Siemens C35 series User manual

V1.0
Local Service Organization Service Manual
C
C
C3
3
35
5
5
S S
Se
e
er
r
riiie
e
es
s
s
6,(0(16 &20081,&$7,216 81/,0,7('

V1.0 i
Table of Content
CHAPTER 1
Cellular Communication
Coverage Concept 1
GSM Network Architecture 2
Subscriber Identity Module 3
SIM Application Toolkit 4
Extended GSM 900 - EGSM 5
Built-in Modem 5
Data Application 6
CHAPTER 2
Level 2 Service Guide
Introduction 7
C35 Series Technical Information 8
Accessories 10
General Information 11
C35 Series Exploded Diagram 13
Mechanical Concept 14
Hardware Concept – Block diagram 15
Hardware Description 16
Power Supply Concept 18
Over voltage Condition 18
Battery 19
Short Circuit Protection 19
Charging 19
Deep Discharge Battery 20
C35 Spare Parts Level 2 21
Disassemble the C35 22
Disassemble/Assemble Lower Housing 24
Disassemble/Assemble Control Board Assy 25
Disassemble/Assemble Upper Housing 27
Assemble the C35 28
Mobile Software Programming 30
Language Groups 32
Customer Specific Initialization 34
International Mobile Equipment Identity 34
Phone Unblocking 35
CHAPTER 3
Siemens Service Equipment
Introduction 37
Other equipment 39
Software Installation 40
Configuring the test software 41
Running the test sequence 42
ANNEX A 46
ANNEX B 49
CHAPTER 4
Level 2.5 Repair Document
Introduction 50
Antenna Connector 51
Ringer 55
Bottom Connector (Lumberg) 58
Display Connector 62
Keyboard LED 66
Display LED 69
Infrared Diodes 73
ANNEX C
PC Adapter Cable & Accessories C35 76
Power Plug for C35 77
Car installation Ratio Unit, C35 78
Car Installation kit Handfree kit 79
Car Installation kit Handfree Pro. 80
Car Installation Comfort GPS, C35 81
References 83

V1.0 1
Cellular Communication
Coverage Concept
.
he cellular systems is made up of numerous transmitting and
receiving sites, whose individual coverage areas partially overlap. The
concept of frequency re-use, same frequency is used by several sites,
allows a high traffic density in a wide area. Due to the limited
transmission range of the terminals, cellular systems are based on a large
number of base stations on the infrastructure side, scattered over the area to
cover, with each covering a fairly small geographical zone called cell. Cells are
often represented by hexagons (see figure 1.1.).
FIGURE 1.1 CELLULAR COVERAGE REPRESENTATION.
C
hapter
1
T

V1.0 2
GSMNetworkArchitecture.
GSM network can be broadly divided into three broad parts, namely:
1. Mobile Station(MS) carried by the subscriber,
2. Base Station Sub-system(BSS) which controls the radio link with the mobile station.
3. Mobile Switching Center(MSC) which performs the switching of calls between the mobile
users, and between mobile and fixed network users.
FIGURE 1.2 GSM ARCHITECTURE
Each mobile station is given a unique identity. As soon as the mobile phone is turned on, it
registers with the network and is authenticated, as such the network could always find the
mobile phone.
Larger amount of data is being exchanged to and from the following functional blocks in the
MSC:
Visitor Location Register, VLR
Stores information about mobile subscribers that enter it coverage area which is associated with
the geographical area where the mobile is currently roaming. When there is an incoming call for
the mobile, the HLR is interrogated about the present address of the VLR.
Home Location Register, HLR
A database that contains all data concerning the subscription of the mobile subscriber, i.e. their
access capabilities, subscribed services, and supplementary services. It also contains
information about the VLR that is handling the mobile station currently. When the mobile
changes location, the HLR is updated accordingly. It also provides the MSC with information
about the MSC area where the mobile is actually located to allow incoming calls to be routed
immediately to the called party.

V1.0 3
Authentication Center, AUC
Stored information that is necessary to protect communication through the air interface against
any intrusions. The legitimacy of the subscriber is established through authentication and
ciphering, which protects the user information against unwanted disclosure.
Equipment Identity Register, EIR
An option the network operator can use to enforce security. With this feature the network can
identify defective or stolen mobile that may not be used in the network.
Subscriber IdentityModule(SIM)
SIM is a smart card which has a computer and memory chip that is permanently installed in the
mobile equipment. It comes in either the size of a credit card or smaller version known as the
plug-in SIM.
The subscriber information, which includes a unique number called the International Mobile
Subscriber Identity (IMSI) is stored in the SIM card. SIM card identifies the subscriber to the
network.
FIGURE 1.3 INSERT SIM CARD
Figure 1.3 illustrates the steps for inserting the SIM card into the C35 series.
1

V1.0 4
To protect the SIMcard from improper use, a security feature, a four digits personal identification
number (PIN), is built in. The PIN is stored in the card and can be changed by the subscriber.
PIN2 is required for additional funtions available with a special SIM card (Consult the operator for
more information about the PIN.
A code (PUK) is provided for unlocking the SIMcard if the SIM card is blocked
ChangePINProcedures.
CHART 1.1 PIN CONTROL
SIMApplicationToolkit
SIM Applications Toolkit (SAT) allows the flexibility to update the SIM, to change the services
and download new services over the air. In the SAT specification, the short message service is a
Β
MENU
SETUP
SECURITY
CODES
CHANGE PIN CHANGE PIN2
{ENTER PIN NUMBER}
CHANGE
{ENTER NEW PIN} AND PRESS OK KEY.
{ENTER NEW PIN) AND PRESS OK KEY.

V1.0 5
key mechanism for personalizing the SIM in each user’s GSM phone. It is designed as a client-
server application. C35 series supports SAT Class 3 specification.
When active, the name of the service may appear in the menu, and there will be sub-menu if
more than one application is active. Figure 1.6 is the SAT icon.
FIGURE 1.4 SAT ICON
ExtendedGSM900, E-GSM
This is a new standard that allows Network Operators to increase their capacity through an
extended frequency. The frequency range of E-GSM is as follows:
•Mobile Transmit: 880 – 915 MHz
•Mobile Receive: 925 – 960 MHz
C35 series is a GSM Phase 2 / Phase 2+ Dualband E-GSM / GSM 1800 mobile phone.
Built-inModem.
C35i has an integrated modem for direct data communication using the data cable as shown in
Figure 1.5. C35 do not have the built-in soft modem for Data Service of GSM network.
FIGURE 1.5 DATA CABLE.

V1.0 6
DataApplicationSupport
Modem driver conforms to V.25 command set, and transmission speed conforms ITU-T-
standard of V.22bis. (2400, 4800,and 9600 bits/sec).
Facsimile conforms to Service Class 1, group 3 and operate at 2400, 4800, 7200 and 9600 bit/s.
Data services via GSMnetwork up to 9600 bps, and remote control using cellular AT commands
for C35i only.
Internet access via the C35i is possible with the inclusion of Wireless Application Protocol (WAP)
browser 1.1 .

V1.0 7
Level2 Service Guide
Introduction
The chapter is intended to help you carry out repair up to Level 2 on the C35 series mobile
phone.
The repair for international version and Asian variants are identical unless otherwise noted,
therefore the description herein is confined to C35 only.
All repairs have to be carried out in an environment set up
according to ESD regulations defined in international standards.
ESD procedure is available from your Service Manager. Ask for
ASC/T001/98
C
hapter
2


V1.0 8
C35 & C35iTechnicalInformation
System GSM Phase 2/Phase2+, Dual Band
EGSM 900, Class 4(2 Watt)
GSM 1800, Class 1(1 Watt)
Operating Voltage 3.6V
Size(LxWxH) 118 x 46 x 21 mm(without antenna)
Volume 88cm3including battery (approx)
Weight 116g including battery (approx)
Battery(Standard) NiMH, 500mAH(Standard)
Li-Ion, 600mAH(Optional)
Standby time150 to 180 hours (standard battery)
Talk time190 to 300 minutes (standard battery)
Charging Time Up to 1.5 hours with Rapid Charger
SIM support Plug in card 1.8 V or 3V
Antenna Non - retractable, λ/2, helical fixed.
Speech codec Triple rate
Enhance Full Rate
Full Rate
Half Rate
Display 101 x 54 pixel graphical display with up to 5 lines
12 x 12 font size for Chinese
Keypad 12 numeric keys(10 numeric, #, *)
4 function keys(Send, End-ON/OFF, Menu, Phonebook)
2 multifunctional softkeys
Key Sound Click/DTMF/None
Key Lock Activation and Deactivation by #-key or
Automatic.
1Actual time dependent on the network.

V1.0 9
Dialing 10 redial numbers,
Last 10 incoming with date/time stamp
Last 10 outgoing calls
Last 10 missed calls with date/time stamp
Ringer On/Beep/Off
Up to 22 melodies and 5 ringing volume settings
(Melody Composer, Crescendo Ringing)
Volume Adjustable in 4 levels during call via softkey
Silent Alert Built-in vibrator
Phone Book Storage depends on the SIM card capacity
Storage of up to 100 list in the phone (VIP)
SMS Support MT, MO, CB
Predictive Text Input, Tegic T9.
Supplementary Call Forwarding, Call Hold, Call Wait,
Services Multiparty Conference, CLIP, CLIR, AoCC
AoCI, FDN, LND USSD and SAT.
Ciphering A5/1 and A5/2 supported
PIN control PIN 1 & 2 Code Control
Phone code 4 to 8 digit code
Network function Automatic and manual network selection
Chipset Siemens E – GOLD
WAP Browser1Version 1.1
Other Features Clock / Alarm
Alarm List2
Built-in modem3
Calculator4
Currency Converter
4 Games
7 User Profiles
1Only for Model C35i.
2Not available in C35 International version.
3Not available in C35 International version.
4Not available in C35 International version.

V1.0 10
Accessories:
1. Standard Battery L36880-N4001-A100
2. Optional Battery L36880-N4001-A101
3. Standard Charger L36280-Z4-CXXX (Country Variant)
4. Travel Charger L36880-N4001-A103 (EU) / A104 (UK)
Similar to standard charger with an universal input voltage from 90 ~ 240V
4. Desk Top Charger L36880-N4001-A102
5. Belt Clip L36880-N4001-A113
6. Headset L36880-N4001-A123
7. Antenna Cradle L36880-N4001-A110
8. Car Charger Cable L36880-N4001-A108
9. Car Kit Portable1L36880-N3015-A117
10. Car Kit Comfort L36880-N4001-A111
11. Car Handset2L36880-N3015-A123
12. Designer Cases L36880-N4001-A119
13. Soft Data Link 3.0 L36880-N4001-A122 (Not for 3508i)
14. Data Cable3L36880-N3101-A102
15. Car Kit Professional Voice L36880-N4001-A124
16. Data Cable Professional4L36880-N3101-A112
1Same as C25(88)
2Same as C25(88)
3Same as C25(88)
4Same as C25(88)

V1.0 11
GeneralInformation
Due to different requirements of the markets, the C35 series has different variants, which
broadly classified under International version and Asian version. Marketing name for
international version is C35 or C35i, whereas Asian version is named 3508 or 3508i.
The 3508 series is equipped with a graphic display which enable the telephone to display
CHINESE characters, either in Traditional font or Simplified font, beside the standard English.
DifferencebetweenC35(08)andC35(08)i
C35(08)i mobile software has WAP Browser 1.1 incorporated thus enabling user to surf the
Internet and it have built-in soft modem for GSMData Service.
The differences between the C35 and C35i are the hardware and software. The memory size of
C35 is 16MB and that of C35I is 32MB.
There are also two variants for 3508, one without the WAP browser is 3508 and that with WAP
browser version 1.1 is 3508i. The different for ASIAN version is only mobile software.
WirelessApplicationProtocol,WAP.
Wireless Application Protocol takes a client-server approach that uses the in-built micro-browser
to make a request, in wireless markup language (WML), for information or service. The request
is passed to a WAP Gateway which then retrieves the information from a Internet server, in
HTML format, and translate it into WML. The requested information is then sent to from the
WAP Gateway to WAP client (mobile) using the available and most appropriate mobile network
bearer services.
WirelessProtocolStack.
Wireless Application Environment (WAE)
Wireless Session Protocol (WSP)
Wireless Transaction Protocol (WTP)
Wireless Transport Layer Security (WTLS)
Wireless Datagram Protocol (WDP)
Bearers e.g. Data, SMS, USSD
TABLE 1..1 WAP PROTOCOL STACK
1. Wireless Application Environment
Defines the user interface on the phone. WAE contains the WML,WML script and the
wireless telephony application (WTA).

V1.0 12
2. Wirelss Session Protocol
Link the WAE to two session services – one connection oriented operating above the WTP
and a connectionless service operating above WDP.
3. Wireless Transaction Protocol
Runs on top of the datagram service and part of the standard suite of TCP/IP protocols, to
provide a simplified protocol suitable for low bandwidth mobile station.
4. Wireless Transport Layer Security
WTLS incorporates security features that are based upon the established Transport layer
Security (TLS) protocol standard, that include data integrity checks, privacy on the WAP
Gateway to client leg and authentication.
5. Wireless Datagram Protocol
Allows WAP to be bearer independent by adapting the transport layer of the under-laying
bearer. WDP presents a consistent data format to the higher layer on the WAP stack.

V1.0 13
C35SeriesMechanicalDiagram
FIGURE 2.1 C35 MECHANICAL DIAGRAM.
Please take note that the number(s) used here IS NOT the part
number, DO NOT used it in your spare parts purchase order.
Always refer to the SERVICE PART PRICE LIST
for your spare part order.
1

V1.0 14
MechanicalConcept
Note: All numbers refer to mechanical drawing in Figure 2.1.
The mechanical concept of the C35 differs in various points from the one of the other Siemens
mobile telephones.
The first thing you will experience is how the housing is locked. In C35 no screws are used to
keep the housing closed. Also inside the telephone no screws are used anymore. To open the
housing, which is kept closed by catches only, a special opening tool has been defined.
For
details on disassembly tool please refer to Photo 2.3 in this chapter
.
Inside, the C35 consists of just one board (1010) which carries display module(1170), control
part and RF section of the mobile.
The display module (1170) is connected to the board by a flexible cable which is inserted into a
plug. In case the display is defective electrically or mechanically it can be exchanged very easily.
C35 does have an external connector of a new type. Since S6 a so called “Molex”-connector
was used, which also offered the possibility to connect an external antenna to it. The new
“Lumberg”-connector which is used in C35 does not feature such a connection, because the
connector for external antenna is located at the back side of the upper end of the mobile, close
to the internal antenna (1130). As a consequence of this there is no need anymore for a RF
cable mounted to the board nor for a RF plug on it to connect this cable. This improves RF-
properties of the mobile and lowers production costs.
To be able to do measurements on and software update of the telephone, an adapter cable
between Molex and Lumberg connector will be available.
See photos in Additional Tools of
Chapter 3
.
C35 series antenna is of a snap-in type which inserted into the lower case shell (1030). The
antenna can only be changed by opening up the C35 phone.
The C35 is a dual-band mobile operating on GSM900 and
GSM1800, the antenna is an integral part of the lower housing.
The keypad (1150), the microphone (1110) and the loudspeaker (1120) are mounted into the
upper case shell (1020). Make sure that the microphone and the earphone contact springs are
not dirty or damaged during repair process.
The dust protection frame and the display window are included in the display module(1170).
1

V1.0 15
HardwareConcept– BlockDiagram
FIGURE2.2 C35 BLOCK DIAGRAM.

V1.0 16
Hardware Description
The handset consists of the following major integrated circuits:
1) E-GOLD – PMB2851E
This IC is a combination of microprocessor, signal processor and real-time clock.
The microprocessor part of this component is responsible for controlling the keyboard, SIM-
Card, Flash and RAM. Furthermore it controls the power saving, power up/power down of the
RF module and sets the amplification of the PA.
The signal processor part of PMB 2851E is responsible for processing the Rx I/Q signals
(filtering, equalizing, speech and channel decoding).
Furthermore it does the speech and channel encoding and the GSMK modulation of the Tx
I/Q signals. The Voice CODEC part is used to realize advanced features regarding coding of
the speech signal. These are:
•Halfrate-Encoding
•Halfrate-Decoding
•Enhanced Fullrate Encoding
•Enhanced Fullrate Decoding
•Voice Activity Detection
•Comfort Noise
2) GAIM – PMB2906
The GAIM (GAIM = GSM Analog Interfacing Module) provides the interface between the
analogue and its digital representation signals (Base-band I/Q, Voice-band, PA-control,
Voltage & Temperature Measurement - Charging control).
3) 13Mhz Ref Oscillator Circuit -
This circuit provides the following main functions:
•Generate 13Mhz clock signal for Logic Circuits – SIN13M.
•Generate 13Mhz reference signal for the PLL circuits for the Tx & Rx of GSM RF signal.
•Received the frequency steering control AFC_PNM from the HiGOLD IC for fine tuning
of the Tx & Rx frequency.
•Temperature dependent resistor sited near the 13MHz oscillator measure the
environment temperature.

V1.0 17
4)
Power Supply ASIC – D0767BA
This circuit provides the following main functions:
•Control of switch on of the Mobile phone by ON/OFF button, Ext Power (Charger) or real
time clock.
•Watchdog monitor – switch off the mobile phone if no proper Watchdog signal send from
HiGOLD IC.
•Voltage supply to the logic circuits – 2.90V, 2.65V & 1.92V, Simcard & real time clock in
HiGOLD IC.
•Switch on the linear regulator to supply the 2.8V for the13Mhz Oscillator circuit.
•RESET signal for the logic circuit.
•Charge control signal for switching the charge FET.
•Low battery detector.
•Over voltage protection.
5) Receiver Circuit – Bright II HD155124F
This circuit provides the following main functions:
•Low Noise Amplifier (LNA) with a fixed amplification of +20dB to amplify the input RF
signal.
•Mixer to mix down the RF signal to the Intermediate Frequency (IF)
•Programmable IF amplifier with a dynamic range of 60dB ( -10dB ~+50dB in steps of
2dB).
•Mixer to mix down the IF signal to the baseband, generating and inphase (I) and a
quadrature (Q) signal and feed the GAIM IC base-band signal, RX I/Q for the decoding
of the digital signal for the HiGOLD IC.
6) Transmitter Circuit – Bright II HD155124F
The GAIM IC generate the MOD I/Q base-band signal under the control of the HiGOLD IC
and feed the IQ modulator of the Bright II IC. The Bright II IC provides the IF synthesizer,
the I/Q modulator, prescaler to regulate the dual-band TX-VCO and feed the modulated GSM
signal to the PA.
The telephone support only 1.8V and 3V SIM card
For user with 5V SIM card, he need to upgrade the SIM card
through his service provider/network operator
1

V1.0 18
PowerSupplyConcept
The C35 has two main power inputs:
1. Battery voltage(3.6V) connected at the battery contact
2. Charging voltage(6.5V) delivered by the different charger type(see Accessory List) via the
Lumberg connector at the bottom of the telephone.
Since the battery voltage is supplying the power supply ASIC, it is always needed to operate the
phone. You cannot switch on the handset if the battery voltage is not present.
From the battery voltage, all other supply voltages are derived and controlled by the power
supply ASIC.
The RF power amplifier is directly connect to the battery, a bad battery with high internal
resistance can cause malfunction of the C35 phone.
The Logic module uses 1.92V, 2.65V & 2.9V generated by voltage regulators inside the ASIC.
Furthermore, the ASIC generates the supply voltage for the SIM card and the RESET signal for
the logic devices.
The ASIC also checks the presence of the watchdog signal from the microprocessor and
provides the switching on functionality (ON_OFF button or Ignition signal).
Wrong polarity or battery voltage setting that exceed the +6.5V
could damage the phone.
Over-voltageCondition
•Battery voltage
If the supply voltage rises above 6.2V, the phone will switch off and it cannot be switched on
again before the voltage is lower than 6.2V.
If the supply voltage rises above 7V, the phone can be damaged
•Charging Current
The charging current must not rise above 1A or a track fuse in the
phone will blow. As a result charging the battery will no longer by
possible.
1
1