SEQ COMMAND TX_OPCODE RX_OPCODE DATA_FIELDS DATA_DEFAULTS OPTION_FIELDS OPTION_DEFAULTS DATA_WIDTH DESCRIPTION
1 READ TIMEOUT
READ
2
YES
1 Read only.
2 GENERIC_COMMAND - Send Generic Opcode/Data Hex String STRING TIMEOUT
READ
10
YES
Enter the opcode and parameters in the Command Data window.
3 BOUNCE - Send BOUNCE message DATA BBCCDDEE TIMEOUT
READ
MSG_ID
2
YES
0004
4 AT_COMMAND - Send AT Command string. STRING AT+MODE=1
5 AT_MODE - Sends AT+MODE=1 for serial comm 41542B4D4F44453D310D0A 41542B4D4F44453D310D0A TIMEOUT
READ
2
YES
No data required
6 AD_CONV - Perform A/D Conversion 0001 0001 PARAMETER 0000 TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
*Denotes 3G unsupported parameter

0000=PA thermistor*
0001=IF thermistor*
0002=BUSMODE*
0003=Uncompensated RSSI*
0004=MCI0*
0005=MCI1*
0006=RF Detect
0007=Raw Ext B+ Voltage*
0008=Main Batt temp.*
0009=CCAP Thermistor*
000A=B+ Voltage
000B=Phased B+SENSE
000C=Main Batt Voltage
000D=Phased BATSENSE
000E=RTC Batt Voltage
000F=Reserved*
0010=MPBSENSE
0011=Phased MPBSENSE
0012=BATT_THERM
0013 Reserved*
0014=CG_DF1
2
0015=Reserved*
0016=BATT_FDBK
0017=Reserved*
0018=DSC_EN_OUT
0019=Reserved*
001A=DOWNLINK
001B=Reserved*
001C=AD9
001D=Reserved*
001E=Touch Screen X1
001F=Reserved*
0020=Touch Screen X2
0021=Reserved*
0022=Touch Screen Y1
0023=Reserved*
0024=Touch Screen Y2
0025=Reserved*
0040=Harmony Lite TXADC_0
0041=Harmony Lite TXADC_1
0042 - 004F=Reserved for WCDMA
00FF=All Parameters*
7 AIRPLANE_MODE - Set the Phone Operating Mode 0C22 0C22 MODE 00 TIMEOUT
READ
2
YES
MODE (1 byte):
00=Handset Mode
01=Airplane Mode
8 AUD_CTRL - Control Audio 0003 0003 ACTION
OPTION
00
01
TIMEOUT
READ
2
YES
ACTION (1 byte):
- Disable - 0x00
- Enable - 0x01

OPTION (1 byte):
01=Sidetone
02=Echo cancellation
03=Noise Supression
9 AUD_LPB - Audio Loopback 0004 0004 ACTION
OPTION
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
- Disable - 0x00
- Enable - 0x01

OPTION (1 byte):
00=Audio IC
01=Speech Coder EFR
02=Speech Coder FR
03=Speech Coder HR
04=AMR 4.75
10 AUD_LVL - Audio Level 0005 0005 ACTION
LEVEL
00
0000
TIMEOUT
READ
2
YES
OPTION (1 byte):
00=Set volume level
01=Get volume level

LEVEL (2 bytes):
0-64 Hexadecimal
11 AUD_EMU 0908 0908 TIMEOUT
READ
2
YES
ATTENTION: Not supported on SCM-A11

No data required
12 AUD_PATH - Set Audio Path 0006 0006 INPUT_PATH
OUTPUT_PATH
L_CHAN_MUTE
R_CHAN_MUTE
00
00
00
00
TIMEOUT
READ
2
YES
PATH (4 bytes):

--1 Byte: (Input path)--
00 = As Is (Prev Set Path)
01 = Mute Input Path
02 = Internal Mic
03 = External Car Kit Mic
04 = Headset Mic
05 = Bluetooth
99 - (Manual Entry)

--1 Byte: (Output path)--
00 = As Is (Prev Set Path)
01 - Mute Output Path
02 - Internal Speaker
03 - Mono/Dual Alert
04 - External Car Kit speaker
05 - SpeakerPhone
06 - Stereo Headset Speaker
07 - Bluetooth
08 - Mono Headset Speaker
99 - (Manual Entry)

--1 Byte:
01 = L. Chan. Mute

--1 Byte:
01 = R. Chan. Mute
13 AUD_PLAY_MEDIA_FILE - Play sound file 0C2D 0C2D ACTION
FILENAME
00 TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 = Stop (must be done before another start is issued)
0x01 = Start a continuous loop on media file

FILENAME (Variable up to 511 bytes):
Directory and path in unicode of filename of media file to play. Must be null terminated.

NOTE: For SCM-A11
the Audio Manager can not be individually suspended by the SUSP_COMP command (See “0C18 - SUSPEND_COMP (Not Supported on SCM-A11)” on page 152.). Instead the AM
will go into a partially supended state when the phone is in test mode with the SUSPEND command.
14 AUD_SAMP - Audio Sample 0C15 0C15 SAMPLE_RATE
SAMPLE_TIME
8
10
TIMEOUT
READ
2
YES
1
1
SAMPLE_RATE (1 byte):
8 or 16 = Sample rate in kHz

SAMPLE_TIME (1 byte):
1 - 255 = Sample time in ms. If a sample time of 0x00 is given
samples will be collected until powerdown.
15 AUD_TN_GEN - Enable/Disable Audio Tone 0044 0044 ACTION
NOM_OF_FREQ
FREQ1
LEVEL1
FREQ2
LEVEL2
FREQ3
LEVEL3
FREQ4
LEVEL4
00
01
7FE7
7FFF
7FE7
7FFF
7FE7
7FFF
7FE7
7FFF
TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00= Stop generating tone
0x01 = Start Tone Generation

NUMBER OF FREQUENCIES
Valid range=01 to 04

FREQ1 (2 bytes):
First phased frequency

LEVEL1 (2 bytes):
Valid range=0000 to 7FFF

FREQ2 (2 bytes):
Second phased frequency

LEVEL2 (2 bytes):
Valid range=0000 to 7FFF

FREQ3 (2 bytes):
Third phased frequency

LEVEL3 (2 bytes):
Valid range=0000 to 7FFF

FREQ4 (2 bytes):
Fourth phased frequency

LEVEL4 (2 bytes):
Valid range=0000 to 7FFF

Phased Frequency=32768*COS(2*PI*(frequency in hertz/sampling frequency))
(e.g. sampling frequency = 8000 Hz)

Note: Generating a frequency tone/tones from DSP will be done through a single path: internal mic -> internal speaker. This is due to the fact that this command supports up to 4 frequencies generated concurrently.

Note: The level of the tones is modified as part of the input params
and not by the AUD_LVL command. This is due to the fact that this command deals with generating several frequencies concurrently and we want the user to be able to control the volume of each frequency separately.
16 AUD_TN_LST - Audio Tone List 0000 0000 ACTION
TONE
00
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
0x01=Enable
0x00=Disable

TONE CODE - 2 bytes
17 AUTOCYCLE 0002 0002 ACTION 01 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Reserved for future use
01=Enable Autocycle mode
18 BATCH - Run an Internal phone .bat file 0C2F 0C2F ACTION
DATA
0002 TIMEOUT
READ
2
YES
ACTION (2 bytes):
0x0000 = Start new batch file
0x0001 = Stop current batch
0x0002 = Get current batch state
0x0003 = Set batch file for auto run (not implemented)
0x0004 = Clear auto run file (not implemented)
0x0005 = Execute auto run file
0x0006 - 0xFFFF = reserved

DATA (Variable or 0 Bytes):
Action 0x0000 (Start):
Byte2:Log_action
0x0001 = Log success responses
0x0002 = Log error responses
0x0004 = log all commands
Byte4: Repeat Count - number of times to repeat batch file. 0x0000 = infinite.
Byte6: Filename - UNICODE path of batch file to execute
19 I_BATCH ACTION
DATA
ACTION (2 bytes):
0x0000 = TCMD
0x0001 = WAIT
0x1001 = LOG MASK
0x1002 = Nested batch

DATA (Variable):
20 BAUD_RATE - Change Baud Rate 0C1D 0C1D PORT
BAUD_RATE
01
08
TIMEOUT
READ
2
YES
PORT (1 byte):
00=Reserved (UART 1)
01=UART 2
02=Reserved (UART 3)

BAUD_RATE (in kbps) (1 byte):
00=1
200
01=2
400
02=4
800
03=9
600
04=14
400
05=19
200
06=28
800
07=57
600
08=115
200
09=230
400
0A=460
800
0B=812
500
21 BT - Bluetooth 0042 0042 TCI_PARAMETER
TCI_DATA
80 TIMEOUT
READ
2
YES
TCI_PARAMETER (1 byte):
01=HCI command message type
02=HCI ACL Data message type
03=HCI SCO Data message type
04=HCI Event message type
80=Set no test mode
81=Set HCI test mode
82=Set L2CAP test mode
83=Set BT transceiver test mode
84=Start Bluetooth - test firmware
85=Start Bluetooth - norm firmware
86=Terminate bluetooth

TCI_DATA (variable):
A byte array of data
22 CAMERA - Camera command (Paragon) 0C1A 0C1A PARAMETER
DATA
02
00
TIMEOUT
READ
5
YES
PARAMETER (1 byte):
0x00 = Read BEP/Imager Rev
0x01 = Start up and Init CAM_IF
I2C
BEP
Imager
0x02 = Start/Stop LCD viewfinder
0x03 = Capture JPEG
0x04 = Capture MP4
0x05 = Camera Rotation
DATA (variable):
23 CAMERA_T - Camera command (Talon) 0C1F 0C1F PARAMETER
DATA
02
00
TIMEOUT
READ
5
YES
PARAMETER (1 byte):
0x00 = Start/Stop Viewfinder
0x01 = Cature JPEG
0x02 = Capture MP4
0x11 = View JPEG
0x12 = View MP4

DATA (variable):
24 CARRIER - Enable/Disable Transmit Carrier 0007 0007 ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Disable
01=All zeroes
03=All ones
05=PRBS w/midamble 0
07=PRBS w/midamble 1
09=PRBS w/midamble 2
0B=PRBS w/midamble 3
0D=PRBS w/midamble 4
0F=PRBS w/midamble 5
11=PRBS w/midamble 6
13=PRBS w/midamble 7
15=RACH Burst
19=PRBS w/midamble 0 in 2 TS
1B=PRBS w/midamble 0 in 3 TS
25 CARRIER_SYN_ATTN - Enable/Disable Transmit Carrier with Channel & Power Level 0052 0052 ENABLE
CHANNEL
BAND
LEVEL
1
384
0
0
TIMEOUT
READ
2
YES
1
2
1
1
ENABLE (1 byte):
Bits D7:D5:
Reserved and set to 0
Bits D4:D1:
Pattern type (GSM only)
Bit D0:
0b=disable
1b=enable

CHANNEL (2 bytes):
Valid range:
1 to 799
990-1023 (CDMA
TDMA
AMPS 800 MHz)
1 to 1998 (TDMA 1900MHz)
25 to 1175 (CDMA 1900 MHz)
1 to 124 (PGSM 900 MHz)
0
975 to 1023 (EGSM 900 MHz)
512 to 885 (DCS 1800 MHz)
512 to 810 (PCS 1900 MHz)

BAND (1 byte/last 4 bits):
0000b=800 MHz (TDMA only)
0011b=1900 MHz (TDMA only)

LEVEL (1 byte):
0 to 7 (CDMA-AMPS)
Tx output power in 2's compliment format (CDMA 800
1900).
0 to 10 (TDMA)
0 to 19 (GSM)
26 CP_MODE - Set Sub-mode 000A 000A SUBMODE 80 TIMEOUT
READ
2
YES
SUBMODE (1 byte):
8x=Read current submode
00=CDMA AMPS
01=CDMA
02=CDMA PCS
03=GSM 900
04=GSM 1800
05=GSM 1900
06=GSM Dual Band 900/1800
07=(Reserved) GSM Dual Band 850/1900
08=W2100
09=(Reserved) Dual Band W2100/GSM1900
0A=(Reserved) Dual Band W2100/GSM900/1800
0B=W1900
0C=Dual Band W1900/GSM850/1900
0D=Dual Band W2100/GSM900/1800
0E=W800/2100 (Japan)
0F=W850/1900 (N. Amer.)
27 CON_MODE - Configures USB connectivity mode 0C2C 0C2C ACTION
MODE
01 TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 = Set Connectivity mode
0x01 = Get Connectivity mode

MODE (1 byte):
0x00 = USB
0x01 = RS232 mode1
0x02 = RS232 mode 2
0x03 = reserved
0x04 = Mono Audio (Rx audio left to UDM
UDP to TXOUT)
0x05 = Stereo Audio (Rx audio left to UDM
Rx audio right to UDP)
0x06 = Test Mode Right (Rx audio right to TXOUT
USB Tx enabled)
0x07 = Test Mode Left (Rx audio Left to TXOUT
USB Tx enabled)
28 DSP_SPI_TRIG_CONFIG - Configure an MQSPI Trigger 0C04 0C04 SELECT/TRIG_ID
R/W_SELECT
TRIG_ID_POINTER
TRIG_ID_MODE
00
80
0000
0000
TIMEOUT
READ
2
YES
SELECT/TRIG_ID (1 byte):
bit D7
0b=MQSPI 1
1b=MQSPI 2
bit D6
0b=SPI 1
1b=SPI 2
bit D5
0b=low priority
1b=high priority
bits D4-D0 - Trigger ID number

R/W_SELECT (1 byte):
00=Write
80=Read

TRIG_ID_POINTER (2 bytes):
This word is copied into SPICDPx register
bits D15-D8 specify the starting location of write
bits D7-D0 specify the starting location of read

TRIG_ID_MODE (2 bytes):
This word is copied into SPICDMx register

bit D15
0b=Burst mode enabled
1b=Burst mode disabled

bits D14-D9 specify number of messages to transfer (000000b=1 message
111111b=64 messages)

bits D8-D4 specify message data byte length (00000b=1 byte
11111b=32 bytes)

bits D3-D0 - Queue chip select
0000b=SPI_CS0 - Harmony
0001b=SPI_CS1 - Magic
0010b=SPI_CS2
0011b=SPI_CS3
0100b=SPI_CS4
0101b=SPI_CS5
0110b=SPI_CS6
0111b=SPI_CS7
1000b=SPI_CS8
1001b=SPI_CS9
29 EGPM - Enable GSM/PCS Handovers 0904 0904 ACTION 01 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Disable
01=Enable
30 ERS_PANIC 000C 000C PROCESSOR TIMEOUT
READ
2
YES
ATTENTION: Obsolete on SCM-A11

PROCESSOR (2 bytes):

NOT REQUIRED FOR BP ONLY PHONES

0x0000=Adjunct Processor
0x0001=Baseband Processor
31 FLASH - Enter Flash Mode 000D 000D TIMEOUT
READ
20
YES
No data fields required. Overwrites the barker code and causes software to jump to the reset vector.
32 FLIP - Flip status (Open/Closed) 0043 0043 PARAMETER 80 TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x80 = Read Flip State
33 FSAC - File System Access 004A 004A PARAMETER
DATA
00000004 TIMEOUT
READ
60
YES
PARAMETER (4 bytes):
0x00000000 = Open File
0x00000001 = Read File
0x00000002 = Write File
0x00000003 = Seek File
0x00000004 = Close File
0x00000005 = Delete File
0x00000006 = Clear File
0x00000010 = Format Volume

DATA (variable):
Open file:
Bytes (1-4)
00000000 = Default
00000001 = Read Only
00000002 = Hidden
00000004 = Preload/System
Bytes (5 - (n+4))
Filename

Read File (4 Bytes):
# of bytes to read

Write File:
Bytes (1-4)
# of bytes to write
Bytes (5 - (n+4)
Data to write

Seek File:
(Bytes 1-4)
Offset to move by
(Byte 5)
Initial location of pointer

Close File:
No Data

Delete File:
Filename to delete

Clear File (1 Byte):
00 = All
01 = User Files
02 = Read Only files
03 = Hidden files
04 = Preload/System Files

Format Volume Data
(1-511) bytes = Volume Name
34 GET_PANIC - Read Panic Info 000E 000E OFFSET
SIZE
PROCESSOR
0000
0100
TIMEOUT
READ
2
YES
ATTENTION: Obsolete on SCM-A11

BP FORMAT

OFFSET (2 bytes):
Offset from beginning of panic block

SIZE (2 bytes):
0=read entire block
Otherwise
# of bytes to read (1-8192)


AP FORMAT

OFFSET (4 bytes):
Offset from beginning of panic block

SIZE (4 bytes):
# of bytes to read
(BP: 1-32768)
(AP: 1-65536)

PROCESSOR (2 bytes)
0x0000=Baseband Processor
0x0001=Adjunct Processor
35 GPIO_MUX_CTRL - Read/Write GPIO Port 0C2B 0C2B PARAMETER
DATA
00
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x00 = Read GPIO
0x01 = Write GPIO
0x02 = Configure GPIO

DATA (Variable)
READ (2 bytes):
Byte0
0x00 = MCU
0x01 = SPBA
Byte1
GPIO Pin # (0x00-0x1F)
WRITE (3 bytes):
Byte0
0x00 = MCU
0x01 = SPBA
Byte1
GPIO Pin # (0x00-0x1F)
Byte 2
Data
CONFIGURE (Variable):
36 GPRS_LPB - GPRS Loopback 0903 0903 CHANNEL
TSC
TADVANCE
CODING
DL_TIMESLOT
UL_TIMESLOT
ALPHA
GAMMA_TN0
GAMMA_TN1
GAMMA_TN2
GAMMA_TN3
GAMMA_TN4
GAMMA_TN5
GAMMA_TN6
GAMMA_TN7
T_AVG_T
CHAN_MEAS
UL_BURST_TYPE
ACCESS_BURST_TYPE
0014
00
00
02
BA
00
00
00
C0
C0
00
00
00
00
00
00
00
00
00
TIMEOUT
READ
2
YES
CHANNEL (2 bytes):
0-1023 = Channel number

TSC (1 byte):
0-7 = Training Sequence Code

TADVANCE (1 byte):
0-63 = Timing Advance

CODING (1 byte):
Coding Scheme
0=CS-1
1=CS-2
2=CS-3
3=CS-4

DL_TIMESLOT (1 byte):
Bitmask where each bit represents a timeslot from 0 to 7
MSB = TS0
LSB = TS7
0b=Timeslot unassigned
1b=Timeslot assigned

UL_TIMESLOT (1 byte):
Bitmask where each bit represents a timeslot from 0 to 7
MSB = TS0
LSB = TS7
0b=Timeslot unassigned
1b=Timeslot assigned

ALPHA (1 byte):
0-19 = Alpha

GAMMA_TN0 - GAMMA_TN7 (1 byte each):
0 = 0dB
1 = 2dB
..........
..........
30 = 60dB
31 = 62dB

T_AVG_T (1 byte):
0-25 = sig strength filter period for pwr cont

CHAN_MEAS (1 byte):
0 = DL meas for pwr cont are on BCCH
1 = DL meas for pwr cont are on PDCH

UL_BURST_TYPE (1 byte):
0 = Normal burst
1 = Access burst
MSB corresponds to TS0
LSB corresponds to TS7

ACCESS_BURST_TYPE (1 byte):
0 = Normal burst
1 = Access burst
Bitmask where each bit represents a timeslot from 0 to 7
MSB = TS0
LSB = TS7
37 GPRS_SEND - Initiate Sending GPRS Data 0905 0905 TYPE
PDU
LENGTH
PRIORITY
THRP
0
0
0
1
0
TIMEOUT
READ
2
YES
1
1
2
1
1
TYPE (1 byte):
LLC Frame Type
00=LLC ACK mode
01=LLC UNACK mode

PDU (1 byte):
0-255=Number of PDUs to send

LENGTH (2 bytes):
0-1530=Data length for RLC to generate

PRIORITY (1 byte):
1-4=Radio Priority

THRPT (1 byte):
0-9=Throughput
38 GPS - GPS Test Command 0C17 0C17 PARAMETER
DATA
08 TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x00 GPS Power Control
0x01 GPS Geolocation
0x02 GPS Logging Mode
0x03 Reserved
0x04 GPS Set Almanac Mode
0x05 Enter GPS Test mode
0x06 Exit GPS Test Mode
0x07 GPS Start C/No Tracking
0x08 GPS Retrieve C/No Tracking Request
0x09 GPS Stop C/No tracking request
39 INVM - Clear/Reset Non-volatile Memory 0012 0012 LEVEL 00 TIMEOUT
READ
90
YES
LEVEL (1 byte):
00=Master Reset
01=Master Clear
02 - 04 Reserved
05=MC & Reset Codes
06=Reset Lock Code
07=Reset Security Code
08=Reset Lock & Security
40 IRDA - Activate / Deactivate the IrDA Port 0040 0040 ACTION
TIME
00
5000
TIMEOUT
READ
6
NO
1
2
ATTENTION: Not Supported on SCM-A11

ACTION (1 byte):
00=Activate IrDA
01=Deactivate IrDA
02=IrRC Tx Activate
03=IrRC Tx Deactivate

TIMEOUT (2 bytes):
Timeout in milliseconds.
41 IS_FR - Is Handset Future Ready 0C20 0C20 TIMEOUT
READ
2
YES
42 KEY_TEST - Return the Last Key Pressed 003F 003F TIMEOUT
READ
2
YES
No data fields required. Returns the last keypress detected.
43 KEYS - Send string of keycodes 0013 0013 KEY_LIST 00 TIMEOUT
READ
2
YES
KEY_LIST (20 bytes max.):
This field is a variable size array of bytes representing key codes to send.
00=Key 0
01=Key 1
02=Key 2
03=Key 3
04=Key 4
05=Key 5
06=Key 6
07=Key 7
08=Key 8
09=Key 9
0A=Asterisk *
0B=Sharp #
0C=Scroll up
0D=Scroll down
0E=Softkey 1 (Left)
0F=Softkey 2 (Center)
10=Softkey 3 (Right)
11=End
12=Send
13=Power
14=Menu
15=Smartkey
16=Single volume
17=Side volume up
18=Side volume down
19=Side volume up (no scroll)
1A=Side volume down (no scroll)
1B=SMS feature key
1C=Voice mail feature key
1D=Phone book feature key
1E=Menu scroll backward
1F=Mute
20=Multiband knifeswitch
21=Voice annotator key
22=Service Dialing Numbers feature key
23=Option key
24=Fast access key
25=Clear key
26=Reserved
27=NOSCROLL_STAR
28=NOSCROLL_POUND
29=FORWARD
2A=BACKWARD
2B=VOICE
2C=JOYSTICK_UP
2D=JOYSTICK_DOWN
2E=JOYSTICK_LEFT
2F=JOYSTICK_RIGHT
30=Menu scroll forward
31=SPEAKER
32=Headset with single position
33=Headset with double position
34=Wild any digit (0-9)
35=Wild any digit (1-9)
36=Wild any CCITT (0-9
+
#
*)
80=Lock keypad
44 KJAVA 0054 0054 PARAMETER
DATA
00 TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x00 Get Version Info from Java Pack
Code objects and data files
0x01 Set Version Info for Java Pack
Code objects and data files
0x02 Get Version Info from Java Pack
data files
0x03 Get Version Info from Java Pack
Code objects
0x04 kJava Backup
0x05 kJava Restore
45 L1T_TCCT - L1 Timer - Change Channel Timing 0C0A 0C0A L1T_SELECT
UPDATE_MODE
QBCO_DATA
0000
0000
0000
TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM L1 Timer

UPDATE_MODE (2 bytes):
0000=Asynch Update to QBCO
0001=Increment by QBCO on CFI
0002=Decrement by QBCO on CFI
0003=Update to QBCO on CFI
0004=Update to QBCO on RFI
0005=Update to QBCO at UDT
0006=Update to QBCO at event code
0007=Early Update (GSM only)

QBCO_DATA (2 bytes):
For update modes 1 and 2
this field specifies the amount to move the QBCO. For all other modes
this is the new QBCO value.
46 L1T_TFTS - L1 Timer - Frame Table Select 0C06 0C06 L1T_SELECT
TABLE_ID
LENGTH
TABLE_DATA
0000
00

TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM L1 Timer

TABLE_ID (1 byte):
ID number of the next active frame table.

LENGTH (1 byte):
Only used if TABLE_ID is 0xFF

TABLE_DATA (variable):
Only used if TABLE_ID is 0xFF.
47 L1T_THEG - L1 Timer - Halt Event Generator 0C07 0C07 L1T_SELECT 0000 TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM L1 Timer
48 L1T_TOLS - L1 Timer - Override L1 Signals 0C05 0C05 L1T_SELECT
SELECT_MASK
STATE_MASK
0000
0000
0000
TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM L1 Timer

SELECT_MASK (2 bytes):
Bitmask indicating L1 signals to override. 1st entry is WCDMA
2nd is GSM 1=override.
bit0=RX_SLOT/DMCS Magic
bit1=TX_RAMP/TX_EN
bit2=TX_PREKEY/EXC_EN
bit3=TX_SLOT/RX_EN
bit4=RX_ACQ/TX_KEY
bit5=RX_ON/DMCS_EDMIC
bit6=TX_FRAME/RX_ACQ
bit7=WCDMA_EN/Unused
bit15=WB_LY1H spare to HL sequence manager/Unused

STATE_MASK (2 bytes):
Bitmask indicating desired state of L1 signal.
0b=low
1b=high
49 L1T_TRRC - L1 Timer - Read Register Command 0C09 0C09 L1T_SELECT
OFFSET
0000
0000
TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM Timer

OFFSET (2 bytes):
Offset of the L1T register from the base address of the L1T.
50 L1T_TWRC - L1 Timer - Write Register Command 0C08 0C08 L1T_SELECT
TYPE
OFFSET
DATA
0000
0000
0000
0000
TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM Timer

TYPE (2 bytes):
0=AND register with DATA
1=OR register with DATA
2=REPLACE register with DATA

OFFSET (2 bytes):
Offset of the L1T register from the base address of the L1T.

DATA (2 bytes):
Data value to write to L1T register.
51 LEDS - LED Control 003E 003E LED
ACTION
DATA
00
00
TIMEOUT
READ
2
YES
LED (1 byte):
00=Keypad Backlight
01=Main Display Backlight
02=Reserved
03=Red LED
04=Green LED
05=Toggle Green/Red
06=Fun Lights

ACTION (1 byte):
00=Disable
01=Enable
02=Set Pulse Current
03=Set Duty Cycle
04=Disable Pulse Skip
05=Enable Pulse Skip
06=Setup
07=Enable Color Combination

DATA (variable size):
*If ACTION=02 (1 byte)*
00=Low
01=Med
02=High
03=Full
*If ACTION=03 (1 byte)*
00=Off
01=Duty Cycle 0.1/1.9
02=Duty Cycle 0.2/1.8
03=Duty Cycle 0.5/1.5
04=Duty Cycle 0.25/0.75
05=Duty Cylce 0.25/1.75
06=Duty Cycle 0.25/1.95
07=Duty Cycle 0.5/0.5
08=Duty Cycle 0/0.5
0.5/0
09=Duty Cycle 0.125/0.5
0.075/1.5
0A=Duty Cycle 0.125/0
0/2.075
0B=Duty Cylce 0/0.625
0.075/1.5
0C=On
*If ACTION=06 (3 bytes)*
byte1=Pulse current
byte2=Duty cycle
byte3=Pulse skip
*If ACTION=07 (1 byte)*
01=Red
02=Green
03=Red/Green
04=Blue
05=Red/Blue
06=Green/Blue
07=Red/Green/Blue
52 LOAD_SYN - Load Synthesizer 0014 0014 CHANNEL
RESERVED
50
0
TIMEOUT
READ
2
YES
2
1
CHANNEL (2 bytes):
1-124=PGSM 900 MHz
0
975-1023=EGSM 900 MHz
512-885=DCS 1800 MHz
512-810=PCS 1900 MHz
TBD=WCDMA 1950 MHz

RESERVED (1 byte):
TBD
53 LONG_STAT - Return Radio Status Info 0015 0015 STATUS 00 TIMEOUT
READ
2
YES
STATUS (1 byte):
00=Request Table status
01=Request Channel status
02=Request Long status
03=Request Packet Data status
54 OCD - On Chip Debugger 0C23 0C23 TIMEOUT
READ
2
YES
55 PANIC - read PANIC sector in NVM 006E 006E PARAMETER
DATA
0000
TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
==>0000=Get Panic Status

==>0001=Get Panic Descriptors (4 Data bytes)
Data Bytes[0-1]: Panic Type (as reported from Get Panic Status)
Data Bytes[2-3]: Panic ID (ID < Count as reported from Get Panic Status)

==>0002=Get Panic Data (12 Data Bytes)
Data Bytes[0-1]: Panic Type (as reported from Get Panic Status)
Data Bytes[2-3]: Panic ID (ID < Count as reported from Get Panic Status)
Data Bytes[4-7]: Offset into structure
Data Bytes[8-11]: Size to retrieve

==>0003=Erase Panic (2 Data Bytes):
Bytes[0-1]: Type (0xFFFF = All (only one initially supported))
56 PDLOG - Power-down Log 0C20 0C20 SUB_COMMAND 00 TIMEOUT
READ
2
YES
SUB_COMMAND (1 byte):
00=Dump Power-down log entries
01=Clear Power-down log entries
57 PHASE - Read/Write Phasing Parameters 001D 001D PARAMETER
RECORD
DATA
0000
08
TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
5B=SEEM_PA_Calibration
5E=SEEM_AGC_Table
61=SEEM_AFC_Adjust
63=SEEM_HAPI_DTOA
64=SEEM_HAPI_ATOD
65=SEEM_PA_Phasing_Configuration
78=SEEM_RX_IQ_Balance

RECORD (1 byte):
--2 bits: D7-D6 (Action)--
00b=Set phasing parameter
01b=Get phasing parameter
--3 bits: D5-D3 (Record number)--
001b=GSM 900
010b=GSM 1800
011b=GSM 1900
100b=Reserved (GSM 850)
101b-111b=spare
--3 bits: D2-D0 (Reserved)--
set to 000

DATA (variable):
Data to be written. Valid only for writes.
58 PING - Check the TCI Connection 0FFF 0FFF TIMEOUT
READ
2
YES
No data fields required.
59 PKI_DATA_PROVISION 006A 006A DATA TIMEOUT
READ
2
YES
60 POLL 1FFF TIMEOUT
READ
2
YES
No data fields. Read only.
61 PUMODE - Report the power up mode and reason 0062 0062 SUB_COMMAND 00 TIMEOUT
READ
2
YES
SUB COMMAND (1 byte):00= Request PowerUp Mode/Reason.
62 PWR_OFF - Power Off 001E 001E TIMEOUT
READ
2
YES
No data fields required.
63 RDELEM - Read NVM Element 0020 0020 ELEMENT_ID
RECORD
OFFSET
LENGTH
0000
0000
0000
0000
TIMEOUT
READ
2
YES
ELEMENT_ID (2 bytes):
Specifies the Element ID

RECORD (2 bytes):
Specifies the record number of the element.

OFFSET (2 bytes):
Specifies the offset
in bytes
into the record. Set to 0 to read the entire record.

LENGTH (2 bytes):
Length
in bytes
of the data to be read.
64 RDWR_DSP_SPI - Read/Write DSP SPI Bus Devices 0C03 0C03 LENGTH
DEVICE
DATA
0000
00
TIMEOUT
READ
2
YES
LENGTH (2 bytes):
This field specifies the number of bits to be sent out on the SPI bus.

DEVICE (1 byte):
00=Read Synthesizer 1
01=Write to Synthesizer 1
02=Read Synthesizer 2
03=Write to Synthesizer 2
04=Read D/A Converter
05=Write to D/A Converter
06=Read A/D Converter
07=Write to A/D Converter
08=Read EEPROM
09=Write to EEPROM

DATA (variable):
Array of bytes to be sent on the SPI bus (MSb first). If number of bits to be sent (specified in LENGTH) is not an integer number of bytes
the last byte must be padded with 0s.
65 RDWR_DSP_SPI(RAINBOW) - Read/Write DSP SPI Bus Devices 0C03 0C03 LENGTH
MQSPI_SELECT
TRIGGER
DATA
0000
00
00
TIMEOUT
READ
2
YES
LENGTH (2 bytes):
This field specifies the number of bits to be sent out on the SPI bus.

MQSPI_SELECT (1 byte):
00=Read MQSPI 1
80=Write MQSPI 1
40=Read MQSPI 2
C0=Write MQSPI 2

TRIGGER (1 byte):
MQSPI trigger select

DATA (32 bytes max.):
Array of bytes to be sent on the SPI bus (MSb first). If number of bits to be sent (specified in LENGTH) is not an integer number of bytes
the last byte must be padded with 0s.
66 RDWR_HARM - Read/Write Harmony Lite 0C13 0C13 REG_ADDR
REG_LENGTH
FIELD_MSB
FIELD_LSB
DATA
0000
01
00
00
00
TIMEOUT
READ
2
YES
REG_ADDR (2 bytes):
Address of HL register

REG_LENGTH (1 byte):
--2 bits: D7-D6 (Mode)--
00b = Read
01b = Write
10b = Modify
--6 bits: D5-D0 (Reg Length)--
Register access length in bytes
1-29 bytes for Read or Write
1
2
3
4
8 bytes for Modify

FIELD_MSB (1 byte):
MSb bit position of register to modify

FIELD_LSB (1 byte):
LSb bit position of register to modify

DATA (variable)
67 RDWR_HWCFG - R/W Hardware Configuration 0065 0065 ACTION
RESERVED
HW_CONFIG_ID
DATA
00
00
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 Read

RESERVED (1 byte)

HW_CONFIG_ID (2 bytes):
Hardware Configuration ID

DATA (variable):
Only applicable for a write
68 RDWR_I2C - Read/Write I2C Bus Device 0063 0063 ACTION
DEVICE
SLAVE_ADDR
LENGTH
DATA
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Read
01 = Write

DEVICE (1 byte):
00 = default for now

SLAVE ADDR (1 byte):

LENGTH (1 byte):
Length of data field

DATA (variable):
69 RD_IC - Read IC ID 0C21 0C21 IC 00 TIMEOUT
READ
2
YES
IC ( 1 Byte):
00=Unique ID
70 RDWR_IO - GPIO Read/Write 0C25 0C25 ACTION
RESERVED
SIGNAL
WRITE_DATA
00
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Read
01=Write
02=Enable Alt Sig
03=Disable Alt Sig

RESERVED (1 byte):
Set to 00

SIGNAL (1 byte):
The signal number.

WRITE_DATA (1 byte):
00=Write a value of 0
01=Write a value of 1
71 RDWR_SPI - Read/Write SPI Bus Device 0021 0021 ACTION
REGISTER
START_BIT
NUM_BITS
DATA
00
00
FF
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
This field specifies read (0x00) or write (0x01) operation.

REGISTER (1 byte):
This field specifies the REGISTER number of the SPI device.

START BIT (1 byte):
FF=Read from the beginning.

NUM BITS (1 byte):
This field specifies number of bits to be written (use 0x00 as default).
72 RDWR_STATIC_RAM - Read/Write to Static Ram Values 0069 0069 ACTION
PARAMETER
WRITE_DATA
01
01
TIMEOUT
READ
2
YES
ACTION (1 byte):
- Read - 0x00
- Write - 0x01

PARAMETER (1 byte):
00=Init AFC
01=Close TransAAM PA Loop
02=Open TransAAM PA Loop

WRITE_DATA (variable)
73 RDWR_UART - Read/Write UART 0C01 0C01 ACTION
PORT
PARITY
STOP_BITS
BAUD
DATA_BITS
DATA
00
00
00
00
00000000
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Read
01 = Write
02 = Configure
03 = Reset UART (n/a for Pgn)
04 = Receive Ready (UART 1 and 3 only) (n/a for Pgn)
05 = Enable Tx and Rx Int. Loopback (n/a for Pgn)
06 = Disable Tx and Rx Int. Loopback (n/a for Pgn)
07 = Flush Tx and Rx FIFOs (n/a for Pgn)

PORT (1 byte):
00 = UART1
01 = UART2
02 = UART3

PARITY (1 byte):
00 = Even
01 = Odd
02 = Off

STOP_BITS (1 byte):
00 = 1 bit
01 = 2 bits

BAUD (4 bytes):
00000000 = Auto Detect
000004B0 = 1200 baud
00000960 = 2400 baud
000012C0 = 4800 baud
00002580 = 9600 baud
00003840 = 14400 baud (n/a for Pgn)
00004B00 = 19200 baud
00007080 = 28800 baud (n/a for Pgn)
0000E100 = 57600 baud
0001C200 = 115200 baud
00038400 = 230400 baud
00070800 = 460800 baud
000C65D4 = 812500 baud (n/a for Pgn)

DATA_BITS (1 byte):
00 = 7 bits
01 = 8 bits

DATA (1 byte):
Data to be written to UART TX register.
74 RESTART - Software Power Recycle 0022 0022 TIMEOUT
READ
2
YES
No data fields required. Generates a software restart of the phone.
75 RQ - General Information Request 0026 0026 PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=GSM Camp Status
02=Smart Battery Data
03=System Information
0D=User Alerting
0E=Hardware Band Capability
0F=IQ Gain Imbalance Phasing
10=Estimate Power
11=Phase Imbalance
12=WCDMA Camp Status
13=WCDMA AFC DAC Counts

DATA (variable):
A byte array of data
76 RQBER - Request PN9 Bit Error Rate 0C14 0C14 TIMEOUT
READ
2
YES
Count and return bit errors.
77 RSSI_RSCP - Receive Signal Strength Indicator/Receive Signal Code Power 0C0D 0C0D PARAMETER 00 TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00 = Raw RSSI from HarmonyLite
01 = Frequency and temperature compensated RSSI
02 = Calculated RSCP
FF = All supported parameters
78 RTCC - Read/Write Real Time Clock 0029 0029 ACTION
DAY
TIME
01 TIMEOUT
READ
2
YES
1
2
4
ACTION (1 byte):
0=Set RTC
1=Read RTC

DAY (2 bytes):
0-32767=Number of days elapsed since any specific date.

TIME (4 bytes):
0-86399=Number of seconds elapsed since midnight.
79 SBSDY_LCK - lock/unlock service passcode. Get status of MSL. 0035 0035 ACTION
CODE
00 TIMEOUT
READ
10
YES
ACTION (1 byte):
00=Get Status of Subsidy Lock
01=Check if SIM Lock code is valid
02=Change MSL password (CDMA)
03=Check if initial phone locking is active and code is valid (TDMA)
04=Check if service password is valid.

CODE (14 bytes):
01=The MSL code as a null terminated UNICODE string. 12 bytes (code string) + 2 bytes (NULL string)

02=The MSL code as a null terminated UNICODE string. 12 bytes (code string) + 2 bytes (NULL string)

03=Initial phone lock code in BCD. (TDMA) Only the first 3 bytes are used. Bytes 4 through 14 must be 0.

04=Service password to be validated and unlock this feature. Only the first 4 bytes are used. Bytes 5 through 14 must be set to 0.
80 SCMP - Simple Camp 0901 0901 ACTION
CHANNEL
1
0
TIMEOUT
READ
2
YES
1
2
ACTION (1 byte):
0=Initiate Simple Camp
1=Stop Simple Camp

CHANNEL (2 bytes):
Specifies the channel number on which the Simple Camp is started.
81 SET_RF_PWR - Set the PA Power Level 002D 002D LEVEL 5 TIMEOUT
READ
2
YES
1 LEVEL (1 byte):
0-19=Power Level
82 SMARTCARD - Read Write Smartcard 003C 003C ACTION
CARD_ID
FILE
REC
OFFSET
LENGTH
DATA
00
00
00
00
0000
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Read form elementary file
01 = Write to elementary file

CARD_ID (1 byte):
This field specifies the card of the file that is being read/written.

FILE (1 byte):
This field specifies the name of the file that is being read/written.

REC (1 byte):
This field specifies which record is being read/written.

OFFSET (2 bytes):
This field specifies the offset
in bytes
into the record. Set field to 0 to read/write entire record.

LENGTH (2 bytes):
The length
in bytes
to be read/written

DATA (variable):
A byte array of data to write to the Smart card.
83 STELEM - Store Memory Element 002F 002F ELEMENT_ID
REC
OFFSET
LENGTH
DATA
0000
0000
0000
0000
TIMEOUT
READ
2
YES
ELEMENT_ID (2 bytes):
Specifies the Element ID

REC (2 bytes):
Specifies the record number of the element.

OFFSET (2 bytes):
Specifies the offset
in bytes
into the record. Set to 0 to read the entire record.

LENGTH (2 bytes):
Length
in bytes
of data to be written

DATA (variable):
A byte array of data
84 SUSPEND - Set Mode 0036 0036 MODE 00 TIMEOUT
READ
4
YES
MODE (1 byte):
8x = Read Current Mode
00 = Test Mode
01 = Normal Mode
02 = Handset Test Mode
85 SUSPEND_COMP - Suspend Component 0C18 0C18 COMPONENT
ACTION
00
00
TIMEOUT
READ
2
YES
COMPONENT (1 byte):
00 = Audio Manager
01 = GPS Chipset

ACTION (1 byte):
00 = Unsuspend Component
01 = Suspend Component
02 = Request Status
86 SWDL - Sftwr DL file creation 0C21 0C21 MODE 00 TIMEOUT
READ
2
YES
MODE (1 byte):
00 = Create file w Phone Information
01 = Create file w Parameter Data
02 = Create file w Data Settings
87 SWUL - Sftwr UL file restore 0C22 0C22 MODE 01 TIMEOUT
READ
2
YES
MODE (1 byte):
00 = Invalid Mode
01 = Load Parameter Data
02 = Load Data Settings
88 TLPB - Traffic Channel Loopback 0902 0902 ACTION
CHANNEL
POWER_LEVEL
TIME_SLOT
64
0
0
1
TIMEOUT
READ
2
YES
1
2
1
1
ACTION (1 byte):
0=Stop TCH loopback
64=Start TCH loopback

CHANNEL (2 bytes):
TCH loopback channel number
set to 0 for Stop

POWER_LEVEL (1 Byte):
Valid data=0 to 19
set to 0 for Stop.
TIME_SLOT (1 byte):
Supports 1-8.
89 TOUCH_SCREEN (Paragon only) 0C19 0C19 PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=Read position

01=Read pressure

DATA (variable):
90 TST_CAMERA - Camera command 0061 0061 PARAMETER
DATA
02
0000
TIMEOUT
READ
10
YES
PARAMETER (1 byte):
0x00 = Start/Stop Viewfinder
0x01 = Cature JPEG
0x02 = Capture MP4
0x03 = Set/Get Attribute
0x11 = View JPEG
0x12 = View MP4

DATA (variable):

Start/Stop Viewfinder (2 Bytes):
Set/Get (1/2 byte) [D7-D4]:
0x0 = Set
0x01 = Get
Action (1/2 byte) [D3-D0]:
0x0 Stop Viewfinder
0x1 = Start Viewfinder
0x2 = Switch to external viewfinder
0x3 = Switch to internal viewfinder
Media Type (1/2 byte) [D7-D4]:
0x0 = Still Image
0x1 = Video
Still Image Res (1/2 Byte) [D3-D0]:
0x0 = VGA
0x1 = QVGA
0x2 = SQVGA
0x3 = QQVGA
0x4 = QQQVGA
0x5 = CIF
0x6 = QCIF
0x7 = SQCIF

Capture JPEG (variable):
Action (1 byte):
0x00 = Capture Still Image
Filename (Bytes 1-257 variable)

Capture MP4 (variable):
Action (1 byte):
0x00 = Starts Video Capture
0x01 = Stops Video Capture
Filename (Bytes 1-257 variable)

Set/Get Attribute (2 Bytes):
Set/Get (Byte 1)[D7]:
0b = Set Attribute
1b = Get Attribute
Camera Attribute (Byte 1)[D6-D0]:
0000000b = White balance
Attribute (Byte 2):
0x00 = Reserved
0x01 = Sunny
0x02 = Cloudy
0x03 = Indoor Home (incandescent)
0x04 = Indoor Office (fluorescent)
0x05 = Automatic
91 TST_DISP - Test Display 0037 0037 PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
This value selects the operation to perform. (See below)

DATA (variable):
The value of the DATA field is dependent on the PARAMETER selected.
The table below defines the meaning of the PARAMETER/DATA field values.

--------------------------
PARAMETER = 00
Get display configurations

DATA (0 bytes)
--------------------------
PARAMETER = 01
Select Display

DATA (1 byte):
00=Main display
01=CLI display
02=External display
--------------------------
PARAMETER = 02
Display predefined pattern

DATA (1 byte):
00=All pixels OFF
01=All pixels ON
02=Checkerboard pattern A
03=Checkerboard pattern B
04=Border pixels ON
05=Gray scale block
06=Horizontal Zebra line
07=Vertical Zebra line
08=16 color strip
09=White screen
0A=Black screen
0B=Red screen
0C=Blue screen
0D=Green screen
0E=Eight color box pattern
--------------------------
PARAMETER = 03
Display input pattern

DATA (variable 1 byte to 5K bytes):
byte0=0x00 denotes the final stream of bytes
and triggers the bitmap display of all buffered bytes.

byte0=0x01 denotes more data to follow on subsequent command.

byte1+ specifies the bitmap to be displayed.
--------------------------
PARAMETER = 04
Continuously shift the current pattern to the left

DATA (2 bytes):
byte0 specifies the number of pixels to shift to the left

byte1 specifies the period in 1/10 sec. (Range: 0.1 to 25.5 secs.) (Value of 0x00 shifts just once)
--------------------------
PARAMETER = 05
Continuously shift the current pattern to the right

DATA (2 bytes):
(same as in parameter 04 description)
--------------------------
PARAMETER = 06
Continuously shift the current pattern up

DATA (2 bytes):
(same as in parameter 04 description)
--------------------------
PARAMETER = 07
Continuously shift the current pattern down

DATA (2 bytes):
(same as in parameter 04 description)
--------------------------
PARAMETER = 08
Stop continuous shift

DATA (0 bytes)
--------------------------
PARAMETER = 09
Turn On/Off the front light

DATA (1 byte):
00=OFF
01=ON
full intensity
02=ON
Low intensity
03=Increase intensity by TBD
04=Decrease intensity by TBD
--------------------------
PARAMETER = 0A
Display input pattern with selected palette colors/levels

DATA (1 byte):
00=4/16 gray levels
01=16/16 gray levels
02=16/4096 colors
03=256/4096 colors
04=4096/4096 colors
--------------------------
PARAMETER = 0B
Disable display

DATA (0 bytes)
--------------------------
PARAMETER = 0C
Enable display

DATA (0 bytes)

--------------------------
PARAMETER = 0D
Display Crosspoints

DATA (1 byte)
00= Display all Crosspoints
01= Display Leftmost Up
02= Display Rightmost Up
03= Display Leftmost Down
04= Display Rightmost Down
05= Display Center Crosspoint
06= Display all Points Reversed
07= Clear Display
92 TST_MSD - Test Mass Storage Device 0C1B 0C1B DEVICE_ID
CATEGORY
SUB_CATEGORY
DATA
0000
00
00
TIMEOUT
READ
2
YES
DEVICE_ID (2 bytes):
0000 = External Device (e.g. MMC
TFR)
0001 = RAM
0002 = Disk on Chip
0003 = NAND

CATEGORY (1 byte):
00 = Get
01 = Put

SUB_CATEGORY-GET (1 byte):
Combined field:
0000 = Read all connected MSD device IDs
0001 = Read MMC/TRF register
0002 = Read MSD data
0003 = Detect MSD status
0004 = Read card write protect line status (Not supported)

SUB_CATEGORY-PUT (1 byte):
PUT Category (Byte0 = 0x01)/ Put Sub-categories (Byte1 =0x00)
Combined field:
-0x0100 = Write MSD data
93 TXBD - Transmit Burst Data 0906 0906 ACTION
ARFCN
PCL_DAC
TX_RANGE_GAIN
OFS
SAT
SAT_OFFSET
DP_GAIN
00
0026
0200
00
25
00
82
41
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Set
01 = Get (not supported)
02 = Reset
03 to FF = Reserved

ARFCN (2 bytes):
Channel Number

PCL_DAC (2 bytes):
PCL DAC Value

TX_RANGE_GAIN (1 byte):
00 = 1dB
01 = 3.16dB
02 = 10dB
03 = Reserved

OFS (1 byte):
OFS Value

SAT (1 byte):
00 = Disable
01 = Enable

SAT_OFFSET (1 byte):
--4 bits: D7-D4 (Delay)--
Microsecond delay after ramp
--2 bits: D3-D2 (Reserved)--
set to 00
--2 bits: D1-D0 (Saturation Correction Steps)--

DP_GAIN (1 byte)
--6 bits: D7-D2 (DP Gain)--
--2 bits: D1-D0 (DP Delay)--
94 TXBD_C - Transmit Burst Data - Colorado 0906 0906 ACTION
ARFCN
PCL_DAC
TX_RANGE_GAIN
OFS
SAT
SAT_CORR_STEPS
CP/DP_GAIN
TRKL/DP_DLY
SAT_THRESH
ACC_INIT
Pgf
Pgs
Egf
Egs
RAMPSEL/GSM_INIT
ACT_TH
PRoff
RAMP_CLKDIV
00
0026
0200
00
25
00
00
BF
48
0082
0018
14
00
07
00
2004
0002
C0
05
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Set
01 = Get (not supported)
02 = Reset
03 to FF = Reserved

ARFCN (2 bytes):
Channel Number

PCL_DAC (2 bytes):
PCL DAC Value

TX_RANGE_GAIN (1 byte):
00 = 1dB
01 = 3.16dB
02 = 10dB
03 = Reserved

OFS (1 byte):
OFS Value

SAT (1 byte):
00 = Disable
01 = Enable

SAT_CORR_STEPS (1 byte):
--3 bits: D7-D5 (Reserved)--
set to 00
--5 bits: D4-D0 (Sat Correction Steps)--
# of LSBs to use in D/A stepping

CP/DP_GAIN (1 byte)
--1 bit: D7 (CP Gain)--

--1 bit: D6 (Tx Gain)--
--6 bits: D5-D0 (DP Gain)--

TRKL/DP_DLY (1 byte)
--2 bits: D7-D6 (TRKL)--

--2 bits: D5-D4 (DP Gain Ana)--
--4 bits: D3-D0 (DP Delay)--

SAT_THRESH (2 bytes):
--Byte 0 - 6 bits: D7-D2 (Reserved)--
set to 00
--Byte 0-1 10 bits: D2-D0 - D7-D0
(Saturation Threshold)

ACC_INIT (2 bytes):
--Byte 0 - 6 bits: D7-D2 (Reserved)--
set to 00
--Byte 0-1 10 bits: D2-D0 - D7-D0
(ACC Init)

Pgf (1 byte):
--1 bit: D7 (Reserved)--
set to 00
--7 bits: D7-D0 (Proportional Gain for
Fast)--
D6 - D4 is fine adjust
D3 - D0 is coarse adjust

Pgs (1 byte):
--1 bit: D7 (Reserved)--
set to 00
--7 bits: D7-D0 (Proportional Gain for
Slow)--
D6 - D4 is fine adjust
D3 - D0 is coarse adjust

Egf (1 byte):
--1 bit: D7 (Reserved)--
set to 00
--7 bits: D7-D0 (Error Gain for Fast)--
D6 - D4 is fine adjust
D3 - D0 is coarse adjust

Egs (1 byte):
--1 bit: D7 (Reserved)--
set to 00
--7 bits: D7-D0 (Error Gain for Slow)--
D6 - D4 is fine adjust
D3 - D0 is coarse adjust

RAMPSEL/GSM_INIT (2 bytes):
--Byte 0 - 3 bits: D7-D5 (RampSel)--
--Byte 0 - 3 bits: D4-D2 (Reserved)
--Byte 0-1 - 10 bits: D2-D0 - D7-D0
(GSM Init)

ACT_TH (2 bytes):
--Byte 0 - 6 bits: D7-D2 (Reserved)--
set to 00
--Byte 0-1 10 bits: D2-D0 - D7-D0
(ACT_TH)

PRoff (1 byte)
--3 bits: D7-D5
D7 - PRoff
D6 - ACT_EN
D5 - ACT_SEL
--5 bits: D5-D0 (Reserved)--
set to 00

RAMP_CLKDIV (1 byte)
--2 bits: D7-D6 (Reserved)--
set to 00
--6 bits: D5-D0 (RAMP_CLKDIV)--
95 TXBD_R - Transmit Burst Data - RFMD 0906 0906 ACTION
ARFCN
Mod_Type
PA_Ramp_Delay
TXENU
TXEND
DAC1
PAG
Power_Range
Tx_Curr_Thresh
Pwr_backoff_Slope
PA_Power_Mode
DN
AMPM1
AMPM2
AMAM1
AMAM2
EDGE_Subband
Adelays
00
0026
00
C3
C0
02
0DAC
01F4
00
82
05
01
1E35
00F007
00BC00
001350
2F
00
51
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Set
01 = Get (not supported)
02 = Reset
03 to FF = Reserved

ARFCN (2 bytes):
Channel Number

MOD_TYPE (1 bit - LSB)
Modulation Type CFG3(EGS)

PA_RAMP_DELAY (1 byte)
Delay from TXST to ramp start

TX_ENU (1 byte)
Delay from TXST to ramp start

TXEND (1 byte)
TXEN to TXST falling edge

DAC1 (2 bytes)

PAG (2 bytes)

POWER_RANGE (2 bits)
bits 7-2 Reserved
bits 1-0
0=Low 1=Med 2=High

TX_CURR_THRESH (1 byte)

PWR_BACKOFF_SLOPE (1 byte)

PA_POWER_MODE (1 bit - LSB)
0=Low 1=High

DN (9 bits)
Delta N value for KV calibration
byte 1 bits 7-1 Reserved
Byte 1 bit 0
Byte 0 bits 7-0 -> DN

AMPM1 (18 bits)
Byte 2 bits 7-2 -> Reserved
Byte 2 bits 1-0
Byte 1
Byte 0 -> AMPM1

AMPM2 (18 bits)
Byte 2 bits 7-2 -> Reserved
Byte 2 bits 1-0
Byte 1
Byte 0 -> AMAM1

AMPM1 (18 bits)
Byte 2 bits 7-2 -> Reserved
Byte 2 bits 1-0
Byte 1
Byte 0 -> AMPM1

AMAM2 (1 byte)

EDGE_SUBBAND (2 bits)
bits 7-2 -> Reserved
bits 1-0
0=1st subband 1=2nd subband 2=3rd subband

Adelays (1 byte)
bits 7-5 -> Adelay1
bit 4 -> Adelay2
bits 3-1 -> Adelay3
bit 0 -> Adelay4
96 VERIFY_EFUSE - verify production or development chipsets 0C2E 0C2E ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Verify fuses are programmed for engineering
01 = Verify fuses are programmed for production
97 VERIFY_PHASE - Calculate and verify SEEM checksum 0C2A 0C2A ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 = Verify
0x01 - 0xFF = Reserved
98 VERSION - Read Software Version Numbers 0039 0039 TYPE 1106 TIMEOUT
READ
2
YES
TYPE (2 bytes):
1000=DSP modem
vocoder
RXCRP
searcher
TXCRP
and RF versions
1100=File creator
1101=Build time
1102=Clearcase view tag name
1103=Base label
1104=Product ID
1105=Version number
1106=Build commentary
1200=Flash Booter version number
FFFF=Product Base Release Label
99 VST_VERSION 0067 0067 DATA 00 TIMEOUT
READ
2
YES
100 VIBRATOR 0096 0096 ACTION
SETTING
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 = OFF
0x01 - ON

SETTING (1 Byte):
0x00 = 1/4 speed
0x01 = 1/2 speed
0x02 = 3/4 speed
0x03 = full speed
101 W_CARRIER - WCDMA Carrier 0C0E 0C0E CHANNEL_ID
ACTION
TRANSMIT_POWER
MAX_POWER
MIN_POWER
CHANNEL_CONFIG
SPREAD_FACTOR
CHAN_CODE
SCRAM_CODE
2616
00
00
1A
C0
15
00
00
000000
TIMEOUT
READ
2
YES
CHANNEL_ID (2 bytes):
0000 to 3FFF (0 - 16383)

ACTION (1 byte):
00=Enable Carrier
01=Disable Carrier

TRANSMIT_POWER (1 byte):
Initial Transmit Power (dBm)
80 to 7F (-128 to 127)

MAX_POWER (1 byte):
Maximum Transmit Power (dBm)
80 to 7F (-128 to127)

MIN_POWER (1 byte):
Minimum Transmit Power (dBm)
80 to 7F (-128 to 127)

CHANNEL_CONFIG (1 byte):
--3 bits: D5-D3 (Data Pattern)--
000b = All 0s
001b = All 1s
010b = PN9
011b = PN15
100 - 111b = Undefined
--1 bit: D2 (Channelization)--
0 = Disable spreading
1 = Enable spreading
--2 bits: D1-D0 (Scrambling)--
00b = Disable scrambling
01b = Enable long scrambling
10b = Enable short scrambling
11b = Undefined

SPREAD_FACTOR (1 byte):
--3 bits: D5-D3 (DPCCH SF)--
000b = SF256
slot format 0
001b = SF256
slot format 1
...
101b = SF256
slot format 5
110 - 111b = Undefined
--3 bits: D2-D0 (DPDCH SF)--
000b = SF256
slot format 0
001b = SF128
slot format 1
...
110b = SF4
slot format 6
111b = Undefined

CHAN_CODE (1 byte):
Channelization Code

SCRAM_CODE (3 bytes):
Scrambling Code
102 W_PHASE - WCDMA Phase 0C0F 0C0F ACTION
ELEMENT_ID
BAND
OFFSET
LENGTH
DATA
00
00
00
00
0000
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
--4 bits: D7-D4 (Action)--
0x=Read from NVM
1x=Write to DSP
2x=Write to NVM
3x=Write phasing table to DSP
--4 bits: D3-D0 (Table type)--
x0=AOC/Power Control
x1=AFC
x2=AGC
x3=DCOC

ELEMENT_ID (1 byte):
Identifier to specify phasing table element ID

BAND (1 byte):
Specifies the WCDMA band.
00=W2100 (Band 1)
01=W1900 (Band 2)
02=Reserved
03=Reserved
04=W850 N. Am & J800 Japan (Bands 5 & 6)

OFFSET (1 byte):
Offset (in bytes) into the selected table. (Works on tables of fixed length only.)

LENGTH (2 bytes)
Length (in bytes) of data to be written

DATA (variable):
A byte array of data to be written according to action
103 WAIT TIMEOUT
READ
2
NO
Causes the TCI to wait for the specified TIMEOUT (seconds).
104 WLAN - WLAN 0C1F 0C1F PARAMETER
DATA
0001
0000
TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
0000 = Raw Data
0001 = DL Firmware
0002 = Reset IC
0003 = Read MAC address
0005 = Start Tx Signal
0006 = Get Tx Attributes
0007 = Start Rx packet counter
0008 = Query Rx Packet Counter
0009 = Start RSSI Measurements
000A = Query RSSI Measurements
000B = Power Down
105 WLOAD_SYN - WCDMA Load Synthesizer 0C0B 0C0B RX_FREQ_ID
TX_FREQ_ID
10700
65535
TIMEOUT
READ
2
YES
2
2
RX_FREQ_ID (2 bytes):
0 to 16383 = Receive UARFCN
(if TX_FREQ_ID = 65535 then valid range = 950 to 16383)

TX_FREQ_ID (2 bytes):
0 to 16383 = Transmit UARFCN
65535 = Transmit UARFCN is (RX_FREQ_ID - 950)
106 WLONG_STAT 0C24 0C24 Sub_Command 00 TIMEOUT
READ
2
YES
Only SUB Command supported at this time is WSCMP status
107 WOPCHAN - WCDMA Open Channel 0C16 0C16 UARFCN
ACTION
TYPE
L1LOG
TFCI
CODING
COMP_MODE
10700
0
1
1
2
2
0
TIMEOUT
READ
2
YES
2
1
1
1
1
1
1
UARFCN (2 bytes):
Channel number

ACTION (1 byte):
0=Open 12.2K Channel
1=Open 64K Channel
2=Open 144K Channel
3=Open 384K Channel
255=Close Channel

TYPE (1 byte):
0=Uplink RMC
1=Downlink RMC
2=Reserved
3=Loopback Mode 2

L1LOG (1 byte):
0=Layer 1 Logging Off
1=RQBER Logging On

TFCI (1 byte):
0=None
1=Force Decode of TFCI 1
2=Force Decode of TFCI 2
3=Force Decode of TFCI 3
4=Force Blind Rate Detection

CODING (1 byte):
0= Coding Off
1=1/2 Rate Coding
2=1/3 Rate Coding
3=Turbo Coding

COMP_MODE (1 byte):
00= Compressed Mode Off
01= Compressed Mode On - SF Reduction on DL
02= Compressed Mode On - Puncturing on DL
108 WPC_DTAR - WCDMA Power Control RF Detect Target 0C11 0C11 VALUE
MODE
0
0
TIMEOUT
READ
2
YES
2
1
VALUE (2 bytes):
If MODE=1 then value is raw RF detect counts
If MODE=2 then value is in dBm in 1/16 of a dB

MODE (1 byte):
0 = Disable force value
1 = Force value is counts
2 = Force value is power
109 WPC_TBLL - WCDMA Power Control Table Load 0C0F 0C0F TIMEOUT
READ
2
YES
110 WPC_TPC - WCDMA Power Control TPC Patterns 0C12 0C12 TPC_SETUP
PATTERN
STEP
09
10
01
TIMEOUT
READ
2
YES
TPC_SETUP (1 byte):
--1 bit: D3 (Mode)--
0b=Single shot
1b=Continuous
--1 bit: D2 (Link Indicator)--
0b=Uplink
1b=Downlink
--2 bits: D1-D0 (Algorithm)--
01b=Algorithm 1
10b=Algorithm 2

PATTERN (1 byte):
00=All zeros
01=Repeat:1 one
1 zero
02=Repeat:2 ones
2 zeros
03=Repeat:3 ones
3 zeros
...
10=All ones

STEP (1 byte):
00 to FF (1/2 dB increments)
111 WPC_VAR - WCDMA Power Control Variables 0C10 0C10 RD_MASK
WR_MASK
DATA
00000000
00000000
TIMEOUT
READ
2
YES
RD_MASK (4 bytes):
Bit mask selector for read.
bit D7=Compensated RF Detect (U16)
bit D9=RF Detect Power (S11.4)
bit D10=TX Power Target (S11.4)
bit D11=VGC1 (U16)
bit D12=VGC2 (U16)
bit D13=TX Index (U16)
bit D17=PA Bias 1 (U16)
bit D18=PA Bias 2 (U16)
bit D19=PA Supply (U16)
bit D20=LS High Power Flag (U16)
bit D22=Raw RF Detect (U16)
bit D23=Temp. Comp. (U16)

WR_MASK (4 bytes):
Bit mask selector for write. (same mask as read)

DATA (variable):
Values to be written (each value is 2 bytes). First value corresponds to the lowest bit set in the mask.
112 WRITE_DA - Set D/A Value 003B 003B PARAMETER
DATA
00
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=Battery/GSM (4 bytes)
01=AGC/GSM (2 bytes)
02=AFC/no Magic/GSM (2 bytes)
03=TX AFC/Magic/GSM (4 bytes)
04=RX AFC/Magic/GSM (4 bytes)
07=Battery charger/GCAPIII/WCDMA (2 bytes)
08=Battery charger/PCAP/WCDMA (2 bytes)
09=AFC/Harm/WCDMA (2 bytes)
0A=DAC0/VGC1/Harm/WCDMA (2 bytes)
0B=DAC1/VGC2/Harm/WCDMA (2 bytes)
0C=DAC2/LDSW/Harm/WCDMA (2 bytes)
0D=DAC3/PA1/Harm/WCDMA (2 bytes)
0E=DAC4/PA2/Harm/WCDMA (2 bytes)
0F=AGC/Harm/WCDMA (2 bytes)

DATA (variable):
A byte array of D/A value to set. (Size is dependent on D/A selection)
113 WSCMP - WCDMA Simple Camp 0C02 0C02 UARFCN
ACTION
2943
01
TIMEOUT
READ
2
YES
UARFCN (2 bytes):
Downlink channel

ACTION (1 byte):
00 = Enable Simple Camp
01 = Disable Simple Camp
02 = Enable Simple Camp S2 OFF
FF = Disable Simple Camp
114 WSCMP2 - WCDMA Simple Camp 0C02 0C02 UARFCN
ACTION
2943
01
TIMEOUT
READ
2
YES
UARFCN (2 bytes):
Downlink channel

ACTION (1 byte):
00 = Enable Simple Camp
01 = Disable Simple Camp
115 WUPD_COMP - WCDMA Update Compensated Values 0C1C 0C1C BITMASK
RESERVED
UARFCN
255
0
9750
TIMEOUT
READ
2
YES
1
1
2
BITMASK (1 byte):
Compensation update type.
0=No Update
1=Channel Gain Compensation
2=Temperature Gain Compensation
255=All Compensation Values

RESERVED (1 byte):

UARFCN (2 bytes):
Valid range = 9600-9900
116 WVAR - Write/Read WCDMA Variables 0C30 0C30 MODE
SLOT_COUNT
WRITE_ID_COUNT
READ_ID_COUNT
WRITE_IDS
READ_IDS
DATA
00
01
00
00


TIMEOUT
READ
2
YES
MODE (1 byte):
00=Single shot
01=Start continuous
02=Stop continuous

SLOT_COUNT (1 byte): Number of slots to write/read.
1 - 128 for single shot
15 - 128 for continuous

WRITE_ID_COUNT (1 byte): Number of IDs to write

READ_ID_COUNT (1 byte): Number of IDs to read

WRITE_IDS (2 bytes x # of write IDs): List of write IDs.

READ_IDS (2 bytes x # of read IDs): List of read IDs.

DATA (variable): Array of write values for Write IDs. Length is 2x number of slots for each write ID listed.
EOF