1# or *#SLOT2# (changes value on screen 46, line 3 --
Thanks Andrew S). Also see this page for a more detailed description of the
slot cycles.
Phone programming
*#639# (do only if you have programming codes -- Thanks Peter
Hartmann)
How do I get the date to show up on my 6185/8
like your phone above? Earlier firmware versions of the 6185/8
do not show the date on the screen. Contact your service provider
and ask for a firmware upgrade of your phone (this is free service
-- no authorized dealer that can upgrade firmware should charge you
to do this).
How do I use my Sprint 6185 on Verizon (or Bell, Telus,
etc)? You need to have an unlocked phone to switch providers.
See the general Nokia
secrets page under SP-lock status. If your phone is locked then
you may try unlocking it with various software programs available on
the internet to generate unlocking codes (enter any codes generated
from this programs at your own risk), attempt to get the unlocking
code from the original service provider, or play around with the
firmware. In general, codes are not easily obtainable and most
people just buy a new handset to use with the new provider.
Please don't email me asking for names of software, how to
override the firmware, or the service programming code (I don't have
the answers to these questions, but there are people that have
successfully done this that lurk in newsgroups or cellular
stores).
Forcing new
profiles: Headset mode: with the phone facing up, locate the contact
bars at the base (there's 7 of them together) and short out between the
1st and 2nd bar on the left hand side (a paperclip works well for this).
Car mode: with the phone turned off short out contacts 2 and 3 from the
left hand side and then turn on the phone while still shorting out the
contacts.Thanks to Bill Acito for these profile
tips
Forcing 800 MHz AMPS network (analog) on the 6185/8: In some
areas EVRC may not be functional yet and you may be able to force analog
mode on this phone by entering *#EVRC# and enabling the Enhanced
Variable Rate Codec. If EVRC is not supported then the 6188 will default
to analog mode. Once you are done using analog mode, disable the EVRC by
repeating the above process to return to digital mode. This trick may also
work on some 6185 models that do not have an analog roaming option in the
Network settings. If your service provider also offers analog or AMPS then
there might be a force analog feature available from the menu.
Forcing other 800 and 1900 MHz CDMA networks from
the 6185/8: If your service provider is using 1900 MHz CDMA (e.g.,
Bell Mobility, Telus Mobility, Sprint PCS, Verizon, Wireless North,
etc...), then you may be able to force your 6185/8 into 800 CDMA mode by
entering *22800 or *22801 and hitting TALK. If you
successfully contact a 800 CDMA network (e.g., Telus Mobility, MT&T
Mobility, Verizon), you will hear a message from that network. Telus'
message is: 'You've reached the customer service centre at Telus
Mobility...'. Hit 3 then 9 to listen to different rate plans from Telus
which will give you a few minutes of looking through all the different
test mode screens. Note that this procedure may take a few times to work
-- you'll get assaulted with a tone if it doesn't. The Nokia 6185/8 allows
you to track other CDMA providers' offset information and more. This is
how the *2280x searches for providers: *22800 - 800 CDMA, Band
A *22801 - 800 CDMA, Band B *22802 - 1900 CDMA, Band
A *22803 - 1900 CDMA, Band B *22804 - 1900 CDMA, Band
C *22805 - 1900 CDMA, Band D *22806 - 1900 CDMA, Band
E *22807 - 1900 CDMA, Band F Thanks to Peter
Harren for providing information on the *2280x forcing
Field Test The test mode display is activated through the test
mode command: *3001#12345#. Once you enter this command, you are
given a list of options, including 'Field Test'. Select Field Test and
then hit 'Enabled'. You must power down the phone and power it up again to
get out of the test mode menu. The test mode screens may vary somewhat
between different firmware versions and providers. Once you power up
the phone you are given a new menu choice at location 10 called 'Field
Test'. There are several different test mode screens. Type in a test
number to get the screen listed below. Alternatively you may use the arrow
buttons to move between the 199 different field test screens. Entering
test number '0' will disable the test mode, but will still allow you to
access the test menu. If you are using the field test mode and are
unsure what the screens mean then hold down the # key for about four
seconds to get a brief description of the screen. Repeat holding the # key
to return to the test mode values. Thanks to L. Tee for
this tip If you would like to see what is behind the test
mode screen then keyguard the phone, wait until the 'press unlock and then
*' screen disappears, and then press one of the numeric keys to see the
regular screen. Thanks to L. Tee for this
tip Note: If you make or receive calls while in test mode,
you may not be able to change the speaker volume. To turn off the field
test mode you can select field test '0' or enter a few digits and then
clear these digits.
Screen 1
CDMA control
CSST CHAN
SP
PPN EC/SO
XF
LOS XHO FR
B
-Rxx-Txx
FER
CDMA traffic
CONV 0450
NP
8000
2
000 0D9 00
0
-093+006
000
AMPS control
RSSI S
D
CHAN P
A
CSST SID
E
XTBY
MINMAX
AMPS traffic
-095 2
3
0273 0
0
CONV 16427
0
Y
CDMA CSST: Cellular
State: IDLE, CONVE, PLIOS, TIME, SYNC, RELE, PAGE, TRFIN,
W_OR. CHAN: Channel NP, NC, SC, SP: xC is for
800 MHz CDMA, xP is for 1900 MHz CDMA. Thanks to J.
Earle for providing this information PPN:
PseudoNoise offset EC/SO: Energy per chip per
noise LOS:Number of times that mobile has been losing the
paging channel during Idle State and entering the System
Initialization State. Thanks to Andry Kolomatsky
for providing this information XHO:Number of
idle handoffs. Thanks to Andry Kolomatsky for
providing this information B: Current
network/frequency. a,b are A and B 800 MHz AMPS (analog). A-F
indicate the digital block in use. Rxx: Receive power in
dB Txx: Transmit power in dB FER: Frame Error
Rate Traffic CODEC's: 8000 - 13 kilobit; 0001 - 8 kilobit;
0003 - EVRC. Thanks to S. Punter for providing this
information
AMPS RSSI: Received
signal strength S: Slot (1-3) D: Digital Colour
Code on analog control channel (0-3 or - for not
locked) CHAN: Channel P: ?? A:
?? CSST: Cellular State: IDLE, CONVE, PLIOS, TIME, SYNC,
RELE, PAGE, TRFIN, W_OR. SID: System ID E:
?? XTBY: ?? MINMAX: Minimum and Maximum RSSI
over last time period?
Screen 2
CDMA control
PN1
ECK
CDMA traffic
PN1 PN3
PN5
ECK ECK
ECK
PN2 PN4
PN6
ECK ECK
ECK
AMPS control
X F S N N
C
SLEEP
EMC
SCC STC
M
RSSCPLCC
CAL
AMPS traffic
2 2 1 0 4
1
00015F927B13
0029B 0A0
2
140 372
0000
CDMA PNx: CDMA PN
offsets handoff candidate listing. Shows only the current offset
while idling. Shows 1 to 6 additional choices during
traffic. Telus (East) and some converted Clearnet>Telus
(West) PN offsets: divisible by 6, separated by 168. Telus
(West) PN offsets: divisible by 4, separated by 160. Bell
Mobility's PN offsets divisible by 6 and grouped in sequence X,
X+6, X+12 (e.g., 006, 012, 018) with 28 different
configurations Sprint PCS offsets: divisible by 2,
separated by 170. If you are using another provider, please
let me know what the offsets separations are. See the Sony field
debug mode page for more information on CDMA offsets.
AMPS ??
Screen 3
OWNNUMBER
ESN-00000000
ESN-HEX
SL P MD
PC
OWNNUMBER: Your phone number, 10
digits ESN: Electronic Serial Number ESN-HEX:
ESN in hexidecimal SL: ?? P: ?? MD:
[AD] at 1900 CDMA; [DI] at 800 CDMA. PC:??
line 1: [17500]: Telus Mobility East SID (System
Identification), [16422] for Telus Mobility West, [16420] Bell
Mobility, or [16xxx odd number] for Rogers AT&T. [00000]: Second
SID assignment line 2: Cellular ID as defined at the
switch Michael Lachance emailed me the decoding scheme for the
CID value: The way to calculate the ID from this value is very
simple: take the number in decimal written on your phone (e.g.,
04787) and convert it to HEX format to give 12B3. The first 3 digits
are the CELL_ID, which is 12B or 299 in decimal form. This is the
cell number in the switch. The last number (3) is sector 3 of that
cell site. You can have 0 (Omni), 1 (Sector X or Alpha), 2 (Sector Y
or Beta) and 3 (Sector Z or Gamma). Now my tests using my 6188
yielded a CID of 55297 or D801, gives a value of 3456 which makes no
sense at all. The site yielded from this reading is known as
Clearnet BC201, beta cell or the CID should be 03218. Forcing the
phone to use Telus 1900 CDMA gave 01240 or 4D8, but no last digit
with the cell number. Comments anyone?
lines 3,4: CDMA specs. [ANSI-J-008] for 1900 MHz CDMA, [TSB74] or
[IS-95] for 800 MHz CDMA. A [005] on line three signifies that the
site is equipped with 1X data services. Thanks to
Dean Hoisak for this info
Screen 7
CSST
MMDDYY
HHMMSS
line 1: [IDLE], [CONVE], [PLIOS], [TIME], [SYNC],
[RELE], [PAGE], [TRFIN], [W_OR]: current phone status lines 2,3:
CDMA Network date (MMDDYY) and time (HHMMSS)
Screen 8
TADD
TDROP
TCOMP
TTDROP
WW1 WW2
WW3
line 1: [TADD]: threshold to add a new active PN (raw
value ex: 28 = Ec/Io at -14 dB), [TDROP] : threshold to drop an
active PN (raw value ex: 32 = Ec/Io at -16 dB) line 2: [TCOMP]:
an other threshold to add an active PN when a candidate PN becomes
stronger than an active PN, [TTROP]: timer to drop a PN when power
of this PN goes below TDROP line 3: [WW1]: value of the seach
window for the active PN, [WW2]: value of the search window for the
neighbour PN,[WW3]: value of the seach window for the remaining PN.
Screen 9
006 330
270
047 062
062
342 102
030
062 062
062
Tracked PN Offsets (3 values on lines 1,3) and EC/SO
(3 values on lines 2,4 - Energy per chip per noise). An EC/SO of 062
likely means not really usable? lower numbers are better strengths).
See screen 2 for PN offset information.
Screen 10
414 084
222
062 060
062
420 366
252
062 062
062
Like Screen 9
Screen 11 - sometimes only during CONV
162
054
062
062
186
084
062
051
Like Screen 9. Screens 12-13 may show similar values
as well.
Screen 41
BATT
CAPA
BATT
VOLTAGE
BATT
TEMP
BTTYPE
CHRGR
line 1: Battery capacity. '1600' for a 1500 mAh;
'984' for a 900 mAh, and '1000' for a 880 mAh. line 2: Battery
voltage (x100). Phone shuts off at 3.1 volts line 3: Battery
temperature in C line 4: Battery type (1500 mAh=2; 900 mAh=1; 880
mAh=5; vibration=6) and charge status: 0=not charging; 1=charging
with quick charger; 2=charging with desk charger. Thanks to both Serge Loranger and Chris Smith for
providing info on this screen
Screen 42
BATVOL
CHMOD
BTEMP
CHTIME
CHRGVOL
PWM
BTYP
BFDC
line 1:Voltage (x100) and battery type
the four-digit number in the BFDC field counts down
while the battery charges. When it reaches zero, the battery pack is
considered charged.
Screen 43
MTDIF
MPDIF
BUPV
BDOWNV
AVERV
SUMMF
Screen 44
DERIC
CHAM
VDIF
VDROP
VDTI
AVDIF
TEMP
VOLT
Screen 45
TXON
TXOFF
CHCUR
STDBY
AGE CAP
CURR
TMP
CMAHTARG
Row 3: 'CURR' gives current drain: Drain examples:
digital, idle, backlight off = 0011; digital, idle, backlight =
0093; analog, idle, backlight off = 0103; analog, idle, backlight on
= 0187; searching, backlight off = 0160-0200; analog (fringe), talk
= 0933; digital, talk, backlight on = 0275 Note the
differences between digital and analog standby currents -- over 9x
higher for analog! Thanks to Dominic Richens
for providing this info
Screen 46
BAND CLASS
a
CS
SUBSTATE
EM
STATEnnn
TX POWER
DB
Row 1: BAND: C= 800MHz CDMA, P=1.9GHz CDMA, A=800MHz
AMPS Row 2: ACTIVITY: IDLE, CONVE, PAGE, PILOS, TIME_, SYNC_,
RELE, etc Row 3: EM (?): SLOT 1, SCANNING, RATE 1 (8k codec),
RATE 2 (13k codec) or EVRC. Row 4: TX power: usually between
-75dB and +4dB Thanks to Howard Chu for
providing this info
Screens 51 through 54
TASK0
0134
TASK1
015C
TASK2
0138
TASK3
0170
Screens 52-54 give task numbers 4-15
Screen 57
16:3A
32:26
64:18
128:21
168:14
264:0E
Screen 57
16:XX
32:XX
64:XX
128:XX
168:XX
264:XX
Screen 58
384:02
512:02
752:02
Screen 59
TMRERR
TH LT ID
IM
Screen 61
Version
430SD3a2.nef
05/18/1999
NSD-3AX
Phone version and date
Screen 62
DSP ROM
2
DSP ROM
VERS 430
BETA ROM
VERS 0014
Screens 63-65
C1M
00
C1L
00
C2M
00
C2L
03
On some handsets these lines are displayed as 1:CAFE
R1 MSB; 2:CAFE R1 LSB; 3:CAFE R2 MSB; 4: CAFE R2 LSB Screens 64,
65 give values for C3,4,5,6
Screen 66
CT1
82
CT2
00
RF
23
Screen 67
REC
00
SEND
00
CTR
4C
STA
68
Screen may give values for 1,2: MBUS RCV, SND; 3,4:
UART CR, sr
Screen 68
CNT
00
ACK
00
M1M
B3
Screen may give values for 1: MBUS MSG CNT; 2: MBUS
ASK CNT; 4: MINT1MASK
Other Screens
The following screens were snapped by Howard Chu
using a Telus Mobility 6185 (Version v542b02u3). Also thanks to Luns
Tee (unlocked Sprint 6185 on Verizon; Version 431Sd3a2), Ivan
Tumanov (Sprint PCS), Peter Mucha and Guillaume Gilbert (both using
Bell Mobility) for emailing me with these screens as well. Now does
anyone know what they mean (perhaps data connection info) ??