[comp.dcom.telecom] A Couple Tech Questions About Cellular Phones

cyamamot%aludra.usc.edu@usc.edu (Cliff Yamamoto) (07/20/90)

Greetings!

I've been reading this group lately and though I may be out of my
league with many of those who read here, I hope this is not a silly
question.

I recently got a cellular phone and have some questions.  This may be
a rumor, but I've heard that *all* cellular phones have the capability
to have their microphones/xmitters activated by the switching office?
Is this true?  Does that mean if I leave the power on, they can
actually "bug" the area my phone is left in?  Are there any other
"unusual" functions that can be performed on my phone w/o me knowing?

Secondly, I haven't had any dropped calls yet, but can anyone explain
the heuristic used for the following: say you are leaving a cell and
the cell you are approaching is completely tied up.  Will the cell you
are leaving boost your xmitter power and keep you on as long as
possible, or will it drop you?  I would hope it would keep you going
on a marginal transmission until you can gracefully kill your call or
until the tied up cell becomes freed.

I hope someone out there can enlighten me on these questions.  If
there is *A* reference book out there (like some sort of IEEE or ANSI
publication) about cellular phone, please let me know.


Thanks,

Cliff Yamamoto

john@bovine.ati.com (John Higdon) (07/21/90)

Doug Faunt N6TQS 415-688-8269 <faunt@cisco.com> writes:

> Do cellular nodes have emergency power?  If so, for how long?
> Obviously some are at CO's and will be up for a long time, but what
> about my neighborhood site?  Any "standard" answers?

All GTE Mobilnet cell sites have emergency power. The outfit that
installed their's installed mine.

Cliff Yamamoto <cyamamot%aludra.usc.edu@usc.edu> writes:

> This may be
> a rumor, but I've heard that *all* cellular phones have the capability
> to have their microphones/xmitters activated by the switching office?

Not true. When your unit is address by the system, a two way audio
path is indeed enabled, but your transmitter is not turned on until
you answer the call.

> Secondly, I haven't had any dropped calls yet, but can anyone explain
> the heuristic used for the following: say you are leaving a cell and
> the cell you are approaching is completely tied up.

If the target site is busy, the current site will hold on to you until
there is an opening or until the call drops due to lack of signal.


        John Higdon         |   P. O. Box 7648   |   +1 408 723 1395
    john@bovine.ati.com     | San Jose, CA 95150 |       M o o !

flak@mcgp1.uucp (Dan Flak) (07/22/90)

In article <9941@accuvax.nwu.edu> cyamamot%aludra.usc.edu@usc.edu
(Cliff Yamamoto) writes:

>Secondly, I haven't had any dropped calls yet, but can anyone explain
>the heuristic used for the following: say you are leaving a cell and
>the cell you are approaching is completely tied up.  Will the cell you
>are leaving boost your xmitter power and keep you on as long as
>possible, or will it drop you?  I would hope it would keep you going
>on a marginal transmission until you can gracefully kill your call or
>until the tied up cell becomes freed.

Several things can happen when you are moving away from a cell
site.

When your signal drops below a certain threshold, it is detected by
the switch servicing the cell to which you are speaking. The switch
sends out a signal to the neighboring cells asking them to "take a
look" at your signal. The one with the strongest signal wins, and the
switch arranges a hand off between the old cell site, and the new one.

Now, if the cell with the best read of your signal has all of its
channels in use, the switch will tell it that it can't take the call
because it's busy. (The mobile is a very dumb piece of equipment, but
it has to know how to make a call. The cell is dumber still. All of
its "thinking" is done at the switch). Some switches will have an
alternate list and redirect you to another servicable cell, even
though it doesn't have the best read of your signal. This may explain
why you may get "scratchy" service in an area where you normally get
good service. Your "normal" cell is busy, and you are handled by one
further away.

The last choice is to try to hang on to you as long as possible.

The threshold levels are (should be) set in accordance with some
common sense engineering. Cell sites on the fring areas of the
coverage will probably have the threshold set way down so that the
weakest signals are still attempted to be processed. Theory is that
the cell probably isn't that busy and can afford to keep calls for a
long time. The attempt is to get as much range as possible. On the
other hand, the "DOWNTOWN" cell site (every system has a "DOWNTOWN"
cell site :-) will probably have its threshold set so as to "force"
handoffs as soon as possible. On busy cells, its a good idea to get
rid of you as soon as somebody else can handle you.

Pittsburgh is a unique example of this. As you leave town to the
southwest, you enter a tunnel. You are most definately knocked off the
"DOWNTOWN" cell site as cellular signals have problems penetrating
rock. So, we've put a cell site in each of the tunnels. These sites
only have a couple of channels each, and they are intended to handle
the traffic in the tunnel only. The threshold on those puppies is set
very high, so that you are constantly causing the switch to ask for a
handoff, and such occurs as soon as you leave the tunnel.  


   Dan Flak - McCaw Cellular Communications Inc., 201 Elliot Ave W.,
Suite 105, Seattle, Wa 98119, 206-286-4355, (usenet: thebes!mcgp1!flak)

wb8foz@mthvax.cs.miami.edu (David Lesher) (07/25/90)

In <10025@accuvax.nwu.edu> flak@mcgp1.uucp (Dan Flak) writes:

>Several things can happen when you are moving away from a cell
>site.

>Now, if the cell with the best read of your signal has all of its
>channels in use, the switch will tell it that it can't take the call
>because it's busy. 

Is the switch smart enough to look at OTHER users of the busy cell,
and try to move one of them to yet another cell? After all, those
other users may be at the other side of the cell, and/or headed
another direction.


wb8foz@mthvax.cs.miami.edu   (305) 255-RTFM   pob 570-335  33257-0335

rpw3%rigden.wpd@sgi.com (Rob Warnock) (07/25/90)

In article <9972@accuvax.nwu.edu> John Higdon <john@bovine.ati.com>
writes:

| Cliff Yamamoto <cyamamot%aludra.usc.edu@usc.edu> writes:
| > This may be a rumor, but I've heard that *all* cellular phones have
| > the capability to have their microphones/xmitters activated by the
| > switching office?

| Not true. When your unit is address by the system, a two way audio
| path is indeed enabled, but your transmitter is not turned on until
| you answer the call.

Uh, I think you have it backwards, John. Your transmitter turns on to
answer the broadcast poll on the setup channel [sent to *all* cells,
in order to find your phone], and you're switched to what will be the
talk channel, *before* the local ringer on the addressed phone starts
tweeting. It's the talk path (mic, earphone amplifier) that doesn't
open 'til you hit SND.

The "dead time" before the first ring you sometimes get when calling a
cellular number is the broadcast poll while the system's trying to
locate the mobile phone. (I have seen this time be as long as fifteen
seconds.) When you [the caller] finally hear the ringing tone, the
mobile has already got its transmitter on, tuned to the assigned talk
channel, and is also ringing.

I actually proved this to myself one day by setting my handheld near a
field-strength meter (el cheapo Radio Shack FSM, with a ~1/4-wave
piece of wire hanging out the top), and calling the handheld from a
landline.  The FSM went offscale *before* either the mobile phone
started ringing or I heard ringing tone the calling phone.

I have no idea whether there is any magic a cellular CO can do to
create an "infinity tap" without causing ringing. I would doubt it,
but, hey, bugs and Trojan horses *have* been known to exist in
software, no?  And cellular phones *are* controlled by the software in
the phone's local microprocessor.


Rob Warnock, MS-9U/510		rpw3@sgi.com		rpw3@pei.com
Silicon Graphics, Inc.		(415)335-1673		Protocol Engines, Inc.
2011 N. Shoreline Blvd.         Mountain View, CA  94039-7311

john@bovine.ati.com (John Higdon) (07/26/90)

Rob Warnock <rpw3%rigden.wpd@sgi.com> writes:

> | Not true. When your unit is address by the system, a two way audio
> | path is indeed enabled, but your transmitter is not turned on until
> | you answer the call.

> Uh, I think you have it backwards, John. Your transmitter turns on to

Sorry, it was the telephony in me that caused an ambiguity. What I
meant by "transmitter" was the mouthpiece in the phone. I am aware
that the RF transmitter comes on immediately when the mobile is paged,
and that is what I meant by "a two way audio path is indeed enabled".


        John Higdon         |   P. O. Box 7648   |   +1 408 723 1395
    john@bovine.ati.com     | San Jose, CA 95150 |       M o o !

Dave Levenson <dave%westmark@uunet.uu.net> (07/27/90)

In article <10094@accuvax.nwu.edu>, rpw3%rigden.wpd@sgi.com (Rob
Warnock) writes:

> I have no idea whether there is any magic a cellular CO can do to
> create an "infinity tap" without causing ringing. I would doubt it,
> but, hey, bugs and Trojan horses *have* been known to exist in
> software, no?  And cellular phones *are* controlled by the software in
> the phone's local microprocessor.

There appear to be tens or hundreds of companies manufacturing
cellular telephones.  A trojan horse of the type described could,
conceivably, be in one or two of them, but probably not in *all* since
they don't all contain the same code.


Dave Levenson			Voice: 908 647 0900  Fax: 908 647 6857
Westmark, Inc.			UUCP: {uunet | rutgers | att}!westmark!dave
Warren, NJ, USA			AT&T Mail: !westmark!dave

aiml@cs.strath.ac.uk (Alan I M Laird) (08/02/90)

>Uh, I think you have it backwards, John. Your transmitter turns on to
>answer the broadcast poll on the setup channel [sent to *all* cells,
>in order to find your phone], and you're switched to what will be the
>talk channel, *before* the local ringer on the addressed phone starts
>tweeting. It's the talk path (mic, earphone amplifier) that doesn't
>open 'til you hit SND.

This seems to be true from my experience as well. I often leave my
8500x sitting next to the television and shortly before it starts
ringing the television loses its picture and there is a loud hum
picked up directly on the speaker. Hi-fi speakers also pick up a hum.
Moving a few feet away restores the picture.

This allows me to display psychic abilities by starting to walk toward
the phone before it rings. Also if you happen to be looking at the
phone when this happens you will see it light up about half a second
before it rings.

Not long after I got the phone my mother had a lot of trouble getting
through to me. She would dial the number but then get cut off. What
happened at my end was that the phone lit up but didn't ring. When I
saw this happen I knew who was trying to call and could call her back.
I'm interested to hear if anyone else has had similar problems with
vodaphones in the UK. She still has occasional problems getting
through and one other person claims that it is almost impossible to
get me; everyone else has no problem. Could this be some sort of bug
in some BT exchanges ?


Alan I M Laird,               E-mail    : aiml@uk.ac.strath.cs
Dept of Computer Science,     Wireline  : 041 552 4400 x3081
University of Strathclyde,    Cellular  : 0836 320786
Glasgow G1 1XH, UK.           

John Gilmore <gnu@toad.com> (08/07/90)

rpw3%rigden.wpd@sgi.com (Rob Warnock) wrote:

> I have no idea whether there is any magic a cellular CO can do to
> create an "infinity tap" without causing ringing.

The US cellular telephone standard defines a way to "ping" a cellular
phone without making it ring.  The ping is transmitted like an
incoming call; the phone wakes up, transmits by radio to its local
cell, saying "I'm here", but does not ring.  In other words, your
phone responds to the cellular base station, without giving any
external indication (to you) that it is doing so.  I don't think the
standard specifies an audio path to the microphone/speaker during this
operation, but individual models might 'extend' the standard that way.

With this feature, the movements or current whereabouts of your phone
can be tracked at will by the cellular company.  Anytime the phone
will accept an incoming call, it will answer these pings.  And if The
Phone Company is any guide, the cellular companies will have chummy
relationships with cops of all stripes, finking on their paying
customers (without requiring warrants), to curry favor with
governments.  Not to mention helping out the occasional private
investigator who knows a friendly technician who...

Cellular base stations typically have a lot of directional antennas
fanning out in a circle, e.g. twelve antennas, each covering 30
degrees of arc from the base.  When your cellular phone transmits to
the base, it compares the reception on the various antennas to know
where you are in the cell (e.g. who to hand you off to as you get
fainter).  By comparing the reception in several base stations (an
operation they already do all the time, for handoffs), they can
probably pin your location down to within a few blocks.  Suppose three
cells can hear your phone (one strongly, two faintly).  This gives
them three pie-shaped areas, all spreading from base stations to you.
The intersection of these areas is likely to contain you.  This works
even with two bases, and can be made a lot more accurate using the
signal strength as well as the direction.  Even if only one cell can
hear you, the direction and strength give a pretty good guide to where
in the cell you are -- and they *know* your phone is in that cell as
opposed to being in Peoria.

If I ever get a cellular phone, this 'ping' will be one of the first
things I reprogram...

[I used to have a copy of the cellular standard document, "EIA IS-3",
but it's been a few years since I dug it out.  I got it for $32 plus
from Global Engineering Documents at +1 800 624 3974.  It may have
been revised since then ('87); they will check if you ask them.  I
recommend that anyone with a technical interest in cellular get it;
it's the real live protocol that runs over the radio.]

[What I have been calling a "ping" they have another name for, which I
forget.  Something like a "service check" or "maintenance request"...]

Cliff Yamamoto <cyamamot%aludra.usc.edu@usc.edu> (08/09/90)

In article <10573@accuvax.nwu.edu> gnu@toad.com (John Gilmore) writes:

>rpw3%rigden.wpd@sgi.com (Rob Warnock) wrote:

>> I have no idea whether there is any magic a cellular CO can do to
>> create an "infinity tap" without causing ringing.

>The US cellular telephone standard defines a way to "ping" a cellular
>phone without making it ring.  I don't think the
>standard specifies an audio path to the microphone/speaker during this
>operation, but individual models might 'extend' the standard that way.

As the originator of this thread, I guess the answer boils down to
"it depends on the model".

>[I used to have a copy of the cellular standard document, "EIA IS-3",
>but it's been a few years since I dug it out.  I got it for $32 plus
>from Global Engineering Documents at +1 800 624 3974.  It may have
>been revised since then ('87); they will check if you ask them.  I
>recommend that anyone with a technical interest in cellular get it;
>it's the real live protocol that runs over the radio.]

My thanks to John for passing on this info.  In my original posting, I
also wondered if there were some sort of defacto standard (i.e. EIA,
ANSI, IEEE).  Many have mentioned the Motorola book from William C. Y.
Lee, but not anything official.  Anyway, I just called and ordered my
copy from the above source.

   Doc #        cost    hndlng   UPS    CA tax   total
EIA/TIA-553    $52.75 + $5.00 + $5.00 + $3.93 = $66.68
Revised 9/89

Seems recent enough for me.  BTW, Global Engineering Documents is
located in Irvine, California so I'm sure anybody out east can call
till 4 P.M. PST/PDT.

Thanks to all who responded to my post.

Regards,

Cliff Yamamoto

dave%westmark@uunet.uu.net (Dave Levenson) (08/09/90)

In article <10573@accuvax.nwu.edu>, gnu@toad.com (John Gilmore) writes:

> The US cellular telephone standard defines a way to "ping" a cellular
> phone without making it ring.  The ping is transmitted like an

> With this feature, the movements or current whereabouts of your phone
> can be tracked at will by the cellular company.  Anytime the phone

> If I ever get a cellular phone, this 'ping' will be one of the first
> things I reprogram...

If you re-program this feature, you will probably be unable to receive
incoming calls when you're roaming.  (You already can't, in many
areas, but the feature is designed to allow it, and some day, it will
probably allow fully-automated transparent nationwide roaming, if
subscribers don't go and disable it!)


Dave Levenson			Voice: 908 647 0900  Fax: 908 647 6857
Westmark, Inc.			UUCP: {uunet | rutgers | att}!westmark!dave
Warren, NJ, USA			AT&T Mail: !westmark!dave