A CELLULAR TUTORIAL Copyright (C) 1994 by Network Wizards This document may be printed for reading by the user of this kit, or copied to other media for backup purposes. It may not be reproduced or retransmitted in any other form for any other purpose. February 10, 1994 OVERVIEW The cellular telephone system is made up of land stations (base stations) and mobile stations (cellular telephones). Each land station provides service coverage to a small geographic area and is called a cell. Clusters of land stations are interconnected to provide continuous coverage as the mobile moves from cell to cell. Land stations are connected to a central computer system that controls the cellular network in a particular area. The cellular network connects to the public telephone network to provide incoming and outgoing call access. SERVICE PROVIDERS A group of land stations in a particular area are controlled by a single cellular service provider. Each geographic area is allowed to have two service providers, licensed by the FCC, and known as the Wireline or Non-Wireline carriers. They are also referred to by which system or set of frequencies they operate on, named the A (non-wireline) and B (wireline) systems. Each service provider's area is assigned a unique 15-bit system id (SID). The SID is odd for A systems and even for B systems. The two highest order bits of the SID are defined as a country code as follows: Bit 14 Bit 13 Country 0 0 United States 0 1 Others 1 0 Canada 1 1 Mexico CELLULAR CHANNELS Each cellular system uses an assigned frequency range. Mobile units communicate with base stations using a pair of frequencies, know as the channel number. Mobile units transmit on a frequency that is 45mhz lower than the frequency base stations transmit on. Mobiles transmit in the 824-849mhz range, and base stations transmit in the 869-894mhz range. So, for example, channel 1 is assigned frequency pair 825.030/870.030mhz. The mobile transmits on 825.030mhz, and the base station receives on this freqency. The base transmits on 870.030mhz and the mobile receives on it. Each cellular system is assigned 416 channels, for a total of 832 cellular channels. Within each system, 21 channels are used as control channels, leaving 395 channels for actual telephone calls. Each cell site will normally have at least one control channel, and some number of voice channels. Neighboring cell sites use different channels to avoid interference. Cell sites are connected to a central control center for the cellular system, known as the Mobile Telephone Switching Office (MTSO), usually over leased land lines or microwave circuits. The A system is assigned channels 1-333, 667-716, and 991-1023. The B system is assigned channels 334-666 and 717-799. System A control channels are 313-333, and system B control channels are 334-354. Its a mess because the cellular system originally covered only 666 channels, and 166 were added on later, both before and after the original frequency allocation block. Channel numbers can be converted to frequency with the following: Transmitter Channel Frequency Mobile 1-799 825.000+0.03*C 990-1023 825.000+0.03*(C-1023) Land 1-799 870.000+0.03*C 990-1023 870.000+0.03*(C-1023) CELLULAR CONTROL The MTSO controls operation of the cellular system, sends orders to mobile units and receives requests from them. Control channels are used for sending and receiving orders. The control channel is usually busy transmitting pages (or incoming call requests) to mobile units. The land station also transmits overhead information, such as the system id and global parameter and action requests. When a mobile unit is turned on, it scans the assigned control channels of the appropriate system (A/B) and locks onto the strongest channel. It then waits until it sees itself being paged, or until the user requests to make an outgoing call. If the phone sees itself being paged, it sends back a message indicating it can receive a call. The land station then assigns a channel and sends back a message telling the phone to tune to that channel. The land station then tells the phone to starts ringing. When the user presses SEND to answer the call, it sends a message back to the control channel saying it will accept the call, and voice communication then begins. If the user wants to make an outgoing call, the number to dial is sent on the control channel when the user presses SEND. The MTSO then assigns an empty voice channel in the current cell for the call, and sends back a message on the control channel telling the mobile what channel number was assigned to it. The mobile then tunes to that channel and the call begins. If the mobile begins moving out of the current cell, the MTSO will notice its signal strength getting weaker. It will check neighboring cells to see if the signal is getting stronger in another cell. If so, the MTSO will command the mobile to hand-off to a channel in the new cell. It does this by sending a new channel number over the voice channel. The mobile acknowledges the command and both the mobile and MTSO switch over to the new channel. This process continues until the call is completed. MOBILE IDENTIFICATION Each mobile unit is uniquely identified by its Electronic Serial Number (ESN). In addition, each mobile may have any number of telephone numbers assigned to it, known as Number Assignment Modules (NAMs). Each NAM contains a telephone number, system id, group id mark, access overload class, and initial paging channel information. The telephone number is a standard 10-digit number made up of area code, prefix, and number. The system id identifies which cellular system provider issued the telephone number. When telephone calls are initially set up, the ESN and NAM are sent from the mobile unit to the base station for verification. The ESN is a 32-bit number: the first 8 bits identify the telephone manufacturer, and the remaning bytes indicate a serial number. The NAM telephone number is represented as a Mobile Identification Number (MIN) in 34 bits, divided into MIN1 and MIN2 pieces. MIN2 is 10-bits and represents the encoded area code, and MIN1 is 24-bits and represents the encoded prefix and number. ESN First Byte (hex) Manufacturer 81 OKI Telecom 82 Motorola 85 Fujitsu 86 Mitsubishi 87 NEC 88 Panasonic 8A Audiovox-Audiotel 8D Goldstar 8E Novatel 8F Ericsson 94 Blaupunkt 96 Alpine 9A Sony Corp. 9C Mobira 9D Ericsson GE 9F Qualcomm, Inc. A2 Technophone A5 Nokia/Tandy/Mobira AC Uniden MOBILE STATIONS Mobile stations are classified into three categories depending on their maximum effective radiated power (ERP). They are: Class I 6 dBW (4.0 Watts) Class II 2 dBW (1.6 Watts) Class III -2 dBW (0.6 Watts) Mobile stations can be commanded by a base station to reduce their power output from the maximum in seven steps, depending on the Class of the mobile unit. The power levels are: Mobile Attenuation Code ERP (dBW) for Class (MAC) I II III 0 6 2 2 1 2 2 -2 2 -2 -2 -2 3 -6 -6 -6 4 -10 -10 -10 5 -14 -14 -14 6 -18 -18 -18 7 -22 -22 -22 A field known as the Station Class Mark (SCM) is sent from the mobile to the base to identify the type of mobile unit. This four bit field is divided into three parts: Power Class Transmission Bandwidth Class I xx00 Continuous x0xx 20 MHz 0xxxx Class II xx01 Discontinuous x1xx 25 MHz 1xxxx Class III xx10 Reserved xx11 The bandwidth bit is normally set. Older cellular phones that were built before the freqency range was expanded from 666 to 832 channels have this bit cleared. Each mobile station is programmed with a 4-bit field called the Access Overload Class. If the cellular system gets overloaded, it can command particular mobile stations to not attempt to access the system. It does this by transmitting a 16-bit bit-mapped field indicating which Classes should not attempt access. Normally this field is set to the last digit of your telephone number (0-9). Class 10 is recommended for test mobile units, and class 11 for emergency units. Classes 12-15 are reserved. SUPERVISORY AUDIO TONE (SAT) The supervisory audio tone is one of three frequencies listed below. The SAT is added to the voice transmission by a land station. A mobile station detects, filters, and modulates the transmitted voice channel carrier with this tone. The tone is used to detect interference between neighboring channels. The SAT is not transmitted when sending wideband data. SAT Code Frequency 0 5970hz 1 6000hz 2 6030hz SIGNALLING TONE The signalling tone is a 10khz tone. It is sent by the mobile station on a voice channel to confirm orders, signal flash requests, and signal release requests. WIDEBAND DATA MESSAGES Land and mobile stations can communicate control information over both control and voice channels. If the land station is transmitting, it is called the Forward channel, and if the mobile is transmitting, it is called the Reverse channel. There are four possibilities, known as the Forward Control Channel (FCC), Forward Voice Channel (FVC), Reverse Control Channel (RCC), and Reverse Voice Channel. Data is sent at a 10khz rate, repeated multiple times, and encoded with error checking and correcting information. ORDERS A land station can send the following orders to a mobile station. These are sent in a wideband data stream on either the control or voice channels. Alert Informs the user that a call is being received. Audit Determines if a mobile station is currently active. Change Power Orders the mobile to change RF output power level. Intercept Informs the user of error made in placing call. Maintenance Used for testing; similar to alert. Page Informs mobile of an incoming call request. Release Disconnects a call being established or already established. Registration Requests mobile to register its identity with the system. Reorder Informs the user that all facilities are in use. Send Called-Address Orders the mobile to send dialed-digit information. Stop Alert Informs mobile to stop alerting the user. THE CELLULAR STANDARD The cellular telephone standard is documented as standard EIA/TIA-553, September 1989, "Mobile Station - Land Station Compatibility Specification". It documents the complete protocol and messaging formats used by the cellular system. It is published by: Electronic Industries Association; 2001 Pennsylvania Ave, N.W.; Washington, DC 20006. It can also be ordered from many standards distributors. One such place located in the San Francisco Bay Area is Document Center (Belmont, CA) at (415) 591-7600. OTHER BOOKS The Cellular Travel Guide contains information about cellular phone service in the US and Canada. It contains coverage maps, information on roaming, airtime charges, access numbers, and more. Its currently available for $19.90 from Communications Publishing Service at (800) 366-6731. They also sell other cellular related books. INSIDE THE OKI-900 The "Technical Instruction Manual for OKI Phones 900 Handheld Cellular Telephone (Model UM9022)", part# 01-20001, can be ordered from OKI Telecom, at (800) 554-3112. It contains maintenance and tuning procedures, schematics, and detailed operating instructions. The OKI-900 contains two printed-circuit boards: one is a radio board, and the other the digital control board. The 900 uses two microcontrollers, one to control the cellular telephone operation, and another to control the LCD display and keypad. The two processors communicate with each other over a three-wire serial link. The control processor can also communicate with external devices through the jack on the bottom of the phone. The display/keypad controller is an 80C154, with its control program in internal ROM. The main controller is an OKI variant of the 80C51. This 8051 has 256 bytes of internal RAM, an 8 channel A/D converter, and 6 8-bit I/O ports (2 for address/data bus, 1 for A/D, 3 for general purpose I/O). The 8051 uses an external ROM (64K 27C512) for program storage. It uses an external EEPROM (8K 28C64) for storing memories and configuration parameters. The program ROM is mapped into the 8051's program address space. The EEPROM is mapped into the 8051's memory address space, along with some other devices. These include an 81C55 port expander, which gives the processor 256 more bytes of RAM, and 3 more 8-bit I/O ports. A DTMF decoder chip is connected to one of these ports, and the rest control or monitor various parts of them phone. INSIDE THE OKI-1150 There is also a technical manual for the OKI-1150 available from OKI. It contains the same type of information as the OKI-900 manual. The OKI-1150 is built on a single printed-circuit board. It uses a proprietary OKI processor that is not compatible with any other processors (although kind of similar to an 8051). It uses an 80C154 processor for controlling the display and keypad. The main processor (an MSM65x227) contains many I/O lines, a built-in A/D converter, and 4K bytes of internal EEPROM which are used for storing memories and configuration data. An external ROM holds the program code.