Make your own free website on Tripod.com

CELLULAR TELEPHONE SIGNALING FORMATS


The original author and copyright on this document is unknown but someone called the Condor from the outlaw Telecommandos supplied this information. It was then reposted by pdempsey@news.gate.net (Grateful Cheese) and tommy@f26.n340.z1.fidonet.org. The original name was DNA box5.

Modulation

SUPERVISORY AUDIO TONE (SAT)

A mobile phone must be able to recognize and retransmit any of the three audio frequencies used as SAT's. These tones (and their binary codes) are: (00) 5970 Hz (01) 6000 Hz (10) 6030 Hz The SAT is used during signaling, but not during data transmission. The binary codes are sent during data transmission to control which of the SAT tones a mobile phone will be using. Each cell site (or tower) uses only one of the three SATs. The mobile transmitter returns that same SAT to the tower. Tone recognition must take place within 250 milliseconds.

SIGNALING TONE (ST)

A 10 KHz tone is used for signaling by mobile phones during alert, handoff, certain service requests, and diconnect.

DATA TRANSMISSION

Cellular Phones use a data rate of 10 Kilobits per second, and must be accurate to within one bit per second. Frequency Modulation (FM) is used for both voice and data transmissions. Digital data is transmitted as an 8KHz frequency shift of the carrier. A binary one is transmited as a +8KHz shift and a binary zero as a -8KHz shift. NRZ (Non-Return to Zero) coding is used, which means that the carrier is not shifted back to it's center frequency between transmitted binary bits.

(RECC) Reverse Control Channel (mobile-to-tower on control channel)

RECC Message Format:


Seizure Precursor: Dotting (30 bits) 1010101010101010101010101010101 Word Sync (11 bits) 11100010010 DCC (7 bits) xxxxxxx Digital Color Code (DCC) Received Coded -------- ------- 00 0000000 01 0011111 10 1100011 11 1111100 Message: (from one to five words in length) First Word repeated 5 times (240 bits) Second Word repeated 5 times (240 bits) Third Word repeated 5 times (240 bits) Fourth Word repeated 5 times (240 bits) Fifth Word repeated 5 times (240 bits)
There are 4 types of RECC messages: Page Response Message Origination Message Order Confirmation Message Order Message These are composed of combinations of the following message words:

Abbreviated Address Word:

F (1bit) 1 (first word indicator) NAWC (3 bits) xxx (number of additional words to send) T (1 bit) x (0=response,1=origination/order) S (1 bit) x (1=serial number will be sent) E (1 bit) x (1=area will to be sent) (1 bit) 0 SCM (4 bits) xxxx (station class mark) MIN1 (24 bits) xxxxxxxxxxxxxxxxxxxxxxxxx (coded 7 digit phone number) P (12 bits) xxxxxxxxxxxx (Parity)

Extended Address Word:

F (1 bit) 0 NAWC (3 bits) xxx LOCAL (5 bits) xxxxx (local control - system specific) ORDQ (3 bits) xxx (order qualifier) ORDER (5 bits) xxxxx (order code) LT (1 bit) x (1=last try) (8 bits) 00000000 MIN2 (10 bits) xxxxxxxxxx (coded Area Code) P (12 bits) xxxxxxxxxxxx

Serial Number Word:

F (1 bit) 0 NAWC (3 bits) xxx SERIAL (32 bits) xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (serial number) P (12 bits) xxxxxxxxxxxx

First Word of Called Address:

[D1..D16 are the encoded digits] F (1 bit) 0 NAWC (3 bits) xxx D1 (4 bits) xxxx Table of Digit Codes: D2 (4 bits) xxxx ----------------------------- D3 (4 bits) xxxx 1 0001 7 0111 NULL 0000 D4 (4 bits) xxxx 2 0010 8 1000 D5 (4 bits) xxxx 3 0011 9 1001 D6 (4 bits) xxxx 4 0100 0 1010 D7 (4 bits) xxxx 5 0101 * 1011 D8 (4 bits) xxxx 6 0110 # 1100 P (12 bits) xxxxxxxxxxxx

Second Word of Called Address:

F (1 bit) 0 NAWC (3 bits) 000 D9 (4 bits) xxxx (encoded digits, see above table) D10 (4 bits) xxxx D11 (4 bits) xxxx D12 (4 bits) xxxx D13 (4 bits) xxxx D14 (4 bits) xxxx D15 (4 bits) xxxx D16 (4 bits) xxxx P (12 bits) xxxxxxxxxxxx

(RVC) Reverse Voice Channel (mobile-to-tower on voice channel)

RVC Message Format:


Dotting (101 bits) 101010101....101 Word Sync (11 bits) 11100010010 Repeat 1 Word 1 (48 bits) xxxxx ... xxxxx Dot (37 bits) 1010101010101010101010101010101 Word Sync (11 bits) 11100010010 Repeat 2 Word 1 (48 bits) xxxxx ... xxxxx . . . . [same pattern of repetition] . . Dot (37 bits) Word Sync (11 bits) Repeat 5 word 1 (48 bits) Dot (37 bits) Word Sync (11 bits) Repeat 1 Word 2 (48 bits) Dot (37 bits) Word Sync (11 bits) Repeat 2 Word 2 (48 bits) . . . . [same pattern of repetition] . . Dot (37 bits) 1010101010101010101010101010101 Word Sync (11 bits) 11100010010 Repeat 5 word 2 (48 bits) xxxxx ... xxxxx
There are two kinds of RVC messages: Order Confirmation Message Called Address Message ----------

Order Confirmation Message Word:

F (1 bit) 1 NAWC (2 bits) 00 T (1 bit) 1 LOCAL (5 bits) xxxxx ORDQ (3 bits) xxx ORDER (5 bits) xxxxx (19 bits) 0000000000000000000 P (12 bits) xxxxxxxxxxxx --------- ---------

Called Address Message, First Word:

F (1 bit) 1 NAWC (2 bits) 01 T (1 bit) 0 D1 (4 bits) xxxx D2 (4 bits) xxxx D3 (4 bits) xxxx D4 (4 bits) xxxx D5 (4 bits) xxxx D6 (4 bits) xxxx D7 (4 bits) xxxx D8 (4 bits) xxxx P (12 bits) xxxxxxxxxxxx

Called Address Message, Second Word:

F (1 bit) 1 NAWC (2 bits) 00 T (1 bit) 0 D9 (4 bits) xxxx D10 (4 bits) xxxx D11 (4 bits) xxxx D12 (4 bits) xxxx D13 (4 bits) xxxx D14 (4 bits) xxxx D15 (4 bits) xxxx D16 (4 bits) xxxx P (12 bits) xxxxxxxxxxxx --------

(FOCC) Forward Control Channel (tower-to-mobile on control channel)

FOCC Message Format:


Dotting (10 bits) b1010101010 Word Sync (11 bits) b11100010010 Repeat 1 word A (40 bits) bxxxxxxxxxxbxxxxxxxxxxbxxxxxxxxxxbxxxxxxxxxx Repeat 1 word B (40 bits) A Busy/Idle Bit (b) is inserted Repeat 2 word A (40 bits) at the beginning of Dotting and Repeat 2 word B (40 bits) Word Sync, and every 10 bits Repeat 3 word A (40 bits) during word repetitions beginning Repeat 3 word B (40 bits) at the start of the first word. Repeat 4 word A (40 bits) b=1 when the RCC is Idle. Repeat 4 word B (40 bits) b=0 when the RCC is Busy. Repeat 5 word A (40 bits) Repeat 5 word B (40 bits) bxxxxxxxxxxbxxxxxxxxxxbxxxxxxxxxxbxxxxxxxxxx Dotting (10 bits) b1010101010
There are three types of FOCC messages: Mobile Station Control Message Overhead Message Control-filler Message

Mobile Station Control Message: (one,two or four words)


Abbreviated Address Word:

TT (2 bits) 0x (00=if one word sent, 01=if multiple words sent) DCC (2 bits) xx Digital Color Code MIN1 (24 bits) xxxxxxxxxxxxxxxxxxxxxxxx P (12 bits) xxxxxxxxxxxx

Extended Address Word: (two versions of this word occur)

----------------------------- ----------------------------- TT (2 bits) 10 TT (2 bits) 10 SCC (2 bits) 11 SCC (2 bits) xx [not=11] MIN2 (10 bits) xxxxxxxxxx MIN2 (10 bits) xxxxxxxxxx (1 bit) 0 (1 bit) 0 LOCAL (5 bits) xxxxx VMAC (3 bits) xxx (attenuation code) ORDQ (3 bits) xxx CHAN (11 bits) xxxxxxxxxxx (channel number) ORDER (5 bits) xxxxx P (12 bits) xxxxxxxxxxxx P (12 bits) xxxxxxxxxxxx

First Directed-Retry Word:

TT (2 bits) 10 SCC (2 bits) 11 SAT Color Code CHANPOS (7 bits) xxxxxxx channel position relative to first access channel CHANPOS (7 bits) xxxxxxx CHANPOS (7 bits) xxxxxxx (3 bits) 000 P (12 bits) xxxxxxxxxxxx

Second Directed-Retry Word:

TT (2 bits) 10 SCC (2 bits) 11 CHANPOS (7 bits) xxxxxxx CHANPOS (7 bits) xxxxxxx CHANPOS (7 bits) xxxxxxx (3 bits) 000 P (12 bits) xxxxxxxxxxxx ------------------------------- -------------------------------

Overhead Messages:

System Parameter Overhead Message: Global Action Overhead Message: Registration Identification Message: Control-filler Message:

System Parameter Overhead Message:

System Parameter Word 1:

TT (2 bits) 11 DCC (2 bits) xx (3 bits) 000 NAWC (4 bits) xxxx OHD (3 bits) 110 (overhead message type) P (12 bits) xxxxxxxxxxxx

System Parameter Word 2:

TT (2 bits) 11 DCC (2 bits) xx S (1 bit) x (serial number flag) E (1 bit) x (extended address flag) REGH (1 bit) x (registration for home stations) REGR (1 bit) x (registration for roaming stations) DTX (1 bit) x (discontinuous transmission flag) (1 bit) 0 N-1 (5 bits) xxxxx (number of paging channels in system minus 1) RCF (1 bit) x (read-control-filler flag) CPA (1 bit) x (combined paging/access flag) CMAX-1 (1 bit) x (number of access channels in system minus 1) END (1 bit) x (1=last word of overhaed message train) OHD (3 bits) 111 P (12 bits) xxxxxxxxxxxx ------------------------------- -------------------------------

Global Action Overhead Messages:

Rescan Global Action Message:

TT (2 bit) 11 DCC (2 bits) xx ACT (4 bits) 0001 (16 bits) 0000000000000000 END (1 bit) x OHD (3 bits) 100 P (12 bits) xxxxxxxxxxxx

Registration Increment Global Action Message:

TT (2 bits) 11 DCC (2 bits) xx ACT (4 bits) 0010 REGINCR (12 bits) xx (registration increment) (4 bits) 0000 END (1 bits) xx OHD (3 bits) 100 P (12 bits) xx

New Access Channel Set Global Action Message:

TT (2 bits) 11 DCC (2 bits) xx ACT (4 bits) 0110 NEWACC (11 bits) xxxxxxxxxxx (new access channel starting point) (4 bits) 0000 END (1 bit) x OHD (3 bits) 100 P (12 bits) xxxxxxxxxxxx

Overload Control Global Action Message:

TT (2 bits) 11 DCC (2 bits) xx ACT (4 bits) 1000 OLCD0 (1 bit) x (overload class flags) OLCD2 (1 bit) x OLCD3 (1 bit) x OLCD4 (1 bit) x OLCD5 (1 bit) x OLCD6 (1 bit) x OLCD7 (1 bit) x OLCD8 (1 bit) x OLCD9 (1 bit) x OLCD10 (1 bit) x OLCD11 (1 bit) x OLCD12 (1 bit) x OLCD13 (1 bit) x OLCD14 (1 bit) x OLCD15 (1 bit) x END (1 bit) x OHD (3 bits) 100 P (12 bits) xxxxxxxxxxxx

Access Type Paramters Global Action Message:

TT (2 bits) 11 DCC (2 bits) xx ACT (4 bits) 1001 BIS (1 bit) x (busy/idle status flag) (15 bits) 000000000000000 END (1 bit) x OHD (3 bits) 100 P (12 bits) xxxxxxxxxxxx

Access Attempt Parameters Global Action Message:

TT (2 bits) 11 DCC (2 bits) xx ACT (4 bits) 1010 MAXBUSY-PGR (4 bits) xxxx (maximum busy occurrences, page response) MAXSZTR-PGR (4 bits) xxxx (maximum seizure tries, page response) MAXBUSY-OTHER (4 bits) xxxx (maximum busy occurrences, other accesses) MAXSZTR-OTHER (4 bits) xxxx (maximum seizure tries, other accesses) END (1 bits) x OHD (3 bits) 100 P (12 bits) xxxxxxxxxxxx

Local Control 1 Message:

TT (2 bits) 11 DCC (2 bits) x ACT (4 bits) 1110 LOCAL CONTROL (16 bits) xxxxxxxxxxxxxxxx (any local control code) END (1 bits) x OHD (3 bits) 100 P (12 bits) xxxxxxxxxxxx

Local Control 2 Message:

TT (2 bits) 11 DCC (2 bits) xx ACT (4 bits) 1111 LOCAL CONTROL (16 bits) xxxxxxxxxxxxxxxx END (1 bits) x OHD (3 bits) 100 P (12 bits) xxxxxxxxxxxx -------------------------------

Registration Identification Message:

TT (2 bits) 11 DCC (2 bits) xx REGID (20 bits) xxxxxxxxxxxxxxxxxxxx (registration ID) END (1 bit) x OHD (3 bits) 000 P (12 bits) xxxxxxxxxxxx

Control-Filler Message:

TT (2 bits) 11 DCC (2 bits) xx (6 bits) 010111 CMAC (3 bits) xxx (current mobile attenuation) (7 bits) 0011001 WFOM (1 bit) x (wait for overhead message) (4 bits) 1111 OHD (3 bits) 001 P (12 bits) xxxxxxxxxxxx

(FVC) Forward Voice Channel: (tower-to-mobile on voice channel)

FVC Message Format:

* BUSY/IDLE bits are inserted into FVC messages in a format similar to that of FOCC messages)
Dotting (101 bits) 101010101...101 Word Sync (11 bits) 11100010010 Repeat 1 Word (40 bits) xxxxx...xxxxx Dot (37 bits) 1010101010101010101010101010101 Word Sync (11 bits) 11100010010 Repeat 2 Word (40 bits) xxxxx...xxxxx Dot (37 bits) Word Sync (11 bits) Repeat 3 Word (40 bits) . . . . [same pattern of repetition] . . Dot (37 bits) 1010101010101010101010101010101 Word Sync (11 bits) 11100010010 Repeat 11 Word (40 bits) xxxxx...xxxxx
There is only kind of FVC message:

Mobile Station Control Message:

Mobile Station Control Word:

(two versions of this word occur) ----------------------------- ----------------------------- TT (2 bits) 10 TT (2 bits) 10 PSCC (2 bits) xx PSCC (2 bits) xx (present SAT code) (9 bits) 000000000 (9 bits) 000000000 LOCAL (5 bits) xxxxx VMAC (3 bits) xxx (attenuation code) ORDQ (3 bits) xxx CHAN (11 bits) xxxxxxxxxxx (channel number) ORDER (5 bits) xxxxx P (12 bits) xxxxxxxxxxxx P (12 bits) xxxxxxxxxxxx