Phoenix Rising BBS/phoenixrising.zip/phoenixrising/cellular/celltest.txt

Text File | 1994-10-07 | 22KB | 461 lines

The following file is a verbatim transcript of an article by the
same name appearing in the January, 1993 issue of NUTS & VOLTS
Magazine.  The six (6) accompanying photographs detailing
construction have been omitted.  Copyright (c) 1992 Damien Thorn
and T & L Publications.  Permission is granted to freely
distribute this file in unmodified form.  Identifying board
headers may be added as desired.


                CELLULAR TELEPHONE MANUAL TEST MODE
               How to Build and Use Programming Aids

                         By Damien Thorn




Over the last few months in Nuts & Volts we've taken a close look
at cellular technology.  From an overview of the network to a
"hands-on" tutorial covering cellular telephone reprogramming.
This article introduces the construction and use of a manual test
adapter to assist in reprogramming or diagnosing problems in
various cellular phones.

You can build this device in about five minutes with one part
from your local computer store or Radio Shack.  The simplicity is
elegant, and belies the powerful control you can achieve over
your cellular hardware.  Need to bypass the security code usually
required for programming, or display the relative signal strength
indication (RSSI) on a specific cellular channel?  With a manual
test adapter you're just a few keystrokes away from this and
more.



                                INTRODUCTION

As I mentioned last month, there is little money to be made by
cellular dealers in the sales of equipment.  Hardware prices are
so competitive that most dealers sell new equipment at close to
cost.  Dealers make their profit through commissions for signing
up subscribers for cellular service, and by installation and
repair.

Installing cellular phones is comparable to installing a CB
radio, and less difficult than wiring a car stereo.  Modern
cellular phones are so reliable that the phone itself rarely
needs to be serviced.  Ancillary equipment such as wiring and
antennas are usually the cause of any malfunction.  Probably the
most common service operation is programming.
Whether you are activating cellular service for the first time,
or moving to another city, your cellular phone must be
reprogrammed with specific data supplied by the cellular service
provider (carrier).  Even changing the unlock code on the phone
requires reprogramming in many instances, often associated with a
fee ranging from $15-50.00.
The vast majority of contemporary cellular phones are programmed
by punching in the data right on the keypad without the aid of
any external programming device.  And this service is often
performed by shop personnel with little technical skill.  With a
programming manual in front of her, I watched the receptionist at
a local dealer program a phone that was being exchanged by a
customer.


I use this example to illustrate how easy it is to reprogram a
phone.  There is really no reason you or I cannot perform this
task ourselves and save money.  Reprogramming can also become a
profitable additional service offered by independent technicians.

                                    Motorola's Test Mode

Motorola is probably the largest manufacturer of cellular phones.
In addition to their own brands, they make phones for a plethora
of other companies.  I've always admired the quality of Motorola
communications equipment, and the test mode engineered into their
cellular firmware has scored them a few more points in my book.

The test mode is designed to be of assistance to cellular
technicians in the field, and is entered by grounding a specific
pin on one of the phone's connectors.  Once in test mode, the
technician has manual control over many of the functions normally
automated by the firmware.   The phone display can now be used to
indicate the status of various operational parameters.
The most useful functions to the hobbyist and professional
programmer alike are those which allow the data stored in the
Numeric Assignment Module (NAM) to be reviewed and changed.  This
is not much different from using the standard programming mode,
except no special keyboard sequences and security codes are
required for access.  The manual test mode effectively bypasses
the software "front door" commonly used to enter programming
mode, and is invaluable when the security code is unknown or has
long since been forgotten.
The rest of this article details the construction of a test
adapter and explains its use as applicable to cellular
programming.  From this point on I'm assuming you've read my
previous article or otherwise have at least a basic knowledge of
cellular programming.
The basic style of the Motorola-manufactured phone will determine
how you go about placing the unit in test mode.  Palm-size folded
phones and the one-piece hand held devices do not require and
adapter.  A jumper between the contact designated as the "test
line" and ground is all that is required.


                           Activating Test Mode:  Hand held
Phones
If your phone is one of the hand held types, slide the battery
pack off the unit.  The battery pack also serves as the rear of
the phone's external case.  On the top rear of the phone you
should see twelve contacts arranged in two horizonal rows as
depicted in Photo #1.
Before you go any further, you should look at the model number of
the phone located on the back of the handset.   A typical model
number is "F09FSF9797."  The fourth letter (underlined) in this
string is important.  This indicates the phone is of the Motorola
"F" series and contains firmware that is programmed to allow us
to use the manual test mode.  The older "D" series phones do not
contain the appropriate firmware, and are not even programmable
from the keypad.  Do not attempt this procedure on a "D" series
phone.

Another way to make sure the phone is of the "F"  or higher (G,
H, I, etc.) series as opposed to the older "D" series is to
examine the plastic shroud which extends from the top of the
phone and partly covers the RF switch/antenna connector housing.
The "F" (and newer) series phones have various notches molded
into the plastic shroud as can be seen in the photo.
To reiterate, if the model number contains the letter "D" as the
fourth character, it does not have a test mode, and cannot be
reprogrammed from the keypad.  Do not attempt to place it in test
mode or you may damage the phone.  Once you are certain the phone
is of the "F" or higher series, you may proceed.

The contact which serves as the test line is #6.  This is the
contact to the far right in the upper row, and should be the last
(and sixth) of the contacts comprising the top row of contacts.
Making a connection between this contact and ground will cause
the phone to enter the test mode when powered up.

The most convenient way I've found to accomplish this in lieu of
a special adapter or modified battery pack is to use a small
piece of wire as a jumper.  The short lengths that come with the
Radio Shack RS-232 jumper box we'll be discussing later work
perfectly, right out of the package!


To jump contact #6 to ground, I use a very small jewelers
screwdriver to carefully wedge one of the solder-tinned ends of
my jumper into the space between the contact and the plastic edge
to the right.  The snug fit assures decent electrical contact and
helps keep the jumper in place.  The other end of the jumper is
gently inserted in the crevice on the RF switch housing.  This
bare metal area is the most convenient ground and will even hold
the end of the jumper.

Once you have the jumper connected, you need to flatten it
against the phone so that you can slide the battery back on
without dislodging it.  Photo #2 depicts the jumper in the proper
position to clear the battery pack.

                                   Palm-size Folded Phones
The "Micro TAC" variety of miniature folded phones ("Flip-Fones")
manufactured by Motorola usually require a special battery to
activate the test mode.  You can simulate this battery with your
standard battery, however.

After removing the battery from the phone, you should see three
contacts in a row located in the lower right area of the phone.
The two outer contacts are the battery connections.  Positive "+"
is to the left, and negative "-" is to the right.


The center contact is somewhat recessed and does not make contact
with the standard battery.  Your battery however, should have a
mating third contact present.  To place the phone in test mode,
you need to get the center contact to mate with the center
contact on the battery.  Strategic use of a small piece of folded
metal foil, solder wick or similar conductive material can be
used to extend the center contact on the phone so that it will
make contact with the third terminal of the battery.

If you attempt this procedure, immediately power up the phone to
make sure you have not shorted the battery terminals.  If the
phone does not come on at all or feels warm to the touch, quickly
remove the battery.  A shorted NiCad battery can explode, causing
serious injury.
                              MINI-TR or Silver MiniTac phones
Two specific phones - Motorola's MINI-TR or Silver MiniTac units
can be placed in programming mode by shorting the two contacts of
the hands-free microphone connector.
                         Mobile Installations & Transportable
Phones
These common phones are the type that consist of a handset
connected to a separate transceiver unit by a coiled cable
resembling the receiver cord of a standard landline telephone.
The handset cable is terminated with a modular connector and
plugged in to a jack.  The control cable from the jack carries
the handset, power and options wiring.  This control cable is
connected to the transceiver with a 25-pin DB25 connector as
depicted in Photo #3.
These phones are also placed in manual test mode by grounding the
test line.  The easiest way to accomplish this is by building a
small test adapter (also known as a "programming aid").  This
device is placed between the control cable and transceiver DB25
connectors allowing all the signals to pass through unaffected
with the exception of jumping the test line to audio ground.
                                  Building the Test Adapter
Construction of the test adapter is pretty straight forward.  The
same DB25 connectors used by Motorola have been used for years as
the standard RS-232-C connector on computer equipment.  You can
easily pick up a serial RS-232 inline jumper box from your local
computer, electronics or Radio Shack store.  The part number at
Radio Shack is #276-1403 and lists for $9.95 in their 1993
catalog.

The Radio Shack jumper box is designed for maximum flexibility
and as such does not have any of the pins preconnected.  Each
trace on the circuit board connecting the pins has a small break
which you will need to bridge with solder to allow the signals to
pass through.  Examine the PC board before beginning and follow a
few of the traces.  Note the difference between the break in each
trace and the small solder pads used for connecting jumpers.  You
only need to bridge the traces.



Once you've applied a small dab of solder to restore the
integrity of each trace, you are ready to install the jumper.
The test line on these Motorola phones is pin #21.  Pin #20 is
the audio ground line.  You want to jumper (short) these two
pins.

Small numbers etched on the PC board indicate the jumper point
for each pin.  Locate the numbers 20 and 21 next to the small
solder pads.  Using one of the short jumper wires provided with
the device, place the ends through these two holes and solder
them down on the opposite side of the board.  Photo #4 depicts
proper jumper installation, although I left one end of the jumper
unsoldered to illustrate it going through the board to be
soldered on the other side.
That completes the construction of a handy programming aid for
Motorola cellular phones, and you have a small packet of left
over jumpers that are perfect for jumpering the test line contact
on the hand held units.  Be sure to save them.

To use the test adapter, place it between the control (handset)
cable and the transceiver as shown in Photo #5.

                                     Test Mode Commands

Once you've jumpered the appropriate contact or applied the test
adapter, it's time to turn on the phone.  When the phone powers
up, a series of digits should appear in the display similar to
those shown in Photo #6.  They should alternate with another
series of digits.  This indicates your phone is in the manual
test mode.

One display consists of two numbers, each three digits in length.
The set to the right is the channel number designator for the
specific cellular frequency the phone is receiving from your
local cell site (tower).  The right-most trio is the relative
signal strength indication (RSSI) of the received frequency.

The seven-digit number alternating with the channel/RSSI display
provides the technician with additional status information.  Each
individual digit in the field is actually an independent status
register.  With a letter substituted for each of the seven
digits, this is what they represent:
                                        A B C D E F G

Position A - SAT Frequency.  Indicates which of the three SAT
lock frequencies is being used by the phone.  In this position a
"0" = 5970Hz, "1" = 6000Hz, "2" = 6030Hz, "3" = No SAT lock.
Position B - Carrier Status indication.  "0" = carrier off, "1" =
carrier on. Position C - Signalling Tone.  "0" = tone off, "1" =
tone on. Position D - RF Power Attenuation Level.  "0" through
"7" are valid values. Position E - Channel designation.  A "0" =
voice channel, "1" = control data channel. Position F - Audio
Mute (receive).  "1" = received audio is muted, "0" = unmuted.
Position G - Audio Mute (transmit).  "1" = transmitted audio is
muted.  "0" = unmuted.
The meaning of all these status registers is fairly complex and
has no bearing on cellular reprogramming.  This display, like the
majority of the test commands, are only of value to an engineer
placing the phone under test with a cellular service monitor.
Table "A" lists the test commands that can be of assistance in
reprogramming.  I have omitted the test commands designed for use
with a service monitor, as issuing them without the phone
connected to a monitor may cause interference to the cellular
network.  You may own the phone, but the cellular provider owns
the FCC license that allows you to use it.  Operating the
transmitter in the phone in a manner inconsistent with this
license could subject you to loss of service and possible legal
trouble.

                                      Issuing Commands

If your phone did not come up with the status display described
above, you may need to manually instruct the phone to do so.
Pressing "#" enters the test command mode, and "02#" is the
command to display the status registers.  If you enter a command
improperly, the phone will scroll the word "error" across the
display.

If you need to review the current programming data stored in the
NAM, enter "55#" which instructs the phone to enter the
programming mode.  You can scroll through the contents of NAM
displaying the stored values by repeatedly pressing the "*" key.
Actual reprogramming through this mode is considerably more
difficult than through the standard programming mode.  The test
mode does not display a step number to let you know what
programming step you are at, and the information is stored and
displayed in a different order.
Many programmers simply use this mode to obtain the security
code, exit test mode and program the phone in the normal fashion.
As you step through the NAM contents with the "*" key, the
security code is the only six-digit number you'll see that isn't
binary.  Once you've written it down, continue to step through
NAM until you see the "tick mark" in the display (it looks like
an apostrophe) and exit test mode by turning off the phone.

Motorola designed their phones so that they could only be
programmed three times.  I don't know the rationale for this, but
a firmware counter increments each time the phone is
reprogrammed, and after the third time it will no longer enter
programming mode.  The instruction booklet that accompanies the
phone instructs you to take it to the dealer where you bought it.

If you took the phone to a dealer, they would put the phone in
test mode (just like we're doing) and enter the command "32#"
which resets the counter to zero, allowing the phone to be
reprogrammed three more times.  Do it yourself and save!

Many phones also have a cumulative call timer that counts the
total number of minutes the phone has been used for calls
(actively transmitting).  This "autonomous timer" (that you were
told was not resetable) can be cleared and reset to zero by
punching in "03#" while in test mode.
Another useful command is "38#" which causes the phone to display
the Electronic Serial Number (ESN) that is burned in ROM.  The
phone will display the ESN one hex byte at a time.  Press "*" to
increment to the next byte.  Note that the display shows four
numbers.  The two to the left indicate which byte you are viewing
(00, 01, 02 or 03), and the actual value of that byte is at the
right of the display.

You can punch in "19#" if you'd like to view the software version
number resident in your phone.

                                         Conclusion

You should now have an understanding of the test mode inherent in
cellular phones manufactured by Motorola, and if you've followed
this series of articles in recent issues of Nuts & Volts, the
operation of the cellular network and reprogramming procedures
are no longer so mysterious.
Your questions and comments are always welcome, and you can write
or send E-mail directly to me as mentioned below.  If plan to do
much programming or would like detailed information on the
cellular network, you would benefit greatly by investing in one
of the detailed technical publications offered in these very
pages.  I've listed the publishers of several good volumes in a
sidebar, and you'll find their ads scattered throughout this
magazine.
As a final note, you should be aware that the use of this
information is undertaken at your own risk.  Although most of
this information was triple-checked against available technical
documentation, none of it originated directly from Motorola.  I
doubt you'll have a problem, but you never know when a
manufacturer might change their specifications.
*****************************************************************
*************

                                  TEST MODE COMMAND SUMMARY

The following is a summary of some of the commands available from
within the test mode on most cellular phones manufactured by
Motorola.


COMMAND              DESCRIPTION

       #             Initial keystroke to enter test command
mode.    01#        Reboot phone (begin power-up routine).
   02#        Display status registers.
   03#        Reset "autonomous timer" to zero minutes.
   04#        Initialize transceiver.
   07#        Mute audio (received).
   08#        Unmute audio (received).
11XXX#               Load frequency synthesizer with specific
cellular channel (XXX = 3-digit                      decimal
channel designator).
   13#        Power down the phone (off).
   19#        Display software version number.
   32#        Initialize NAM.  Erases all programmed data! 36XXX#
             Activate channel scanning.  Pauses on each channel
for XXX milliseconds.                       Keying "#" aborts
scanning.
   38#        Display Electronic Serial Number (ESN).
   45#        Display current relative signal strength (RSSI) of
currently loaded channel.    53#        Enables scrambler option
if phone is equipped.    54#        Disables scrambler option if
phone is equipped.    55#        Programming mode -
display/change NAM contents.



*****************************************************************
*************

                              Sources of Additional Information


The following companies distribute publications that offer
detailed instructions and information pertaining to cellular
programming and various aspects of cellular hardware:
Spy Supply
7 Colby Court, Suite 215
Bedford, NH 03110
[phone]


TeleCode
P.O. Box 6426
Yuma, AZ 85366-6426
[phone]


Consumertronics
2011 Crescent Drive
P.O. Box 88310
Alamogordo, NM 88310
[phone]






*****************************************************************
*************


                                      AUTHOR BIOGRAPHY

                                      (For publication)



Damien Thorn's interest in electronics has deep roots.  A noted
"hacker" and "phone phreak" by age sixteen, he contributed
regularly to the underground newsletter "TAP."   Today Damien is
an on-air radio personality and FCC licensed engineer in
California's San Joaquin Valley.  His interests include
computers, communications, security and privacy issues.  He
welcomes questions and comments.  You can reach him at 6333
Pacific Ave. #203, Stockton, CA 95207-3713 or via E-Mail as
[e-mail] via the Internet.