SEQ COMMAND TX_OPCODE RX_OPCODE DATA_FIELDS DATA_DEFAULTS OPTION_FIELDS OPTION_DEFAULTS DATA_WIDTH DESCRIPTION
1 READ TIMEOUT
READ
2
YES
Read only
2 GENERIC_COMMAND - Send Generic Opcode/Data Hex String STRING TIMEOUT
READ
10
YES
Enter the opcode and parameter data in the command window.
3 AD_CONV - Perform A/D Conversion 0001 0001 PARAMETER 0000 TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
0000=PA thermistor
0001=IF thermistor
0002=BUSMODE
0003=Uncompensated RSSI
0004=MCI0
0005=MCI1
0006=RF Detect
0007=Raw Ext B+ Voltage
0008=Main Batt temp.
0009=CCAP Thermistor
000A=B+ Voltage
000B=Phased B+SENSE
000C=Main Batt Voltage
000D=Phased BATSENSE
000E=RTC Batt Voltage
000F=Reserved
0010=MPBSENSE
0011=Phased MPBSENSE
0012=BATT_THERM
0013 Reserved
0014=CG_DF1
2
0015=Reserved
0016=BATT_FDBK
0017=Reserved
0018=DSC_EN_OUT
0019=Reserved
001A=DOWNLINK
001B=Reserved
001C=AD9
001D=Reserved
001E=Touch Screen X1
001F=Reserved
0020=Touch Screen X2
0021=Reserved
0022=Touch Screen Y1
0023=Reserved
0024=Touch Screen Y2
0025=Reserved
00FF=All Parameters
4 AT_MODE - Sends AT+MODE=1 for serial comm 41542B4D4F44453D310D0A 41542B4D4F44453D310D0A TIMEOUT
READ
2
YES
No data required
5 AUD_CTRL - Control Audio 0003 0003 CONTROL 01 TIMEOUT
READ
2
YES
CONTROL (1 byte):
00=Vibrator off
01=Vibrator on
02=Sidetone off
03=Sidetone on
04=Echo Cancelling off
05=Echo Cancelling on
06=Noise suppressor off
07=Noise suppressor on
6 AUD_LPB - Audio Loopback 0004 0004 TYPE 00 TIMEOUT
READ
2
YES
TYPE (1 byte):
00=Codec Loopback off
01=Codec Loopback on
02=13k Vocoder on
03=13k Vocoder off
04=ACELP Vocoder on
05=ACELP Vocoder off
06=Full Rate off
07=Full Rate on
08=Enh. Full Rate off
09=Enh. Full Rate on
0A=Half Rate off
0B=Half Rate on
11=ATI Loopback
7 AUD_LVL - Audio Level 0005 0005 LEVEL 80 TIMEOUT
READ
2
YES
LEVEL (1 byte):
00 to 0F=Set volume level
8x=Read current volume level
8 AUD_EMU 0908 0908 TIMEOUT
READ
2
YES
No data required
9 AUD_PATH - Set Audio Path 0006 0006 PATH
MUTE
00
03
TIMEOUT
READ
2
YES
PATH (1 byte):
Input path:
0x=IN no change
1x=IN Mute
2x=IN Internal
3x=IN External
4x=IN Boom

Output path:
x0=OUT no change
x1=OUT Mute
x2=OUT Internal
x3=OUT Alert
x4=OUT External
x5=OUT Speakerphone
x6=OUT Boom

MUTE (1 byte):
00=RX/TX Unmute
01=RX Unmute/TX Mute
02=RX Mute/TX Unmute
03=RX/TX Mute
10 AUD_TN_GEN - Enable/Disable Audio Tone 0044 0044 ACTION
FREQ1
LEVEL1
FREQ2
LEVEL2
FREQ3
LEVEL3
80
0000
0000
0000
0000
0000
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
Bit 7:
0x=Generate tone
8x=Stop generating tone
Bits 6:0:
Number of frequencies to generate - Valid range=01 to 03

FREQ1 (2 bytes):
First phased frequency

LEVEL1 (2 bytes):
Valid range=0000 to 3FFF

FREQ2 (2 bytes):
Second phased frequency

LEVEL2 (2 bytes):
Valid range=0000 to 3FFF

FREQ3 (2 bytes):
Third phased frequency

LEVEL3 (2 bytes):
Valid range=0000 to 3FFF

11 AUD_TN_LST - Audio Tone List 0000 0000 ENABLE
TONE
80
0000
TIMEOUT
READ
2
YES
ENABLE (1 byte):
00=Enable tone
80=Disable tone

TONE (2 bytes):
0000=DTMF_0
0001=DTMF_1
0002=DTMF_2
0003=DTMF_3
0004=DTMF_4
0005=DTMF_5
0006=DTMF_6
0007=DTMF_7
0008=DTMF_8
0009=DTMF_9
000A=DTMF_STAR
000B=DTMF_POUND
000C=SOFT_KEY_LIGHT
000D=MENU_KEY_LIGHT
000E=SEND_KEY_LITE
000F=END_KEY_LITE
0010=SMART_KEY_LITE
0011=VOLUME_KEY_LITE
0012=KEY_LITE
0013=CALLDROP_LITE
0014=CHARGE_BATTERY_LITE
0015=ERROR_LITE
0016=DEVICE_CONNECT_LITE
0017=DEVICE_DROP_LITE
0018=CALL_TIMER_LITE
0019=INCALL_LOW_BATTERY_LITE
12 AUTOCYCLE 0002 0002 ENABLE 01 TIMEOUT
READ
2
YES
ENABLE (1 byte):
01=Enable auto cycle mode
13 BT - Bluetooth Control 0042 0042 DATA TIMEOUT
READ
2
YES
DATA (variable):
BT TCI unsolicited message
14 CALL 004D 004D DATA 00 TIMEOUT
READ
2
YES
15 CARRIER - Enable/Disable Transmit Carrier 0007 0007 ENABLE 01 TIMEOUT
READ
2
YES
ENABLE (1 byte):
Bits D7:D5:
Reserved and set to 0
Bits D4:D1:
Pattern type (GSM only)
Bit D0:
0b=disable
1b=enable
16 CARRIER_SYN_ATTN - Enable/Disable Transmit Carrier with Channel & Power Level 0052 0052 ENABLE
CHANNEL
BAND
LEVEL
1
384
0
0
TIMEOUT
READ
2
YES
1
2
1
1
ENABLE (1 byte):
Bits D7:D5:
Reserved and set to 0
Bits D4:D1:
Pattern type (GSM only)
Bit D0:
0b=disable
1b=enable

CHANNEL (2 bytes):
Valid range:
1 to 799
990-1023 (CDMA
TDMA
AMPS 800 MHz)
1 to 1998 (TDMA 1900MHz)
25 to 1175 (CDMA 1900 MHz)
1 to 124 (PGSM 900 MHz)
0
975 to 1023 (EGSM 900 MHz)
512 to 885 (DCS 1800 MHz)
512 to 810 (PCS 1900 MHz)

BAND (1 byte/last 4 bits):
0000b=800 MHz (TDMA only)
0011b=1900 MHz (TDMA only)

LEVEL (1 byte):
0 to 7 (CDMA-AMPS)
Tx output power in 2's compliment format (CDMA 800
1900).
0 to 10 (TDMA)
0 to 19 (GSM)
17 CDATA - Transmit Continuous Data 0008 0008 DATA
ENABLE
000000000000
80
TIMEOUT
READ
2
YES
DATA (6 bytes):
Data continuously transmitted.

ENABLE (1 byte):
Bit D7:
0x=start
8x=stop

Bits D6:D0:
x0=variable rate
x1=full rate
x2=half rate
x3=quarter rate
x4=eighth rate
18 CEM_TEST - CE_Module Bus Pins Connectivity Testing 0049 0049 TYPE 00 TIMEOUT
READ
2
YES
TYPE (1 byte):
00=SCI test
All other values TBD
19 COMMIT 0B0C 0B0C ELEMENT
AUTHO
NAM
00
000000
00
TIMEOUT
READ
2
YES
ELEMENT (1 byte):
00=NAM elements
01=SEEM_IRDB elements

AUTHO (3 bytes):
If ELEMENT=01
then value=000000
else use last 18 bits for value

NAM (1 byte):
Bit 7:
If ELEMENT=01
then value=0b
Bits 6:0:
00=First NAM
01=Second NAM
20 COMPD - Compander On/Off 0009 0009 ENABLE 00 TIMEOUT
READ
2
YES
ENABLE (1 byte):
00=Turns compander on
01=Turns compander off
21 CP_MODE - Set Sub-mode 000A 000A SUBMODE 80 TIMEOUT
READ
2
YES
SUBMODE (1 byte):
Bit D7:
0x=Set sub-mode
8x=Get sub_mode
Bits D6:D0:
x0=CDMA AMPS
x1=CDMA Digital 800
x2=CDMA Digital 1900
x3=GSM900
x4=GSM1800
x5=GSM1900
x6=GSM900
GSM1800
22 CPY_ACTIVE - Copies Active Element To Scratchpad 0B0D 0B0D ELEMENT
NAM
00
00
TIMEOUT
READ
2
YES
ELEMENT (1 byte):
00=Copies the active NAM to the sratchpad
01=copies the active SEEM_IRDB to the scratchpad

NAM (1 byte):
00=First NAM
01=Second NAM
23 DIGTS - Switch To Digital Mode 0B04 0B04 SLOT 01 TIMEOUT
READ
2
YES
SLOT (1 byte):
01=Slot 1
02=Slot 2
03=Slot 3
24 DTMF - Enable/Disable DTMF Tones 000B 000B ENABLE
TONE
80
00
TIMEOUT
READ
2
YES
ENABLE (1 byte):
80=Enable DTMF tone
00=Disable DTMF tone

TONE (1 byte):
00=Key 0
01=Key 1
02=Key 2
03=Key 3
04=Key 4
05=Key 5
06=Key 6
07=Key 7
08=Key 8
09=Key 9
25 EGPM - Enables/Disables Handovers 0904 0904 ACTION 00 TIMEOUT
READ
2
YES
ACTION (1byte):
00=Disable handover
01=Enable handover
26 ERS_PANIC - Erase Panic Information In Flash 000C 000C TIMEOUT
READ
2
YES
No data required.
27 FLASH - Enter Flash Mode 000D 000D TIMEOUT
READ
2
YES
No data required.
28 FLIP - Read/Write Flip 0043 0043 STATE 80 TIMEOUT
READ
2
YES
STATE (1byte):
80=Read the flip state
40=Write the flip state opened
00=Write the flip state closed
29 FSAC - File System Access 004A 004A PARAMETER
DATA
00000004 TIMEOUT
READ
60
YES
PARAMETER (4 bytes):
0x00000000 = Open File
0x00000001 = Read File
0x00000002 = Write File
0x00000003 = Seek File
0x00000004 = Close File
0x00000005 = Delete File
0x00000006 = Clear File
0x00000010 = Format Volume

DATA (variable):
Open file:
Bytes (1-4)
00000000 = Default
00000001 = Read Only
00000002 = Hidden
00000004 = Preload/System
Bytes (5 - (n+4))
Filename

Read File (4 Bytes):
# of bytes to read

Write File:
Bytes (1-4)
# of bytes to write
Bytes (5 - (n+4)
Data to write

Seek File:
(Bytes 1-4)
Offset to move by
(Byte 5)
Initial location of pointer

Close File:
No Data

Delete File:
Filename to delete

Clear File (1 Byte):
00 = All
01 = User Files
02 = Read Only files
03 = Hidden files
04 = Preload/System Files

Format Volume Data
(1-511) bytes = Volume Name
30 GET_PANIC - Read Information Out Of Panic Sector 000E 000E OFFSET
SIZE
0000
0000
TIMEOUT
READ
2
YES
OFFSET (2 bytes):
Offset from beginning of the location where Panic data is stored

Size (2 bytes):
0000=read entire 8k data
Valid range for number of bytes to read=0001 to 2000
31 GPIO_TEST - Read/Write GPIO Port/Register 0041 0041 ACTION
PORT
MASK
VALUE
DIRECTION
I/O
00
00
0000
0000
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Read
01=Write
02=Configure

PORT (1 byte):
TDMA
GSM:
00=Port A
01=Port B
02=Port C
03=Port D
04=Port E
05=Port F
CDMA:
00=MGDRA
01=MGDRB
02=KPDR
03=EDPR
04=QDPR

MASK (2 bytes):
Used when configuring pins with bit 0=pin 0 to bit 15=pin 15.
0=No change
1=To be configured

VALUE(2 bytes):
Used when writing to pins with bit 0=pin 0 to bit 15=pin 15.

DIRECTION (1 byte):
Used when configuring pins enabled in MASK.
00=Input
01=Output

I/O (1 byte):
32 GPRS_LPB - Enter GPRS Loopback Mode 0903 0903 CHANNEL
TSC
TIM_ADV
CS
DL_TS
UL_TS
ALPHA
GAMMA
0
0
0
0
0
0
0
0
TIMEOUT
READ
2
YES
2
1
1
1
1
1
1
1
CHANNEL (2 bytes):
Valid range=0 to 1023

TSC (1 byte/last 3 bits):
Valid range=0 to 7

TIM_ADV (1 byte/last 6 bits):
Valid range=0 to 63

CS (1 byte/last 2 bits):
0=CS-1
1=CS-2
2=CS-3
3=CS-4

DL_TS (1 byte):
0b=Timeslot not assigned
1b=Timeslot asigned
With MSB=timeslot 0 and LSB=timeslot 7

UL_TS (1 byte):
0b=Timeslot not assigned
1b=Timeslot asigned
With MSB=timeslot 0 and LSB=timeslot 7

ALPHA (1 byte/last 5 bits):
Valid range=0 to 19

GAMMA (1 byte/last 5 bits):
00000b=0dB
00001b=2dB
.....
.....
11110b=60dB
11111b=62dB
33 GPRS_SEND - Transmitting A Repetetive LLC 0905 0905 TYPE
PDU
LENGTH
PRIORITY
THROUGHPUT
0
0
0
1
0
TIMEOUT
READ
2
YES
1
1
2
1
1
TYPE (1 byte):
0=LLC ACK mode
1=LLC UNACK mode

PDU (1 byte):
The number of PDUs to send. Valid range=0 to 255

LENGTH (2 bytes):
RLC data length. Valid range=0 to 1530

PRIORITY (1 byte):
Valid range=1 to 4

THROUGHPUT (1 byte):
Valid range=0 to 9
34 HDW - Enable/Disable Hardware Control 000F 000F ACTION 80 TIMEOUT
READ
2
YES
ACTION (1 byte):
Bit 7:
8x=Enable
0x=Disable
Bits 6:0:
HW Control Options
x0=Antenna retraction
35 HIBERNATE 0053 0053 TIMEOUT
READ
2
YES
36 ICACS - Read/Write IC Register 0046 0046 ACTION
RESERVED
ADDRESS
LENGTH
DATA
80
00
0000
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
Bit 7:
8x=Read
0x=Write
Bits 6:0:
Device type
00000000b=CCAP

RESERVED (1 byte):
Not used

ADDRESS (2 bytes):
Format is device specific.

LENGTH (2 bytes):
Number of bytes to read/write.

DATA (variable):
Write request only
37 INIT - Initialize 0011 0011 TIMEOUT
READ
2
YES
Initializes phone to default settings.
38 INVM - Initialize Non-volatile Memory 0012 0012 LEVEL 00 TIMEOUT
READ
2
YES
LEVEL (1 byte):
00=Master Reset
01=Master Clear
39 IRDA - Enable/Disable IRDA Port 0040 0040 ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=IRDA activate
01=IRDA deactivate
40 IR_STATUS - Read/Write IR Scanning Parameters 0B0A 0B0A SCAL_FAC 0 TIMEOUT
READ
2
YES
1 SCALING_FACTOR (1 byte):
0=no operation performed
All other values=RESCAN_COUNT/(parameter/10)
41 KEYS - Perform Multiple Keypresses 0013 0013 KEY TIMEOUT
READ
2
YES
KEY (variable):
Array of Key codes
42 KEY_PRESS - Perform Single Keypress 0045 0045 ACTION
KEY
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
80=Press
00=Release

KEY(1 byte):
Key code
43 KEY_TEST - Return Last Keypress 003F 003F TIMEOUT
READ
2
YES
No data required.
44 LEDS - Enable/Disable LEDS 003E 003E LED
ACTION
DATA
00
00
TIMEOUT
READ
2
YES
LED (I byte):
00=Keypad backlight LED
01=Main display backlight LED
02=CLI display backlight LED
03=Red LED
04=Green LED
05=Alternating green and red LED (CDMA only)

ACTION (1 byte):
00=Disable LED
01=Enable LED
02=Set pulse current (GSM/TDMA only)
03=Set duty cycle (GSM/TDMA only)
04=Disable pulse skip (GSM/TDMA only)
05=Enable pulse skip (GSM/TDMA only)
06=Setup (GSM/TDMA only)

DATA: (GSM/TDMA only)
ACTION=02(1 byte)
00=Low
01=Med
02=High
03=Full
ACTION=03(1 byte)
00=OFF
01=.1 ON 1.9 OFF
02=.2 ON 1.8 OFF
03=.5 ON 1.5 OFF
04=.25 ON .75 OFF
05=.25 ON 1.75 OFF
06=.05 ON 1.95 OFF
07=.5 ON .5 OFF
08=0 ON .5 OFF .5 ON 0 OFF
09=.125 ON .5 OFF .075 ON 1.5 OFF
0A=.125 ON 0 OFF 0 ON 2.075 OFF
0B=0 ON .625 OFF .075 ON 1.5 OFF
0C=ON
ACTION=06(3 bytes)
Byte 2: Pulse current
Byte 3: Duty cycle
Byte 4: Pulse skip
00=Disable
01=Enable
45 LOAD_SYN - Load Synthesizer 0014 0014 CHANNEL
BAND
384
0
TIMEOUT
READ
2
YES
2
1
CHANNEL (2 bytes):
Valid range:
1 to 799
990-1023 (CDMA
TDMA
AMPS 800 MHz)
1 to 1998 (TDMA 1900MHz)
25 to 1175 (CDMA 1900 MHz)
1 to 124 (PGSM 900 MHz)
0
975 to 1023 (EGSM 900 MHz)
512 to 885 (DCS 1800 MHz)
512 to 810 (PCS 1900 MHz)

BAND (1 byte/last 4 bits):
0000b=800 MHz (TDMA only)
0011b=1900 MHz (TDMA only)
46 LONG_STAT - Return Status Data 0015 0015 COMMAND 00 TIMEOUT
READ
2
YES
COMMAND (1 byte)(GSM only):
00=Request table status
01=Request channel status
02=Request long status
03=Request packet data status
47 MEMACS - Read/Write Memory Address 0016 0016 ADDRESS
DEVICE/SIZE
DATA
00000000
0000
TIMEOUT
READ
2
YES
ADDRESS (4 bytes):
32 bit address for read/write (LSB 16 bits for DSP accesses)

DEVICE/SIZE (2 bytes):
Bit 15:
0b=Read
1b=Write
Bit14:12:
000b=MCU
001b=DSP X
010b=DSP Y
Bits 11:0:
Requested number of bytes to read/write

DATA (variable):
MCU=Array of bytes
DSP=Array of Halfwords
48 MIDI 0912 0912 DATA TIMEOUT
READ
2
YES
49 MSG_INJ - Send a SUAPI Message 0033 0033 TYPE
DEST_LENGTH
REP_LENGTH
DATA_LENGTH
DEST_PORT
REP_PORT
DATA
00000000
00
00
0000


TIMEOUT
READ
2
YES
TYPE (4 bytes):
Application ID

DEST_LENGTH (1 byte):
Length of destination port ID

REP_LENGTH (1 byte):
Length of reply port ID

DATA_LENGTH (2 bytes):
Length of SUAPI message data

DEST_PORT (variable):
ASCII string ID

REP_PORT (variable):
ASCII string ID

DATA (variable):
SUAPI mesage data.
50 MSG_RT - Set Routing Of SUAPI Ports 0034 0034 SELECTION
PORT_LIST
00
<320 bytes>
TIMEOUT
READ
2
YES
SELECTION (1 byte):
00=Changes take effect at next power up.
40=Changes are immediate.
80=Both immediate and at power up.

PORT_LIST (320 bytes max.):
List of port names to be set to intercept mode.
51 PA_FDBACK - Read RF Detect 0B08 0B08 TIMEOUT
READ
2
YES
No data required.
52 PARM - Read/Write Parameter 0030 0030 PARAMETER
ACTION
DATA
0000
80
TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
0000=Autocycle
0001=Drive testing wait duration
0002=Drive testing call duration
0003=Data feature bytes
0004=Feature bytes

ACTION (1 byte):
80=Get parameter
00=Set parameter

DATA (variable):
(Set only)Phasing parameter data
53 PHASE - Read/Write Phased Parameters 001D 001D PARAMETER
RECORD
DATA
0000
40
TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
0000=CDMA Analog pwr control
0001=MOD0
0002=MOD1
0003=MOD2
0004=MOD3
0005=MOD4
0006=AUX
0007=MIC
0008=DTMF
0009=DATA
000A=SAT
000B=DIS
000C=AFC_WARP
000D=Analog ZIF high
000E=Analog ZIF med
000F=Analog ZIF low
0010=LSDATA
0011=TX CLIPPER
0013=DRX_SHORT
0014=DRX_LONG
0015=Analog AOC Force
0016=Variable Bias Table
0017=PWR_ADJ_FREQ
0018=RSSI_FREQ_AMPS
0019=Analog RSSI Phasing
001A=A_DAC_FRC
001B=B_DAC_FRC
001C=CL_SUM_FRC

RECORD (1 byte):
Bit 6:
1=Get
0=Set
Bits 5-4
Record #

DATA (variable):
(Set only)Phasing parameter data
54 PING - Check the TCI Connection 0FFF 0FFF TIMEOUT
READ
2
YES
No data required.
55 PKI_DATA_PROVISION 006A 006A DATA TIMEOUT
READ
2
YES
56 PREKEY - Enable/Disable Prekey 001F 001F ACTION 80 TIMEOUT
READ
2
YES
ACTION (1 byte):
80=Enable
00=Disable
57 PRG_OTP 006D 006D DATA TIMEOUT
READ
2
YES
58 PROT - Technology Selection 0050 0050 ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
Bit 7:
0b=Get current protocol
1b=Set protocol
Bits 3:0: (Set only)
0000b=GSM protocol
0001b=TDMA protocol
59 PWR_OFF - Power Off 001E 001E TIMEOUT
READ
2
YES
No data required.
60 RCVS1 - Receive Control Channel Messages 0023 0023 ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Start
01=Terminate
61 RCVS2 - Receive Control Channel Messages 0024 0024 ACTION
FRAMES
00
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Start
01=Terminate

FRAMES (2 bytes):
Number of frames to be received (Start only).
62 RD_ID_GSM 0B0E 0B0E IC 00 TIMEOUT
READ
2
YES
IC ( 1 Byte):
00=POG
63 RDELEM - Read Memory Element 0020 0020 ELEMENT_ID
REC
OFFSET
LENGTH
0000
0000
0000
0000
TIMEOUT
READ
2
YES
ELEMENT_ID (2 bytes):
Specifies the Element ID.

RECORD (2 bytes):
Specifies the record number of the element.

OFFSET (2 bytes):
Specifies the offset
in bytes
into the record. Set to 0 to read the entire record.

LENGTH (2 bytes):
Length
in bytes
of the data to be read.
64 RDWR_I2C - Read/Write I2C Bus Device 0063 0063 ACTION
DEVICE
SLAVE_ADDR
LENGTH
DATA
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Read
01 = Write

DEVICE (1 byte):
00 = default for now

SLAVE ADDR (1 byte):

LENGTH (1 byte):
Length of data field

DATA (variable):
65 RDWR_SPI - Read/Write SPI Data 0021 0021 LENGTH
DEVICE
DATA
0000
00
TIMEOUT
READ
2
YES
LENGTH (2 bytes):
This field specifies the number of bits to write to the SPI device.

DEVICE (1 byte):
02=Read from GCAP
03=Write to GCAP

DATA (variable):
Array of bytes to send on the SPI bus (MSb first). If the number of bits to send (specified in LENGTH) is not an integer number of bytes
then the last byte must be padded with 0s.
66 RESTART - Software Restart 0022 0022 TIMEOUT
READ
2
YES
No data required.
67 RSSI - Request RSSI Value 0027 0027 TYPE 00 TIMEOUT
READ
2
YES
TYPE (1 byte):
00=RSSI_C_MCU (AMPS sub-mode)
01=RSSI_R_DSP
02=RSSI_C_DSP
03=RSSI_TDMA
04=RSSI_C_FILT
05=RSSI_C_MCU (all sub_modes)
68 RTCC - Read/Write Real-time Clock 0029 0029 ACTION
DAY_CTR
TIME
00

TIMEOUT
READ
2
YES
ACTION (1byte):
00=Set RTCC
01=Get RTCC

DAY_CTR (2 bytes):
Number of days since any date.

TIME (4 bytes):
Number of seconds since midnight.
69 RQ - Request Data 0026 0026 PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=RQCS
01=RQEQ
02=RQSB
03=RQSI
04=Tx Attn.
05=Tx Power

DATA (variable):
A byte array of data.
70 SAT - Enable/Disable SAT Tone 002B 002B ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Disable
80=5970 Hz
81=6000 Hz
82=6030 Hz
71 SBSDY_LCK - Set/Check/Change Master Subsidy Lock Code 0035 0035 ACTION
CODE
00
<14 bytes>
TIMEOUT
READ
2
YES
ACTION (1 byte):
00=MSL status (CDMA) or SL status (GSM)
01=Verify MSL code (CDMA) or SIM Lockcode (GSM)
02=Change MSL code (CDMA)
03=Check Initial Phone Locking and verify code (TDMA).
04=Verify service password

CODE (14 bytes):
Code format is detmined by ACTION.
72 SCMP - Simple Camp 0901 0901 ACTION
CHANNEL
0
0
TIMEOUT
READ
2
YES
1
2
ACTION (1 byte):
0=Initialize
1=Stop

CHANNEL (2 bytes): Channel number
set to 0 for Stop.
73 SET_RF_POWER - Set Transmit Power Level 002D 002D LEVEL 0 TIMEOUT
READ
2
YES
1 LEVEL (1 byte):
0 to 7 (CDMA-AMPS)
Tx output power in 2's compliment format (CDMA 800
1900).
0 to 10 (TDMA)
0 to 19 (GSM)
74 SIGTONE - Enable/Disable Signalling Tone 002E 002E ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
01=Enable
00=Disable
75 SMARTCARD - Read Write Smartcard 003C 003C ACTION
CARD_ID
FILE
REC
OFFSET
LENGTH
DATA
00
00
00
00
0000
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Read form elementary file
01 = Write to elementary file

CARD_ID (1 byte):
This field specifies the card of the file that is being read/written.

FILE (1 byte):
This field specifies the name of the file that is being read/written.

REC (1 byte):
This field specifies which record is being read/written.

OFFSET (2 bytes):
This field specifies the offset
in bytes
into the record. Set field to 0 to read/write entire record.

LENGTH (2 bytes):
The length
in bytes
to be read/written

DATA (variable):
A byte array of data to write to the Smart card.
76 SSI_LPB - SSI Loopback 0048 0048 ACTION
SOURCE
DEST
GAIN
01
00
00
FFFF
TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Start SSI loopback
01=Set default state

SOURCE (1 byte):
00=SAP RX slot 1
01=SAP RX slot 2
02=SAP RX slot 3

DEST (1 byte):
00=SAP TX slot 1
01=SAP TX slot 2
02=SAP TX slot 3

GAIN (2 bytes):
Valid gain=0001 to 7FFF
Audio path disconnected=FFFF
77 STELEM - Store Memory Element 002F 002F ELEMENT_ID
REC
OFFSET
LENGTH
DATA
0000
0000
0000
0000
TIMEOUT
READ
2
YES
ELEMENT_ID (2 bytes):
Specifies the Element ID.

REC (2 bytes):
Specifies the record number of the element.

OFFSET (2 bytes):
Specifies the offset
in bytes
into the record. Set to 0 to read the entire record.

LENGTH (2 bytes):
Length
in bytes
of data to be written.

DATA (variable):
A byte array of data
78 SUSPEND - Enter Test Mode 0036 0036 MODE 80 TIMEOUT
READ
2
YES
MODE (1 byte):
00=Test Mode
01=Normal Mode
02=Handset Test Mode
8x=Read Current Mode
79 SWT_RF 006C 006C DATA TIMEOUT
READ
2
YES
80 TDMA_CFG - Configure TDMA Parameters 0B09 0B09 MODE_CTRL
AUDIO_STATE
NFREQ
FREQ1
FREQ2
AMP1
AMP2
CH_INDEX
RADIO_CTRL
I_SEL
Q_SEL
IQ_FREQ
IQ_AMP
SAW_INC
WARP
RX_GAIN
DC_OFFSET
PWR_LEVEL
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
TIMEOUT
READ
2
YES
1
1
1
2
2
2
2
2
1
2
2
2
2
2
2
2
1
2
MODE_CTRL (1 byte):
0=Disable
1=Enable

AUDIO_STATE (1 byte):
Not currently supported

NFREQ (1 byte):
Not currently supported

FREQ1 (2 bytes):
Not currently supported

FREQ2 (2 bytes):
Not currently supported

AMP1 (2 bytes):
Not currently supported

AMP2 (2 bytes):
Not currently supported

CH_INDEX (2 bytes):
For PCS channels
add 16384 offset.

RADIO_CTRL (1 byte):
0=TX disabled
1=DQPSK with SYNC1 and random DATA bits
2=DQPSK with SYNC1 and remaining bits
3=I and Q sawtooth
4=FM modulation
5=FM loopback
6=I/Q loopback
7=Custom I/Q pattern

I_SEL (2 bytes):
1=sine
-1=cosine
All others should be a 16 bit DC level.

Q_SEL (2 bytes):
1=sine
-1=cosine
All others should be a 16 bit DC level.

IQ_FREQ (2 bytes):
Range=0 to 30kHz

IQ_AMP (2 bytes):
Amplitude in units
32767=Full-scale

SAW_INC (2 bytes):
Sawtoth increment

WARP (2 bytes):
Range=-20 to 20 ppm
-32768=Use AFC

RX_GAIN (2 bytes):
Units=.1 dB
Negative value=Use AGC

DC_OFFSET (1 byte):
0=Disable
1=Enable

PWR_LEVEL (2 bytes):
Range=0 to 10
81 TDMA_INFO - Send TDMA Stack Data 0B05 0B05 DATA <2 to 32 bytes> TIMEOUT
READ
2
YES
DATA (variable):
Data to send to the TDMA call stack.
82 TDMA_ON - Start TDMA Forward Channel Sync 0B06 0B06 DVCC
MASK
00
00
TIMEOUT
READ
2
YES
DVCC (1 byte):

MASK (1 byte):
Bit 7:
Unused.
Bits 6:3:
0000b=Tx key=1s/Rx key=0s
0001b=Tx key=0s/Rx key=1s
0010b=Tx key=101010…/Rx key=0s
0011b=Tx key=010101…/Rx key=0s
0100b=Tx key=0s/Rx key=101010…
0101b=Tx key=0s/Rx key =010101…
0110b=Tx key=Rx key=0s
0111b=Tx key=Rx key=101010...
Bit 2:
0b=No VPM
1b=Apply VPM
Bit 1:
0b=Echo before convolutional decoding
1b=Echo after convolutional decoding
Bit 0:
0b=Speech DATA
1b=FACCH word
83 TLPB - Traffic Channel Loopback 0902 0902 ACTION
CHANNEL
POWER_LEVEL
TIME_SLOT
64
0
0
1
TIMEOUT
READ
2
YES
1
2
1
1
ACTION (1 byte):
0=Stop TCH loopback
64=Start TCH loopback

CHANNEL (2 bytes):
TCH loopback channel number
set to 0 for Stop

POWER_LEVEL (1 Byte):
Valid data=0 to 19
set to 0 for Stop.
TIME_SLOT (1 byte):
Supports 1-8.
84 TST_CAMERA - Camera command 0061 0061 PARAMETER
DATA
02
00
TIMEOUT
READ
10
YES
PARAMETER (1 byte):
0x00 = Start/Stop Viewfinder
0x01 = Cature JPEG
0x02 = Capture MP4
0x03 = Set/Get Attribute
0x11 = View JPEG
0x12 = View MP4

DATA (variable):

Start/Stop Viewfinder (2 Bytes):
Set/Get (1/2 byte) [D7-D4]:
0x0 = Set
0x01 = Get
Action (1/2 byte) [D3-D0]:
0x0 Stop Viewfinder
0x1 = Start Viewfinder
0x2 = Switch to external viewfinder
0x3 = Switch to internal viewfinder
Media Type (1/2 byte) [D7-D4]:
0x0 = Still Image
0x1 = Video
Still Image Res (1/2 Byte) [D3-D0]:
0x0 = VGA
0x1 = QVGA
0x2 = SQVGA
0x3 = QQVGA
0x4 = QQQVGA
0x5 = CIF
0x6 = QCIF
0x7 = SQCIF

Capture JPEG (variable):
Action (1 byte):
0x00 = Capture Still Image
Filename (Bytes 1-257 variable)

Capture MP4 (variable):
Action (1 byte):
0x00 = Starts Video Capture
0x01 = Stops Video Capture
Filename (Bytes 1-257 variable)

Set/Get Attribute (2 Bytes):
Set/Get (Byte 1)[D7]:
0b = Set Attribute
1b = Get Attribute
Camera Attribute (Byte 1)[D6-D0]:
0000000b = White balance
Attribute (Byte 2):
0x00 = Reserved
0x01 = Sunny
0x02 = Cloudy
0x03 = Indoor Home (incandescent)
0x04 = Indoor Office (fluorescent)
0x05 = Automatic
85 TST_DISP - Test Display 0037 0037 PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=Get display configurations
01=Select display
02=Display predefined pattern
03=Display input pattern
04=Shift curent pattern left(NYI)
05=Shift curent pattern right(NYI)

DATA(variable):
No data required to a variable array of data required. Data format is determined by PARAMETER.
86 TST_FMIC - Test the FM radio module 0910 0910 PARAMETER
DATA
00
01
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x00=Enable/Disable
0x01=Tune

DATA (variable)
87 TST_HDD 006B 006B DATA TIMEOUT
READ
2
YES
88 TX_PWR_DET - Set RF Detect Mode 0B0B 0B0B MODE 00 TIMEOUT
READ
2
YES
MODE (1 byte):
00=Low power
01=High power
89 VERSION - Read Software Version Numbers 0039 0039 TYPE 0001 TIMEOUT
READ
2
YES
TYPE (2 bytes):
0001=Platform
0002=DSP (TDMA
GSM)
0003=Factory Hardware (TDMA)
0004=Language Package ID
FFFF= Release Label
90 VIBRATOR 0096 0096 DATA TIMEOUT
READ
2
YES
91 VST_VERSION 0067 0067 DATA 00 TIMEOUT
READ
2
YES
92 WR_PBK 004B 004B LOCATION
FIELDSEP
NUMBER
FIELDSEP
NAME
FIELDSEP
TYPE
FIELDSEP
0000
000D
0000
000D
0000
000D
0000
000D
TIMEOUT
READ
2
YES
LOCATION (2 bytes): phonebook location
FIELDSEP (2 bytes):
Must be 000D
NUMBER (2 bytes):number to store
FIELDSEP (2 bytes):
Must be 000D
NAME (2 bytes): name for location
FIELDSEP (2 bytes):
Must be 000D
TYPE (2 bytes): entry type
FIELDSEP (2 bytes):
Must be 000D
93 WRITE_DA - Set D/A Value 003B 003B PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=Set D to A (battery)
01=Set AGC DAC
02=Set AFC DAC (No MAGIC)
03=Set AFC DAC (MAGIC present
TX)
04=Set AFC DAC (MAGIC present
RX)
05=Set AOC DAC (Merlin)
06=Set AOC DAC (Lewis)

DATA (variable):
A byte array of data. Data format is determined by PARAMETER.
94 WSTS - Receive Analog Control Channel 003A 003A ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Start
01=Terminate
95 XUPID - Get/Set Extended Universal Platform Identifier 0038 0038 ACTION
XUPID
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Get
80=Set

XUPID (4 bytes):
Specifies the XUPID (set only).