| MOTOROLA 6200 / 7500 / 8200 / 8400 / 8700
To activate RBS (Engineering Menus):
[pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
(pause means the * key held in until box appears)
You now have to press the [MENU] and scroll to the
'Eng Field Options' function with the < or > keys, and enable it.
To de-activate RBS (Engineering Menus):
[pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
(pause means the * key held in until box appears)
Works on 6200's,8200's,1-888's,7500's,8400's and GSM StarTacs
with later than version .27 software.
Options under Eng Field Options
Eng Field Options
Active Cell
RxLev -55Received powerlevel in dBm
NCC 0National Colour Code, used for identifying channel
BCC 7Broadcast Colour Code, also for identifying purposes
MSTxPwr 35Max allowed transmit power 35dBm about 3.2W
Time Adv xxxxxx is a number. Multiply this number by 550,and the result is the distance from the RBS (Radio Base Station), in meters.
Adjacent Cells
Adj Cell 1
Channel 0033Channel Number
RxLev -65Received powerlevel in dBm
BCCH DecodeI think it means it is able to decode thechannel information contained in the BCCH
RxLevAM -104Min allowed reception, compare with RxLev -65 and you get the C1 value which is 39 and reported back to base asmeasure of field strength.
MTxPwr 35 Aain max allowed powerlevel
C1 003 ??
NCC 0 National Colour Code
BCC 6 Broadcast Colour Code
System Parameters
Combined Off ??
AcsClas 0000 Allows different priorities - this network doesn't support it.
MCC 505 Mobile Country Code, 505 for Australia, 240 for Swedes etc
MNC 01Mobile Network Code, 01 for Mobilenet, 02 for Optus, 03 for Vodafone using MCC 505. MCC+MNC is often called Network Code
LAC 08720Location Area Code, shows which exchange your're in
CellID 00473Base Station Identity
T3212 005Time between periodic network updates (either hours between or time remaing until update, not sure)
BS-PA-MFRM 4 ??
XZQTY 14.3 ??
Motorola Flip Pinout:
ANT- (O) | | | | | | | | | |
10 9 8 7 6 5 4 3 2 1
Top of phone (screen)
1) Audio Ground
2) Ext b+
3) T Data
4) C Data
5) R Data
6) Logic Ground
7) Audio Out - on/off
8) Audio In
9) Manual Test
10) Battery Feedback
Motorola 6200
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
UK (Orange)
AU
What's the use of RBS:
Get Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters.
Get Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected.
Pin Outs
Numbered left to right, keypad up, battery down
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 7500
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
IT (model: F16 HW: 5.2 SW: 2.1)
What's the use of RBS:
Get Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters.
Get Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Gnd
2. Pos
3. True data (TD) (input)
4. Complimentary data (CD) (input)
5. Return data (RD) (output)
6. Audio gnd
7. Audio out
8. Audio in
Motorola 7500
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
IT (model: F16 HW: 5.2 SW: 2.1)
What's the use of RBS:
Get Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters.
Get Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Gnd
2. Pos
3. True data (TD) (input)
4. Complimentary data (CD) (input)
5. Return data (RD) (output)
6. Audio gnd
7. Audio out
8. Audio in
Motorola 8200
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
ES, AU, NL, BE
What's the use of RBS:
Get Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters.
Get Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected.
Pin Outs
Numbered right to left, keypad up, battery down looking
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 8400
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
IT, NL
What's the use of RBS:
Get Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters.
Get Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected.
Pin Outs
Numbered left to right, keypad up, battery down
1. Audio Ground
2. V+
3. True data (TD) (input)
4. Downlink - Complimentary data (CD) (input)
5. Uplink - Return data (RD) (output)
6. GND
7. Audio Out - on/off
8. Audio In
9. Manual Test - ???
10. Battery Feedback
11. Antenna connector
Motorola 8700
*#06# for checking the IMEI (International Mobile Equipment Identity)
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software.
These countries has been reported working:
AU, IT, SG, DE, ES, ZA
What's the use of RBS:
Get Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters.
Get Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected.
Motorola Analogue Phones
MOTOROLA PROGRAMMING INSTRUCTIONS
NOTES: Some units have dual NAM's.
The ESN prefix is 130 decimal, 82 hex.
Determine which access sequence to use:
HAND HELD PORtable MODELS
If the phone has a FCN button and no MENU button use sequence 1.
If the phone has no FCN button use sequence 2.
If the phone has a MENU button and a FCN button use sequence 4.
INSTALLED MOBILE PHONES AND TRANSPORtable MODELS
If the phone has no FCN button and no RCL button use sequence 3.
If the phone has a FCN button use sequence 4.
If the phone has a MEM button use sequence 5.
If the phone has a RCL button and no FCN button use sequence 6.
SEQUENCE# ACCESS CODE
1 FCN (SECURITY CODE TWICE) RCL
2 STO # (SECURITY CODE TWICE) RCL
3 CTL 0 (SECURITY CODE TWICE) *
4 FCN 0 (SECURITY CODE TWICE) RCL
5 FCN 0 (SECURITY CODE TWICE) MEM
6 CTL 0 (SECURITY CODE TWICE) RCL
The default security code is 000000. The CTL (control) button is the single black button on the side of the handset.
NAM programing:
1. Turn the power on.
2. Within ten seconds enter the access sequence as determined above.
3. The phone should now show "01" in the left of the display, this is the first programing entry step number. If it does not the security code is incorrect, or the programing lock-out counter has been exceeded. In either case you can still program the unit by following the steps under TEST MODE PROGRAMING below.
4. The * key is used to increment each step:
Each time you press * the display will increment from the step number, displayed on the left, to the data stored in that step, displayed on the right. When the data is displayed make any necessary changes and press * to increment to the next step number.
5. The SND key is used to complete and exit programing when any STEP NUMBER is displayed.
If you have enabled the second phone number bit in step 10 below then pressing SND will switch to NAM 2. Steps 01 thru 06, 09 and 10 will repeat for NAM 2, the step number will be followed by a "2" to indicate NAM two.
6. The CLR key will revert the display to the previously stored data.
7. The # key will abort programing at any time.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
01 00000 - 32767 SYSTEM ID
02 3 DIGITS AREA CODE
03 7 DIGITS TEL NUMBER
04 2 DIGITS STATION CLASS MARK
05 2 DIGITS ACCESS OVERLOAD CLASS
06 2 DIGITS GROUP ID (10 IN USA)
07 6 DIGITS SECURITY CODE
08 3 DIGITS LOCK CODE
09 0333 OR 0334 INITIAL PAGING CHANNEL
10 6 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 1)
11 3 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 2)
NOTES:
Take care with Motorola's use of "0" and "1". Some options use "0" to enable, some use "1".
1. This is a 6 digit binary field used to select the following options:
Digit 1: Internal handset speaker, 0 to enable.
Digit 2: Local Use Mark, 0 or 1.
Digit 3: MIN Mark, 0 or 1.
Digit 4: Auto Recall, always set to 1 (enabled).
Digit 5: Second phone number (not all phones), 1 to enable.
Digit 6: Diversity (Two antennas, not all phones), 1 to enable.
2. This is a 3 digit binary field used to select the following options:
Digit 1: Continuous DTMF, 1 to enable.
Digit 2: Transportable Ringer/Speaker, 0=Transducer, 1=Handset.
Digit 3: 8 hour time out in transportable mode, 0 to enable.
TEST MODE ACCESS:
INSTALLED MOBILE PHONES AND TRANSPORtable MODELS
To enter test mode on units with software version 85 and higher you must short pins 20 and 21 of the transceiver data connector. An RS232 break out box is useful for this, or construct a test mode adaptor from standard Radio Shack parts.
For MINI TR or Silver Mini Tac transceivers (smaller data connector) you can either short pins 9 and 14 or simply use a paper clip to short the hands free microphone connector.
HAND HELD PORtable MODELS:
There are two basic types of Motorola portable phones, the Micro-Tac series "Flip" phones, and the larger 8000 and Ultra Classic phones. Certain newer Motorola and Pioneer badged Micro-Tac phones do not have a "flip", but follow the same procedure as the Micro-Tac.
8000 & ULTRA CLASSIC SERIES:
If you have an 8000 series phone determine the "type" before trying to enter test mode. On the back of the phone, or on the bottom in certain older models, locate the F09... number this is the series number. If the FOURTH digit of this number is a "D" you CAN NOT program the unit through test mode, a Motorola RTL4154/RTL4153 programer is required to make any changes to this unit.
Having determined that you do not have a "D" series phone the following procedure is used to access test mode:
Remove the battery from the phone and locate the 12 contacts at the top near the antenna connector. These contacts are numbered 1 through 12 from top left through bottom right. Pin 6, top right, is the Manual Test Mode Pin. You must ground this pin while powering up the phone. Pin 7 (lower left) or the antenna connector should be used for ground. Follow one of these procedures to gain access to pin 6:
1. The top section of the battery that covers the contacts contains nothing but air. By careful measuring you can drill a small hole in the battery to gain access to pin 6, alternately simply cut the top off the battery with a hack saw. Having gained access use a paper clip to short pin six to the antenna connector ground while powering up the phone.
2. If you do not want to "destroy" a battery you can apply an external 7.5 volts to the + and - connectors at the bottom of the phone, ground pin 6 while powering up the phone as above.
3. You can also try soldering or jamming a small jumper between pins 6 and 7 (top right to lower left), or between pin 6 and the antenna connector housing ground. Carefully replace the battery and power up the phone. Use caution with this method not to short out any other pin.
4. A cigarette lighter adaptor, if you have one, also makes a great test mode adaptor as it can be disassembled to give you easier access to pin 6. Many are pre marked, or even have holes in the right location. This is because they are often stamped from the same mold that the manufacturer uses for making hands free adaptor kits and these kits require access to the phone's connectors.
Motorola CD 160, CD 520, 920, 930
Motorola CD 160
Press menu and type one of these numbers and press OK:
11 = Status Review
13 = Available Networks
14 = Preferred Networks
22 = Select Keypad Tones
25 = Require SIM Card PIN
26 = Language Selection
32 = Repetitive Timer
33 = Single Alert Timer
34 = Set IN-Call Display
35 = Show Call Timers
36 = Show Call Charges
37 = Call Charge Settings
38 = Reset All Timers
43 = Reset All Timers
45 = Show Last Call
46 = Total For All Calls
47 = Lifetime Timer
51 = Change Unlock Code
52 = Master Reset
53 = Master Clear (Warning!! May result in deleting the Message Editor!!!)
54 = New Security Code
55 = Automatic Lock
63 = Battery Saving Mode
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
Motorola CD 520
Free call tip
1 Enter the phone number
2 Enter OK
3 Type *#06#
4 Press Button C
5 And finally press the button for power off.
You should now be able to talk without being billed.
Motorola 920/930
The 54# Tip:
Type 1#, 2#........54# on the keypad (when you're not in the menu) to get the phone number used for with this key when speed dialing.
Motorola d460, 2500, 6200 (Flare), 7500, 8200, 8400 & 8700
IMEI
*#06# displays IMEI on 8700, NOT on 6200, 7500, 8200
To activate RBS:
(pause means the * key held in until box appears)
[pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it.
To de-activate RBS,
[pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software. Please report what works and doesn't for you.
Reported working, by country:
d460: IT
6200 Flare: UK (Orange), AU
7500: IT (model: F16 HW: 5.2 SW: 2.1)
8200: ES, AU, NL, BE
8400: IT, NL
8700: AU, IT, SG, DE, ES, ZA
Uses of RBS:
Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters.
Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected.
Motorola d460
*#06# for checking the IMEI (International Mobile Equipment Identity)
Activate RBS
(Note: pause means the * key held in until box appears)
To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok]
You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it.
De-activate RBS
To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok]
This only works with some versions of software.
What's the use of RBS:
Get Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters.
Get Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected.
Motorola Elite
Test Mode
To enter in Nam programming Mode, press:
[arrow up]
000000000000 (12 times zero)
[MR]
now display shows the first step of NAM programming; simply enter data and move to the next step using:
* (the same key of [left arrow])
Software version
To see software version of your phone you need to short-circuit antenna ground with the two nearest pin together in the connector located under the phone. then:
Power ON the phone
and type:
#19#
now display is showing software version of your phone.
Serial Number
To see the serial number of your phone you need to short-circuit antenna ground with the two nearest pin together in the connector located under the phone. then:
Power ON the phone
and type:
#75#
now display is showing the first pair of digits, then go ahead using
* (the same key of [left arrow])
to show the second pair and so on.
Pinout
The pins are numbered 1 thru 10 from right to left
ANT- (O) | | | | | | | | | |
1) Audio Ground
2) Ext b+
3) T Data
4) C Data
5) R Data
6) Logic Ground
7) Audio Out - on/off
8) Audio In
9) Manual Test
10) Battery Feedback
Motorola Flare
Functionality Enablement
Following you'll find the procedure in order to get more menu's from your phone. But you don't just get more menu's, you'll get 99 more memories available, giving a total of 198 memories! These memories are stored in the phone, not in the SIM, which means you can store many more characters and numbers for each name.
Before you begin, take note that:
Make a note of your voicemail number! You may lose it during this! (don't worry, you can reprogramme it later).
You may need to use the master reset option to get outgoing DTMF going again after this.
All the menu's seem to be dependant on others being available, so if you just activate one, it will say not available
Lastly, p = a pause. ie, what you get when you hold down the * button for 3 seconds.
And then .... let's go !
First of all, press
ppp070p0p OK
You have just turned off the code that disables further changes. This seems to have been set in some phones.
Now enter:
ppp000p1p OK
ppp001p1p OK
ppp002p1p OK
all the way to
ppp113p1p OK
but AVOID ppp070p1p and ppp007p1p
Don't worry, this only takes about 35 mins for all 111, but just don't lose count!
Then go to phone setup menu, and select extended menu
And finally ....
You'd find some more menu items which wasn't there before and you got 99 more memory locations giving a total of 198 memories.
Show IMEI code
If you need to know what's the IMEI code of your phone, simply press:
* # 06 #
you'll read it on display.
Pinout
Numbered left to right, keypad up, battery down
1) Audio Ground
2) V+
3) True data (TD) (input)
4) Downlink - Complimentary data (CD) (input)
5) Uplink - Return data (RD) (output)
6) GND
7) Audio Out - on/off
8) Audio In
9) Manual Test - ???
10) Battery Feedback
11) Antenna connector
To switch to the external antenna, a 2k2 resitor shout be placed in the coaxial antenna cable from shield to core.
Motorola MicroTac
Test Mode
To enter in Nam programming Mode, you need to short-circuit the first and the third battery pin from the right, then:
Power ON the phone
display will show "Tacs5", type in:
55
now display shows the first step of NAM programming; simply enter data and move to the next step using:
* (the same key of [left arrow])
Software version
To enter in Nam programming Mode, you need to short-circuit the first and the third battery pin from the right, then:
Power ON the phone
display will show "Tacs5", type in:
19
now display is showing software version of your phone.
Motorola StarTac
Show IMEI code
If you need to know what's the IMEI code of your phone, simply press:
* # 06 #
you'll read it on display.
Pinout
1) Connected with 22pf to pin 3
2) RF out
3) Connected with 33 pf to pin 8, 33 pf to pin, 33 pf to pin 7
4) BAT_FDBAK
5) MAN_TEST connected with 10k to L275
6) RS232_TX - connected to MCU SPI bus
7) RS232_RX - connected to MCU SPI bus
8) AUDIO_IN
9) AUDIO_OUT
10) Connected with 33 pf to pin 13, 33 pf to pin 14
11) UPLINK -|
12) DOWNLINK -|- DSC bus connected to the BIC
13) DSC_EN_B -|
14) EXT_B+
15) Gnd |
01-31-2007, 02:51 AM
Linear Mode
