Test 30
Audio API register display

aaaa bbbb  cccc dddd  eeee ffff  gggg hhhh

A1Cnf  A2Cnf   ST   AU3 1Tone  2Tone  Conf  HFVol

• aaaa - API_AUD1_CTRL
• bbbb - API_AUD2_CTRL
• cccc - API_SIDETONE
• dddd - API_AU3
• eeee and ffff - API_1_TONE and API_2_TONE (see description below)
• gggg - API_CONFIG: connected with sound setting from test 71 and 72: you will see here number (hexadecimal), which was displayed there below AUDIO ENHANCEMENT (in last selected menu). Here are some examples:

  normally (for example during standby)	wybieranie numeru	call
  5148 (cracks) - 20808 decimal	5149	5140
  851A - 34074 decimal	851B	8512
  C6A4 (cracks) - 50852 decimal	C6AD	C6A4
  DB34 (cracks) - 56116 decimal	DB3D	DB34
  DF29 (after enabling phone) - 57129 decimal	DF29	DF20
  F436 - 62518 decimal	F43F	F436
  F437 - 62519 decimal	F43F	F436

• hhhh - API_HF_VOL: volume during call - you will count it from the "110 - hhhh" formula (subtract value of this parameter from 110). It's displayed too (during call only) in test 76. When you connect headset, values here change - volume can be count from "510 - hhhh" formula then (for car kit use "2210 - hhhh"). Type of connected audio accesories can be checked in test 75 too. Phone remembers volume for each audio accesory separately.

When you press any key, phone generates sound, which consist of two tones. Parameters eeee and ffff change then. First tone is short, second is emited all time, when you press key. When you press C, NaviKey, Up or Down keys, change parameter eeee only (value 0E10 - 3600 decimal) - sound consist of one tone only. And now the most important thing: you will divide displayed in these parameters values by 4, you will have frequencies in Hz conncected with pressing adequate keys in DTMF (Dual Tone Multi Frequency) system. I think, you use DTMF very often - it's used in tone system in all modern phones during calling number. Adequate values are in table (decimal) - parameter eeee is connected with vertical values, ffff with horizontal:

	1209 Hz	1336 Hz	1477 Hz
697 Hz	1	2	3
770 Hz	4	5	6
852 Hz	7	8	9
941 Hz	#	0	*

Test 32

Test from Nokia 6250 (no help):

0       0002922 3000 0205714

In 4'th line there is clock. Example: 0205714 means 20 hours 57 minutes 14 seconds of the day ...

Test 34
Information about FBUS connection between phone and computer.

aa bb cc dd eee fff ggg hhh iii jjj  k

CM LD LM NM  PEC FEC OEC ACC RXS TXS  Mod

• aa - current fbus media in hex
• bb - last sender dev in hex
• cc - last sender media in hex
• dd - next media to be connected. Same as aa if the connection is not pending
• eee - fbus parity error counter
• fff - fbus framing error counter
• ggg - fbus overrun error counter
• hhh - fbus alive check counter
• iii - received sequence number
• jjj - sent sequence number
• k - phone mode: S=slave, H=host

Description above is from some English documents. As you can see in some phones (like Nokia 5110) values in this test looks rather different, but help is the same. But, when you make connection with FBUS cable and make transmission, first line of values in this test changes to "1E0C1E -". When you will look into some FBUS protocol descriptions, you will see, that:

• "1E" could mean datas send with FBUS protocol over cable
• "0C" could mean, that FBUS cable is connected to phone

and it's the truth. So, it means, that this description is real (even, that test looks a little different).

Observation from Nokia 6150:

aabbccdd     eeffgghh i j kk l-m

• aabbcc:
  • 000000 - no transmission after enabling phone
  • 1E0C1E - there was FBUS transmission
  • 140000 - there was infrared connection using NBS (business card, calendar entry, etc.)
  • 1C7F1C - there was 2-players snake game (host)
  • 1C001C - there was 2-players snake game (slave)
• hh: 0 - no infrared transmission in this moment
• i: increases for example after each sending data using infrared and NBS or ending transmission
• j: P - infrared enabled, searching next device (blinking indicator in phone)
• l: H - host in infrared transmission; S - slave in infrared transmission
• m: T - infrared enabled, connection terminated (blinking indicator in phone)

In Nokia 9110 this menu looks different:

ll mm nn oo  ee ff gg p  q r s tt

PA RS DR PR  PE FE OE Rx Tx D U DC

• p and q are probably iii and jjj

Links to pages with FBUS (MBUS) protocol are in the question 25.

If values in this test changed after enabling phone, it means, that it was connected to computer and datas were transmitted with FBUS protocol (not MBUS).

Test 35
Reason of last reboting internal firmware of phone.

aaaaa        bbbbbbbb

Reset reason Task name

• aa - reason:
  • NORM: probably normal power up
  • UNKNO: default value, reset reason is unknown
  • SWSIM: SIM contact failure reset. Shown, when phone has simlock and wrong mastercode was entered.
  • STACK: task stack overflow
  • SWIDL: idle task not running reset
  • HW lub WD: ASIC watchdog timeout. SW WD in Nokia 3310 ?
  • SWDSP: restart DSP recovery reset

• bbbbbbbb - name of running task before reset (for example, "AUD TASK", "CC TASK" (confirmed), "DDI TASK", "DEV IO" (confirmed), "EM TASK", "FBUSTASK" (confirmed - after errors in cable transmission), "L1 CONTR", "L1 MEAS", "L1 SYSPA" (confirmed), "L2 TASK", "LOCAL" (confirmed - shown, for example, when phone had to restart because of error in firmware), "MDI RECE" (confirmed), "MDI SEND" (confirmed), "MM TASK" (confirmed), "OS IDLE" (confirmed), "PN TASK" (confirmed), "RR TASK" (confirmed), "RM TASK", "SIM L2" (confirmed), "SIM UPL" (confirmed), "SMS TASK" (confirmed), "TONETASK", "UI TASK" (confirmed) "PND TASK" (for example Nokia 6210), "WMLSTASK" (for example Nokia 6210), "IRDATASK" (for example Nokia 6210), "IRDA MGR" (for example Nokia 6210), "PH TASK" (for example Nokia 6210), "DGC TASK" (for example Nokia 6210), "DGNTB TA" (for example Nokia 6210), "DGFAX TA" (for example Nokia 6210), "SCKT SRV" (for example Nokia 6210), "PMM CLUP" (for example Nokia 6210), "PMM WRBA" (for example Nokia 6210), "ND TASK" (for example Nokia 6210), "PPC TASK" (for example Nokia 6210), "No task!" (for example Nokia 6210) or "UNKNOWN" (confirmed - after normal phone enabling)). We can notice, that tasks names are similiar to names in help to tests 84-86.

Test 36
Reasons of last reboting internal firmware of phone (you will find here information, how many times phone made restarts because of reasons from previous test).

aa  bb  cc   dd  ee  ff

UN  WD DSP  SIM IDL STK

• aa - unknown resets
• bb - ASIC watchdog timeout resets (in some you can simulate it - see question 9 for details)
• cc - DSP recovery resets. In Nokia 3310 displayed also in test 130.
• dd - some English descriptions say, that it's connected with SIM contact failure reset (in some phones you can force reset because of this reason - see question 9). I noticed too, that this counter increases when to try to enter mastercode connected with simlock level 1 using #pw+2222222222+1# code (where mastercode is instead of 2222222222), when your phone has simlock.
• ee - idle task not running resets
• ff - task stack overflow resets

Counters are stored to EEPROM.

In Nokia 3310 some counters (DSP only ?) are displayed from end (for example, 01 is displayed as 10, 02 as 20, etc.)

You can reset counters from this menu using some Nokia service programs - for example, in Pc-Locals 1.3 enter to menu 8 ("Event Trace"), menu 5 ("Permanent Counter Table...") and press F6 key ("Clear Counters"). Unfortunatelly :(, "real" counters connected with mastercode entering attempts (Counter for example in WinTesla and WinLock) don't reset then...

Test 38
Memory dump

aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa

Memory dump

• aaaa.... - hex dump of 24 successive memory locations

The start address of the dump is entered as 6 digit address value into location 30 into phonebook on SIM card (information, how to make it, are in test 17). An example: for address 0x0C89AB enter 0C2089AB value there... Dump address is changed only when you directly enter to this menu.

This display rather is not included in offcial firmware (I found only one phone with it). It can be switched on by defining flag DEV_FT_MEMORY_DUMP_IN_USE in ftd_conf.h.

Test 39
Reason of last connection end (asterisk means, that the diagnosis won't be sent to the network - it'll be only shown in phone) and making Location Update:

CC:   aaa    MM:   bbb  RR:   ccc

CC CauseValu MM CauseValu RR CauseValu

• reason from the CallControl-Layer - it's displayed in test 2 and test 63 too:
  1. from the GSM specifications (section 10.5.4.11/GSM 04.08):
     •  1: unassigned (unallocated) number
     •  3: no route to destination
     •  8: operator determined barring
     • 16: normal end of call (you were speaking or you heard some text - that dialled number was busy or something similiar)
     • 17: user busy
       • if it was outgoing call, dialled number was busy (phone even displayed 'Number busy')
       • if it was incoming call, a man, who dialled to you, heard busy signal - you were speaking or you rejected it (in Nokia 5110 or 5130 to make it you have to press C key, in Nokia 6110, 6130 or 6150 red receiver)

     • 18: no user responding
     • 19: user alerting (from specification - I had it with normal connection too (phone displayed 'No answer' ('Nie odpowiada')) or when incoming call was diverted to voice mailbox), no answer
     • 21: call rejected
       • phone wasn't in network coverage (message 'No coverage network'), when you tried to make call
       • you tried to call to non existing phone number or you heard busy signal

     • 22: number changed
     • 27: destination out of order
     • 28: invalid number format/number incomplete. Phone displayed 'Invalid phone number'
     • 31: unspecidied. It seems, that with this error connection is end by network (for example, when it's overcharged). Shown sometimes too, when you call for not supported for some tariffs numbers.
     • 34: no circuit/channel available to make call. Phone displayed 'Network busy'. I noticed too, that in my network RR value changed to 1 with this error. More about situations, when network is busy, I write in TS description.
     • 38: network out of order
     • 41: temporary failure
     • 42: switching equipment congestion (message "Network busy")
     • 44: requested channel not available
     • 47: ressource unavailable. I had it, when connection was "brutal" broken. Concrete: during call phone of my interlocutor disabled because of empty battery. My phone displayed 'Error in connection'
     • 50: requested facility not subscribed (you must subscribe it to use it) In some networks shown too, when you set not supported by network function (for example, "Own number sending" in Era-GSM network). Message "Check operator services".
     • 65: bearer service not implemented
     • 68: ACM equal to or greater than ACMmax
     • 69: requested facility not implemented
     • 88: incompatible destination

  2. from mine (and not only) experiences:
     •  28: I had it, when phone number was too long
     •  57: no asynchronous data transmission allowed (concrete: phone wasn't able to connect to WAP from this concrete SIM card)
     •  63: "Poza zasiêgiem sieci"
     • 79: error with message 'Check operator services'. You have it, when you enable ALS (Alternative Line Service) function, don't have second number on SIM card, select it and try to make call
     • 111:'Error in connection'

• reason from the MobilityManagement-Layer - it's shown in test 64 too. It's from GSM specification (section 10.5.3.6/GSM 04.08):
  •  2: IMSI unknown in HLR (SIM card not active in network)
  •  3: illegal phone
  •  4: IMSI unknown in VLR
  •  5: phone's IMEI was not accepted
  •  6: illegal ME
  • 11: PLMN not allowed (you tried to log into network, which doesn't have roaming convention with your home network - your phone displays 'No access', when you try to select it manually; I don't know only, if this code is displayed only, when this network is saved on forbidden list on SIM card (see test 6)
  • 12: Location Area not allowed. You can check it in test 11.
  • 13: roaming not allowed in this Location Area
  • 17: network failure
  • 22: network congestion
  • 32: service option not supported
  • 33: service option not subscribed
  • 34: service temporarily out of order
  • 38: call cannot be identified (call RE)

• reason from RadioRessourceManagement-Layer) - see GSM specifications: section 10.5.2.31/GSM 04.08:
  •   0: normal release
  •   1: unspecified
  •   2: channel unacceptable
  •   3: timer expired
  •   4: no activity on the radio path
  •   5: Pre-emptive release
  •   8: handover impossible, TA out of range
  •   9: channel mode unacceptable
  •  10: frequency not implemented
  •  65: call already cleared
  •  97: message type not compatible with protocol state
  • 101: no cell allocation available
  • 111: protocol error unspecified

When you will see "*" before third parameter from this test, it means (the most often), that call is in progress. Sometimes phone displays different values - I don't know their meaning :-(.

Values of counters are not saved in EEPROM. When phone makes another measure, doesn't reset them (changes only these values during next measure, which are connected with it; doesn't change the rest of them).

This test allows to find, why exactly your phone doesn't want to work - doesn't want to make calls.

Test 40
Resets handover counters (by direct enter)...

RESET   HANDOVER     COUNTERS

Use menu     to reset   handover   counters

Test 41
Information about handover

Handover - it's transfer of radio connection (between phone and cell) from one cell to another (without breaking call). It's made, when:

1. new radio connecting will give better quality (it's parameters are all the time checked by phone and base station)
2. when phone is between few cells and can use "new" cells for him (it frees some place for phones, which can use "old" cell only)

When they're problems with transmission, decision about handover is made by phone (otherwise it's made by BSC). If you enabled using one channel by phone (test 17), handovers are not made.

There are 4 types of handovers:

• Intra cell - Intra BSC handover (called handoff too): it's the smallest handover inside one cell. Receiver is "thrown over" from one channel to another (gennerally to another frequency inside one cell). Decision, if it should be done, is made by BSC.
• Inter cell - Intra BSC handover: receiver is moved from one cell to another. Decision about it is made by BSC. Connection with first cell is broken after moment, when connection with another is made (displacement between two BTSes inside one BSC).
• Inter cell - Inter BSC handover: displacement of connection between two cells, which are not served by the same BSC. In this case handover is moved by MSC, but decision about it made by first BSC. Connection with first BSC (and BTS) is broken before moment, when connection with another BSC (and BTS) is made.
• Inter MSC handover: receiver moves from cell served by MSC/VLR to another controlled by another MSC/VLR. It's more complicated situation. We can notice, that MSC is connected to GSMc over PSTN. In this case is visible, that another MSC can't receive information from first normally.

  What will happen, when connection will be moved to target MSC/VLR ?

  Because both MSC belongs to the same network, connection is kept. To move it from one to another MSC special number HON (HON=CC+NDC+SN, CC - country code, NDC - network code, SN - subscriber's number) must be generated. It's similiar to roaming number (it's connection between two MSC too). During handover between two MSC connection can't be broken (phone connection realised by network's subscriber).

HandOOk: aaa PrevCh : bbb HONotOK: ccc HOIntra: ddd

HandOvOKCntr PrevChanCntr HandOvNOKCnt HOIntraOKCnt

• aaa - counter for successful handovers
• bbb - counter for successful back to previous channel attempts (number of actual used channel is displayed, for example, in test 1)
• ccc - counter for failed handovers
• ddd - counter for successful Intra cell - Intra BSC handovers or assignments

Counters will stop when they reach their maximum (999). To initialize them to zero, use test 40 (or test 60).

In dual phones (like Nokia 6150 or 3210) test 41 looks different and is connected with Inter cell - Intra BSC, Inter cell - Inter BSC and Inter MSC handovers:

aaaa  bbbb  cccc  dddd eeefffggghhh iiijjjkkklll

G>G InterD>D G>D  OK  D>G InterHoFail BackToPrev

• aaa - counter of successful handovers from GSM 900 to GSM 900
• bbb -counter of successful handovers from GSM 1800 to GSM 1800
• ccc - counter of successful handovers from GSM 900 to GSM 1800
• ddd - counter of successful handovers from GSM 1800 to GSM 900
• eee - counter of failed handovers from GSM 900 to GSM 900
• fff - counter of failed handovers from GSM 1800 to GSM 1800
• ggg -counter of failed handovers from GSM 900 to GSM 1800
• hhh - counter of failed handovers from GSM 1800 to GSM900
• iii - counter of successful back to previous channel attempts (number of actual used channel is displayed, for example, in test 1) from GSM 900 to GSM 900
• jjj - counter of successful back to previous channel attempts from GSM 1800 to GSM 1800
• kkk - counter of successful back to previous channel attempts from GSM 900 to GSM 1800
• lll - counter of successful back to previous channel attempts from GSM 1800 to GSM 900

Counters will stop when they reach their maximum (9999 dla dwóch pierwszych linii, 999 dla dwóch ostatnich). To initialize them to zero, use test 40 (or test 60).

In Nokia 3310 sum of all handovers is also displayed in test 131 (?).

In Nokia 3110 this test looks like follows:

HandOOk: aaa  PrevCh : bbb  HONotOK: ccc  T200: eeee

HandOvOKCntr  PrevChanCntr  HandOvNOKCnt  T200Cntr

• eeee - I write about T200 counter in test 43

and here's for Nokia 6185/6188:

BSI 01000 VBAT 388 BTEMP 018 BATT 2 CHG 0

• VBAT - battery voltage (/100V)
• BTEMP - battery temperature in C
• CHG - battery charge status: 1 - charging, 0 - not charging

Test 42
This test is in dual phones (for example, Nokia 6150 or 3210) only and is connected with first kind of handovers (Intra cell - Intra BSC):

aaaa  bbbb  cccc  dddd eeefffggghhh iiijjjkkklll

G>G IntraD>D G>D  OK  D>G IntraHoFail BackToPrev

• aaaa - counter of successful Intra cell - Intra BSC handovers from GSM 900 to GSM 900
• bbbb - counter of successful Intra cell - Intra BSC handovers from GSM 1800 to GSM 1800
• cccc - counter of successful Intra cell - Intra BSC handovers from GSM 900 to GSM 1800
• dddd - counter of successful Intra cell - Intra BSC handovers from GSM 1800 to GSM 900
• eee - counter of failed Intra cell - Intra BSC handovers from GSM 900 to GSM 900
• fff - counter of failed Intra cell - Intra BSC handovers from GSM 1800 to GSM 1800
• ggg - counter of failed Intra cell - Intra BSC handovers from GSM 900 to GSM 1800
• hhh - counter of failed Intra cell - Intra BSC handovers from GSM 1800 to GSM 900
• iii - counter of successful back to previous normal channel (you can check number of actual used channel for example in test 1) attempts inside one cell (INTRA CELL) from GSM 900 to GSM 900
• jjj - counter of successful back to previous normal channel attempts inside one cell (INTRA CELL) from GSM 1800 to GSM 1800
• kkk - counter of successful back to previous normal channel attempts inside one cell (INTRA CELL) from GSM 900 to GSM 1800
• lll - counter of successful back to previous normal channel attempts inside one cell (INTRA CELL) from GSM 1800 to GSM 900

Counters will stop when they reach their maximum (9999 for two first lines, 999 for two last). To initialize them to zero, use test 40 (or test 60).

In Nokia 6185/6188 this test looks like test 20.

Test 43

Some English descriptions write about this test:

T200MS: aaaa T200BS: bbbb T200MS: cccc T200BS: dddd

T200 MS GSM  T200 BS GSM T200 MS DCS T200 BS DCS

• aaaa - for GSM 900: counts how many times T200 in phone has expired and therefore L2 transmission has been repeated.
• bbbb - for GSM 900: counts how many times T200 in BTS (network) has expired and therefore L2 transmission has been repeated.
• cccc - for GSM 1800 called earlier DCS (in dual phones only): counts how many times T200 in phone has expired and therefore L2 transmission has been repeated.
• dddd - for GSM 1800 (in dual phone only): counts how many times T200 in BTSie (network) has expired and therefore L2 transmission has been repeated.

Counters will stop when they reach their maximum (9999 for two first lines, 999 for two last). To initialize them to zero, use test 40 (or test 60).

I noticed, that some things are a little different: in all 900, 1800, 900/1800 MHz phones, I saw, info is displayed ONLY in two first lines. Help is a little different too:

T200 MS      T200 BS

or:

T200Cntr MS T200Cntr Net

or:

T200Cutr MS T200Cutr Net

In Nokia 6185/6188 this test looks like test 21.

Test 44
You change value from 01 (default) to 00 (or vice versa) by direct enter to this test.

REVISION LEVEL IS aa

Use menu to     change   Revision    Level

In Nokia 6185/6188 this test looks like test 22.

Test 45
This test allows to simulate situations. when phone can normally receive network signal (but network can't receive any information from phone). It's very realistic (even in test 1 in ddd parameter an asterisk (*) is displayed, when you try to make connection), but not always (in test 10 you will see 'xxxxxxxx' instead of TMSI, when T3212 counter in first parameter will be expired).

You can change it by direct enter.

When you enable it, phone won't be able, for example, to update location (see test 64) and make calls. It will allow to: "blockade" phone to the moment of another enabling it (for example, when you want to observe network parameters, but you don't want to be accessible for others - when somebody will call to you, for network your phone will be outside range) fast remind you of number written to phonebook (it's written on leaf, but you don't remember name of person assigned to): simple call it. When phone will choose number, it will display this name; it will be written on list odf last dialed numbers too.

This test DOESN'T WORK CORRECTLY in Nokia 3210, 3310 and 7110 (you change setting, but it doesn't give described above results).

In Nokia 6185/6188 this test looks like test 23.

Test 46

BAND CLASS a CS SUBSTATE EM STATEnnn TX POWER DB

Test 48
In Nokia 3110 this test looks like test 7.

Test 51
Information about SIM card

aaa bbb ccc   dddddddd  e f  gg hh   i   jjjj

VSel Bau SAl SCond  CStop PIN12  PUK12  ATR  FE/PE

• aa - SIM voltage selection type (3, 3/5 or 5)
• bbb - division coefficient, which define speed of communication phone with SIM card (372, 64, 32 or 0) saved in ATR (first sequence send by SIM card after reset - Answer To Reset). When you will divide clock frequency (maximal 3,25 MHz = 3 250 000 Hz) by it, you will have speed of transmission (for example, 3 250 000 Hz / 372 = 8736,5 bods) WARNING ! YOU CAN'T CHANGE SPEED OF COMMUNICATION PHONE WITH SIM CARD AND VALUE OF THIS PARAMETER !
• ccc - information, whether SIM clock stop is allowed (it saves energy) during standby (YES or NOT - possible or not). This information is displayed (in Nokia phones and not only) using *#SIM0CLOCK# code - when you will see "SIM clock stop allowed", SIM card allows to make it. Some Nokia 6110 phones (it depeneds on their firmware) can not support correctly this code - they display, for example, "Result unknown". Phone disables SIM card clock automatically - you can't make it manually !
• dddd - information about clock stop condition:
  • UP
  • DOWN
  • DOWN(UP) - in tested by me SIM cards
  • UP(DOWN)
  • xxxxxxxx

• e - number of left PIN1 code entering attempts. When it's bigger than 9, you will see only last digit of it (for example, I found some prepaid cards with 10 value). Maximal number of entering code attempts depends on concrete SIM card (it can be set to any value), but the most often it's equal 3. In some SIM cards you can disable answering for this code (for example, you can select it in Menu 4-3-1 in Nokia 5110). When it's equal 0, phone shows "Sim card blocked" and asks for PUK1. If it was entered correctly, this counter is reset to maximal value. Disabling and enabling phone doesn't reset it !
• f - number of left PIN2 code entering attempts (when SIM card doesn't support PIN2 functions, you will see "x" here). You can check, if these functions are supported, using call cost function too (if they're not, phone displays "Not allowed"). If you wanted to use them and your card doesn't support them (you will see "x" here), you (or your operator ;-) rather) have to change it. Maximal number of entering code attempts depends on concrete SIM card (it can be set to any value), but the most often it's equal 3. When this counter is equal 0, phone asks for PUK2. When this code was entered correctly, counter is reset to maximal value. Of course, even when it's equal 0, you can normally use SIM card (PIN2/PUK2 are independent of PIN1/PUK1), when you know PIN1. Disabling and enabling phone doesn't reset it ! If SIM card has blocked PIN2/PUK2 codes, you can enter to the menus contains supported by these codes functions (but after changing next settings you will see error).
• gg - number of left PUK1 code entering attempts. Maximal number of entering code attempts depends on concrete SIM card (it can be set to any value), but the most often it's equal 10. Phone asks for it, when counter of left PIN1 code entering attempts is equal 0 (phone shows "Sim card blocked"). When this counter is equal 0 too, SIM card can be blocked (phone shows "Sim card rejected") or (it depends on card) asks for PUK2. When this code was entered correctly, counters of left PIN1 and PUK1 codes entering attempts are reset to maximal values. Disabling and enabling phone doesn't reset it !
• hh - number of left PUK2 code entering attempts (when SIM card doesn't support PIN2 functions, you will see "x" here). Maximal number of entering code attempts depends on concrete SIM card (it can be set to any value), but the most often it's equal 10. When it's equal 0, using PIN2 functions can be impossible on this SIM card (ask operator for help). Additionaly, when you were asked for PUK2, when counters of left PIN1 and PUK1 codes entering attempts were equal 0 and now left PUK2 code entering attempts is equal 0 too, using this SIM card can be impossible (you have to replace it to new). When it was entered correctly, counters for this code and PIN2 (when you entered PUK2, because PIN2 was blocked) are reset to maximal values or counters for this, PIN1 and PUK1 are reset (when you entered PUK2, because PIN1 and PUK1 were blocked). Disabling and enabling phone doesn't reset it !
• i - ATR repeat counter (ATR is first sequence sent by SIM card in answet to reset - Answer To Reset) (0-9)
• jjjj - number of retransmissions/parity errors in transmission with SIM card (when the happen, two first chars are equals FE (Frame Error) or PE (Parity Error), two last number of retransmission/errors)

If you don't have SIM card in the phone, you will see "ERROR1" in this test.

If phone has problems with communication with SIM card, this test can look like follows (i and jjjj parameters are described above):

ERROR1 5  55 55   i   jjjj

CStop parameter (information, if SIM card clock is disabled in this moment) is displayed in help only. Why ? Probably somebody didn't remember about it...

Here are some observations for SIM voltage selection type (first parameter) Nokia 5110 and tested SIM cards:

After enabling phone reads some information from SIM card (for example, number saved on it SMS messages, numbers from phonebook) - when you try to read something, what is written there (for example, phonebook), "SIM card not ready" message is displayed then (and first parameter shows 3). I noticed, that phone can't display names assigned to numbers in phonebook too (for example, when you call somebody) and shows, that "Inbox" and "Outbox" are empty (even, when some messages are saved there).

Later value of parameter changes to 3/5 - I suppose, SIM card clock is enabled then.

Phone disables it (in test value 3), when communicates with network (requesting services, sending or receiving SMS messages) because of saving energy (the same in NSPS state).

When you call to number assigned to name in phonebook (or phone recognizes incoming number), value to the end of call is equal 3/5 (otherwise it changes to 3). After end of call is always equal 3. Logical conclusion: after enabling phone saves in own memory checksum for all numbers from phonebook (it's enought to make for 7 last digits - they're used to identify number in Nokia phones). If this checksum is the same to checksum for number, you're calling (or incoming number), phone reads name from phonebook...

And the last observation: without connection (see above) value of first parameter is equal 3/5 (is some energy loose ? Probably yes... But why counter from test 20 doesn't show any change in their consumption ?)

When you try to open "Outbox" or "Inbox", phone doesn't enable clock, when they're empty (that's why I think, that phone saves into own memory number of saved SMS messages too).

Many information about SIM card are displayed by SIMedit (unfortunatelly, in Czech language only :-( )... Parameters like ATR you can study using SIM Scan (it's on the www.net.yu/~dejan or http://members.tripod.com/~dejank/ pages). They both work with SIM card readers only...

If you want to see "Insert SIM card" and (sometimes) "SIM card rejected" messaeges, try to make such activities (checked for Nokia 5110): Press very delicately the locking catch of the battery and start to slide the battery downwards very slowly (stop, when you will hear silently crack). In this moment you should see first message and phone will start to inform about problems with communication with SIM card (you will see "ERROR1" here)...

In Nokia 6185/6188 this test looks like follows:

TASK0 0134   TASK1 015C TASK2 0138 TASK3 0170

Test 52
Reads datafield from SIM card

Read SIM- data field   to SIM-SCM

Use menu to  read SIM- data field to SIM-SCM

This display reads a binary datafield from SIM card to SIM SCM memory (SCM = Short Code Memory and it means phonebook on SIM card).

Prior using this display the identifier of datafield has to be stored as an alpha-identifier of SCM location number 34 of SIM memory. The datafield must be written in hexadecimal notation. The identifiers can be found from the GSM 11.11.

The contents of datafield is stored as a data-identifier of SCM location number 35 of SIM memory. The contents are displayed in hexadecimal notation. The maximum length of the datafield is 10 bytes, but the length depends on the name length of the SIM memory. In case the datafield cannot be read the alpha-identifier of SCM location is NOT DONE.

The information of how the read succeeded can be read from the SCM location 36 of SIM memory and on the display for a short period.

The following results are possible:

OK	datafield was read correctly
NOT BINARY	datafield is either formatted or cyclic
NOT FOUND	datafield was not found from SIM card
CARD ERROR	something weird happened, card did not respond as expected
NO RIGHTS	not enough rights to read the datafield (PIN2,adm..)
NOT STORED	could not store into the result memory place
NO ADDRESS	could not read the address from the SCM-location
UNKNOWN	unidentified error

For the time being following binary datafields exist in SIM. In future there could be more. All of these are not necessarily on all SIM cards.

2FE2	ICC identification	(10 bytes)
6F05	Language preference	(variable length)
6F07	IMSI	(9 bytes)
6F20	Ciphering key Kc (it's read from card after entering PIN)	(9 bytes)
6F30	PLMN selector	(variable length)
6F31	HPLMN (home network ?) search period	(1 byte)
6F37	ACM maximum value	(3 bytes)
6F38	SIM service table	(2-4 bytes)
6F41	Price per unit and currency table	(5 bytes)
6F45	Cell broadcast message identifier selection	(variable length)
6F74	Broadcast control channels	(16 bytes)
6F78	Access control class	(2 bytes)
6F7B	Forbidden PLMNs (see test 7)	(12 bytes)
6F7E	Location information (TMSI, Local Area Information (consist of MCC, MNC & LAC - see test 11 for them), last Location Update status)	(11 bytes)
6FAD	Administrative data	(variable length)
6FAE	Phase identification	(1 byte)
6F43	SMS status	(variable length)
Next two binary datafields are phase 2+ features which are not currently in use
6F3E	Group Identifier Level 1	(variable length)
6F3F	Group Identifier Level 2	(variable length)

In Nokia 6185/6188 this test looks like follows:

TASK4 0134   TASK5 015C TASK6 0138 TASK7 0170

Test 53
Writes datafield into SIM card

Write  data field from SIM-SCM   to SIM

Use menu to write data field to SIM

This display writes data for a binary datafield in SIM card by using data in SCM memory of SIM card.

Prior using this display the identifier of datafield has to be stored as an alpha-identifier of SCM location number 34 of SIM memory. The datafield must be written in hexadecimal notation. The identifiers can be found from the GSM 11.11. In addition the data to be stored into SIM card has to be entered as an alpha-identifier of SCM location number 35 of SIM memory. The data has to be stored in hexadecimal notation.

The result of write operation can be seen from the alpha-identifier of SCM-location 36 of SIM-memory and on the display for a short period.

The following results are possible:

OK	datafield was read correctly
NOT BINARY	datafield is either formatted or cyclic
NOT FOUND	datafield was not found from SIM card
CARD ERROR	something weird happened, card did not respond as expected
NO RIGHTS	not enough rights to read the datafield (PIN2,adm..)
DATA ERROR	the data contents in SCM location is coded wrongly
NOT STORED	could not store into the result memory place
NO ADDRESS	could not read the address from the SCM location
UNKNOWN	unidentified error

If you want to see changes, often you have to restart your phone.

In Nokia 6185/6188 this test looks like follows:

TASK8 0134   TASK9 015C TASK10 0138 TASK11 0170

Test 54
Information about memory blocks

aa bb  aa bb aa bb  aa bb aa bb  aa bb aa bb  aa bb

ResF1  ResF2 ResF3  ResF4 ResF5  ResF6 ResF7  ResF8

Meaning of the individual lines (information about another blocks):

1. 1, 2
2. 3, 4
3. 5, 6
4. 7, 8

• aa - number of reserved blocks
• bb - number of free blocks in worst case

In Nokia 6185/6188 this test looks like follows:

TASK12 0134  TASK13 015C TASK14 0138 TASK15 0170

Test 55
Information about memory blocks (some phones don't have this test - they don't have such big memory)

aa bb  aa bb aa bb  aa bb aa bb  aa bb aa bb  aa bb

ResF9 ResF10 ResF11ResF12 ResF13ResF14 ResF15ResF16

Meaning of the individual lines (information about another blocks):

1. 9, 10
2. 11, 12
3. 13, 14
4. 15, 16

• aa - number of reserved blocks
• bb - number of free blocks in worst case

In Nokia 7110 counters end on ResF11, in 6210/6250 on ResF15.

In Nokia 3110 this test looks like test 56.

In Nokia 8210/3310 help to this test is a little different (another firmware "bug" ? ;-))):

and values are displayed in first line only...

Test 56
Block display

aaaaaa bbb   cccccccc

Ptr   Cntr   Task

• aaaaaa - pointer to memory where double deallocation was called, in hex format.
• bbb - counter for failed deallocations.
• cccccccc - name of task which last tried to double deallocate a block (you can find their list in test 35 description).

This test has correct values only, when counter bbb is different from 0.

In Nokia 3110 it looks like test 57.

Test 57
Memory status before reset

aaaaaaaaaaaa aaaaa... bbbbbbbb

Status of  stacks  Block sets

• aaaaaa... - Status of each stack before reset. First position contains the status of stack 0, second position the status of stack 1 and so on. The last position contains the status of System stack. Number of stacks depends on the current configuration of software. Possible values for each stack are:
  • 0: status OK, no overflow - it's normally !
  • 1: status not OK, stack overflow

• bbbbbbb - status of each block set before reset. First position contains the status of block set 1, second position the status of block set 2 and so on. Possible values for each block set are:
  • 0: status OK
  • 1: block set full - it's normally !
  • 2: (de)allocation error or total memory corruption

This display is only valid when a unknown or a stack overflow interrupt has occured. In some phones you can make restart connected with stack overflow (see question 9) and see this test in "action"...

In Nokia 6210 this test is bigger and displayed on full screen...

In Nokia 6185/6188 this test is different:

16:3A 32:26 64:18 128:21 168:14 264:0E

Back to the top

Marcin Wiacek (WWW)
Last modifcation: 5 January 2002