[GA628] [GH688]

Ericsson GA628 info.

Index

Introduction
GA628 Pinout
Command set
TTL Interface
Formatting of SMS data
Hidden menus
Some pics
Links
[Goto TOP]

Introduction

I have been gathering information on the GA628 for over a year now. It once started as a project in which mortar supply bunkers were to be equipped with smart level indicators. These would send a warning message to the distribution centre when the mortar runs out. The idea was to use a GA628, a weight sensor and some electronics to this end. Unfortunately costs were too high, as phone companies didn't give enough rebate on volume contracts. But the idea was neat. Follows the information I collected, partly by investigating the phone myself, but also thanks to many contributions from the net. Thanks !

[Goto TOP]

Pinout of the GA628.

Bottom view, keyboard up, counting from the left:

01 Out Audio from Mobile Station
02 In Audio to Mobile Station
03 In External Analogue Audio Accessory Sense. Connect to GND to enable external mike and speaker
04 - Audio Signal Ground, 0V reference
05 In Portable Handsfree.
06 Out Music Mute (to mute eg. the car radio) High when calling.
07 In Flash Memory Voltage and Service Voltage. Phone enters debug mode when tied to +5V at power-up.
08 Out Logic Reference, Status On. Sources over 100mA.
09 Out Data from Mobile Station. Debug messages appear here at 112KBaud when in debug mode.
10 GND Digital Ground and DC return
11 In Data to Mobile Station
12 I/O DC positive for battery charging (in)/DC for external accessory powering (out)

All signals seem to be at 5V logic. Most debug messages are text. Like "CB ok!" etc. Debug messages are trailed by 0x0A, 0x0D. Power-up means removal of battery, reconnection of battery, depressure of "NO".

A portable hands free kit is connected as follows:
Portable Handsfree (directly connected to pins 01, 02, 04):
01 Earphone: 16 Ohm
02 Microphone: <= 2 kOhm
05 to be connected to 04 (GND)

[Goto TOP]

Command set

The following commands are recognised by the phone. This list is not complete. If you know the full commandset or if you have any comments, please mail me. Use 9600 baud, 1 stopbit, 8 data bits, no parity.

ATA     Pick up phone during ring
AT+GMI  Manufacturer identification
AT+GMO  Request model Identification
AT+GMR  Request revision Identification
AT+GMM
ATDxxx; Dial number xxx (note the semicolon (;))
ATH     Hang up phone
AT+CFUN=? Define levels of fuctionality in the order of power consumed
AT+CFUN=0 Switches off the phone
AT+CBC  Query battery level

Each command has to be followed by a 0x0A, 0x0D sequence, that is carriage return - line feed. These commands will be acknowledged with an 'OK' prompt. An incoming call is signalled by the string 'RING' sent by the phone at 9600b in normal mode.

[Goto TOP]

Interfacing circuitry

TTL signal levels are use on the data pins of the GA628. Probably the easiest way to generate TTL signals out of a serial port is by removing the RS232 level shifters (1488 1489 or alike) from the serial board inside your computer !

[Goto TOP]

SMS formatting

The following is applicable to at least the Ericsson GH377.

Written by Anthony, aberkow@syfrets.co.za

Well here's the skimpy info I have on sending SMS messages via the
phone's serial port:

SMS Commands
============

When sending/receiving SMS messages the text cannot exceed 160
characters though larger messages can be sent in blocks of 160 and
joined again by the receiving PC. The character set used is not quite
regular ASCII and is as follows (note characters are only 7-bit):

SMS Character Set
=================
				b7 	0 	0 	0 	0 	1 	1 	1 	1 
				b6 	0 	0 	1 	1 	0 	0 	1 	1 
				b5 	0 	1 	0 	1 	0 	1 	0 	1 
b4 	b3 	b2 	b1 	   	0 	1 	2 	3 	4 	5 	6 	7 
0 	0 	0 	0 	0 	SP 	D   	SP	0 	@ 	P 	¿ 	p 
0 	0 	0 	1 	1 	£ 	SP	! 	1 	A 	Q 	a 	q 
0 	0 	1 	0 	2 	$ 	F   	" 	2 	B 	R 	b 	r 
0 	0 	1 	1 	3 	¥ 	G   	# 	3 	C 	S 	c 	s 
0 	1 	0 	0 	4 	è 	L  	$   	4 	D 	T 	d 	t 
0 	1 	0 	1 	5 	é 	W	% 	5 	E 	U 	e 	u 
0 	1 	1 	0 	6 	ù 	P  	& 	6 	F 	V 	f 	v 
0 	1 	1 	1 	7 	ì 	Y   	' 	7 	G 	W 	g 	w 
1 	0 	0 	0 	8 	ò 	S 	( 	8 	H 	X 	h 	x 
1 	0 	0 	1 	9 	Ç 	Q   	) 	9 	I 	Y 	i 	y 
1 	0 	1 	0 	10	LF	X   	* 	: 	J 	Z 	j 	z 
1 	0 	1 	1 	11	Ø  	SP	+ 	; 	K 	Ä 	k 	ä 
1 	1 	0 	0 	12	ø 	Æ 	, 	< 	L 	Ö 	l 	ö 
1 	1 	0 	1 	13	CR	æ 	- 	= 	M 	Ñ 	m 	ñ 
1 	1 	1 	0 	14	Å 	ß 	. 	> 	N 	Ü 	n 	ü 
1 	1 	1 	1 	15	å 	É 	/ 	? 	O 	§	o 	à 

Notes:
SP	Space
LF	Line feed (in GSM this implies a carriage return/line feed
combination)
CR	Carriage return is forbidden by the TAP protocol and cannot be
included in the message text.

The ONLY SMS command I have been able to work out is the one to send an
SMS MO message from the PC to the cellphone (BS) but NOT actually
transmit it. Once in the phone's memory, this message can then be
optionally edited and subsequently sent at a later time (assuming one
has the GH388 or other model that supports SMS MO). However I suspect
the same command with different parameters may actually transmit the
message. The command must be sent using the correct protocol as per my
earlier posting. The command (with parameters) is:
  0x41 0x07  0x03 0x01 0x00 0x01 0x00 0x00 0x81 0x00 0x00 


The first 2 bytes are the command itself as usual, the next 9 bytes are
parameters that I expect can be somehow modified to give different
results.  is a byte containing the number of ASCII characters in
the TEXT of . The number of actual bytes in  in NOT
necessarily the same as  - since the message is compressed!
Each character of the message is only 7-bits and the 8th bit is stripped
out to save bandwidth such that the lsb of the 2nd character will be
sent as the msb (8th bit) of the first byte, etc.

As an example consider the message "test" with is 4 characters long so
 above = 4 (and bytes = 3.5 with compression).

The characters "test" in hex are:  0x74 0x65 0x73 0x74
So in binary this is:
01110100 01100101 01110011 01110100   (note 8th bit is zero for each
character)
---t---- ---e---- ---s---- ---t----
87654321 87654321 87654321 87654321

So strip out the 8th bit:
1110100 1100101 1110011 1110100
---t--- ---e--- ---s--- ---t---
7654321 7654321 7654321 7654321

and stuff it:
1 1110100 11 110010 100 11100 0000 1110
e ---t--- s- --e--- -t- --s-- ---- -t--
1 7654321 21 765432 321 76543 ---- 7654

To give:
11110100 11110010 10011100 00001110  (4 bits wasted in msb of 4th byte)
or in hex: 0xF4 0xF2 0x9C 0x0E

So the full command string is:

  0x02 0x10   0x41 0x07 0x03 0x01 0x00 0x01 0x00 0x00 0x81 0x00 0x00  
0x04   0xF4 0xF2 0x9C 0x0E

Perhaps you can get further than I did? It's really difficult to get any
info on this.

Anthony

[Goto TOP]

Hidden menus

        Go to MissedCall
        Empty the list
        Press the -> key for a second or two
        The option Menu size turns up
        Choose 'yes' and go from there.
        
        An alarm clock turned up too but it never rang. I think this was
        because there is no clock in the phone.

        By Michael Sexton 

And another:

        Try to type this in your Ericsson:
        >*<<*<*

        where < is the left arrow and > is the right one

        This should enter the hidden menu.

        By Gemini@4u.net

And the IMEI (Serial Number)

        *#06#

Reset language to English

        *#0000#

Switch off the phone, but continue call:

Press 40# 'NO' while the phone is diverting, 
press 'NO' again to switch off the phone.
Disconnect battery to hang up.

Mute the microphone:

Hold the CLR button (by danield@w3.org)

Add SIM lock:

        <**<

Note: I really don't know how to unlock your phone. I am in no way responsible 
for any damage to your equipment, or whatever misfortune that might arise from 
using any of this information on this page. I sympathize, though.

[Goto TOP]

Some pictures

Note the peculiar position of the eeprom. One would expect it near the uC, at the back of the PCB. And what about these extra button contacts ?

[GA628 PCB Frontside] [GA628 PCB Backside]

[Goto TOP]

Data on many ericsson models

[Next Page] [Goto Index]
[Contact Form]


This article was written by Arian van Dorsten jwasys@xs4all.nl
The most recent version can be found on: http://www.xs4all.nl/~jwasys