Motorola CMT Programming

Here are some notes I found regarding programming Motorola cellular
products. I have an 8000H portable phone. Some comments:
 
 From the keyboard, you must know the security code to get to
programming mode. You may enter programming mode a total of three
times.  After three times, the phone must be returned to the dealer to
have a counter reset. However, at least on the 8000H and Ultra Classic
portables, one can fabricate a jumper, and reset the counter easily.
 
Before changing anything, I'd use * to step through and record
your present values.
 
Note that if you install the jumper, you would enter 55# and then
follow the notes for entering the customer/system information.  You
can also first do a 32# to clear all timers and restore features to
standard. THIS ERASES ALL STORED PARAMATERS!
 
What I found most useful was to step through, record all paramaters
entering programming mode from the keypad without the jumper.
 
Then, power up with the jumper, use 32# to clear evertying
        power off
        remove jumper
        power up
        reset params entering programming mode from keyboard,
                using 000000 as the security code
 
This technique let me have two phone numbers in two markets, even
though the phone is single NAM. I'd get to a particular spot on the
road, with a convenient rest area, and reprogram my phone for service
(as contracted for!) in the second city. This was to have a local
number and not pay roaming rates in the second city.  On the return
trip, I'd stop and reprogram for my "home" market.
 
Disclaimers: You can put the phone in several modes intended for
alignment and testing "on the bench". Don't do it. You could also set
the phone up such that the contracted for service won't work properly.
Don't program paramaters to other than those provided by your carrier.
 
There is no way (as far as I know) to alter the ESN on these phones.
Well, I'm sure it's possible if you're the vendor but there is no
magic keypad code to do it.
 
You can also make the phone a cellular receiver: power up with jumper

        353#        Select Handset audio path
        08#         RX Audio ON
        11xxx#      Three digit number, i.e. 11362#
        474#        Set to mid level audio
        11xxx#      Change to another channel
 
Power off, remove jumper, power up to restore normal phone
operations.
 
Dec 29, 1993 Motorola Cellular Mobile Telephone programming notes:
 
Part 1: From the manual included with the 8000H portable phone.
 
Items to be programmed:                                

System ID Code                5 digits        
Cellular Telephone Number    10 digits        
Station Class Code            2 digits        
Access Overload Class         2 digits        
Group ID Mark                 2 digits        
Security Code                 6 digits        
Unlock Code                   3 digits        
Initial Paging Channel        4 digits (Use Leading 0)
Option Bits                   6 digits
*Internal Speaker             0 for internal
*Local Use                    normally 1
*Min Mark                     Normally 0, 0=disabled
when enabled, unit sends area code on all calls
*Auto REcall                  Always set to 1
*Second PHone number          0
*Diversity                    0=off
Option Bits
*Long Tone DTMF               1 (0 to disable)
*FUTURE USE                   0
*Eight hour timeout           0 to enable
 
Programming your telephone:
 
If you have:
Menu and Fcn keys              Sequence 6
FCN key but no Menu key        Sequence 1
No Fcn key                     Sequence 2
 
Model            Handset      Type   Sequence
3000SCN          2007         A        6
6000SCN          2023         A        2
6000XSL          N2020        A        1
6800XLT          LN2659       A        1
6800XLT          LN2733       A        6
Alpha Hndset     SCN2083      A        6
 
Sequence        
1                FCN, Security Code entered twice, RCL
2                STO, #, Security Code entered twice, RCL
3                Ctl, 0 + SC twice, RCL
4                Ctl, 0 + SC twice, *
5                FCN, 0 + SC twice, MEM
6                FDN, 0 + SC twice, RCL
Security code is programmed 000000 at the factory
 
After successfully entering program mode, 01 appears on the display

* steps thorugh
SND stores information
 
Step 1        SID
Step 2        Area Code
Step 3        Phone Number
Step 4        Station Class Mark
Step 5        Access Overload Class
Step 6        Group ID
Step 7        Security Code
Step 8        Unlock Code
Step 9        Initial Paging Channel
Step 10       Options (6 digits)
Step 11       Options (3 digits)
 
Part 2: From a programming Cheat Sheet, not normally included with the
phone: Assumes one has fabricated a jumper or has a test jig.  These
functions available only if you start the phone with one pin jumpered
to ground as below.
 
CHAN      \/   PWR LVL
x   x   x     x   x   x <--Rx Sig Strength, 00-99
--MORE--(51%)

SAT -->x   x   x  x  x   x   x <--1=TX Audio OFF
    ^   ^     ^   ^ 
1=TX on <-- :   :     :   : 1=RX AUdio OFf
1=SigTone ON    :     : 1=Control Channel
 
01#    Restart (Turns unit off and back on)
02#    Display current radio stuatus (non-scrolling version
       of above display)
04#    Initiales Unit to Standard Default Settings
Carrier OFF
RF Attenuator to max power
Receiver Audio Muted
Transmit Audio Muted
Signalling Tone Off
Resetting of Watchdog Timer Enabled
DTMF and Audio Tones off
Audio path set to speaker
 
05#     TX Carrier ON
06#     TX Carrier OFF
07#     RX OFF (Mute RX audio)
08#     RX Audio ON (Unmuted)
09#     TX Audio OFF
10#     TX Audio ON
11(CH No)# Sets to desired channel
12#     Set power to x; 0=max 7 = min
14#     10 Khz sig tone on
15#     10 Khz Sig tone off
19#     Display software version number (4 digits)
25x#    SAT Tone on when x=0, SAT = 5970 Hz
        x=1, SAT = 6000 Hz
        x=2, SAT = 6030 Hz
26#     SAT Tone off
27#     Transmit Data
28#     1150 Hz Tone on
29#     1150 Hz Tone off
30#     770 Hz Tone on
31#     770 Hz Tone off
32#     Clears all timers and resets User's programmable features to
        standard, also clears user stored memory.
33x#    Turn on DTMF Tone for X, X = 0-9, * or #
34#     DTMF Tone(s) off
35#     Display RSSI ("D" Series portable only)
35x#    Set Audio path to xx = 0, VSP mike
        (mobile only)x = 1, speaker
        x = 2, Alert
        x = 3, Handset
38#     Display ESN in Hex, 2 char at a time use * to step
        (Compandor OFF (D series portable only))
39#     Compandor on (D series portableonly)
41#     Enables Diversity (on f19cta series only)
42#     Disables Diversity)
43#     Disable Diversity
44#     Disable Diversity
45#     Display current rssi
46#     Display cumulative call timer
47x#    Set Rx audio level, 0-7 i.e. 474# is mid level
48#     Set side tone on
49#     Side Tone off
53#     Enable Scrambler option when equiped
54#     Disable scrambler
55#     Programming customer/system information
        Enter 55#, display shows U5 '
        Enter 55# again, proceed as if you've
        followed the sheet included with the phone.
        This allows one to change the phone params
        an infinite number of times.
        However, some of the info is not in sequence
        with the sheet provided with the phone.
58#     Compandor on
59#     Compandor off)
61#     Serial number transfer (for dmt / minitac only)
        (See Esn transfer procedure elsewhere)
62#     Turn on ringer audio path
63#     Turn off ringer audio path
70#     Abbreviated field transmitter audio deviation command
71#     Abbreviated field power adjustment command
72#     Field audio phasing commands
73#     Field power adjustment command (dmt/minitac only)
 
Fabrication of jumper in lieu of test jig:
 
8000H and Ultra Classic 
To enter diag/self test mode:
 
1.Remove battery.
2.Looking at rear of radio, ground pin x
3.Re install battery and apply power
 
 
Rear Connector:
 
I  I  I  **  I  I  X
I  I  I  **  I  I  I
         **
 
* Is the antenna. I is the pins. Note: the case screws are NOT
at ground. The outer silver part of the antenna connector is.
 
I soldered a piece of stiff resistor lead at the X, and made it just
the proper length. I can then move it to touch the ground to read sig
strength, and then move it to touch nothing for normal operations.
 
Note that soldering to these pads is tricky, and probably voids the
warranty. A more elegant way would be to use a DC adaptor (Ora and
Celldyne sell them) and drill two small holes to use to connect with
an external jumper. No soldering. Note that the phone is not in power
save mode when in self test/diag mode and the battery will go down
quickly!
 
The inital display is channel and receive sig strength indicator,
useful for determing how close you are to a tower, or for aiming a
yagi in the desired direction.

Mark Earle   mwearle@mcimail.com

[TELECOM Digest Editor's Note: Your documentation above is remarkably
similar to the way Motorola has programmed their phones for the past
several years. Your documentation would work easily on many old phones
 from Motorola I suspect. My old 600 channel Motorola phone also went
into 'local' or 'test/programming mode' with the same grounding of a
pin as you describe it above, enabling one to reset the counter which
supposedly restricted programming the phone number to three times.
Since my Motorola had a 25-pin thing on it which connected to the
battery pack, the way I handled the grounding of the pin was to get a
25-pin connector from Radio Shack. I opened it up, shorted the desired
lead in there to another lead coming from the pin on the back of the
phone known to be a floating ground. Then when I wanted to go into
local or test mode, I'd just slide the battery pack a little back out
of the way, insert the little connector in there which had the changes
I had made, then slide the battery forward again reconnecting it all.
Quite simple and quick; snap in, reprogram quickly, snap out and restart
the phone. Of course I caution anyone doing re-programming of this
sort to have made prior arrangements with all involved carriers.  PAT]

