Home
Nokia 6185/6188 Field Test and Secrets
Last updated
The information on this page covers secrets and field test functions on both Nokia 6185 and 6188 models plus the Nokia 5185/85i. My Nokia 6188
Secrets
Change the provider's name to your own welcome message on startup:
Menu-1-3
Change the provider's name on the screen:
Enter *3001#12345#, then select NAM1, ALPHA TAG, and enter in your own text string. Power off to get out of this menu
Quickly switch profiles:
Hit POWER button briefly to select
Keyguard:
Hold down END key for 2 seconds OR Menu + '*' OR Menu + '9'
Phone lock to prevent unauthorized use:
Menu-4-3-2-1, ON, Power off to engage
Setting Speed Dial:
NAMES Softkey, 1-TOUCH DIALING, Pick name out of phone book
Software version:
*#837# or *#VER# or *#9999#
Serial / ESN:
*#92772689# or *#WARRANTY#
Phone reset?
*#SLOT1# or *#SLOT2# (changes value on screen 46, line 3 -- Thanks Andrew S). Also see this page for a more detailed description of the slot cycles.
Phone programming
*#639# (do only if you have programming codes -- Thanks Peter Hartmann)
How do I get the date to show up on my 6185/8 like your phone above? Earlier firmware versions of the 6185/8 do not show the date on the screen. Contact your service provider and ask for a firmware upgrade of your phone (this is free service -- no authorized dealer that can upgrade firmware should charge you to do this).

How do I use my Sprint 6185 on Verizon (or Bell, Telus, etc)? You need to have an unlocked phone to switch providers. See the general Nokia secrets page under SP-lock status. If your phone is locked then you may try unlocking it with various software programs available on the internet to generate unlocking codes (enter any codes generated from this programs at your own risk), attempt to get the unlocking code from the original service provider, or play around with the firmware. In general, codes are not easily obtainable and most people just buy a new handset to use with the new provider. Please don't email me asking for names of software, how to override the firmware, or the service programming code (I don't have the answers to these questions, but there are people that have successfully done this that lurk in newsgroups or cellular stores).

Forcing new profiles: Headset mode: with the phone facing up, locate the contact bars at the base (there's 7 of them together) and short out between the 1st and 2nd bar on the left hand side (a paperclip works well for this). Car mode: with the phone turned off short out contacts 2 and 3 from the left hand side and then turn on the phone while still shorting out the contacts.Thanks to Bill Acito for these profile tips

Forcing 800 MHz AMPS network (analog) on the 6185/8: In some areas EVRC may not be functional yet and you may be able to force analog mode on this phone by entering *#EVRC# and enabling the Enhanced Variable Rate Codec. If EVRC is not supported then the 6188 will default to analog mode. Once you are done using analog mode, disable the EVRC by repeating the above process to return to digital mode. This trick may also work on some 6185 models that do not have an analog roaming option in the Network settings. If your service provider also offers analog or AMPS then there might be a force analog feature available from the menu.

*22801Forcing other 800 and 1900 MHz CDMA networks from the 6185/8: If your service provider is using 1900 MHz CDMA (e.g., Bell Mobility, Telus Mobility, Sprint PCS, Verizon, Wireless North, etc...), then you may be able to force your 6185/8 into 800 CDMA mode by entering *22800 or *22801 and hitting TALK. If you successfully contact a 800 CDMA network (e.g., Telus Mobility, MT&T Mobility, Verizon), you will hear a message from that network. Telus' message is: 'You've reached the customer service centre at Telus Mobility...'. Hit 3 then 9 to listen to different rate plans from Telus which will give you a few minutes of looking through all the different test mode screens. Note that this procedure may take a few times to work -- you'll get assaulted with a tone if it doesn't. The Nokia 6185/8 allows you to track other CDMA providers' offset information and more.
This is how the *2280x searches for providers:
*22800 - 800 CDMA, Band A
*22801 - 800 CDMA, Band B
*22802 - 1900 CDMA, Band A
*22803 - 1900 CDMA, Band B
*22804 - 1900 CDMA, Band C
*22805 - 1900 CDMA, Band D
*22806 - 1900 CDMA, Band E
*22807 - 1900 CDMA, Band F
Thanks to Peter Harren for providing information on the *2280x forcing

Field Test
Test menu The test mode display is activated through the test mode command: *3001#12345#. Once you enter this command, you are given a list of options, including 'Field Test'. Select Field Test and then hit 'Enabled'. You must power down the phone and power it up again to get out of the test mode menu. The test mode screens may vary somewhat between different firmware versions and providers.
Once you power up the phone you are given a new menu choice at location 10 called 'Field Test'. There are several different test mode screens. Type in a test number to get the screen listed below. Alternatively you may use the arrow buttons to move between the 199 different field test screens. Entering test number '0' will disable the test mode, but will still allow you to access the test menu.
If you are using the field test mode and are unsure what the screens mean then hold down the # key for about four seconds to get a brief description of the screen. Repeat holding the # key to return to the test mode values. Thanks to L. Tee for this tip
If you would like to see what is behind the test mode screen then keyguard the phone, wait until the 'press unlock and then *' screen disappears, and then press one of the numeric keys to see the regular screen. Thanks to L. Tee for this tip
Note: If you make or receive calls while in test mode, you may not be able to change the speaker volume. To turn off the field test mode you can select field test '0' or enter a few digits and then clear these digits.


Screen 1
CDMA control
CSST CHAN SP
PPN EC/SO XF
LOS XHO FR B
-Rxx-Txx FER
CDMA traffic
CONV 0450 NP
8000 2
000 0D9 00 0
-093+006 000
AMPS control
RSSI S D
CHAN P A
CSST SID E
XTBY MINMAX
AMPS traffic
-095 2 3
0273 0 0
CONV 16427 0
Y
CDMA
CSST: Cellular State: IDLE, CONVE, PLIOS, TIME, SYNC, RELE, PAGE, TRFIN, W_OR.
CHAN: Channel
NP, NC, SC, SP: xC is for 800 MHz CDMA, xP is for 1900 MHz CDMA. Thanks to J. Earle for providing this information
PPN: PseudoNoise offset
EC/SO: Energy per chip per noise
LOS:Number of times that mobile has been losing the paging channel during Idle State and entering the System Initialization State. Thanks to Andry Kolomatsky for providing this information
XHO:Number of idle handoffs. Thanks to Andry Kolomatsky for providing this information
B: Current network/frequency. a,b are A and B 800 MHz AMPS (analog). A-F indicate the digital block in use.
Rxx: Receive power in dB
Txx: Transmit power in dB
FER: Frame Error Rate
Traffic CODEC's: 8000 - 13 kilobit; 0001 - 8 kilobit; 0003 - EVRC. Thanks to S. Punter for providing this information
AMPS
RSSI: Received signal strength
S: Slot (1-3)
D: Digital Colour Code on analog control channel (0-3 or - for not locked)
CHAN: Channel
P: ??
A: ??
CSST: Cellular State: IDLE, CONVE, PLIOS, TIME, SYNC, RELE, PAGE, TRFIN, W_OR.
SID: System ID
E: ??
XTBY: ??
MINMAX: Minimum and Maximum RSSI over last time period?

Screen 2
CDMA control
PN1
ECK


CDMA traffic
PN1 PN3 PN5
ECK ECK ECK
PN2 PN4 PN6
ECK ECK ECK
AMPS control
X F S N N C
SLEEP EMC
SCC STC M
RSSCPLCC CAL
AMPS traffic
2 2 1 0 4 1
00015F927B13
0029B 0A0 2
140 372 0000
CDMA
PNx: CDMA PN offsets handoff candidate listing. Shows only the current offset while idling. Shows 1 to 6 additional choices during traffic.
Telus (East) and some converted Clearnet>Telus (West) PN offsets: divisible by 6, separated by 168.
Telus (West) PN offsets: divisible by 4, separated by 160.
Bell Mobility's PN offsets divisible by 6 and grouped in sequence X, X+6, X+12 (e.g., 006, 012, 018) with 28 different configurations
Sprint PCS offsets: divisible by 2, separated by 170.
If you are using another provider, please let me know what the offsets separations are.
See the Sony field debug mode page for more information on CDMA offsets.
AMPS
??

Screen 3
OWNNUMBER
ESN-00000000
ESN-HEX
SL P MD PC
OWNNUMBER: Your phone number, 10 digits
ESN: Electronic Serial Number
ESN-HEX: ESN in hexidecimal
SL: ??
P: ??
MD: [AD] at 1900 CDMA; [DI] at 800 CDMA.
PC:??

Screen 4
CSST CHAN
A B
SID
SD IT TM CAP
CSST: Cellular state (e.g., IDLE, PAGE, CONV)
CHAN: Channel
A: ??
B: Network Band and Frequency (lowercase a,b = 800 MHz band; uppercase A,B = 1900 MHz band)
SID:System ID. [17500] Telus Mobility East; [16422] Telus Mobility West; [16420] Bell Mobility; [16xxx odd number] Rogers AT&T
SD: ??
IT: ??
TM: ??
CAP: ??

Screens: 5-12 AMPS only
AMPS 5
1YNC_OK_097B
SYNC_FAI4CC1
FOCC_WOR587C
WORD_OK_3E65
AMPS 6
0ORD_COR0CE3
WORD_FAI0E76
CTRL_FIL787D
SAT_V_OK0004
AMPS 7
1AT_V_FA0000
FVC_S_FA0000
WFLG_INT7046
NORMALRXFE25
AMPS 8
1STBY_RX7244
XNRML_RX006C
X_N_RX_O004C
X_N_RX_F0020
AMPS 9
1PT_1_OK724E
RPT_1_FA0042
TIME__2_0000
MER2HIGH0002
AMPS 10
1X_XSTBY000D
SYNC_LOS0031
DEC_SAME0000
VOTED_BT0000
AMPS 11
11_BETTR0000
SYNC_SAM0000
MSG__BTR0000
SFLG_BTR0000
AMPS 12
1IN_FAIL0044
DYN_FAIL01C7
MIN2_FAI0045
DYN2_FAI01CB
AMPS mode: ???

Screen 6
SID NID
BASE ID
P_REV
MIN_P_REV
line 1: [17500]: Telus Mobility East SID (System Identification), [16422] for Telus Mobility West, [16420] Bell Mobility, or [16xxx odd number] for Rogers AT&T. [00000]: Second SID assignment
line 2: Cellular ID as defined at the switch
Michael Lachance emailed me the decoding scheme for the CID value: The way to calculate the ID from this value is very simple: take the number in decimal written on your phone (e.g., 04787) and convert it to HEX format to give 12B3. The first 3 digits are the CELL_ID, which is 12B or 299 in decimal form. This is the cell number in the switch. The last number (3) is sector 3 of that cell site. You can have 0 (Omni), 1 (Sector X or Alpha), 2 (Sector Y or Beta) and 3 (Sector Z or Gamma).
Now my tests using my 6188 yielded a CID of 55297 or D801, gives a value of 3456 which makes no sense at all. The site yielded from this reading is known as Clearnet BC201, beta cell or the CID should be 03218. Forcing the phone to use Telus 1900 CDMA gave 01240 or 4D8, but no last digit with the cell number. Comments anyone?

lines 3,4: CDMA specs. [ANSI-J-008] for 1900 MHz CDMA, [TSB74] or [IS-95] for 800 MHz CDMA. A [005] on line three signifies that the site is equipped with 1X data services. Thanks to Dean Hoisak for this info


Screen 7
CSST
MMDDYY
HHMMSS

line 1: [IDLE], [CONVE], [PLIOS], [TIME], [SYNC], [RELE], [PAGE], [TRFIN], [W_OR]: current phone status
lines 2,3: CDMA Network date (MMDDYY) and time (HHMMSS)

Screen 8
TADD TDROP
TCOMP TTDROP
WW1 WW2 WW3

line 1: [TADD]: threshold to add a new active PN (raw value ex: 28 = Ec/Io at -14 dB), [TDROP] : threshold to drop an active PN (raw value ex: 32 = Ec/Io at -16 dB)
line 2: [TCOMP]: an other threshold to add an active PN when a candidate PN becomes stronger than an active PN, [TTROP]: timer to drop a PN when power of this PN goes below TDROP
line 3: [WW1]: value of the seach window for the active PN, [WW2]: value of the search window for the neighbour PN,[WW3]: value of the seach window for the remaining PN.

Screen 9
006 330 270
047 062 062
342 102 030
062 062 062
Tracked PN Offsets (3 values on lines 1,3) and EC/SO (3 values on lines 2,4 - Energy per chip per noise). An EC/SO of 062 likely means not really usable? lower numbers are better strengths). See screen 2 for PN offset information.

Screen 10
414 084 222
062 060 062
420 366 252
062 062 062
Like Screen 9

Screen 11 - sometimes only during CONV
162 054
062 062
186 084
062 051
Like Screen 9. Screens 12-13 may show similar values as well.

Screen 41
BATT CAPA
BATT VOLTAGE
BATT TEMP
BTTYPE CHRGR
line 1: Battery capacity. '1600' for a 1500 mAh; '984' for a 900 mAh, and '1000' for a 880 mAh.
line 2: Battery voltage (x100). Phone shuts off at 3.1 volts
line 3: Battery temperature in C
line 4: Battery type (1500 mAh=2; 900 mAh=1; 880 mAh=5; vibration=6) and charge status: 0=not charging; 1=charging with quick charger; 2=charging with desk charger.
Thanks to both Serge Loranger and Chris Smith for providing info on this screen

Screen 42
BATVOL CHMOD
BTEMP CHTIME
CHRGVOL PWM
BTYP BFDC
line 1:Voltage (x100) and battery type
the four-digit number in the BFDC field counts down while the battery charges. When it reaches zero, the battery pack is considered charged.

Screen 43
MTDIF MPDIF
BUPV BDOWNV
AVERV SUMMF


Screen 44
DERIC CHAM
VDIF VDROP
VDTI AVDIF
TEMP VOLT

Screen 45
TXON TXOFF
CHCUR STDBY
AGE CAP CURR
TMP CMAHTARG
Row 3: 'CURR' gives current drain: Drain examples: digital, idle, backlight off = 0011; digital, idle, backlight = 0093; analog, idle, backlight off = 0103; analog, idle, backlight on = 0187; searching, backlight off = 0160-0200; analog (fringe), talk = 0933; digital, talk, backlight on = 0275
Note the differences between digital and analog standby currents -- over 9x higher for analog!
Thanks to Dominic Richens for providing this info

Screen 46
BAND CLASS a
CS SUBSTATE
EM STATEnnn
TX POWER DB
Row 1: BAND: C= 800MHz CDMA, P=1.9GHz CDMA, A=800MHz AMPS
Row 2: ACTIVITY: IDLE, CONVE, PAGE, PILOS, TIME_, SYNC_, RELE, etc
Row 3: EM (?): SLOT 1, SCANNING, RATE 1 (8k codec), RATE 2 (13k codec) or EVRC.
Row 4: TX power: usually between -75dB and +4dB
Thanks to Howard Chu for providing this info

Screens 51 through 54
TASK0 0134
TASK1 015C
TASK2 0138
TASK3 0170
Screens 52-54 give task numbers 4-15

Screen 57
16:3A 32:26
64:18 128:21
168:14
264:0E

Screen 57
16:XX 32:XX
64:XX 128:XX
168:XX
264:XX

Screen 58
384:02
512:02
752:02


Screen 59
TMRERR
TH LT ID IM



Screen 61
Version
430SD3a2.nef
05/18/1999
NSD-3AX
Phone version and date

Screen 62
DSP ROM 2
DSP ROM VERS 430
BETA ROM VERS 0014


Screens 63-65
C1M 00
C1L 00
C2M 00
C2L 03
On some handsets these lines are displayed as 1:CAFE R1 MSB; 2:CAFE R1 LSB; 3:CAFE R2 MSB; 4: CAFE R2 LSB
Screens 64, 65 give values for C3,4,5,6

Screen 66
CT1 82
CT2 00
RF 23


Screen 67
REC 00
SEND 00
CTR 4C
STA 68
Screen may give values for 1,2: MBUS RCV, SND; 3,4: UART CR, sr

Screen 68
CNT 00
ACK 00

M1M B3
Screen may give values for 1: MBUS MSG CNT; 2: MBUS ASK CNT; 4: MINT1MASK

Other Screens
The following screens were snapped by Howard Chu using a Telus Mobility 6185 (Version v542b02u3). Also thanks to Luns Tee (unlocked Sprint 6185 on Verizon; Version 431Sd3a2), Ivan Tumanov (Sprint PCS), Peter Mucha and Guillaume Gilbert (both using Bell Mobility) for emailing me with these screens as well. Now does anyone know what they mean (perhaps data connection info) ??
Screen 80
??

Screen 81
??

Screen 82
??

Screen 83
??

Screen 84
??

Home
Tips and Secrets

Sony PCS | iDEN | Nokia General | Nokia 6185/6188
Motorola | Ericsson | Samsung | GSM Codes