AMPS Specifications

See Table 10.2 Blake for carrier A and Carrier B Cellular frequencies
Also Refer to Module 5 Course Pack for details
Since AMPS is passing away from the scene, it will not be discussed in full details
in this course. Only a brief summary will be given since all advance and modern
Cellular systems are based on AMPS.
AMPS stand for Advance Mobile Phone System. It was the first North
American Standard for Cellular Communications and still being used in some
rural areas where the carriers have not updated their Networks to modern
Protocols
Table below lists the major AMPS specs

BS Transmission band (Forward Channels)

869 to 894 MHz

25 MHz BW

Mobile Unit Transmission band (Reverse Channels) 824 to 849 MHz 25 MHz BW
Spacing between Forward and Reverse Channels

45 MHz

Channel Spacing

30 Khz

Number of FDX Voice Channels

790 (395 in each direction)

Number of FDX Control Channels

42 (21 in each direction)

Mobile Unit Maximum power

3W

Cell Size Radius

2 to 20 Km

Modulation, Control Channels

FM, 12 KHz peak deviation

Data Transmission Rate

FSK, 8KHz Peak deviation

Error Control Coding

10 Kbps

In N.A, AMPS uses 2-25 MHz BW, 869 to 894 for BS to Mobile and 824 to 849
for Mobile to BS Communications.
These are split into 2 bands to encourage competion between service providers.
Each Service Provider is allocated 12.5 MHz, for example, Bell Mobility (a
Wireline Provider has 12.5 and Rogers (A Wireless Provider) has 12.5 MHz.
Channels are spaced 30 KHz apart giving a total of ________ channels to each
provider in each direction
_____________ Channels are used to carry calls and _________ Channels are
used for control
Control channels are data channels operating at 10 Kbps
The Voice Channels use FM
The control information is also sent on voice channels, in bursts of data
Frequency Reuse factor of 7 is used to increase capacity with Sectoring and Cell
splitting.

Hyder Khoja

Page 1

4/16/2015

Operation of AMPS:

Each AMPS capable Cellular phone contains a Numeric Assignment Module

(NAM) in its read Only Memory (ROM)
Refer to the diagram shown on P111 of your Course pack (Draw the diagram on
P5 of your Notes.

The NAM contains the telephone number of Mobile (assigned by the service
provider) and the serial # of the phone (assigned by the manufacturer of the
phone). The Mobile phone # is also called MIN, the Mobile Identification
Number.
When the phone is turned ON, it transmits its serial number and phone number to
the MTSO (Mobile Telephone Switching Office)
MTSO is the control computer that connects a Wireless phone call to the PSTN.
The MTSO controls the entire system operation, including monitoring calls,
Switching, billing and handoffs
The MTSO also maintains a database with information about each valid registered
mobile phone numbers as well as mobile units that have been reported stolen, and
uses the serial number to block out stolen units
The MTSO uses the valid subscriber Phone numbers for billing purposes
If the phone is used in a remote city, the service is still billed to the users local
service provider.

Call Sequence in AMPS:

When a Call is placed, it is processed as follows
1. The user enters the telephone # of the called party and presses the SEND key
2. The MTSO receives the # and verifies that the # is valid and that the user is
authorized to place the call. Some service providers also require the user to enter a
PIN to TX and RX a call

Hyder Khoja

Page 2

4/16/2015

3. The MTSO sends a message to the mobile , indicating which traffic channel to use
for TX and RX
4. The MTSO sends a ringing signal to the called party. Steps 1 to 4 occur within 10
seconds of initiating a call.
5. When the called party answers, the MTSO creates a circuit between the calling
and called party and initiates billing information.
6. When one party hangs up, the MTSO releases the circuit, frees the radio channel
and completes the billing information.
AMPS Control Channels:

AMPS uses 21, 30 KHz channels in Forward (BS to Mobile) and 21 in Reverse
(Mobile to BS) directions
These channels transmit digital data using FSK
In both directions, data are transmitted in frames
Fig below shows Forward and Reverse frame structure. Draw fig in the space
provided. (draw fig on the board from your notes p6). Note: Module 5 course
Pack contains detailed specs. You should familiarize your selves with these specs.

Reverse Control Channel (RCC):

Bit Sync: 30 bits of alternating 1s and 0sfor bit synchronization
Word SYNC: 11100010010 = 0712Hex, for word synchronization
7 Bit Digital Color Code (DCC):A unique identifier of a BS used to distinguish
transmissions in co-channel cells, and acts as a destination address for a Reverse Control
Channel frame.

Hyder Khoja

Page 3

4/16/2015

Data Bits (W1, W2, W3 .Wn): Contains control information such as origination,
page response, confirmation etc. For reliability, each word is repeated 5 times
Forward Control Channel (FCC):
10 Bit of bit Sync as before
11 Bit Word Sync as before
Data words carry information such as busy, idle, frequency assignment etc. Again
messages are repeated to ensure reliability.
Control Information transmitted over voice channels:

The mobile unit or the BS can insert a FSK encoded data burst into the voice
channels by turning off the voice for about 100 ms
These messages are used to exchange urgent information such as change power
level or handoffs

Channel Allocation in AMPS:

The control channels are used to allocate voice channels to the Mobile
When a Mobile is turned ON, it scans the channels to find the strongest, which
would be obviously from the closest Cell site.
The Cell site then assigns a voice channel to the Mobile
While the conversation is in progress, the Cell site adjacent to the one in use
monitors the signal strength from the Mobile.
When the signal strength in one of the adjacent cell is greater then the one in use,
the system transfers the call to this new cell.
This transfer is called HANDOFF, and involves a change in frequency mobile is
using.
A similar procedure takes place for incoming calls.
A mobile periodically identifies itself to the system whenever it is turned ON.
Thus the System has a good idea of its current location
Paging Signals are sent out on control channels and the Mobile responds
The phone is instructed to ring, and once it is answered, the system assigns it a
voice channel
After that, the system follows the Mobile as it moves from one cell to the next

Example:
A vehicle travels through a Cellular System at 100 Km/h. Approximately, how often will
hand off occur if the cell radius is (a) 10 Km (b) 500m
Solution: Speed in meters/s = 100 Km/h 1000m/Km 3600 s/h = 27.8m/s
(a)

Time between handoffs for a radius of 10Km:

Hyder Khoja

Page 4

4/16/2015

Diameter of the Cell = 2 10Km = 20 Km

Time between handoffs t = d/v = 20 1000m/27.8m/s = 719 seconds, approximately
every 12 minutes
(b) Time between handoffs for a cell radius of 500 m. Calculate? Ans: every
36 seconds
AMPS Control System: Performs following functions

Keeps track of Mobile phones

Determines which phones have been turned on and their locations
Keeps track of telephone numbers for authentication and billing
Detects and prevents fraudulent use.
Sets up calls in both directions (from Cell to Mobile and vice versa)
Transfers calls from cell to cell as required
An advance Control system should also allow fax, email and internet surfing.

Voice and Control Channels: (ST-Signaling Tones and SAT Supervisory Audio
Tones): See P128 of the course Pack)
Voice channels are mostly used for voice transmission, however, sometimes
control signals are sent over the voice channels during conversation using either
(a) in-channel, out of band signaling (meaning tones above the voice frequency
range) or (b) BLANK and BURST signaling, during which voice signals are
muted for 100 ms
These signals are FSK with 8 KHz deviation (16KHz total shift), Manchester
encoded, at 10 Kbps rate
These control signals, sent during conversation are used for emergency messages
such as change power level or handoffs
Each message is sent 5 times with hamming Error correction code to minimize
errors
Other control signals are used for call set/termination and call control
One of the serious drawbacks of AMP is the total lack of security. There is no
encryption and all the data coding is publicly available.
Mobile and Base Identification:

Each Mobile has 2 unique Numbers.

The Mobile Identification Number (MIN) stored in the Number Assignment
Module (NAM)
The MIN is the 10 digit phone number of the Mobile, Area code + 7 digit local #,
stored as a 34 bit Binary number, assigned by the service provider
The NAM is a programmable memory module

Hyder Khoja

Page 5

4/16/2015

Usually a phone is registered with either service provider A or Service provider B

and has only one MIN.
It can operate on the other system (called Roaming) provided there is an
agreement between 2 systems
The 2nd Identification number is the factory assigned Electronic Serial Number
(ESN), which Identifies the manufacturer of the Mobile
This ESN is not supposed to be alterable by the customer without making the
phone inoperable. However, an expert technician with the right tools can
reprogram it.
The combination of the MIN and ESN is used by the Service Provider to bill the
right person and detect fraudulent use.
The Mobile also has a # called the Station Class mark (SCM), which identifies its
maximum power level as follows:
Class I

Mobile

+ 6 dBW (4 W)

Class II

Transportable

+2 dBW (1.6W)

Class III

Portable

-2 dBW (600mW)

The maximum power level is specified as ERP (Effective radiated Power)

Mobile transmitted Power is controlled by the BS in 4 dB increments, with the
lowest level being 22dbW (6.3mW)
The purpose is to reduce interference with the adjacent cells by using as little
power as possible.
The Cellular System itself also has an ID called System Identification Number
(SID) to enable the mobile to find out if it is communicating with its home system
or it is Roaming.
A Digital Color Code (DCC) is associated with each cell site to detect if cochannel interference. When a mobile detects a change in DCC without a change in
frequency it means co-channel Interference

Turning ON a Mobile Phone:

When a cell phone is turned ON, it identifies itself to the Network and scans all
the control channels for its designated system (A or B) and finds the strongest.
It also looks for the System ID (SID) to determine whether it is Roaming.
If it doesnt find this information in 3 Seconds, it tries the next strongest control
channel.
Once it receives the System information, it turns to the strongest paging channel
to look for any incoming calls. Paging channel carry the information about the
incoming calls to the Mobile.
Only the System transmits on the Forward channel (from the BS to the Mobile).
Any Mobile can transmit on the reverse channels.

Hyder Khoja

Page 6

4/16/2015

After checking that the Reverse channel is free, the Mobile now transmits its MIN
and ESN to the station to let the system know its identity, location and the
willingness to call someone.
If the Mobile loses the signal or moves to another cell, the whole procedure is
repeated again.
System also periodically polls the mobiles to see which are still ON and active.
In the IDLE condition, the Mobile continues to check the control channels from
the cell site at least every 46.3 ms to determine if the signal is still available, and
that it is from the same system and that there are no incoming calls.

Initiating a Call:

If the Mobile wants to place a call, it keys in a phone Number and presses SEND
on the Reverse channel. This message also includes the MIN and the ESN.
The Cell Site passes this information to MTSO
The MTSO checks its database for the validity and authorization of the calling
party using MIN and ESN, and if finds valid, authorizes the call.
The cell site than sends a message to the Mobile on the forward channel,
indicating which voice channel to use, DCC and CMAC (Control Module
Attenuation Code- which sets the power level to be used)
This power level can be changes by the BS as necessary during the call by means
of a control message on the forward channel by sending a data burst).
The cell site then sends a continuous sine wave called SAT (Supervisory Audio
Tone) on the voice channel to the Mobile to confirm correct connection. The
Mobile returns the SAT back to the Station to confirm the connection.
The SAT frequencies are above the voice band, 5970Hz, 6000Hz, and 6030Hz.
After this handshaking, the actual conversation begins.
During the call, SAT continues to be exchanged
The reception of wrong SAT by the BS indicates an interfering signal.
Interruption of the tone indicates lost connection or serious fading.
If the tone is not recovered within 5 seconds, the call is terminated.
A 10 KHz Signaling Tone (ST) is used to signal Handoffs to another cell site and
also for call termination.

Incoming Call processing:

An incoming call is routed by the MTSO to the cell where the Mobile last
identified itself.
If the called mobile is turned off, the call will fail and a recorded message will be
transmitted to the calling party.
If the called Mobile is ON, the BS will send the MIN on the paging channel along
with the voice channel to be used and the power level.
The called Mobile confirms this by sending its own ESN and NIN on the reverse
channel.

Hyder Khoja

Page 7

4/16/2015

This avoids fraudulent use.

The BS now sends this information again along with DCC and the Mobile
confirms on the reverse voice channel.
After this the SAT is exchanged on the voice channel as before and the
conversation begins.

Handoff Procedure:

The Network monitors the received power level from the mobile at adjacent cell
sites during a call.
If it detects that its strength is greater at an adjacent cell site than at the site it is
communicating with, it orders a Handoff from one cell site to the next.
Handoff always involve a change in channel frequency
As mentioned earlier, the current cell site uses the BLANK-and Burst signaling
on the voice channel to order Handoff. The 100ms interruption is hardly noticed
by the user.
Vice channel is used because during conversation, the Mobile is not monitoring
any control channel.
The Mobile is given a new channel #, a new power level and a new SAT
frequency.
The Mobile confirms this on the reverse channel and switches to new channel,
which connects the Mobile to the new cell site and the conversation continues.
There will probably an audible disturbance for a very short time while switching
is taking place and obviously we have learnt to tolerate this brief disturbance.

Security and Privacy in AMPS:

AMPS is not very secure and anybody can pickup the conversation using an FM
receiver ( since AMPS uses FM Modulation).
Thus the transmission of sensitive information such as credit card #, SIN # ,
health card # or any other information that we would like to protect from public
exposure is not very secure using AMPS.
Stolen Phone work only until the user has the service cancelled (or reports it to be
stolen)
There is a code to LOCK the phone, but most people dont bother, or they leave
the password at factory setting (1234)
We think that only the dealer can the change the password, however it can be
changed from the key pad if one knows the correct procedure.
Since there is no encryption, anybody can decode a 10 KHz FSK data stream and
retrieve MIN and ESN and clone a cell phone to emulate a valid phone number.
Unfortunately the calls made on a cloned phone will be billed to the original
subscriber.

Hyder Khoja

Page 8

4/16/2015

Service provider can detect something wrong, if network detects the same phone
trying to make connection at the same time from two different locations or 2 calls
in quick succession from two far away locations
Another common fraud is to use a cloned phone on another Network as a Roamer.
If the foreign Network is not capable of checking the phones Home Network in
real time, it may accept the call

Cellular Telephone Specs and Operation:

Fig shows a block diagram of a typical analog Cell phone. Fig 10.4P385B
Since the TXMTR and RCXVR operate simultaneously with a single Antenna, a
DUPLEXER is used to separate TX and RX frequencies, thats why TX and RX
frequencies are chosen to be 45 MHz apart
The Microprocessor and logic circuitry allows the phone to switch channels and
power levels remotely from the BS via Radio link
The Microprocessor memory is used to time calls, store passwords, unlock the
phone, store frequently called numbers etc
Table 10.3P385 B shows the TXMTR power levels. MAC refers to Mobile
Attenuation Code
Most portable cell phones use a quarter wave, monopole Antenna. At 800MHz,
the length of this antenna is about 9.5cms or about 4 inches

Cell Site Equipment:

Fig shows a typical Cellular Telephone System (Fig 10.8 P 389 B).
The combination of the Mobile and the Cell Site Radio Equipment is known as
the Air Interface.
Each cell has several Radio Transceivers called Base Stations, one per channel.
(i.e one Transmitter/Receiver /channel)
Usually one wideband power amplifier provides the TX power for all channels in
a site.
A device called BSC (Base Station Controller) controls the operation of the Radio
Equipment. It performs functions such as channel assignments, power levels,
transmitting signaling tones etc
The MTSO (Mobile Telephone Switching Office in AMPS terminology) or MSC
(Mobile Switching Center in GSM terminology) performs call routing over a
private copper, fiber or microwave network operated by the Cellular Service
provider.
MTSO also performs functions such as call authorization, billing, initiating
handoffs, preventing fraudulent use etc.
Sometimes BS and MSC are combined into one set of Equipment

Hyder Khoja

Page 9

4/16/2015

MTSO also contains the database where the locations of the local and Roaming
mobiles is stored.
MTSO also interfaces with the PSTN using SS#7 signaling to route calls to and
from the Public Switched telephone Network.

Block Diagram of a BS:

Fig 10.7 P388 B shows the block diagram of a BS Radio Equipment.

Fig shows only 2 Transceivers, but a cell site actually has as many Transceivers as
the # of channels it is serving.

Hyder Khoja

Page 10

4/16/2015