NetMonitor in Nokia phones (5/7)
Author: Marcin Wiacek
Description: NOKIA NetMonitor description (English version)
Keywords: 3110, 9110, GSM, DCS, Nokia, 3210, 5110, 5130, 6110, 6130, 6150, 8810, FAQ, NetMonitor, Marcin, Wiacek, Marcin Wiacek

Main page

NetMonitor in Nokia phones (5/7)

[Part 1][Part 2][Part 3][Part 4][Part 5][Part 6][Part 7]

1. What is it ?
2. Do I need it ?
3. Does my phone use more power with NetMonitor enabled ?
4. How to activate it ?
5. Which NetMonitor version can be activated in my phone ?
6. Does NetMonitor activation void warranty ?
7. NetMonitor menu in my phone has different number than 10. Is it normal ?
8. NetMonitor menu in my phone has 11 number, hovewer previous position has 9 number. Is it normal ?
9. How to use it ?
10. Can I damage my phone ?
11. Glossary
12. Description of the individual tests
13. You can also use a program...
14. Can I use NetMonitor without SIM card inserted, without PIN number entered or when SIM card is not active ?
15. How can I disable NetMonitor ?
16. Do I need to disable NetMonitor before sending my phone to the service ?
17. Is it possible to re-activate NetMonitor after disabling it ?
18. Is NetMonitor available in analog Nokia phones ?
19. Does NetMonitor allow to use phone like broadcast station ?
20. I don't have all described tests in my phone. Why ? Can I increase their number ?
21. Does NetMonitor allow to identify place, where is my interlocutor ?
22. Does NetMonitor allow to identify place, where am I ?
23. What are NetMonitor codes ?
24. Is it the truth, that in phones with additional hardware changing frequency band NetMonitor doesn't work correct ?
25. Where can I find description of FBUS/MBUS protocol and commands connected with NetMonitor ?
26. Information sources
27. Additional information

Menu 10-30
Audio API register display

`aaaa bbbb cccc dddd eeee ffff gggg hhhh`
`A1Cnf A2Cnf ST AU3 1Tone 2Tone Conf HFVol`

- aaaa - API_AUD1_CTRL
- bbbb - API_AUD2_CTRL
- cccc - API_SIDETONE
- dddd - API_AU3
- eeee and ffff - API_1_TONE and API_2_TONE (see description below)
- gggg - API_CONFIG: connected with sound setting from Menu 10-71 and 10-72: you will see here number (hexadecimal), which was displayed there below AUDIO ENHANCEMENT (in last selected menu). Here are some examples:

  normally (for example during standby) | wybieranie numeru | call
  5148 (cracks) - 20808 decimal | 5149 | 5140
  851A - 34074 decimal | 851B | 8512
  C6A4 (cracks) - 50852 decimal | C6AD | C6A4
  DB34 (cracks) - 56116 decimal | DB3D | DB34
  DF29 (after enabling phone) - 57129 decimal | DF29 | DF20
  F436 - 62518 decimal | F43F | F436
  F437 - 62519 decimal | F43F | F436

- hhhh - API_HF_VOL: volume during call - you will count it from the "110 - hhhh" formula (subtract value of this parameter from 110). It's displayed too (during call only) in Menu 10-76. When you connect headset, values here change - volume can be count from "510 - hhhh" formula then (for car kit use "2210 - hhhh"). Type of connected audio accesories can be checked in Menu 10-75 too. Phone remembers volume for each audio accesory separately.

When you press any key, phone generates sound, which consist of two tones. Parameters eeee and ffff change then. First tone is short, second is emited all time, when you press key. When you press C, NaviKey, Up or Down keys, change parameter eeee only (value 0E10 - 3600 decimal) - sound consist of one tone only. And now the most important thing: you will divide displayed in these parameters values by 4, you will have frequencies in Hz conncected with pressing adequate keys in DTMF (Dual Tone Multi Frequency) system. I think, you use DTMF very often - it's used in tone system in all modern phones during calling number. Adequate values are in table (decimal) - parameter eeee is connected with vertical values, ffff with horizontal:

| 1209 Hz | 1336 Hz | 1477 Hz
697 Hz | 1 | 2 | 3
770 Hz | 4 | 5 | 6
852 Hz | 7 | 8 | 9
941 Hz | # | 0 | *

Menu 10-34
Information about FBUS connection between phone and computer.

`aa bb cc dd eee fff ggg hhh iii jjj k`
`CM LD LM NM PEC FEC OEC ACC RXS TXS Mod`

- aa - current fbus media in hex
- bb - last sender dev in hex
- cc - last sender media in hex
- dd - next media to be connected. Same as aa if the connection is not pending
- eee - fbus parity error counter
- fff - fbus framing error counter
- ggg - fbus overrun error counter
- hhh - fbus alive check counter
- iii - received sequence number
- jjj - sent sequence number
- k - phone mode: S=slave, H=host

Description above is from some English documents. As you can see in some phones (like Nokia 5110) values in this test looks rather different, but help is the same. But, when you make connection with FBUS cable and make transmission, first line of values in this test changes to "1E0C1E -". When you will look into some FBUS protocol descriptions, you will see, that:

- "1E" could mean datas send with FBUS protocol over cable
- "0C" could mean, that FBUS cable is connected to phone

and it's the truth. So, it means, that this description is real (even, that test looks a little different).

In Nokia 9110 this menu looks different:

`ll mm nn oo ee ff gg p q r s tt`
`PA RS DR PR PE FE OE Rx Tx D U DC`

- p and q are probably iii and jjj

Links to pages with FBUS (MBUS) protocol are in the question 25.

| If values in this test changed after enabling phone, it means, that it was connected to computer and datas were transmitted with FBUS protocol (not MBUS).

Menu 10-35
Reason of last reboting internal firmware of phone.

`aaaaa bbbbbbbb`
`Reset reason Task name`

- aa - reason:

  - NORM: probably normal power up
  - UNKNO: default value, reset reason is unknown
  - SWSIM: SIM contact failure reset
  - STACK: task stack overflow
  - SWIDL: idle task not running reset
  - HW lub WD: ASIC watchdog timeout
  - SWDSP: restart DSP recovery reset

- bbbbbbbb - name of running task before reset (for example, "AUD TASK", "CC TASK" (confirmed), "DDI TASK", "DEV IO" (confirmed), "EM TASK", "FBUSTASK" (confirmed), "L1 CONTR", "L1 MEAS", "L1 SYSPA" (confirmed), "L2 TASK", "LOCAL" (potwierdzone), "MDI RECE" (confirmed), "MDI SEND" (confirmed), "MM TASK" (confirmed), "OS IDLE" (confirmed), "PN TASK" (confirmed), "RR TASK" (confirmed), "RM TASK", "SIM L2" (confirmed), "SIM UPL" (confirmed), "SMS TASK" (confirmed), "TONETASK", "UI TASK" (confirmed) or "UNKNOWN" (confirmed)). We can notice, that tasks names are similiar to names in help to tests 84-86.

Menu 10-36
Reasons of last reboting internal firmware of phone (you will find here information, how many times phone made restarts because of reasons from previous test).

`aa bb cc dd ee ff`
`UN WD DSP SIM IDL STK`

- aa - unknown resets
- bb - ASIC watchdog timeout resets (in some you can simulate it - see question 9 for details)
- cc - DSP recovery resets
- dd - some English descriptions say, that it's connected with SIM contact failure reset (in some phones you can force reset because of this reason - see question 9). I noticed too, that this counter increases when to try to enter mastercode connected with simlock level 1 using #pw+2222222222+1# code (where mastercode is instead of 2222222222).
- ee - idle task not running resets
- ff - task stack overflow resets

Counters are stored to EEPROM.

| You can reset counters from this menu using some Nokia service programs - for example, in Pc-Locals 1.3 enter to menu 8 ("Event Trace"), menu 5 ("Permanent Counter Table...") and press F6 key ("Clear Counters"). Unfortunatelly :(, "real" counters connected with mastercode entering attempts (Counter for example in WinTesla and WinLock) don't reset then...

Menu 10-38
Memory dump

`aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa`
`Memory dump`

- aaaa.... - hex dump of 24 successive memory locations

The start address of the dump is entered as 6 digit address value into location 30 into phonebook on SIM card (information, how to make it, are in Menu 10-17). An example: for address 0x0C89AB enter 0C2089AB value there... Dump address is changed only when you directly enter to this menu.

This display rather is not included in offcial firmware (I found only one phone with it). It can be switched on by defining flag DEV_FT_MEMORY_DUMP_IN_USE in ftd_conf.h.

Menu 10-39
Reason of last connection end (asterisk means, that the diagnosis won't be sent to the network - it'll be only shown in phone) and making Location Update:

`CC: aaa MM: bbb RR: ccc`
`CC CauseValu MM CauseValu RR CauseValu`

- reason from the CallControl-Layer - it's displayed in Menu 10-2 and Menu 10-63 too:

  1. from the GSM specifications (section 10.5.4.11/GSM 04.08):

     - `1`: unassigned (unallocated) number
     - `3`: no route to destination
     - `8`: operator determined barring
     - `16`: normal end of call (you were speaking or you heard some text - that dialed number was busy or something similiar)
     - `17`: user busy

       - if it was outgoing call, dialed number was busy (phone even displayed 'Number busy')
       - if it was incoming call, a man, who dialed to you, heard busy signal - you were speaking or you rejected it (in Nokia 5110 or 5130 to make it you have to press C key, in Nokia 6110, 6130 or 6150 red receiver)

     - `18`: no user responding
     - `19`: user alerting (from specification - I had it with normal connection too (phone displayed 'No answer' ('Nie odpowiada')) or when incoming call was diverted to voice mailbox), no answer
     - `21`: call rejected

       - phone wasn't in network coverage (message 'No coverage network'), when you tried to make call
       - you tried to call to non existing phone number or you heard busy signal

     - `22`: number changed
     - `27`: destination out of order
     - `28`: invalid number format/number incomplete
     - `31`: unspecidied. It seems, that with this error connection is end by network (for example, when it's overcharged)
     - `34`: no circuit/channel available to make call. Phone displayed 'Network busy'. I noticed too, that in my network RR value changed to 1 with this error. More about situations, when network is busy, I write in TS description.
     - `38`: network out of order
     - `41`: temporary failure
     - `42`: switching equipment congestion
     - `44`: requested channel not available
     - `47`: ressource unavailable. I had it, when connection was "brutal" broken. Concrete: during call phone of my interlocutor disabled because of empty battery. My phone displayed 'Error in connection'
     - `50`: requested facility not subscribed (you must subscribe it to use it)
     - `65`: bearer service not implemented
     - `68`: ACM equal to or greater than ACMmax
     - `69`: requested facility not implemented
     - `88`: incompatible destination

  2. from mine (and not only) experiences:

     - `79`: error with message 'Check operator services'. You have it, when you enable ALS (Alternative Line Service) function, don't have second number on SIM card, select it and try to make call

- reason from the MobilityManagement-Layer - it's shown in Menu 10-64 too. It's from GSM specification (section 10.5.3.6/GSM 04.08):

  - `2`: IMSI unknown in HLR (SIM card not active in network)
  - `3`: illegal phone
  - `4`: IMSI unknown in VLR
  - `5`: phone's IMEI was not accepted
  - `6`: illegal ME
  - `11`: PLMN not allowed (you tried to log into network, which doesn't have roaming convention with your home network - your phone displays 'No access', when you try to select it manually; I don't know only, if this code is displayed only, when this network is saved on forbidden list on SIM card (see Menu 10-6)
  - `12`: Location Area not allowed. You can check it in Menu 10-11.
  - `13`: roaming not allowed in this Location Area
  - `17`: network failure
  - `22`: network congestion
  - `32`: service option not supported
  - `33`: service option not subscribed
  - `34`: service temporarily out of order
  - `38`: call cannot be identified (call RE)

- reason from RadioRessourceManagement-Layer) - see GSM specifications: section 10.5.2.31/GSM 04.08:

  - `0`: normal release
  - `1`: unspecified
  - `2`: channel unacceptable
  - `3`: timer expired
  - `4`: no activity on the radio path
  - `5`: Pre-emptive release
  - `8`: handover impossible, TA out of range
  - `9`: channel mode unacceptable
  - `10`: frequency not implemented
  - `65`: call already cleared
  - `97`: message type not compatible with protocol state
  - `101`: no cell allocation available
  - `111`: protocol error unspecified

When you will see "*" before third parameter from this test, it means (the most often), that call is in progress. Sometimes phone displays different values - I don't know their meaning :-(.

Values of counters are not saved in EEPROM. When phone makes another measure, doesn't reset them (changes only these values during next measure, which are connected with it; doesn't change the rest of them).

| This test allows to find, why exactly your phone doesn't want to work - doesn't want to make calls.

Menu 10-40
Resets handover counters (by direct enter)...

`RESET HANDOVER COUNTERS`
`Use menu to reset handover counters`

Menu 10-41
Information about handover

Handover - it's transfer of radio connection (between phone and cell) from one cell to another (without breaking call). It's made, when:

1. new radio connecting will give better quality (it's parameters are all the time checked by phone and base station)
2. when phone is between few cells and can use "new" cells for him (it frees some place for phones, which can use "old" cell only)

When they're problems with transmission, decision about handover is made by phone (otherwise it's made by BSC). If you enabled using one channel by phone (Menu 10-17), handovers are not made.

There are 4 types of handovers:

- Intra cell - Intra BSC handover (called handoff too): it's the smallest handover inside one cell. Receiver is "thrown over" from one channel to another (gennerally to another frequency inside one cell). Decision, if it should be done, is made by BSC.
- Inter cell - Intra BSC handover: receiver is moved from one cell to another. Decision about it is made by BSC. Connection with first cell is broken after moment, when connection with another is made (displacement between two BTSes inside one BSC).
- Inter cell - Inter BSC handover: displacement of connection between two cells, which are not served by the same BSC. In this case handover is moved by MSC, but decision about it made by first BSC. Connection with first BSC (and BTS) is broken before moment, when connection with another BSC (and BTS) is made.
- Inter MSC handover: receiver moves from cell served by MSC/VLR to another controlled by another MSC/VLR. It's more complicated situation. We can notice, that MSC is connected to GSMc over PSTN. In this case is visible, that another MSC can't receive information from first normally.

  What will happen, when connection will be moved to target MSC/VLR ?

  Because both MSC belongs to the same network, connection is kept. To move it from one to another MSC special number HON (HON=CC+NDC+SN, CC - country code, NDC - network code, SN - subscriber's number) must be generated. It's similiar to roaming number (it's connection between two MSC too). During handover between two MSC connection can't be broken (phone connection realised by network's subscriber).

`HandOOk: aaa PrevCh : bbb HONotOK: ccc HOIntra: ddd`
`HandOvOKCntr PrevChanCntr HandOvNOKCnt HOIntraOKCnt`

- aaa - counter for successful handovers
- bbb - counter for successful back to previous channel attempts (number of actual used channel is displayed, for example, in Menu 10-1)
- ccc - counter for failed handovers
- ddd - counter for successful Intra cell - Intra BSC handovers or assignments

Counters will stop when they reach their maximum (999). To initialize them to zero, use Menu 10-40 (or Menu 10-60).

In dual phones (like Nokia 6150 or 3210) Menu 10-41 looks different and is connected with Inter cell - Intra BSC, Inter cell - Inter BSC and Inter MSC handovers:

`aaaa bbbb cccc dddd eeefffggghhh iiijjjkkklll`
`G>G InterD>D G>D OK D>G InterHoFail BackToPrev`

- aaa - counter of successful handovers from GSM 900 to GSM 900
- bbb -counter of successful handovers from GSM 1800 to GSM 1800
- ccc - counter of successful handovers from GSM 900 to GSM 1800
- ddd - counter of successful handovers from GSM 1800 to GSM 900
- eee - counter of failed handovers from GSM 900 to GSM 900
- fff - counter of failed handovers from GSM 1800 to GSM 1800
- ggg -counter of failed handovers from GSM 900 to GSM 1800
- hhh - counter of failed handovers from GSM 1800 to GSM900
- iii - counter of successful back to previous channel attempts (number of actual used channel is displayed, for example, in Menu 10-1) from GSM 900 to GSM 900
- jjj - counter of successful back to previous channel attempts from GSM 1800 to GSM 1800
- kkk - counter of successful back to previous channel attempts from GSM 900 to GSM 1800
- lll - counter of successful back to previous channel attempts from GSM 1800 to GSM 900

Counters will stop when they reach their maximum (9999 dla dwóch pierwszych linii, 999 dla dwóch ostatnich). To initialize them to zero, use Menu 10-40 (or Menu 10-60).

In Nokia 3110 this test looks like follows:

`HandOOk: aaa PrevCh : bbb HONotOK: ccc T200: eeee`
`HandOvOKCntr PrevChanCntr HandOvNOKCnt T200Cntr`

- eeee - I write about T200 counter in Menu 10-43

and here's for Nokia 6185/6188:

`BSI 01000 VBAT 388 BTEMP 018 BATT 2 CHG 0`

- VBAT - battery voltage (/100V)
- BTEMP - battery temperature in C
- CHG - battery charge status: 1 - charging, 0 - not charging

Menu 10-42
This test is in dual phones (for example, Nokia 6150 or 3210) only and is connected with first kind of handovers (Intra cell - Intra BSC):

`aaaa bbbb cccc dddd eeefffggghhh iiijjjkkklll`
`G>G IntraD>D G>D OK D>G IntraHoFail BackToPrev`

- aaaa - counter of successful Intra cell - Intra BSC handovers from GSM 900 to GSM 900
- bbbb - counter of successful Intra cell - Intra BSC handovers from GSM 1800 to GSM 1800
- cccc - counter of successful Intra cell - Intra BSC handovers from GSM 900 to GSM 1800
- dddd - counter of successful Intra cell - Intra BSC handovers from GSM 1800 to GSM 900
- eee - counter of failed Intra cell - Intra BSC handovers from GSM 900 to GSM 900
- fff - counter of failed Intra cell - Intra BSC handovers from GSM 1800 to GSM 1800
- ggg - counter of failed Intra cell - Intra BSC handovers from GSM 900 to GSM 1800
- hhh - counter of failed Intra cell - Intra BSC handovers from GSM 1800 to GSM 900
- iii - counter of successful back to previous normal channel (you can check number of actual used channel for example in Menu 10-1) attempts inside one cell (INTRA CELL) from GSM 900 to GSM 900
- jjj - counter of successful back to previous normal channel attempts inside one cell (INTRA CELL) from GSM 1800 to GSM 1800
- kkk - counter of successful back to previous normal channel attempts inside one cell (INTRA CELL) from GSM 900 to GSM 1800
- lll - counter of successful back to previous normal channel attempts inside one cell (INTRA CELL) from GSM 1800 to GSM 900

Counters will stop when they reach their maximum (9999 for two first lines, 999 for two last). To initialize them to zero, use Menu 10-40 (or Menu 10-60).

In Nokia 6185/6188 this test looks like Menu 10-20.

Menu 10-43

`T200MS: aaaa T200BS: bbbb T200MS: cccc T200BS: dddd`
`T200 MS GSM T200 BS GSM T200 MS DCS T200 BS DCS`

- aaaa - for GSM 900: counts how many times T200 in phone has expired and therefore L2 transmission has been repeated.
- bbbb - for GSM 900: counts how many times T200 in BTS (network) has expired and therefore L2 transmission has been repeated.
- cccc - for GSM 1800 called earlier DCS (in dual phones only): counts how many times T200 in phone has expired and therefore L2 transmission has been repeated.
- dddd - for GSM 1800 (in dual phone only): counts how many times T200 in BTSie (network) has expired and therefore L2 transmission has been repeated.

Counters will stop when they reach their maximum (9999 for two first lines, 999 for two last). To initialize them to zero, use Menu 10-40 (or Menu 10-60).

In Nokia 6185/6188 this test looks like Menu 10-21.

Menu 10-44
You change value from 01 (default) to 00 (or vice versa) by direct enter to this test.

`REVISION LEVEL IS aa`
`Use menu to change Revision Level`

In Nokia 6185/6188 this test looks like Menu 10-22.

Menu 10-45
This test allows to simulate situations. when phone can normally receive network signal (but network can't receive any information from phone). It's very realistic (even in Menu 10-1 in ddd parameter an asterisk (*) is displayed, when you try to make connection), but not always (in Menu 10-10 you will see 'xxxxxxxx' instead of TMSI, when T3212 counter in first parameter will be expired).

You can change it by direct enter.

`TRANSMITTER ENABLED`
(default setting) |
`TRANSMITTER DISABLED`
`Use menu to enable or disable transmitter`

| When you enable it, phone won't be able, for example, to update location (see Menu 10-64) and make calls. It will allow to: "blockade" phone to the moment of another enabling it (for example, when you want to observe network parameters, but you don't want to be accessible for others - when somebody will call to you, for network your phone will be outside range) fast remind you of number written to phonebook (it's written on leaf, but you don't remember name of person assigned to): simple call it. When phone will choose number, it will display this name; it will be written on list odf last dialed numbers too.

This test DOESN'T WORK CORRECTLY in Nokia 3210 and 7110 (you change setting, but it doesn't give described above results).

In Nokia 6185/6188 this test looks like Menu 10-23.

Menu 10-46

`BAND CLASS a CS SUBSTATE EM STATEnnn TX POWER DB`

Menu 10-48
In Nokia 3110 this test looks like Menu 10-7.

Menu 10-51
Information about SIM card

`aaa bbb ccc dddddddd e f gg hh i jjjj`
`VSel Bau SAl SCond CStop PIN12 PUK12 ATR FE/PE`

- aa - SIM voltage selection type (3, 3/5 or 5)
- bbb - division coefficient, which define speed of communication phone with SIM card (372, 64, 32 or 0) saved in ATR (first sequence send by SIM card after reset - Answer To Reset). When you will divide clock frequency (maximal 3,25 MHz = 3 250 000 Hz) by it, you will have speed of transmission (for example, 3 250 000 Hz / 372 = 8736,5 bods)
- ccc - information, whether SIM clock stop is allowed (it saves energy) during standby (YES or NOT - possible or not). This information is displayed (in Nokia phones and not only) using *#SIM0CLOCK# code - when you will see "SIM clock stop allowed", SIM card allows to make it. Some Nokia 6110 phones (it depeneds on their firmware) can not support correctly this code - they display, for example, "Result unknown". Phone disables SIM card clock automatically - you can't make it manually !
- dddd - information about clock stop condition:

  - UP
  - DOWN
  - DOWN(UP) - in tested by me SIM cards
  - UP(DOWN)
  - xxxxxxxx

- e - number of left PIN1 code entering attempts. When it's bigger than 9, you will see only last digit of it (for example, I found some prepaid cards with 10 value). Maximal number of entering code attempts depends on concrete SIM card (it can be set to any value), but the most often it's equal 3. In some SIM cards you can disable answering for this code (for example, you can select it in Menu 4-3-1 in Nokia 5110). When it's equal 0, phone shows "Sim card blocked" and asks for PUK1. If it was entered correctly, this counter is reset to maximal value. Disabling and enabling phone doesn't reset it !
- f - number of left PIN2 code entering attempts (when SIM card doesn't support PIN2 functions, you will see "x" here). You can check, if these functions are supported, using call cost function too (if they're not, phone displays "Not allowed"). If you wanted to use them and your card doesn't support them (you will see "x" here), you (or your operator ;-) rather) have to change it. Maximal number of entering code attempts depends on concrete SIM card (it can be set to any value), but the most often it's equal 3. When this counter is equal 0, phone asks for PUK2. When this code was entered correctly, counter is reset to maximal value. Of course, even when it's equal 0, you can normally use SIM card (PIN2/PUK2 are independent of PIN1/PUK1), when you know PIN1. Disabling and enabling phone doesn't reset it !
- gg - number of left PUK1 code entering attempts. Maximal number of entering code attempts depends on concrete SIM card (it can be set to any value), but the most often it's equal 10. Phone asks for it, when counter of left PIN1 code entering attempts is equal 0 (phone shows "Sim card blocked"). When this counter is equal 0 too, SIM card can be blocked (phone shows "Sim card rejected") or (it depends on card) asks for PUK2. When this code was entered correctly, counters of left PIN1 and PUK1 codes entering attempts are reset to maximal values. Disabling and enabling phone doesn't reset it !
- hh - number of left PUK2 code entering attempts (when SIM card doesn't support PIN2 functions, you will see "x" here). Maximal number of entering code attempts depends on concrete SIM card (it can be set to any value), but the most often it's equal 10. When it's equal 0, using PIN2 functions can be impossible on this SIM card (ask operator for help). Additionaly, when you were asked for PUK2, when counters of left PIN1 and PUK1 codes entering attempts were equal 0 and now left PUK2 code entering attempts is equal 0 too, using this SIM card can be impossible (you have to replace it to new). When it was entered correctly, counters for this code and PIN2 (when you entered PUK2, because PIN2 was blocked) are reset to maximal values or counters for this, PIN1 and PUK1 are reset (when you entered PUK2, because PIN1 and PUK1 were blocked). Disabling and enabling phone doesn't reset it !
- i - ATR repeat counter (ATR is first sequence sent by SIM card in answet to reset - Answer To Reset) (0-9)
- jjjj - number of retransmissions/parity errors in transmission with SIM card (when the happen, two first chars are equals FE (Frame Error) or PE (Parity Error), two last number of retransmission/errors)

CStop parameter (information, if SIM card clock is disabled in this moment) is displayed in help only. Why ? Probably somebody didn't remember about it...

Here are some observations for SIM voltage selection type (first parameter) Nokia 5110 and tested SIM cards:

After enabling phone reads some information from SIM card (for example, number saved on it SMS messages, numbers from phonebook) - when you try to read something, what is written there (for example, phonebook), "SIM card not ready" message is displayed then (and first parameter shows 3). I noticed, that phone can't display names assigned to numbers in phonebook too (for example, when you call somebody) and shows, that "Inbox" and "Outbox" are empty (even, when some messages are saved there).

Later value of parameter changes to 3/5 - I suppose, SIM card clock is enabled then.

Phone disables it (in test value 3), when communicates with network (requesting services, sending or receiving SMS messages) because of saving energy (the same in NSPS state).

When you call to number assigned to name in phonebook (or phone recognizes incoming number), value to the end of call is equal 3/5 (otherwise it changes to 3). After end of call is always equal 3. Logical conclusion: after enabling phone saves in own memory checksum for all numbers from phonebook (it's enought to make for 7 last digits - they're used to identify number in Nokia phones). If this checksum is the same to checksum for number, you're calling (or incoming number), phone reads name from phonebook...

And the last observation: without connection (see above) value of first parameter is equal 3/5 (is some energy loose ? Probably yes... But why counter from Menu 10-20 doesn't show any change in their consumption ?)

When you try to open "Outbox" or "Inbox", phone doesn't enable clock, when they're empty (that's why I think, that phone saves into own memory number of saved SMS messages too).

Many information about SIM card are displayed by SIMedit (unfortunatelly, in Czech language only :-( )... Parameters like ATR you can study using SIM Scan (it's on the www.net.yu/~dejan or http://members.tripod.com/~dejank/ pages). They both work with SIM card readers only...

In Nokia 6185/6188 this test looks like follows:

`TASK0 0134 TASK1 015C TASK2 0138 TASK3 0170`

Menu 10-52
Reads datafield from SIM card

`Read SIM- data field to SIM-SCM`
`Use menu to read SIM- data field to SIM-SCM`

This display reads a binary datafield from SIM card to SIM SCM memory (SCM = Short Code Memory and it means phonebook on SIM card).

Prior using this display the identifier of datafield has to be stored as an alpha-identifier of SCM location number 34 of SIM memory. The datafield must be written in hexadecimal notation. The identifiers can be found from the GSM 11.11.

The contents of datafield is stored as a data-identifier of SCM location number 35 of SIM memory. The contents are displayed in hexadecimal notation. The maximum length of the datafield is 10 bytes, but the length depends on the name length of the SIM memory. In case the datafield cannot be read the alpha-identifier of SCM location is NOT DONE.

The information of how the read succeeded can be read from the SCM location 36 of SIM memory and on the display for a short period.

The following results are possible:

OK | datafield was read correctly
NOT BINARY | datafield is either formatted or cyclic
NOT FOUND | datafield was not found from SIM card
CARD ERROR | something weird happened, card did not respond as expected
NO RIGHTS | not enough rights to read the datafield (PIN2,adm..)
NOT STORED | could not store into the result memory place
NO ADDRESS | could not read the address from the SCM-location
UNKNOWN | unidentified error

For the time being following binary datafields exist in SIM. In future there could be more. All of these are not necessarily on all SIM cards.

2FE2 | ICC identification | (10 bytes)
6F05 | Language preference | (variable length)
6F07 | IMSI | (9 bytes)
6F20 | Ciphering key Kc (it's read from card after entering PIN) | (9 bytes)
6F30 | PLMN selector | (variable length)
6F31 | HPLMN (home network ?) search period | (1 byte)
6F37 | ACM maximum value | (3 bytes)
6F38 | SIM service table | (2-4 bytes)
6F41 | Price per unit and currency table | (5 bytes)
6F45 | Cell broadcast message identifier selection | (variable length)
6F74 | Broadcast control channels | (16 bytes)
6F78 | Access control class | (2 bytes)
6F7B | Forbidden PLMNs (see Menu 10-7) | (12 bytes)
6F7E | Location information (TMSI, Local Area Information (consist of MCC, MNC & LAC - see Menu 10-11 for them), last Location Update status) | (11 bytes)
6FAD | Administrative data | (variable length)
6FAE | Phase identification | (1 byte)
6F43 | SMS status | (variable length)
Next two binary datafields are phase 2+ features which are not currently in use
6F3E | Group Identifier Level 1 | (variable length)
6F3F | Group Identifier Level 2 | (variable length)

In Nokia 6185/6188 this test looks like follows:

`TASK4 0134 TASK5 015C TASK6 0138 TASK7 0170`

Menu 10-53
Writes datafield into SIM card

`Write data field from SIM-SCM to SIM`
`Use menu to write data field to SIM`

This display writes data for a binary datafield in SIM card by using data in SCM memory of SIM card.

Prior using this display the identifier of datafield has to be stored as an alpha-identifier of SCM location number 34 of SIM memory. The datafield must be written in hexadecimal notation. The identifiers can be found from the GSM 11.11. In addition the data to be stored into SIM card has to be entered as an alpha-identifier of SCM location number 35 of SIM memory. The data has to be stored in hexadecimal notation.

The result of write operation can be seen from the alpha-identifier of SCM-location 36 of SIM-memory and on the display for a short period.

The following results are possible:

OK | datafield was read correctly
NOT BINARY | datafield is either formatted or cyclic
NOT FOUND | datafield was not found from SIM card
CARD ERROR | something weird happened, card did not respond as expected
NO RIGHTS | not enough rights to read the datafield (PIN2,adm..)
DATA ERROR | the data contents in SCM location is coded wrongly
NOT STORED | could not store into the result memory place
NO ADDRESS | could not read the address from the SCM location
UNKNOWN | unidentified error

If you want to see changes, often you have to restart your phone.

In Nokia 6185/6188 this test looks like follows:

`TASK8 0134 TASK9 015C TASK10 0138 TASK11 0170`

Menu 10-54
Information about memory blocks

`aa bb aa bb aa bb aa bb aa bb aa bb aa bb aa bb`
`ResF1 ResF2 ResF3 ResF4 ResF5 ResF6 ResF7 ResF8`

Meaning of the individual lines (information about another blocks):

1. 1, 2
2. 3, 4
3. 5, 6
4. 7, 8

- aa - number of reserved blocks
- bb - number of free blocks in worst case

In Nokia 6185/6188 this test looks like follows:

`TASK12 0134 TASK13 015C TASK14 0138 TASK15 0170`

Menu 10-55
Information about memory blocks (some phones don't have this test - they don't have such big memory)

`aa bb aa bb aa bb aa bb aa bb aa bb aa bb aa bb`
`ResF9 ResF10 ResF11ResF12 ResF13ResF14 ResF15ResF16`

Meaning of the individual lines (information about another blocks):

1. 9, 10
2. 11, 12
3. 13, 14
4. 15, 16

- aa - number of reserved blocks
- bb - number of free blocks in worst case

In Nokia 7110 counters end on ResF11.

In Nokia 3110 this test looks like Menu 10-56.

Menu 10-56
Block display

`aaaaaa bbb cccccccc`
`Ptr Cntr Task`

- aaaaaa - pointer to memory where double deallocation was called, in hex format.
- bbb - counter for failed deallocations.
- cccccccc - name of task which last tried to double deallocate a block (you can find their list in Menu 10-35 description).

This test has correct values only, when counter bbb is different from 0.

In Nokia 3110 it looks like Menu 10-57.

Menu 10-57
Memory status before reset

`aaaaaaaaaaaa aaaaa... bbbbbbbb`
`Status of stacks Block sets`

- aaaaaa... - Status of each stack before reset. First position contains the status of stack 0, second position the status of stack 1 and so on. The last position contains the status of System stack. Number of stacks depends on the current configuration of software. Possible values for each stack are:

  - 0: status OK, no overflow - it's normally !
  - 1: status not OK, stack overflow

- bbbbbbb - status of each block set before reset. First position contains the status of block set 1, second position the status of block set 2 and so on. Possible values for each block set are:

  - 0: status OK
  - 1: block set full - it's normally !
  - 2: (de)allocation error or total memory corruption

This display is only valid when a unknown or a stack overflow interrupt has occured. In some phones you can make restart connected with stack overflow (see question 9) and see this test in "action"...

In Nokia 6185/6188 this test is different:

`16:3A 32:26 64:18 128:21 168:14 264:0E`

Back to the top

[Part 1][Part 2][Part 3][Part 4][Part 5][Part 6][Part 7]

Marcin Wiacek (WWW)
Last modifcation: 4 May 2000