The information on this page covers secrets and field test functions on both Nokia 6185 and 6188 models plus the Nokia 5185/85i.
Have a question about these tips & secrets or want to share some of your own? Post them on our forums at GeckoBeachForums.com.
Secrets
Change the provider's name to your own welcome message on startup:
Menu-1-3
Change the provider's name on the screen:
Enter *3001#12345#, then select NAM1, ALPHA TAG, and enter in your own text string. Power off to get out of this menu
Quickly switch profiles:
Hit POWER button briefly to select
Keyguard:
Hold down END key for 2 seconds OR Menu + '*' OR Menu + '9'
Phone lock to prevent unauthorized use:
Menu-4-3-2-1, ON, Power off to engage
Setting Speed Dial:
NAMES Softkey, 1-TOUCH DIALING, Pick name out of phone book
Software version:
*#837# or *#VER# or *#9999#
Serial / ESN:
*#92772689# or *#WARRANTY#
Phone reset?
*#SLOT1# or *#SLOT2# (changes value on screen 46, line 3 -- Thanks Andrew S). Also see this page for a more detailed description of the slot cycles.
Phone programming
*#639# (do only if you have programming codes -- Thanks Peter Hartmann)
How do I get the date to show up on my 6185/8 like your phone above? Earlier firmware versions of the 6185/8 do not show the date on the screen. Contact your service provider and ask for a firmware upgrade of your phone (this is free service -- no authorized dealer that can upgrade firmware should charge you to do this).
How do I use my Sprint 6185 on Verizon (or Bell, Telus, etc)? You need to have an unlocked phone to switch providers. See the general Nokia secrets page under SP-lock status. If your phone is locked then you may try unlocking it with various software programs available on the internet to generate unlocking codes (enter any codes generated from this programs at your own risk), attempt to get the unlocking code from the original service provider, or play around with the firmware. In general, codes are not easily obtainable and most people just buy a new handset to use with the new provider. Please don't email me asking for names of software, how to override the firmware, or the service programming code (I don't have the answers to these questions, but there are people that have successfully done this that lurk in newsgroups or cellular stores).
Forcing new profiles: Headset mode: with the phone facing up, locate the contact bars at the base (there's 7 of them together) and short out between the 1st and 2nd bar on the left hand side (a paperclip works well for this). Car mode: with the phone turned off short out contacts 2 and 3 from the left hand side and then turn on the phone while still shorting out the contacts.Thanks to Bill Acito for these profile tips
Forcing 800 MHz AMPS network (analog) on the 6185/8: In some areas EVRC may not be functional yet and you may be able to force analog mode on this phone by entering *#EVRC# and enabling the Enhanced Variable Rate Codec. If EVRC is not supported then the 6188 will default to analog mode. Once you are done using analog mode, disable the EVRC by repeating the above process to return to digital mode. This trick may also work on some 6185 models that do not have an analog roaming option in the Network settings. If your service provider also offers analog or AMPS then there might be a force analog feature available from the menu.
Forcing other 800 and 1900 MHz CDMA networks from the 6185/8: If your service provider is using 1900 MHz CDMA (e.g., Bell Mobility, Telus Mobility, Sprint PCS, Verizon, Wireless North, etc...), then you may be able to force your 6185/8 into 800 CDMA mode by entering *22800 or *22801 and hitting TALK. If you successfully contact a 800 CDMA network (e.g., Telus Mobility, MT&T Mobility, Verizon), you will hear a message from that network. Telus' message is: 'You've reached the customer service centre at Telus Mobility...'. Hit 3 then 9 to listen to different rate plans from Telus which will give you a few minutes of looking through all the different test mode screens. Note that this procedure may take a few times to work -- you'll get assaulted with a tone if it doesn't. The Nokia 6185/8 allows you to track other CDMA providers' offset information and more.
This is how the *2280x searches for providers: *22800 - 800 CDMA, Band A *22801 - 800 CDMA, Band B *22802 - 1900 CDMA, Band A *22803 - 1900 CDMA, Band B *22804 - 1900 CDMA, Band C *22805 - 1900 CDMA, Band D *22806 - 1900 CDMA, Band E *22807 - 1900 CDMA, Band F Thanks to Peter Harren for providing information on the *2280x forcing
Field Test
The test mode display is activated through the test mode command: *3001#12345#. Once you enter this command, you are given a list of options, including 'Field Test'. Select Field Test and then hit 'Enabled'. You must power down the phone and power it up again to get out of the test mode menu. The test mode screens may vary somewhat between different firmware versions and providers.
Once you power up the phone you are given a new menu choice at location 10 called 'Field Test'. There are several different test mode screens. Type in a test number to get the screen listed below. Alternatively you may use the arrow buttons to move between the 199 different field test screens. Entering test number '0' will disable the test mode, but will still allow you to access the test menu.
If you are using the field test mode and are unsure what the screens mean then hold down the # key for about four seconds to get a brief description of the screen. Repeat holding the # key to return to the test mode values. Thanks to L. Tee for this tip
If you would like to see what is behind the test mode screen then keyguard the phone, wait until the 'press unlock and then *' screen disappears, and then press one of the numeric keys to see the regular screen. Thanks to L. Tee for this tip
Note: If you make or receive calls while in test mode, you may not be able to change the speaker volume. To turn off the field test mode you can select field test '0' or enter a few digits and then clear these digits.
Screen 1
CDMA control
CSST CHAN SP
PPN EC/SO XF
LOS XHO FR B
-Rxx-Txx FER
CDMA traffic
CONV 0450 NP
8000 2
000 0D9 00 0
-093+006 000
AMPS control
RSSI S D
CHAN P A
CSST SID E
XTBY MINMAX
AMPS traffic
-095 2 3
0273 0 0
CONV 16427 0
Y
CDMA CSST: Cellular State: IDLE, CONVE, PLIOS, TIME, SYNC, RELE, PAGE, TRFIN, W_OR. CHAN: Channel NP, NC, SC, SP: xC is for 800 MHz CDMA, xP is for 1900 MHz CDMA. Thanks to J. Earle for providing this information PPN: PseudoNoise offset EC/SO: Energy per chip per noise LOS:Number of times that mobile has been losing the paging channel during Idle State and entering the System Initialization State. Thanks to Andry Kolomatsky for providing this information XHO:Number of idle handoffs. Thanks to Andry Kolomatsky for providing this information B: Current network/frequency. a,b are A and B 800 MHz AMPS (analog). A-F indicate the digital block in use.
Rxx: Receive power in dB Txx: Transmit power in dB FER: Frame Error Rate Traffic CODEC's: 8000 - 13 kilobit; 0001 - 8 kilobit; 0003 - EVRC. Thanks to S. Punter for providing this information
AMPS RSSI: Received signal strength S: Slot (1-3) D: Digital Colour Code on analog control channel (0-3 or - for not locked) CHAN: Channel P: ?? A: ?? CSST: Cellular State: IDLE, CONVE, PLIOS, TIME, SYNC, RELE, PAGE, TRFIN, W_OR. SID: System ID E: ?? XTBY: ?? MINMAX: Minimum and Maximum RSSI over last time period?
Screen 2
CDMA control
PN1
ECK
CDMA traffic
PN1 PN3 PN5
ECK ECK ECK
PN2 PN4 PN6
ECK ECK ECK
AMPS control
X F S N N C
SLEEP EMC
SCC STC M
RSSCPLCC CAL
AMPS traffic
2 2 1 0 4 1
00015F927B13
0029B 0A0 2
140 372 0000
CDMA PNx: CDMA PN offsets handoff candidate listing. Shows only the current offset while idling. Shows 1 to 6 additional choices during traffic. Telus (East) and some converted Clearnet>Telus (West) PN offsets: divisible by 3 and grouped in sequence X, Y=X+168, Z=X+336 (e.g. 003, 171, 339) with 56 possible configurations. Telus (West) PN offsets: divisible by 4, separated by 160. Bell Mobility's PN offsets divisible by 4 and grouped in sequence X, X+4, X+8 (e.g., 004, 008, 012) with 42 possible different configurations. Sprint PCS offsets: divisible by 2, separated by 170. If you are using another provider, please let me know what the offsets separations are.
See the Sony field debug mode page for more information on CDMA offsets.
AMPS ??
Screen 3
OWNNUMBER
ESN-00000000
ESN-HEX
SL P MD PC
OWNNUMBER: Your phone number, 10 digits ESN: Electronic Serial Number ESN-HEX: ESN in hexidecimal SL: System Selection - [AB] = Automatic Band Selection, [A] = Semi-Auto A [B] = Semi-Auto B [H] = Home Area P: Plan Allocation - [A] = Band Plan A (Telus) [B] = Band Plan B (Bell Mobility) MD: This is the current Mode [AD] = Digital (800 and 1900 CDMA) [AN] = Analog. PC: Disappears in Analog Mode. Only a [C] is displayed on a Nokia 5180, and [PC] is displayed on a 6185/6188 phone.
line 1: [17500]: Telus Mobility East SID (System Identification), [16422] for Telus Mobility West, [16420] Bell Mobility, or [16xxx odd number] for Rogers. [00000]: Second SID assignment
line 2: Cellular ID as defined at the switch
Michael Lachance emailed me the decoding scheme for the CID value: The way to calculate the ID from this value is very simple: take the number in decimal written on your phone (e.g., 04787) and convert it to HEX format to give 12B3. The first 3 digits are the CELL_ID, which is 12B or 299 in decimal form. This is the cell number in the switch. The last number (3) is sector 3 of that cell site. You can have 0 (Omni), 1 (Sector X or Alpha), 2 (Sector Y or Beta) and 3 (Sector Z or Gamma).
Now my tests using my 6188 yielded a CID of 55297 or D801, gives a value of 3456 which makes no sense at all. The site yielded from this reading is known as Clearnet BC201, beta cell or the CID should be 03218. Forcing the phone to use Telus 1900 CDMA gave 01240 or 4D8, but no last digit with the cell number. Comments anyone?
lines 3,4: CDMA specs. [ANSI-J-008] for 1900 MHz CDMA, [TSB74] or [IS-95] for 800 MHz CDMA. A [005] on line three signifies that the site is equipped with 1X data services.
Dean Hoisak fills in some of the details for this screen as follows:
Bell Mobility CIDs are re-used in different Geographical regions and NPA's.. For instance the CIDs found in and around Ottawa are re-used in Quebec City. The CIDs found in Montreal are re-used in Toronto. Bell CIDs are grouped in three's (e.g. 03761, 03762, 03763 or 10865, 10866, 10867) If you convert 03761, 03762, & 03763 to hex, they become 0eb1..0eb2, and 0eb3. The 1 at the end corresponds to sector X, 2 = sector Y and 3 = sector Z. The 0e sequence starts at 0e0 and ends at 0ef and the continues at 0f01. Each beginning number of each group of CIDs is spaced 16 numbers apart. The next group of CIDs after 03761, 03762, 03763 would be 03777, 03778, and 03779 and so on. Some Bell Mobility sites have both 1900 MHz and 800 MHz CDMA frequencies. A site with both frequencies will have their CIDs spaced by 4800 (e.g.06065 is the 1900 MHz CID, therefore 10865 would be the 800 MHz CID). Cell sites that have both frequencies will also have different PN Offsets for each frequency range.
Telus Mobility CIDs are also re-used in different geographical regions and NPA's. The lowest CID seen on the screen 6 for sector X is 00256. Sector Y would be X+00256 = 00512 and Z being 00768. In this scenario, sector X can range from 00256 to 00511, sector Y from 00512 to 00767, and sector Z from 00768 to 01023. This type of grouping would repeat again starting with sector X from 01024 to 01279, Y from 01280 to 01535 and Z from 01536 to 01791. Each cluster of CIDs provides 255 possible sites. Converting these CIDs to hex is useless and using the decimal form is much easier to keep track of sites.
Screen 7
CSST
MMDDYY
HHMMSS
line 1: [IDLE], [CONVE], [PLIOS], [TIME], [SYNC], [RELE], [PAGE], [TRFIN], [W_OR]: current phone status
lines 2,3: CDMA Network date (MMDDYY) and time (HHMMSS)
Screen 8
TADD tdROP
TCOMP TtdROP
WW1 WW2 WW3
line 1: [TADD]: threshold to add a new active PN (raw value ex: 28 = Ec/Io at -14 dB), [tdROP] : threshold to drop an active PN (raw value ex: 32 = Ec/Io at -16 dB)
line 2: [TCOMP]: an other threshold to add an active PN when a candidate PN becomes stronger than an active PN, [TTROP]: timer to drop a PN when power of this PN goes below tdROP
line 3: [WW1]: value of the seach window for the active PN, [WW2]: value of the search window for the neighbour PN,[WW3]: value of the
seach window for the remaining PN.
Screen 9
006 330 270
047 062 062
342 102 030
062 062 062
Tracked PN Offsets (3 values on lines 1,3) and EC/SO (3 values on lines 2,4 - Energy per chip per noise). An EC/SO of 062 likely means not really usable? lower numbers are better strengths). See screen 2 for PN offset information.
Screen 10
414 084 222
062 060 062
420 366 252
062 062 062
Like Screen 9
Screen 11 - sometimes only during CONV
162 054
062 062
186 084
062 051
Like Screen 9. Screens 12-13 may show similar values as well.
Screen 41
BATT CAPA
BATT VOLTAGE
BATT TEMP
BTtype ChrGR
line 1: Battery capacity. '1600' for a 1500 mAh; '984' for a 900 mAh, and '1000' for a 880 mAh.
line 2: Battery voltage (x100). Phone shuts off at 3.1 volts
line 3: Battery temperature in C
line 4: Battery type (1500 mAh=2; 900 mAh=1; 880 mAh=5; vibration=6) and charge status: 0=not charging; 1=charging with quick charger; 2=charging with desk charger. Thanks to both Serge Loranger and Chris Smith for providing info on this screen
Screen 42
BATVOL CHMOD
BTEMP CHTIME
ChrGVOL PWM
BTYP BFDC
line 1:Voltage (x100) and battery type
the four-digit number in the BFDC field counts down while the battery charges. When it reaches zero, the battery pack is considered charged.
Screen 43
MtdIF MPDIF
BUPV BDOWNV
AVERV SUMMF
Screen 44
DERIC CHAM
VDIF VDROP
VDTI AVDIF
TEMP VOLT
Screen 45
TXON TXOFF
CHCUR StdBY
AGE CAP CURR
TMP CMAHTARG
Row 3: 'CURR' gives current drain: Drain examples: digital, idle, backlight off = 0011; digital, idle, backlight = 0093; analog, idle, backlight off = 0103; analog, idle, backlight on = 0187; searching, backlight off = 0160-0200; analog (fringe), talk = 0933; digital, talk, backlight on = 0275 Note the differences between digital and analog standby currents -- over 9x higher for analog! Thanks to Dominic Richens for providing this info
Screen 46
BAND CLASS a
CS SUBSTATE
EM STATEnnn
TX POWER DB
Row 1: BAND: C= 800MHz CDMA, P=1.9GHz CDMA, A=800MHz AMPS
Row 2: ACTIVITY: IDLE, CONVE, PAGE, PILOS, TIME_, SYNC_, RELE, etc
Row 3: EM (?): SLOT 1, SCANNING, RATE 1 (8k codec), RATE 2 (13k codec) or EVRC.
Row 4: TX power: usually between -75dB and +4dB Thanks to Howard Chu for providing this info
Screens 51 through 54
TASK0 0134
TASK1 015C
TASK2 0138
TASK3 0170
Screens 52-54 give task numbers 4-15
Screen 57
16:3A 32:26
64:18 128:21
168:14
264:0E
Screen 57
16:XX 32:XX
64:XX 128:XX
168:XX
264:XX
Screen 58
384:02
512:02
752:02
Screen 59
TMRERR
TH LT ID IM
Screen 61
Version
430SD3a2.nef
05/18/1999
NSD-3AX
Phone version and date
Screen 62
DSP ROM 2
DSP ROM VERS 430
BETA ROM VERS 0014
Screens 63-65
C1M 00
C1L 00
C2M 00
C2L 03
On some handsets these lines are displayed as 1:CAFE R1 MSB; 2:CAFE R1 LSB; 3:CAFE R2 MSB; 4: CAFE R2 LSB Screens 64, 65 give values for C3,4,5,6
Screen 66
CT1 82
CT2 00
RF 23
Screen 67
REC 00
SEND 00
CTR 4C
STA 68
Screen may give values for 1,2: MBUS RCV, SND; 3,4: UART CR, sr
Screen 68
CNT 00
ACK 00
M1M B3
Screen may give values for 1: MBUS MSG CNT; 2: MBUS ASK CNT; 4: MINT1MASK
Other Screens
The following screens were snapped by Howard Chu using a Telus Mobility 6185 (Version v542b02u3). Also thanks to Luns Tee (unlocked Sprint 6185 on Verizon; Version 431Sd3a2), Ivan Tumanov (Sprint PCS), Peter Mucha and Guillaume Gilbert (both using Bell Mobility) for emailing me with these screens as well. Now does anyone know what they mean (perhaps data connection info) ??
The test mode display is activated through the test mode command: *3001#12345#. Once you enter this command, you are given a list of options, including 'Field Test'. Select Field Test and then hit 'Enabled'. You must power down the phone and power it up again to get out of the test mode menu. The test mode screens may vary somewhat between different firmware versions and providers.
Forcing other 800 and 1900 MHz CDMA networks from the 6185/8: If your service provider is using 1900 MHz CDMA (e.g., Bell Mobility, Telus Mobility, Sprint PCS, Verizon, Wireless North, etc...), then you may be able to force your 6185/8 into 800 CDMA mode by entering *22800 or *22801 and hitting TALK. If you successfully contact a 800 CDMA network (e.g., Telus Mobility, MT&T Mobility, Verizon), you will hear a message from that network. Telus' message is: 'You've reached the customer service centre at Telus Mobility...'. Hit 3 then 9 to listen to different rate plans from Telus which will give you a few minutes of looking through all the different test mode screens. Note that this procedure may take a few times to work -- you'll get assaulted with a tone if it doesn't. The Nokia 6185/8 allows you to track other CDMA providers' offset information and more.
