TAP YIPL/TAP_and_YIPL_Collection_CD.iso/PHREAK/CELLULAR/CTEK.ZIP/TUTORIAL.DOC

Text File | 1994-05-13 | 13.6 KB | 316 lines

                A CELLULAR TUTORIAL

           Copyright (C) 1994 by Network Wizards

     This document may be printed for reading by the user of this kit,
     or copied to other media for backup purposes.  It may not be
     reproduced or retransmitted in any other form for any other purpose.

                  February 10, 1994


OVERVIEW

The cellular telephone system is made up of land stations (base stations)
and mobile stations (cellular telephones).  Each land station provides
service coverage to a small geographic area and is called a cell.  Clusters
of land stations are interconnected to provide continuous coverage as the
mobile moves from cell to cell.  Land stations are connected to a central
computer system that controls the cellular network in a particular area.
The cellular network connects to the public telephone network to provide
incoming and outgoing call access.


SERVICE PROVIDERS

A group of land stations in a particular area are controlled by a single
cellular service provider.  Each geographic area is allowed to have two
service providers, licensed by the FCC, and known as the Wireline or
Non-Wireline carriers.  They are also referred to by which system or set of
frequencies they operate on, named the A (non-wireline) and B (wireline)
systems.

Each service provider's area is assigned a unique 15-bit system id (SID).
The SID is odd for A systems and even for B systems.  The two highest order
bits of the SID are defined as a country code as follows:

    Bit 14    Bit 13      Country
      0        0        United States
      0        1        Others
      1        0        Canada
      1        1        Mexico


CELLULAR CHANNELS

Each cellular system uses an assigned frequency range.  Mobile units
communicate with base stations using a pair of frequencies, know as the
channel number.  Mobile units transmit on a frequency that is 45mhz lower
than the frequency base stations transmit on.  Mobiles transmit in the
824-849mhz range, and base stations transmit in the 869-894mhz range.  So,
for example, channel 1 is assigned frequency pair 825.030/870.030mhz.  The
mobile transmits on 825.030mhz, and the base station receives on this
freqency.  The base transmits on 870.030mhz and the mobile receives on it.

Each cellular system is assigned 416 channels, for a total of 832 cellular
channels.  Within each system, 21 channels are used as control channels,
leaving 395 channels for actual telephone calls.  Each cell site will
normally have at least one control channel, and some number of voice
channels.  Neighboring cell sites use different channels to avoid
interference.  Cell sites are connected to a central control center for the
cellular system, known as the Mobile Telephone Switching Office (MTSO),
usually over leased land lines or microwave circuits.

The A system is assigned channels 1-333, 667-716, and 991-1023.  The B
system is assigned channels 334-666 and 717-799.  System A control channels
are 313-333, and system B control channels are 334-354.  Its a mess because
the cellular system originally covered only 666 channels, and 166 were
added on later, both before and after the original frequency allocation
block.  Channel numbers can be converted to frequency with the following:

    Transmitter    Channel        Frequency
       Mobile    1-799        825.000+0.03*C
            990-1023    825.000+0.03*(C-1023)
       Land        1-799        870.000+0.03*C
            990-1023    870.000+0.03*(C-1023)


CELLULAR CONTROL

The MTSO controls operation of the cellular system, sends orders to mobile
units and receives requests from them.  Control channels are used for
sending and receiving orders.  The control channel is usually busy
transmitting pages (or incoming call requests) to mobile units.  The land
station also transmits overhead information, such as the system id and
global parameter and action requests.

When a mobile unit is turned on, it scans the assigned control channels of
the appropriate system (A/B) and locks onto the strongest channel.  It
then waits until it sees itself being paged, or until the user requests to
make an outgoing call.

If the phone sees itself being paged, it sends back a message indicating
it can receive a call.  The land station then assigns a channel and sends
back a message telling the phone to tune to that channel.  The land
station then tells the phone to starts ringing.  When the user presses
SEND to answer the call, it sends a message back to the control channel
saying it will accept the call, and voice communication then begins.

If the user wants to make an outgoing call, the number to dial is sent on
the control channel when the user presses SEND.  The MTSO then assigns an
empty voice channel in the current cell for the call, and sends back a
message on the control channel telling the mobile what channel number was
assigned to it.  The mobile then tunes to that channel and the call begins.

If the mobile begins moving out of the current cell, the MTSO will notice
its signal strength getting weaker.  It will check neighboring cells to
see if the signal is getting stronger in another cell.  If so, the MTSO
will command the mobile to hand-off to a channel in the new cell.  It does
this by sending a new channel number over the voice channel.  The mobile
acknowledges the command and both the mobile and MTSO switch over to the
new channel.  This process continues until the call is completed.


MOBILE IDENTIFICATION

Each mobile unit is uniquely identified by its Electronic Serial Number
(ESN).  In addition, each mobile may have any number of telephone numbers
assigned to it, known as Number Assignment Modules (NAMs).  Each NAM
contains a telephone number, system id, group id mark, access overload
class, and initial paging channel information.  The telephone number is a
standard 10-digit number made up of area code, prefix, and number.  The
system id identifies which cellular system provider issued the telephone
number.  When telephone calls are initially set up, the ESN and NAM
are sent from the mobile unit to the base station for verification.

The ESN is a 32-bit number:  the first 8 bits identify the telephone
manufacturer, and the remaning bytes indicate a serial number.  The NAM
telephone number is represented as a Mobile Identification Number (MIN) in
34 bits, divided into MIN1 and MIN2 pieces.  MIN2 is 10-bits and represents
the encoded area code, and MIN1 is 24-bits and represents the encoded
prefix and number.

   ESN First Byte (hex)             Manufacturer
    81                OKI Telecom
    82                Motorola
    85                Fujitsu
    86                Mitsubishi
    87                NEC
    88                Panasonic
    8A                Audiovox-Audiotel
    8D                Goldstar
    8E                Novatel
    8F                Ericsson
    94                Blaupunkt
    96                Alpine
    9A                Sony Corp.
    9C                Mobira
    9D                Ericsson GE
    9F                Qualcomm, Inc.
    A2                Technophone
    A5                Nokia/Tandy/Mobira
    AC                Uniden


MOBILE STATIONS

Mobile stations are classified into three categories depending on their
maximum effective radiated power (ERP).  They are:

    Class I        6 dBW (4.0 Watts)
    Class II    2 dBW (1.6 Watts)
    Class III      -2 dBW (0.6 Watts)

Mobile stations can be commanded by a base station to reduce their power
output from the maximum in seven steps, depending on the Class of the
mobile unit.  The power levels are:

     Mobile Attenuation Code        ERP (dBW) for Class
            (MAC)              I     II    III
          0                  6      2      2
          1                  2      2     -2
          2                 -2      -2     -2
          3                 -6     -6     -6
          4                -10    -10    -10
          5                -14    -14    -14
          6                -18    -18    -18
          7                -22    -22    -22

A field known as the Station Class Mark (SCM) is sent from the mobile
to the base to identify the type of mobile unit.  This four bit field
is divided into three parts:

     Power Class        Transmission          Bandwidth
       Class I       xx00          Continuous     x0xx    20 MHz    0xxxx
       Class II    xx01          Discontinuous  x1xx    25 MHz    1xxxx
       Class III   xx10
       Reserved    xx11

The bandwidth bit is normally set.  Older cellular phones that were built
before the freqency range was expanded from 666 to 832 channels have this
bit cleared.

Each mobile station is programmed with a 4-bit field called the Access
Overload Class.  If the cellular system gets overloaded, it can command
particular mobile stations to not attempt to access the system.  It does
this by transmitting a 16-bit bit-mapped field indicating which Classes
should not attempt access.  Normally this field is set to the last digit
of your telephone number (0-9).  Class 10 is recommended for test mobile
units, and class 11 for emergency units.  Classes 12-15 are reserved.


SUPERVISORY AUDIO TONE (SAT)

The supervisory audio tone is one of three frequencies listed below.  The
SAT is added to the voice transmission by a land station.  A mobile station
detects, filters, and modulates the transmitted voice channel carrier with
this tone.  The tone is used to detect interference between neighboring
channels.  The SAT is not transmitted when sending wideband data.

    SAT Code       Frequency
       0        5970hz
       1        6000hz
       2        6030hz


SIGNALLING TONE

The signalling tone is a 10khz tone.  It is sent by the mobile station
on a voice channel to confirm orders, signal flash requests, and signal
release requests.


WIDEBAND DATA MESSAGES

Land and mobile stations can communicate control information over both
control and voice channels.  If the land station is transmitting, it is
called the Forward channel, and if the mobile is transmitting, it is called
the Reverse channel.  There are four possibilities, known as the Forward
Control Channel (FCC), Forward Voice Channel (FVC), Reverse Control Channel
(RCC), and Reverse Voice Channel.  Data is sent at a 10khz rate, repeated
multiple times, and encoded with error checking and correcting information.


ORDERS

A land station can send the following orders to a mobile station.  These
are sent in a wideband data stream on either the control or voice channels.

Alert        Informs the user that a call is being received.
Audit        Determines if a mobile station is currently active.
Change Power    Orders the mobile to change RF output power level.
Intercept    Informs the user of error made in placing call.
Maintenance    Used for testing; similar to alert.
Page        Informs mobile of an incoming call request.
Release        Disconnects a call being established or already established.
Registration    Requests mobile to register its identity with the system.
Reorder        Informs the user that all facilities are in use.
Send Called-Address    Orders the mobile to send dialed-digit information.
Stop Alert    Informs mobile to stop alerting the user.


THE CELLULAR STANDARD

The cellular telephone standard is documented as standard EIA/TIA-553,
September 1989, "Mobile Station - Land Station Compatibility
Specification".  It documents the complete protocol and messaging formats
used by the cellular system.  It is published by:  Electronic Industries
Association;  2001 Pennsylvania Ave, N.W.;  Washington, DC 20006.  It can
also be ordered from many standards distributors.  One such place located
in the San Francisco Bay Area is Document Center (Belmont, CA) at (415)
591-7600.


OTHER BOOKS

The Cellular Travel Guide contains information about cellular phone
service in the US and Canada.  It contains coverage maps, information
on roaming, airtime charges, access numbers, and more.  Its currently
available for $19.90 from Communications Publishing Service at
[phone].  They also sell other cellular related books.


INSIDE THE OKI-900

The "Technical Instruction Manual for OKI Phones 900 Handheld Cellular
Telephone (Model UM9022)", part# 01-20001, can be ordered from OKI Telecom,
at [phone].  It contains maintenance and tuning procedures,
schematics, and detailed operating instructions.

The OKI-900 contains two printed-circuit boards: one is a radio board, and
the other the digital control board.  The 900 uses two microcontrollers,
one to control the cellular telephone operation, and another to control the
LCD display and keypad.  The two processors communicate with each other
over a three-wire serial link.  The control processor can also communicate
with external devices through the jack on the bottom of the phone.

The display/keypad controller is an 80C154, with its control program in
internal ROM.  The main controller is an OKI variant of the 80C51.  This
8051 has 256 bytes of internal RAM, an 8 channel A/D converter, and 6 8-bit
I/O ports (2 for address/data bus, 1 for A/D, 3 for general purpose I/O).
The 8051 uses an external ROM (64K 27C512) for program storage.  It uses an
external EEPROM (8K 28C64) for storing memories and configuration
parameters.

The program ROM is mapped into the 8051's program address space.  The
EEPROM is mapped into the 8051's memory address space, along with some
other devices.  These include an 81C55 port expander, which gives the
processor 256 more bytes of RAM, and 3 more 8-bit I/O ports.  A DTMF
decoder chip is connected to one of these ports, and the rest control or
monitor various parts of them phone.


INSIDE THE OKI-1150

There is also a technical manual for the OKI-1150 available from OKI.
It contains the same type of information as the OKI-900 manual.  The
OKI-1150 is built on a single printed-circuit board.  It uses a
proprietary OKI processor that is not compatible with any other
processors (although kind of similar to an 8051).  It uses an 80C154
processor for controlling the display and keypad.

The main processor (an MSM65x227) contains many I/O lines, a built-in
A/D converter, and 4K bytes of internal EEPROM which are used for
storing memories and configuration data.  An external ROM holds the
program code.